Already fixed
|
| Author | Content |
|---|---|
| Bob_Robertson May 16, 2008 7:54 AM EDT |
I did an update today, SSL was updated and a "bad key" package came along too. The system ssh keys were regenerated. So it looks good. Sadly, in "stable", that additional blacklist package cannot be added. I'm sure they'll find a way. |
| montezuma May 16, 2008 8:16 AM EDT |
I updated and the system keys were regenerated as well and the blacklist package installed. However when I ran the diagnostic program http://security.debian.org/project/extra/dowkd/dowkd.pl.gz A bunch of (personal not system) compromised keys showed up. |
| number6x May 16, 2008 8:33 AM EDT |
debian wiki has info about running that diagnostic: http://wiki.debian.org/SSLkeys |
| Sander_Marechal May 16, 2008 1:37 PM EDT |
Quoting:Sadly, in "stable", that additional blacklist package cannot be added. Eh? Sure it can. And it has. Just do "apt-get dist-upgrade" instead of "apt-get upgrade". |
| Steven_Rosenber May 16, 2008 1:39 PM EDT |
I think the problem is that if a regular apt-get update apt-get upgrade doesn't fix everything, a lot of people who aren't following the issue on the blogs won't know that they have a problem with compromised keys. |
| Sander_Marechal May 16, 2008 1:56 PM EDT |
The debian updater which virtually all desktop people use complains very loudly that it cannot install the update and that you have to use Synaptic to "mark all updates". If you do that, you'll get the blacklist pacage. So, I think most regular desktop folk will get the package and the new keys. |
| Bob_Robertson May 16, 2008 2:37 PM EDT |
What I meant is, "stable" is only supposed to get package updates, not new packages. Hopefully, the Debian team will violate that rule and mark them as new, required packages, so that even with an "apt-get upgrade" the new package will be installed. Nothing will be deleted. The real use of "dist-upgrade" is that it will automatically delete conflicted obsolete packages. |
| jezuch May 17, 2008 2:32 AM EDT |
Debian stable also gets "important updates", not only plain security patches. I don't think they need to violate any rules :) |
Posting in this forum is limited to members of the group: [ForumMods, SITEADMINS, MEMBERS.]
Becoming a member of LXer is easy and free. Join Us!