*** Reply to message from "Carlos E. R."
I don't know if it applies to you, but there is a new patch today:
| SUSE Security Announcement | | Package: apache2 | Announcement-ID: SUSE-SA:2004:032 | Date: Wednesday, Sep 15th 2004 16:00 MEST | Affected products: 8.1, 8.2, 9.0, 9.1 SUSE Linux Enterprise Server 9 | Vulnerability Type: remote denial-of-service | Severity (1-10): 5 | SUSE default package: no | Cross References: CAN-2004-0747 | CAN-2004-0786
etc. I've been wondering guys just how much baby sitting do you wind up doing when you run your own web servers? Think small company , nothing larger than a one doc office, or something smaller, lawyer or ??? other single proffessional who might like to have the control over thier own website. No one can suddenly jack up prices or take their sweet time updating etc. I would think, tho I truely don't know as I usually suggest small offices farm out such things where someone else has staff around because they are hosting more than one site.. and one assumes, tho it's not always true, I'm sure, that *someone* is paying attention to things like the logs and apparent scans and attacks, at least since the first Red Worm they should be... But I often, as I suspect others do , hear that it would cost much less to "do it myslef".I usualy hear this from someone who has a friend w/ a windows setup who telsl them it's a piece of cake and all the scare stories just don't ever seem to appear.) Mind you this friend has a box full of trojans and worms of which they are blissfully unaware, and never ever looks at a log file ( What's a log? And why would I bother to read it? It's long and dull and doesn't make sense.) I try to explain that an ill created "web server" which, it seems they often wish to run on the same servers as thier file server or billing server or other box that if it's breached, would give an attacker some valuable info. But, THE one thing that would clinch it would be if I could actually give some sort of time management information. How much time someone would really nead to spend, reading those logs, making certain no one is visiting thier location w/ nefarious designs upon their network... etc. In other words, if you can't afford a full time designated IT individual, don't do it in house. Am I right? OR is it time I spent a month or two investigating web servers and thier setup ( which still should be isolated from the rest of the company computers, no matter who baby sits them.! I've seen too many ways for folks to get into a server that has one or more empty passwords, and w/ a bit more effort, they manage to breach the inner lan. At the least it needs to sit outside the firewall, but that seems to be something that is also difficult to grasp for these guys. Many have read or heard that Linux boxen are safer for web stuff and as firewalls At last , we get some good info trickling down to the new users or the ones who think they know a lot about computers because they can install windows or even have managed a dual boot w/ some version of linux. TIA, -- j -- nemo me impune lacessit