Tag Info

New answers tagged

0

Thanks everyone for the suggestions but we have found the problem. Seems that our SSL reverse proxy that was deployed was mis-configured, causing strange issues like this. Once we took it offline to test, the external clients then connected fine.


0

You have to configure your server to provide the chain certificate. How precisely to do this depends on your server. For apache, you need to add to your config: SSLCertificateChainFile /path/to/intermediate.crt For IIS (and most other Windows-native stuff), you have to import the intermediate certificate into your server's "Intermediate Certification ...


0

Related but important topic: According to this CentOS hosted page which is about having custom kernels, "CentOS is designed to function as a complete environment. If you replace a critical component, it may very well affect how the rest of the system acts.": http://wiki.centos.org/HowTos/Custom_Kernel See also this Stackexchange-related answer to the ...


2

User-agent strings do provide the companies running web servers with useful information. If they're contemplating introducing web site features or content they want to know if the majority of their user base have browsers that support that technology. They can look at the user-agent strings logged in the past month or two and get a sense of what browsers ...


2

Short answer Yes it is possible and aside from gpg-checking there are still several possible attacks! To prevent getting a fake repo, I would make sure to use HTTPS for my repos, and run a validating caching nameserver locally (DNSSEC) like Joe Sniderman suggests (the only available measure against DNS spoofing I have seen so far) But if the repository ...


-1

It really depends on your threat model. If you are hosting some Wikileaks-grade document, that might be a very real threat. If it's just a casual server on the Internet, you'll just want to update as often as possible way before worrying about this kind of attack.


4

Yes it is possible to do a cache poisoning attack, and yes it is possible to protect yourself. In addition to the rather standard practice of signing the package files with GPG, some distros use DNSSEC to protect the domains that serve those files against DNS spoofing. Notice the 'ad' flag in the dns answer below: $ dig +dnssec security.debian.org. ; ...


1

My vote would be number 3, with number 2 as a close second. I suppose it depends on the rest of your infrastructure. To my knowledge, AJP doesn't support encryption between hosts. Number 3 allows you to implement an N Tiered architecture. Ideally the Apache server would be parsing/URL filtering for malicious traffic and not blindly proxying all requests to ...


2

To answer your question, it is possible to spoof the update servers DNS; then, your packet manager should not install unsigned packets, an attacker could send you bad data, but you wouldn't accept it. Most distributions use OpenPGP to sign their updates. Fedora and Debian do for example. You just have to make sure that your automated option validates ...



Top 50 recent answers are included