- Roundtable - muug.ca

Solaris fix for the bash bug
by Kevin McGregor 30 Sep '14

30 Sep '14

I'm trying to apply IDR 126546-06 to our Solaris servers. One of them (eventually) went fine. The second one I tried failed with this message: ERROR: IDR 126546-06 cannot be applied until all Interim Relief/Diagnostics are backed out. Dryrun complete. No changes were made to the system. Okay, so how do I find a list of IDRs I need to back out of? This is Oracle Solaris 10 9/10 s10s_u9wos_14a SPARC (SunOS <server> 5.10 Generic_142909-17 sun4u sparc SUNW,Sun-Fire-V490). Both servers show have been identically installed; how do I find out the differences, on a package basis? Kevin

1 1

Desktop SSDs
by Kevin McGregor 30 Sep '14

30 Sep '14

Does anyone have an opinion ( ;-) ) on which desktop SSDs to buy or avoid in the ~250 GB size? How about the Kingston HyperX Fury 240GB SSD SATA3 SandForce SF2281 <http://www.ncix.com/detail/kingston-hyperx-fury-240gb-ssd-82-100152-1342.htm> ? (E.g. $140 + tax & shipping from NCIX) Kevin

3 2

any MTS employees here?
by Adam Thompson 29 Sep '14

29 Sep '14

Any MTS employees here, who know where to report this internally? athompso@t5400:~$ dig @dns1.mts.net in mx mymts.ca ; <<>> DiG 9.8.1-P1 <<>> @dns1.mts.net in mx mymts.ca ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21118 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;mymts.ca. IN MX ;; ANSWER SECTION: *mymts.ca. 43200 IN MX 0 localhost.* This makes it a bit difficult to send mail to accounts @mymts.ca, which plenty of people still (claim to) use. -- -Adam Thompson athompso(a)athompso.net

2 1

bash + procmail vulnerabilities
by Trevor Cordes 26 Sep '14

26 Sep '14

Wonderful, another day, another big bad security hole... or two. Run your patches! First up: bash: $ env x='() { :;}; echo OOPS' bash -c /usr/sbin/nologin OOPS This account is currently not available. http://www.openwall.com/lists/oss-security/2014/09/24/10 claims: > In many common configurations, this vulnerability is exploitable over > the network. I'm trying to guess how? In what instance is some program allowing network vectors to set env vars, especially without sterilization? Or do I not want to know... Next up, procmail has a formail buffer overflow that may or may not allow arb code exec CVE-2014-3618. Many stock procmail recipes use formail. It's easy to see how this one is remotely exploitable.

3 5

ssl cert renewal warning/anecdote
by Trevor Cordes 24 Sep '14

24 Sep '14

People who manage (paid for) SSL certs (for web servers, etc), don't make the same mistake I just did. It was renewal time and I did what I always do: blindly hit renew on my cert provider/reseller control panel. I get the cert, install into apache, restart, then boom: [ssl:emerg] [pid 11648] AH02565: Certificate and private key mydomain.blah:443:0 from /etc/pki/tls/certs/mycert.crt and /etc/pki/tls/private/mykey.key do not match AH00016: Configuration Failed After a very brief WTF moment, it dawned on me: "heartbleed". I regen'd my CSR/key and got a reissued cert a few months back. That is done direct with the vendor (Thawte), and *not* through my reseller (OpenSRS). So Thawte had my new CSR, but OpenSRS still had my old CSR on file (the one with the possibly-compromised heartbleed key) and that is the CSR they sent to Thawte when I renewed! Doh! So I had to make yet a new CSR/key, and have Thawte reissue a new cert, and then revoke the cert I (didn't) use for all of 5 seconds. Blah, there goes half an hour. I verified this is indeed what was happening with some openssl -modulus command line magic. I've written to notify OpenSRS they should put up a warning on the renewal page. This doubly sucks because OpenSRS *still* will have cached the revoked/compromised CSR and if I forget *next* year to paste a new CSR in, I'll be doing the exact same thing! Maybe the moral of the story is: always regen a new CSR everytime you renew. An extra 2 mins, and remembering some cryptic openssl commands, but not the end of the world, but still a pain vs. just hitting "renew". Maybe everyone else already does this and I wasn't following "best practices", but don't we all like to keep things simple when we can? Exercise for the curious/pedantic/strange people who read this far: Is there a way SRS or Thawte could have prevented this? Perhaps by linking the CSR used to make a revoked cert and disallowing renewals based on it? Or perhaps SRS needs an API with Thawte whereby you reissue via SRS, not Thawte, or Thawte needs to pass back the last-used-CSR to SRS so it can replace the stale cached copy.

