remote administration of upgrades

From: Voracity.net Administrator (voracity_net_at_yahoo.com)
Date: 09/18/03

  • Next message: Gil Agno Virtucio: "randomize execution the a script?" 
    Date: Thu, 18 Sep 2003 01:30:13 -0700 (PDT)
To: freebsd-questions@freebsd.org

    Hello, I am concerned about the recent ssh and
    sendmail security
    bulletins and would like to patch, but I have a few
    questions. The
    server that I administer runs FreeBSD 4.8, and I only
    have ssh access to
    it, not physical console access. Additionally, it's a
    production web
    server and so it would be nice if upgrades went off
    with as little
    disruption as possible.

    Anyway, I used cvsup to grab the RELENG_4_8 sources
    with the fixes. I'm
    now faced with the choice of doing "make world" (which
    I have never
    done) or just recompiling ssh and sendmail and
    installing them only.

    - All of the instructions for "make world" that I've
    read involve
    shutting down into single-user mode, am I corrent that
    this is not
    possible over ssh? Is there a way to accomplish the
    install step
    remotely? I have already recompiled and successfully
    installed a
    customized kernel remotely, and that was gut-wrenching
    enough waiting
    the minute or so while it rebooted with fingers
    crossed. :-)

    - Assuming that is not possible, I will just recompile
    the individual
    parts, following the instructions in the bulletin.
    However, I still
    don't want to fubar sshd and then not be able to
    connect to fix it.
    When I run "kill `cat /var/run/sshd.pid`" will that
    kill only the
    listening daemon (leaving any already-established
    sessions open) or will
    it kill all connections and everything related to
    sshd? I was hoping
    that I could kill just the listening sshd, restart the
    new one, and test
    it by connecting, all without severing the old known
    working
    connections... at least I'd have an out if something
    went wrong. And
    likewise, if I wanted to restart sshd (for example,
    after changing the
    config file) can I safely kill the sshd.pid process
    without killing the
    current sessions, just in case restarting sshd doesn't
    work?

    Thanks.

    __________________________________
    Do you Yahoo!?
    Yahoo! SiteBuilder - Free, easy-to-use web site design software
    http://sitebuilder.yahoo.com
    _______________________________________________
    freebsd-questions@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"

  • Next message: Gil Agno Virtucio: "randomize execution the a script?"

    Relevant Pages

    • Re: ssh going zombie
      ... on the server kill the ssh server then restart it with the -d flag to put ... it into debug mode. ... and the ssh process hogs the processor on the server. ... subprocess is removed from the sshd config file the a sub sshd process ...
      (SSH)
    • RE: sshd / ssh setup
      ... USA server and his windows/xp notebook to use SSH. ... followed sshd instruction and built ... and require users to submit keys. ...
      (freebsd-questions)
    • intermittent sshd connection problem in Linux
      ... The error I get is "connection refused by the server". ... It's not a client problem or a network problem, ... I've tried with several clients (puTTy, cygwin, ssh) from Windows ... The sshd service is running, and I can connect through it from another ...
      (comp.security.ssh)
    • Re: Scheduling problems
      ... > The biggest problem I have is if there is no CPU idle time (as reported ... > connect to my box using SSH, and the connection is broken somehow, the ... All I need to do to trigger this is to connect to the server, ... > then kill the SSH client process. ...
      (Debian-User)
    • [SLE] pam_ldap and ssh
      ... Right now I can only ssh as a local user. ... I have used the pam.d files that come with pam_ldap, including the sshd one. ... putting in the correct password. ... Using SuSE 9.1 updated with the latest openLDAP2 running on the same server. ...
      (SuSE)