Olaf Kirch wrote:
For the record, we were notified of this vulnerability on Monday afternoon (and I didn't learn that you have to go to 3.3 _and_ enable privilege separation until after I had built RPMs for all suse platforms :)
Speaking of all platforms - yeah, I know you didn't say versions :): The Suse-Advisory yesterday mentioned RPMs for 6.4 (which I am stuck with at the moment at least on two servers). I know about problems with older PAM-Versions and Kernel 2.2.x, but seeing that there are patches for 7.0 (which also seems to have 2.2.x, at least here), I'm wondering if I could go with these. Or did anyone have success with compiling OpenSSH on their own? Another question: What do I break if I use the RPMs for 7.0 on SuSE Mailserver II? It seems to require an update of openssl, which at least sslwrap uses, which seems to be needed for at least imaps. Any hints? Ralph