Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.os.linux.debian > #7494 > unrolled thread

Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)?

Back to article view | Back to alt.os.linux.debian

Contents

  Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)? ANTant@zimage.com (Ant) - 2015-12-19 13:34 -0600
    Re: Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)? J G Miller <miller@yoyo.ORG> - 2015-12-19 22:40 +0000
      Re: Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)? ANTant@zimage.com (Ant) - 2015-12-19 20:00 -0600
        Re: Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)? Mark Carroll <mtbc@ixod.org> - 2015-12-20 10:22 +0000
    Re: Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)? yamo' <yamo@beurdin.invalid> - 2015-12-20 10:06 +0100
      Re: Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)? ANTant@zimage.com (Ant) - 2015-12-21 00:20 -0600
        Re: Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)? yamo' <yamo@beurdin.invalid> - 2015-12-21 10:20 +0100
          Re: Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)? ANTant@zimage.com (Ant) - 2015-12-21 21:49 -0600
            Re: Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)? J G Miller <miller@yoyo.ORG> - 2015-12-22 16:35 +0000
              Re: Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)? ANTant@zimage.com (Ant) - 2015-12-22 14:35 -0600
                Re: Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)? J G Miller <miller@yoyo.ORG> - 2015-12-22 23:56 +0000
                  Re: Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)? ANTant@zimage.com (Ant) - 2015-12-23 19:44 -0600
                    Re: Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)? J G Miller <miller@yoyo.ORG> - 2015-12-24 12:58 +0000
    Re: Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)? Solbu <solbu@solbu.net> - 2015-12-28 16:10 +0100
      Re: Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)? ANTant@zimage.com (Ant) - 2015-12-29 01:51 -0600

#7494 — Anything I should worry about before upgrading my Debian oldstable (Wheezy) to stable (Jessie)?

Hi.

With my almost 1.5 weeks Christmas 2015 break coming up, I think it is 
time to finally upgrade (not a clean install?) my old Debian oldstable 
to stable (Wheezy) in case anything goes wrong (am pretty sure something 
will break) with the free time I will have. It is just a basic 
desktop/workstation/server/backup machine.

From https://www.debian.org/releases/stable/amd64/release-notes/ and 
other sources, I read that some packages will be removed, like 
DenyHosts, so I will have to find a replacement. Also, I am not sure if 
I have enough free disk space for Kernels and stuff. This is what I have 
currently on my tiny 115 GB SSD (you can see the rest of my secondary 
computer (specification/detail)s in 
http://zimage.com/~ant/antfarm/about/MyComputerStuff.txt ). Systemd 
seems to be a big change for upgrades due to being new and changing a 
lot of things. :(

$ df
Filesystem                                             1K-blocks      Used Available Use% Mounted on
rootfs                                                    960504    591852    319860  65% /
udev                                                       10240         0     10240   0% /dev
tmpfs                                                     206052      2120    203932   2% /run
/dev/disk/by-uuid/242d81f2-8a0d-48e1-a144-22ab4d2b9407    960504    591852    319860  65% /
tmpfs                                                       5120         8      5112   1% /run/lock
tmpfs                                                    1193200        80   1193120   1% /run/shm
/dev/sda9                                               50013916   2699516  44773808   6% /home
/dev/sda5                                                 960504     17672    894040   2% /tmp
/dev/sda8                                               49982172   6720980  40722184  15% /usr
/dev/sda6                                                4804736   1881892   2678776  42% /var
...

http://pastebin.com/raw/C0JnbFay for my current long "dpkg -l" listing.

