From owner-freebsd-security@FreeBSD.ORG Sun Feb 27 20:12:26 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4C96516A4DD for ; Sun, 27 Feb 2005 20:12:26 +0000 (GMT) Received: from uucp.dinoex.sub.de (uucp.dinoex.sub.de [194.45.71.2]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7D44A43D1F for ; Sun, 27 Feb 2005 20:12:24 +0000 (GMT) (envelope-from pmc@citylink.dinoex.sub.org) Received: from uucp.dinoex.sub.de (uucp@uucp.dinoex.sub.de [194.45.71.2] (may be forged)) by uucp.dinoex.sub.de (8.13.3/8.13.3) with ESMTP id j1RKCHl2010907 for ; Sun, 27 Feb 2005 21:12:17 +0100 (CET) (envelope-from pmc@citylink.dinoex.sub.org) X-MDaemon-Deliver-To: Received: from citylink.dinoex.sub.org (uucp@localhost)j1RKCHIg010906 for freebsd-security@freebsd.org; Sun, 27 Feb 2005 21:12:17 +0100 (CET) (envelope-from pmc@citylink.dinoex.sub.org) Received: from gate.oper.dinoex.org (gate-e [192.168.98.2]) j1RJq98t096149 for ; Sun, 27 Feb 2005 20:52:09 +0100 (CET) (envelope-from peter@gate.oper.dinoex.org) Received: from gate.oper.dinoex.org (gate-e [192.168.98.2]) by gate.oper.dinoex.org (8.13.1/8.13.1) with ESMTP id j1RJpx6G096096 for ; Sun, 27 Feb 2005 20:52:00 +0100 (CET) (envelope-from peter@gate.oper.dinoex.org) Received: (from peter@localhost) by gate.oper.dinoex.org (8.13.1/8.13.1/Submit) id j1RJpxeo096095 for freebsd-security@freebsd.org; Sun, 27 Feb 2005 20:51:59 +0100 (CET) (envelope-from peter) Date: Sun, 27 Feb 2005 20:51:59 +0100 From: Peter Much To: freebsd-security@freebsd.org Message-ID: <20050227195159.GA93630@gate.oper.dinoex.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.4.2.1i X-Milter: Spamilter (Reciever: uucp.dinoex.sub.de; Sender-ip: 194.45.71.2; Sender-helo: uucp.dinoex.sub.de;) X-Mailman-Approved-At: Mon, 28 Feb 2005 13:29:43 +0000 Subject: ipfw deny or reject - not just a matter of taste? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 27 Feb 2005 20:12:26 -0000 Hi, I think this is worth a note. It was generally said the decision between deny and reject (aka unreach) could be taken lightly - and most people seem to prefer "deny", which complicates things for an attacker, because packets just vanish without any report and tasks timeout. But from my viewpoint, this argument falls into the category "security by obscurity", and I found by preferring "unreach" I get the advantage of intellegible errormessages appearing fastly, which helps at least while developing and modifying. And so I am really honest and put "unreach filter-prohib" in, which is just the truth and ends in a "permission denied" message on the application side. But now there is another matter here, and that should be taken more serious. When, while developing/modifying the ruleset, applications accidentally run into a "deny" rule, they will not notice it - the packet is then just one that disappeared in transit, as it can happen on the network, and the usual retry actions will apply or at least the service should continue as soon as the ruleset is corrected. But, when applications accidentally run into an "unreach" rule, they may react in maybe unexpected ways. So I just noticed that syslogd, when configured for remote logging, in this case logs an error of "sendto: Permission denied" locally with severity syslog.err, and then CEASES TO SEND MESSAGES to that host until it receives a kill -HUP. And this is not funny, because we do not think we have trouble when we do NOT get messages - just the opposite... Maybe such things may already happen when reloading rules - that depends on their sequence and individual layout. So it really is a good thing that ipfw provides the atomic functions for shifting sets of rules. Take care! PMc From owner-freebsd-security@FreeBSD.ORG Mon Feb 28 15:19:26 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0214716A4F3 for ; Mon, 28 Feb 2005 15:19:26 +0000 (GMT) Received: from bgo1smout1.broadpark.no (bgo1smout1.broadpark.no [217.13.4.94]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3EFFF43D64 for ; Mon, 28 Feb 2005 15:19:23 +0000 (GMT) (envelope-from des@des.no) Received: from bgo1sminn1.broadpark.no ([217.13.4.93]) by bgo1smout1.broadpark.no (Sun Java System Messaging Server 6.1 HotFix 0.05 (built Oct 21 2004)) with ESMTP id <0ICM00H7FNNC21E0@bgo1smout1.broadpark.no> for freebsd-security@freebsd.org; Mon, 28 Feb 2005 16:14:00 +0100 (CET) Received: from dsa.des.no ([80.203.228.37]) by bgo1sminn1.broadpark.no (Sun Java System Messaging Server 6.1 HotFix 0.05 (built Oct 21 2004)) with ESMTP id <0ICM00CXVNZRQYB0@bgo1sminn1.broadpark.no> for freebsd-security@freebsd.org; Mon, 28 Feb 2005 16:21:27 +0100 (CET) Received: by dsa.des.no (Pony Express, from userid 666) id D1AB54535E; Mon, 28 Feb 2005 16:19:20 +0100 (CET) Received: from xps.des.no (xps.des.no [10.0.0.12]) by dsa.des.no (Pony Express) with ESMTP id DB3FF4516C; Mon, 28 Feb 2005 16:19:00 +0100 (CET) Received: by xps.des.no (Postfix, from userid 1001) id BF51033C3E; Mon, 28 Feb 2005 16:19:00 +0100 (CET) Date: Mon, 28 Feb 2005 16:19:00 +0100 From: des@des.no (=?iso-8859-1?q?Dag-Erling_Sm=F8rgrav?=) In-reply-to: <20050227195159.GA93630@gate.oper.dinoex.org> To: Peter Much Message-id: <86sm3ghfvf.fsf@xps.des.no> MIME-version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: quoted-printable X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on dsa.des.no References: <20050227195159.GA93630@gate.oper.dinoex.org> User-Agent: Gnus/5.110002 (No Gnus v0.2) Emacs/21.3 (berkeley-unix) X-Spam-Status: No, score=-2.8 required=5.0 tests=ALL_TRUSTED,AWL autolearn=disabled version=3.0.1 X-Spam-Level: cc: freebsd-security@freebsd.org Subject: Re: ipfw deny or reject - not just a matter of taste? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Feb 2005 15:19:26 -0000 Peter Much writes: > Maybe such things may already happen when reloading rules - that depends > on their sequence and individual layout. So it really is a good thing that > ipfw provides the atomic functions for shifting sets of rules. Look for 'ipfw set' in the ipfw man page. DES --=20 Dag-Erling Sm=F8rgrav - des@des.no From owner-freebsd-security@FreeBSD.ORG Mon Feb 28 16:26:29 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 31A4716A4D6 for ; Mon, 28 Feb 2005 16:26:29 +0000 (GMT) Received: from mail.freebsd.org.cn (dns3.freebsd.org.cn [61.129.66.75]) by mx1.FreeBSD.org (Postfix) with SMTP id 45B8043D54 for ; Mon, 28 Feb 2005 16:26:13 +0000 (GMT) (envelope-from delphij@frontfree.net) Received: (qmail 57449 invoked by uid 0); 28 Feb 2005 16:17:03 -0000 Received: from unknown (HELO beastie.frontfree.net) (219.239.99.7) by mail.freebsd.org.cn with SMTP; 28 Feb 2005 16:17:03 -0000 Received: from localhost (localhost.frontfree.net [127.0.0.1]) by beastie.frontfree.net (Postfix) with ESMTP id 1CF591321B9; Tue, 1 Mar 2005 00:26:00 +0800 (CST) Received: from beastie.frontfree.net ([127.0.0.1]) by localhost (beastie.frontfree.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 67934-04; Tue, 1 Mar 2005 00:25:48 +0800 (CST) Received: by beastie.frontfree.net (Postfix, from userid 1001) id 1C369135C87; Tue, 1 Mar 2005 00:25:48 +0800 (CST) Date: Tue, 1 Mar 2005 00:25:48 +0800 From: Xin LI To: freebsd-arch@FreeBSD.org, freebsd-security@FreeBSD.org Message-ID: <20050228162548.GA57140@frontfree.net> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="KsGdsel6WgEHnImy" Content-Disposition: inline User-Agent: Mutt/1.4.2.1i X-GPG-key-ID/Fingerprint: 0xCAEEB8C0 / 43B8 B703 B8DD 0231 B333 DC28 39FB 93A0 CAEE B8C0 X-GPG-Public-Key: http://www.delphij.net/delphij.asc X-Operating-System: FreeBSD beastie.frontfree.net 5.3-RELEASE-p2 FreeBSD 5.3-RELEASE-p2 #15: Wed Dec 15 10:43:16 CST 2004 delphij@beastie.frontfree.net:/usr/obj/usr/src/sys/BEASTIE i386 X-URL: http://www.delphij.net X-By: delphij@beastie.frontfree.net X-Location: Beijing, China X-Virus-Scanned: by amavisd-new at frontfree.net Subject: bind() on 127.0.0.1 in jail: bound to the outside address? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Feb 2005 16:26:29 -0000 --KsGdsel6WgEHnImy Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Dear folks, It seems that doing bind() inside a jail (whose IP address is an outside address), will result in some wierd behavior, that the actual bind is done on the outside address. For example, binding to 127.0.0.1:6666 inside a jail addressed 192.168.1.1, will finally result in a bind to 192.168.1.1:6666. With this in mind, it is possible that some formerly secure configuration fail in jail environment. It seems that our implementation will forward every loopback connection to the outside address. A simple hack to work around this issue might be to modify the individual bind procedures to treat prison case with loopback address, but I'm not sure if a true solution can solve the issue with minimum code change and code complexity. Your ideas are highly appreciated! Cheers, --=20 Xin LI http://www.delphij.net/ See complete headers for GPG key and other information. --KsGdsel6WgEHnImy Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) iD8DBQFCI0YM/cVsHxFZiIoRAnqIAJ9POX6OwQUb9k8jOQcNmdyEanmutwCeLQaA rxIUQwv4OU3t2ziOu5defsQ= =li2c -----END PGP SIGNATURE----- --KsGdsel6WgEHnImy-- From owner-freebsd-security@FreeBSD.ORG Mon Feb 28 21:12:29 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id BD73216A4CF for ; Mon, 28 Feb 2005 21:12:29 +0000 (GMT) Received: from wproxy.gmail.com (wproxy.gmail.com [64.233.184.196]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3C17143D48 for ; Mon, 28 Feb 2005 21:12:29 +0000 (GMT) (envelope-from fehwalker@gmail.com) Received: by wproxy.gmail.com with SMTP id 49so16811wri for ; Mon, 28 Feb 2005 13:12:28 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:references; b=WPhoVyFFt4GrYAJv0e3PhwncN3xdAQdcODqsUV+mVU7DD3Qc4rekisBBqB6DlVzty/TYcVLkgZzyhO9XZH11BbtjZjMkutvfQCTumrx/IXtyxmHeIud5msdo3cXEpa//HYfI/kRq2yl/KTG3HCaEm2wDfZxk/v4VubPn8QyUwcY= Received: by 10.54.17.14 with SMTP id 14mr64523wrq; Mon, 28 Feb 2005 13:12:28 -0800 (PST) Received: by 10.54.19.52 with HTTP; Mon, 28 Feb 2005 13:12:28 -0800 (PST) Message-ID: <35de0c300502281312617af051@mail.gmail.com> Date: Mon, 28 Feb 2005 16:12:28 -0500 From: Bryan Fullerton To: freebsd-arch@freebsd.org, freebsd-security@freebsd.org In-Reply-To: <20050228162548.GA57140@frontfree.net> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit References: <20050228162548.GA57140@frontfree.net> Subject: Re: bind() on 127.0.0.1 in jail: bound to the outside address? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Bryan Fullerton List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Feb 2005 21:12:29 -0000 I'd noticed this as well, but assumed it was a feature. Given that there's only one IP inside the jail, how do you bind to a loopback IP that doesn't exist? I suspect the behavior you're seeing is another 'simple hack' to allow binding to the loopback IP to not just immediately fail with "unable to bind". If this isn't documented somewhere (I didn't bother to check, it made sense to me once I figured out what it was doing) it should be. I have noticed that documentation of jail in the handbook in general is a bit lacking, maybe I'll see if I can find time to look at that (heh). Bryan On Tue, 1 Mar 2005 00:25:48 +0800, Xin LI wrote: > Dear folks, > > It seems that doing bind() inside a jail (whose IP address is an outside > address), will result in some wierd behavior, that the actual bind is > done on the outside address. > > For example, binding to 127.0.0.1:6666 inside a jail addressed 192.168.1.1, > will finally result in a bind to 192.168.1.1:6666. With this in mind, > it is possible that some formerly secure configuration fail in jail > environment. > > It seems that our implementation will forward every loopback connection > to the outside address. A simple hack to work around this issue might > be to modify the individual bind procedures to treat prison case with > loopback address, but I'm not sure if a true solution can solve the > issue with minimum code change and code complexity. > > Your ideas are highly appreciated! > > Cheers, > -- > Xin LI http://www.delphij.net/ > See complete headers for GPG key and other information. > > > From owner-freebsd-security@FreeBSD.ORG Thu Mar 3 08:03:35 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C714216A4CE for ; Thu, 3 Mar 2005 08:03:35 +0000 (GMT) Received: from brainbox.winbot.co.uk (cpc2-mapp3-6-0-cust221.nott.cable.ntl.com [81.101.250.221]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3880043D2F for ; Thu, 3 Mar 2005 08:03:35 +0000 (GMT) (envelope-from brain@winbot.co.uk) Received: from synapse.brainbox.winbot.co.uk ([10.0.0.2] helo=[192.168.1.10]) by brainbox.winbot.co.uk with esmtp (Exim 4.24; FreeBSD) id 1D6nJz-0002Bc-8a for freebsd-security@freebsd.org; Thu, 03 Mar 2005 10:12:43 +0000 Message-ID: <4226C4DF.3050806@winbot.co.uk> Date: Thu, 03 Mar 2005 08:03:43 +0000 From: Craig Edwards Organization: Crypt Software User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: freebsd-security@freebsd.org X-Enigmail-Version: 0.90.1.1 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Renaming root account X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: brain@winbot.co.uk List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Mar 2005 08:03:35 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi everyone, One quick question: Is it safe and/or sensible to rename the root account, so that the only uid 0 user on a system is something different to root? I can see how this would be effective against external attackers who have no knowledge of the internals of the system as they would spend pointless hours trying to crack a user which doesnt exist, however to internal users they could always just cat /etc/passwd and see that root has been renamed. So firstly, is this possible, and security wise is it of any real use? Can anyone think of any apps it would break that assume that the uid 0 user is called root and don't just address the user by its uid? Thanks, Craig Edwards - -- WinBot IRC client developer: http://www.winbot.co.uk ChatSpike - The users network: http://www.chatspike.net InspIRCd - Modular IRC server: http://www.inspircd.org Online RPG Developer: http://www.ssod.org - -- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (MingW32) iD8DBQFCJsTf0k42Wxli/BARAp2DAJ9dp1eu2IL41pfp/4ZFp9kS2KuMdgCeI20k w1Jt+uriEmWM+wmhEFxH+vw= =vGhO -----END PGP SIGNATURE----- From owner-freebsd-security@FreeBSD.ORG Thu Mar 3 08:16:24 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 650D716A4CE for ; Thu, 3 Mar 2005 08:16:24 +0000 (GMT) Received: from home.ephemeron.org (68-190-193-132.riv-mres.charterpipeline.net [68.190.193.132]) by mx1.FreeBSD.org (Postfix) with ESMTP id CCFD743D1D for ; Thu, 3 Mar 2005 08:16:21 +0000 (GMT) (envelope-from bigby@ephemeron.org) Received: from home.fake.net (bigby@localhost [127.0.0.1]) by home.ephemeron.org (8.12.8p2/8.12.8) with ESMTP id j238GLs3084353; Thu, 3 Mar 2005 00:16:21 -0800 (PST) (envelope-from bigby@ephemeron.org) Received: from localhost (bigby@localhost)j238GIkp084350; Thu, 3 Mar 2005 00:16:21 -0800 (PST) X-Authentication-Warning: home.fake.net: bigby owned process doing -bs Date: Thu, 3 Mar 2005 00:16:18 -0800 (PST) From: Bigby Findrake X-X-Sender: bigby@home.fake.net To: Craig Edwards In-Reply-To: <4226C4DF.3050806@winbot.co.uk> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: freebsd-security@freebsd.org Subject: Re: Renaming root account X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Mar 2005 08:16:24 -0000 There may be others, but here are 2... 1. It's not a *good* idea because it's security through obscurity. It's not a bad idea on that account, but you should realize the limitations of security through obscurity when using that tactic. 2. It's a *bad* idea because you don't know what things *might* break down the road, even if you did manage to either verify that nothing would break currently if you made the change or fixed everything that would break currently if you made the change. Also, as you suggest in your question, I believe that most binary executables use "uid 0" vs "root", so changing the name of the account there might be of limited use. Additionally, with many remote attack types (eg. remote buffer overflows), the attacker does not need to know what access he is trying to get (eg. root or non-root), only what service her/his attack will use as a vector. For example, a remote attacker may not know that sendmail is running as the user "root" or "fakeroot," but neither does the attacker need to know what user sendmail is running as *if s/he is successfully able to execute her/his code* - s/he has gained some sort of access, privileged or otherwise. On Thu, 3 Mar 2005, Craig Edwards wrote: > Hi everyone, > > One quick question: Is it safe and/or sensible to rename the root > account, so that the only uid 0 user on a system is something different > to root? I can see how this would be effective against external > attackers who have no knowledge of the internals of the system as they > would spend pointless hours trying to crack a user which doesnt exist, > however