LWN Weekly Edition
Front pageSecurity
Kernel development
Distributions
Development
Linux in the news
Announcements
Letters to the editor
->One big page
This page
Previous weekFollowing week
| |||||||||||||
DistributionsNews and Editorials New directions for SME Server, ImmunixWith the recent compromise of several Debian servers, nobody needs a reminder about the importance of security on publicly accessible production machines. Diligent applying of security patches is one form of guarding against known vulnerabilities, but as in Debian's case, how can one prevent (or at least reduce the likelihood) of an attacker exploiting an unknown vulnerability? Some of the solutions include various kernel patches protecting the kernel from buffer and stack overflows, security enhanced kernels, User Mode Linux with critical processes confined to "jails", Linux intrusion detection systems with mandatory access control policies and other solutions.However, most mainstream Linux distributions, as well as Linux kernel developers have yet to be persuaded about the need to implement any of the above solutions in their products. As a result, a wave of various "secure" distributions came into existence in the past several years, attempting to fill the gap and appealing to the more careful or paranoid amongst the system administrators running mission critical servers. Some of these distributions provide little more than sensible default settings with all unnecessary services turned off, while others attempt more sophisticated protection mechanisms against common exploits. Among the oldest of these distributions are SME Server (formerly e-smith) by Mitel and Immunix, by Immunix, Inc. (formerly WireX Communications, Inc.). Both Mitel and Immunix made interesting announcements last week. Mitel's Director of Product Management Dan York posted a message on the distribution's mailing list saying that the upcoming SME Server 6.0 would be the last unsupported developer (i.e. freely download-able) release. "Mitel is a commercial enterprise," asserts the writer, "and has decided to focus our developers on our commercial products." Future releases, if any, are up to the SME Server user community and even the distribution's mailing lists, forums and bug reporting facilities will no longer be hosted by Mitel. The announcement was met with various emotions ranging from anger at Mitel for abandoning their long-term users and contributors to hope that the product will continue, albeit in a different form. Despite its relatively low-profile status in the media, e-smith SME Server is a popular distribution with highly active mailing lists, a satisfied user base and several community web sites, including SME-Fr (in French) and contribs.org. The latter has now accepted the challenge of setting up a complete development framework, thus providing continuity in the development of the community supported SME Server. The other interesting announcement was a quiet release of Immunix Secured OS, version 7.3. Unlike the company's previous releases, version 7.3 is no longer free: "Immunix Secured OS 7.3 is not free software. Immunix does employ many GPL components, among other licenses, and source code for GPL software is available under the terms of the license." All previous versions of Immunix were available in the form of freely download-able ISO images for non-commercial use, although all of them have now reached end of life. What makes SME Server and Immunix Secured OS worth paying for? SME Server falls into a category of server distributions where security is achieved through simplicity and transparency, elimination of non-essential services and replacement of certain services with more secure alternatives. It also provides a unique, template-driven configuration system written in Perl. On the other hand, Immunix has developed its own set of technologies guarding against various common exploits. As an example, Immunix 7.3 comes with StackGuard, a set of patches for the GCC compiler (presently only available for GCC 2.96) which forces the binaries to perform additional checks on stack operations to prevent stack overflows. Another interesting technology is SubDomains, a mandatory access control mechanism for limiting privileges given to critical programs and processes. There is a lot more and if all these features work as advertised, the $200 price tag does not seem excessive. Still, the decision to discontinue the non-commercial edition was not well received by many long-term Immunix users. What do these changes at Mitel and Immunix mean for the Linux user community? They seem to confirm a trend in the direction of several Linux companies which have decided to focus exclusively on the corporate market. They probably see small businesses and private users as somebody contributing very little to their overall profit margins, while draining precious developer resources. Although this seems to be an understandable direction from the business point of view, these companies sometimes forget the power of non-tangible benefits that a large user base brings them in terms of product recommendations, bug reports, exchange of ideas on forums and mailing lists, suggestions and other non-monetary values. And abandoning one's users, even if those users don't provide immediate material benefits, does not seem like a smart idea in the long run.
