Re:Ancient Linux servers: The blighted slum houses of the In...
by foohbarbaz on Friday March 21, 2014 @07:17PM
(#7445603)
Of course I can and will keep up with every vulnerability for every service that is running and facing the Internet.
I do not accept the risk of waiting for some vendor to release a patch. If there's a hole, read the report, determine whether your config/build is vulnerable, rebuild.
Why would want to patch something you are not running or use?
Re:Ancient Linux servers: The blighted slum houses of the In...
by andrewflnr on Friday March 21, 2014 @06:53PM
(#7445490)
WRT local shells, it might well be a good idea to assume someone who got a shell as apache could use a privilege escalation 0-day and do some more damage. Hopefully your deployment process is such that starting from scratch isn't a huge hardship. I'd appreciate of someone with actual security experience (not me) weighed in...
Re:Ancient Linux servers: The blighted slum houses of the In...
by foohbarbaz on Friday March 21, 2014 @07:24PM
(#7445639)
It's very naive to think that you can protect a box from somebody with a local shell. Never worked.
The is no way you could possibly keep up with every vulnerability of everything installed on your server.
> If somebody breaks in and gets a local shell, all is lost anyway.
That is not true at all. You should run your server such that someone could get a shell running as the apache user - and still be able to do very little. They could read files and the database (which is bad), but not modify any files (which would be worse).