On Sat, 27 Oct 2001, Steffen Dettmer wrote:

...

login as root with no password, reset root password.

This would offer a small window for attacker/scanners which could install a backdoor on networked systems. Don't do that except at home :)

I agree you must be careful, but with the right option to lilo you can boot into runlevel 1. Am I right in thinking that all network connections, and all ttys and gettys except the local console, will be down? I think this means you are ok. On Sat, 27 Oct 2001, Kurt Seifried wrote:

for a cdrom drive for most headless servers =). Another alternative is to boot from floppy and use rescue via network.

There are still rescue systems that run entirely from floppy -- aren't there any suitable floppy images on the latest distributions? I have a floppy of tomsrtbt in case the SuSE boot floopy isn't enough. dproc

Hi, On Monday 29 October 2001 11:10, you wrote:

...

No. /bin/sh is not really optional on any install (that I've ever seen). If it is that vendor would be seriously breaking with tradition, there is a very good reason for a small statically linked shell. In most cases now it is linked to bash (i.e. literally a symlink) which is unfortunate because bash is often nolonger compiled statically, meaning if you lose one critical library you are really up the creek. Still it's more reliable then hoping for a cdrom drive for most headless servers =). Another alternative is to boot from floppy and use rescue via network.

We know of the old tradition of statically linking /bin/sh, we would like to have it, but it doesn't work that way. With modern glibc systems, static linking is not supported any more, mostly because of the language/localization support.

If it was all that easy, we'd have it there.

You have it (almost). How about /bin/sash? I think it's in the default SuSE installation. Usually sufficient for recovery purposes.

...

Kurt Seifried, kurt@seifried.org

Thanks, Roman.

Regards, Martin -- Martin Leweling Institut fuer Planetologie, WWU Muenster Wilhelm-Klemm-Str. 10, 48149 Muenster, Germany

I think it is more important to have a small statically linked shell available for emergencies -- AND shells for daily use that have multi-language support -- than to remove something essential because it doesn't have multi-language support. This is even a security issue, in some cases. Dynamically linked shells are vulnerable to shared-object spoofs. Bear

My boxed Suse 7.3pro just walked in the door, and I am contemplating fireing up yast and doing the Update Existing installation routine to replace the 7.1 install currently on the machine.

Since I have not done this with Suse before, I'm a little worried. Yes I'll take a backup, but what I really want to know from Suse Sourdoughs (Alaskan for Veterans), is wether this is a good idea or does it munge things more often than not?

(Another of the never ending data SECURITY questions).

Upgrade from an older distribution should work, especially if it is 7.1 and newer (think of the init script changes from 7.0 to 7.1: /sbin/init.d -> /etc/init.d). Watch the output of the rpm commands during the installation to see if something goes wrong. Configuration files should not get touched. If the old system is a 7.0 or older, manual help is needed in the case where you have added init scripts by yourself. This could turn out to be a bit messy, to be honest. But it works. Roman. -- - - | Roman Drahtmüller // "You don't need eyes to see, | SuSE GmbH - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -

* Ray Dillinger wrote on Thu, Nov 01, 2001 at 07:40 -0800:

I think it is more important to have a small statically linked shell available for emergencies

sash is excactly that. Additionally, it has a lot of built-in features, even mount can be used (without /bin/mount). So you can remount even a root partition under some circumstances.

This is even a security issue, in some cases. Dynamically linked shells are vulnerable to shared-object spoofs.

Well, you're right, but I feel this thread is more about data safeness that security in the sense of this list :) oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.