New features in APT-RPM1. IntroductionAPT-RPM is a port of Debian's APT tool to RPM based distributions (Conectiva Linux, Fedora Linux, SuSE Linux, ALT-Linux, etc), written and maintained by Conectiva. APT is an advanced package management utility front-end which allows one to easily perform package installation, upgrading and removal. Dependencies are automatically handled, so if one tries to install a package that requires others to be installed, it will download all needed packages and install them. Recently, an intensive amount of development has been happening under the hood in the APT-RPM world, but unfortunately, most of the features are only perceived by a small number of people that follow the development closely. This article is an attempt to introduce the reader to some of the latest features available today in the RPM port of APT. 2. Dealing with local packages One of the recently introduced features, which was on the top of the TODO list for a long time, is the capability of dealing with random local packages using APT's ability to handle dependencies. With this feature, installing a local package with dependency handling is as easy as installing a file in any remote repository. Here is an example, assuming that the file is in the current working path: % apt-get install rpmver-2.0-13498cl.i386.rpm Reading Package Lists... Done Building Dependency Tree... Done Selecting rpmver to represent rpmver-2.0-13498cl.i386.rpm The following NEW packages will be installed: rpmver 0 upgraded, 1 newly installed, 0 removed and 8 not upgraded. Need to get 0B/6404B of archives. After unpacking 5552B of additional disk space will be used. Committing changes... Preparing... ########################################### [100%] 1:rpmver ########################################### [100%] Done. This is valid for operations dealing with source packages as well. The following example shows an operation that checks every build-time dependency of the given source package, asks for confirmation, fetches, and installs them locally. % apt-get build-dep apt-listchanges-1.49-11104cl.src.rpm Reading Package Lists... Done Building Dependency Tree... Done The following NEW packages will be installed: rpmver 0 upgraded, 1 newly installed, 0 removed and 8 not upgraded. Need to get 6404B of archives. Need to get 6404B of archives. After unpacking 5552B of additional disk space will be used. Do you want to continue? [Y/n] Get:1 ftp://mapi8.distro.conectiva latest/conectiva/all rpmver 2.0-13498cl [6404B] Fetched 6404B in 8s (798B/s) Committing changes... Preparing... ########################################### [100%] 1:rpmver ########################################### [100%] Done. 3. Local repositories Dealing with package files directly is just one way to use APT-RPM. Another easy way is to set up a local repository. Traditionally, local repositories are always available, but they require maintenance of meta-information, which APT-RPM expects to find in the base/ subdirectory. Now APT-RPM has learned to deal with a special kind of local repository, which does not require the maintenance of meta-information. Instead, information is fetched directly from the packages, and new packages dropped into these directories are automatically recognized. The configuration of this new kind of local repository is straightforward. One only needs to replace the rpm source type with the rpm-dir source type in the sources.list repository configuration file. For example, to maintain a repository in /repos/conectiva/RPMS.local and to have every package dropped in this directory automatically recognized by APT-RPM, one should include the following line in the sources.list file: rpm-dir file:///repos conectiva local No additional configuration is needed. The same rules apply to source repositories as well, using rpm-src-dir instead of rpm-src in the sources.list repository configuration file. Extending the example above, the following line would allow one to maintain SRPM packages in /repos/conectiva/SRPMS.local without any further work: rpm-src-dir file:///repos conectiva local 4. Installing packages by filenames One feature that seems logical for most package tool users is the ability to install packages by providing file names instead of package names. This feature was only available in APT-RPM through an external Lua extension, until recently. Now this is available internally in APT-RPM, which is able to translate any filename included in the meta information of the remote repository. The following example shows the feature working. The filename is translated to the package name, and with user confirmation, the package is downloaded and