Re: regarding a fresh ftp install

["STeve Andre'" <andres@msu.edu>]

When a new version of OpenBSD comes out it is by
definition a "release" version.  If you then build your
own copy using the provided tar files, you have a
system where you can apply updates and make your
own -stable system.  The first time you successfully
build your system, you will have something that should
be identical to the release system.  Once you apply
updates and compile, you'll have a "-stable" system.

The SSH bug was last summer, so that means a stock 3.1
release system did indeed have the bug.  By getting the
OpenSSH 3.4 code you could then make your own 3.1
-stable system.

To get to the point where you can make a 3.2-stable system
you need to read the release(8) man page (at least), and the
"upgrade mini-FAQ" section of the FAQ  Actually, taking the
time to read the faq in its entirety would be a good idea.

--STeve Andre'

On Thursday 20 February 2003 18:47, Captain Weenie wrote:
> Quick Question:
>
> after installing via ftp do I have a fresh install of
>
> Stable
>
> or
>
> Release?
>
> If the answer is release - then - is there any way to do an install from
> scratch that will result in a 'Stable' build?
>
> If the answer is Stable - then I'm not quite sure how I still had a
> vulnerable version of ssh on a post patch release ftp install of 3.1. --
> but I did - without a doubt.  :(
>
> my ftp install of 3.1 was done in August -- I would have thought the
> patch would have been rolled into stable by then... so I'm wondering if
> my ftp install is pulling down a release version.
>
> so I have replaced my exploited box - with a fresh ftp install of 3.2
> --- please advise my status - do I need to apply all of the erratta
> currently available for 3.2 - or is it already in my install.
>
> thanks for your time and advise,
>
>    Capt. Weenie
>
>
> ps
> a very special shout to the folks who were behind "server daily
> insecurity output" -- it proved to be timely news of ugly events.  AHO!