Mailinglist Archive: opensuse-security (601 mails)

< Previous Next >
Re: [suse-security] SuSE security reputation, etc..
  • From: Roman Drahtmueller <draht@xxxxxxx>
  • Date: Fri, 4 Aug 2000 15:40:52 +0200 (MEST)
  • Message-id: <Pine.LNX.4.21.0008041533340.2133-100000@xxxxxxxxxxxx>
Simon,

First off, most important, the beta-package that you have downloaded, adds
the following lines to your /etc/rc.config:


#
# allow execution of autorpm via cron (cron.daily)
#
START_AUTORPM_CRON="yes"

Soon after installation, change the "yes" to "no". This must have been an
accident to enable this in a beta package...

It is a comforting coincidence that the dependencies don't match. :-|



>
> I checked the dependencies, and discovered that I don't have perl_net
> installed - nor can I find that package on the distribution CDs or on any
> SuSE site.
>

This is correct. perl_net is a split-off from the original perl
package. Starting with SuSE-7.0, it will be seperate.

In this case (6.4 or such), you can safely ignore it using the "--nodeps"
rpm option. Use "--force", too, if it won't stop bitching around. Deletion
of the package using "-e" should be safe (but the rc.config thing won't be
erased!).


> Besides, I have to admit that enabling this feature on a production server
> seems somewhat scaring to me (especially since site-hijacking and other DNS
> troubles are not so uncommon in these days...).

The security issues will hopefully be resolved with package signing. What
also bothers me is that there is still no conclusive solution wrt the
question if the package will really still work after the update (packages
such as apache, wuftpd, ...).


> I'd probably try it for a while on a user's workstation.

As do we! :-)

Thanks for your efforts!
Roman Drahtmüller.
--
- -
| Roman Drahtmüller <draht@xxxxxxx> "Caution: Cape does not |
SuSE GmbH - Security enable user to fly."
| Nürnberg, Germany (Batman Costume warning label) |
- -


< Previous Next >
References