to internal users they could always just cat /etc/passwd and see > that root has been renamed. So firstly, is this possible, and security > wise is it of any real use? Can anyone think of any apps it would break > that assume that the uid 0 user is called root and don't just address > the user by its uid? > > Thanks, > Craig Edwards > > -- > WinBot IRC client developer: http://www.winbot.co.uk > ChatSpike - The users network: http://www.chatspike.net > InspIRCd - Modular IRC server: http://www.inspircd.org > Online RPG Developer: http://www.ssod.org > --Signature by unknown keyid: 0x1962FC10 > /-------------------------------------------------------------------------/ "It was half way to Rivendell when the drugs began to take hold" --Hunter S Tolkien "Fear and Loathing in Barad Dur" finger://bigby@ephemeron.org http://www.ephemeron.org/~bigby/ news://news.ephemeron.org/alt.lemurs /-------------------------------------------------------------------------/ From owner-freebsd-security@FreeBSD.ORG Thu Mar 3 08:42:39 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6B33316A4CE for ; Thu, 3 Mar 2005 08:42:39 +0000 (GMT) Received: from mail.nativenerds.com (host-70-0-111-24.midco.net [24.111.0.70]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8282C43D2F for ; Thu, 3 Mar 2005 08:42:38 +0000 (GMT) (envelope-from estover@nativenerds.com) Received: from red (host-14-37-230-24.midco.net [24.230.37.14]) j238okQl048192; Thu, 3 Mar 2005 01:50:47 -0700 (MST) (envelope-from estover@nativenerds.com) From: Ed Stover To: freebsd-security@freebsd.org In-Reply-To: <4226C4DF.3050806@winbot.co.uk> References: <4226C4DF.3050806@winbot.co.uk> Content-Type: text/plain Organization: Native Nerds Date: Thu, 03 Mar 2005 01:42:32 -0700 Message-Id: <1109839352.4804.24.camel@red.nativenerds.com> Mime-Version: 1.0 X-Mailer: Evolution 2.0.3 FreeBSD GNOME Team Port Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.63 X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on mail.nativenerds.com cc: brain@winbot.co.uk Subject: Re: Renaming root account X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: estover@nativenerds.com List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Mar 2005 08:42:39 -0000 This response is a bit off of what you asked but I will just toss this out there. I generally protect my machines from the root user but utilizing chflags and kernel secure levels. That way if an attacker were to gain root access they wouldn't be able to change files... On my firewalls I modify rc.conf to boot to secure level 2 ,then I lock down /bin /sbin /etc /usr/local/etc with chflags schg while still in secure level 0 then reboot. Upon the restart you have a very secure machine that is protected from root user. In secure level two, even root cannot change those files flagged immutable. The only way to change those files would be to have physical access to the machine and modify rc.conf in single user mode and then reboot change the flags back from immutable and then modify the files. That is a bit too secure to be user friendly. I am just a getRdun type of person, you could lock down certain files and leave the five passwd files alone so users could change their passwords but generally attackers try to add themselves an account right away. What application would you be using the server for? Most H4X0RZ attacks I have seen where they have gained shell access are stumped when it comes to file flags and kernel secure levels. On Thu, 2005-03-03 at 08:03 +0000, Craig Edwards wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi everyone, > > One quick question: Is it safe and/or sensible to rename the root > account, so that the only uid 0 user on a system is something different > to root? I can see how this would be effective against external > attackers who have no knowledge of the internals of the system as they > would spend pointless hours trying to crack a user which doesnt exist, > however to internal users they could always just cat /etc/passwd and see > that root has been renamed. So firstly, is this possible, and security > wise is it of any real use? Can anyone think of any apps it would break > that assume that the uid 0 user is called root and don't just address > the user by its uid? > > Thanks, > Craig Edwards > > - -- > WinBot IRC client developer: http://www.winbot.co.uk > ChatSpike - The users network: http://www.chatspike.net > InspIRCd - Modular IRC server: http://www.inspircd.org > Online RPG Developer: http://www.ssod.org > - -- > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.5 (MingW32) > > iD8DBQFCJsTf0k42Wxli/BARAp2DAJ9dp1eu2IL41pfp/4ZFp9kS2KuMdgCeI20k > w1Jt+uriEmWM+wmhEFxH+vw= > =vGhO > -----END PGP SIGNATURE----- > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" From owner-freebsd-security@FreeBSD.ORG Thu Mar 3 08:53:47 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 95C6716A4CE for ; Thu, 3 Mar 2005 08:53:47 +0000 (GMT) Received: from brainbox.winbot.co.uk (cpc2-mapp3-6-0-cust221.nott.cable.ntl.com [81.101.250.221]) by mx1.FreeBSD.org (Postfix) with ESMTP id A7F4743D3F for ; Thu, 3 Mar 2005 08:53:46 +0000 (GMT) (envelope-from brain@winbot.co.uk) Received: from synapse.brainbox.winbot.co.uk ([10.0.0.2] helo=[192.168.1.10]) by brainbox.winbot.co.uk with esmtp (Exim 4.24; FreeBSD) id 1D6o6Z-0002MN-79; Thu, 03 Mar 2005 11:02:55 +0000 Message-ID: <4226D0A2.70508@winbot.co.uk> Date: Thu, 03 Mar 2005 08:53:54 +0000 From: Craig Edwards Organization: Crypt Software User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: estover@nativenerds.com References: <4226C4DF.3050806@winbot.co.uk> <1109839352.4804.24.camel@red.nativenerds.com> In-Reply-To: <1109839352.4804.24.camel@red.nativenerds.com> X-Enigmail-Version: 0.90.1.1 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit cc: freebsd-security@freebsd.org Subject: Re: Renaming root account X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: brain@winbot.co.uk List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Mar 2005 08:53:47 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thanks Ed, My system already has securelevel 2 set and immutable flags on most of its core system files in /sbin and /bin, etc. Basically i am aware of the fact that other systems (for example windows) let you change the administrative user's username to enhance security that little bit more. Security through obscurity on its own is not a good method of securing a network but when combined with other systems, it can be an advantage. Currently i also utilize samhain and make regular (nightly) backups to a windows machine behind a second router (which is a security aspect many people will overlook!). I run nightly virus scans from my /etc/periodic and update the signatures automatically, as i have lost a redhat linux machine before due to a cracker dropping the RST.b trojan/virus onto it, and this would locate such a problem and allow me to reformat the machine faster. The machine is being used as my internet gateway for my small network and also as a collaberative centre for a group of users who work on my programming projects. These users are trusted of course but the more users you add to a system the more chance there is of it being compromised as there is more to keep track of and more to audit, so the more layers of security you can use, the better. Thanks for your time, Craig Ed Stover wrote: > This response is a bit off of what you asked but I will just toss this > out there. > I generally protect my machines from the root user but utilizing > chflags and kernel secure levels. That way if an attacker were to gain > root access they wouldn't be able to change files... On my firewalls I > modify rc.conf to boot to secure level 2 ,then I lock > down /bin /sbin /etc /usr/local/etc with chflags schg while still in > secure level 0 then reboot. Upon the restart you have a very secure > machine that is protected from root user. In secure level two, even root > cannot change those files flagged immutable. The only way to change > those files would be to have physical access to the machine and modify > rc.conf in single user mode and then reboot change the flags back from > immutable and then modify the files. That is a bit too secure to be > user friendly. I am just a getRdun type of person, you could lock down > certain files and leave the five passwd files alone so users could > change their passwords but generally attackers try to add themselves an > account right away. What application would you be using the server for? > Most H4X0RZ attacks I have seen where they have gained shell access are > stumped when it comes to file flags and kernel secure levels. > On Thu, 2005-03-03 at 08:03 +0000, Craig Edwards wrote: > > Hi everyone, > > One quick question: Is it safe and/or sensible to rename the root > account, so that the only uid 0 user on a system is something different > to root? I can see how this would be effective against external > attackers who have no knowledge of the internals of the system as they > would spend pointless hours trying to crack a user which doesnt exist, > however to internal users they could always just cat /etc/passwd and see > that root has been renamed. So firstly, is this possible, and security > wise is it of any real use? Can anyone think of any apps it would break > that assume that the uid 0 user is called root and don't just address > the user by its uid? > > Thanks, > Craig Edwards > _______________________________________________ freebsd-security@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" - -- WinBot IRC client developer: http://www.winbot.co.uk ChatSpike - The users network: http://www.chatspike.net InspIRCd - Modular IRC server: http://www.inspircd.org Online RPG Developer: http://www.ssod.org - -- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (MingW32) iD8DBQFCJtCi0k42Wxli/BARAuzfAJ4yOV0OTXmrwa0PYTp2BPTU4pMWsQCfYX29 kPWaZ4Oz/q0Bf8xg4D6HoHo= =RZT4 -----END PGP SIGNATURE----- From owner-freebsd-security@FreeBSD.ORG Thu Mar 3 12:57:03 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id BA68716A4CE for ; Thu, 3 Mar 2005 12:57:03 +0000 (GMT) Received: from splinter.bowdoin.edu (splinter.bowdoin.edu [139.140.181.132]) by mx1.FreeBSD.org (Postfix) with ESMTP id E428643D2F for ; Thu, 3 Mar 2005 12:57:02 +0000 (GMT) (envelope-from alec@thened.net) Received: by splinter.bowdoin.edu (Postfix, from userid 12008) id 60179C11A; Thu, 3 Mar 2005 07:57:02 -0500 (EST) Date: Thu, 3 Mar 2005 07:57:02 -0500 From: Alec Berryman To: freebsd-security@freebsd.org Message-ID: <20050303125702.GA52534@thened.net> Mail-Followup-To: freebsd-security@freebsd.org References: <4226C4DF.3050806@winbot.co.uk> <1109839352.4804.24.camel@red.nativenerds.com> <4226D0A2.70508@winbot.co.uk> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="sdtB3X0nJg68CQEu" Content-Disposition: inline In-Reply-To: <4226D0A2.70508@winbot.co.uk> X-Ned-Wuz-Here: Yes X-GPG-Fingerprint: 3DB5 8785 53D9 8BF4 5049 B6B9 02E7 7FD9 881C 85C4 X-GPG-Key: http://www.thened.net/~alec/static/alec.asc User-Agent: Mutt/1.5.8i Subject: Re: Renaming root account X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Mar 2005 12:57:03 -0000 --sdtB3X0nJg68CQEu Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Craig Edwards on 2005-03-03 08:53:54 +0000: > Basically i am aware of the fact that other systems (for example > windows) let you change the administrative user's username to > enhance security that little bit more. On our networks we have certainly changed the Windows Administrator account's name, but that's mostly because there's no good way to remotely log in as an unprivileged user and perform the equivalent of 'su -'. [1] I suggest that instead of changing root's username that you simply disallow direct remote logins as root and require anyone who needs root access to go through an unprivileged user account. I would guess with the level of security measures you've put in place this has already been done, but I didn't see you mention it. Certainly you mentioned that changing root's username won't fool local users, but I think that disallowing remote logins as root provides the same end as changing the Administrator account on Windows. > Security through obscurity on its own is not a good method of > securing a network but when combined with other systems, it can be > an advantage. There's certainly nothing wrong with obscuring things a little as long as it's only part of the whole security plan. [1] I'm no Windows guru - if there is a way I'd certainly like to know! --sdtB3X0nJg68CQEu Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) iD8DBQFCJwmeAud/2YgchcQRAo6kAKChVEm/jwV+6aqTDa2sXyPstgwr1QCgn0CU 3nSnCuRw4jcKKkHGEsWg5HI= =zcry -----END PGP SIGNATURE----- --sdtB3X0nJg68CQEu-- From owner-freebsd-security@FreeBSD.ORG Thu Mar 3 09:22:07 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EA57216A4CE for ; Thu, 3 Mar 2005 09:22:07 +0000 (GMT) Received: from smtp-vbr12.xs4all.nl (smtp-vbr12.xs4all.nl [194.109.24.32]) by mx1.FreeBSD.org (Postfix) with ESMTP id 183BD43D60 for ; Thu, 3 Mar 2005 09:22:05 +0000 (GMT) (envelope-from wouter@spierenburg.net) Received: from wouter (drunken.ircuser.org [82.92.95.187]) by smtp-vbr12.xs4all.nl (8.12.11/8.12.11) with SMTP id j239M0sd016206 for ; Thu, 3 Mar 2005 10:22:04 +0100 (CET) (envelope-from wouter@spierenburg.net) Message-ID: <029801c51fd2$783a7f60$0100000a@wouter> From: "Wouter" To: References: <4226C4DF.3050806@winbot.co.uk> Date: Thu, 3 Mar 2005 10:22:05 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1478 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1478 X-Virus-Scanned: by XS4ALL Virus Scanner X-Mailman-Approved-At: Thu, 03 Mar 2005 13:39:33 +0000 Subject: Re: Renaming root account X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Mar 2005 09:22:08 -0000 Renaming root is generally a bad idea, what you could do, however, is set a password on(thus enabling) the "toor" account and set root's shell to /sbin/nologin Wouter ----- Original Message ----- From: "Craig Edwards" To: Sent: Thursday, March 03, 2005 09:03 Subject: Renaming root account > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi everyone, > > One quick question: Is it safe and/or sensible to rename the root > account, so that the only uid 0 user on a system is something different > to root? I can see how this would be effective against external > attackers who have no knowledge of the internals of the system as they > would spend pointless hours trying to crack a user which doesnt exist, > however to internal users they could always just cat /etc/passwd and see > that root has been renamed. So firstly, is this possible, and security > wise is it of any real use? Can anyone think of any apps it would break > that assume that the uid 0 user is called root and don't just address > the user by its uid? > > Thanks, > Craig Edwards > > - -- > WinBot IRC client developer: http://www.winbot.co.uk > ChatSpike - The users network: http://www.chatspike.net > InspIRCd - Modular IRC server: http://www.inspircd.org > Online RPG Developer: http://www.ssod.org > - -- > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.5 (MingW32) > > iD8DBQFCJsTf0k42Wxli/BARAp2DAJ9dp1eu2IL41pfp/4ZFp9kS2KuMdgCeI20k > w1Jt+uriEmWM+wmhEFxH+vw= > =vGhO > -----END PGP SIGNATURE----- > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" > From owner-freebsd-security@FreeBSD.ORG Thu Mar 3 14:06:38 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 53CC816A4CE for ; Thu, 3 Mar 2005 14:06:38 +0000 (GMT) Received: from mail.scls.lib.wi.us (mail.scls.lib.wi.us [198.150.40.25]) by mx1.FreeBSD.org (Postfix) with ESMTP id CD4E643D54 for ; Thu, 3 Mar 2005 14:06:37 +0000 (GMT) (envelope-from nalists@scls.lib.wi.us) Received: from [172.26.2.238] ([172.26.2.238]) by mail.scls.lib.wi.us (8.12.9p2/8.12.9) with ESMTP id j23E6akA057927; Thu, 3 Mar 2005 08:06:36 -0600 (CST) (envelope-from nalists@scls.lib.wi.us) Message-ID: <422719BC.8060600@scls.lib.wi.us> Date: Thu, 03 Mar 2005 08:05:48 -0600 From: Greg Barniskis User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Alec Berryman References: <4226C4DF.3050806@winbot.co.uk> <1109839352.4804.24.camel@red.nativenerds.com> <4226D0A2.70508@winbot.co.uk> <20050303125702.GA52534@thened.net> In-Reply-To: <20050303125702.GA52534@thened.