Gentoo Weekly Newsletter: January 10, 2005Discouraging Forum abuse: visual registration confirmation added In the last week of December 2004, an attacker had registered about 8,500 user accounts from more than 160 hosts, in less than one hour. While the Forum admins were working on a solution to block these registrations, users started reporting the mass forum account registrations. A few hours later 15696 user accounts were deleted, taking along a number of inactive accounts from the past. To prevent these mass registration attempts from happening again, a visual registration confirmation has now been added to the Forum user account registration process. This function was originally implemented in the phpBB 2.2 development versions, with the changes being backported to version 2.0.11 of phpBB. The same changes have now been applied to the customized version of phpBB that is installed at forums.gentoo.org. By the time you are reading this, the Linux 2.6.10 release of gentoo-dev-sources will be marked stable, or in the final stages of being tested, on supported system architectures. Linux 2.6.10, released late on Christmas Eve, is proving to be the best kernel release in a long time, fixing almost all of the issues we know about present in 2.6.9 and earlier. Relatively few new issues have been reported, and the major ones have already been fixed. 2.6 users are recommended to upgrade as soon as possible, as this release also fixes some recently discovered security vulnerabilities. A meta-thread on the gentoo-dev mailing list keeps track of goals set forth for some Gentoo projects. Here's an overview of items scheduled to see the light of day shortly: Release engineering
Kernel
Gentoo/BSD
LinPopUp: Buffer overflow in message reply LinPopUp contains a buffer overflow potentially allowing execution of arbitrary code. For more information, please see the GLSA Announcement a2ps: Multiple vulnerabilities The fixps and psmandup scripts in the a2ps package are vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files. A vulnerability in a2ps filename handling could also result in arbitrary command execution. For more information, please see the GLSA Announcement Mozilla, Firefox, Thunderbird: Various vulnerabilities Various vulnerabilities were found and fixed in Mozilla-based products, ranging from a potential buffer overflow and temporary files disclosure to anti-spoofing issues. For more information, please see the GLSA Announcement Shoutcast Server: Remote code execution Shoutcast Server contains a possible buffer overflow that could lead to the execution of arbitrary code. For more information, please see the GLSA Announcement mit-krb5: Heap overflow in libkadm5srv The MIT Kerberos 5 administration library (libkadm5srv) contains a heap overflow that could lead to execution of arbitrary code. For more information, please see the GLSA Announcement tiff: New overflows in image decoding An integer overflow has been found in the TIFF library image decoding routines and the tiffdump utility, potentially allowing arbitrary code execution. For more information, please see the GLSA Announcement xine-lib contains multiple overflows potentially allowing execution of arbitrary code. For more information, please see the GLSA Announcement phpGroupWare: Various vulnerabilities Multiple vulnerabilities have been discovered in phpGroupWare that could lead to information disclosure or remote compromise. For more information, please see the GLSA Announcement xzgv contains multiple overflows that may lead to the execution of arbitrary code. For more information, please see the GLSA Announcement Vilistextum: Buffer overflow vulnerability Vilistextum is vulnerable to a buffer overflow that allows an attacker to execute arbitrary code through the use of a malicious webpage. For more information, please see the GLSA Announcement Disappearing X causing slight unrest The decision by Gentoo developers to gently nudge people to use xorg-x11 isn't entirely new, but the deletion of XFree86 from Portage on 1 January seems to have come as a nasty surprise to some people. One thread out of a handful, to represent them all: New global moderator Earthwings Earthwings has already served in the German subforum for several months before being promoted to deal with the rest of the lot now: Achieving Hardware Happiness? Many laptop users experience the same conundrum: Having a mobile computer results in different configurations. Most of the time these are network-related, for example the difference between a corporate LAN and a home network. But occasionally this includes hardware as well. Many laptops have hardware docking stations with additional network cards, video adapters, and even SCSI. This presents a unique issue to Linux users since most of the time, the various settings are hard-edited into various files in /etc. Curious how to find your own way to portable paradise? Read on! Bash Arguments What could be more Linux-y than a debate on the proper way to delete many files out of a directory? There's xargs, find, even... for loops? An informative thread of opinionated answers is what we got this week! "Monitoring" CPU Usage On a more humorous note, one list member posted a "helpful" link to a newsforge article on a CPU monitoring package called "Hot Babe". We'll provide GWN readers a link to the gentoo-user thread, and leave it at that. RFC: Advice on driving compile times down Stuart Herbert asks how to reduce compile times. Read the thread for the different possibilities offered to Gentoo users. xfree gone With this short notice Gentoo officially stopped supporting xfree. All users are asked to migrate to xorg. 2005.0 2.4 & 2.6 stages John Davis asks, on behalf of the Gentoo Releng subproject, which kernel header and sources 2005.0 stages should be offered. He writes: "Our options for building include (a) only 2.6 stages, (b) only 2.4 stages, or (c) a combination of 2.4 and 2.6 stages." From a release point of view only one set would be preferred, but many users still depend on 2.4 kernels. This rather long thread explores the many small problems that may arise and shows how difficult it is to make all people equally happy.
