Discuss

discuss@lists.centos.org

3 participants
34748 discussions

Re: [CentOS] https and self signed
by James B. Byrne 21 Jun '16

21 Jun '16

On Mon, June 20, 2016 13:16, Gordon Messmer wrote: > On 06/20/2016 07:47 AM, James B. Byrne wrote: >> On Sat, June 18, 2016 18:39, Gordon Messmer wrote: >> >>> I'm not interested in turning this in to a discussion on >>> epistemology. >>> This is based on the experience (the evidence) of some of the >>> world's foremost experts in the field (Akamai, Cisco, EFF, >>> Mozilla, etc). I would rather look to Bruce Schneier and Noam Chomsky for guidance before I would take security advice from organisations that have already shown to be compromised in the matters of their clients' security -- the EFF being the sole exception in the list provided. Or so I presently believe. >> Really? Then why did you forward your reply a private message to a >> public mailing list if not to do exactly what you claim you wish to >> avoid? > > Accidents happen. I didn't intentionally mail you off-list, > and when I noticed that I had, seconds later, I re-sent the > message to the list, expecting that you'd notice and understand > that I intended to keep the conversation on the list. > Except that I get the list as a digest. Which means that your assumptions were wrong. Funny that think you not? > ..which isn't relevant to the question of what you consider "evidence" > of security practice implications. > > Look, go to https://www.google.com/ right now and tell me what you > see. A snoop that self-signs its own certificates? > Do you suddenly distrust the internet's single largest domain? Do you > think they implement poor security practices? > My distrust of Google developed over many years. There was nothing sudden about it. But it is deep now. >>> For someone who wants "evidence" you make a lot of unsupported >>> assertions. You do see the irony, don't you? I assert my opinions if that is what you are referring to. I do not claim them to be fact. I believe them to be true but I admit readily that I may be wrong. Indeed I most certainly must be wrong in some of them. My difficulty begin determining which ones. However, I have formed my opinions on the basis of a long term exposure to security matters both pre and post Internet. And I have seen before the same thoughtless enthusiasms for things shiny and different in the security community. Things adopted and put into practice without even the most cursory of trials and evaluations for effectiveness and efficacy -- not to mention lawfulness on some occasions --. Sometimes I have had to deal with the consequences of those choices at the pointy end of the stick. Thus if I am to adopt a different point of view then I require something in the way of supporting measurable evidence to show that I am wrong and that others are right. >> The difference is that I state this is my opinion and I do not claim >> it as a fact. Your statement claimed a factual basis. I was >> naturally curious to see what evidence supported your claim. > > Citation required. > > Allow me an example. To quote you: > "The usual way a private key gets compromised is by theft or by > tampering with its generation. Putting yourself on a hamster wheel of > constant certificate generation and distribution simply increases the > opportunities for key theft and tampering." > > Now, when you asked "what possible benefit accrues from changing > secured device keys on a frequent basis?" I pointed you to > letsencrypt's documentation, which describes the benefits of > 90-day certificates. Having actual software in the possession of users rendered unusable by a policy decision implemented in the name of security is not beneficial. Referring to others self-justification of measures they have already implemented is not evidence. It is argument. Which has its place providing that one accepts the fundamental postulates of the positions being argued. These, in this case, require evidence. Assertions that these measures solve certain perceived flaws without addressing the costs of those measures is a one-side argument and not very convincing in my opinion. Refusing to deal with that is simply ignoring the elephant in the room. > > So, please describe how I am "claiming a factual basis" while you are > not. > >> Automated security is BS. It has always been BS and it always will >> be BS. That is my OPINION. It may not be a fact for I lack >> empirical evidence to support it. However, it has long been my >> observation that when people place excessive trust in automation >> they are are eventually and inevitably betrayed by it. Often at >> enormous cost. > > This is what I consider "enormous cost": > https://en.wikipedia.org/wiki/Heartbleed#Certificate_renewal_and_revocation > > After a major security bug which exposed private keys, hundreds of > thousands of servers did not take the required action to secure their > services, and the vast majority of those that took *some* action did > it incorrectly and did not resolve the problem. > > Had those sites been using letsencrypt and renewing automatically, > the exposed keys would have been replaced within 90 days > (typically 60 max, so 30 days on average). Instead, it is likely > that the problem will remain a risk for "months, if not years, to > come." > > And that's empirical evidence, which you have yet to offer. Again, you miss the point. I am not offering evidence of something that I am claiming as fact. I am seeking evidence in support of what someone else is claiming as fact. Evading the question may be a good rhetorical technique but it is hardly science. And your 'evidence' as presented above presupposes a number of unspoken assumptions. Some of which I fear would not stand scrutiny. The consequences of Heartbleed are well known to me. I had to tear down and re-establish our entire PKI because of it. However, anecdotal references to specific cases where a particular practice might, and let us remember that HB was out in the wild being exploited for at least two years before being publicly revealed, just might have provided some protection in some cases does not prove anything. In the case cited I do not believe changing