From owner-freebsd-jail@FreeBSD.ORG Wed Jan 2 13:17:46 2008 Return-Path: Delivered-To: freebsd-jail@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 65FCE16A417 for ; Wed, 2 Jan 2008 13:17:46 +0000 (UTC) (envelope-from alexander@leidinger.net) Received: from redbull.bpaserver.net (redbullneu.bpaserver.net [213.198.78.217]) by mx1.freebsd.org (Postfix) with ESMTP id E3AE013C46E for ; Wed, 2 Jan 2008 13:17:45 +0000 (UTC) (envelope-from alexander@leidinger.net) Received: from outgoing.leidinger.net (p54A54BD9.dip.t-dialin.net [84.165.75.217]) by redbull.bpaserver.net (Postfix) with ESMTP id 0C28C2E0BF; Wed, 2 Jan 2008 14:17:33 +0100 (CET) Received: from deskjail (deskjail.Leidinger.net [192.168.1.109]) by outgoing.leidinger.net (Postfix) with ESMTP id C44F478498; Wed, 2 Jan 2008 14:17:27 +0100 (CET) Date: Wed, 2 Jan 2008 14:10:19 +0100 From: Alexander Leidinger To: "Andrew Hotlab" Message-ID: <20080102141019.3a0c9b1d@deskjail> In-Reply-To: References: <20071220083441.uo6hmypq84ssoowc@webmail.leidinger.net> <20071220164656.1acd2b45@deskjail> <20071230004139.yvolsno8gsks0k0g@webmail.leidinger.net> X-Mailer: Claws Mail 3.0.2 (GTK+ 2.12.3; i686-portbld-freebsd8.0) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-BPAnet-MailScanner-Information: Please contact the ISP for more information X-BPAnet-MailScanner: Found to be clean X-BPAnet-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-14.9, required 6, BAYES_00 -15.00, RDNS_DYNAMIC 0.10) X-BPAnet-MailScanner-From: alexander@leidinger.net X-Spam-Status: No Cc: FreeBSD-Jail Subject: Re: How to better update a jail host system X-BeenThere: freebsd-jail@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Discussion about FreeBSD jail\(8\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Jan 2008 13:17:46 -0000 Quoting "Andrew Hotlab" (Wed, 2 Jan 2008 13:12:24 +0100): > -------------------------------------------------- > From: "Alexander Leidinger" > Sent: Sunday, December 30, 2007 12:41 AM > To: "Andrew Hotlab" > Cc: "FreeBSD-Jail" > Subject: Re: How to better update a jail host system > > >> I've spent some time on the past days to find how to build a world > >> which contains only the "Binary base" and "man" distributions (as I > >> always select from the sysinstall menu options during the first server > >> setup), but I didn't found any article or man page which helped me. > > > > I don't know exactly what is in the binary and man dists, but what you > > need to do is either to just grab the new dists from an FTP server and > > extract them over the old ones, or to have a look what is installed by a > > make world what is not in those dists and have a look for WITHOUT_ knobs > > which exclude those parts from the build/install. There may be not enough > > WITHOU_ knobs to produce those dists, as they are generated in a > > different way (make release). > > Ok, thank you Alexander! But what do you think about upgrading the server on > the "installed binary distribution" basis? Perhaps it sounds good to me > because I'm coming from Windows Server experience (where it's important to > maintain only the Windows components you need, in order to reduce the attack > surface). Maintaining as few as possible binary distributions is so > important in FreeBSD too, or it helps only to grow unnecessary system > complexity? If an attacker has access to a machine, he can probably transfer all what he wants to the system. So often it doesn't matter if you have all or files or not. If there's a problem with a SUID program in the additional stuff, you may be more at risk at some point in time than when you only install a limited set of stuff. Personally I would install everything and maybe remove the SUID bit from stuff I don't use (use a list of programs which are allowed to be SUID/SGID and remove all SUID/SGID bits from files in this list after a search with "find / -perm +06000 -print"). This can be scripted, and I think it is less work to do it this way than to try to install only what is in a distribution (but I may be biased, as I do all updates from source). Bye, Alexander. -- "Ahhh! We're gonna die! Right?" -Fry "Right." -Bender "Ahhh!" -Fry http://www.Leidinger.net Alexander @ Leidinger.net: PGP ID = B0063FE7 http://www.FreeBSD.org netchild @ FreeBSD.org : PGP ID = 72077137