[TriLUG] oldest production linux box

[Jeremy Portzer]

On Thu, 2004-03-04 at 14:54, Mike M wrote:
> On Thu, Mar 04, 2004 at 07:07:08AM -0800, Turnpike Man wrote:
> > I'm betting for "company's internal use" he may not care as long as it performs
> > its duties.  But a good question anyway!
> 
> This thread was started with a highlight of a 2.1 kernel still humming
> along - which is very cool.  Now if it hasn't been updated for security, 
> then there's a good chance the ssh is vulnerable.

Not to mention openssl, if there is an apache listening on https: . 
That would probably be the easiest way to get in on an old system.

> I am guessing that keeping a sub 2.2 kernel based system up to date is
> similar to maintaining a Gentoo system.  

Um, not really.  Gentoo doesn't really require you to figure out
dependencies and run configure and make commands yourself... it's all
predetermined by the Gentoo developers in the "ebuild" files.  Trying to
maintain a seriously old system would require a LOT of custom compiling,
patching, and even coding.  Much more difficult than Gentoo.

> Would it be too parnoid to suggest that announcing that you have an
> old system working dependably might be a human engineering nugget
> to a cracker who might rightly assume such a system is vulnerable 
> to legacy exploits?
> 

Not paranoid at all.  As someone else said, that's probably why this
thread got so few responses.

--Jeremy


/---------------------------------------------------------------------\
| Jeremy Portzer       jeremyp at pobox.com       trilug.org/~jeremy     |
| GPG Fingerprint: 712D 77C7 AB2D 2130 989F  E135 6F9F F7BC CC1A 7B92 |
\---------------------------------------------------------------------/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://www.trilug.org/pipermail/trilug/attachments/20040304/65198c1c/attachment.pgp>