Oldstable's apt:
$ cat /etc/apt/sources.list
#############################################################
################### OFFICIAL DEBIAN REPOS ###################
#############################################################

#deb http://ftp.us.debian.org/debian/ stable main contrib non-free
deb http://ftp.us.debian.org/debian wheezy main contrib non-free
deb http://ftp.debian.org/debian/ wheezy-updates main contrib non-free
deb http://ftp.us.debian.org/debian/ wheezy-proposed-updates main 
contrib non-free
#deb http://mirrors.kernel.org/debian wheezy-updates main contrib
deb http://security.debian.org/ wheezy/updates main contrib non-free

# Debian Backports - http://backports.debian.org/
deb http://ftp.debian.org/debian/ wheezy-backports main contrib non-free
#deb http://mirrors.kernel.org/debian wheezy-backports main contrib 
non-free

#Iceweasel (aka Firefox)
deb http://mozilla.debian.net/ wheezy-backports iceweasel-release

#Google
deb http://dl.google.com/linux/chrome/deb/ stable main
deb http://dl.google.com/linux/earth/deb/ stable main

# Debian Multimedia
deb http://www.deb-multimedia.org oldstable main
deb ftp://ftp.deb-multimedia.org oldstable-backports main
deb http://www.deb-multimedia.org wheezy main non-free
deb http://www.deb-multimedia.org wheezy-backports main

I assume when I go to stable/Jessie, I will just rename all wheezy to 
jessie and oldstable to stable? Am I correct?

Thank you in advance. :)
-- 
Merry Christmas/Season's Greetings/:) Holidays & May The Force Be With U!
Note: A fixed width font (Courier, Monospace, etc.) is required to see this signature correctly.
  /\___/\   Ant(Dude) @ http://antfarm.home.dhs.org (Personal Web Site)
 / /\ /\ \                 Ant's Quality Foraged Links: http://aqfl.net
| |o   o| |
   \ _ /    Please nuke ANT if replying by e-mail privately. If credit-
    ( )     ing, then please kindly use Ant nickname and AQFL URL/link.

[toc] | [next] | [standalone]

#7495

On Saturday, December 19th, 2015, at 13:34:41h -0600, Ant pondered:

> With my almost 1.5 weeks Christmas 2015 break coming up, I think it is 
> time to finally upgrade (not a clean install?) my old Debian oldstable 
> to stable (Wheezy) 

Just a suggestion -- it probably would take you less time to just
do a clean install of Debian Jessie from scratch after archiving
your system, rather than doing an upgrade to Wheezy and then an
upgrade to Jessie.

And you do not have to use full systemd on Jessie, but stay with
SysVInit as provided by systemd-sysv (which is what I am using
on two Jessie systems -- Debian 8.2).

[toc] | [prev] | [next] | [standalone]

#7496

In alt.os.linux.debian J G Miller <miller@yoyo.org> wrote:
> On Saturday, December 19th, 2015, at 13:34:41h -0600, Ant pondered:

> > With my almost 1.5 weeks Christmas 2015 break coming up, I think it is 
> > time to finally upgrade (not a clean install?) my old Debian oldstable 
> > to stable (Wheezy) 

> Just a suggestion -- it probably would take you less time to just
> do a clean install of Debian Jessie from scratch after archiving
> your system, rather than doing an upgrade to Wheezy and then an
> upgrade to Jessie.

Oops. I messed up in my body text. I meant to say "With my almost 1.5 
weeks Christmas 2015 break coming up, I think it is time to finally 
upgrade (not a clean install?) my old Debian oldstable (Wheezy) to 
stable (Jessie) ..." I am already at oldstable/Wheezy.


> And you do not have to use full systemd on Jessie, but stay with
> SysVInit as provided by systemd-sysv (which is what I am using
> on two Jessie systems -- Debian 8.2).

Oh. I thought Debian stable was forcing everyone off SysVInit to SystemD 
like other Linux OSes. :/
-- 
Merry Christmas/Season's Greetings/:) Holidays & May The Force Be With U!
Note: A fixed width font (Courier, Monospace, etc.) is required to see this signature correctly.
  /\___/\   Ant(Dude) @ http://antfarm.home.dhs.org (Personal Web Site)
 / /\ /\ \                 Ant's Quality Foraged Links: http://aqfl.net
| |o   o| |
   \ _ /    Please nuke ANT if replying by e-mail privately. If credit-
    ( )     ing, then please kindly use Ant nickname and AQFL URL/link.

