Re: [discuss] Mandrake Honeypot

[Vincent Danen]

On Wednesday, December 11, 2002, at 11:41 AM, Kory Tarr wrote:

> I had assumed that the cooker branch of mandrake changes frequently 
> (Havent played with cooker yet, an assumption as I said), I also 
> assumed that we may end up having a lag and need a repository for the 
> 3 day old bread before we rebuild with the latest and greatest. We 
> would also need a way to keep everyone up to date with the latest 
> config files as we turn the machine into a honeypot. (this assumes we 
> are going to use wrappers?)
It does change rapidly.  I'd recommend not following cooker closely, 
but taking a snapshot and perhaps every 2 weeks, syncing up to the 
current cooker.  Of course, this may introduce instabilities that would 
have a negative impact on testing.  But I think tracking cooker daily 
will be too much work.

Having that in CVS, tho, seems excessive.  I also recommend not doing 
any rebuilding of cooker stuff, but take it "as is" from cooker.  
Environment changes may change how things operate on a rebuild.  For 
example, I had to redo the python updates for 9.0 because there was no 
requires on db2-devel, only db1-devel was installed on my build 
machine.  So all of a sudden python required libdb.so.2 instead of 
libdb.so.3.

--
MandrakeSoft Security; http://www.mandrakesecure.net/
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FE6F2AFD: 88D8 0D23 8D4B 3407 5BD7 66F9 2043 D0E5 FE6F 2AFD}

Attachment: PGP.sig
Description: PGP signature