August 2016 - luv-main

Re: Security and the "better than nothing" trap
by trentbuck＠gmail.com 13 Aug '16

13 Aug '16

[Sent last week, but got eaten due to gmane DOS attacks confusing luv.asn.au MTA.] trentbuck(a)gmail.com (Trent W. Buck) writes: > Peter Ross via luv-main writes: >> Should SELinux be reworked so that disarming is not possible? > > Linux watchdog drivers can behave this way ("nowayout=1"). > I looked for a similar option for selinux, but all I found was: > http://stopdisablingselinux.com/

1 0

Linux TCP security flaw?
by Erik Christiansen 13 Aug '16

13 Aug '16

Reading this: https://ucrtoday.ucr.edu/39030 which is doing the rounds on some lists, I checked: https://www.cert.gov.au/advisories but that seems to be unmaintained. There is however, no mention of a new TCP vulnerability at: https://www.us-cert.gov/ncas/current-activity https://www.us-cert.gov/ncas/alerts https://www.auscert.org.au/render.html?cid=1 Is the article perhaps a furphy? Erik

4 4

zfs vs. recent kernels
by Robin Humble 12 Aug '16

12 Aug '16

has anyone else had issues with ZFS on recent kernels and distros? I'm a bit of a newbie to daily use of ZFS, but I found it's fairly easy to completely lockup with lots of metadata ops (eg. du or big rsync). the thing that fixed it for me is booting with -> cgroup_disable=memory which I found from here https://github.com/zfsonlinux/zfs/issues/4726 but the patch commited there didn't fix it for me. I'm not sure if that's quite the right issue, or if I should be patching ZFS 7.0.0 instead of 0.6.5.7? if the root cause is not enough GPL symbols exported from the kernel then that's sad. the perils of non GPL code :-/ BTW this is on fedora 24 with root on ZFS, but it sounds like ubuntu has similar issues. symptoms feel like a livelock in some slab handling rather than an outright OOM. there's 100% system time on all cores, zero fs activity, no way out except to reset. unfortunately root on ZFS on a laptop means no way that I can think of to get stack traces or logs :-/ cheers, robin

3 9

webdav
by Glenn McIntosh 11 Aug '16

11 Aug '16

Anyone have thoughts on WebDAV clients for Android? My context is to connect to a basic WebDAV server (just the standard dav module for nginx). It works well with Linux clients (eg davfs2), only partially with the quirky default Windows client (but I can live with that). I'm looking for an Android client which has a Libre licence. I was hoping to use the NextCloud client, but ended down a rabbit hole of setting up a folder structure to make the server look like an OpenCloud/NextCloud server, and only got it half working. If I have to, I'll fall back to WebDAV Nav Lite, but it is proprietary (and a bit clunky). Glenn -- sks-keyservers.net 0x6d656d65

2 1

Security and the "better than nothing" trap
by Peter Ross 10 Aug '16

10 Aug '16

Hi all, as you may know, there is a "quadRooter" exploit for most of the available Android devices. https://www.checkpoint.com/downloads/resources/quadRooter-vulnerability-res… Among others, it is possible to exploit because it is possible to disable SELinux (page 10) After years of using FreeBSD and securing them, I was astonished when I saw someone disabling SELinux the first time. How could that be? I am used to securelevels in FreeBSD, see security(7), https://www.checkpoint.com/downloads/resources/quadRooter-vulnerability-res… The kernel runs with five different security levels. Any super-user process can raise the level, but no process can lower it. chflags(1) is used to harden access to files, with securitylevel 1 or higher it is not possible to alter them neither (in contrast to SELinux where I can change the security contexts of files on a running SELinux hardened system) The current exploit is a fine example why this kind of approach is needed. No process should be able to disarm a hardened system. Linux containers do not seem to give too much additional security, so it is always recommended to use SELinux to increase the security.. It sometimes feels like a "better than nothing" trap, giving the false sense of security. Should SELinux be reworked so that disarming is not possible? Regards Peter

2 1

Ansible questions
by Peter Ross 08 Aug '16

08 Aug '16

Hi all, I have two questions related to Ansible (I just learn a bit about it): How do you compare a status of a deployed system with the "latest standard" and upgrade when needed? E.g. you have a line added for Ciphers in ssh.config and have to make sure all already deployed systems have this check applied. Even if there are local changes in this config (let's say, for the sake of demonstration, every VM has the IP Address somewhere mentioned in this config) so it is more than just a simple diff between standard and config on a deployed system. In "my former life" I used a very much Ansible-like approach for FreeBSD systems (templates, well-defined package lists, configuration scripts for deployed packages, and access via ssh) But it all was done via shell scripts. I used svn to update configurations(svn mainly because it is part of the FreeBSD base system). If there were no local changes, the config would be a symlink to the svn version, otherwise I would have a script which would write the local config from a template (which may have a ${IP} in it, e.g.) The check would be done via svn revision number. Puppet has the ability to detect necessary changes but it is running a local agent. I cannot find the "Ansible way" of doing this. [But, actually, I tend more and more to "throw away" containers when upgrading. Installing a new version side by side and then replace the old with the new container.] Second, has Ansible a way of replacing ssh by something else (e.g. to access a FreeBSD jail from the host system via jexec)? Regards Peter

1 0

puppet, chef, etc
by Russell Coker 07 Aug '16

07 Aug '16

I've seen various reports of people using tools like puppet and chef for deploying systems. I'm looking at setting up some scripts to create test images for Debian. The main use will be for testing SE Linux so I can test all the combinations of daemons that the policy should support. But I also plan to publish them for the benefit of other people. What system do you recommend for creating such images? Puppet? Chef? Something else? -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

