I have recently started a new position in a relatively small company and taken lead position on the Linux/UNIX side of things (and windows server/AD etc, but that is beside the point) in our company (before there was one guy who did absolutely everything ICT related). He is still with us and kinda my equal, but now allowed to concentrate more on the network side of things which he is probably; at least with regards experience, my superior; while I take greatest responsibility for the Linux/UNIX/Windows/(general systems and applications) side of things, (and network while/whenever he is away).
Many years ago before I joined he set up a Debian mail server (and several other internal/DMZ nodes) for our company, but due to time constraints simply did not have enough hours in the day to keep on top of updates and security for these (blame our boss; to be fair to my colleague, given the time available and knowledge he had at the time I think he did a damn good job of setting these servers up). Many years passed and eventually I took over lead for these nodes and decided to do a preliminary penetration test on the systems I now inherited responsibility over. I was able to remotely exploit bash ShellShock and show proof of concept exploits of a couple other known issues within very little time, tens of minutes in fact.
The most important of these servers is our main mail server, and most of the others in question, which are very old (version 3 I think) of Debian Linux, which there is no longer support or active repositories for (I have since set up secondaries running in parallel running on FreeBSD which are for most intents and purposes to be considered secure, but due to the rather complex setup my colleague had implemented, have not been able to completely replace).
My question is; I shall probably have to build packages such as bash and openssl and the like which have had major security holes found in them over the last few months/years, from source, as Debian have not for some time released patches for these systems and replacing them entirely is too time consuming to not have a temporary fix in place for the meantime; where would be the best place to:
- find which packages have had major security holes over the past few years,
- get source code to build them from,
- how to build them to avoid dependency issues (no compiler on nodes in question so shall have to cross-compile from another system, probably statically with inbuilt dependencies),
- how to properly test everything afterwards to make sure it works as expected and at least is no longer open to all but the most determined of intruders (I can pen test myself but realise there are several years of holes to explore).
I am mostly a Gentoo and FreeBSD user myself so haven't really kept up to date properly on Debian knowledge, but am a very experienced Linux/UNIX user in general with a good bit of programming experience, but want to be sure I don't overlook anything before potentially bricking our main mail server and several of our internal use servers.