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit cc: freebsd-security@freebsd.org Subject: Re: Renaming root account X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Mar 2005 14:06:38 -0000 Alec Berryman wrote: ... > On our networks we have certainly changed the Windows Administrator > account's name, but that's mostly because there's no good way to > remotely log in as an unprivileged user and perform the equivalent of > 'su -'. [1] ... > > > [1] I'm no Windows guru - if there is a way I'd certainly like to know! Alec, see the URL below re: the "runas" cmd line tool and the "Run as..." GUI widgetry (the link is probably wrapped and broken): http://www.microsoft.com/windows2000/en/advanced/help/default.asp?url=/windows2000/en/advanced/help/windows_security_runas.htm?id=767 Sorry to everyone else for bringing the site of the beast into this forum, but this is an important and not well-understood feature of modern Windows (and the question was raised). I like to use runas best on the command line, which I find is most effective with a batch wrapper so I don't have to type in all the syntax. Never tried using it remotely, but I assume it would work. The only thing I don't understand is why MS doesn't trumpet this privilege differentiation feature during the OS installation (like FreeBSD and others do) so that people could be, like, clueful and stuff. I guess it'd lower their demand for paid tech support. ;-) -- Greg Barniskis, Computer Systems Integrator South Central Library System (SCLS) Library Interchange Network (LINK) , (608) 266-6348 From owner-freebsd-security@FreeBSD.ORG Thu Mar 3 17:13:34 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5A6A016A4CE for ; Thu, 3 Mar 2005 17:13:34 +0000 (GMT) Received: from hermes0.pyramidbrew.com (hermes0.pyramidbrew.com [12.46.52.105]) by mx1.FreeBSD.org (Postfix) with ESMTP id EF45143D2D for ; Thu, 3 Mar 2005 17:13:31 +0000 (GMT) (envelope-from APowers@PyramidBrew.com) Received: from mercury0.pyramidbrew.com (mercury0.pyramidbrew.com [192.168.0.60]) by hermes0.pyramidbrew.com (Postfix) with ESMTP id 85C0F5C77; Thu, 3 Mar 2005 09:13:32 -0800 (PST) Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Date: Thu, 3 Mar 2005 09:12:38 -0800 Message-ID: <1AE2004B175A3D4A8B6230A10D0B5BE368E420@mercury0.pyramidbrew.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Renaming root account Thread-Index: AcUf9m9Dez50041oSHKDcb50qBHungAHDrSw From: "Atom Powers" To: "Wouter" , Subject: RE: Renaming root account X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Mar 2005 17:13:34 -0000 =20 Enabling "toor" is not very different from renaming the root account, = worse because you would then have two "root" (uid 0) accounts. I don't see any harm in renaming the root account, but I don't think it = would do much either. Most processes that use root run with setuid 0, = regardless of what's in the passwd file. Even in user land you don't have to know what = the root account is named if you use 'su' or 'sudo'. The only case I can envision where it would make a difference is if you = have an application which wants to run as a specific (usually unpriv.) user = and you set it to use "root", or if you allow "root" logon through ssh (bad = idea) or terminal (but if somebody can get that then you are already in = trouble). ---- Perfection is just a word I use occasionally with mustard. Atom Powers Systems Administrator Pyramid Breweries Inc. 206.682.8322 x251 -----Original Message----- From: owner-freebsd-security@freebsd.org [mailto:owner-freebsd-security@freebsd.org] On Behalf Of Wouter Sent: Thursday, March 03, 2005 1:22 AM To: freebsd-security@freebsd.org Subject: Re: Renaming root account Renaming root is generally a bad idea, what you could do, however, is = set a password on(thus enabling) the "toor" account and set root's shell to /sbin/nologin Wouter ----- Original Message ----- From: "Craig Edwards" To: Sent: Thursday, March 03, 2005 09:03 Subject: Renaming root account > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi everyone, > > One quick question: Is it safe and/or sensible to rename the root > account, so that the only uid 0 user on a system is something = different > to root? I can see how this would be effective against external > attackers who have no knowledge of the internals of the system as they > would spend pointless hours trying to crack a user which doesnt exist, > however to internal users they could always just cat /etc/passwd and = see > that root has been renamed. So firstly, is this possible, and security > wise is it of any real use? Can anyone think of any apps it would = break > that assume that the uid 0 user is called root and don't just address > the user by its uid? > > Thanks, > Craig Edwards > > - -- > WinBot IRC client developer: http://www.winbot.co.uk > ChatSpike - The users network: http://www.chatspike.net > InspIRCd - Modular IRC server: http://www.inspircd.org > Online RPG Developer: http://www.ssod.org > - -- > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.5 (MingW32) > > iD8DBQFCJsTf0k42Wxli/BARAp2DAJ9dp1eu2IL41pfp/4ZFp9kS2KuMdgCeI20k > w1Jt+uriEmWM+wmhEFxH+vw=3D > =3DvGhO > -----END PGP SIGNATURE----- > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" > _______________________________________________ freebsd-security@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to = "freebsd-security-unsubscribe@freebsd.org" From owner-freebsd-security@FreeBSD.ORG Fri Mar 4 13:05:43 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0868B16A4CE for ; Fri, 4 Mar 2005 13:05:43 +0000 (GMT) Received: from avscan2.sentex.ca (avscan2.sentex.ca [199.212.134.19]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8B6B343D53 for ; Fri, 4 Mar 2005 13:05:42 +0000 (GMT) (envelope-from mike@sentex.net) Received: from localhost (localhost.sentex.ca [127.0.0.1]) by avscan2.sentex.ca (8.12.11/8.12.11) with ESMTP id j24D5jQG042543 for ; Fri, 4 Mar 2005 08:05:45 -0500 (EST) (envelope-from mike@sentex.net) Received: from avscan2.sentex.ca ([127.0.0.1]) by localhost (avscan2.sentex.ca [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 42165-05 for ; Fri, 4 Mar 2005 08:05:44 -0500 (EST) Received: from lava.sentex.ca (pyroxene.sentex.ca [199.212.134.18]) by avscan2.sentex.ca (8.12.11/8.12.11) with ESMTP id j24D5iDF042536 for ; Fri, 4 Mar 2005 08:05:44 -0500 (EST) (envelope-from mike@sentex.net) Received: from simian.sentex.net (simeon.sentex.ca [192.168.43.27]) by lava.sentex.ca (8.12.11/8.12.11) with ESMTP id j24D5Yve019915 for ; Fri, 4 Mar 2005 08:05:34 -0500 (EST) (envelope-from mike@sentex.net) Message-Id: <6.2.1.2.0.20050304075708.0478bdf0@64.7.153.2> X-Mailer: QUALCOMM Windows Eudora Version 6.2.1.2 Date: Fri, 04 Mar 2005 07:58:35 -0500 To: freebsd-security@freebsd.org From: Mike Tancsa Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Virus-Scanned: by amavisd-new X-Virus-Scanned: by amavisd-new at avscan2b Subject: Fwd: FreeBSD hiding security stuff X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Mar 2005 13:05:43 -0000 FYI >To: misc@openbsd.org >Subject: FreeBSD hiding security stuff >Date: Fri, 04 Mar 2005 03:51:42 -0700 >From: Theo de Raadt > >A few FreeBSD developers apparently have found some security issue >of some sort affecting i386 operating systems in some cases. > >They have refused to give us real details. > >A promise is now being made. > >If a bug is found in OpenSSH, which we believe to have security >consequences, we wil inform FreeBSD last. > >Fair is fair. > >I really wish it was not this way, but after a week of trying to get the >policy to be fixed, we are changing our policy as well. > >Without immediate action from them to repair their polcy, and a public >apology for this, that policy will stand. -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike@sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike From owner-freebsd-security@FreeBSD.ORG Fri Mar 4 13:28:17 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A15CF16A4CF for ; Fri, 4 Mar 2005 13:28:17 +0000 (GMT) Received: from web26805.mail.ukl.yahoo.com (web26805.mail.ukl.yahoo.com [217.146.176.81]) by mx1.FreeBSD.org (Postfix) with SMTP id D6E4C43D2D for ; Fri, 4 Mar 2005 13:28:16 +0000 (GMT) (envelope-from cguttesen@yahoo.dk) Received: (qmail 90038 invoked by uid 60001); 4 Mar 2005 13:28:15 -0000 Message-ID: <20050304132815.90036.qmail@web26805.mail.ukl.yahoo.com> Received: from [194.248.174.58] by web26805.mail.ukl.yahoo.com via HTTP; Fri, 04 Mar 2005 14:28:15 CET Date: Fri, 4 Mar 2005 14:28:15 +0100 (CET) From: Claus Guttesen To: Mike Tancsa , freebsd-security@freebsd.org In-Reply-To: <6.2.1.2.0.20050304075708.0478bdf0@64.7.153.2> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Subject: Re: Fwd: FreeBSD hiding security stuff X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Mar 2005 13:28:17 -0000 > FYI > > > >To: misc@openbsd.org > >Subject: FreeBSD hiding security stuff > >Date: Fri, 04 Mar 2005 03:51:42 -0700 > >From: Theo de Raadt > > > >A few FreeBSD developers apparently have found some > security issue > >of some sort affecting i386 operating systems in > some cases. > > > >They have refused to give us real details. > > > >A promise is now being made. > > > >If a bug is found in OpenSSH, which we believe to > have security > >consequences, we wil inform FreeBSD