October 2014 - luv-main

the POODLE attack
by Aníbal Monsalve Salazar 15 Oct '14

15 Oct '14

https://www.openssl.org/~bodo/ssl-poodle.pdf http://www.infoq.com/news/2014/10/google-ssl3 online test: https://www.poodletest.com/ Daniel Silverstone suggests: recommended actions = disable SSLv3 in browser, and disable SSLv3 in apache, same for dovecot if your Exim4 is compiled against gnutls, you want something like: tls_require_ciphers = NORMAL:-VERS-SSL3.0 to test that: gnutls-cli -s --priority NONE:+VERS-SSL3.0 --port 25 my.server EHLO me STARTTLS ^D should fail if you don't put the --priority blah, then you should get: - Version: TLS1.2

1 0

Re: How many people have actually tried systemd ?
by Peter Ross 15 Oct '14

15 Oct '14

"Brian May" <brian(a)microcomaustralia.com.au> wrote. > Sometimes a daemon will hang badly, and the init.d script won't kill it, > and killing one process leaves the other processes running. So you have to > go in by hand and kill -9 every process. Under FreeBSD I have a service in a jail and run /etc/rc.d/jail stop <jailname> It kills all processes in the jail using "jail -r". While I find "cgcreate" and "cgexec" I cannot find the "destroyer" but I am sure there is one. "http://www.linux.com/news/featured-blogs/200-libby-clark/733595-all-about-t…" "Systemd and cgroup developers are working together to turn systemd into a global cgroup manager that creates higher-level control knobs and prevents direct access to the kernel." FreeBSD is using rctl for resource control (not for jails only), and devfs.rules for access to devices (if needed). The standard rules for a jail have a handful of devices only "unhidden" (dev/stdin,stdout,zero, null etc.) It all goes down into a few well-defined areas of the kernel and the same controls exist inside and outside a jail. A handful of sysctls are added to define security of a jail further. >From above: "What’s the Issue?" The problem is that cgroups were often built independently of the developers most familiar with the kernel subsystems they interact with. “This is partly because cgroup tends to add complexity and overhead to the existing subsystems and building and bolting something on the side is often the path of the least resistance,” said Tejun Heo, Linux kernel cgroup subsystem maintainer. “Combined with the fact that cgroup has been exploring new areas without firm established examples to follow, this led to some questionable design choices and relatively high level of inconsistency.” --- No, you are not allowed to look at FreeBSD's jail design;-) --- Cgroup is made of two parts: the cgroup core creates a hierarchical classification of processes running on the system, while a set of 13 controllers link the core with the kernel subsystems. The memory controller, for example, limits the amount of memory a group of processes can allocate from the system, the block controller can limit the bandwidth to the disk input/output, and so on. Kernel developers are now working to fix these issues by implementing a single unified hierarchy in the cgroup core and improving consistency among the controllers. But because of the patchwork nature of the subsystem and the need to ensure backward compatibility, they won’t be able to completely stop this abuse. That’s where systemd, and any other control agents that may emerge, comes in. --- Shudder.. How safe can this design be? Instead of getting the design right first time (instead "bolting something on the side is often the path of the least resistance") you create a second part to tame a beast you unleashed before. All in all I do not trust a system like this. Regards Peter

2 1

Re: How many people have actually tried systemd ?
by Roger 15 Oct '14

15 Oct '14

> I'm curious after the recent storm about systemd to find out how > many people > have actually tried to use it? > > > > It doesn't magically solve the problem of X crashing once every 1 to 4 > weeks, it doesn't make me a cup of coffee in the morning[1], it isn't > bigger on the inside then the outside, and my time machine is still on > the blink. Nor does it stop strangers having loud arguments outside > my office window. > I think my latest ubuntu14.04 uses it, I haven't noticed any difference, life progresses from day to day in endless cycles of sunshine and rain. The terminal command for coffee is [go-coffee-now.sh] then you go get it yourself. My new bus does get better mileage thanks to systemd. Roger

2 1

Re: How many people have actually tried systemd ?
by Peter Ross 15 Oct '14

15 Oct '14

From: "Toby Corkindale" <toby(a)dryft.net> > I have been quite bemused by all the commotion on this mailing list, > because systemd has been completely fine. OpenSSL works perfectly fine too. It "secures" our Internet traffic for years perfectly.. You can just find one hole in it after another. Regards Peter ----- "It seems that perfection is reached not when there is nothing left to add, but when there is nothing left to take away" - Antoine de Saint Exupéry

