From owner-freebsd-security Sun Jul 29 15:53:27 2001 Delivered-To: freebsd-security@freebsd.org Received: from chrome.jdl.com (chrome.jdl.com [209.39.144.2]) by hub.freebsd.org (Postfix) with ESMTP id 6EC9637B401 for ; Sun, 29 Jul 2001 15:53:22 -0700 (PDT) (envelope-from jdl@chrome.jdl.com) Received: from chrome.jdl.com (localhost [127.0.0.1]) by chrome.jdl.com (8.9.1/8.9.1) with ESMTP id RAA21644; Sun, 29 Jul 2001 17:58:31 -0500 (CDT) (envelope-from jdl@chrome.jdl.com) Message-Id: <200107292258.RAA21644@chrome.jdl.com> To: Peter Pentchev Cc: "Antoine Beaupre (LMC)" , security@freebsd.org Subject: Re: Some Followup on that ypchfn mess of mine In-reply-to: Your message of "Fri, 27 Jul 2001 20:25:27 +0300." <20010727202527.E1105@ringworld.oblivion.bg> Clarity-Index: null Threat-Level: none Software-Engineering-Dead-Seriousness: There's no excuse for unreadable code. Net-thought: If you meet the Buddha on the net, put him in your Kill file. Date: Sun, 29 Jul 2001 17:58:30 -0500 From: Jon Loeliger Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org So, like Peter Pentchev was saying to me just the other day: > > > > OK, I'll state it publicly: > > > > This machine will be rebuilt from sources. > > The old disk will be completely reformatted. > > I'm putting a new firewall in place first. > > Sorry to be a pain ;) But sometimes, a rebuild from sources might > not be enough: I wasn't clear. I will take a stock 4.3 release and install that onto _new_ disk. I will then rebuild world with some uprev'ed sources and install that. I will format the old, compromised disk and newfs it straight up. > you'll have to perform at least the install on > the machine in question (unless you take off the hard disk, mount > it on another machine, build from sources, and install with a DESTDIR > pointing to this machine's filesystems). > This still poses a risk, > albeit unlikely, of somebody having compromised your compiler, make(1), > install(1), perl, and whatever else is running on the machine before > the installation starts using the newly-compiled binaries. In any event, these all go too. I've downloaded a 4.3 release from ftp2.FreeBSD.org already and have started that install and "make world" onto an entirely _new_ disk. > This is why I - following the advice of others, including > http://www.FreeBSD.org/security/ - recommended backing up the data, > then reinstalling from a CD (or over the net; the point is, reinstalling > from a install medium completely unrelated to the compromised machine). Absolutley. Yes. jdl To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message