[toc] | [prev] | [next] | [standalone]

#7498

On 20 Dec 2015, Ant wrote:

> Oops. I messed up in my body text. I meant to say "With my almost 1.5 
> weeks Christmas 2015 break coming up, I think it is time to finally 
> upgrade (not a clean install?) my old Debian oldstable (Wheezy) to 
> stable (Jessie) ..." I am already at oldstable/Wheezy.

That doesn't sound too bad then. You seem to have a good amount of disk
space available, just read through the release notes carefully, there
are passages about things like purging removed packages to get rid of
old init scripts. It's not difficult, it's just good to know about it
all. My wheezy to jessie upgrades have gone generally quite well.

>> And you do not have to use full systemd on Jessie, but stay with
>> SysVInit as provided by systemd-sysv (which is what I am using
>> on two Jessie systems -- Debian 8.2).
>
> Oh. I thought Debian stable was forcing everyone off SysVInit to SystemD 
> like other Linux OSes. :/

In the longer term, who knows how viable avoiding SystemD will be? Other
software seems to be increasingly assuming that it is now the way to
offer various functionality, just like we started having to use apulse
because applications began to assume pulseaudio. In jessie, a
SysVInit-based system remains quite workable. Though, I'm not using
GNOME anywhere, I don't know how it is from there: remember that SystemD
is more than just an init system: a lot depends on if you just don't
want to use it for starting daemons, or if you really want as little
trace of it on your system as possible. There might be small issues in
some desktop environments, in things like automounting flash drives for
users or offering a working power-down button to them, but I haven't run
into anything too major, it's just the kind of stuff you should test out
to see if it still works. In my limited experience, many of the issues
seem solvable simply by installing the right non-obvious package. It's
all a bit too much of a confusing twisty maze for me to figure out why
some things stopped working -- the whole ecosystem with cgmanager and
polkit and whatnot in there is frankly a bit opaque to me, even given
the logging -- but a non-SystemD jessie system is certainly viable if
you don't mind doing things the old, manual way while you figure some
new things out. My main outstanding puzzle is actually on a SystemD
system so I can't blame its absence!

I don't know how much momentum/activity Devuan has but I still don't
think it's anywhere near ready for prime-time. I'd say, read the release
notes, take a full backup, then go ahead, do the upgrade, reboot, and
test jessie out right away. If something does stop working and you can't
figure it out (which is unlikely given that probably others ran into it
by now and you can google their solutions) you can always restore from
backup, but you'll probably be able to get it working well enough if you
don't mind having at least some systemd-related libraries around.

-- Mark

[toc] | [prev] | [next] | [standalone]

#7497

Hi,

Ant a écrit le 19/12/2015 20:34 :
> Hi.
> 
> With my almost 1.5 weeks Christmas 2015 break coming up, I think it is 
> time to finally upgrade (not a clean install?) my old Debian oldstable 
> to stable (Wheezy) in case anything goes wrong (am pretty sure something 
> will break) with the free time I will have. It is just a basic 
> desktop/workstation/server/backup machine.
> 
> From https://www.debian.org/releases/stable/amd64/release-notes/ and 
> other sources, I read that some packages will be removed, like 
> DenyHosts, so I will have to find a replacement. Also, I am not sure if 

For denyHosts, you may can use the sid package :
<https://packages.debian.org/sid/denyhosts>

The page
<https://debian-handbook.info/browse/stable/sect.dist-upgrade.html> may
be usefull.


> I have enough free disk space for Kernels and stuff. This is what I have 
> currently on my tiny 115 GB SSD (you can see the rest of my secondary 
> computer (specification/detail)s in 
> http://zimage.com/~ant/antfarm/about/MyComputerStuff.txt ). Systemd 
> seems to be a big change for upgrades due to being new and changing a 
> lot of things. :(

systemd is working well. I didn't had trouble with it.

