devil-linux-develop — developer discussions

Re: [Devil-linux-develop] 1.0RC1 - Notes from installation.

[Heiko Z. <he...@zu...>]

Dean Nedelman wrote:

>1) Memtest works!  Though I couldn't use 'M' (as the option indicated), but
>rather 'm'.
>
fixed

>2) For some reason, I can no longer scroll backwards through the console
>messages on VC/1.  I noticed this when I wanted to scroll back and get a
>GRSec error and couldn't. I am using the "default" (non-framebuffer) option
>on boot
>
SHIFT + PGUP doesn't work?
I just checked it on VMWare, it worked fine.
Unfortunately I don't have any computers which don't support the VESA mode.

>3) I am still getting the grsec resource errors.  I believe they are comming
>from /etc/sysconfig/network/scripts/dhcpcd.exe - and yes, even if I use the
>distrubted one:
>
>Starting DHCP client daemon on interface eth0
>grsec: attempted resource overstep by requesting 37695488 for RLIMIT_STACK
>against limit 8388608 by (pidof:381) UID(0) EUID(0), parent (S05network:370)
>UID(0) EUID(0)
>grsec: attempted resource overstep by requesting 77271040 for RLIMIT_STACK
>against limit 8388608 by (pidof:381) UID(0) EUID(0), parent (S05network:370)
>UID(0) EUID(0)
>
I don't use DHCP and I couldn't reproduce the problem with my test config.
Can you send me your /etc/dhcpd.conf ?

>4) ClamAV fails with the following errors when I try to start it:
>Updating ClamAV Virus signatures:
>ERROR: LOGGER: Can't open file /var/log/clam-update.log to write.
>ERROR: Problem with internal logger
>
>For what its worth, I do have LogFileMaxSize set to 2M - but that shouldn't
>be an issue.
>
fixed in CVS
edit the file /etc/sysconfig/permissions.base and add the line
/var/log                        root.root        0777

>
>5) Starting SAGATOR fails with:
>
>creating chroot jail for SAGATOR.....cp: writting
>`/var/spool/vscan/lib/libc-2.3.2.so': No space left on device
>And similar cp: errors for another 9 files
>...
>.sed: Couldn't flush stdout: No space left on device
>Warning: no source refers to internal message, they'll go to /dev/null
>
You need more RAM. ;-)

>I noticed that when I do a df command, I get:
>Filesystem	1K-blocks	Used	Available	Use%	Mounted
>rootfs		292032		292032	0		100%	/
>/dev/hdb	292032		292032	0		100%	/
>shmfs		30832		30832	0		100%	/shm
>
>Interestingly, no messages from the Kernel about being out of space.
>
>(Since the above results from df came AFTER the errors from ClamAV and
>SAGATOR, I did a reboot and a fresh df (following the POSTFIX startup) and
>got this:
>Filesystem	1K-blocks	Used	Available	Use%	Mounted
>...
>shmfs		30832		20164	10668		66%	/shm
>)
>  
>
Since the shmfs was eating up more space then it should have, we (I) 
switched to the default which is RAM / 2
You really should upgrade to at least 128 MB, this helps a lot. ;-)

>6) PowerOFF WORKED!
>  
>
Finally!
This time I would have mailed you a bomb or something... ;-)

cya
  Heiko

[Devil-linux-develop] 1.0RC1 - Notes from installation.

[Dean N. <De...@Ti...>]

1) Memtest works!  Though I couldn't use 'M' (as the option indicated), but
rather 'm'.

2) For some reason, I can no longer scroll backwards through the console
messages on VC/1.  I noticed this when I wanted to scroll back and get a
GRSec error and couldn't. I am using the "default" (non-framebuffer) option
on boot

3) I am still getting the grsec resource errors.  I believe they are comming
from /etc/sysconfig/network/scripts/dhcpcd.exe - and yes, even if I use the
distrubted one:

Starting DHCP client daemon on interface eth0
grsec: attempted resource overstep by requesting 37695488 for RLIMIT_STACK
against limit 8388608 by (pidof:381) UID(0) EUID(0), parent (S05network:370)
UID(0) EUID(0)
grsec: attempted resource overstep by requesting 77271040 for RLIMIT_STACK
against limit 8388608 by (pidof:381) UID(0) EUID(0), parent (S05network:370)
UID(0) EUID(0)

4) ClamAV fails with the following errors when I try to start it:
Updating ClamAV Virus signatures:
ERROR: LOGGER: Can't open file /var/log/clam-update.log to write.
ERROR: Problem with internal logger

For what its worth, I do have LogFileMaxSize set to 2M - but that shouldn't
be an issue.

