- luv-main - example.com

Re: MS PPTP problem between Windows 7 and poptop daemon
by Peter Ross 24 Oct '14

24 Oct '14

Peter Ross wrote: > Hi Jeremy, > >> It can be cracked in under a day with a 100% success rate. >> >> <https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/> > > I am aware of it. Sorry, it may have sounded a bit harsh. I considered a "please refrain from flogging MS PPTP" before I wrote it. As said, it is access to a particular service only. The VPN is used to connect to one VM via RDP to run a particular Windows app. This VM is quarantined. Otherwise I do not use "full-featured VPNs". I do not like BYOD in the network (at least not fully embedded in the LAN), and I do not like VPNs opening up the network to places which are not controlled. May sound a bit authoritarian - but I am the one who has to clean up the mess when things go wrong. Agreed, that there are other ways to encrypt the VPN. But I have to make it easy (e.g. OpenVPN needs an install first) so I do not have to visit everybody's home to get it work. IPSEC is the other choice but the "real deal" is with certificates and I cannot really trust files given out and stored on Windows computers which can be infected (and this happens still a lot, unfortunately) IMHO this cancels out the advantage it seems to have in the first place. If somebody has good experiences with VPN employee setups I am interested to hear it. Regards Peter

1 0

Re: MS PPTP problem between Windows 7 and poptop daemon
by Peter Ross 24 Oct '14

24 Oct '14

Hi Jeremy, > It can be cracked in under a day with a 100% success rate. > > <https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/> I am aware of it. The access is to a small separated area with no "real value" for any attacker. Medieval technology written in COBOL ensures this. It is, for a start, so obscure that the attacker may think of a virus on his display;-) As the article above shows, IPSEC has issues itself. Keys are not a solution either if you put it on a Windows desktop in amateurish hands. In fact, you cannot consider any Windows system in the wild a system safe enough to read any valuable data. Regards Peter

