Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #268588
| From | Lee <ler762@gmail.com> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | Re: making Debian secure by default |
| Date | 2024-03-28 17:30 +0100 |
| Message-ID | <In0Nz-2juy-3@gated-at.bofh.it> (permalink) |
| References | <ImJa1-27aa-1@gated-at.bofh.it> <ImQlb-2bMw-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Thu, Mar 28, 2024 at 1:11 AM tomas wrote:
>
> On Wed, Mar 27, 2024 at 05:30:50PM -0400, Lee wrote:
> > I just saw this advisory
> > Escape sequence injection in util-linux wall (CVE-2024-28085)
> > https://seclists.org/fulldisclosure/2024/Mar/35
> > where they're talking about grabbing other users sudo password.
>
> Are there any users logged in to your computer you dont't trust?
>
> Thought so.
>
> Relax.
>
> Security means first and foremost understanding the threat.
Which I don't. Hence the request for 'secure by default' instructions
for Debian. Even better would be a secure by default installation
option.
To be clear, I'm not all that concerned about _this_ CVE. I've got
the disable_mesg.sh file in /etc/profile.d so sending messages with
control codes to other terminals should be disabled for all.
My concern is all the other stuff that I don't even know about that
could be configured in a more secure manner but isn't. For heavens
sake, the man page says
Traditionally, write access is allowed by default. However, as users
become more conscious of various security risks, there is a trend to
remove write access by default, at least for the primary login shell.
To make sure your ttys are set the way you want them to be set, mesg
should be executed in your login scripts.
Clearly at least the man page writer realized there was a threat there
_and chose not to remove the threat_ !?
So what other goodies are there that I don't know about? Is there
really nothing better than sudo find / <something to show files with
uid or gid perms> and try to figure out which of those program are not
necessary?
And I'm still a bit surprised that needrestart isn't included as part
of the default install. Or at least as part of the synaptic package
manager install. I never guessed that I would _not_ be warned that I
needed to reboot after updating software with the synaptic package
manager -- that didn't happen until after I installed needrestart.
> Randomly
> reaching into the CVE box will most probably keep you from actually
> working on your real issues. E.g. your browser.
I think it's up to date:
$ cat /etc/motd
lee@spot ~
$ sudo crontab -l
[sudo] password for lee:
...
47 4 * * * (apt update >> apt-update.log 2>/dev/null) && \
(apt list --upgradable 2>/dev/null |\
egrep -v '^Listing' >| /etc/motd)
> Or your social media
> account.
I've never had one.
> Cheers
>
> [1] https://xkcd.com/1200/
I like the quote I saved from the full disclosure mailing list back
when it was fun & exploits were mailed out as attachments:
And at some point, you really have to ask yourself "Is this really a
plausible attack method, or did I forget to take my meds again?"
-- Valdis Kletnieks
Regards
Lee
Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
making Debian secure by default Lee <ler762@gmail.com> - 2024-03-27 22:40 +0100
Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 00:10 +0100
Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 05:30 +0100
Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 14:40 +0100
Re: making Debian secure by default Greg Wooledge <greg@wooledge.org> - 2024-03-28 16:30 +0100
Re: making Debian secure by default Hans <hans.ullrich@loop.de> - 2024-03-28 16:50 +0100
Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 19:20 +0100
Re: making Debian secure by default Ralph Aichinger <ra@h5.or.at> - 2024-03-29 08:50 +0100
Re: making Debian secure by default Stefan Monnier <monnier@iro.umontreal.ca> - 2024-03-29 20:10 +0100
Re: making Debian secure by default Jeffrey Walton <noloader@gmail.com> - 2024-03-29 20:40 +0100
Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 17:00 +0100
Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 21:20 +0100
Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-28 18:50 +0100
Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 20:40 +0100
Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-29 18:00 +0100
Re: making Debian secure by default Joe <joe@jretrading.com> - 2024-03-29 18:30 +0100
Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-29 18:50 +0100
Re: making Debian secure by default Nicholas Geovanis <nickgeovanis@gmail.com> - 2024-04-01 02:30 +0200
Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-04-01 03:50 +0200
Re: making Debian secure by default Roberto C. Sánchez <roberto@debian.org> - 2024-04-01 05:00 +0200
Re: making Debian secure by default Nate Bargmann <n0nb@n0nb.us> - 2024-04-01 10:40 +0200
Re: making Debian secure by default <tomas@tuxteam.de> - 2024-04-06 09:50 +0200