last. > > > >Fair is fair. > > > >I really wish it was not this way, but after a week > of trying to get the > >policy to be fixed, we are changing our policy as > well. > > > >Without immediate action from them to repair their > polcy, and a public > >apology for this, that policy will stand. > Did you verify with Theo whether this mail originated from him? regards Claus From owner-freebsd-security@FreeBSD.ORG Fri Mar 4 13:28:21 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1644316A4D4 for ; Fri, 4 Mar 2005 13:28:21 +0000 (GMT) Received: from smtpq3.home.nl (smtpq3.home.nl [213.51.128.198]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7E02343D3F for ; Fri, 4 Mar 2005 13:28:20 +0000 (GMT) (envelope-from dodell@sitetronics.com) Received: from [213.51.128.136] (port=57519 helo=smtp5.home.nl) by smtpq3.home.nl with esmtp (Exim 4.30) id 1D7Cqn-0003fb-TS; Fri, 04 Mar 2005 14:28:17 +0100 Received: from cc740438-a.deven1.ov.home.nl ([82.72.18.239]:33782 helo=192.168.1.104) by smtp5.home.nl with esmtp (Exim 4.30) id 1D7Cqm-0000OM-CB; Fri, 04 Mar 2005 14:28:16 +0100 From: "Devon H. O'Dell" To: mike@sentex.net, deraadt@cvs.openbsd.org, freebsd-security@freebsd.org, security-officer@dragonflybsd.org Content-Type: text/plain Organization: SiteTronics Date: Fri, 04 Mar 2005 14:28:15 +0100 Message-Id: <1109942895.3926.71.camel@localhost.localdomain> Mime-Version: 1.0 X-Mailer: Evolution 2.0.2 (2.0.2-3) Content-Transfer-Encoding: 7bit X-AtHome-MailScanner-Information: Please contact support@home.nl for more information X-AtHome-MailScanner: Found to be clean Subject: Re: Fwd: FreeBSD hiding security stuff X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Mar 2005 13:28:21 -0000 On Fri, 2005-03-04 at 07:58 -0500, Mike Tancsa wrote: > FYI > > > >To: misc@openbsd.org > >Subject: FreeBSD hiding security stuff > >Date: Fri, 04 Mar 2005 03:51:42 -0700 > >From: Theo de Raadt > > > >A few FreeBSD developers apparently have found some security issue > >of some sort affecting i386 operating systems in some cases. > > > >They have refused to give us real details. > > > >A promise is now being made. > > > >If a bug is found in OpenSSH, which we believe to have security > >consequences, we wil inform FreeBSD last. > > > >Fair is fair. > > > >I really wish it was not this way, but after a week of trying to get the > >policy to be fixed, we are changing our policy as well. > > > >Without immediate action from them to repair their polcy, and a public > >apology for this, that policy will stand. DragonFly received this email as well, we were also not given details, which is somewhat disturbing, to be honest. I haven't said anything about this until now because I didn't want to cause a disturbance, but obviously one has been caused. Everyone who knows me from DragonFly knows that I am quite the DragonFly diplomat: I really don't tolerate FUD about FreeBSD. As a person who also contributes to FreeBSD (yes, I contribute to both projects), I really have to say that I find this strange. It would be okay if we were given a timeframe, but there was no information. The `advisory' consisted of the following: `On May 13th at BSDCan I will be publishing a local information-disclosure vulnerability which affects multiple operating systems running on x86 hardware. I'm not sure if your OS is affected; can you tell me the state of your SMP support on the x86 platform?' Matt (Dillon) replied stating that the aforementioned `advisory' wasn't enough information to ``go on.'' We (security-officer@dragonflybsd.org) were told that we'd receive the paper after it was confirmed that DragonFly is affected. Matt asked if it was related to a certain issue. The response was ``No.'' This seems vague. This `advisory' was received by us last Saturday. So, before we get a huge ruckus about Theo being totally unreasonable, lets have a little bit of information about why this vulnerability isn't being disclosed to the security teams of other projects. I think that it's pretty unreasonable that we're not getting more information. We can't even confirm that we're affected because we have nothing to go on. For these reasons, I don't think Theo is being terribly unreasonable. I don't want to start a holy war here, just present the facts before a million misinformed subscribers to security@ start flaming OpenBSD and Theo. Kind regards, Devon H. O'Dell From owner-freebsd-security@FreeBSD.ORG Fri Mar 4 13:31:00 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EA11116A4CE for ; Fri, 4 Mar 2005 13:31:00 +0000 (GMT) Received: from avscan1.sentex.ca (avscan1.sentex.ca [199.212.134.11]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8BBFC43D2F for ; Fri, 4 Mar 2005 13:31:00 +0000 (GMT) (envelope-from mike@sentex.net) Received: from localhost (localhost.sentex.ca [127.0.0.1]) by avscan1.sentex.ca (8.12.11/8.12.11) with ESMTP id j24DUxxm006794; Fri, 4 Mar 2005 08:30:59 -0500 (EST) (envelope-from mike@sentex.net) Received: from avscan1.sentex.ca ([127.0.0.1]) by localhost (avscan1.sentex.ca [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 06576-03; Fri, 4 Mar 2005 08:30:59 -0500 (EST) Received: from lava.sentex.ca (pyroxene.sentex.ca [199.212.134.18]) by avscan1.sentex.ca (8.12.11/8.12.11) with ESMTP id j24DUxAo006765; Fri, 4 Mar 2005 08:30:59 -0500 (EST) (envelope-from mike@sentex.net) Received: from simian.sentex.net (simeon.sentex.ca [192.168.43.27]) by lava.sentex.ca (8.12.11/8.12.11) with ESMTP id j24DUq54020032; Fri, 4 Mar 2005 08:30:52 -0500 (EST) (envelope-from mike@sentex.net) Message-Id: <6.2.1.2.0.20050304083232.03287990@64.7.153.2> X-Mailer: QUALCOMM Windows Eudora Version 6.2.1.2 Date: Fri, 04 Mar 2005 08:33:28 -0500 To: Claus Guttesen , freebsd-security@freebsd.org From: Mike Tancsa In-Reply-To: <20050304132815.90036.qmail@web26805.mail.ukl.yahoo.com> References: <6.2.1.2.0.20050304075708.0478bdf0@64.7.153.2> <20050304132815.90036.qmail@web26805.mail.ukl.yahoo.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Virus-Scanned: by amavisd-new X-Virus-Scanned: by amavisd-new at avscan1b Subject: Re: Fwd: FreeBSD hiding security stuff X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Mar 2005 13:31:01 -0000 At 08:28 AM 04/03/2005, Claus Guttesen wrote: > > > >Did you verify with Theo whether this mail originated >from him? No, and good point, but I did look at the headers. It appeared to come from his machine. I am guessing this is related to the Received: from cvs.openbsd.org (cvs.openbsd.org [199.185.137.3]) ---Mike From owner-freebsd-security@FreeBSD.ORG Fri Mar 4 13:39:26 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D8C3D16A4CE for ; Fri, 4 Mar 2005 13:39:26 +0000 (GMT) Received: from pd4mo3so.prod.shaw.ca (shawidc-mo1.cg.shawcable.net [24.71.223.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id 71F5943D2D for ; Fri, 4 Mar 2005 13:39:26 +0000 (GMT) (envelope-from colin.percival@wadham.ox.ac.uk) Received: from pd2mr2so.prod.shaw.ca (pd2mr2so-qfe3.prod.shaw.ca [10.0.141.109]) by l-daemon (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with ESMTP id <0ICT00CXOXXNMN80@l-daemon> for freebsd-security@freebsd.org; Fri, 04 Mar 2005 06:39:23 -0700 (MST) Received: from pn2ml10so.prod.shaw.ca ([10.0.121.80]) by pd2mr2so.prod.shaw.ca (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with ESMTP id <0ICT008QIXXN4DK0@pd2mr2so.prod.shaw.ca> for freebsd-security@freebsd.org; Fri, 04 Mar 2005 06:39:23 -0700 (MST) Received: from [192.168.0.60] (S0106006067227a4a.vc.shawcable.net [24.87.209.6]) by l-daemon (iPlanet Messaging Server 5.2 HotFix 1.18 (built Jul 28 2003)) freebsd-security@freebsd.org; Fri, 04 Mar 2005 06:39:23 -0700 (MST) Date: Fri, 04 Mar 2005 05:39:23 -0800 From: Colin Percival To: freebsd-security@freebsd.org Message-id: <4228650B.10607@wadham.ox.ac.uk> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7bit X-Accept-Language: en-us, en X-Enigmail-Version: 0.90.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime User-Agent: Mozilla Thunderbird 1.0 (X11/20050302) Subject: [Fwd: Re: Fwd: FreeBSD hiding security stuff] X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Mar 2005 13:39:27 -0000 The mailing list detained my email because I posted from the wrong address... hoepfully it will get through this time. -------- Original Message -------- Subject: Re: Fwd: FreeBSD hiding security stuff Date: Fri, 04 Mar 2005 05:35:32 -0800 From: Colin Percival To: Devon H. O'Dell CC: mike@sentex.net, freebsd-security@freebsd.org, security-officer@dragonflybsd.org References: <1109942895.3926.71.camel@localhost.localdomain> Devon H. O'Dell wrote: > Matt (Dillon) replied stating that the aforementioned `advisory' wasn't > enough information to ``go on.'' We (security-officer@dragonflybsd.org) > were told that we'd receive the paper after it was confirmed that > DragonFly is affected. Matt asked if it was related to a certain issue. > The response was ``No.'' ... and then Matt started corresponding with me directly. Colin Percival From owner-freebsd-security@FreeBSD.ORG Fri Mar 4 13:40:50 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 27B9B16A4CE for ; Fri, 4 Mar 2005 13:40:50 +0000 (GMT) Received: from pd3mo1so.prod.shaw.ca (shawidc-mo1.cg.shawcable.net [24.71.223.