gmane.linux.openwall.user

Re: openvz kernel

Zenny — 2013-05-15T08:34:19

Thanks for the pointer.


< at > Alexey: Would love to know a bit more about your approach of
building kernel without initrd. Thanks!

Re: Owl encrypted / and tcplay

Zenny — 2013-05-14T19:44:05

< at >Alexey: I checked the page that you referred to about storage, but I
am trying to use zfs instead of traditional softraid or hardraid
whereas all the vms will be stored in the encrypted zfs volumes.
However, like I stated earlier, / encryption is one of the
requirements.

On 5/14/13, Zenny <garbytrash< at >gmail.com> wrote:

Re: Owl encrypted / and tcplay

Zenny — 2013-05-14T19:41:52

Thanks to Alexancer and Alexey both for very useful info.

< at >Alexey: I need to encrypt /. I am quite impressed by full disk
encryption, recognized by bootloader of OpenBSD 5.3. Impressive work.
If Owl can implement somehting similar it would be wonderful. (ref:
http://ryanak.ca/planet-ubuntu/2013/03/26/Setting-up-full-disk-encryption-in-OpenBSD-5.3.html).

Actually full disk encryption is a basic requirement for me. I also
thought of installing Owl as a qemu instance of OpenBSD, but gave up
the idea of running vitualization on top of another virtualization i.e
openvz on top of qemu!

On 5/14/13, gremlin< at >gremlin.ru <gremlin< at >gremlin.ru> wrote:

Re: Owl encrypted / and tcplay

2013-05-14T12:32:26

 > Is there a way to encrypt Owl / with aes-xts-plain64 which can be
 > remotely authenticated remotely for decryption (like using dropbear
 > in initrd or mandos server-client mechanism in debian using hooks)?

No. And normally you don't need that.

When dealing with sensitive data, personally I prefer leaving bare
system at unencrypted / and /var, while keeping all the sensitive
data inside VZ containers stored at encrypted /home; when I reboot
the server, I wait for it to start and then issue the command like:

gpg < vzhost.key | ssh root< at >vzhost.somewhere \
 "xxd -p -r | losetup -p 0 -e twofish -k 256 -H sha512 /dev/loop0 /dev/md2"

(hint: `head -c128 /dev/random | xxd -p -c32 | gpg -ea > vzhost.key`
will provide you with secure encryption key).

After that, I go to vzhost.somewhere and issue two obvious commands:

mount /dev/loop0
service vz start

Please see the http://openwall.info/wiki/Owl/secure-storage page for
instructions of how to set up secure data storage.

 > Also interested in tcplay, but wo

Re: openvz kernel

2013-05-14T12:00:29

 > I recommend staying with our RHEL5'ish kernels for now, but if
 > you like to experiment, you may try OpenVZ's RHEL6'ish kernels
 > as well.

People who wish to try RHEL6-style OVZ kernels may try this one:

ftp://gremlin.people.openwall.com/pub/linux/Owl/kernel/kernel-2.6.32-ovz042stab065.3.g1.src.rpm
(size: 88 115 306 bytes, MD5 sum: 5c1eac15b2101836897cb147edb2e6b6)

It works on most of my servers just fine. Differences from "mainstream"
are:

0. The kernel is mostly monolythic (but modules support is enabled).
1. Removed "magic /dev/cdrom" together with legacy IDE support, as I
use SCSI layer instead (with root=/dev/sr0 for CD boot).
2. Fixed build of lxdialog (see kernel-owl-lxdialog.diff).

 > Installing them may be a bit tricky because they use initrd in
 > their builds and we don't - at least you'd need to add mkinitrd
 > first.

Building own kernel is simple and doesn't require using initrd.

Anyone has Owl image for Raspberry Pi?

2013-05-13T08:18:39

Colleagues,

despite that ARM is not mentioned at
http://www.openwall.com/Owl/ARCHITECTURES.shtml, I recall someone in the
past reported some experiments with Owl on ARM.  I wonder now whether
anyone tried to bring Owl up on Raspberry Pi.  Actually, what I need is a
(tiny, and definitely console-only) OS for Raspberry Pi being used as a
controlling computer in applications such as smart house, and it seems to
me that Owl is natural choice.

