Quicksearch
Navigation
Events
Trusted Ad
Blower Door Test
Luftdichtigkeitsmessung für Gebäude Raum Hamburg ab 160 € excl. MwSt
www.m-tectum.de
Luftdichtigkeitsmessung für Gebäude Raum Hamburg ab 160 € excl. MwSt
www.m-tectum.de
Kategorien
About this blog- Apple
- iPhone
- Aviation
- Bahn
- Begriffe des Lebens
- Blogosphere
- Braindump
- Business Travel
- CANBOX
- CeBIT
- CEC
- Computing
- del.icio.us
- Fundsache
- General
- i hate sundays
- Kochen
- Mindfuck
- Movies
- Music
- On Benchmarketing
- Persoenliches Pech
- Photographie
- policy of ...
- Privacy
- Recommended Blogs
- Security
- Solaris
- Strange Days
- Sun
- suncec2007
- suncec2008
- Technology
- The IT Business
- Toolbox
- Travel
- Work
Security Drama Queens
Friday, March 28. 2008
Okay, at the first moment i was really in fear that we have installed OS images with a nasty new security vulnerability or we installed a solaris version with the infamous telnet bug, when i´ve read this Sun confirms it shipped vulnerable servers. Okay, then searching for the SunAlertSome Sun SPARC Enterprise T5120 and T5220 Servers Shipped With an Incorrect Solaris 10 Image Containing an Insecure Configuration. Drama queens ... just a little experience from the field: We delivered a system in a configuration that many systems gets within 10 minutes after booting anyway .. with activated remote root login 
Well, believe it or not ... there are customers still using telnet. The day when the last admin understands that telnet or remote direct root login are bad ideas will be the same day i´m out for figure skating in hell ...
PS: Nevertheless, something like that should not happen ....
Well, believe it or not ... there are customers still using telnet. The day when the last admin understands that telnet or remote direct root login are bad ideas will be the same day i´m out for figure skating in hell ... PS: Nevertheless, something like that should not happen ....
Posted by Joerg Moellenkamp
in Solaris
at
19:59
| Comments (8)
| Trackbacks (0)
View as PDF: This entry | This month | Full blog
View as PDF: This entry | This month | Full blog
Trackbacks
Trackback specific URI for this entry
No Trackbacks
Comments
Display comments as
(Linear | Threaded)
That why OpenBSD comes with telnetd and rsh defaults to ssh. Sun instead distributes its own "version" of OpenSSH but doesn't support the developers.
We need our own modified version because of BSM.
We can´t make this hard cut like OpenBSD because of the Binary Compatibility Guarantee.
We can´t make this hard cut like OpenBSD because of the Binary Compatibility Guarantee.
Mmhhh...shit happens. As long as the customer have a proper security management they won't get in trouble. They should have there own policies to setup and operate a server.
How long will it take until SUN delivers a fixed image?
How long will it take until SUN delivers a fixed image?
They wouldn´t even get in trouble without a proper security policy ....
Do you know any customer with a proper security policy?? I know only two excesses: Nothing or paranoid.
There is a third kind: Paranoid, but downright bullshit because of false assumptions when assessing the thread scenario.
It takes to much work to bring the pre-installed Solaris in a usable state so it makes me wonder that anyone is using it. Configuring and running JET takes just a few minutes...
Besides of this it´s a good practice to use the Solaris Security Toolkit after installing a system (or using it in conjunction with JET)
The LKSF book
The book with the consolidated Less known Solaris Tutorials is available for download here
Web 2.0
Contact
Networking
open.bc
LinkedIn
Facebook
My photos
- mail: joerg@c0t0d0s0.org
- icq: 144000169
- Me, myself and I
- openBC
- My del.icio.us
- c0t0d0s0@twitter
- c0t0d0s0@last.fm
- wiki@c0t0d0s0
- Amazon Wishlist
Networking
open.bc
My photos
Syndication
Comments
about Leaked Airbus "787 lessons learned" presentation
Thu, 04.12.2008 22:09
Funny .. i guess another lesso ns learnt case would be: Do not circulate too much confid ential information among [...]
Thu, 04.12.2008 22:09
Funny .. i guess another lesso ns learnt case would be: Do not circulate too much confid ential information among [...]
about Overpopulated
Thu, 04.12.2008 17:36
Oh yeah, try being on a dual q uad core and running MenuMeter s, just the CPUs alone take up a lot of space. Can [...]
Thu, 04.12.2008 17:36
Oh yeah, try being on a dual q uad core and running MenuMeter s, just the CPUs alone take up a lot of space. Can [...]
about Deutschsprachiger Anwenderbericht zu Opensolaris 2008.11
Thu, 04.12.2008 15:41
Jo ... einige Dinge sind nicht ganz korrekt ... aber im gros sen und ganzen finde ich den T ext gut
Thu, 04.12.2008 15:41
Jo ... einige Dinge sind nicht ganz korrekt ... aber im gros sen und ganzen finde ich den T ext gut
about Deutschsprachiger Anwenderbericht zu Opensolaris 2008.11
Thu, 04.12.2008 15:17
"Ab Version 2008.11 kann man a uch von ZFS booten." na das ging aber auch schon mit 2008 .05...
Thu, 04.12.2008 15:17
"Ab Version 2008.11 kann man a uch von ZFS booten." na das ging aber auch schon mit 2008 .05...
about Guided tour through new features in Opensolaris 2008.11
Thu, 04.12.2008 12:56
wow - it really comes along ni cely! with the easier linux-le gibility this could make some inroads. what I am missi [...]
Thu, 04.12.2008 12:56
wow - it really comes along ni cely! with the easier linux-le gibility this could make some inroads. what I am missi [...]
Getaggte Artikel
AMD Apple avs Bahn Blogging Blogosphere braindump Business Travel CeBIT cec cec2006 CMT del.icio.us deutsch dtrace fliegen Fundsache General Hamburg IBM i hate sundays Intel iscsi jumpstart Links Linux lksf Mindfuck Movies Music Musik Niagara Opensolaris Opteron Photographie policy of ... Politik Security Solaris storage Sun suncec2007 sunw t1 The IT Business Ultrasparc ultrasparc t1 Wirtschaft Work ZFS
Blog Administration
Buttons
