lkml.org 
[lkml]   [2000]   [Jan]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: why I run no-exec-stack patch
In <Pine.LNX.4.10.10001051405220.6778-100000@server.ylenurme.ee> Elmer Joandi (elmer@ylenurme.ee) wrote:


>> * From: don@sabotage.org

>> I'm not close to talking about letting a box sit around unpatched for months
>> like too many do.

> I would do that.

> Here was a box, which was set up 2 years ago, with non-exec-stack patch
> and all suids removed. RH4.2 I think. It took me about 2 weeks to set it
> up and test (basically, it took that time to make RedHat secure)
> And it was running about 1.5 years(till we wanted to upgrade it on other
> reasons) the way that all bugtraq root exploits
> were going by. Half of it thanks to RH suid bits sent to hell, the other
> half thanks to that patch.
> it was login,X,http,nfs,imap,ssh,lpd server.

> I just cant estimate the workhours that patch has been saving for us(2
> weeks ?) on 5 servers.

This is EXACTLY why you do not need this patch in mainstream. I guess IMAP
was enough to break in your system but no crackers skilled enough to work
around no-exec patch tryed to break in. Wonder why ? EXACTLY since this
patch is not in mainstream kernel and easily foundable exploits do not have
work around for non-exec-stack patch (workaround for daemon like IMAP is
pretty simple as Theodore Y. Ts'o pointed out).




-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [W:0.309 / U:2.720 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site