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id D88EE43D39 for ; Fri, 4 Mar 2005 13:40:49 +0000 (GMT) (envelope-from colin.percival@wadham.ox.ac.uk) Received: from pd5mr3so.prod.shaw.ca (pd5mr3so-qfe3.prod.shaw.ca [10.0.141.144]) by l-daemon (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with ESMTP id <0ICT003Q4XZMDW80@l-daemon> for freebsd-security@freebsd.org; Fri, 04 Mar 2005 06:40:34 -0700 (MST) Received: from pn2ml10so.prod.shaw.ca ([10.0.121.80]) by pd5mr3so.prod.shaw.ca (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with ESMTP id <0ICT00FB6XZMC940@pd5mr3so.prod.shaw.ca> for freebsd-security@freebsd.org; Fri, 04 Mar 2005 06:40:34 -0700 (MST) Received: from [192.168.0.60] (S0106006067227a4a.vc.shawcable.net [24.87.209.6]) by l-daemon (iPlanet Messaging Server 5.2 HotFix 1.18 (built Jul 28 2003)) freebsd-security@freebsd.org; Fri, 04 Mar 2005 06:40:34 -0700 (MST) Date: Fri, 04 Mar 2005 05:40:33 -0800 From: Colin Percival To: freebsd-security@freebsd.org Message-id: <42286551.30301@wadham.ox.ac.uk> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7bit X-Accept-Language: en-us, en X-Enigmail-Version: 0.90.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime User-Agent: Mozilla Thunderbird 1.0 (X11/20050302) Subject: [Fwd: Re: FW:FreeBSD hiding security stuff] X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Mar 2005 13:40:50 -0000 Well, I *tried* to CC: freebsd-security... I'm forwarding this to get around the "posting from wrong address" filter. -------- Original Message -------- Subject: Re: FW:FreeBSD hiding security stuff Date: Fri, 04 Mar 2005 04:42:48 -0800 From: Colin Percival To: Jonathan Weiss CC: freebsd-security@freebsd.org, FreeBSD-Hackers References: [I'm adding a CC: to freebsd-security, since I'm sure this thread will get reposted there if I don't. For those not subscribed to -hackers: Jonathan forwarded the an email Theo wrote to openbsd-misc: http://marc.theaimsgroup.com/?l=openbsd-misc&m=110993373705509&w=2 ] Jonathan Weiss wrote: > Whats the intention behind the FreeBSD developers policy? Quoting from secteam's TODO list for advisories: 1. Check if security officers need to be contacted at OpenBSD, NetBSD, OS X, or DragonFlyBSD. Yes, that's item #1 on our list. :-) In this case, I wasn't sure if OpenBSD was affected, so I emailed Theo asking for certain details which would allow me to make this determination. Theo wrote: > A few FreeBSD developers apparently have found some security issue > of some sort affecting i386 operating systems in some cases. s/A few FreeBSD developers/One FreeBSD developer/ I discovered this issue in December; until a few days ago I was working on it to determine whether it could be exploited. > They have refused to give us real details. Theo, in one of several replies, indicated that I should provide the details to Ted Unangst (tedu@). I contacted Ted and provided him with the details; he agreed with me about how and when it should be handled by OpenBSD. > A promise is now being made. > > If a bug is found in OpenSSH, which we believe to have security > consequences, we wil inform FreeBSD last. > > Fair is fair. > > I really wish it was not this way, but after a week of trying to get the > policy to be fixed, we are changing our policy as well. > > Without immediate action from them to repair their polcy, and a public > apology for this, that policy will stand. The policy of the FreeBSD security team is to notify other vendors and work with them to co-ordinate a disclosure schedule. It is also the policy of the FreeBSD security team to avoid disclosing security issues to anyone who does not need to know about them (i.e., anyone other than other affected vendors, admins@, and in some cases re@). I will make no apology for either of these, and I doubt anyone else (either from the security team, or the security officer himself) will do so either. Colin Percival _______________________________________________ freebsd-hackers@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org" From owner-freebsd-security@FreeBSD.ORG Fri Mar 4 13:46:34 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2DF3716A4CE for ; Fri, 4 Mar 2005 13:46:34 +0000 (GMT) Received: from smtpq1.home.nl (smtpq1.home.nl [213.51.128.196]) by mx1.FreeBSD.org (Postfix) with ESMTP id DCDE843D3F for ; Fri, 4 Mar 2005 13:46:33 +0000 (GMT) (envelope-from dodell@sitetronics.com) Received: from [213.51.128.132] (port=55078 helo=smtp1.home.nl) by smtpq1.home.nl with esmtp (Exim 4.30) id 1D7D8T-0003H6-7S; Fri, 04 Mar 2005 14:46:33 +0100 Received: from cc740438-a.deven1.ov.home.nl ([82.72.18.239]:33866 helo=192.168.1.104) by smtp1.home.nl with esmtp (Exim 4.30) id 1D7D8R-00039C-6i; Fri, 04 Mar 2005 14:46:31 +0100 From: "Devon H. O'Dell" To: Colin Percival In-Reply-To: <42286551.30301@wadham.ox.ac.uk> References: <42286551.30301@wadham.ox.ac.uk> Content-Type: text/plain Organization: SiteTronics Date: Fri, 04 Mar 2005 14:46:30 +0100 Message-Id: <1109943990.3926.79.camel@localhost.localdomain> Mime-Version: 1.0 X-Mailer: Evolution 2.0.2 (2.0.2-3) Content-Transfer-Encoding: 7bit X-AtHome-MailScanner-Information: Please contact support@home.nl for more information X-AtHome-MailScanner: Found to be clean cc: freebsd-security@freebsd.org Subject: Re: FreeBSD hiding security stuff X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Mar 2005 13:46:34 -0000 On Fri, 2005-03-04 at 05:40 -0800, Colin Percival wrote: > Well, I *tried* to CC: freebsd-security... I'm forwarding this to > get around the "posting from wrong address" filter. > I will make no apology for either of these, and I doubt anyone else (either > from the security team, or the security officer himself) will do so either. *snip* I'm misinformed as well. I retract my statement; my apologies Colin and security-team@. --Devon From owner-freebsd-security@FreeBSD.ORG Fri Mar 4 17:32:24 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7F8ED16A4CE for ; Fri, 4 Mar 2005 17:32:24 +0000 (GMT) Received: from mail.gmx.net (pop.gmx.net [213.165.64.20]) by mx1.FreeBSD.org (Postfix) with SMTP id 42D7243D55 for ; Fri, 4 Mar 2005 17:32:23 +0000 (GMT) (envelope-from tomonage2@gmx.de) Received: (qmail invoked by alias); 04 Mar 2005 17:32:21 -0000 Received: from p54BF56F8.dip.t-dialin.net (EHLO [192.168.0.200]) (84.191.86.248) by mail.gmx.net (mp010) with SMTP; 04 Mar 2005 18:32:21 +0100 X-Authenticated: #7843803 User-Agent: Microsoft-Entourage/11.1.0.040913 Date: Fri, 04 Mar 2005 18:32:16 +0100 From: Jonathan Weiss To: Colin Percival Message-ID: In-Reply-To: <422857C8.6050600@freebsd.org> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-Y-GMX-Trusted: 0 X-Mailman-Approved-At: Fri, 04 Mar 2005 17:52:46 +0000 cc: freebsd-security@freebsd.org Subject: Re:FreeBSD hiding security stuff X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Mar 2005 17:32:24 -0000 >> They have refused to give us real details. > > Theo, in one of several replies, indicated that I should provide the > details to Ted Unangst (tedu@). I contacted Ted and provided him with > the details; he agreed with me about how and when it should be handled > by OpenBSD. > I've mailed with Theo and his main problem is that they (as the OpenBSD developers) did not get enough details even after one week. Theo has no detailed information yet and if this problem affects SMP on i386 he needs the eyes of 8 of his developers. Maybe informing them as a group with more information would have been better, but I cannot really know or say. Maybe (and hopefully) you two can work this issue out because a good coorperation and relationship between FreeBSD and OpenBSD benefits all. Greets, Jonathan From owner-freebsd-security@FreeBSD.ORG Fri Mar 4 18:29:56 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 05FCD16A4CE; Fri, 4 Mar 2005 18:29:56 +0000 (GMT) Received: from gw.celabo.org (gw.celabo.org [208.42.49.153]) by mx1.FreeBSD.org (Postfix) with ESMTP id AD64343D4C; Fri, 4 Mar 2005 18:29:55 +0000 (GMT) (envelope-from nectar@FreeBSD.org) Received: from lum.celabo.org (lum.celabo.org [10.0.1.107]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "lum.celabo.org", Issuer "celabo.org CA" (verified OK)) by gw.celabo.org (Postfix) with ESMTP id 2DA9C3E2F04; Fri, 4 Mar 2005 12:29:55 -0600 (CST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by lum.celabo.org (Postfix) with ESMTP id 5AA9B620DD3; Fri, 4 Mar 2005 12:29:54 -0600 (CST) Message-ID: <4228A922.8090003@FreeBSD.org> Date: Fri, 04 Mar 2005 12:29:54 -0600 From: Jacques Vidrine Organization: The FreeBSD Project User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.5) Gecko/20041206 Thunderbird/1.0 Mnenhy/0.7.1 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Jonathan Weiss References: In-Reply-To: X-Enigmail-Version: 0.89.5.