Re: making Debian secure by default Nate Bargmann <n0nb@n0nb.us> - 2024-04-06 09:50 +0200
Re: making Debian secure by default <tomas@tuxteam.de> - 2024-04-06 09:51 +0200
Re: making Debian secure by default <tomas@tuxteam.de> - 2024-04-06 09:50 +0200
Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-04-06 09:50 +0200
Re: making Debian secure by default Nate Bargmann <n0nb@n0nb.us> - 2024-04-06 09:51 +0200
Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-04-06 09:51 +0200
Re: making Debian secure by default Jeffrey Walton <noloader@gmail.com> - 2024-04-06 09:51 +0200
Re: making Debian secure by default Nate Bargmann <n0nb@n0nb.us> - 2024-04-06 09:52 +0200
Re: making Debian secure by default Charles Curley <charlescurley@charlescurley.com> - 2024-04-06 09:52 +0200
Re: making Debian secure by default Jeffrey Walton <noloader@gmail.com> - 2024-04-06 09:51 +0200
Re: making Debian secure by default John Hasler <john@sugarbit.com> - 2024-04-06 09:51 +0200
Re: making Debian secure by default Joe <joe@jretrading.com> - 2024-04-06 09:52 +0200
Re: making Debian secure by default John Hasler <john@sugarbit.com> - 2024-04-06 09:52 +0200
Re: making Debian secure by default Joe <joe@jretrading.com> - 2024-04-06 09:52 +0200
Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-29 18:50 +0100
Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-29 21:00 +0100
Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-30 17:10 +0100
Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 19:10 +0100
Re: making Debian secure by default Jeffrey Walton <noloader@gmail.com> - 2024-03-28 23:20 +0100
Re: making Debian secure by default Florent Rougon <f.rougon@free.fr> - 2024-03-28 17:30 +0100
Re: making Debian secure by default Florent Rougon <f.rougon@free.fr> - 2024-03-28 18:10 +0100
Re: making Debian secure by default Greg Wooledge <greg@wooledge.org> - 2024-03-28 18:10 +0100
Re: making Debian secure by default Florent Rougon <f.rougon@free.fr> - 2024-03-28 18:10 +0100
Re: making Debian secure by default jeremy ardley <jeremy.ardley@gmail.com> - 2024-03-28 00:40 +0100
Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 00:50 +0100
Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 05:50 +0100
Re: making Debian secure by default <tomas@tuxteam.de> - 2024-03-28 06:20 +0100
Re: making Debian secure by default Emanuel Berg <incal@dataswamp.org> - 2024-03-28 06:30 +0100
Re: making Debian secure by default <tomas@tuxteam.de> - 2024-03-28 08:20 +0100
Re: making Debian secure by default Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-28 12:20 +0100
Re: making Debian secure by default Emanuel Berg <incal@dataswamp.org> - 2024-03-28 12:40 +0100
Re: making Debian secure by default David Wright <deblis@lionunicorn.co.uk> - 2024-03-28 21:40 +0100
Re: making Debian secure by default Emanuel Berg <incal@dataswamp.org> - 2024-03-29 10:40 +0100
Re: making Debian secure by default David Wright <deblis@lionunicorn.co.uk> - 2024-03-30 04:00 +0100
Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-28 15:50 +0100
Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 17:30 +0100
Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 18:10 +0100
Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 21:50 +0100
Re: making Debian secure by default tomas@tuxteam.de - 2024-03-28 18:30 +0100
Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 20:30 +0100
Re: making Debian secure by default Greg Wooledge <greg@wooledge.org> - 2024-03-28 20:30 +0100
Re: making Debian secure by default Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-28 21:50 +0100
Re: making Debian secure by default tomas@tuxteam.de - 2024-03-28 21:20 +0100
Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-29 17:10 +0100
Re: making Debian secure by default debian-user@howorth.org.uk - 2024-03-29 21:50 +0100
Re: making Debian secure by default debian-user@howorth.org.uk - 2024-03-28 22:50 +0100
Re: making Debian secure by default Marc SCHAEFER <schaefer@alphanet.ch> - 2024-03-28 12:10 +0100
Re: making Debian secure by default Franco Martelli <martellif67@gmail.com> - 2024-03-28 17:30 +0100
Re: making Debian secure by default Michel Verdier <mv524@free.fr> - 2024-03-28 17:30 +0100
Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 17:40 +0100
Re: making Debian secure by default Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-28 21:50 +0100
Re: making Debian secure by default Richmond <dnomhcir@gmx.com> - 2024-03-28 21:50 +0100
Re: making Debian secure by default Jeffrey Walton <noloader@gmail.com> - 2024-03-29 16:40 +0100
Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-31 21:10 +0200
Re: making Debian secure by default Roberto C. Sánchez <roberto@debian.org> - 2024-03-31 21:30 +0200
Re: making Debian secure by default gene heskett <gheskett@shentel.net> - 2024-03-31 22:30 +0200
Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-31 23:20 +0200
Re: making Debian secure by default gene heskett <gheskett@shentel.net> - 2024-04-01 01:00 +0200
csiph-web