RE: [cobalt-developers] FW: Cobalt RaQ 3 security hole?

[Barry Titmarsh <barry@xxxxxxxxxxxxxx>]

At 09:52 21/07/00 -0700, you wrote:
> Now personally, I'm a security paranoid sort of person, so when I set up
> ftp.cobaltnet.com, I did things like disable POP and IMAP, install ssh, and
> disable the admin server... I shut down all services that were not being
> used.  I even disable the root password and use only RSA keypairs for
> access.
>
> My theory is thus:
>         - all software has risk of security holes.  Minimize the risk by 
> minimizing
> the services running.
>
> People are constantly finding exploits in all sorts of different code.  The
> risk with running Apache as root is a similar risk... run it as an
> unprivileged user, and the most access someone can gain with the Apache
> process is the access level the process is running at.


I use an out-bound access-list on my local cisco router that deny's all and 
permits the known IP address of the administrator to ports like ssh and the 
admin-web on port 81
all un-used ports are off and denied at the router, and I use ssh to get 
access.

So why dont cobalt ship it with ssh instead of telnet or as an option.? 
save us all installing it anyway.

that works for me.  Make a simple firewall.

Barry


> I figure that once you have a box configured, you don't use the web
> interface that often, so you should shut it down, and only turn it on when
> you need to modify something.
>
> The simple method I use to disable the admin server is to rename
> /etc/rc.d/init.d/admserv (I think that's the name) to another name so that
> activemonitor can't restart it, and then issue a
> "/etc/rc.d/init.d/renamed.admserv stop" or "/etc/rc.d/init.d/renamed.admserv
> start" when I want to turn it on or off.  ActiveMonitor complains a bit
> about this, but I ignore it.
>
> - Lyle
>
>
> _______________________________________________
> cobalt-developers mailing list
> cobalt-developers@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-developers


---------------------------------------------------------------------------------------------------------- 

Barry Titmarsh BMT1-RIPE           Nacamar Ltd (Sheringham Office)
                                                  Knole House 38 Cromer Rd
                                                  Sheringham Norfolk NR268RR
e-mail: barry@xxxxxxxxxxxxxx      voice: +44-1263-821-844
www: www.nacamar.net.uk
----------------------------------------------------------------------------------------------------------