Phil Miller's questions

I have a local apt archive with a bunch of packages I built in it. The Packages and Release file are generated by apt-ftparchive. The Release file looks like

Date: Thu, 06 May 2010 23:04:33 UTC
Label: PPL
Origin: PPL
Suite: ppl
MD5Sum:
 ebec3527ebc8351468b2ef8796c19855            37325 Packages
 d41d8cd98f00b204e9800998ecf8427e                0 Release
SHA1:
 a0593b663d77fde88ee35b56ae1f3c17801cfe99            37325 Packages
 da39a3ee5e6b4b0d3255bfef95601890afd80709                0 Release
SHA256:
 dd73a02846aee111cac58a869c6bf650886632ba82c2172ffddd81aa4429981c            37325 Packages
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855                0 Release

I'm using unattended-upgrades to keep the machines in the lab up to date on security and bug fixes, but I'm finding that it doesn't pull from my local archive. The configuration file for it looks like

// Automaticall upgrade packages from these (origin, archive) pairs
Unattended-Upgrade::Allowed-Origins {
    "Ubuntu hardy-security";
    "Ubuntu hardy-updates";
    "PPL ppl";
};

// List of packages to not update
Unattended-Upgrade::Package-Blacklist {
//  "vim";
//  "libc6";
//  "libc6-dev";
//  "libc6-i686";
};

// Send email to this address for problems or packages upgrades
// If empty or unset then no email is sent, make sure that you
// have a working mail setup on your system. The package 'mailx'
// must be installed or anything that provides /usr/bin/mail.
//Unattended-Upgrade::Mail "root@localhost";

Yet, when I run sudo unattended-upgrade on one of these machines, newer package versions don't get installed. Can anyone point out what I'm getting wrong?

Many people (including the Securing Debian Manual) recommend mounting /tmp with the noexec,nodev,nosuid set of options. This is generally presented as one element of a 'defense-in-depth' strategy, by preventing the escalation of an attack that lets someone write a file, or an attack by a user with a legitimate account but no other writable space.

Over time, however, I've encountered arguments (most prominently by Debian/Ubuntu Developer Colin Watson) that noexec is a useless measure, for a couple potential reasons:

1. The user can run /lib/ld-linux.so <binary> in an attempt to get the same effect.
2. The user can still run system-provided interpreters on scripts that can't be run directly

Given these arguments, the potential need for more configuration (e.g. debconf likes an executable temporary directory), and the potential loss of convenience, is this a worthwhile security measure? What other holes do you know of that enable circumvention?

I have to deal with a very poorly loaded out AIX system for a development project. One thing I find missing are utilities common to Linux systems, such as those in the procps collection. Is there a convention on AIX for names or paths under which utilities common from the Linux world would be installed?

For instance, the watch in /usr/sbin/ on AIX is not the watch found on Linux systems. The Linux version runs a command periodically and keeps its most recent output on screen. The AIX version is a privileged auditing/logging tool. I want to know if there's someplace I should look for the Linux version, or if I'd need to build it for myself.

I have a lab full of workstations running Ubuntu 8.04 (Hardy Heron). My predecessors made a hackish bit of cron script to update, upgrade, and clean daily. I like the fact that it requires zero attention, but want to stick as close to distro-supported methods as possible, so future admins can find and understand it easily. Specifically, it seems that there is infrastructure in Ubuntu to do this more cleanly, so I'd rather use that instead. What does this entail?

This question was inspired by this one, which has a decent but scattered answer. What's the bottom line, based on the documentation?