1 0

MS PPTP problem between Windows 7 and poptop daemon
by Peter Ross 24 Oct '14

24 Oct '14

Hi all, I am having a MS PPTP "login server" running poptop. It works for a a few Windows 7 clients bare one which seems to fail in the LCP part. The obvious difference is: The one that failed is a member of a Samba 4 AD domain. (the others standalone work group clients) But I did not enable domain authentication in the VPN connection Windows setup dialogue. In fact the setups look the same for all desktops (working or not working) as far as I can tell. Does anyone understands LCP? I have two conversations to compare (see below). I did not find an exhausting description of LCP packets yet (but keep trying, just look through RFCs etc.) But maybe someone knows it by heart so can help me out? Thank you Peter Version 1 - It works: Phase: deflink: carrier -> lcp LCP: FSM: Using "deflink" as a transport LCP: deflink: State change Initial --> Closed LCP: deflink: State change Closed --> Stopped LCP: deflink: RecvConfigReq(0) state = Stopped LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x4f3126cd LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigReq(1) state = Stopped LCP: ACFCOMP[2] LCP: PROTOCOMP[2] LCP: ACCMAP[6] 0x00000000 LCP: MRU[4] 1500 LCP: MAGICNUM[6] 0x35e41cf7 LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81) LCP: deflink: SendConfigRej(0) state = Stopped LCP: CALLBACK[3] CBCP LCP: deflink: LayerStart LCP: deflink: State change Stopped --> Req-Sent LCP: deflink: RecvConfigAck(1) state = Req-Sent LCP: ACFCOMP[2] LCP: PROTOCOMP[2] LCP: ACCMAP[6] 0x00000000 LCP: MRU[4] 1500 LCP: MAGICNUM[6] 0x35e41cf7 LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81) LCP: deflink: State change Req-Sent --> Ack-Rcvd LCP: deflink: RecvConfigReq(1) state = Ack-Rcvd LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x4f3126cd LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: deflink: SendConfigAck(1) state = Ack-Rcvd LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x4f3126cd LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: deflink: State change Ack-Rcvd --> Opened LCP: deflink: LayerUp Phase: bundle: Authenticate The one that fails: Phase: deflink: carrier -> lcp LCP: FSM: Using "deflink" as a transport LCP: deflink: State change Initial --> Closed LCP: deflink: State change Closed --> Stopped LCP: deflink: RecvConfigReq(0) state = Stopped LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x10e21d38 LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigReq(1) state = Stopped LCP: ACFCOMP[2] LCP: PROTOCOMP[2] LCP: ACCMAP[6] 0x00000000 LCP: MRU[4] 1500 LCP: MAGICNUM[6] 0x69226efe LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81) LCP: deflink: SendConfigRej(0) state = Stopped LCP: CALLBACK[3] CBCP LCP: deflink: LayerStart LCP: deflink: State change Stopped --> Req-Sent LCP: deflink: RecvConfigReq(1) state = Req-Sent LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x10e21d38 LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigRej(1) state = Req-Sent LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigReq(1) state = Req-Sent LCP: ACFCOMP[2] LCP: PROTOCOMP[2] LCP: ACCMAP[6] 0x00000000 LCP: MRU[4] 1500 LCP: MAGICNUM[6] 0x69226efe LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81) LCP: deflink: RecvConfigReq(2) state = Req-Sent LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x10e21d38 LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigRej(2) state = Req-Sent LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigReq(1) state = Req-Sent LCP: ACFCOMP[2] LCP: PROTOCOMP[2] LCP: ACCMAP[6] 0x00000000 LCP: MRU[4] 1500 LCP: MAGICNUM[6] 0x69226efe LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81) LCP: deflink: SendConfigReq(1) state = Req-Sent LCP: ACFCOMP[2] LCP: PROTOCOMP[2] LCP: ACCMAP[6] 0x00000000 LCP: MRU[4] 1500 LCP: MAGICNUM[6] 0x69226efe LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81) LCP: deflink: RecvConfigReq(3) state = Req-Sent LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x10e21d38 LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigRej(3) state = Req-Sent LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigReq(1) state = Req-Sent LCP: ACFCOMP[2] LCP: PROTOCOMP[2] LCP: ACCMAP[6] 0x00000000 LCP: MRU[4] 1500 LCP: MAGICNUM[6] 0x69226efe LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81) LCP: deflink: RecvConfigReq(4) state = Req-Sent LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x10e21d38 LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigRej(4) state = Req-Sent LCP: CALLBACK[3] CBCP LCP: deflink: LayerFinish LCP: deflink: State change Req-Sent --> Stopped LCP: deflink: State change Stopped --> Closed LCP: deflink: State change Closed --> Initial Phase: deflink: Disconnected!

2 1

Fwd: [luv-ctte] FW: Seeking short term consultant embedded Linux security
by Andrew Pam 24 Oct '14

24 Oct '14

Can anyone help Robert? Thanks, Andrew -------- Forwarded Message -------- Subject: FW: Seeking short term consultant embedded Linux security Date: Thu, 16 Oct 2014 21:20:25 +0000 From: Robert Smyth <robert.smyth(a)servelec-semaphore.com> Hi, I wonder if the wider LUV group can assist me. See below. Rob Smyth *From:*Robert Smyth *Sent:* Thursday, 16 October 2014 2:59 PM *Subject:* Seeking short term consultant embedded Linux security Hi, We are in need to a Linux expert to assist us in making some decisions on implementing security in our embedded product. I wonder if there is LUV / Security SIG can help us get a message out to people who may be able to assist. We have a need to reuse password hashes between Linux and Windows, so we are looking at the algorithms and formats found in the /etc/shadow file. There is interest in using PBKDF2 or SHA512crypt, but we do not know if the crypt supported algorithms can be extended (e.g. PBKDF2). Can you assist? Robert Smyth Senior Software Developer P +61 (03) 8544 8544 A Unit 8 / 3-5 Gilda Crt, Mulgrave, Victoria 3170, Australia E Robert.Smyth(a)servelec-semaphore.com W www.servelec-semaphore.com This email including any attachments is for the named person or persons use only. It may contain confidential or legally privileged information. No confidentiality or privilege is waived or lost by any mis-transmission. If you receive this email in error, please notify the sender, delete the email immediately, and remove all copies from your system. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. All opinions expressed in this message are that of the individual sender, except where the message states otherwise and the sender is so authorized. Any liability (in negligence or otherwise) arising from any third party relying on this email is excluded. The company reserves the right to monitor all email communication for compliance purposes and to protect our business. Please consider the environment and do not print this email unless absolutely necessary. Servelec Group encourages environmental awareness.