certificates on an hourly basis would have made much difference against an technically proficient attacker exploiting the weakness. It is well to recall how HB came to be. A misguided attempt at an improvement in protocol exchange which amounted to not much more than gilding-the-lily and which since has been discarded without noticeable loss. What prevents similarly motivated 'improvements' to an automated certificate authority from having equally damaging effects on the robustness of the the certificates that they provide? We trusted OpenSSL because it was open. How do you trust an organisation's internal practices once they have been automated? Does anyone here actually believe that once in production this automation is or will be adequately documented? Or that said documentation will be rigourously maintained up-to-date? Or that independent and competent audits will be regularly conducted without notice? I take particular care with my PKI. I rebuild all the moduli for ssh on all of our servers for SSH. Because I trust no-one with my security. And that includes RedHat and any other external organisation, volunteer or commercial, open-source or proprietary. Automating your certificate replacement and entrusting it to an outside provider is begging to have some state actor or other financially powerful group subvert it. Look at what the NSA pulled off with RSA. That was for just money. What about patriotism? What would a true believer do if asked by his state and they were in a position to act? Think of the security nightmare that would result from having the certificate production of an automated 90 day certificate authority tampered with and left undetected for even a modest amount of time, say 180 days. At its core security is about risk analysis. And at the core of risk analysis is cost/benefit analysis. If the cost of a security measure exceeds the value of what is being secured then it makes no sense. I am seeking that cost-benefit analysis for short term certificates. And I have not seen anything in the way of objective evidence that supports the assertion that short-term certificates, or passwords for that matter, provide any measurable security benefit other than the feel-good sense that "at least its something". For one thing, this position presupposes that the rest of your security is so bad that frequent key compromise is inevitable. For another is assumes that the cost to users having to constantly deal with change is negligible. I run a business. Let me assure you that the cost of change is never negligible. > >> This impediment however is strictly an artefact of signing code with >> short term certificates. I simply had to reset the date on my MB >> back to some future date when the certificate was valid and >> everything worked fine. > > Apple's intermediate certs have a 10 year lifetime. If you consider > that "short term" then I fear that nothing is suitable in your > opinion. Apple evidently did not use those certificates to sign their software in this case. So you point is irrelevant even if it may be true. > >> But hey, what is my time worth in comparison to the security those >> certificates provided? SECURITY that was trivially evaded in the >> end. > > Fixing your clock is not "evading" security. Setting a clock backwards in time by two years is 'fixing it'? A curious point of view in my opinion. > >> Exactly what mindless person or committee of bike-shedders decided >> that software should be distributed so that copies of it expire? > > Expiration is a fundamental aspect of x509 certificates. Do you > understand x509 at all? Expiry is a fundamental part of many things including life itself. That does not imply that shorter is better. Why sign software with an expiry date when you know that your recovery programme will fail to operate after it expires? Imagine that you are on a hospital operating table and the defibrillators fail to function because the certificate that signed the firmware has expired. And that the immediate the fix is to simply reset the computer clock in the defibrillator controller backwards in time. Which of course no-one in the OR knows. So, too bad. But, you were secure when you expired. There is absolutely no sensible reason why the recovery software could not have simply warned me that the signature had expired and then asked me if I wished to proceed regardless. Having made the design decision that it would not do so then it was incumbent on the organisation responsible to allow people to override it. Instead they offer up some weasel-worded warning about "TAMPERING" and "CORRUPTION". Just what a person in the middle of system recovery is waiting to hear. Most of what passes for informed opinion about security is folk remedy dressed up with techno-babble and pushed onto an audience mostly too embarrassed to admit that they do not understand what is being talked about. In my opinion of course. However, decisions having real consequences are made on the basis of such ignorant acceptance of received wisdom. Therefore I think it important to challenge those that assert such things to produce convincing evidence that what they say is so. I understand that you believe that short term certificates and passwords and such provide a measure of security. That very well may be the case. I am not trying to convince you otherwise. All I ask for is a reasonable explanation of how much these practices cost those that employ them, how much benefit they provide to those users and what further risks they introduce. Security is a funny sort of thing being mostly based on our fear of the unknown; our too-active imaginations; and our attraction to the spectacular at the cost of dealing adequately with the mundane. At one time an automobile had to be preceded by a pedestrian waving a red flag. This too was done for the general security of all. We do not do it any more so there must have been a reason we stopped. I suggest that it was because the evidence did not support a positive cost/benefit analysis. But it sure sounded reasonable at the time to people that had little or no experience with automobiles. YMMV. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