So, if there are any results so far in this area, please point me on them; 
if there are none, I'm going to try to build Owl for Raspberry Pi myself,
and in this case I'd be pleased for any tips and advices.  I only would
like to confirm I will not repeat someone else's work doing that.

Please note I've got an image of Debian for Raspberry Pi which is already
up and running; however, I doubt whether it is wise to use the Raspberry Pi
board itself for building a whole distro :) (well, as a last resort I'd do
even that).


Thanks!

--
Croco

Re: Owl-current and 3.0-stable 2013/04/08 snapshot

Solar Designer — 2013-05-09T08:00:42

I wish we had a timeline for Owl development (and could adhere to it),
but unfortunately we don't.  There was a tentative plan for when Owl 4.0
should have been released, but we're past that date already.


Yeah.  We definitely don't recommend use of RHEL4/CentOS 4 packages on
Owl now, except in cases where security and maintenance are unimportant.

In practice, we've been using our own builds of so-called "Owl-extra"
packages on top of Owl, but we never made those suitable for the public.

Another option is NetBSD pkgsrc:

http://openwall.info/wiki/Owl/pkgsrc

We (Openwall team) haven't been using NetBSD pkgsrc on Owl ourselves,
but apparently some Owl users do.


When we released Owl 3.0, the plan was to have Owl 4.0 mostly package
compatible with RHEL6/CentOS 6.  This is still the plan, unless Owl 4.0
gets delayed so much that the compatibility target shifts to RHEL7.
We'll definitely not bother implementing package compatibility with
RHEL5/CentOS 5.

Alexander

Re: openvz kernel

Solar Designer — 2013-05-09T07:51:45

Yes, we're definitely not supporting Vswap until after we move to
RHEL6'ish kernels.


I recommend staying with our RHEL5'ish kernels for now, but if you like
to experiment, you may try OpenVZ's RHEL6'ish kernels as well.
Installing them may be a bit tricky because they use initrd in their
builds and we don't - at least you'd need to add mkinitrd first.

Alexander

Re: Owl encrypted / and tcplay

Solar Designer — 2013-05-09T07:49:29

Hi,

On Sat, May 04, 2013 at 03:45:51PM +0200, Zenny wrote:

Perhaps there's a way by deviating from Owl, but it's not something we
support.  As a supported alternative, you may consider using Owl's
OpenVZ host system in the way you would have used your initrd image, and
using an OpenVZ container in the way you would have used the encrypted
system.  That is, simply place an OpenVZ container on an encrypted
filesystem, and only start it (maybe along with the entire OpenVZ
service) once the decryption passphrase is somehow entered and the
filesystem is mounted.


Well, for now we're only supporting cryptoloop, which I understand has
its drawbacks (lack of key stretching, no protection from watermarks -
which may or may not be relevant to a given use case).  Perhaps we'll
need to start supporting dm-crypt.

Alexander

Re: software raid with device busy status

misha shiposh — 2013-05-08T11:21:44

Hi Bernhard!
In my case, I change my root fs from raid to second disk. And the second
disk is not any more in raid array.
After reboot, os booted from second disk, but array, as I think, array
monitor still holds /dev/hda1 and I cannot stop this array and do any
action with first disk....
By the way, /dev/md0 (array dev) is not mounted.
mdadm says that the status is clean and degraded. And the state of hda1 is
still active sync....

mdadm --zero-superblock /dev/hda1
I did it on the second disk, and it's ok.
But I cannot do this on the first disk (/dev/hda1).




On Tue, May 7, 2013 at 6:29 PM, Bernhard Fischer <fischerb< at >fischer-ing.de>wrote:

Re: software raid with device busy status

Bernhard Fischer — 2013-05-07T14:29:25

Hi Misha,

you can't stop /dev/md0 if it's your root filesystem. It's like cutting
the branch you are sitting on.

If you remove a device from a raid set, you may also clear the
superblock for reusage.

mdadm --zero-superblock /dev/hda1

or do it the hard way

dd if=/dev/zero of=/dev/hda1

Check the other devices for proper bootloader installation. Otherwise
your machine will refuse booting afterwards. You have to install the
bootloader on every single device in the RAID set, to get it booting in
the case of a disaster.