I had to replace :
dbus-send --system --print-reply --dest=org.freedesktop.UPower \
/org/freedesktop/UPower org.freedesktop.UPower.Suspend >/dev/null 2>&1

with :
systemctl suspend

I didn't test brtfs, ext4 is working well.

> 
> $ df
> Filesystem                                             1K-blocks      Used Available Use% Mounted on
> rootfs                                                    960504    591852    319860  65% /
> udev                                                       10240         0     10240   0% /dev
> tmpfs                                                     206052      2120    203932   2% /run
> /dev/disk/by-uuid/242d81f2-8a0d-48e1-a144-22ab4d2b9407    960504    591852    319860  65% /
> tmpfs                                                       5120         8      5112   1% /run/lock
> tmpfs                                                    1193200        80   1193120   1% /run/shm
> /dev/sda9                                               50013916   2699516  44773808   6% /home
> /dev/sda5                                                 960504     17672    894040   2% /tmp
> /dev/sda8                                               49982172   6720980  40722184  15% /usr
> /dev/sda6                                                4804736   1881892   2678776  42% /var
> ...
> 
> http://pastebin.com/raw/C0JnbFay for my current long "dpkg -l" listing.
> 
> Oldstable's apt:
> $ cat /etc/apt/sources.list
> #############################################################
> ################### OFFICIAL DEBIAN REPOS ###################
> #############################################################
> 
> #deb http://ftp.us.debian.org/debian/ stable main contrib non-free
> deb http://ftp.us.debian.org/debian wheezy main contrib non-free
> deb http://ftp.debian.org/debian/ wheezy-updates main contrib non-free
> deb http://ftp.us.debian.org/debian/ wheezy-proposed-updates main 
> contrib non-free
> #deb http://mirrors.kernel.org/debian wheezy-updates main contrib
> deb http://security.debian.org/ wheezy/updates main contrib non-free
> 
> # Debian Backports - http://backports.debian.org/
> deb http://ftp.debian.org/debian/ wheezy-backports main contrib non-free
> #deb http://mirrors.kernel.org/debian wheezy-backports main contrib 
> non-free
> 
> #Iceweasel (aka Firefox)
> deb http://mozilla.debian.net/ wheezy-backports iceweasel-release
> 
> #Google
> deb http://dl.google.com/linux/chrome/deb/ stable main
> deb http://dl.google.com/linux/earth/deb/ stable main
> 
> # Debian Multimedia
> deb http://www.deb-multimedia.org oldstable main
> deb ftp://ftp.deb-multimedia.org oldstable-backports main
> deb http://www.deb-multimedia.org wheezy main non-free
> deb http://www.deb-multimedia.org wheezy-backports main
> 
> I assume when I go to stable/Jessie, I will just rename all wheezy to 
> jessie and oldstable to stable? Am I correct?

Yes, you can first comment all backports or other external repositories.
And after apt-get update && apt-get dist-upgrade && reboot
Install all this backports if they are usefull.

I think that the name of the release is better than stable in source.list.

apt-cache policy package-name will be usefull.

> 
> Thank you in advance. :)

wheezy to Jessie is only harder for Apache and INN2 upgrade. I had
troubles with /boot and GRUB on an old machine.

-- 
Stéphane
Sorry for mistakes in English.

[toc] | [prev] | [next] | [standalone]

#7499

> > With my almost 1.5 weeks Christmas 2015 break coming up, I think it is 
> > time to finally upgrade (not a clean install?) my old Debian oldstable 
> > to stable (Wheezy) in case anything goes wrong (am pretty sure something 
> > will break) with the free time I will have. It is just a basic 
> > desktop/workstation/server/backup machine.
> > 
> > From https://www.debian.org/releases/stable/amd64/release-notes/ and 
> > other sources, I read that some packages will be removed, like 
> > DenyHosts, so I will have to find a replacement. Also, I am not sure if 

> For denyHosts, you may can use the sid package :
> <https://packages.debian.org/sid/denyhosts>

But will it still work?


> The page
> <https://debian-handbook.info/browse/stable/sect.dist-upgrade.html> may
> be usefull.