10 10

Re: Cheap Home Cloud ~ Raspberry Pi + USB Drives
by Russell Coker 03 Aug '16

03 Aug '16

On Wed, 3 Aug 2016 06:39:07 PM Craig Sanders via luv-main wrote: > > But as 6TB disks are affordable and 8TB disks are available hardly > > anyone needs more than 4 disks for a home server. > > I don't know if i trust the 6 or 8TB drives yet. maybe in a year or so. 6tb disks have been around for over a year, I don't think that 8TB has been around for so long. > and size isn't everything. multiple smaller disks in RAID-1/10 will give > much better performance. 4x2TB RAID-10 will cost 10-20% more than 2x4TB > RAID-1 but will be much faster. You usually don't need a lot of performance from disks. In most cases saturating GigE is enough. Get SSD for filesystems that need speed and maybe for ZIL/L2ARC and you don't need lots of spindles. > > In the long term I think that 2.5" disks won't be a useful option > > for many people. Anyone who is designing a laptop now should design > > for M.2 except for the corner-case of >15" laptops. Anyone who is > > designing a motherboard now should include 2*M.2 sockets on it. > > i've got nothing against NVMe (in fact, it's one of the technologies I'm > keenly waiting to get better and cheaper), but they have different use > cases than 2.5" or 3.5" drives. > > 2.5" drives will be useful for years to come. NVMe (esp. in raid-1) > is great for an OS drive and for bcache/l2arc/zil/etc but capacity is > limited due to the small size and, worse, pci-e lanes are limited (esp. > in Intel motherboards) so very few motherboards will have more than 1 or > 2 M.2 slots. You can get 512G M.2 NVMe cards for $425 and they will continue to get bigger and cheaper. 2*M.2 slots on the motherboard and the option of PCIe cards for more means that very few people will have a lack of fast storage. > i haven't yet seen any NVMe hot-swap capability either, which means > taking the system down to replace a drive. True. But the number of installations that depend on a single server (as opposed to a HA cluster) and need 24*7 operation is quite small. Certainly not anyone's home server! > SATA3 SSDs get up to around 550MB/s. 4 of them in RAID-1 or RAID-10 > will get nearly 2GB/second read speed, and over 1TB/s write. and the > more mirrored pairs you add, the faster it gets. That's fast enough > that it doesn't need an NVMe for caching. Currently if you want large SSDs the biggest that's in the affordable range seems to be 1TB M.2 SATA for $459 (about $500 with a SATA adapter). If you want a RAID array of fast 1TB storage devices then that would do well. But if you need more then it won't. My home server has a RAID-1 array of 2*4TB disks. A RAID-Z of 5*1TB SSDs would cost $2500, those 2 disks cost about $300 each. My home server has a RAID-1array of SATA SSDs for the things that need speed (root, /home, and swap). But if I was going to do it all again from scratch I'd consider a pair of NVMe devices for root and for L2ARC and a pair of 6TB disks for main storage. > > For all storage nowadays you either want the speed of SATAe (which > > is most easily realised with M.2) or the capacity and price of 3.5" > > disks. > > part of my point was that SSDs are getting cheaper all the time. In > the not too distant future, they will be cheap enough for home users > to build reasonably large arrays of 1-4TB SSDs, with much greater > performance, especially on random seeks or programs that open files > with O_SYNC or just fsync a lot. True. The size of storage is increasing much faster than most people use storage. NVMe is currently available in affordable sizes to replace the hard drives in the vast majority of systems I run (note not the majority of hard drives, but the majority of systems having hard drives). A lot of systems that I'm responsible for don't need the performance of NVMe, home PCs are a good example. But the cost difference is dropping so eventually it'll just make sense to do it. Relatives who currently have 120G SATA SSDs might get NVMe when they wear out. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

1 0

Re: [luv-talk] LUVpods? [Was: LUV Main August 2016 Meeting: M.2 / CRCs]
by Russell Coker 02 Aug '16

02 Aug '16

Moved to luv-main because it concerns the operation of LUV. On Tue, 2 Aug 2016 10:34:49 PM Douglas Ray via luv-talk wrote: > On 1/08/16 9:18 PM, Andrew Pam via luv-announce wrote: > > My sincere apologies for the late notice! I have a nasty flu and > > probably won't be able to attend tomorrow night. > > > > > > Start: Aug 2 2016 18:30 > > Last year, when the meetings moved earlier, I gave up. I'm sorry to hear that. > The year before, Andrew gave a - ummm - vaguely positive > response to the idea of recording or videoing some of the > presentations, to be available to LUVers who can't attend. > > Can we have a think about what might make podcasts or > streams of the meeting presentations possible? Or whether > anything would make them impractical? Yes we can do that. We have done some on occasion but not as a general practice. We will have to talk about availability of a video camera but it's not impossible to make publishing video the default. Some speakers will request to not be recorded and we won't refuse any speaker who only offers their talk on that condition. So you won't get to see 100% of the LUV lectures on Youtube, but 80% seems possible. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

1 0

August meeting?
by Brian May 01 Aug '16

01 Aug '16

Hello, Do we have a meeting tomorrow? AFAIK nothing announced; the website says we are having a talk by TBD, but doesn't say what TBD will be discussing. https://luv.asn.au/2016/08/02 Regards

2 1