[Workaround.org] Beta version of ISPmail tutorial for Squeeze ready - help me test it
email at christoph-haas.de
Tue May 17 11:10:29 CEST 2011
On 17.05.2011 09:38, Philip Krasteff wrote:
> Yeah, sure. I know that. But! Sometimes, I check my server for
> vulnerabilities, with services like openvas. Also some major holes
> appear from time to time in the package versions.
> For example, in Lenny (old stable), the apache version was 2.2.9-10,
> which had vulnerabilities and had to upgrade to at least 2.2.15 or
> later. However, a newer apache package 2.2.16 was available in
> lenny-backports. So if one wants to have this fixed, he should either
> install from backports, install from squeeze (testing at the time) or
> upgrade manually the package. This is a security concern... Me
> personally I don't want my server to be hacked because of vulnerable
> packages. That's why imho sometimes backports is a good decision.
Isn't that what security.debian.org is for? Even if the version number
of a certain application appears to be vulnerable, the package
maintainers still provide patches for their stable version.
In my opinion the opposite is rather true: if you use backports you
don't get security updates and your server becomes vulnerable unless you
provide the security updates yourself. There are people who run
"testing" on their servers. But they are more likely to be hacked thatn
servers running on "stable" plus security updates. You'd have to keep an
eye on your servers daily to avoid that.
I just had to patch 50 Debian servers and I'm very glad that we have
official security updates. I can't imagine how much time it would have
been to deal with that myself manually.
More information about the Workaround-chitchat