5) Starting SAGATOR fails with:

creating chroot jail for SAGATOR.....cp: writting
`/var/spool/vscan/lib/libc-2.3.2.so': No space left on device
And similar cp: errors for another 9 files
...
.sed: Couldn't flush stdout: No space left on device
Warning: no source refers to internal message, they'll go to /dev/null

I noticed that when I do a df command, I get:
Filesystem	1K-blocks	Used	Available	Use%	Mounted
rootfs		292032		292032	0		100%	/
/dev/hdb	292032		292032	0		100%	/
shmfs		30832		30832	0		100%	/shm

Interestingly, no messages from the Kernel about being out of space.

(Since the above results from df came AFTER the errors from ClamAV and
SAGATOR, I did a reboot and a fresh df (following the POSTFIX startup) and
got this:
Filesystem	1K-blocks	Used	Available	Use%	Mounted
...
shmfs		30832		20164	10668		66%	/shm
)

6) PowerOFF WORKED!

[Devil-linux-develop] new version number scheme for DL

[Heiko Z. <he...@zu...>]

Howdy !

now it's time to do it like many other Opensource groups:
The development release will be 1.1 and the next official release will 
be 1.2.

Updates for 1.0 will be 1.0.1, 1.0.2 and so on.

cya
  Heiko

[Devil-linux-develop] don't use update_src after CVS update !

[Heiko Z. <he...@zu...>]

Howdy folks !

don't use update_src after CVS update !
I already changed the version number in the script to 1.1, but our 
Server Admin (Gunther)  needs to copy the folder first.

cya
  Heiko

Re: [Devil-linux-develop] Different release download options.

[Heiko Z. <he...@zu...>]

Diego Torres wrote:

>On Tue, Oct 07, 2003 at 01:47:42PM -0400, Bruce Smith wrote:
>
>  
>
>>Combined patch for 2.4.22, with all of the following:
>>
>>  Bootsplash
>>    
>>
>
>at last! :)) a patch with bootsplash that surely will go mainline...
>
>  
>
Will it ? In 2.6 ?
One more reason to include it.

Heiko

Re: [Devil-linux-develop] Different release download options.

[Diego T. <dt...@co...>]

On Tue, Oct 07, 2003 at 01:47:42PM -0400, Bruce Smith wrote:

> Combined patch for 2.4.22, with all of the following:
> 
>   Bootsplash

at last! :)) a patch with bootsplash that surely will go mainline...


-- 
-- gnupg keyfingerprint -- 48AF 5BF9 8F54 2966 64CC  2327 7CD0 DD91 B09D 5799
-- Use of a keyboard or mouse may be linked to serious injuries or disorders.  
Diego Torres - dt...@co... - Madrid / España

Re: [Devil-linux-develop] Different release download options.

[Heiko Z. <hz...@pr...>]

On 10/07/2003 05:09:27 PM Bruce Smith wrote:
>> > We probably should (right now) add the feature of loading differen=
t
>> > "profiles" or "preconfigured options" to the menuconfig.
>> > This way we could make sure, it's every time the same and we dont'=

>forgett
>> > anything.
>>
>> Yes, except we need to create those profiles first ...
>>
>> I just got done removing most of the stuff that is not useful for a
>> firewall (servers, compilers, email, ...) and am running a fresh
>compile
>> to see the size of the resulting ISO.
>>
>> I'll be interesting to see how small of a USB stick is required for =
a
>> firewall like this.  Getting it under 256MB shouldn't be a problem.
>> Under 128MB would be great, but I'm not real hopeful.
>
>Wow, if I did the math right, this is just under 128MB!!!  :-)

Until the next DL release ;-)

>-rw-r--r--    1 root     root     133332992 Oct  7 15:51 bootcd.iso
>
>My .config file is attached if you want to see my selections.

For a pure firewall, you could reduce it even more.
I.e. No man pages and no documentation.
I'm pretty sure you can also remove some more binaries.

cya
  Heiko
=

Re: [Devil-linux-develop] Different release download options.

[Bruce S. <bw...@ar...>]

> > We probably should (right now) add the feature of loading different
> > "profiles" or "preconfigured options" to the menuconfig.
> > This way we could make sure, it's every time the same and we dont' forgett
> > anything.
> 
> Yes, except we need to create those profiles first ...
> 
> I just got done removing most of the stuff that is not useful for a
> firewall (servers, compilers, email, ...) and am running a fresh compile
> to see the size of the resulting ISO.
> 
> I'll be interesting to see how small of a USB stick is required for a
> firewall like this.  Getting it under 256MB shouldn't be a problem. 
> Under 128MB would be great, but I'm not real hopeful.