1 0

Is http://boycottsystemd.org/ right? [Was: Is systemd a benefit or a liability? [Was: btrfs :(]]
by zlinw＠mcmedia.com.au 15 Oct '14

15 Oct '14

On Tue, 14 Oct 2014 17:12:08 jeremy(a)visser.name said, >ITYM fourth kernel. >X.org borders on an entire operating system. Not any more really, the low level functions of all modern drivers are now in the Linux Kernel (Note 1), so the xserver increasingly stays in user mode. Even the closed src AMD/ATI driver (Note 2) is currently being rewriten to pass all the lowlevel functions to the kernel. Note 1: This was started quite some time back, the Xserver GPU drivers being divided into 2 parts, a low level driver in the kernel specfic to a Graphics card and a largely common high level driver within Mesa DRI. This was done as it was found the high level functions for most cards even from different manufacturers was virtually identical and dividing the drivers into low and hgh level saved much programming effort. Note 2: AMD is doing this to allow a greater effort to be put in to the open source driver. Basicly from a month or so ago, all low level driver work for both the open and closed src drivers use the same code base. The ultimate goal being that when AMD releases a new GPU the open source driver will be availible from day one. Lindsay

1 0

Re: Is systemd a benefit or a liability? [Was: btrfs :(]
by Peter Ross 15 Oct '14

15 Oct '14

Hi Russell, thanks for your answer. From: "Russell Coker" <russell(a)coker.com.au> > Your mistake is to think that we need to convince you. Hmmh. Apologies but this does not sound exactly right. An unconvinced public makes every project irrelevant. http://boycottsystemd.org makes some points which seem to be relevant. Just to say: "Well, we know better and do not care" is not exactly great communication. If you have time, maybe write a few of your thoughts related to the criticism. (No, you do not have to. I am simply curious and value your opinion. Really.) Have a look at Gnome 3 and FreeBSD. There is still no official support because "Linuxalisation" and especially "Systemdlization" make it difficult to maintain a Gnome 3 port "beyond systemd". If you want a logind to run Gnome 3 - just knock yourself out! But to require a change of the init process to get Gnome 3 running is a bit "overreaching" I would think. FreeBSD (as an example of another Open Source "Unix") may have (besides of technical qualities and different licensing) a role to play to keep as a reference check. If your "default desktop" does not work with another Unix - is it really that good? The IETF is describing their approach (http://www.ietf.org/tao.html) here: "To become an Internet Standard, an RFC must have multiple interoperable implementations and the unused features in the Proposed Standard must be removed" It served us well. Just look at the well-described world of TCP/IP standards and their implementation under Unix/Linux, and compare it with Microsoft networking and the efforts of the Samba team to implement a second open source implementation, and especially a modular Samba 4. Paul McCartney and John Lennon were most successful as The Beatles. Someone said something along the lines: John got Paul to rock and not just to write sweet melodies, and Paul could stop John if he went over the top. People are rarely good in many areas. As an example, a potentially corrupt binary logging file is not great design - maybe they just should have left this part to someone else. To make it an integrated part of an init process sounds silly. I would prefer a focused project which has a well-described functionality it is aiming to implement, and works nicely with other parts. This kind of modular approach created a successful Unix/Linux ecosystem so far. Regards Peter

11 20

Re: How many people have actually tried systemd ?
by Peter Ross 14 Oct '14

14 Oct '14

Hi Jeremy, > From a sysadmin perspective killing off pesky child processes is SO last > century. You may well argue that every instance where child processes > linger when the parent dies is a bug in the application. Well, good luck > fixing every one. I am actually surprised by this one. How often does it happen? I think I have not used the kill command on my servers for the last year at all. But you do not need systemd. You are talking about cgroups here. I come back to that in a minute. > It's a classic case of technical purists telling the users what they > should want, rather than actually giving users what they want. No, users want Windows;-) Or everything with an Apple on it. One point of open source is reliable stuff which is worked on by a community instead of some big egos which say quite often "Don't bother. It works for me and you adapt your stuff." Bigger projects with big egos end up with few enlightened developers and the rest "pissed off" and does not create good reliable software. If the handful of enlightened people are the only ones seeing it and understand it you have code which is not audited by many. Afterwards you have the security disasters which you had in the news recently. As more complex it is, as more and more features go into a system, the chance of this to happen increases. > I find a good analogy for the way cgroups improves management is thinking > about the ways in which virtualisation also improves management. Yes. That's why I am using FreeBSD jails for years now;-) Amazing: FreeBSD can do this with init and jails get started and stopped via init script.. The only utility finally creating the jail is the jail(8) command (reading pararameters or a jail config). What else do you need? I can see some advantages of systemd (or other similar approaches). The frustration comes from the feeling having to use some kind of half-backed stuff written by difficult people and in a project which is quite fuzzy in its goals. But maybe I am on the wrong side anyway. Security coming from simple and working concepts is so yesterday. Somehow it reminds me of an old song which in translation means: Everything gets better. But nothing really good. Regards Peter

