devil-linux-develop — developer discussions

Re: [Devil-linux-develop] net-tools compile patch 2.6

[<hzu...@ra...>]

On 01/12/2004 12:24:02 PM Oliver Jehle wrote:
>use the new debian patch set instead of 1.60.8.diff.gz..  fix problem
>for 2.6 and x25
>
>
> - net-tools_1.60-9.diff.gz

Keep on looking, that makes my life so much easier :-))

Thanks

Heiko

Re: [Devil-linux-develop] Re: signed source packages

[<hzu...@ra...>]

On 01/12/2004 12:39:01 PM Friedrich Lobenstock wrote:
>Bruce Smith wrote on 12.01.2004 17:49 MET:
>>>>>>another questions, are there plans to sign the source packages ????
>>>>>>only a litte but important thing :-)
>>>>>
>>>>>Maybe we should at least do md5sums automatically in the update
>script.
>>>>>That should be enough for now I think.
>>>>
>>>>
>>>>Good idea
>>>
>>>Already filed a feature request.
>>>
>>>I think the best way is that we create for eg. archive.tar.bz2
>>>a file archive.tar.bz2.md5sum. This was we can easily automate
>>>the task of checking every file while at the same time decoupling
>>>it from one single ftp maintainer who would create on big md5sum
>>>file for all files.
>>
>>
>> While this is a great idea to ensure the downloads are good, it does
>> nothing to prevent what happened at Debian.  If someone breaks into
>the
>> FTP site, they can easily create a new md5sum file after they change
>the
>> source code.  We really need some kind of a signed file to prevent
>> that.  Or at least keep the md5sum files on a different server.
>
>Than every developer who can upload files to the ftp server needs
>to sign each md5sum file he uploads, right?.
>
>That would mean GPG needs to be installed in the lfs system right
>from the beginning. The kexring can't be in CVS either, so that
>would mean at start a developer has to initialize the keyring with
>all the GPG/PGP public certificates. It always get's more
>complicated...

GPG signing is just too much work, especially the handling of the private
key.
We can't put it in CVS, because otherwise everybody can sign the files.....

What's about this simple idea:
we add a new file to the CVS repository with this format:
filename md5sum

One line per source file.
When we upload a file to the FTP Server, we have to create the checksum and
update the file.
update_src checks the checksum and warns if it is wrong or missing.

Heiko

Re: [Devil-linux-develop] Re: signed source packages

[Bruce S. <bw...@ar...>]

> > While this is a great idea to ensure the downloads are good, it does
> > nothing to prevent what happened at Debian.  If someone breaks into the
> > FTP site, they can easily create a new md5sum file after they change the
> > source code.  We really need some kind of a signed file to prevent
> > that.  Or at least keep the md5sum files on a different server.
> 
> Than every developer who can upload files to the ftp server needs
> to sign each md5sum file he uploads, right?.

Probably be easier than signing the tar files.  :-)

> That would mean GPG needs to be installed in the lfs system right
> from the beginning. 

Or on the host Linux, especially since you can't download the source
from within the LFS chroot anyway.

We could make GPG required on the host Linux, like lftp.

> The kexring can't be in CVS either, 

Why not?  It's a different server.  Different access/passwords, and
if someone changed it, we'd be notified by email on the commit list.

> so that would mean at start a developer has to initialize the keyring
> with all the GPG/PGP public certificates. 

Maybe the keys could be installed on the local system once?

Redhat does it something like that with their RPM's.  You download the
keys once, which are installed on the local Redhat system.  Then RPM
automatically checks the signatures when installing a RPM file.

This is all just theory on my part, since I've never actually setup
anything like this.  Feel free to blow holes in my ideas.

> It always get's more complicated...

I didn't say it would be easy!!!    ;-)
Just pointing out that md5sum does not solve the original concern.

 - BS

[Devil-linux-develop] Re: signed source packages

[Friedrich L. <fl...@fl...>]

Bruce Smith wrote on 12.01.2004 17:49 MET:
>>>>>another questions, are there plans to sign the source packages ????
>>>>>only a litte but important thing :-)
>>>>
>>>>Maybe we should at least do md5sums automatically in the update script.
>>>>That should be enough for now I think.
>>>
>>>
>>>Good idea
>>
>>Already filed a feature request.
>>
>>I think the best way is that we create for eg. archive.tar.bz2
>>a file archive.tar.bz2.md5sum. This was we can easily automate
>>the task of checking every file while at the same time decoupling
>>it from one single ftp maintainer who would create on big md5sum
>>file for all files.
> 
> 
> While this is a great idea to ensure the downloads are good, it does
> nothing to prevent what happened at Debian.  If someone breaks into the
> FTP site, they can easily create a new md5sum file after they change the
> source code.  We really need some kind of a signed file to prevent
> that.  Or at least keep the md5sum files on a different server.

