- WLUG - wlug.mailman3.com

Self-Introduction and LinuxGlobe Invitation

by Markus McLaughlin

Hello everyone, my name is Markus McLaughlin, I am both a member of the Fedora Project and a Linux blogger with a blog at http://linuxglobe.wordpress.com. About 5 years ago, I became a fan of Linux but did not actually use it until I bought my first Mac, which was a Mini, I now use an Intel iMac and I run Fedora 9, Ubuntu 8.04, and openSUSE in VMware Fusion. I want to reach out to other Linux hobbyists AND writers who want to promote Linux. What I want to do with my blog is to add other Writers who want to both promote Linux and help those who don't know what to do with it, with columns. Hopefully, Red Hat, Novell, and other companies will want to help fund a major Linux Magazine right here in North America. I want to help fill a niche that needs to be filled and HELP those who can't afford a Windows/Mac computer have free tools, internet access, and an inexpensive used laptop/desktop. Anyway, if anyone here has any ideas on what we can do together to promote Linux in this part of Massachusetts, PLEASE contact me. Fedora 9, IMHO, is much better than Ubuntu, so please check out the Fedora site at http://fedoraproject.orgsoon! Onward and forward!!! *Mark McLaughlin Hudson, MA*

May 17, 2008

Re: [Wlug] Debian/*ubuntu security bug and a question...

by Chuck Anderson

On Thu, May 15, 2008 at 10:39:51AM -0400, Theo Van Dinter wrote: > On Thu, May 15, 2008 at 10:32:32AM -0400, Brian A. Dewhirst wrote: > > I'm afraid my head spins a bit when I try to make sense of what > > corrective measures should be taken... has Ubuntu already rolled out a > > bug fix which will take care of the problem? If not, what needs to be > > done to fix my machine? > > In short if you've generated any keys with OpenSSL (ie: certificates, > ssh keys, etc,) on Debian or its derivatives at anytime in at least the > last 2 years, you will want to regenerate them after you upgrade to the > fixed version. > > Updating will solve the weak key generation issue, but not do anything about > the already generated keys in use. Also, if you've used SSH Password Authentication to log into to any system whose SSH host keys were generated with the vulnerable OpenSSL (likely any Debian, Ubuntu, or derivative systems), then you should change your password. Any data that was transferred over SSH to a system with a vulnerable key could have been compromised.

May 15, 2008

Re: [Wlug] Debian/*ubuntu security bug and a question...

by Lee Keyser-Allen

Brian, This particular problem is only related (as far as I can tell) to RSA key generation. If you've not done this, then you should be okay. I would still recommend bringing your OpenSSL lib up-to-date, as it is, indeed, used for secure web browsing as well (although firefox may statically link with it's own version to avoid just such problems ... ) So yeah, in short, if you don't have a key that you use to sign e-mail or for access to another computer, then you're probably fine. This is still probably of interest to the rest of the group, though, since there was recently a key-signing party, and with the proliferation of Ubuntu and Debian, I'm betting that a significant number of those keys will be compromised. Cheers, Lee On Thu, May 15, 2008 at 11:34 AM, Brian A. Dewhirst <b.dewhirst(a)gmail.com> wrote: > On Thu, May 15, 2008 at 10:39 AM, Theo Van Dinter <felicity(a)kluge.net> wrote: >> On Thu, May 15, 2008 at 10:32:32AM -0400, Brian A. Dewhirst wrote: >>> I'm afraid my head spins a bit when I try to make sense of what >>> corrective measures should be taken... has Ubuntu already rolled out a >>> bug fix which will take care of the problem? If not, what needs to be >>> done to fix my machine? >> >> In short if you've generated any keys with OpenSSL (ie: certificates, >> ssh keys, etc,) on Debian or its derivatives at anytime in at least the >> last 2 years, you will want to regenerate them after you upgrade to the >> fixed version. >> >> Updating will solve the weak key generation issue, but not do anything about >> the already generated keys in use. > > Well, pretend you're talking to a linux novice for a minute... does > that mean that if I don't think I've done any cryptography that I'm > fine, or is OpenSSL used for lots of other programs... for example, > does Firefox use it when someone logs into their checking account? > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > -- Lee Keyser-Allen (lkeyser(a)alum.wpi.edu)