CentOS 6 + nux-dextop: GIMP vs. GIMP 2.8 ?
by Nicolas Kovacs 21 Jun '16

21 Jun '16

Hi, I just setup a CentOS 6 desktop with the nux-dextop repository activated. When installing GIMP (yum install gimp), I get a gimp package as well as a gimp28 package. I understand this is the Nux-Dextop GIMP 2.8 package. Unfortunately this doesn't work so well with my system. It's not localized (menus appear in english, though the system is in French), the main GTK theme (Murrina Gilouche) is not managed and the application has that ugly east german look like in the good old GTK1 days, and there are two redundant menu entries, one of which is not responsive. I'd like to be able to install the plain "official" GIMP 2.6 application on my system, but when I try to 'yum remove gimp28', it takes the whole GIMP stuff down the drain with it. Note: I'm already using the Yum Priorities plugin. Official repos (base, updates and extra) are configured with a priority of 1, the other stuff (epel, adobe, nux-dextop) has a priority of 10. Any suggestions? Cheers from the sunny South of France, Niki Kovacs -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Web : http://www.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

3 5

bad iscsi performance after upgrade to CentOS 7.2
by Ulrich Leodolter 21 Jun '16

21 Jun '16

hi all, after i upgraded a physical server (SUN FIRE X4170) from CentOS 6.8 to 7.2 i am not able to get the same iSCSI read performance. the server is connected to HP P2000 Storage via 2 x 1GbE Ethernet. CentOS 6.8 gives me full read performance on raw iSCSI devices /dev/sdxx at 115MB/s. CentOS 7.2 allows only 90-100MB/s, read performance varies and is not stable like for 6.8 the multipath performance on 7.2 is even worse. CentOS 6.8 allows to read a full speed and stable 220MB/s. CentOS 7.2 maximum was 140MB/s after i disabled readahead for multipath devices in tuned. btw. i tried many recommended optimizations in 7.2, but i am not getting the raw iSCSI read performance than on 6.8, and on 6.8 i had no special tuning für iSCSI. mtu 9000 is set and verified for both OS, other settings like network buffers are almost identical. has anyone an idea why iSCSI read performance degraded in CentOS 7.2 ? best regards ulrich

2 1

https and self signed
by Jerry Geis 21 Jun '16

21 Jun '16

I followed the instructions here https://wiki.centos.org/HowTos/Https Checking port 80 I get the file... curl http://localhost/file.html <HTML> <FORM> Working </FORM> </HTML> Checking port 443 I get and error curl https://localhost/file.html curl: (60) Peer's certificate issuer has been marked as not trusted by the user. More details here: http://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option. How do I get past this? I was looking to just self sign for https. Yes I can added the --insecure for curl - but - my other app doesn't seem to work either - perhaps getting the same return message instead of the actual file. Thanks, jerry

