Debian Security Advisory - DSA-3025-1 apt - security update

Anonymous Coward

in linux on 2014-09-18 21:52 (#2SK4)

Debian has announced a security advisory about its apt-get software, and recommends that you upgrade your apt packages ... with apt, of course.

"It was discovered that APT, the high level package manager, does not properly invalidate unauthenticated data (CVE-2014-0488), performs incorrect verification of 304 replies (CVE-2014-0487), does not perform the checksum check when the Acquire::GzipIndexes option is used (CVE-2014-0489) and does not properly perform validation for binary packages downloaded by the apt-get download command (CVE-2014-0490)."

This update comes to you courtesy of the IOERROR Twitter account.

Re: Some glaring security holes? (Score: 0)

by fnj@pipedot.org on 2014-09-19 21:48 (#2SMK)

I have zero security concern about sshd on my VPS. It's pretty much child's play to make it mathematiocally impossible for them to break in even if they keep trying for billions of years using thousands of bots.
1) Disallow root sshd logins. And never use root or sudo.
2) For admin, have a second UID 0 user account with a long name that no one would ever find in a dictionary. Give it a long, super obscure password and make sure it is set to use SHA512 hashing. Then login to this account using an ssh key which has a long obscure passphrase. Use ssh-agent to manage the passphrase.
3) For ordinary user accounts, use the same name and password policy.