8 Aug
2022
8 Aug
'22
4:39 p.m.
Again sent earlier. Thanks for the intervening comments about
vulnerabiliteis and versions.
A lot of issues and suggestions have been made and raised. My brief
response is that yes, according to nmap and my intention I had port 23,
for ssh (I moved it) and port 5900 open and the rpc port, I think. I'm
going by memory.
Theoretically the only pinhole in the ISP router firewall was port 23.
To use port 5900, you had to use an ssh tunnel.
My web server is on another machine. Since I only use it for
development, I don't leave it up.
My actual web pages are hosted externally on a vendor's box.
My experience with the upgrade treadmill is that it is a waste of time.
By its own admission (if a concept can have that) the new versions will
have issues and you need to upgrade. If the issues with an older
version don't affect you, then it is perfectly fine to use it. Why
upgrade and risk the fact that the new issues will affect your use case.
The developers for Fedora 13 were no smarter or dumber than the
developers who are writing Fedora 36. Or pick your distro of choice.
The issue with an older release is that nifty new things come out and
you can't really use them. But, if you run a VM with a recent version
of the distro, you can use them just fine.
The other issues is that if you are getting vendor support, they can
only reasonably commit to supporting a limited number of versions.
This is AMD hardware from '06.
-Gary
On Fri, Aug 05, 2022 at 06:19:54PM -0700, Rick Moen wrote:
Quoting Brian E. Lavender (brian(a)brie.com):
----- End forwarded message -----
Gary,
You were running Fedora 13?
If so, _that_ is likely a big problem. Fedora 13's initial release was
May 25, 2010, and it was EOLed on June 24, 2011.
Because Fedora. If you don't want to keep moving to newer versions,
it's about the worst possible distro. (But it's possible Gary meant
that he did _original_ installation 15 years ago, but has been following
the recommended upgrade treadmill^W path.
Linus Sphinx wrote:
You know, I have a _lot_ of things to be grateful for, and somewhere on
the list is the glad tidings that I don't need to rely on
Bleepingcomputer.com for IT information.
Over the past 1.5 months since its discovery, the new botnet used
over 3,500 unique IPs worldwide to scan and attempt brute-forcing Linux
SSH servers.
[...]
The SSH brute-forcing relies on a list of credentials downloaded from
the [command and control server]. [...]
*snore*
So, doorknob-twisting for "joe accounts", like user=service
password=manager and like that.
Guestimate the math, and measure the lengthly setup and teardown times
for remote connections to an sshd, and you'll find that
dictionary-attacking an sshd with any reasonable rules set about
password quality and length is going to take an appreciable fraction of
the time to the heat death of the universe, to succeed.
I mentioned upthread that a lot of IT device comes from gadget freaks.
The _other_ common problem is that most security _articles_ are
copied-pasted press releases from security/antimalware firms.
So, they're big on shockhorror, and small on conveying understanding.
I've only quick-glanced at this article about enforcing password policy
via PAM, so won't swear to it being a good one:
https://www.techrepublic.com/article/controlling-passwords-with-pam/
Of course, if you're the -only- user, you ought to stick to decent
passwords without PAM forcing you to. (Also, a user who can su to
root has the power to overrule PAM. But if you do that, you have only
yourself to blame for consequences.)
_______________________________________________
Lug-nuts mailing list -- lug-nuts(a)bigbrie.com
To unsubscribe send an email to lug-nuts-leave(a)bigbrie.com