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit cc: freebsd-security@freebsd.org cc: Colin Percival Subject: Re: FreeBSD hiding security stuff X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Mar 2005 18:29:56 -0000 On 3/4/05 11:32 AM, Jonathan Weiss wrote: > I've mailed with Theo and his main problem is that they (as the OpenBSD > developers) did not get enough details even after one week. Theo has no > detailed information yet and if this problem affects SMP on i386 he needs > the eyes of 8 of his developers. > Maybe informing them as a group with more information would have been > better, but I cannot really know or say. > Maybe (and hopefully) you two can work this issue out because a good > coorperation and relationship between FreeBSD and OpenBSD benefits all. There's nothing to see here. It was a simple miscommunication that has been fixed. The BSDs (as well as Linux distributions and commercial vendors) routinely share information through various channels, and will continue to do so. Despite occasional flareups, I do not believe there is any permanent animosity between the folks on these various security teams. Cheers, -- Jacques A Vidrine / NTT/Verio nectar@celabo.org / jvidrine@verio.net / nectar@FreeBSD.org From owner-freebsd-security@FreeBSD.ORG Sat Mar 5 04:56:54 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C7BF616A4CE for ; Sat, 5 Mar 2005 04:56:54 +0000 (GMT) Received: from sccrmhc12.comcast.net (sccrmhc12.comcast.net [204.127.202.56]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5600943D1D for ; Sat, 5 Mar 2005 04:56:54 +0000 (GMT) (envelope-from gorebofh@comcast.net) Received: from os.org (pcp02973047pcs.pthurn01.mi.comcast.net[68.61.249.247]) by comcast.net (sccrmhc12) with ESMTP id <20050305045653012001ksule>; Sat, 5 Mar 2005 04:56:53 +0000 Received: by os.org (Postfix, from userid 1000) id B93A0472AA; Fri, 4 Mar 2005 23:56:55 -0500 (EST) Date: Fri, 4 Mar 2005 23:56:55 -0500 From: Allen To: freebsd-security@freebsd.org Message-ID: <20050305045655.GA29514@os.pthurn01.mi.comcast> References: <6.2.1.2.0.20050304075708.0478bdf0@64.7.153.2> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6.2.1.2.0.20050304075708.0478bdf0@64.7.153.2> User-Agent: Mutt/1.5.6i cc: sonny.discini@montgomerycountymd.gov Subject: Re: Fwd: FreeBSD hiding security stuff X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Mar 2005 04:56:54 -0000 On Fri, Mar 04, 2005 at 07:58:35AM -0500, Mike Tancsa wrote: > > FYI > > > >To: misc@openbsd.org > >Subject: FreeBSD hiding security stuff > >Date: Fri, 04 Mar 2005 03:51:42 -0700 > >From: Theo de Raadt > > > >A few FreeBSD developers apparently have found some security issue > >of some sort affecting i386 operating systems in some cases. > > > >They have refused to give us real details. Daddy Timmy won't give me a turn!.... > >A promise is now being made. > > > >If a bug is found in OpenSSH, which we believe to have security > >consequences, we wil inform FreeBSD last. Ohhhhh tough guy! what a testicle. > >Fair is fair. Like when you take Net BSD and change it around, make it so upon boot up nothing is open by default, slapping the "It's secure" sticker ..... > >I really wish it was not this way, but after a week of trying to get the > >policy to be fixed, we are changing our policy as well. "I'm telling my Daddy on you!" Damn I can't stand him. > >Without immediate action from them to repair their polcy, and a public > >apology for this, that policy will stand. If you guys apologize to that walking turnip I'm trading in my Free BSD merchadise I've paid for, for Windows NT tee-shirts. -Allen / Gore. A Slackware and Free BSD guy. > -------------------------------------------------------------------- > Mike Tancsa, tel +1 519 651 3400 > Sentex Communications, mike@sentex.net > Providing Internet since 1994 www.sentex.net > Cambridge, Ontario Canada www.sentex.net/mike > > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" From owner-freebsd-security@FreeBSD.ORG Sat Mar 5 04:59:49 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 571CC16A4CE for ; Sat, 5 Mar 2005 04:59:49 +0000 (GMT) Received: from rwcrmhc11.comcast.net (rwcrmhc11.comcast.net [204.127.198.35]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3DD3E43D2D for ; Sat, 5 Mar 2005 04:59:49 +0000 (GMT) (envelope-from gorebofh@comcast.net) Received: from os.org (pcp02973047pcs.pthurn01.mi.comcast.net[68.61.249.247]) by comcast.net (rwcrmhc11) with ESMTP id <2005030504594801300odob1e>; Sat, 5 Mar 2005 04:59:49 +0000 Received: by os.org (Postfix, from userid 1000) id 2888B2D6D8; Fri, 4 Mar 2005 23:59:51 -0500 (EST) Date: Fri, 4 Mar 2005 23:59:51 -0500 From: Allen To: freebsd-security@freebsd.org Message-ID: <20050305045951.GB29514@os.pthurn01.mi.comcast> References: <4228A922.8090003@FreeBSD.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4228A922.8090003@FreeBSD.org> User-Agent: Mutt/1.5.6i Subject: Re: FreeBSD hiding security stuff X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Mar 2005 04:59:49 -0000 I should probably have sent this with my first mail: I forgot to add it, I'm tired Ok? ;) My first message, is humor. The "tones" of the mails here seem a little over worked like you could use a vacation so I tried to make some humor out of it. Just incase there was any confusion or upset people. It's a joke, laugh and have fun :) -Allen. From owner-freebsd-security@FreeBSD.ORG Sat Mar 5 07:43:32 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 79D2716A4CE for ; Sat, 5 Mar 2005 07:43:32 +0000 (GMT) Received: from pd4mo3so.prod.shaw.ca (shawidc-mo1.cg.shawcable.net [24.71.223.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id DBAAC43D39 for ; Sat, 5 Mar 2005 07:43:31 +0000 (GMT) (envelope-from colin.percival@wadham.ox.ac.uk) Received: from pd2mr8so.prod.shaw.ca (pd2mr8so-qfe3.prod.shaw.ca [10.0.141.11])2004))freebsd-security@freebsd.org; Sat, 05 Mar 2005 00:43:29 -0700 (MST) Received: from pn2ml7so.prod.shaw.ca ([10.0.121.151]) by pd2mr8so.prod.shaw.ca (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with ESMTP id <0ICV004HJC4H7L10@pd2mr8so.prod.shaw.ca> for freebsd-security@freebsd.org; Sat, 05 Mar 2005 00:43:29 -0700 (MST) Received: from [192.168.0.60] (S0106006067227a4a.vc.shawcable.net [24.87.209.6]) by l-daemon (iPlanet Messaging Server 5.2 HotFix 1.18 (built Jul 28 2003)) freebsd-security@freebsd.org; Sat, 05 Mar 2005 00:43:29 -0700 (MST) Date: Fri, 04 Mar 2005 23:43:28 -0800 From: Colin Percival To: freebsd-security@freebsd.org Message-id: <42296320.4080303@wadham.ox.ac.uk> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7bit X-Accept-Language: en-us, en X-Enigmail-Version: 0.90.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime User-Agent: Mozilla Thunderbird 1.0 (X11/20050302) Subject: Heads up: End of RELENG_4_8 support X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Mar 2005 07:43:32 -0000 At the end of March, the RELENG_4_8 (sometimes called 4.8-SECURITY) branch will reach its designated End of Life and cease to be supported by the FreeBSD Security Team. Released in April 2003, FreeBSD 4.8 was the first release designated for "extended" two-year security support instead of the normal one-year support. Over this time, 27 security advisories have been issued which have affected FreeBSD 4.8. It is recommended that all FreeBSD 4.8 users upgrade their systems to FreeBSD 4.11 before the end of the month. FreeBSD 4.11 has also been designated for extended support, and will be supported until at least the end of January 2007. After FreeBSD 4.8, the next release End of Life will be for FreeBSD 4.10, which will cease to be supported at the end of May 2006. Colin Percival