Slashdot Mirror
No Logo Wins FreeBSD Foundation Contest
RJPDeanLO writes: "The FreeBSD Foundation logo contest has ended with no winners! Check out their statement on the site.
To support FreeBSD ... I'm hoping that we can all get a second chance at it. Please reopen the contest!"
Run *BSD? Chances are that your SSH *will* be comprimised sometime after tuesday.
www.deadly.org
Quick hacks to fix:
filter out port 22 on your firewall.
shut down sshd process.
Proper fix:
Upgrade to OpenSSH 3.3 and you *must* have privilage separation on. Then, after Monday, upgrade to the new OpenSHH that will be released.
3.3 is only vunerable if pivilage separaiton is off. No true patches are being released as nasty-type people will be able to quickly find trhe vunerability by reading the patch.
For your consideration:
As a tempory hack, I ssh'ed into my servers, started Telnetd and loged into them via Telnet. I then killed telnetd, and kept my open Telnet connection. I've left these open telnet connections in case I have to manage my servers.
I've firewalled port 22 from the outside and will upgrade the systems at my leasure when the new version of SSH comes out around monday or tuesday.
Moneyed corporations, non-working 'poor' and criminal prisoners are turning productive citizens into tax-slaves.
When the story first appeared (I believe my comment was the fifth for the story) the link was: /freebsdfoundation.org. It was corrected without the editor making note of the fact that there was an error in the original story.
I'm not the only one who noticed. This person, this person, this person, and this person all noticed the problem. Funny thing is that I have seen a story or two on Slashdot complaining when other news cites change stories without indicating it.
Jesus was all right but his disciples were thick and ordinary. -John Lennon