Re: [Security-Discuss] MDK Update And Shorewall

On Wednesday 22 September 2004 02:05 pm, FACORAT Fabrice wrote:
> Le mercredi 22 Septembre 2004 18:11, Matt Parker a écrit :
> > On Wednesday 22 Sep 2004 16:53, steve szmidt wrote:
> > > On Wednesday 22 September 2004 11:07 am, Matt Parker wrote:
> > > > On Wednesday 22 Sep 2004 15:30, Vincent Danen wrote:
> > > > > The advisory for shorewall explicitly stated that you might need to
> > > > > restart your firewall.
> > > > >
> > > > > http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:080
> > > >
> > > > Yes, but I, and most sensible people would IMO, read that as meaning
> > > > that Shorewall would need to be restarted after the upgrade.
>
> How this could be done technically ? scripts from a rpm package are
> launched when the package is installed/removed. This can't be delayed.
> The only solution to implement this should be to use a tool specialized in
> system upgrade and for which you could applied some policies depending of
> the package/computer/....

Even if it was not supported by a package technology, the correct thing would 
be to supply a method for doing it according to best known standards. Which 
is to either make a default deny, or bring down the device, when temporarily 
removing a security device like a firewall. 

What if something goes wrong, at the wrong time? Of if that brief moment was 
enough to install/activate or otherwise gain improper access?

The installer cannot say "Oh, well it's only for a short while. I'm sure I'll 
be fine." Even though most of the time he will be. 

> > In which case, how do I use Mandrake-Update to connect and get the
> > updates? This breaks the pattern of how Mandrake-Update normally works -
> > normally the update is downloaded with the current package still running,
> > then you restart the services that have been updated.
>
> yes and no. some %postun and %preinst script could stop and/or restart the
> service.
> The point is that you should follow what's happen during the upgrade, or if
> it's automatic you should log what's happen.

-- 

Steve Szmidt

"They that would give up essential liberty for temporary safety 
deserve neither liberty nor safety."
                                Benjamin Franklin

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________