It’s at Practical-tech.com. “So where do I see Caldera really going? I see them buying out some companies by the end of the year. I don’t think they’ll be Linux though. I think Caldera, along with SuSE, will be UnitedLinux’s biggest supporter this side of IBM, they’ll continue to support the SCO Unixes, and they’re going to be working very hard indeed on Volution Internet servers-for e-mail and network administration-and soon to be announced Volution Web Services servers that will be aimed right at resellers working with the SMB market.”

LinuxSecurity Contributors write: “This month’s challenge is to make sense of a seemingly innocuous flurry of UDP packets. LinuxSecurity.com has the summary. On the evening of Feb 15th, three different members of the Honeynet Research Alliance received a flurry of strange UDP packets, that at first look seemed to have no apparent purpose. Congratulations to Dave Turner for winning this month’s challenge.”

Barbara Irwin writes: Version 1.0.1 of the Loads of Linux Links project has been released. Below is the project summary, with relevant links.

WHAT: GPLed Database and software to generate a website with 3000+ subject -classified and searchable Linux links for all levels of Linux users.

WHERE: Loads of Linux Links (LoLL) home page (http://loll.sourceforge.net);
project page (http://sourceforge.net/projects/loll); file release area
(http://sourceforge.net/project/showfiles.php?grou p_id=42381); CVS
repository (http://sourceforge.net/cvs/?group_id=42381), mailing list
(http://lists.sourceforge.net/lists/listinfo/loll- general), and the
generated website (http://loll.sourceforge.net/linux/links) which is the
place to do your Linux searching!

WHY: Provides convenient access to information needed by all levels of Linux
users.

HOW: LoLL GPLed software and data (scripts, configuration files, and a bookmark file that contains the basic link
information), are used in combination with bk2site
(http://bk2site.sourceforge.net) to generate the Loads of Linux Links
website (http://loll.sourceforge.net/linux/links).

WHO: Andrew Willard (willychilly@users.sourceforge.net) and Barbara E. Irwin
(beirwin@users.sourceforge.net).

LinuxJournal: “Open source, although not hyped, was everywhere. A fax server by Morgan Hill, California-based Castelle, basically a black box that acted as a multiuser hub for outgoing and incoming messages, runs Linux. Although the screenshots in the company brochure portray a world full of Windows, Tux is running the show…” Read more here.

LinuxWorld: “Despite his personal preference for GNOME/GTK and the shortcomings of current KDE applications, Nicholas Petreley explains why KDE/Qt developers are likely to outbattle GNOME/GTK developers in the quest for mainstream desktop applications.”

Advogato: ” Some consider it rite of passage to have a Debian-based system. This is not only because it’s the true GNU Linux, but perhaps also because it has a reputation of being hard to install. Whether it deserves this reputation or not, there is a certain coolness and mystique associated with Debian as the completely open-source distribution. This attracts hackers, but is Debian the right system for a hacker? Or is Debian merely an unfortunate hurdle for a would-be Linux hacker?” Read more here.

Conectiva: “ISS published an advisory concerning a remote vulnerability in OpenSSH that could be used by remote attackers to obtain root privileges on the server where OpenSSH is running… To minimize the impact of this vulnerability the 3.3p1 version of OpenSSH has been made available previously. That version, which still has this vulnerability, implements by default the PrivilegeSeparation mechanism which greatly reduces the impact of this and potential future vulnerabilities in OpenSSH.”

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : openssh
SUMMARY   : Remote vulnerability in openssh 
DATE      : 2002-06-28 15:27:00
ID        : CLA-2002:502
RELEVANT
RELEASES  : 6.0, 7.0, 8

- -------------------------------------------------------------------------

DESCRIPTION
 OpenSSH[1] is a very popular and versatile tool that uses encrypted
 connections between hosts and is commonly used for remote
 administration.
 
 ISS[5] published[4] an advisory concerning a remote vulnerability in
 OpenSSH that could be used by remote attackers to obtain root
 privileges on the server where OpenSSH is running.
 
 The vulnerability is present in two authentication mechanisms:
 ChallengeResponse and PAMAuthenticationViaKbdInt. If these mechanisms
 are not necessary in your installation, they can be disabled by the
 following entries in /etc/ssh/sshd_config:
 
 ChallengeResponseAuthentication no
 PAMAuthenticationViaKbdInt no
 
 Please note that any changes made to the sshd_config file require a
 service restart to be effective.
 
 To minimize the impact of this vulnerability the 3.3p1 version of
 OpenSSH has been made available previously[2]. That version, which
 still has this vulnerability, implements by default the
 PrivilegeSeparation mechanism which greatly reduces the impact of
 this and potential future vulnerabilities in OpenSSH. The 3.4p1
 version of OpenSSH has now been made available and it includes fixes
 for the reported vulnerabilities.
 