Than every developer who can upload files to the ftp server needs
to sign each md5sum file he uploads, right?.

That would mean GPG needs to be installed in the lfs system right
from the beginning. The kexring can't be in CVS either, so that
would mean at start a developer has to initialize the keyring with
all the GPG/PGP public certificates. It always get's more
complicated...

-- 
MfG / Regards
Friedrich Lobenstock
____________________________________________________________________
Friedrich Lobenstock                       Linux Services Lobenstock
URL: http://www.lsl.at/                         Email: fl...@fl...
____________________________________________________________________

[Devil-linux-develop] net-tools compile patch 2.6

[Oliver J. <oli...@mo...>]

use the new debian patch set instead of 1.60.8.diff.gz..  fix problem
for 2.6 and x25

Re: signed source packages (was Re: [Devil-linux-develop] ISAKMP for kernel 2.6)

[Bruce S. <bw...@ar...>]

> >>>another questions, are there plans to sign the source packages ????
> >>>only a litte but important thing :-)
> >>
> >>Maybe we should at least do md5sums automatically in the update script.
> >>That should be enough for now I think.
> > 
> > 
> > Good idea
> 
> Already filed a feature request.
> 
> I think the best way is that we create for eg. archive.tar.bz2
> a file archive.tar.bz2.md5sum. This was we can easily automate
> the task of checking every file while at the same time decoupling
> it from one single ftp maintainer who would create on big md5sum
> file for all files.

While this is a great idea to ensure the downloads are good, it does
nothing to prevent what happened at Debian.  If someone breaks into the
FTP site, they can easily create a new md5sum file after they change the
source code.  We really need some kind of a signed file to prevent
that.  Or at least keep the md5sum files on a different server.

 - BS

Re: signed source packages (was Re: [Devil-linux-develop] ISAKMP for kernel 2.6)

[Friedrich L. <fl...@fl...>]

hzu...@ra... wrote on 12.01.2004 16:36 MET:
> On 01/12/2004 09:57:57 AM Friedrich Lobenstock wrote:
> 
>>Oliver Jehle wrote on 12.01.2004 15:52 MET:
>>
>>>another questions, are there plans to sign the source packages ????
>>>only a litte but important thing :-)
>>
>>Maybe we should at least do md5sums automatically in the update script.
>>That should be enough for now I think.
> 
> 
> Good idea

Already filed a feature request.

I think the best way is that we create for eg. archive.tar.bz2
a file archive.tar.bz2.md5sum. This was we can easily automate
the task of checking every file while at the same time decoupling
it from one single ftp maintainer who would create on big md5sum
file for all files.

-- 
MfG / Regards
Friedrich Lobenstock
____________________________________________________________________
Friedrich Lobenstock                       Linux Services Lobenstock
URL: http://www.lsl.at/                         Email: fl...@fl...
____________________________________________________________________

[Devil-linux-develop] e2fsprogs patches to compile actual sources kernel 2.6

[Oliver J. <oli...@mo...>]

e2fsprogs didnt compile ... problem with defines

Re: [Devil-linux-develop] Patch for glibc / getgrouplist and glibc/ifaddrs

[Heiko Z. <he...@zu...>]

> getgrouplist patch...  see in the cve.mitre..
> applies ....
>
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0689
>
> another one is for the netlink interface .. but have to check it
> first, didn't apply with my sources... but only to have them on the
> mailing list :-) and not forgot...
>
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0859

I don't know when I get a chance to test the patches, anybody else got time?

-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

[Devil-linux-develop] Patch for glibc / getgrouplist and glibc/ifaddrs

[Oliver J. <oli...@mo...>]

getgrouplist patch...  see in the cve.mitre..
applies ....

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0689

another one is for the netlink interface .. but have to check it
first, didn't apply with my sources... but only to have them on the
mailing list :-) and not forgot...  

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0859

Re: signed source packages (was Re: [Devil-linux-develop] ISAKMP for kernel 2.6)

[<hzu...@ra...>]

On 01/12/2004 09:57:57 AM Friedrich Lobenstock wrote:
>Oliver Jehle wrote on 12.01.2004 15:52 MET:
>>
>> another questions, are there plans to sign the source packages ????
>> only a litte but important thing :-)
>
>Maybe we should at least do md5sums automatically in the update script.
>That should be enough for now I think.