installed. % apt-get install /usr/bin/rpmver Reading Package Lists... Done Building Dependency Tree... Done The following extra packages will be installed: rpmver The following NEW packages will be installed: rpmver 0 upgraded, 1 newly installed, 0 removed and 8 not upgraded. Need to get 6404B of archives. After unpacking 5552B of additional disk space will be used. Do you want to continue? [Y/n] Get:1 ftp://mapi8.distro.conectiva latest/conectiva/all rpmver 2.0-13498cl [6404B] Fetched 6404B in 17s (376B/s) Committing changes... Preparing... ########################################### [100%] 1:rpmver ########################################### [100%] Done. Notice that it's possible to exclude some files from the meta-information, for space saving purposes. 5. APT Shell Another interesting feature developed recently is the apt-shell. This is a tool which offers a shell to make the user experience more pleasant while navigating through the APT cache and installing, erasing, and upgrading packages. Here is a very short list of available features to leave the reader excited enough to look further:
Here is an interactive sample section, hacked for objectiveness. Reading Package Lists... Done Building Dependency Tree... Done Welcome to the APT shell. Type "help" for more information. apt> install dum [TAB pressed] dummy dump apt> install dummy= [TAB pressed] 0.1-1cl 1.0-1cl 1:1.0-1cl 1:1.5-1cl apt> install dummy=1:1.0-1cl apt> install alsa-lib-devel Unrequested changes are needed to execute this operation. The following packages will be upgraded alsa-lib-devel libalsa2 (...) Do you want to continue? [Y/n] n Abort. apt> commit The following NEW packages will be installed: dummy (...) Executing RPM (-Uvh)... Preparing... ########################################### [100%] 1:dummy ########################################### [100%] (...) apt> ls dum* dummy dump apt> ls -v dum* Name Installed Candidate ---- --------- --------- dummy 1:1.0-1cl 1:1.5-1cl dump - 0.4b28-11400cl apt> ls -s dum* dummy - Dummy package doing weird stuff. dump - Programs for backing up and restoring filesystems. 6. Meta-components Unlike the Debian strategy of maintaining main, contrib, and a few other major components, some users of APT-RPM, like Conectiva Linux, have chosen to split components in a more finely grained fashion with, for example, devel, doc, audio, and many others. This introduces some interesting possibilities, as users may "subscribe" to just those components they are really interested in. On the other hand, splitting components like this also introduces some annoyance to those who want to simply subscribe to every available component. It also creates problems when a new component is created, since nobody is currently subscribed to it, and would take some time to discover that the new component was available. The meta-component was created to solve these issues. Using meta-components one is able to create components that contain the information of other real components. For APT-RPM users, there's no difference between a meta-component and a real component. For repository maintainers who want to create a meta-component, it's just a matter of using the appropriate genbasedir options. For example, suppose that the components main, extra, kde, and gnome are available, one may create an additional all meta-component which includes information from all of them with the following command: genbasedir --meta=all /repos/path main extra kde gnome Doing this, users may either include any combination of individual components in their sources.list repository configuration file, or use the meta-component. 7. Lua interface One exciting new capability recently introduced into APT-RPM is the embedding of the Lua interpreter. This allows customization and extension of APT-RPM in any direction, being limited mostly by the imagination and scripting ability of anyone who needs extensive packaging features. The scripting interface is done using a slot concept. Slots are places in APT-RPM execution where any number of scripts may be plugged in to introduce special behavior. Some of these slots allow scripts to introduce new commands in the APT-RPM tools apt-get, apt-cache and apt-shell. Additionally, scripts may also be called with the script subcommand. Currently, a good part of the APT API is already available to Lua scripts, and complete documentation is available at AptRpm/Scripting. To give you an idea of how it works, the following script may be executed with apt-get script install-devel.lua (assuming it has this name), to install development packages with suffixes -devel and -devel-static, as long as the main package is already installed.
