Security Drama Queens

Quicksearch

Disclaimer

The individual owning this blog works for Oracle in Germany. The opinions expressed here are his own, are not necessarily reviewed in advance by anyone but the individual author, and neither Oracle nor any other party necessarily agrees with them.

Navigation

< Future of NFS | links for 2008-03-29 >

Friday, March 28. 2008

Okay, at the first moment i was really in fear that we have installed OS images with a nasty new security vulnerability or we installed a solaris version with the infamous telnet bug, when i´ve read this Sun confirms it shipped vulnerable servers. Okay, then searching for the SunAlertSome Sun SPARC Enterprise T5120 and T5220 Servers Shipped With an Incorrect Solaris 10 Image Containing an Insecure Configuration. Drama queens ... just a little experience from the field: We delivered a system in a configuration that many systems gets within 10 minutes after booting anyway .. with activated remote root login

Well, believe it or not ... there are customers still using telnet. The day when the last admin understands that telnet or remote direct root login are bad ideas will be the same day i´m out for figure skating in hell ...

PS: Nevertheless, something like that should not happen ....

Posted by Joerg Moellenkamp in English, Solaris at 19:59 | Comments (8) | Trackbacks (0)

Defined tags for this entry: security

, solaris

, sun

Related entries by tags:

View as PDF: This entry | This month | Full blog

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

That why OpenBSD comes with telnetd and rsh defaults to ssh. Sun instead distributes its own "version" of OpenSSH but doesn't support the developers.

#1 Martin (Homepage) on 2008-03-29 00:31 (Reply)

We need our own modified version because of BSM.

We can´t make this hard cut like OpenBSD because of the Binary Compatibility Guarantee.

#1.1 Joerg+M. (Homepage) on 2008-03-29 06:21 (Reply)

Mmhhh...shit happens. As long as the customer have a proper security management they won't get in trouble. They should have there own policies to setup and operate a server.

How long will it take until SUN delivers a fixed image?

#2 Patrick (Homepage) on 2008-03-29 11:19 (Reply)

They wouldn´t even get in trouble without a proper security policy ....

#2.1 Joerg+M. (Homepage) on 2008-03-29 13:14 (Reply)

Do you know any customer with a proper security policy?? I know only two excesses: Nothing or paranoid.

#2.1.1 Patrick (Homepage) on 2008-03-29 17:01 (Reply)

There is a third kind: Paranoid, but downright bullshit because of false assumptions when assessing the thread scenario.

#2.1.1.1 Joerg+M. (Homepage) on 2008-03-29 17:46 (Reply)

It takes to much work to bring the pre-installed Solaris in a usable state so it makes me wonder that anyone is using it. Configuring and running JET takes just a few minutes...

#3 Joern (Homepage) on 2008-03-29 11:28 (Reply)

Besides of this it´s a good practice to use the Solaris Security Toolkit after installing a system (or using it in conjunction with JET)

#3.1 Joerg+M. (Homepage) on 2008-03-29 13:18 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	E-Mail addresses will not be displayed and will only be used for E-Mail notifications. To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above: Standard emoticons like :-) and ;-) are converted to images. Enclosing asterisks marks text as bold (word), underscore are made via _word_.
	Remember Information? Subscribe to this entry