3 ms·
fwiw, 4/5 of your points are specific issues to Atlassian JIRA, a commercial product :) The 5th point, as explained in the post... We actually tried to disable
by pquerna 17y ago
fwiw, 4/5 of your points are specific issues to Atlassian JIRA, a commercial product :)
The 5th point, as explained in the post... We actually tried to disable Password based authentication -- It is the ASF's standard policy for it to be disabled! -- we just failed at testing the configuration on Brutus. On our other machines, we had a block of configuration options we appended to the END of the sshd configuration, and these options successfully turned off password authentication, requiring ssh keys only.
On brutus however, we were missing a "UsePAM no", which meant pam went in and fell back to password authentication. This was a mistake, and we didn't realize until after the vulnerability when we were testing the machine, that its sshd was misconfigured.
- justinsb 17y agoI didn't mean to criticize. There were mistakes made - there always are. But amongst the list of mistakes, I would not put Slicehost's slow response anywhere near the top, and I'm surprised that anyone (particularly someone whose opinions I normally respect) could choose that as the lesson to highlight. Anyway, when is Apache going to get serious about a bug tracking project? :-)
- epochwolf 17y ago* Able to change the configuration to upload executable scripts Not familiar with JIRA but... couldn't you prevent this by either changing the ownership of the uploaded files or configure the web server not to execute any files in uploaded files directory.