Good idea

Heiko

Re: [Devil-linux-develop] ISAKMP for kernel 2.6

[<hzu...@ra...>]

On 01/12/2004 09:52:03 AM Oliver Jehle wrote:
>whats the roblem with the initrd ??? i think evms.sourceforge.net use it
>for having root-evms volumes or the fedora / redhat distribution..

I don't  know yet. Yesterday I had the first time the Kernel compiling and
it refused to mount the initrd.
One problem is that the support for having the initrd as cramfs, but that
solved.
At the moment it doesn't even like the ext2 version.

But as I said I'm in an early stage, so that doesn't mean anything.

Heiko

Re: signed source packages (was Re: [Devil-linux-develop] ISAKMP for kernel 2.6)

[<hzu...@ra...>]

On 01/12/2004 10:02:32 AM Oliver Jehle wrote:
>that would be a great enhancement :-)
>
>if i remember 2 month ag, the debian distribution...

yeah yeah.... ;-)

Heiko

[Devil-linux-develop] [ devil-linux-Feature Requests-875424 ] add md5sum support to update_src

[SourceForge.net <no...@so...>]

Feature Requests item #875424, was opened at 2004-01-12 16:09
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410646&aid=875424&group_id=34096

Category: Build System
Group: v1.1.x
Status: Open
Priority: 5
Submitted By: Friedrich Lobenstock (friedl)
Assigned to: Nobody/Anonymous (nobody)
Summary: add md5sum support to update_src

Initial Comment:
For a more secure download of the sources create 
md5sum files so each developer can check the integrity 
of the files when downloading them to his development 
system.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410646&aid=875424&group_id=34096

Re: signed source packages (was Re: [Devil-linux-develop] ISAKMP for kernel 2.6)

[Oliver J. <oli...@mo...>]

that would be a great enhancement :-)

if i remember 2 month ag, the debian distribution... 

On Mon, 2004-01-12 at 15:57, Friedrich Lobenstock wrote:
> Oliver Jehle wrote on 12.01.2004 15:52 MET:
> > 
> > another questions, are there plans to sign the source packages ???? 
> > only a litte but important thing :-)
> 
> Maybe we should at least do md5sums automatically in the update script.
> That should be enough for now I think.

signed source packages (was Re: [Devil-linux-develop] ISAKMP for kernel 2.6)

[Friedrich L. <fl...@fl...>]

Oliver Jehle wrote on 12.01.2004 15:52 MET:
> 
> another questions, are there plans to sign the source packages ???? 
> only a litte but important thing :-)

Maybe we should at least do md5sums automatically in the update script.
That should be enough for now I think.

-- 
MfG / Regards
Friedrich Lobenstock
____________________________________________________________________
Friedrich Lobenstock                       Linux Services Lobenstock
URL: http://www.lsl.at/                         Email: fl...@fl...
____________________________________________________________________

Re: [Devil-linux-develop] ISAKMP for kernel 2.6

[Oliver J. <oli...@mo...>]

for the kernel, it makes no difference which tool you use, racoon or
freeswan... 

but i think, porting the existing freeswan package should not be a big
task, you only have to compile the (adapted) sources of the usermode
modules. because freeswan work also on the
2.6-kernel-ipsec-implementation
instead of the old 2.4.x patch (i think the name was klips or so)... 

but if i see, that my racoon will work and is usable, i will try to
also work on a package for freeswan, if needed... or not already done by
a freeswan expert :-)





On Mon, 2004-01-12 at 15:40, hzu...@ra... wrote:
> On 01/12/2004 08:47:07 AM Oliver Jehle wrote:
> >are there any plans which usermode tools should be used with the kernel
> >2.6 and devil linux  ?
> >
> >with kernel 2.6, there are no differences which one you
> >take, only the user mode utilities/deamons differ.
> >
> >i'm using here the kame/racoon port on 2.6 kernels and i'm very happy
> >with it.. its easy, no x509 patching and only a small diff for the
> >makefile then it works.
> >
> >i've also see some postings, that freeswan usermode utilities also
> >work with 2.6 now... and there exists a third one... from openbsd..
> >
> >as soon i have a running devil-linux system, i can make a package for
> >the racoon/kame tools, if someone is interested..
> >
> >but before i will make the work,  i should know if there is an interest
> >in it.. or not...
> 
> I think it's a good idea to implement it.
> 
> Is it possible to have both?
> 
> Heiko
> 
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: Perforce Software.
> Perforce is the Fast Software Configuration Management System offering
> advanced branching capabilities and atomic changes on 50+ platforms.
> Free Eval! http://www.perforce.com/perforce/loadprog.html
> _______________________________________________
> Devil-linux-develop mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-develop