May 15, 2008

Re: [Wlug] Debian/*ubuntu security bug and a question...

by Brian A. Dewhirst

On Thu, May 15, 2008 at 10:39 AM, Theo Van Dinter <felicity(a)kluge.net> wrote: > On Thu, May 15, 2008 at 10:32:32AM -0400, Brian A. Dewhirst wrote: >> I'm afraid my head spins a bit when I try to make sense of what >> corrective measures should be taken... has Ubuntu already rolled out a >> bug fix which will take care of the problem? If not, what needs to be >> done to fix my machine? > > In short if you've generated any keys with OpenSSL (ie: certificates, > ssh keys, etc,) on Debian or its derivatives at anytime in at least the > last 2 years, you will want to regenerate them after you upgrade to the > fixed version. > > Updating will solve the weak key generation issue, but not do anything about > the already generated keys in use. Well, pretend you're talking to a linux novice for a minute... does that mean that if I don't think I've done any cryptography that I'm fine, or is OpenSSL used for lots of other programs... for example, does Firefox use it when someone logs into their checking account?

May 15, 2008

Re: [Wlug] Debian/*ubuntu security bug and a question...

by Barış Hasdemir

On Thu, 2008-05-15 at 10:32 -0400, Brian A. Dewhirst wrote: > So, someone directed me at this bug report: > > http://metasploit.com/users/hdm/tools/debian-openssl/ > > I'm afraid my head spins a bit when I try to make sense of what > corrective measures should be taken... has Ubuntu already rolled out a > bug fix which will take care of the problem? If not, what needs to be > done to fix my machine? > > Thanks, > > Brian Hi, Yes, a security update was released on 14th. See http://www.ubuntu.com/usn/usn-612-5 baris

May 15, 2008

Re: [Wlug] Debian/*ubuntu security bug and a question...

by Theo Van Dinter

On Thu, May 15, 2008 at 10:32:32AM -0400, Brian A. Dewhirst wrote: > I'm afraid my head spins a bit when I try to make sense of what > corrective measures should be taken... has Ubuntu already rolled out a > bug fix which will take care of the problem? If not, what needs to be > done to fix my machine? In short if you've generated any keys with OpenSSL (ie: certificates, ssh keys, etc,) on Debian or its derivatives at anytime in at least the last 2 years, you will want to regenerate them after you upgrade to the fixed version. Updating will solve the weak key generation issue, but not do anything about the already generated keys in use. -- Randomly Selected Tagline: Leela: "Great. We're two days from earth with no food." Bender: "Problem solved. You two fight to the death and I'll cook the loser."

May 15, 2008

Debian/*ubuntu security bug and a question...

by Brian A. Dewhirst

So, someone directed me at this bug report: http://metasploit.com/users/hdm/tools/debian-openssl/ I'm afraid my head spins a bit when I try to make sense of what corrective measures should be taken... has Ubuntu already rolled out a bug fix which will take care of the problem? If not, what needs to be done to fix my machine? Thanks, Brian