3 2

FTP Mirror
by Russell Coker 23 Oct '14

23 Oct '14

Many years ago I used a program named "mirror" that would copy the contents of a FTP server. I think it screen-scraped the output of the "dir" command and used that to recurse through a directory tree. Now I need such a program and can't find one. My Google searches turn up many hits about things such as creating a mirror of a server with rsync (EG a Debian mirror site). But nothing about what I want. Does anyone have any ideas? Failing that, what's a good way of recursively transferring files from one Android phone to another? While I'm sure that there are better ways of transferring files than a recursive FTP the fact that both phones already have FTP servers installed means that FTP might be the easiest option. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

7 8

Fwd: Event Invitation: Simplified Linux Systems Management with Red Hat Satellite 6
by Russell Coker 22 Oct '14

22 Oct '14

This should be a good event. I'm attending. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

1 0

Re: FTP Mirror
by Peter Ross 21 Oct '14

21 Oct '14

> Many years ago I used a program named "mirror" that would copy the > contents of a FTP server. I have a script which runs lftp: /usr/local/bin/lftp -c "set ftp:list-options -a; open $FTPURL; cd $RCD; mirror ${MIRROROPT} ${VERBOSEOPT} $DELETE ${FTPOPTIONS}" where ${MIRROROPT} is "" or "-R" (reverse), ${DELETE} is "" or "--delete" and, in the example I just looked at, FTPOPTIONS='--exclude-glob logs/ --exclude-glob *.LCK --exclude-glob .svn/' Regards Peter

1 0

squeeze-lts signed apt oddness
by Chris Samuel 20 Oct '14

20 Oct '14

Hi folks, Due to a lack of Copious Free Time my VM in the US is still running Debian Squeeze and is set up to use squeeze-lts thus: deb http://http.debian.net/debian/ squeeze-lts main contrib non-free But it is complaining that: The following packages will be upgraded: apache2 apache2-mpm-worker apache2-threaded-dev apache2-utils apache2.2-bin apache2.2-common apt apt-utils 8 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. Need to get 4404 kB of archives. After this operation, 426 kB of additional disk space will be used. Do you want to continue [Y/n]? WARNING: The following packages cannot be authenticated! apt apt-utils apache2-threaded-dev apache2 apache2-mpm-worker apache2.2-common apache2.2-bin apache2-utils Install these packages without verification [y/N]? n E: Some packages could not be authenticated Now we also have some Squeeze VMs at work and they are configured almost identically: deb http://http.debian.net/debian/ squeeze-lts main contrib and they do not have this same issue. Now at both locations they resolve to the same IPv4 and IPv6 addresses but my personal VM in the US is using IPv6 and the work ones are IPv4 only, so I added the v4 address to /etc/hosts on my personal VM and it doesn't make any difference. The only thought I have left is that they are anycast addresses that are hitting different mirrors (or someone is MITM'ing me) so do any Debian gurus have any hints? cheers! Chris -- Chris Samuel : http://www.csamuel.org/ : Melbourne, VIC