Re: [Devil-linux-develop] ISAKMP for kernel 2.6

[Oliver J. <oli...@mo...>]

whats the roblem with the initrd ??? i think evms.sourceforge.net use it
for having root-evms volumes or the fedora / redhat distribution..

i will try to build a compiling and installing ipsec-tools package for
kame/racoon (http://sourceforge.net/projects/ipsec-tools/)


another questions, are there plans to sign the source packages ???? 
only a litte but important thing :-)





On Mon, 2004-01-12 at 15:40, hzu...@ra... wrote:
> On 01/12/2004 09:22:06 AM Friedrich Lobenstock wrote:
> >Oliver Jehle wrote on 12.01.2004 14:47 MET:
> >>
> >> but before i will make the work,  i should know if there is an
> >interest
> >> in it.. or not...
> >
> >Heiko is currently working on getting 2.6 up and runnning so I think
> >everything you could contribute for 2.6 is interesting.
> 
> Yes, and I will be so happy ones that damned initrd get's loaded..... ;-)
> 
> Heiko
> 
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: Perforce Software.
> Perforce is the Fast Software Configuration Management System offering
> advanced branching capabilities and atomic changes on 50+ platforms.
> Free Eval! http://www.perforce.com/perforce/loadprog.html
> _______________________________________________
> Devil-linux-develop mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-develop

Re: [Devil-linux-develop] ISAKMP for kernel 2.6

[<hzu...@ra...>]

On 01/12/2004 08:47:07 AM Oliver Jehle wrote:
>are there any plans which usermode tools should be used with the kernel
>2.6 and devil linux  ?
>
>with kernel 2.6, there are no differences which one you
>take, only the user mode utilities/deamons differ.
>
>i'm using here the kame/racoon port on 2.6 kernels and i'm very happy
>with it.. its easy, no x509 patching and only a small diff for the
>makefile then it works.
>
>i've also see some postings, that freeswan usermode utilities also
>work with 2.6 now... and there exists a third one... from openbsd..
>
>as soon i have a running devil-linux system, i can make a package for
>the racoon/kame tools, if someone is interested..
>
>but before i will make the work,  i should know if there is an interest
>in it.. or not...

I think it's a good idea to implement it.

Is it possible to have both?

Heiko

Re: [Devil-linux-develop] ISAKMP for kernel 2.6

[<hzu...@ra...>]

On 01/12/2004 09:22:06 AM Friedrich Lobenstock wrote:
>Oliver Jehle wrote on 12.01.2004 14:47 MET:
>>
>> but before i will make the work,  i should know if there is an
>interest
>> in it.. or not...
>
>Heiko is currently working on getting 2.6 up and runnning so I think
>everything you could contribute for 2.6 is interesting.

Yes, and I will be so happy ones that damned initrd get's loaded..... ;-)

Heiko

Re: [Devil-linux-develop] ISAKMP for kernel 2.6

[Friedrich L. <fl...@fl...>]

Oliver Jehle wrote on 12.01.2004 14:47 MET:
> 
> but before i will make the work,  i should know if there is an interest
> in it.. or not... 

Heiko is currently working on getting 2.6 up and runnning so I think
everything you could contribute for 2.6 is interesting.

BTW you only need to check if the license is GPL or some other
kind of opensource license that does not put a limit to the use
of the software that's all we require.

-- 
MfG / Regards
Friedrich Lobenstock
____________________________________________________________________
Friedrich Lobenstock                       Linux Services Lobenstock
URL: http://www.lsl.at/                         Email: fl...@fl...
____________________________________________________________________

[Devil-linux-develop] ISAKMP for kernel 2.6

[Oliver J. <oli...@mo...>]

are there any plans which usermode tools should be used with the kernel
2.6 and devil linux  ? 

with kernel 2.6, there are no differences which one you
take, only the user mode utilities/deamons differ.  

i'm using here the kame/racoon port on 2.6 kernels and i'm very happy
with it.. its easy, no x509 patching and only a small diff for the
makefile then it works. 

i've also see some postings, that freeswan usermode utilities also
work with 2.6 now... and there exists a third one... from openbsd..

as soon i have a running devil-linux system, i can make a package for
the racoon/kame tools, if someone is interested..

but before i will make the work,  i should know if there is an interest
in it.. or not... 