> > I have enough free disk space for Kernels and stuff. This is what I have 
> > currently on my tiny 115 GB SSD (you can see the rest of my secondary 
> > computer (specification/detail)s in 
> > http://zimage.com/~ant/antfarm/about/MyComputerStuff.txt ). Systemd 
> > seems to be a big change for upgrades due to being new and changing a 
> > lot of things. :(

> systemd is working well. I didn't had trouble with it.

> I had to replace :
> dbus-send --system --print-reply --dest=org.freedesktop.UPower \
> /org/freedesktop/UPower org.freedesktop.UPower.Suspend >/dev/null 2>&1

> with :
> systemctl suspend

Is that power management?


> I didn't test brtfs, ext4 is working well.

I only use ext4. :)


> > $ df
> > Filesystem                                             1K-blocks      Used Available Use% Mounted on
> > rootfs                                                    960504    591852    319860  65% /
> > udev                                                       10240         0     10240   0% /dev
> > tmpfs                                                     206052      2120    203932   2% /run
> > /dev/disk/by-uuid/242d81f2-8a0d-48e1-a144-22ab4d2b9407    960504    591852    319860  65% /
> > tmpfs                                                       5120         8      5112   1% /run/lock
> > tmpfs                                                    1193200        80   1193120   1% /run/shm
> > /dev/sda9                                               50013916   2699516  44773808   6% /home
> > /dev/sda5                                                 960504     17672    894040   2% /tmp
> > /dev/sda8                                               49982172   6720980  40722184  15% /usr
> > /dev/sda6                                                4804736   1881892   2678776  42% /var
> > ...
> > 
> > http://pastebin.com/raw/C0JnbFay for my current long "dpkg -l" listing.
> > 
> > Oldstable's apt:
> > $ cat /etc/apt/sources.list
> > #############################################################
> > ################### OFFICIAL DEBIAN REPOS ###################
> > #############################################################
> > 
> > #deb http://ftp.us.debian.org/debian/ stable main contrib non-free
> > deb http://ftp.us.debian.org/debian wheezy main contrib non-free
> > deb http://ftp.debian.org/debian/ wheezy-updates main contrib non-free
> > deb http://ftp.us.debian.org/debian/ wheezy-proposed-updates main 
> > contrib non-free
> > #deb http://mirrors.kernel.org/debian wheezy-updates main contrib
> > deb http://security.debian.org/ wheezy/updates main contrib non-free
> > 
> > # Debian Backports - http://backports.debian.org/
> > deb http://ftp.debian.org/debian/ wheezy-backports main contrib non-free
> > #deb http://mirrors.kernel.org/debian wheezy-backports main contrib 
> > non-free
> > 
> > #Iceweasel (aka Firefox)
> > deb http://mozilla.debian.net/ wheezy-backports iceweasel-release
> > 
> > #Google
> > deb http://dl.google.com/linux/chrome/deb/ stable main
> > deb http://dl.google.com/linux/earth/deb/ stable main
> > 
> > # Debian Multimedia
> > deb http://www.deb-multimedia.org oldstable main
> > deb ftp://ftp.deb-multimedia.org oldstable-backports main
> > deb http://www.deb-multimedia.org wheezy main non-free
> > deb http://www.deb-multimedia.org wheezy-backports main
> > 
> > I assume when I go to stable/Jessie, I will just rename all wheezy to 
> > jessie and oldstable to stable? Am I correct?

> Yes, you can first comment all backports or other external repositories.
> And after apt-get update && apt-get dist-upgrade && reboot
> Install all this backports if they are usefull.

> I think that the name of the release is better than stable in source.list.

> apt-cache policy package-name will be usefull.

> > 
> > Thank you in advance. :)

> wheezy to Jessie is only harder for Apache and INN2 upgrade. I had
> troubles with /boot and GRUB on an old machine.