3 4

Re: btrfs :(
by Peter Ross 20 Oct '14

20 Oct '14

From: "Russell Coker" <russell(a)coker.com.au> > Technical analysis of the features and relative merits of different > software has some value. For a FreeBSD user it is annoying if a well-known Unix/Linux desktop environment gets "Linuxalized" via systemd etc. It is obviously harder to port it to other than Linux if you think of systemd during development in the first place. It is a learning curve from shell scripts to something different. But that is okay as long as it is worthwhile. The init scripts are grown in nearly half a century and are well-thought through. In substance, a daemon start/stop script looks the same under all kinds of Unix. A postfix start/stop scripts runs under any kind of Unix/Linux so - minimizing the work to integrate it in any kind of distribution. Complexity risks to overlook problems. I remember putting a LDAP dependency in /etc/nsswitch.conf in Linux as done under FreeBSD before, and then udev starts.. waiting for a 30 seconds timeout per device created. It found it reported and closed in the Red Hat bugs database. It is not a nsswitch problem, it is not an udev problem.. nobody wanted to "own" it. It was somewhere fallen through the cracks. Best advice: "Don't do it." The containers get less and less shared resources from the base system. E.g. networking: Whether it is Solaris Crossbow architecture or FreeBSD jails v2 or newer Linux containers, they all can have their own network stack. Does it make sense to have one journald on the "host system" and one network daemon? Isn't that better located in "normal userland" (so in containers when appropriate) and so separated by default? That are questions I had in mind when going through systemd. More in general, it is a question of effort and result. Why reinventing the wheel? E.g. FreeBSD is using the old fashioned /etc/rc and this uses "rcorder" to prioritize /etc/rc.d scripts. After that they start in order - and it is possible to do things in parallel. The main reason _not_ to do so are (IMHO) a conservative approach to satisfy different environments (e.g. diskless clients etc.) You only have to modify the /etc/rc "starter" and rcorder to have parallelisation in place. For a physical server I wait for the hardware when booting, the OS initialisation only take seconds. A jail is running more or less immediately. The gain will be in millisecond range. Yes on a desktop it takes a bit of time. But start a system on a SSD and it isn't that much anymore. With hibernation you do not boot that way at all. Mobile devices with Android are using another approach all together. Not to mention Busybox. It is a huge development .. and it isn't clear how many people will actually benefit from it significantly. [This is opinion] The history of Linux daemons close to the hardware (udev, hald, policy-kit, dbus, kdbus) as well as filesystem layout (procfs,sysfs) does not convince me. It all feels half-baked (sometimes even a bit narrow-minded, "I need this for me here now", and there are huge egos involved it seems) and I am not confident about quality and security of the code which is redone every few years and with competition between different approaches (and with this, splits in attention and effort). In general, I have the feeling Linux developers are "overcomplicating" things;-) Regards Peter

10 16

Fwd: [GIT PULL] Btrfs corruption fix
by Chris Samuel 19 Oct '14

19 Oct '14

Heads up.. If there are people playing with 3.17 and btrfs at the moment then you'll want this patch, pull request for Linus below (not yet merged into the mainline so not yet a candidate for a stable release). The actual commit has a better description of the problem. https://git.kernel.org/cgit/linux/kernel/git/mason/linux-btrfs.git/commit/?… cheers, Chris ---------- Forwarded Message ---------- Subject: [GIT PULL] Btrfs corruption fix Date: Thu, 16 Oct 2014, 03:51:13 AM From: Chris Mason <clm(a)fb.com> To: Linus Torvalds <torvalds(a)linux-foundation.org>, Linux Kernel Mailing List <linux-kernel(a)vger.kernel.org>, linux-btrfs <linux-btrfs(a)vger.kernel.org> Hi Linus, I'm testing a pull with more fixes, but wanted to get this one out so Greg can pick it up. The corruption isn't easy to hit, you have to do a readonly snapshot and have orphans in the snapshot. But my review and testing missed the bug. Filipe has added a better xfstest to cover it. Please pull: git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs.git for-linus Chris Mason (1) commits (+33/-36): Revert "Btrfs: race free update of commit root for ro snapshots" Total: (1) commits (+33/-36) fs/btrfs/inode.c | 36 ------------------------------------ fs/btrfs/ioctl.c | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 33 insertions(+), 36 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ----------------------------------------- -- Chris Samuel : http://www.csamuel.org/ : Melbourne, VIC

2 7