Re: Disabling Root Access

[Chuck Yerkes <chuck@snew.com>]

Quoting David S. (dgjs@acm.org):
> On Sun, May 27, 2001 at 03:40:30PM +1000, Oliver Bode wrote:
> > The idea is to strive to get it right before doing it. When it goes wrong I
> > can live with that and learn my lesson. I'd aim for it to have a lifespan of
> > three to five years - everything has some sort of a lifespan.
> 
> You don't have a snowball's chance in hell of keeping it running 
> unattended for three years.

I've had one box, and internal Ultrix box, behind the firewall,
that was up for that kind of time.  We regularly patched the userland
software that it was running, we did everything but reboot it.

Would you really want a secure machine running at 3 year old
standards?

Also, if it's a firewall, let it be a firewall.  If it's
living/breathing OpenSSL, which does and will get updated,
make it that general purpose machine.  And don't dare think
that you don't want IPFilter 4.1 or OpenBSD's 2.14 kernel,
let alone OpenSSL 1.x.