Ah thanks. :)
-- 
Merry Christmas/Season's Greetings/:) Holidays & May The Force Be With U!
Note: A fixed width font (Courier, Monospace, etc.) is required to see this signature correctly.
  /\___/\   Ant(Dude) @ http://antfarm.home.dhs.org (Personal Web Site)
 / /\ /\ \                 Ant's Quality Foraged Links: http://aqfl.net
| |o   o| |
   \ _ /    Please nuke ANT if replying by e-mail privately. If credit-
    ( )     ing, then please kindly use Ant nickname and AQFL URL/link.

[toc] | [prev] | [next] | [standalone]

#7500

Hi,

Ant a écrit le 21/12/2015 07:20 :
>> For denyHosts, you may can use the sid package :
>> > <https://packages.debian.org/sid/denyhosts>
> But will it still work?

You can look at the dependencies they seems not impossible with Jessie.

But there is some bad bugs to watch :
<https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802917>

I use fail2ban whick only work on ipV4 like denyHosts (I have configured
sshd to bind on 0.0.0.0).

<http://serverfault.com/questions/128962/denyhosts-vs-fail2ban-vs-iptables-best-way-to-prevent-brute-force-logons#129171>


So I advice to try fail2ban on Wheezy and then upgrade debian.

You have time to upgrade before wheezy became LTS.

-- 
Stéphane

[toc] | [prev] | [next] | [standalone]

#7514

In alt.os.linux.debian yamo' <yamo@beurdin.invalid> wrote:
> Hi,

> Ant a écrit le 21/12/2015 07:20 :
> >> For denyHosts, you may can use the sid package :
> >> > <https://packages.debian.org/sid/denyhosts>
> > But will it still work?

> You can look at the dependencies they seems not impossible with Jessie.

> But there is some bad bugs to watch :
> <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802917>

> I use fail2ban whick only work on ipV4 like denyHosts (I have configured
> sshd to bind on 0.0.0.0).

> <http://serverfault.com/questions/128962/denyhosts-vs-fail2ban-vs-iptables-best-way-to-prevent-brute-force-logons#129171>


> So I advice to try fail2ban on Wheezy and then upgrade debian.

> You have time to upgrade before wheezy became LTS.

Thanks. I think I will switch to fail2ban then.
-- 
Merry Christmas/Season's Greetings/:) Holidays & May The Force Be With U!
Note: A fixed width font (Courier, Monospace, etc.) is required to see this signature correctly.
  /\___/\   Ant(Dude) @ http://antfarm.home.dhs.org (Personal Web Site)
 / /\ /\ \                 Ant's Quality Foraged Links: http://aqfl.net
| |o   o| |
   \ _ /    Please nuke ANT if replying by e-mail privately. If credit-
    ( )     ing, then please kindly use Ant nickname and AQFL URL/link.

[toc] | [prev] | [next] | [standalone]

#7515

On Monday, December 21st, 2015, at 21:49:44h -0600, Ant wrote:

> Thanks. I think I will switch to fail2ban then.

Incidentally did "denyhosts" trap a lot of attacks during your
long period of usage?

[toc] | [prev] | [next] | [standalone]

#7516

> > Thanks. I think I will switch to fail2ban then.

> Incidentally did "denyhosts" trap a lot of attacks during your
> long period of usage?

Yep, daily on SSH port. So many brute force attacks! :(
-- 
Merry Christmas/Season's Greetings/:) Holidays & May The Force Be With U!
Note: A fixed width font (Courier, Monospace, etc.) is required to see this signature correctly.
  /\___/\   Ant(Dude) @ http://antfarm.home.dhs.org (Personal Web Site)
 / /\ /\ \                 Ant's Quality Foraged Links: http://aqfl.net
| |o   o| |
   \ _ /    Please nuke ANT if replying by e-mail privately. If credit-
    ( )     ing, then please kindly use Ant nickname and AQFL URL/link.

[toc] | [prev] | [next] | [standalone]

#7517

On Tuesday, December 22nd, 2015, at 14:35:57h -0600, Ant wrote:

> Yep, daily on SSH port. So many brute force attacks! :(

Ah, thanks for the reply.

