From: Stuart Henderson (stuspacehopper.org)
Date: Sat Apr 02 2005 - 18:44:41 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

--On 03 April 2005 07:21 +0900, Tetsuji Maverick Rai wrote:

> And another concern is apache-1.3.x comes with OpenBSD by default,
> not as a package. It means *if* any vulnerability is found with that
> version of apache, I need to install the new one by hand instead of
> compiling it in the port directory.

This is treated the same as any other problem with the base OpenBSD
system - listed on <http://www.openbsd.org/errata.html> with details of
what's affected and instructions on how to patch. You can then decide
whether or not you need to patch (since you might not be using options
which trigger the problem and may be able to skup it). For a recent
example, look at the httpd problem in 3.6 fixed by errata 009.

Following the patch branch is another option, requiring more machine
resources but less human resources to keep up to date,
<http://www.openbsd.org/stable.html>.

The OpenBSD OS (including httpd, named and sendmail) is audited, you
can read about this at <http://www.openbsd.org/security.html>, so don't
be too surprised if a problem with Apache doesn't affect OpenBSD's
httpd.

> PS: I found port is downloadable via cvs. Is it compatible with
> older versions of OpenBSD releases (3.5,3.6..)? --------

No, see "Keeping things in sync" at the bottom of section 5.1 in
<http://www.openbsd.org/faq/faq5.html>, and "Life Cycle of the Ports
Tree", <http://www.openbsd.org/ports.html#Life>

> I don't mind the version of mysql so much (especially, both php4 and
> 5 seem to have problems with password authentication..I have a
> problem with phpMyAdmin with mysql-4.1.x on Linux/FreeBSD..so I want
> to stick to mysql-4.0.x.

<http://dev.mysql.com/doc/mysql/en/password-hashing.html>

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]