function installdevel(name)
pkg = pkgfind(name.."-devel")
if pkg and not pkgvercur(pkg) then
markinstall(pkg)
end
pkg = pkgfind(name.."-devel-static")
if pkg and not pkgvercur(pkg) then
markinstall(pkg)
end
end
for i, pkg in pairs(pkglist()) do
if pkgvercur(pkg) then
installdevel(pkgname(pkg))
end
end
8. Upgrading algorithm Some changes in APT-RPM go mostly unnoticed by the everyday user. One of these changes happened during the release period of Conectiva Linux 9.0. Several days were spent to improve the behavior of APT-RPM in complex situations, like when whole distributions are upgraded. Today, APT-RPM is the only tool used for upgrading Conectiva Linux, and heavy tests were done, even upgrading two distribution versions in a single step. Recently, users of other distributions have reported that the upgrading algorithm is indeed working more reliably, as they are also able to upgrade their own distributions, and problems during upgrades are mostly related to packaging bugs. 9. Internal committing of changes One behavior that many users disliked, was the way it committed the programmed changes to the system. Until recently, APT-RPM did this by executing the rpm binary itself. This behavior indeed had a few disadvantages, like splitting the transition into more than one unit, since the rpm binary doesn't currently support installation and erasure of packages in a single step. Fortunately, since version 0.5.15cnc3, APT-RPM supports internal committing of changes, through the use of the rpmlib API, which leaves the mentioned problems behind. Using the old method is still supported, and is runtime configurable. 10. Synaptic Synaptic is very good graphic interface for package installation which supports both APT-RPM and APT. Lately this software is receiving special attention, and is evolving at large steps. If one would like to have access to the features of APT-RPM or APT with a graphical interface, looking at the Synaptic project is highly advisable. 11. Changes in the original APT Changes being done in the original version of APT, maintained by Debian developers, are constantly being integrated in APT-RPM as well. A small example of this is the recently introduced argument of the install subcommand of apt-get which shows which versions are going to be installed in the system, if the transaction is committed, as shows the following example: % apt-get install -V rpmver Reading Package Lists... Done Building Dependency Tree... Done The following NEW packages will be installed: rpmver (2.0-13498cl) 0 upgraded, 1 newly installed, 0 removed and 8 not upgraded. Need to get 6404B of archives. (...) 12. Credits The core maintenance of APT-RPM is done by the Conectiva developer Gustavo Niemeyer, but it would be unfair to take the credits and not mention other people (without any special order), like Panu Matilainen and Richard Bos, which have always been persistent APT-RPM contributors; Michael Vogt, a Debian developer that has been doing a wonderful job maintaining Synaptic with Gustavo, Jeff Johnson, the RPM software maintainer; ALT-Linux, which constantly send patches "upstream"; Vine Linux, which pushes APT-RPM in the oriental side of the world; the Debian developers which contribute to the original APT project, and many others which contribute to the continuous progress of APT-RPM. 13. Links
Distribution News Debian GNU/LinuxThe Debian Weekly News for November 26, 2003 is available with the latest news from the Debian Project. Topics include the breach of Debian servers, an interview with several developers from freedesktop.org, results for new SPI Board of Directors Member Vote, and more.The Debian Weekly News for December 2 is out; this issue looks at Mozilla problems, Debian GNU/KNetBSD, Virtual Stallman discrepancies, and several other topics. The Debian Project has posted a lengthy report on the compromise of its servers. Most of what is here has also been disclosed elsewhere, but this report is a comprehensive summary in a single place. A couple of important things are, seemingly, still not known, however: who did it, and when the maintainers' accounts will be unlocked. Anthony Towns reports on the progress of the 'sarge' release, with a summary of the progress to date and what still needs to be done.