 Even though the vulnerability is fixed in version 3.4p1, users are
 still advised to keep using the PrivilegeSeparation feature. There
 are, though, still a few problems with certain authentication methods
 and PrivilegeSeparation that are expected to be solved in future
 releases. Whenever appropriate, new packages will be provided as
 bugfix advisories. In particular, the packages provided here contain
 a patch from Solar Designer (from the Openwall Project[4]) which
 allows the use of PrivilegeSeparation together with data compression
 in 2.2 kernels. Next releases might not need this patch anymore.
 
 If for some reason the use of PrivilegeSeparation is not possible in
 some setup, it can be disabled via the following entry in
 /etc/ssh/sshd_config:
 
 UsePrivilegeSeparation no


SOLUTION
 It is recommended that all OpenSSH users upgrade their packages.
 
 The ssh service will be automatically restarted during the upgrade if
 it is already running. Current ssh sessions will remain open during
 the restart.
 
 
 REFERENCES
 1.http://www.openssh.com
2.http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000500
3.http://www.cert.org/advisories/CA-2002-18.html
4.http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20584

5.http://www.iss.net/
6.http://www.openwall.com/Owl/


DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/openssh-3.4p1-1U60_1cl.src.rpmftp://atualizacoes.conectiva.com.br/6.0/RPMS/openssh-3.4p1-1U60_1cl.i386.rpmftp://atualizacoes.conectiva.com.br/6.0/RPMS/openssh-askpass-3.4p1-1U60_1cl.i386.rpmftp://atualizacoes.conectiva.com.br/6.0/RPMS/openssh-askpass-gnome-3.4p1-1U60_1cl.i386.rpmftp://atualizacoes.conectiva.com.br/6.0/RPMS/openssh-clients-3.4p1-1U60_1cl.i386.rpmftp://atualizacoes.conectiva.com.br/6.0/RPMS/openssh-server-3.4p1-1U60_1cl.i386.rpmftp://atualizacoes.conectiva.com.br/7.0/SRPMS/openssh-3.4p1-1U70_1cl.src.rpmftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssh-3.4p1-1U70_1cl.i386.rpmftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssh-askpass-3.4p1-1U70_1cl.i386.rpmftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssh-askpass-gnome-3.4p1-1U70_1cl.i386.rpmftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssh-clients-3.4p1-1U70_1cl.i386.rpmftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssh-server-3.4p1-1U70_1cl.i386.rpmftp://atualizacoes.conectiva.com.br/8/SRPMS/openssh-3.4p1-1U8_1cl.src.rpmftp://atualizacoes.conectiva.com.br/8/RPMS/openssh-3.4p1-1U8_1cl.i386.rpmftp://atualizacoes.conectiva.com.br/8/RPMS/openssh-askpass-3.4p1-1U8_1cl.i386.rpmftp://atualizacoes.conectiva.com.br/8/RPMS/openssh-askpass-gnome-3.4p1-1U8_1cl.i386.rpmftp://atualizacoes.conectiva.com.br/8/RPMS/openssh-clients-3.4p1-1U8_1cl.i386.rpmftp://atualizacoes.conectiva.com.br/8/RPMS/openssh-server-3.4p1-1U8_1cl.i386.rpm


ADDITIONAL INSTRUCTIONS
 Users of Conectiva Linux version 6.0 or higher may use apt to perform 
 upgrades of RPM packages:
 - add the following line to /etc/apt/sources.list if it is not there yet
   (you may also use linuxconf to do this):

 rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates

(replace 6.0 with the correct version number if you are not running CL6.0)

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en


- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br

eWeek reports that “The Open Source Development Lab Inc. (OSDL) Friday announced that it is making progress on the road to a Carrier-Grade Linux (CGL) specification, including a new white paper, a requirements definition and a new developer site.”

Anonymous Reader writes: “PCWorld gives a favorable review of Lycoris Desktop/LX. http://www.idg.net/ic_879479_1794_9-10000.html
Excerpt: ‘Looking for an inexpensive, simple-to-use alternative to the Windows operating system? Linux may leap to mind, but since Corel abandoned its effort, no vendor has concentrated strictly on making Linux friendly enough for newbies. Now, the $30 Desktop/LX distribution from upstart Lycoris demonstrates that Microsoft’s monopoly on friendly operating systems for the PC could be coming to a close.’ It’s nice to see broader audience print magazine’s like PCWorld taking an interest in what’s happening on the Linux desktop.”

C|Net’s News.com has a story saying Egenera, which makes high-end specialized Linux servers, has received $44 million from earlier investors in a third round of funding.