Re: [Security-Discuss] MDK Update And Shorewall

Le mercredi 22 Septembre 2004 18:11, Matt Parker a écrit :
> On Wednesday 22 Sep 2004 16:53, steve szmidt wrote:
> > On Wednesday 22 September 2004 11:07 am, Matt Parker wrote:
> > > On Wednesday 22 Sep 2004 15:30, Vincent Danen wrote:
> > > > The advisory for shorewall explicitly stated that you might need to
> > > > restart your firewall.
> > > >
> > > > http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:080
> > >
> > > Yes, but I, and most sensible people would IMO, read that as meaning
> > > that Shorewall would need to be restarted after the upgrade. 

How this could be done technically ? scripts from a rpm package are launched 
when the package is installed/removed. This can't be delayed.
The only solution to implement this should be to use a tool specialized in 
system upgrade and for which you could applied some policies depending of the 
package/computer/....

> > > It does 
> > > not say that the firewall will be down for the duration of the upgrade
> > > process leaving you open to attack in the meantime.
> > >
> > > Regards,
> > >
> > > Matt
> >
> > I agree that it would have been better if it automatically closed the
> > connection before removing the fw. Though most sensible network admins
> > disconnect the network cable before doing any kind of firewall upgrade.
>
> In which case, how do I use Mandrake-Update to connect and get the updates?
> This breaks the pattern of how Mandrake-Update normally works - normally
> the update is downloaded with the current package still running, then you
> restart the services that have been updated. 

yes and no. some %postun and %preinst script could stop and/or restart the 
service.
The point is that you should follow what's happen during the upgrade, or if 
it's automatic you should log what's happen.

> In order to do it the way you 
> suggest (and how I'm going to do it in the future) I'd have had to note
> down what packages were going to be updated, then download from an FTP
> mirror and manually install.



-- 
L'homme est libre, comme la terre est immobile.
Tout est combiné pour ces illusions.
Paul Valéry

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________