2 3

multi-platform encryption
by Dan Martin 16 Sep '14

16 Sep '14

I am in need of encryption software that would keep files encrypted on the cloud as well as local on all machines. Here is what I'm looking for: Downloaded files saved to a particular folder on a Windows 7 or 8 machine would automatically be encrypted (after a prompt for passphrase). Ideally, this folder would be in a Dropbox or Google Drive folder, or on a thumb drive. No record of the unencrypted file would remain on the local PC (I am not worried about pieces of it on swap). I would prefer that the files are individually encrypted with the same passphrase, rather than added to one large file which is encrypted. I don't want the cloud storage to have to recreate the whole folder, and I don't want a bit error to trash all of my files. The file names do not need to be encrypted. Since I will be the only user in the foreseeable future, a symmetric encryption scheme would be fine. >From the cloud (preferably) or thumb drive folder, my ruby program running on Mac OS X would edit the files. I would also want to be able to decrypt the files to view in a text editor or other software, after which I would secure erase copies of decrypted files - again, no unencrypted files on the local machine other than in swap. This is the ideal. An alternative would be to send the files via https to a web server on the Mac (which could handle encryption in a local Mac environment) and the secure erase the files on the PC. If I did this, could I send the files unencrypted (since https will encrypt them while they are on the internet)? True Crypt appears to be close to what I want, but it is discontinued. I don't know if I could use something like gpg, since I don't have admin privileges on the PC. -Dan -- Dan Martin, MD GP Hospital Practitioner Computer Scientist ummar143(a)shaw.ca (204) 831-1746 answering machine always on

4 3

Fwd: MbOUG: Welcome to our next exciting event on Sep 23!
by Gilbert E. Detillieux 12 Sep '14

12 Sep '14

I'm passing this along in case any of you might be interested in learning more about Oracle Linux... I have no affiliation with MbOUG, so please respond to <info(a)mboug.org> if you want to register or have any questions. (Please don't just reply to this e-mail.) Gilbert ---------- Forwarded message ---------- From: *MbOUG Info* <info(a)mboug.org> Date: Sat, Sep 6, 2014 at 10:28 AM Subject: MbOUG: Welcome to our next exciting event on Sep 23! You are cordially invited to the next Manitoba Oracle Users Group (MbOUG) event focused on Oracle Linux/VM/OEM12c. Tuesday September 23, 4:15 - 7:45pm Norwood Hotel (112 Marion St.) - Tache Room and parking is free! More details are provided in the attached invitation or online at http://www.mboug.org or https://www.linkedin.com/groups?home=&gid=3751612 To help entice you in attending, there is food & complimentary gifts as well so don't miss out! If you know of other Oracle/Linux/VM Professionals (or wannabe professionals) who didn't receive the invitation but are interested to come, please spread the word. We expect a great turnout so please take advantage of the opportunity to network, exchange ideas, and share stories with your local peers. To register, please send an email with your name and professional contact information to: register(a)mboug.org Kudos to our event sponsors Oracle and networkEARTH in keeping this event free! Hope to see you there! Your local MbOUG Team "Your Participation is always needed and most welcome" -------- End Forwarded message -------- -- Gilbert E. Detillieux E-mail: <gedetil(a)muug.mb.ca> Manitoba UNIX User Group Web: http://www.muug.mb.ca/ PO Box 130 St-Boniface Phone: (204)474-8161 Winnipeg MB CANADA R2H 3B4 Fax: (204)474-7609

1 0

do you have a Seagate external USB3 2TB from 2013-2014?
by Trevor Cordes 11 Sep '14