Wow, if I did the math right, this is just under 128MB!!!  :-)

-rw-r--r--    1 root     root     133332992 Oct  7 15:51 bootcd.iso

My .config file is attached if you want to see my selections.

 - BS

[Devil-linux-develop] [ devil-linux-Feature Requests-819578 ] add imq

[SourceForge.net <no...@so...>]

Feature Requests item #819578, was opened at 2003-10-07 16:03
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410646&aid=819578&group_id=34096

Category: Base System
Group: None
Status: Open
Priority: 5
Submitted By: Heiko Zuerker (smiley73)
Assigned to: Nobody/Anonymous (nobody)
Summary: add imq

Initial Comment:
>>- IMQ.  http://trash.net/~kaber/imq/faq.html
>
>I took a look at the sources, they didn't get updated 
since
>kernel 2.4.21
>Does is still work, or is it not well maintained ?

Didn't try on .22
Just googled it and seems the patch works.
http://www.spinics.net/lists/lartc/msg09873.html


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410646&aid=819578&group_id=34096

[Devil-linux-develop] [ devil-linux-Feature Requests-819464 ] Add Postgresql and MySQL servers.

[SourceForge.net <no...@so...>]

Feature Requests item #819464, was opened at 2003-10-07 14:30
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410646&aid=819464&group_id=34096

Category: Base System
Group: Next Release
Status: Open
Priority: 5
Submitted By: Bruce Smith (blubdog)
Assigned to: Nobody/Anonymous (nobody)
Summary: Add Postgresql and MySQL servers.

Initial Comment:
Add PostgreSQL and MySQL server backends (not just
clients).

http://www.postgresql.org/
http://www.mysql.com/

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410646&aid=819464&group_id=34096

[Devil-linux-develop] [ devil-linux-Feature Requests-819456 ] add Apache and PHP

[SourceForge.net <no...@so...>]

Feature Requests item #819456, was opened at 2003-10-07 14:23
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410646&aid=819456&group_id=34096

Category: None
Group: None
Status: Open
Priority: 5
Submitted By: Bruce Smith (blubdog)
Assigned to: Nobody/Anonymous (nobody)
Summary: add Apache and PHP

Initial Comment:
Add the Apache web server, and the PHP server side
scripting language.
http://www.apache.org/   http://www.php.net/

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410646&aid=819456&group_id=34096

[Devil-linux-develop] [ devil-linux-Feature Requests-819454 ] add both XFS and grsecurity

[SourceForge.net <no...@so...>]

Feature Requests item #819454, was opened at 2003-10-07 14:21
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410646&aid=819454&group_id=34096

Category: Base System
Group: Next Release
Status: Open
Priority: 5
Submitted By: Bruce Smith (blubdog)
Assigned to: Nobody/Anonymous (nobody)
Summary: add both XFS and grsecurity

Initial Comment:
http://members.optusnet.com.au/ckolivas/kernel/
has a combined patch for the current kernel with both
XFS and grsecurity, including all of the following options:

  O(1) + Batch scheduler
  Preemptible - enable this in kernel config
  Low latency - enable this in kernel config 
  Variable Hz
  Supermount-NG
  XFS file system
  Bootsplash
  Gr Security
  Andrea Arcangeli's VM patches
  Rik Van Riel's rmap


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410646&aid=819454&group_id=34096

RE: [Devil-linux-develop] Different release download options.

[Dean N. <di...@ti...>]

>
>I just got done removing most of the stuff that is not useful for a
>firewall (servers, compilers, email, ...) and am running a fresh compile
>to see the size of the resulting ISO.
>
>I'll be interesting to see how small of a USB stick is required for a
>firewall like this.  Getting it under 256MB shouldn't be a problem.
>Under 128MB would be great, but I'm not real hopeful.

I support the concept (see my previous emails commenting that the size of
Devil-Linux was starting to be a problem - especially when we considered USB
pen drives), but I would suggest that Postfix server be included.

As I have previously commented, I use only DHCP, IPTables, and Postfix (plus
various other utilities).  (I want to use ClamAV and SAGATOR - but I haven't
tried RC1 yet to see if I can get them to fit into 64MB).  I can easily see
that being a "standard" configuration for most people.

One of the things that can be done (and that I actually do) is to strip a
lot of the sample configuration files (especially from the Postfix
directory!) from the etc.tar.bz2 that I create.  We may want to consider
distributing a "full" etc.tar.bz2 containing all of the sample files, and
striped down version.  Of course, I say that because I build and maintain my
Devil-Linux configuration on another box....

Dean Nedelman
TimeLord Consulting

Re: [Devil-linux-develop] Different release download options.

