search for: ottolander

Hello John, On Thu, 2017-02-09 at 16:33 +0000, John Hodrien wrote: > On Thu, 9 Feb 2017, Leonard den Ottolander wrote: > > > How about my request for checksums in the git repo? > > What checksums would you actually want in git? SRPMS are signed which allows the integrity of the contents to be checked. Such an integrity check is missing from the git repo. Either a checksum file for each fil...

On Wed, Sep 2, 2015 at 1:59 PM, Leonard den Ottolander < leonard at den.ottolander.nl> wrote: > Hello Mike, > > On Wed, 2015-09-02 at 13:05 -0400, Mike - st257 wrote: > > I've been through the virt-install manpage a few times now to no avail. > > What is wrong with my syntax here (seen below)? > > > ~]# virt-ins...

On 10/19/2016 11:34 AM, Leonard den Ottolander wrote: > Hello Gordon, > *snip* > > Personally I would be more concerned whether or not to enable ECDSA > algorithms (https://blog.cr.yp.to/20140323-ecdsa.html). > > Regards, > Leonard. > For web server ECDSA certs is currently a concern because the only curves with pop...

Hello team, Just wondering how the build of 5.10 is coming along. Is there a resource that informs us on these matters? Thanks! Regards, Leonard. -- mount -t life -o ro /dev/dna /genetic/research

On 10/19/2016 08:30 AM, Leonard den Ottolander wrote: > Where did you get the idea that AES (~ Rijndael) is a weak cipher? It's not the cipher, but the mode. CBC has several known weaknesses in TLS, and is frequently regarded as potentially insecure as a result. https://www.openssl.org/~bodo/tls-cbc.txt

Hi, I woke up Saturday morning unable to boot my freshly upgraded 5.6 with grub hanging at "GRUB". After getting the boot loader fixed I experienced crashes in evolution. Downgrading glibc to 2.5-58 seems to fix these issues. Anyone else seeing this? Leonard. -- mount -t life -o ro /dev/dna /genetic/research

Hi, Reading http://www.centos.org/modules/newbb/viewtopic.php?topic_id=30939&forum=37 I noticed a warning about an upcoming bugged update xorg-x11-server-utils-7.1-5.el5_6.1 I would advise everyone to add exclude=xorg-x11-server-utils-7.1-5.el5_6.1 to their updates repo config. Regards, Leonard. -- mount -t life -o ro /dev/dna /genetic/research

On Thu, 2017-02-02 at 06:40 -0800, John R Pierce wrote: > On 2/2/2017 6:22 AM, Leonard den Ottolander wrote: > > However, the fact that the binary in the example is setuid is orthogonal > > to the fact that heap spraying is a very serious attack vector. > > without privilege escalation, what does it attack ? pkcheck might not be directly vulnerable. However, pkexec is. Closing t...

Hello Johnny, On Wed, 2017-02-15 at 09:47 -0600, Johnny Hughes wrote: > 2. They already have shell access on the machine in question and they > can already run anything in that shell that they can run via what you > are pointing out. No, assuming noexec /home mounts all they can run is system binaries. > 3. If they have access to a zeroday issue that give them root .. they >

Hi, The fact that apparently the last tigervnc update from upstream was missed triggered me to check for missing updates and packages in 6.3. Here are my results. Sorry for any false positives that might have crept in, but note that some of the 6_x updates actually are updates and not a parsing error. And perhaps an occasional false positive due to having to compare upstream SRPMS vs downstream

On Thu, 2017-02-02 at 13:40 -0800, Gordon Messmer wrote: > Escalation *requires* attacking a program in a security context other > than your own. Not necessarily. Suppose the adversary is aware of a root exploit/privilege escalation in a random library. Then the heap spraying allows this attacker to easily trigger this exploit because he is able to initialize the entire contents of the

Hello, On Thu, 2015-04-02 at 14:25 +0100, Karanbir Singh wrote: > On 04/02/2015 11:45 AM, Leonard den Ottolander wrote: > > Just noticed that the distro tag used in openssl is different from > > upstream. Upstream and the last update (openssl-1.0.1e-30.el6_6.7) use > > "el6_6" where as the latest update (openssl-1.0.1e-30.el6.8) uses > > "el_6". Any reason for this...

On 02/09/2017 12:53 PM, Johnny Hughes wrote: > On 02/09/2017 12:50 PM, Leonard den Ottolander wrote: >> Hello John, >> >> On Thu, 2017-02-09 at 16:33 +0000, John Hodrien wrote: >>> On Thu, 9 Feb 2017, Leonard den Ottolander wrote: >>> >>>> How about my request for checksums in the git repo? >>> >>> What checksums would you ac...

Hello Jonathan, On Wed, 2016-12-14 at 15:03 -0500, Jonathan Billings wrote: > On Wed, Dec 14, 2016 at 07:29:19PM +0100, Leonard den Ottolander wrote: > > > get_sources.sh > > > > The name suggests this is what we need (or do we??) If only I could find > > that script anywhere... > > Johnny said it at the beginning of his email. I'll paste it again so > you don't have to go re-read it: > O...

On Sun, Sep 25, 2016 at 04:38:39PM +0200, Leonard den Ottolander wrote: > The qemu-kvm option "-enable-nesting" that I dug up in the source looks > promising. No mention in the man page on either C6 or C7 but it is > mentioned here: > https://www.redhat.com/archives/libvir-list/2012-October/msg01138.html > > How do I pass the "-...

Hello list, To my astonishment the openssh versions on both C6 and C7 will by default negotiate an MD5 HMAC. C6 client, C7 server: debug2: mac_setup: found hmac-md5 debug1: kex: server->client aes128-ctr hmac-md5 none debug2: mac_setup: found hmac-md5 debug1: kex: client->server aes128-ctr hmac-md5 none C7 client & server: debug2: mac_setup: setup hmac-md5-etm at openssh.com debug1:

Hi, In a recent security review some systems I manage were flagged due to supporting "weak" ciphers, specifically the ones listed below. So first question is are people generally modifying the list of ciphers supported by the ssh client and sshd? On CentOS 6 currently it looks like if I remove all the ciphers they are concerned about then I am left with Ciphers

Hi, I am trying to install a C6 VM on C6 using the text installer using: # virt-install -n C6_1 -r 3072 --os-variant=rhel6 -l \ ftp://ftp.nluug.nl/site/centos.org/CentOS/6.3/os/x86_64/ --disk \ path=/dev/VG1/vm_c6_1 -w network:default --nographics \ -x "console=ttyS0" --autostart /dev/VG1/vm_c6_1 has been successfully created. The installation starts but once I get to the disk

On 02/09/2017 01:11 PM, Leonard den Ottolander wrote: > On Thu, 2017-02-09 at 12:58 -0600, Johnny Hughes wrote: >> At the time of extraction, the <name>.metadata file is created (again, >> not by us, but by the Red Hat team that distributes source), and all the >> non-text sha1sums are in there as well as all the text...

On 07/11/2018 09:20 AM, Leonard den Ottolander wrote: > On Thu, 2018-07-05 at 06:34 -0500, Johnny Hughes wrote: >> I pushed the 3 SRPMs that are not in CR to: >> >> http://vault.centos.org/6.10/os/Source/SPackages/ > >> All the other new SRPMS should be available from : >> >> http://vault.centos.org/6....