Re: OpenBSD rootkit?

[Jolan Luff <jolan@enteract.com>]

> Yes, there were. But the systems were 0wn3d through httpd bug, not open ssh.
> I haven't seen anyone yet (except for this post) mentioning publically being
> own3d through ssh.
go read slashdot/bsd or the openbsd journal. some 15 year old script
kiddie got busted while attacking a honeypot with the gobbles exploit.

> because you dudes claim "super-security" and give people fake sense of
> safety.. not anymore, though, after a few amusing bugs went public.
i've never seen a claim of super-security made anywhere. just strong
crypto, and thorough code auditing.

obviously, things fall through the cracks. openbsd is not perfect, but
it's usually ahead of the curve.

now, even more features are being added to reduce the effect that faulty
code (in openbsd and third party software) can have.

ssh -> privsep
apache -> chroot
skey -> per user (no longer suid)
lpr -> sgid (no longer suid)

oh, and systrace too.

there's no promises. just a humble mention of "1 remote hole in 6
years". pretty damn good.

- jolan