Gentoo rsync server compromisedThe Gentoo Project has sent out an alert to the effect that one of the servers which makes up rsync.gentoo.org has been compromised. "However, the compromised system had both an IDS and a file integrity checker installed and we have a very detailed forensic trail of what happened once the box was breached, so we are reasonably confident that the portage tree stored on that box was unaffected." Gentoo users may have gotten off relatively easy, as Debian's users did before. At this point, however, it is clear that the level of attacks on the free software community's infrastructure is increasing. Be careful out there.
Gentoo Weekly Newsletter - Volume 2, Issue 48The Gentoo Weekly Newsletter for the week of December 1st, 2003 is out. The Gentoo Documentation Project is looking for for more translators. Read more on this and other Gentoo news by clicking below.
Mandrake LinuxMandrakeSoft has announced the first release candidate of MandrakeMove. MandrakeMove is a 9.2 system on a live CD. Personal data and configuration settings may be stored on a dedicated USB Key so you can take your Mandrake system with you where ever you go.Mandrake Linux 9.2 updates:
A UserLinux manifestoBruce Perens has posted (in draft form) a document called UserLinux: Repairing the Economic Paradigm of Enterprise Linux. It describes his complaints with the current state of "enterprise" distributions and what he proposes to do about it. "We, the Free Software developers, created this software to empower everyone, and for everyone to share. But today's Enterprise Linux is a lock-in play, designed to draw the customer into expensive subscriptions and single-vendor service.... We have no problem with payment for service, when service is rendered. But the $1000 per year or greater that many customers now pay for their Linux systems goes not for service, but for a brand and the endorsement of a few application providers like Oracle."
New Fedora leadership draft postedFor those who are interested, Red Hat has posted a new draft leadership scheme for the Fedora Project. Changes are listed at the end. "The idea of voting bodies was removed. It was creating too much complexity in infrastructure to retain the amount of control that Red Hat requires for its participation in the project, for no real gain. It was also contrary to existing practice, both in Linux and Red Hat's experience building a distribution."
Fedora updatesHere are this week's Fedora updates:
Slackware LinuxThe slackware-current changelog shows an upgrade to bind-9.2.3, gnupg-1.2.3 with support for ElGamal keys removed, an upgrade to kernel-2.4.23, alsa-driver-0.9.8 added to the kernel, and more.
Trustix Secure LinuxTrustix notes that the sym53c8xx module in Linux kernel 2.4.22 has been renamed to sym53c8xx_2 in 2.4.23 which could cause some systems to not upgrade properly. The fix is fairly straightforward, and definitely worthwhile.There are updates to freeswan to upgrade to the latest upstream version.
Lindows.com releases "Laptop Edition"Lindows.com has announced the availability of the LindowsOS Laptop Edition, a version of its distribution oriented toward laptop use. "LindowsOS Laptop Edition includes improved power management, high compatibility with WiFi cards, and the ability to take advantage of keyboard shortcuts to browsers and email programs."
New Distributions cAoscAos is a Linux distribution created by the community, for the community. The purpose is to provide a stable Linux solution for organizations and individuals that do not need or want to purchase their Linux solution. The kernel and almost every application that makes up a Linux distribution are free and supported by their respective development groups. cAos is simply a project that allows them to integrate together into a usable product. This distribution is focused on becoming an enterprise level community produced solution. The project was announced November 8, 2003. The first alpha version was released December 1, 2003.
LBA-LinuxThe Linux Business Alliance (LBA) has announced the creation of LBA-Linux. The new distribution is the result of professional co-operation between the members of the LBA, and is based on SOT's GNU/Linux distribution, SOT Linux. LBA-Linux is considered a successor to SOT Linux.
Feather LinuxFeather Linux is a Linux distribution which runs completely off a CD and takes up under 50Mb of space. It is suitable especially for business-card sized CDs. It is a Knoppix remaster (based on Debian), and tries to include software which most people would use every day on their desktop. Feather joins the list at version 0.2, released November 30, 2003.
