Date: Sat, 2 Dec 1995 15:57:01 -0500 (EST) From: Robert Watson <robert@fledge.watson.org> To: Robert Du Gaue <rdugaue@calweb.com> Cc: "Jordan K. Hubbard" <jkh@time.cdrom.com>, Michael Smith <msmith@atrad.adelaide.edu.au>, security@FreeBSD.ORG Subject: Re: ****HELP***** Message-ID: <Pine.BSF.3.91.951202155052.18350B-100000@fledge.watson.org> In-Reply-To: <Pine.BSF.3.91.951202102847.1571B-100000@uucp1.calweb.com>
next in thread | previous in thread | raw e-mail | index | archive | help
/usr/local/bin, some systems have /usr/contrib/bin, /usr/libexec, /usr/local/libexec, /usr/local/sbin, also do your libs -- /usr/lib, /usr/local/lib, if you haev X, /usr/X11R6/bin, /usr/X11R6/lib, /stand if you use it.. and /lkm. In fact, it occurs to me that if you're really concerned, maybe it would be best just to reinstall FreeBSD on that system? Or use the upgrade package in 2.1.0 to overwrite the distribution itself (backing up heavily first, though.) That way you know that things are configured/installed without backdoors (assuming you trust Jordan, and I think most of us do :). Kind of a pain for a often-used system with a lot of personal configuration details, but.. Anyhow, that's what I'd do. Also, if you haven't yet, file a report with CERT and scan their archives for stuff that might be relevant. Also, you might check to see if the most recent ftp related CERT advisory effects you -- I think there's probably a group of people who read the advisories, and test their ISP at once :). Unless you've changed your ftp config under FreeBSD to enable it, it shouldn't work, though. On Sat, 2 Dec 1995, Robert Du Gaue wrote: > I plan on rebuilding a new system from scratch, then I'll wipe all the > bin directories clena on the compromised systems and use the rebuilt > system to update all the bins. Which should I do? > > /bin /sbin /usr/sbin /usr/bin Where else? I know there are alot I'm > missing... > > > On Sat, 2 Dec 1995, Robert Watson wrote: > > > Date: Sat, 2 Dec 1995 13:14:42 -0500 (EST) > > From: Robert Watson <robert@fledge.watson.org> > > To: "Jordan K. Hubbard" <jkh@time.cdrom.com> > > Cc: Michael Smith <msmith@atrad.adelaide.edu.au>, > > Robert Du Gaue <rdugaue@calweb.com>, security@FreeBSD.ORG > > Subject: Re: ****HELP***** > > > > > > Actually, what might be nice is to include the MD5's with the system, and > > have a script in daily.local that verifies that the key system binaries > > are correct. Obviously then the md5 file would be at risk, but.. This > > would also be nice, unrelated to the daily part, after an upgrade to > > check if there are any old binaries lying around. > > > > Actually, one thing I was going to ask about was -- is there a difference > > between the 2.1.0 binaries for standard executables (eg., pine) and the > > 2.0.5 ones? Is there anyway I can use strings (or something) to get a > > list of all the old binaries on my system and upgrade them if needed? > > > > On Sat, 2 Dec 1995, Jordan K. Hubbard wrote: > > > > > > Jordan; how hard would it be to generate a file with the md5's of a stock > > > > release system's "standard binaries" for this sort of thing? > > > > > > Probably not too hard. Let me think about it. You'd want a file > > > for each distrib, probably. > > > > > > Jordan > > >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.3.91.951202155052.18350B-100000>