May 15, 2008

Re: [Wlug] Wlug Digest, Vol 55, Issue 4

by Simeon MacMillen

Thanks Andy! I will set this up as soon as I have a chance. Simeon MacMillen KC2THZ On Mon, May 12, 2008 at 12:00 PM, <wlug-request(a)mail.wlug.org> wrote: > Send Wlug mailing list submissions to > wlug(a)mail.wlug.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://mail.wlug.org/mailman/listinfo/wlug > or, via email, send a message with subject or body 'help' to > wlug-request(a)mail.wlug.org > > You can reach the person managing the list at > wlug-owner(a)mail.wlug.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Wlug digest..." > > > Today's Topics: > > 1. port security question (Simeon MacMillen) > 2. Re: port security question (Andy Stewart) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 11 May 2008 23:00:53 -0400 > From: "Simeon MacMillen" <penguinem(a)gmail.com> > Subject: [Wlug] port security question > To: wlug(a)mail.wlug.org > Message-ID: > <4bffb9c50805112000i6096280cx82e1a8316b14b92e(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > I'm trying to set up Echolink (amateur radio software) on Ubuntu > (through WINE). My computer failed the firewall tests -the > troubleshooting material recommended the following: > > Allow UDP destination ports 5198-5199 between Internet and PC in both directions > Allow TCP (source port any, destination port 5200) from PC to Internet > > What security risks do I introduce by doing this? (Is it worth the risk?) > > Thanks, > Simeon MacMillen > > P.S. I've been on the Wlug mailing list for a year, though I've only > managed to make it to one meeting so far. > > > ------------------------------ > > Message: 2 > Date: Mon, 12 May 2008 07:16:16 -0400 > From: Andy Stewart <andystewart(a)comcast.net> > Subject: Re: [Wlug] port security question > To: Worcester Linux Users Group <wlug(a)mail.wlug.org> > Message-ID: <48282700.6040704(a)comcast.net> > Content-Type: text/plain; charset=ISO-8859-1 > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Simeon MacMillen wrote: > > I'm trying to set up Echolink (amateur radio software) on Ubuntu > > (through WINE). My computer failed the firewall tests -the > > troubleshooting material recommended the following: > > > > Allow UDP destination ports 5198-5199 between Internet and PC in both directions > > Allow TCP (source port any, destination port 5200) from PC to Internet > > > > What security risks do I introduce by doing this? (Is it worth the risk?) > > > > Hi Simeon, > > For those who may not know, "EchoLink? software allows licensed Amateur > Radio stations to communicate with one another over the Internet, using > voice-over-IP (VoIP) technology." (from www.echolink.org) > > I'm wondering if EchoLinux would do the job for you instead of using > WINE. See http://cqinet.sourceforge.net/. > > I don't think there should be a problem opening these ports for EchoLink > use. On my machine, the ports are unassigned. > > Have fun, and 73, > > Andy > > - -- > Andy Stewart, Founder > Worcester Linux Users' Group (http://www.wlug.org) > Chelmsford Linux Meetup Group (http://linux.meetup.com/393) > Amateur Radio: KB1OIQ > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.2 (GNU/Linux) > Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org > > iD8DBQFIKCcAHl0iXDssISsRAsoyAJwIN0qNy84466h/70yMPe/qnAu5bgCeMNJ6 > wwDuk25YYaCWVxvMiN+t71Y= > =D1kk > -----END PGP SIGNATURE----- > > > ------------------------------ > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > > > End of Wlug Digest, Vol 55, Issue 4 > *********************************** >

May 12, 2008

Re: [Wlug] port security question

by Andy Stewart

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Simeon MacMillen wrote: > I'm trying to set up Echolink (amateur radio software) on Ubuntu > (through WINE). My computer failed the firewall tests -the > troubleshooting material recommended the following: > > Allow UDP destination ports 5198-5199 between Internet and PC in both directions > Allow TCP (source port any, destination port 5200) from PC to Internet > > What security risks do I introduce by doing this? (Is it worth the risk?) > Hi Simeon, For those who may not know, "EchoLink® software allows licensed Amateur Radio stations to communicate with one another over the Internet, using voice-over-IP (VoIP) technology." (from www.echolink.org) I'm wondering if EchoLinux would do the job for you instead of using WINE. See http://cqinet.sourceforge.net/. I don't think there should be a problem opening these ports for EchoLink use. On my machine, the ports are unassigned. Have fun, and 73, Andy - -- Andy Stewart, Founder Worcester Linux Users' Group (http://www.wlug.org) Chelmsford Linux Meetup Group (http://linux.meetup.com/393) Amateur Radio: KB1OIQ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iD8DBQFIKCcAHl0iXDssISsRAsoyAJwIN0qNy84466h/70yMPe/qnAu5bgCeMNJ6 wwDuk25YYaCWVxvMiN+t71Y= =D1kk -----END PGP SIGNATURE-----

May 12, 2008

port security question

by Simeon MacMillen

I'm trying to set up Echolink (amateur radio software) on Ubuntu (through WINE). My computer failed the firewall tests -the troubleshooting material recommended the following: Allow UDP destination ports 5198-5199 between Internet and PC in both directions Allow TCP (source port any, destination port 5200) from PC to Internet What security risks do I introduce by doing this? (Is it worth the risk?) Thanks, Simeon MacMillen P.S. I've been on the Wlug mailing list for a year, though I've only managed to make it to one meeting so far.

May 12, 2008