[Heiko Z. <hz...@pr...>]

On 10/07/2003 01:47:42 PM Bruce Smith wrote:
>> >Is there going to be another option with XFS?
>>
>>  When you fix the XFS part ...
>
>Here you go:
>
>http://members.optusnet.com.au/ckolivas/kernel/
>
>Combined patch for 2.4.22, with all of the following:
>
>O(1) + Batch scheduler
>Preemptible - enable this in kernel config
>Low latency - enable this in kernel config
>Variable Hz
>Supermount-NG
>XFS file system
>Bootsplash
>Gr Security
>Andrea Arcangeli's VM patches
>Rik Van Riel's rmap
>
>
>That was easy!  :-)

Wow cool !

Document that on sf.net as feature request.
As soon as we start working on 1.1, we'll include it
(I most likely create a CVS branch this week).

cya
  Heiko
=

Re: [Devil-linux-develop] Different release download options.

[Bruce S. <bw...@ar...>]

> >Is there going to be another option with XFS?
>
>  When you fix the XFS part ...

Here you go:  

http://members.optusnet.com.au/ckolivas/kernel/

Combined patch for 2.4.22, with all of the following:

  O(1) + Batch scheduler
  Preemptible - enable this in kernel config
  Low latency - enable this in kernel config 
  Variable Hz
  Supermount-NG
  XFS file system
  Bootsplash
  Gr Security
  Andrea Arcangeli's VM patches
  Rik Van Riel's rmap


That was easy!  :-)

 - BS

Re: [Devil-linux-develop] Different release download options.

[Bruce S. <bw...@ar...>]

> >I don't mind compiling/maintaining/uploading some of these versions if
> >you'd like me to.  All we need to make sure our code is exactly the same
> >for the compiles.
> 
> We probably should (right now) add the feature of loading different
> "profiles" or "preconfigured options" to the menuconfig.
> This way we could make sure, it's every time the same and we dont' forgett
> anything.

Yes, except we need to create those profiles first ...

I just got done removing most of the stuff that is not useful for a
firewall (servers, compilers, email, ...) and am running a fresh compile
to see the size of the resulting ISO.

I'll be interesting to see how small of a USB stick is required for a
firewall like this.  Getting it under 256MB shouldn't be a problem. 
Under 128MB would be great, but I'm not real hopeful.

 - BS

Re: [Devil-linux-develop] Different release download options.

[Heiko Z. <hz...@pr...>]

On 10/07/2003 01:12:17 PM Bruce Smith wrote:
>> >Is there going to be another option with XFS?
>>
>> When you fix the XFS part and create this version
>
>Is XFS broken, or is grsecurity broken?
>Or do they both point their fingers at each other?  :-)

The problem is both modify the same files so they break eachother.
I would say it's a grsecurity problem, because XFS is bigger and longer=
 on
the market, but my voice doesn't count. ;-)

>> >A stripped down one for smaller USB memory sticks?
>>
>> When yours is too small, get an enlargement. ;-)
>
>Yeah, I'll have to start paying closer attention to my spam.  :-)

Yeah. *lol*

>I don't mind compiling/maintaining/uploading some of these versions if=

>you'd like me to.  All we need to make sure our code is exactly the sa=
me
>for the compiles.

We probably should (right now) add the feature of loading different
"profiles" or "preconfigured options" to the menuconfig.
This way we could make sure, it's every time the same and we dont' forg=
ett
anything.

cya
  Heiko
=

Re: [Devil-linux-develop] Different release download options.

[Bruce S. <bw...@ar...>]

> >Is there going to be another option with XFS?
> 
> When you fix the XFS part and create this version

Is XFS broken, or is grsecurity broken?
Or do they both point their fingers at each other?  :-)

> >A stripped down one for smaller USB memory sticks?
> 
> When yours is too small, get an enlargement. ;-)

Yeah, I'll have to start paying closer attention to my spam.  :-)

I don't mind compiling/maintaining/uploading some of these versions if
you'd like me to.  All we need to make sure our code is exactly the same
for the compiles.