Minor distribution updates 2-Disk Xwindow embedded Linux2-Disk Xwindow embedded Linux has released source code v1.2.4 with minor bugfixes. "Changes: Cleanups were made to the taskbar, script, and graphics. New build options for CD/USB/hard-disk systems. The new expunge application build system adds support for auto-building Mozilla, XMame, GTK, MPlayer, and Apache. A humungous build option was added. Boot-time speedups were made. Many other minor changes were made."
Astaro Security LinuxAstaro Security Linux has released v4.017 with major security fixes. "Changes: This version includes a kernel vulnerability fix and support for new hardware. It fixes the USB keyboard support and the port scan notification."
Aurox LinuxAurox Linux has released beta v9.2 with major feature enhancements. "Changes: This version features GNOME 2.4.1, KDE 3.1.4, fluxbox 0.1.14, and OpenOffice.org 1.1 with dictionaries. During the install users can now choose 'Light Desktop' with fluxbox, mozilla-firebird, rox-filer, and sylpheed. The new dvd+rw-tools with k3b 0.10.2 allows users to write DVDs. Other new applications include Sodipodi, Blender, Scribus, QtParted, and tools for mobile phones (gnokii and gscmxx)."
ClusterKnoppixClusterKnoppix v3.3-2003-11-19-EN-cl1 has been released. This version has been upgraded to the latest Knoppix and OpenMosix 2.4.22-2. Click below for more information.
DeLi LinuxDeLi Linux has released v0.4 with minor feature enhancements. "Changes: The setup script has been rewritten. Minor bugfixes were made."
Mepis LinuxMepis Linux has released v2003.10 with major feature enhancements. From the change log, "With release 2003.10, MEPIS has expanded the functionality of the MEPIS Installation Center to allow the user to install MEPIS or repair the boot loader, Xconfig, make a floppy, or test the hard drive all while running from the Live-CD."
Recovery Is Possible!Recovery Is Possible! has released v6.6. "Changes: The kernel and some of the software has been updated."
Sentry FirewallSentry Firewall has released v1.5.0-rc7 with minor bugfixes. "Changes: Snort, FreeS/WAN, iptables, ebtables, and net-snmp have been updated. The rc.inet1 init script has also been updated to utilize the rc.inet1.conf file introduced in Slackware 9.1."
Webfish LinuxWebfish Linux has released v2.0pre1. "Changes: This version is built using the new LFS-5 packages as a base. Work has begun on sets of packages to extend functionality. These will be downloadable as binary, or as source with a nALFS XML defintion to build and install them. Installation is currently achieved using the same old method."
Second White Box Linux release candidate availableWhite Box Enterprise Linux is an attempt to make a free distribution based on Red Hat Enterprise Linux 3. The second release candidate for the "White Box Enterprise Linux 3.0" release is now available. White Box, if it can put together the developers to keep up with security updates and such, could eventually become another alternative for Red Hat Linux users looking for a new distribution. (Thanks to Xose Vazquez Perez).
Distribution reviews Hola, ADIOS boot CD (NewsForge)Here's a NewsForge review of the ADIOS Linux Boot CD. "Developed by the Queensland University of Technology in Brisbane, Australia, ADIOS is an acronym that stands for "Automated Download and Installation of Operating Systems." The original idea was to create a tool for easy installation of multiple operating systems on students' workstations, but as the project evolved and the original needs changed, more and more effort went into a Red Hat-based live CD, which is now known as ADIOS Linux Boot CD. Version 2.00, based on Red Hat Linux 9, was released last week."
SENTINIX Gives the Boot to Monitoring Woes (NewsForge)NewsForge takes a look at Sentinix and talks with developer Michel Blomgren. "Reboot the system and it starts with openMosix running and the pre-configured network and service monitoring tools are started and working. Where most CD distributions try to "do it all" or "do only one thing well", SENTINIX does just two."
Page editor: Rebecca Sobol |
|||||||||||||