Fedora Authentication Server Breached: Do People Run Production Servers Using Fedora???

by Todd Ogasawara

Most so-called Linux security issues turn out to be some insecurely coded PHP/Perl/Python/Ruby/fill_in_the_blank app that is simply another application and not a core part of Linux at all. So, I wasn't alarmed when I read this in Information Week.

Red Hat Confirms Intruder Breached Fedora Servers

From the sound of it, the problem has been contained. And, more importantly, the Red Hat Enterprise Linux (RHEL) production software is not affected at all. The assumption is that RHEL is used for production work and the quickly changing experimental Fedora distro is used for testing, personal workstations, and maybe test servers.

But, I wonder if that is really true? We've probably all seen little servers running on platforms that were never intended for that purpose or are incredibly ancient. You've probably seen isolated ftp servers running on Windows 98 or a small phone system still running on an unpatched Windows NT box. I'd hazard to guess that there are more than a few small or forgotten servers running Fedora because a RHEL license couldn't be obtained in a timely fashion and they didn't know about the CentOS distro.

If you have some examples that can be safely discussed (don't ID the party or otherwise worsen the security problem for the party), please share them here.