From a mailing list mostly frequented by people using Gentoo for non-desktop purposes, gentoo-server@gentoo.org, here's a noteworthy thread that has spun from the original poster asking a simple question: USA: Gentoo lectures at MIT, 10 and 24 January Rajiv Manglani, Gentoo Linux Security Team member and PPC developer, will give an introductory (10 January) and an advanced lecture (24 January) on Gentoo Linux at the Massachusetts Institute of Technology, MIT, in Cambridge, MA. Both lectures are sponsored by the MIT's Student Information Processing Board (SIPB) and will be held tonight and Monday 24 starting at 20:00, at Building 4 room 237 (today) and room 231 (24 January) respectively. The first lecture will focus on giving an overview and demonstrating a running Gentoo system, while the "Advanced Gentoo Linux" presentation on 24 January will have more in-depth discussions of Portage and ebuild script creation, system tools such as qpkg and etcat. More details can be found in Rajiv's Independent Activities Period Gentoo lecture announcements. Please make sure to RSVP to the Student Information Board if you plan on attending. Canada: Gentoo LTSP project at elementary school The Prairie Linux User Group (PLUG) is planning to deploy Gentoo Linux at the Holy Cross Elementary School in Winnipeg. The project will use reclaimed hardware previously running various shades of Windows that are being replaced with Linux due to cost of licensing for upgrades, concerns about lax security, growing hardware requirements if Windows was chosen as an upgrade path, and the current platform generally not meeting the educational requirements at the school any longer. The setup includes an implementation of the Linux Terminal Server Project (LTSP) across thirty workstations, with Gentoo Linux running openmosix for the terminal server system. On Thursday 20 January the PLUG will meet at the University of Winnipeg (starting at 19:00 in room 2M70) to get a few things straightened out before performing their real world test at the school on Sunday, 23 January from 10:00. Thirty elementary students have been invited to stress-test the system that they might get to keep if it works as advertized: "If the system is successfully able to meet the requirements it would be permanently installed," says PLUG member Mike Crawford, a Gentoo dev-perl developer-to-be and maintainer of one of the official Gentoo file mirrors (gentoo.eliteitminds.com). More details can be found at the PLUG meeting announcement.
Linux Journal (5 January 2005) Andrew Cowie with the Linux Journal published a rather flattery piece on "Gentoo for all the unusual reasons," providing extensive coverage of Portage as a tool for professional use: "You might think of Gentoo as a bleeding-edge distribution for development workstations, but the simple packaging system can make it a good choice for any production system that needs to stay up to date," writes the author in his introduction, before explaining in great detail the steps for installing and updating software in Gentoo, all nicely accompanied by screenshots. The thoroughly researched article was among LJ's top reads and most commented-on articles last week - even without the GWN boosting its popularity yet again... The Gentoo community uses Bugzilla (bugs.gentoo.org) to record and track bugs, notifications, suggestions and other interactions with the development team. Between 02 January 2005 and 09 January 2005, activity on the site has resulted in:
Of the 7862 currently open bugs: 117 are labeled 'blocker', 229 are labeled 'critical', and 568 are labeled 'major'. The developers and teams who have closed the most bugs during this period are:
The developers and teams who have been assigned the most new bugs during this period are:
The following developers recently left the Gentoo team:
The following developers recently joined the Gentoo Linux team:
The following developers recently changed roles within the Gentoo Linux project:
Denu - a Portage-savvy menu generator for window managers Are you switching from Fluxbox to Gnome to KDE a lot? Would you like to try out even more window managers, if it wasn't for the missing application entries in the menus to hop along with you? This week's tip brings a nifty solution in reach: Denu is a brandnew tool to assist in menu generation. It can generate similarly structured menus for various window managers enabling easy transitions from one to another. Denu synchronizes with an online database to allow program definitions to be updated without a software update, and best of all: Portage itself provides the installed program data!
Before we go any further backup any menu configurations you don't want overwritten. Now run denu as a normal user, Denu is not meant to be run as root.
The first step after installing Denu is to run Update (for program definitions) and Sysupdate (for the current list of installed programs). Neither of these are run at startup, so after installing a new program via Portage, Sysupdate will need execution again. To create a menu there are two approaches: hand pick entries from the Installed Tree and add them, or you can hit Autofill, and Denu will automatically generate a menu based on the information it has. Reorganizing a newly created menu is as simple as drag and drop, menu systems will respect the order of entries, except for Gnome and KDE who sort things alphabetically. Click on generate, and then on one of the boxes corresponding to your desired window manager or desktop environment. Some window managers like Fluxbox will be able to use your menu immediately, others may need to be reconfigured or restarted. Denu is still under development, but author Shux has scanned half of the Portage tree for items that might be needed in a GUI menu already. For the remaining half (or things that might need adding in the future) Denu provides a tool to include other applications not in its database yet. Adding programs and their categories, descriptions etc. is just as easy as shifting them around. For questions and answers of all sorts check the lively Denu 2.0 thread in the Forums. Interested in contributing to the Gentoo Weekly Newsletter? Send us an email. Please send us your feedback and help make the GWN better. 12. GWN subscription information To subscribe to the Gentoo Weekly Newsletter, send a blank email to gentoo-gwn-subscribe@gentoo.org. To unsubscribe to the Gentoo Weekly Newsletter, send a blank email to gentoo-gwn-unsubscribe@gentoo.org from the email address you are subscribed under. The Gentoo Weekly Newsletter is also available in the following languages:
|
|
