Re: [Full-Disclosure] Cronning Update Jobs <- really a bad idea in Portage

From: Tobias Weisserth (tobias_at_weisserth.de)
Date: 03/28/04

  • Next message: ~Kevin Davisł: "Re: [Full-Disclosure] Nessus stores credentials in plain text" 
    To: full-disclosure@lists.netsys.com
Date: Sun, 28 Mar 2004 22:58:20 +0200

    Hi there,

    Am So, den 28.03.2004 schrieb Nico Golde um 17:24:
    > Hallo Luke,
    >
    > * Luke Norman <luke@normanonline.co.uk> [2004-03-27 17:28]:
    > [...]
    > > My question is this - are there any security risks to adding this
    > > command to a cron job, and having it execute say, once every 12 hours.
    > > Any and all input appreciated
    >
    > is it a risk if you do it manually? see? ;-)
    > regards nico

    There's always the issue of integrity checking. Using automatic updates
    in conjunction with AIDE or Tripwire is pointless. It ruins the database
    and makes it very hard to spot unwanted changes each time an automatic
    update is done.

    One more problem are the compile times. Since Gentoo emerges everything
    (well most things, 99%) from source and compiles it this leaves your
    machine at random times (whenever the cron job runs) very vulnerable for
    denial of service issues since the CPU will be VERY busy compiling. If
    you don't know in advance which stuff it emerges (this could be much or
    nothing at all) this is a pretty risky thing. You might want to plan
    emerging bigger ebuilds opposed to just run a cron job to avoid unwanted
    down times due to compiler activity.

    Then there's the problem of configuration file swaps. Portage won't
    overwrite a config file but when the machine is rebooted or a service
    restarts the newer version of a service might expect the newer config
    file and stop working properly. You'll have to monitor configuration
    updates yourself so there's no point in handling updates automatically.

    Automatic updating in Gentoo on machines providing external services is
    also a stupid idea since Portage does a lot of version bumps and this
    will ruin a perfectly stable box most of the time. What if the newer
    version doesn't work in your setup but emerged without problems? If you
    don't monitor the automatic emerging activities regularly you won't even
    be able to tell with certainty what the cause for the problem is.

    I'd even go further. Running external services on a Gentoo box is
    probably not recommended at all. General security and bug handling
    hasn't reached a level acceptable for server use in my opinion yet. But
    opinions and risk willingness differ.

    regards,
    Tobias W. 

    -- 
***************************************************
   ____  _____
  |  _ \| ____| Tobias Weisserth
  | | | |  _|   tobias@weisserth.[de|com|net|org]
 _| |_| | |___  http://www.weisserth.org
(_)____/|_____|
                
Encrypted mail is welcome.
Key and fingerprint: http://imprint.weisserth.org
***************************************************

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: ~Kevin Davisł: "Re: [Full-Disclosure] Nessus stores credentials in plain text"

    Relevant Pages

    • Re: Dependency .CPP --> .OBJ broken
      ... .CPP files, but I included a .C file from another project for a variable ... If I modify a .CPP file, it compiles and links without a problem. ... If I modify the .C file, it APPEARS to compile and link, but the object ... link and again never updates the object. ...
      (microsoft.public.vstudio.general)
    • version compitabilites
      ... I have got the following message when running on the hosting machine. ... An error occurred during the processing of a configuration file ... Source Error: ... Can I compile my code that will be compatible to lower versions? ...
      (microsoft.public.vstudio.general)
    • Re: Community Starter Kit wont compile ASPNET.StarterKit.Communities.dll
      ... I'm definately using ASP 1.1 in VS 2003 for this one. ... ASPNET.Starterkit.Community.dll so I can actually fix this site. ... In 2.0 the compile model is different, ... do some basic updates. ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: FreeBSD Update is the binary update solution [Re: HEADS UP: Release schedule for 2006]
      ... >>configuration options we'll have to compile our own binaries. ... >>the work of tracking system updates currently requires us to build our own ... > additional features FreeBSD needs to satisfy you. ...
      (freebsd-stable)
    • Re: Up2date
      ... >>After trying all day to get my fresh install of fedora upgraded, ... >>finally locally downloaded all the updates. ... How do I configure up2date to go ...
      (Fedora)