1 0

Re: How many people have actually tried systemd ?
by trentbuck＠gmail.com 14 Oct '14

14 Oct '14

Brian May writes: > [1] This is good because I don't like coffee. Coffee is medicine; you're not supposed to LIKE it. >duck<

1 0

Re: Is systemd a benefit or a liability? [Was: btrfs :(]
by Peter Ross 14 Oct '14

14 Oct '14

Hi Russell and all, > Most people involved in this discussion could have spun up a virtual > machine > running systemd in less time than they spent arguing. Well, I cannot help but I can say I have similar thoughts about your time spent. You spent plenty of time arguing that you do not need to put your arguments on the table. I have read a few things by now but you came nowhere near of engaging in technical argument. > Why not just test out systemd and see if it works for you? Well, I can install Windows on my laptop and figure out "whether it works for me". And I can tell you: No, even if it installs and starts. It is a system which is too hard to understand for my brain. I just come back from the room next door where Acrobat on Win7 is not working, it is starting and stops after three seconds without visible output. Go figure. To be honest, one of my best arguments (for me) in favour of FreeBSD is the simple logic driving the development process. It is easier to understand (and to administrate) than a modern Linux. It is quite lean too. I know what I am running, and it is not running "69 magic binaries" which aim to make it a real operating system. FreeBSD works according to the 10% effort for a 90% perfect result rule. If that is not good enough there are additional tools to come closer to 100% (or a tool covering the one percent which I want to achieve.) Systemd instead seems to be an attempt to get close to 100% by rewrite so introducing new problems we would not have without. The commercial examples cited by you aren't convincing. Apple does not want you to understand how it works. That is not really their aim. > This thread on luv-main was never about explanations of systemd. It was > always about people who have decided against it without reason who think > that they know more about the topic than people who use systemd and have > read the code. That is simply not true. I asked a few times what the pros are. I have not found the "killer feature" which makes systemd so superior. Where is it? > But this mailing list has given plenty of examples to show that anyone who > wants to work on systemd must ignore unqualified people. Well, I am qualified enough to understand this: https://plus.google.com/+TheodoreTso/posts/4W6rrMMvhWU His workarounds demonstrate quite clearly the shortcomings when dealing with a Linux system these days. I had similar experiences. E.g. I had, at times, to put similar "weird configs" in place to get around some Policykit magic. It comes awful close to Windows;-) And it gets even better if I need all this "desktop magic" when all what I want is a server which will never have a USB stick attached or a wireless network driving by or whatever the reason are to put these things in place. And I do not boot my servers everyday so I do not care that much about 30 seconds more uptime per year. I am not 100% convinced by PC-BSD but it has the right concept (in my eyes): Make it easy to put FreeBSD on the desktop. For that reason it makes a few userland changes to adapt the FreeBSD system. Last time I checked Debian was not a system entirely dedicated to the desktop. Maybe systemd is written and supported by people who want to make the rest of us uneducated so nobody interferes with the wise leaders who manage the world on our behalf? Back to my beloved Acrobat and Windows 7! Regards Peter

2 1

Re: How many people have actually tried systemd ?
by Peter Ross 14 Oct '14

14 Oct '14

From: "Chris Samuel" <chris(a)csamuel.org> > Hi all, > > I'm curious after the recent storm about systemd to find out how many > people have actually tried to use it? > > I installed a test machine with CentOS 7 (which has systemd by default) I did the same but it is a "play VM only". So it does not prove much. As said, a Windows 7 runs as well but it is not really nice _if_ it's not working. I just re-installed an Acrobat Suite which magically stopped working. It takes a bit more "work" and imagination to get a Linux/Unix in trouble. Regards Peter

1 0