Re: [Security-Discuss] MDK Update And Shorewall

On Wednesday 22 Sep 2004 15:30, Vincent Danen wrote:
> On Sep 22, 2004, at 6:25 AM, Matt Parker wrote:
> > Yesterday I noticed that a new package for Shorewall had found it's
> > way into
> > MDK update for MDK 9.1. I had loads of other non-security related
> > downloads
> > on there too so I decided to update it all.
> >
> > All seemed to be going well until it got to installing Shorewall when
> > I was
> > VERY DISAPPOINTED to notice that the install process shut down my
> > existing
> > Shorewall and didn't bring the new version back up. Because I was
> > doing a
> > large update, there was a good 5 or 6 minutes - my server is only a
> > P166 -
> > when I was without a firewall with all kinds of services exposed to the
> > outside world (I had a few attempts in my log to connect to SAMBA
> > during this
> > period - luckily unsuccessful). As soon as everything was installed,
> > only
> > then did I get to restart Shorewall.
> >
> > This is pretty poor IMO.
>
> The advisory for shorewall explicitly stated that you might need to
> restart your firewall.
>
> http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:080

Yes, but I, and most sensible people would IMO, read that as meaning that 
Shorewall would need to be restarted after the upgrade. It does not say that 
the firewall will be down for the duration of the upgrade process leaving you 
open to attack in the meantime.

Regards,

Matt

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________