Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 2 Jan 2008 14:10:19 +0100
From:      Alexander Leidinger <Alexander@Leidinger.net>
To:        "Andrew Hotlab" <andrew.hotlab@hotmail.com>
Cc:        FreeBSD-Jail <freebsd-jail@freebsd.org>
Subject:   Re: How to better update a jail host system
Message-ID:  <20080102141019.3a0c9b1d@deskjail>
In-Reply-To: <BAY138-DS233320556E3337817F270F6520@phx.gbl>
References:  <BAY102-W41E0DDC536BD8491761400F65C0@phx.gbl> <20071220083441.uo6hmypq84ssoowc@webmail.leidinger.net> <BAY138-DS1F782EFBC33924A07CFB6F65D0@phx.gbl> <20071220164656.1acd2b45@deskjail> <BAY138-DS149E69993FB0F913A4F08F6590@phx.gbl> <20071230004139.yvolsno8gsks0k0g@webmail.leidinger.net> <BAY138-DS233320556E3337817F270F6520@phx.gbl>

next in thread | previous in thread | raw e-mail | index | archive | help
Quoting "Andrew Hotlab" <andrew.hotlab@hotmail.com> (Wed, 2 Jan 2008 13:12:24 +0100):

> --------------------------------------------------
> From: "Alexander Leidinger" <Alexander@Leidinger.net>
> Sent: Sunday, December 30, 2007 12:41 AM
> To: "Andrew Hotlab" <andrew.hotlab@hotmail.com>
> Cc: "FreeBSD-Jail" <freebsd-jail@freebsd.org>
> Subject: Re: How to better update a jail host system
> 
> >> I've spent some time on the past days to find how to build a world
> >> which contains only the "Binary base" and "man" distributions (as I
> >> always select from the sysinstall menu options during the first server
> >> setup), but I didn't found any article or man page which helped me.
> >
> > I don't know exactly what is in the binary and man dists, but what you 
> > need to do is either to just grab the new dists from an FTP server and 
> > extract them over the old ones, or to have a look what is installed by  a 
> > make world what is not in those dists and have a look for WITHOUT_  knobs 
> > which exclude those parts from the build/install. There may be  not enough 
> > WITHOU_ knobs to produce those dists, as they are generated  in a 
> > different way (make release).
> 
> Ok, thank you Alexander! But what do you think about upgrading the server on 
> the "installed binary distribution" basis? Perhaps it sounds good to me 
> because I'm coming from Windows Server experience (where it's important to 
> maintain only the Windows components you need, in order to reduce the attack 
> surface). Maintaining as few as possible binary distributions is so 
> important in FreeBSD too, or it helps only to grow unnecessary system 
> complexity?

If an attacker has access to a machine, he can probably transfer all
what he wants to the system. So often it doesn't matter if you have all
or files or not. If there's a problem with a SUID program in the
additional stuff, you may be more at risk at some point in time than
when you only install a limited set of stuff. Personally I would
install everything and maybe remove the SUID bit from stuff I don't use
(use a list of programs which are allowed to be SUID/SGID and remove all
SUID/SGID bits from files in this list after a search with "find /
-perm +06000 -print"). This can be scripted, and I think it is less
work to do it this way than to try to install only what is in a
distribution (but I may be biased, as I do all updates from source).

Bye,
Alexander.

-- 
 "Ahhh! We're gonna die! Right?" -Fry 
 "Right." -Bender 
 "Ahhh!" -Fry 
http://www.Leidinger.net  Alexander @ Leidinger.net: PGP ID = B0063FE7
http://www.FreeBSD.org     netchild @ FreeBSD.org  : PGP ID = 72077137



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080102141019.3a0c9b1d>