[rescue] [geeks] PSA: Remote root, OpenSSH 3.5p1, FreeBSD

[Phil Stracchino]

On 07/02/11 07:23, Sevan / Venture37 wrote:
> On 30 June 2011 18:27, Phil Stracchino <alaric at metrocast.net> wrote:
>> http://lists.grok.org.uk/pipermail/full-disclosure/2011-June/081722.html
>>
>>
>> (Sorry if this duplicates, sent from the wrong account first time)
> 
> http://lists.grok.org.uk/pipermail/full-disclosure/2011-July/081730.html
> 
> Anyone still running FreeBSD 4.x in production?


Oh, and to answer the specific question rather than the meta-question,
yes, you would probably be quite surprised how many hosted commercial
websites are still running FreeBSD 4.  At my current employer, we
disabled PAM authentication for sshd for several hundred customers still
running FreeBSD 4.x on Thursday.  Just like there are huge numbers of
hosted websites still running MSSQL 2005 and Windows Server 2003, and
virtually every site out there running Red Hat Enterprise or CentOS is
still running a 2.6.18 kernel and MySQL 5.0.77 (or older), and....


The business world is not Us.  The business world does not understand
why software needs to be kept up to date.


-- 
  Phil Stracchino, CDK#2     DoD#299792458     ICBM: 43.5607, -71.355
  alaric at caerllewys.net   alaric at metrocast.net   phil at co.ordinate.org
  Renaissance Man, Unix ronin, Perl hacker, SQL wrangler, Free Stater
                 It's not the years, it's the mileage.