[Devil-linux-develop] [fmII] Linux-VServer 1.23 released (Stable branch)

[<no...@fr...>]

This email is to inform you about the release of version '1.23' of
'Linux-VServer' through freshmeat.net. All URLs and other useful
information can be found at

    http://freshmeat.net/projects/vserver/

The changes in this release are as follows:
This version removes some SMP race conditions between procfs access
and context creation/destruction. It also integrates a new
configuration interface, which enables the user to mask out dangerous
or unwanted procfs entries. 

Project description:
Linux-VServer allows you to create virtual private servers and
security contexts which operate like a normal Linux server, but allow
many independent servers to be run simultaneously in one box at full
speed. All services, such as ssh, mail, Web, and databases, can be
started on such a VPS, without modification, just like on any real
server. Each virtual server has its own user account database and
root password and doesn't interfere with other virtual servers.  

Trove categories:
[Development Status  ] 5 - Production/Stable
[Intended Audience   ] System Administrators
[License             ] OSI Approved, OSI Approved :: GNU General Public
License (GPL)
[Operating System    ] POSIX :: Linux
[Topic               ] Security, System :: Operating System Kernels ::
Linux 

If you would like to cancel subscription to releases of this project,
login to freshmeat.net and choose 'home' from the personal menubar at the
top of the page. You'll be presented with a list of projects and
categories you're subscribed to in the right column, which you may cancel
by highlighting the project or category in question and clicking the
'delete' button.

Sincerely,
freshmeat.net 
 
____________________________| Advertising |____________________________
This email is sponsored by OSDN's Audience Survey. 

Help shape OSDN's sites and tell us what you think.
Take this five minute survey and you could 
win a $250 Gift Certificate.
 

http://www.wrgsurveys.com/2003/osdntech03.php?site=2 
____________________________| Advertising |____________________________

[Devil-linux-develop] [ devil-linux-Bugs-874860 ] update zebra from 0.93a to 0.94

[SourceForge.net <no...@so...>]

Bugs item #874860, was opened at 2004-01-11 13:22
Message generated for change (Comment added) made by friedl
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410643&aid=874860&group_id=34096

Category: Package
Group: all
Status: Open
Resolution: None
Priority: 5
Submitted By: Friedrich Lobenstock (friedl)
>Assigned to: Friedrich Lobenstock (friedl)
Summary: update zebra from 0.93a to 0.94

Initial Comment:
See annoucement from 26.11.2003:
http://freshmeat.net/projects/zebra/?branch_id=12323&release_id=143416

Release focus: Minor security fixes

Changes:
zebra does not listen to other processes' netlink
messages anymore. A "bgp log-neighbor-changes" feature
was added to bgpd. A "set ip next-hop peer-address" was
added. The community delete bug was fixed.
Point-to-Multipoint support was added to ospfd. The
OSPF MD5 authentication bug, the OSPF NSSA bug, and the
NSM event schedule bug were fixed. The Opaque LSA patch
was updated. The ospf6d DR election bug was fixed. The
link-local address is updated on interface creation.
vtysh was updated for IPv6 handling. A vty bug in the
library that caused a daemon crash was fixed.



----------------------------------------------------------------------

>Comment By: Friedrich Lobenstock (friedl)
Date: 2004-01-11 14:01

Message:
Logged In: YES 
user_id=38090

Assigned to me, as Thomas EDER who will do the real work of
testing if it compiles ok after the update, does not (yet)
have a SF user.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410643&aid=874860&group_id=34096

[Devil-linux-develop] [ devil-linux-Bugs-874860 ] update zebra from 0.93a to 0.94

[SourceForge.net <no...@so...>]

Bugs item #874860, was opened at 2004-01-11 13:22
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410643&aid=874860&group_id=34096

Category: Package
Group: all
Status: Open
Resolution: None
Priority: 5
Submitted By: Friedrich Lobenstock (friedl)
Assigned to: Nobody/Anonymous (nobody)
Summary: update zebra from 0.93a to 0.94

Initial Comment:
See annoucement from 26.11.2003:
http://freshmeat.net/projects/zebra/?branch_id=12323&release_id=143416

Release focus: Minor security fixes

Changes:
zebra does not listen to other processes' netlink
messages anymore. A "bgp log-neighbor-changes" feature
was added to bgpd. A "set ip next-hop peer-address" was
added. The community delete bug was fixed.
Point-to-Multipoint support was added to ospfd. The
OSPF MD5 authentication bug, the OSPF NSSA bug, and the
NSM event schedule bug were fixed. The Opaque LSA patch
was updated. The ospf6d DR election bug was fixed. The
link-local address is updated on interface creation.
vtysh was updated for IPv6 handling. A vty bug in the
library that caused a daemon crash was fixed.



----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410643&aid=874860&group_id=34096