Text 1811, 75 rader
Skriven 2004-12-19 12:05:00 av MARTIN ATKINS (1:123/140)
     Kommentar till en text av CHIP HEARN
Ärende: Mandrake 10.1
=====================
-=> CHIP HEARN wrote to MARTIN ATKINS <=-

CH>   Re: Mandrake 10.1
CH>   By: MARTIN ATKINS to BEN RITCHEY on Fri Dec 17 2004 10:07 am

> Prior to my present setup i had Mandrake 9.0, far more stable than 10.0.
> I've found with these RPM setups that upgrading can cause a lot of problems
> so i always go for a complete install but for some i imagine this would be a
> lot of aggravation. Just to satisfy my curiosity can i ask what applications
> you found incompatible with Mandrake 9.2?

CH> Dude, I would highly suggest you not do full installs.  An incident I
CH> encountered shows what a mistake that is.

Sorry. What i should have said is i do a fresh install. I'm glad you
pointed it out because i always recommend the minimal installation
to start off with and the build machine as required. As you point out
bellow this allows security matters to be addressed as you go along.
Also it is better for identifying any installation problems with
individual packages.

CH> I had hired a RH certified individual.  I had a job come up where the
CH> client wanted a Linux server to run a program called Medical Manager.
CH> Anyway, this so called RH Certified person was put on the task of
CH> building the machine.  

I can see trouble looming already. ;)

CH> It was stressed that it didn't need everything,
CH> as the server was going to have dumb terminals connected via serial.
CH> Anyway, things went on, the system was built, and installed.  A couple
CH> of months later, I get a frantic call from the client. They can't
CH> connect to their server.  The employee that set it up was at another
CH> client, so I went to see what was going on.  Now, understand, I'm not
CH> RH Certified, just a long time Linux user myself.  Anyway, I found that
CH> the box had been rooted.  Eventually, after a bunch of checking, and
CH> work, I was able to get enough info to figure out what had occured.
CH> Some Warez group had hacked into the machine, in the easiest way
CH> possible.  Turns out that my Employee, when he had built the RH box,
CH> had done a full install.  There was some stupid web interface thing
CH> that having not be configured, was still using the default username and
CH> password.  This web interface thing was a remote administrator access
CH> port.  Its installed when you do a full install.  Oh, instead of
CH> another one of my normal setups, the Employee had also changed the
CH> router, instead of opening the specific ports I specified, he had
CH> basically setup the server in a DMZ.  But the main portion, no one had
CH> gone through all the Installed programs and made sure they were either
CH> not running or diabled access, or changed the passwords.

This could be the culprit:-

Summary: An SSL web-based administration interface for Unix systems.

Description: A web-based administration interface for Unix systems. Using
Webmin you can configure DNS, Samba, NFS, local/remote filesystems, Apache,
Sendmail/Postfix, and more using your web browser.

After installation, enter the URL https://localhost:10000/ into your browser
and login as root with your root password. Please consider logging in and
modify your password for security issue.

PLEASE NOTE THAT THIS VERSION NOW USES SECURE WEB TRANSACTIONS: YOU HAVE TO
LOGIN TO "https://localhost:10000/" AND NOT "http://localhost:10000/".

CH> Anyway, I'd be very careful about your system.  You have no idea what
CH> all was installed.  Very dangerous.

Fortunately i only run a small home network. All remote machines are
isolated before i use the internet so if my main server came under attack
it would only be something that would spur my interest in better security.

L8r. ;)
 
--- MultiMail/Linux v0.46
 * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)