13 39

Re: [CentOS] https and self signed
by James B. Byrne 21 Jun '16

21 Jun '16

On Sat, June 18, 2016 18:39, Gordon Messmer wrote: > On 06/18/2016 02:49 PM, James B. Byrne wrote: >> On Fri, June 17, 2016 21:40, Gordon Messmer wrote: >>> https://letsencrypt.org/2015/11/09/why-90-days.html >> With respect citing another person's or people's opinion in support >> of >> your own is not evidence in the sense I understand the word to mean. > > I'm not interested in turning this in to a discussion on epistemology. > This is based on the experience (the evidence) of some of the world's > foremost experts in the field (Akamai, Cisco, EFF, Mozilla, etc). Really? Then why did you forward your reply a private message to a public mailing list if not to do exactly what you claim you wish to avoid? > >> The assertion expressed in the link given above that 90-day >> certificate lives will serve to increase certificate renewal >> automation is at best a pious hope. > > You are ignoring the fact that the tool used to acquire letsencrypt > certificates automates the entire process. They're not merely hoping > that users will automate the process, they're automating it on behalf > of users. They've done everything but schedule it for their users. > >> One that is unlikely to be >> realised in my opinion for the simple reason that automated and >> therefore mostly unobserved security systems are a primary target >> for tampering. > > For someone who wants "evidence" you make a lot of unsupported > assertions. You do see the irony, don't you? The difference is that I state this is my opinion and I do not claim it as a fact. Your statement claimed a factual basis. I was naturally curious to see what evidence supported your claim. > >> Likewise the authors' opinion that pki certificates are in >> general just casually left laying around to be compromised displays >> a >> certain level of what reasonably could be considered elitist >> contempt >> for the average human's intelligence. > > Or, you know, a review of actual security problems in the real world. > >> Even as arguments I find these two positions are less than >> compelling. >> And in no respect could either opinion be considered evidence. > > That's fine. I don't really need to convince you, personally, of > anything. But for the security of the internet community in general, > I'll continue to advocate for secure practices, including pervasive > security (which means reducing barriers to the use of encryption at > all points along the process of setup). > > I know, and we put infants on no-fly lists for essentially the same religious beliefs. The benefit of so-called general security for the rest of us who do not have to bear its individual specific cost. The is no evidence that this sort of stuff works. It is just done so that if anything bad happens the authorities can claim that they did something preventative which they can point to. Regardless of how ineffectual it was. Automated security is BS. It has always been BS and it always will be BS. That is my OPINION. It may not be a fact for I lack empirical evidence to support it. However, it has long been my observation that when people place excessive trust in automation they are are eventually and inevitably betrayed by it. Often at enormous cost. Let me give you an example of stupidity in action with respect to signed certificates. I have a MacBookPro c. early 2009. There have been five or six major releases of OSX since then. Being a cautious type I download the upgrade installer apps and archive them before installing and upgrading. Over this past weekend my MB stopped booting. It would get to the Apple symbol and go black. Much trial, error, and research later I discover that this is sometimes occurs when a MB has been repeatedly upgraded and that a clean install is the recommended cure. Oh, by-the-way, if you ever have to do this then do not use the Apple Migration Assistant app when you are done. You will be sorry. So, I get out my archived Installer app, go to install it and BANG! My MB proclaims that "Somebody has tampered with the application or it is corrupted!". OH NO! This impediment however is strictly an artefact of signing code with short term certificates. I simply had to reset the date on my MB back to some future date when the certificate was valid and everything worked fine. Of course this took me a great deal of frustrating effort to discover what had happened to all of my archived copies and how to fix it. In the middle of a system recovery I might add. But hey, what is my time worth in comparison to the security those certificates provided? SECURITY that was trivially evaded in the end. Exactly what mindless person or committee of bike-shedders decided that software should be distributed so that copies of it expire? What security issue was addressed by this decision? What benefit to the public was achieved? When real people suffer real inconvenience and real loss of productive effort because of mindless adhesion to bromide based cures that are blandly offered for ills that mostly exist in the imagination of the ignorant then yes; I require evidence of their efficacy. And lining up a bunch of band-wagon pundits chanting the same vacuous refrains is not evidence. And this one is going to the list. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3 -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

4 3

why gstreamer can't use ffmpeg on centos?
by qw 21 Jun '16

21 Jun '16

Hi, I have one question about gstreamer. Why gstreamer can't use ffmpeg on centos? is there some patent issue related to ffmpeg and gstreamer? Thanks! B.R. Andrew