11 Sep '14

Out of curiosity, if you do and wouldn't mind trading up to a new unit (same size or bigger) at nominal (or no) cost, with imaging to the new drive done for free (if you require, or you can do yourself and DBAN), email me the part # printed on your unit's case. I'm not guaranteeing I'll do this deal, I'm just seeing if anyone has one and might be interested. Guaranteed it would be a win-win for a couple of MUUG members :-)

1 0

linux md RAID6 + XFS + add 1 drive
by Trevor Cordes 10 Sep '14

10 Sep '14

Just some observations, tangential ramblings from a recent experience: For the first time in a long time I ran out of space on my home file server. It was a 8 x 2TB drive linux software (md) RAID6, 12TB usable, with a tweaked XFS on top. 99.5% full and running out of things I can painlessly delete. Yesterday, I added a 2TB 7200rpm WD SE ("enterprise") drive that is actually quite affordable. A very solid, heavy drive. Built like a SCSI. Crossed my fingers and did a md RAID6 grow/reshape, which is quite easy to do, but took 24 hours 10 mins to complete. And I did it while the fs live and mounted and nfs exported! (For my sanity I did turn off some heavy-data daemons.) Hooray, no errors! Read up on XFS grows and did, while mounted, an xfs_grow -d and (surprisingly?) it *instantly* returned and df showed the array magically was 2TB bigger. Hooray #2. Had to adjust my mdadm.conf (I manually specify some parameters) and luckily remembered to also do a dracut --force (Fedora system) for next boot. Had to adjust fstab to tweak sunit/swidth (s==stripe) to have the remount use a new, sane, value for performance. I'm a bit confused after reading the sparse docs and the nearly non-existent googles of people doing precisely this: md grow + xfs grow. Of course, it's not imperative, unless you care about performance. It appears sunit is not changeable unless you increase it by a factor of a power of 2. For instance, doubling your drives would allow you to double your sunit. That kind of sucks. Some articles I read said you should set sunit = RaidChunkSize * 2, which mine is set to. But reading the XFS mans in more detail it strikes me as incorrect, unless you have only 2 usable-data drievs (ie 4 drive RAID6 or 3 drive RAID5). I'm not sure who to believe. Regardless, if my reading of the XFS docs is correct, it looks like my sunit was never configured properly, and is set to perfectly match 8 data drives, not my old 6 and certainly not my new 7. I may, in short order, get a 10th drive for my array, and run perf tests before and after to see if sunit should indeed be a multiple of usable-drives or not. swidth is easier. Just make it sunits * usabledrives, and it appears it can be any valid multiple, changed at will. swidth was set correctly for my old setup and is now set correctly for my new setup. Bottom line is, if my new reading of sunit is correct, and it needs to be tailored to usable-disk-count and can only be changed by factors of 2, then md+XFS is de facto limited to only ever doubling your usable-disk count, and NOT allowing of adding 1 disk here, 1 disk there, as I first thought. *IF* you care about performance, that is. Nothing stops you from doing any of this, but if your FS striping does not match your RAID striping you could see insane performance decreases. Neat: Filesystem 1K-blocks Used Available Use% Mounted on before: /dev/md4 11716644864 11499740512 216904352 99% /data after : /dev/md4 13669767872 11499740704 2170027168 85% /data Final note: After hearing ZFS (on Linux at least) cannot grow by 1 disk when using RAID5 or 6, and after nearly 10 years using XFS on md on huge arrays, I say give some hero cookies to md/XFS. It's withstood some pretty strange events on my server, and has never blown up. If I'm wrong about the sunit being a problem, then md/XFS is a great option for those who want to gradually add space as they need it.

2 3

HGST
by Trevor Cordes 10 Sep '14

10 Sep '14

As per an after-meeting conversation: HGST was indeed bought out by WD. I have a vague recollection of that news but I think I repressed the memory for sanity reasons. Wyatt and I were just discussing how it's funny that hard drive prices really haven't changed in 2 years (except for the 3+ TB size) and... boom, "there's your problem". Now there are only 2 companies (of note) competing worldwide in spinning rust. Can you spell duopoly? Now it all becomes clear...

1 0