 - BS

[Devil-linux-develop] [ devil-linux-Bugs-819423 ] ignoreip patch for djbdns

[SourceForge.net <no...@so...>]

Bugs item #819423, was opened at 2003-10-07 12:07
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410643&aid=819423&group_id=34096

Category: Package
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Heiko Zuerker (smiley73)
Assigned to: Nobody/Anonymous (nobody)
Summary: ignoreip patch for djbdns

Initial Comment:
http://tinydns.org//djbdns-1.05-ignoreip.patch

This patch changes djbdns's dnscache program so that 
it will ignore the
IP address given in the IGNOREIP environment variable.  
I wrote this
patch because of Verisign's oh-so helpful wildcard A 
records for *.COM
and *.NET.  Install the patch like this:
    patch <djbdns-1.05-ignoreip.patch
    svc -d /service/dnscache
    make setup check
    svc -u /service/dnscache

Configure it to ignore Verisign's wildcard record like this:
    echo 64.94.110.11 >/service/dnscache/env/IGNOREIP
    svc -t /service/dnscache

If IGNOREIP isn't found in the environment variable 
space, nothing is
ignored.



----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410643&aid=819423&group_id=34096

[Devil-linux-develop] [ devil-linux-Feature Requests-819417 ] add tarpd

[SourceForge.net <no...@so...>]

Feature Requests item #819417, was opened at 2003-10-07 11:59
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410646&aid=819417&group_id=34096

Category: Packages
Group: None
Status: Open
Priority: 5
Submitted By: Heiko Zuerker (smiley73)
Assigned to: Nobody/Anonymous (nobody)
Summary: add tarpd

Initial Comment:
Would be nice to have ....

http://www.cs.hut.fi/~tricky/utils/net/tarpd-1.6.tar.gz

Is a very small arp 'proxy' ....

You can use this to 'bridge' ip's over a secure tunnel.

Taco


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410646&aid=819417&group_id=34096

Re: [Devil-linux-develop] Different release download options.

[Heiko Z. <hz...@pr...>]

On 10/07/2003 11:51:23 AM Bruce Smith wrote:
>> >Back to the original question, any reason not to compile for i586 a=
s
>the
>> >minimum?
>>
>> Yes :
>http://www.devil-linux.org/poll/test.php?action=3Dresults&poll_id=3D13=

>>
>> My plan was to release for the final version a i486 and a i686-SMP.
>> I just didn't want to bother for the Release Candidates.
>
>OK.
>
>Is there going to be another option with XFS?

When you fix the XFS part and create this version

>A stripped down one for smaller USB memory sticks?

When yours is too small, get an enlargement. ;-)

cya
  Heiko
=

Re: [Devil-linux-develop] Different release download options.

[Bruce S. <bw...@ar...>]

> >Back to the original question, any reason not to compile for i586 as the
> >minimum?
> 
> Yes : http://www.devil-linux.org/poll/test.php?action=results&poll_id=13
> 
> My plan was to release for the final version a i486 and a i686-SMP.
> I just didn't want to bother for the Release Candidates.

OK.  

Is there going to be another option with XFS?

A stripped down one for smaller USB memory sticks?

...  :-)

 - BS

Re: [Devil-linux-develop] Different release download options.

[Heiko Z. <hz...@pr...>]

On 10/07/2003 11:28:10 AM Bruce Smith wrote:
>Back to the original question, any reason not to compile for i586 as t=
he
>minimum?

Yes : http://www.devil-linux.org/poll/test.php?action=3Dresults&poll_id=
=3D13

My plan was to release for the final version a i486 and a i686-SMP.
I just didn't want to bother for the Release Candidates.

Heiko
=

Re: [Devil-linux-develop] Different release download options.

[Bruce S. <bw...@ar...>]

> I see the new 1.0RC1 is compiled for i486.  Is there really anyone left
> in this world with a 486?  I've seen complete Pentium machines (P5-200)
> sell for $20 consistently, and have even seen them as low as $5 (USD).
> 
> It would be fine with me if we upped the requirement to i586.  Maybe I
> should ask this question on the discuss list to see if anyone is still
> running a 486?
> 
> Or, is the problem the old AMD chips?  Will a K6 chip run software
> compiled for a 586?

After asking the last question about AMD, I got thinking.  Mandrake is a
586 & above distribution, so I went over to their web site.  It says:

  Processor:  an x586-class or above processor is required. 
  This includes Intel Pentium I/II/III/IV, AMD K6/II/III, AMD Duron, 
  AMD Athlon/XP/MP. Multi-processor machines are supported. (*)

Back to the original question, any reason not to compile for i586 as the
minimum?

 - BS

[Devil-linux-develop] Different release download options.

[Bruce S. <bw...@ar...>]

I see the new 1.0RC1 is compiled for i486.  Is there really anyone left
in this world with a 486?  I've seen complete Pentium machines (P5-200)
sell for $20 consistently, and have even seen them as low as $5 (USD).

It would be fine with me if we upped the requirement to i586.  Maybe I
should ask this question on the discuss list to see if anyone is still
running a 486?

Or, is the problem the old AMD chips?  Will a K6 chip run software
compiled for a 586?

 - BS