1 0

yum "Requires" yum-plugin-fastestmirror; why?
by Warren Young 20 Jun '16

20 Jun '16

In another recent thread,[1] someone was having trouble with the yum-plugin-fastestmirror feature, so I suggested he remove it, since it’s just a plugin and should therefore be optional. He reported that it couldn’t be removed due to package dependencies. I investigated further and found that this also affects CentOS 5.11 and CentOS 7.2. (The OP is on CentOS 6.8.) So, I reported it as a bug upstream, and they claim their yum package doesn’t do that, so they’re bouncing the problem back downstream. I checked, and they’re right insofar as CentOS’s current C7 yum.spec file has this on line 118: Requires: yum-plugin-fastestmirror I then tried to go get the RHEL SRPM for yum to compare its spec file to C7’s, but their download site just refers visitors to git.centos.org, and the yum repo there doesn’t seem to have an upstream RHEL7 branch. So, I started poking around in the yum.spec file history, and indeed, the oldest yum.spec file on the c7 branch doesn’t have that Requires line! It was introduced in checkin f1c1b982, which claims all it does is “debrand yum-3.4.3-132.el7”.[2] I realize it is in the CentOS project’s best interest if users always use the fastest mirror when downloading, but I claim that it is a bug to mark any plugin as Requires, particularly when upstream does not. [1]: https://lists.centos.org/pipermail/centos/2016-June/159933.html [2]: https://git.centos.org/blobdiff/rpms!yum/f1c1b9820b3d295cf5b44fa7fc8ff3673e…

4 4

Centos 7 install on dual SSD disk Asus
by Bachir Bachir 19 Jun '16

19 Jun '16

Dear all,I installed centos 7 on the second disk of my Asus laptop. The laptop i have has two SSD disks 240 G and 480G consecutively the fist disk (240) has already windows 10 installed on , the second disk now has Centos 7 installed on.while insalling Centos 7 i let the bootloader part and because i can see only the centos disk not the windowsWhen i turn on my pc the windows part does not boot but the linux i boot on Centos disk and it run as on normal.what would be the best way to add the windows disk so that i can boot it using the bootloader?Any help will be much more appreciated Thanks muchRegards

2 1

AAC in .m4a command line tagging ???
by Alice Wonder 19 Jun '16

19 Jun '16

Hi All, Software patents suck but but unfortunately for speech, MP3 (also still patented until end of next year) also sucks - for html5 audio served to iPhones where Safari doesn't support Ogg Opus and where bandwidth may be limited, AAC is a very attractive option. I have an AAC encoding solution for Linux but I don't have a way to tag them. Anyone know of Linux command-line tagger for .m4a files that produces tags that will work in iTunes? Preferably one that allows addition of album art as well as text tags. Something like eyeD3 (python script) would be great. Has to be command line so it can be automated on a server that does the transcoding. Thanks for suggestions.

1 1

Re: [CentOS] https and self signed
by Gordon Messmer 19 Jun '16

19 Jun '16

On 06/18/2016 02:49 PM, James B. Byrne wrote: > On Fri, June 17, 2016 21:40, Gordon Messmer wrote: >> https://letsencrypt.org/2015/11/09/why-90-days.html > With respect citing another person's or people's opinion in support of > your own is not evidence in the sense I understand the word to mean. I'm not interested in turning this in to a discussion on epistemology. This is based on the experience (the evidence) of some of the world's foremost experts in the field (Akamai, Cisco, EFF, Mozilla, etc). > The assertion expressed in the link given above that 90-day > certificate lives will serve to increase certificate renewal > automation is at best a pious hope. You are ignoring the fact that the tool used to acquire letsencrypt certificates automates the entire process. They're not merely hoping that users will automate the process, they're automating it on behalf of users. They've done everything but schedule it for their users. > One that is unlikely to be > realised in my opinion for the simple reason that automated and > therefore mostly unobserved security systems are a primary target for > tampering. For someone who wants "evidence" you make a lot of unsupported assertions. You do see the irony, don't you? > Likewise the authors' opinion that pki certificates are in > general just casually left laying around to be compromised displays a > certain level of what reasonably could be considered elitist contempt > for the average human's intelligence. Or, you know, a review of actual security problems in the real world. > Even as arguments I find these two positions are less than compelling. > And in no respect could either opinion be considered evidence. That's fine. I don't really need to convince you, personally, of anything. But for the security of the internet community in general, I'll continue to advocate for secure practices, including pervasive security (which means reducing barriers to the use of encryption at all points along the process of setup).

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss