Re: need to update the following after security audit

[Leuy Eeelyu <sarawakbird yahoo com>]

> Don't rely on version numbers. Examine the RPM
> packages for backported
> security relevant patches. E.g. use rpm --query
> --changelog packagename
> or read Red Hat's advisories.
> 
> http://www.redhat.com/advice/speaks_backport.html

Thanks I got what you mean. You were saying that the
package version might be the most suitable for my
linux version.  But how do I convince the the auditor
and my boss that for example openssh-3.6.1p2-33.30.1
is the most stable version for RHEL3.0 ?

[root box root]# uname -a
Linux box.box.com 2.4.21-20.0.1.ELsmp #1 SMP Wed Nov
24 20:34:01 EST 2004 i686 i686 i386 GNU/Linux

Just showing them the following link ??
http://www.redhat.com/advice/speaks_backport.html

Besides, I used the following command and know that
openssh-3.6.1p2-33.30.1 was last updated on 04 Mar
2004. But what does it means to them?

[root box root]# rpm --query --changelog
openssh-3.6.1p2-33.30.1 | more
* Thu Mar 04 2004 Phil Knirsch <pknirsch redhat com>
3.6.1p2-33.30.1

- Built RHLE3 U2 update package.

* Thu Mar 04 2004 Daniel Walsh <dwalsh redhat com>
3.6.1p2-33

- Close file descriptors on exec

* Tue Mar 02 2004 Thomas Woerner <twoerner redhat com>
3.6.1p2-32






		
__________________________________ 
Yahoo! Mail Mobile 
Take Yahoo! Mail with you! Check email on your mobile phone. 
http://mobile.yahoo.com/learn/mail