So presumably you have port 22 wide open on your router to the world?

[toc] | [prev] | [next] | [standalone]

#7518

> > Yep, daily on SSH port. So many brute force attacks! :(

> Ah, thanks for the reply.

> So presumably you have port 22 wide open on your router to the world?

Yeah. I need it open because my employer blocks non-standard ports. :(
-- 
Merry Christmas/Season's Greetings/:) Holidays & May The Force Be With U!
Note: A fixed width font (Courier, Monospace, etc.) is required to see this signature correctly.
  /\___/\   Ant(Dude) @ http://antfarm.home.dhs.org (Personal Web Site)
 / /\ /\ \                 Ant's Quality Foraged Links: http://aqfl.net
| |o   o| |
   \ _ /    Please nuke ANT if replying by e-mail privately. If credit-
    ( )     ing, then please kindly use Ant nickname and AQFL URL/link.

[toc] | [prev] | [next] | [standalone]

#7519

On Wednesday, December 23rd, 2015, at 19:44:35h -0600, Ant explained:

>> So presumably you have port 22 wide open on your router to the world?
> 
> Yeah. I need it open because my employer blocks non-standard ports. :(

So on your router (if it has the feature, and if not you should get a 
more capable router). and certainly with the firewall on your PC, just
allow incoming port 22 connections from the IP address range used by
your employer and not the whole of the Internet.

The method to security is always keep everything closed and when opening
up as necessary, try to limit how much the thing is opened up; only open
to everybody if it is absolute necessary (not just as a lazy convenience
approach).

Another good thing to do is to create a Unix group group ssh-users and
add this to your sshd config to only allow members of that group to be
able to actually try to authenticate with sshd.  Obviously you then
have to add each user you want to allow to connect to that group
(in the /etc/group file entry for ssh-users and to /etc/gshadow as well).

Hope that helps to make your more secure and reduce the size of your
failed login attempts file.

[toc] | [prev] | [next] | [standalone]

#7561

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ant sent the following transmission through subspace:

> I read that some packages will be removed, like 
> DenyHosts, so I will have to find a replacement.

DenyHosts is removed because it's been abandoned upstream,
Last release was v2.6 in 2008.

I recommend to use the fork DenyHost. (Note the missing trailing s.)
https://sourceforge.net/projects/denyhost/

- -- 
Solbu - http://www.solbu.net
PGP key ID: 0xFA687324
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlaBUNUACgkQT1rWTfpocyRNiQCgxR1w+FOceGOrYgXNN7DCUZuW
R/YAnjdXUULIgXybqmuuRFjtL5WiXT2p
=0dw9
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#7566

> > I read that some packages will be removed, like 
> > DenyHosts, so I will have to find a replacement.

> DenyHosts is removed because it's been abandoned upstream,
> Last release was v2.6 in 2008.

> I recommend to use the fork DenyHost. (Note the missing trailing s.)
> https://sourceforge.net/projects/denyhost/

Thanks. I hope it goes to Debian's official servers soon. My DenyHosts 
still work with Jessie/stable since last night. :)
-- 
Quote of the Week: "Yeah, what's left of it. I was in the militia -- 
national guard... That's good! Wasn't any war any more than there's war 
between men and ants." --stranger; "And we're eat-able ants. I found 
that out... What will they do with us?" --Pierson from H.G. Wells' The 
War of the Worlds
Note: A fixed width font (Courier, Monospace, etc.) is required to see this signature correctly.
  /\___/\   Ant(Dude) @ http://antfarm.home.dhs.org (Personal Web Site)
 / /\ /\ \                 Ant's Quality Foraged Links: http://aqfl.net
| |o   o| |
   \ _ /    Please nuke ANT if replying by e-mail privately. If credit-
    ( )     ing, then please kindly use Ant nickname and AQFL URL/link.

[toc] | [prev] | [standalone]

Back to top | Article view | alt.os.linux.debian

csiph-web