Security and Supported packages

[Brian Fahrlander]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Anthony M Simonelli wrote:
> I have a Debian Sarge server at work that we use as a proxy server
> (Squid), an MTA (Postfix) with Spamassassin, and for webmail
> (Squirrelmail).  I would like to replace it with an Ubuntu server
> because of it's predictable and consistent release cycle with up-to-date
> packages that I need like Spamassassin.  I noticed that Squid and
> Postfix are in the main repositories but Spamassassin and Squirrelmail
> are in the universe repository.
> 
> Does this mean that Postfix and Squid will continue to get security
> updates throughout the 18 month life-cycle and Spamassassin and
> Squirrelmail won't?  This is important because Debian supports all of
> their packages with security updates for the entire release and through
> the next.

   I've done the same thing.  In fact, probably this week I'll convert
another FC4 to Ubuntu Dapper.  It's very, very similar, though Redhat's
"upgrade in place" technique has lead a checkered past, and Dapper's
excellent in every way...but one.

   The SA-Update mechanism is sketchy; it's not something you can just
turn on, yet. It's a little bit overcomplicated for me, but NOTHING like
modifying the kernel or hand-wrangling Sendmail without a script.

   And ClamAV (which in Ubuntu is cleverly called, as is spamassassin if
you switch to Postfix, and you probably should) has the annoying habit
of WARNING YOU EVERY DAY THAT YOU'RE THE SLIGHTEST BIT BEHIND. The
Fedora boxes, embarrassingly, are running 88.7; the Ubuntu box, 'cause
no one's given it the priority it needs, is at 88.2.  It complains every
night; I keep hoping that when it comes time to go to 89.0, we'll at
least get a release, then.

   But the whole thing's better organized than Fedora. It's probably
exactly as organized as Debian.  I've come to really like it; Logwatch
does a better job, there are myriad choices for server/alternate/desktop
installs, and life is good, here on Ubuntu.  In fact, it's all I have in
my house, now- one server and five workstations.

    You'll still want to do a "rollback" strategy- not because you'll
need it, but just because (at least under Ubuntu) it's merely a smart
thing to do.  Oh, and LDAP actually works on the first pull, too!  :)
- --
 ------------------------------------------------------------------------
 Brian Fahrländer                 Christian, Conservative, and Technomad
 Evansville, IN                              http://Fahrlander.net/brian
 ICQ: 5119262                         AOL/Yahoo/GoogleTalk: WheelDweller
 ------------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFm4lx6PLtRzZbdhYRAi9+AJ9zEMtqAP8Q1VusQVZsnm7kH6q11ACeL3JR
fZUKnnLgdkXHyepEBY3KUSA=
=WApg
-----END PGP SIGNATURE-----