-bernhard

Am Di 07.05.2013 15:45 schrieb misha shiposh <netsferato< at >gmail.com>:

software raid with device busy status

misha shiposh — 2013-05-07T13:45:19

Good day, guys!

I was wander, if there are any faq or guides of how to totally destroy raid
array?

In my case I'll trying in a virtual sandbox to emulate this thing, without
success...

After I create software raid 1, I'll try to delete it with the following
steps:

Also this raid is root for my os,

first delete one of disk
mdadm --manage /dev/md0 --fail /dev/hda1
mdadm --manage /dev/md0 --remove /dev/hda1

then if I try to stop array md0 it says that it's busy.... no wonder...
then I'll try to boot from removed disk and after that totally removing
raid.

and no success!

stopping raid says it's busy, other way trying to delete the second disk
without any result because of device is busy...

is there any way to totally destroy raid ?


Thanks!

Owl encrypted / and tcplay

Zenny — 2013-05-04T13:45:51

Hi:

Is there a way to encrypt Owl / with aes-xts-plain64 which can be
remotely authenticated remotely for decryption (like using dropbear in
initrd or mandos server-client mechanism in debian using hooks)?

Also interested in tcplay, but would be nice to know to securely
integrated with Owl 3.0.

Thanks!

openvz kernel

Zenny — 2013-05-04T13:41:38

Hi:

In Owl 3.0 there is 2.6.18-348.3.1.el5.028stab106.2 kernel and vzctl
is 3.0.23. This has some limitations like vswap (--ram and --swap
parameters) which is not available below 3.0.30
(http://wiki.openvz.org/Vswap).

Is it ideal to update to RHEL6 kernels from openvz? If yes, how is
that accomplished in Owl? Is there a specific way to do so?

Thanks!

Re: Owl-current and 3.0-stable 2013/04/08 snapshot

Zenny — 2013-05-04T11:16:43

What is the timeline for Owl 4.0 compatible with RHEL6?

Look forward to. Thanks for the great work!

On 5/4/13, Zenny <garbytrash< at >gmail.com> wrote:

Re: Owl-current and 3.0-stable 2013/04/08 snapshot

Zenny — 2013-05-04T11:11:10

It is nice to learn about the update, but what makes me wonder is the
upstream for RHEL4 is alreade EoL (end of life) about a year ago (2012
Feb as far as I remember).

It would be nice if Owl get upgraded to be compatible with the
packages for RHEL6/CentOS6 which has an end of life for 10 years? If
not at least, RHEL5/CentOS5 which alos has EoL for a decade.

Actually I encountered a lot of backward  incompatibility when I try
to use some applications.

Thanks!


On 4/11/13, Solar Designer <solar< at >openwall.com> wrote:

Owl-current and 3.0-stable 2013/04/08 snapshot

Solar Designer — 2013-04-11T12:07:47

Hi,

A few days ago, we've released new snapshots of Owl-current and Owl
3.0-stable, as usual including ISO images, OpenVZ container templates,
binary packages for i686 and x86_64, and full sources:

http://www.openwall.com/Owl/

The Linux kernel has been rebased on the latest from OpenVZ's
RHEL5-based branch (RHEL 5.9-based currently), thereby fixing a number
of vulnerabilities including the PTRACE_SETREGS vs. process death race
condition (CVE-2013-0871), which could allow for a local root compromise
and OpenVZ container escape.  (However, the risk probability might have
been low due to the race being difficult to win.)

GnuPG has been updated to 1.4.13, which fixes a memory corruption bug
(CVE-2012-6085).  The bug allowed an attacker to crash gpg(1) and
corrupt the public keyring database file.  Arbitrary code execution was
not possible because the attacker cannot control the corrupted data.
The corrupted data is stored in the keyring file, so the DoS effect is
persistent, but the keyring can be manually r

Re: Manage network interfaces

а х — 2013-02-20T11:15:50

Thank you for very clear answer!

2013/2/20 <gremlin< at >gremlin.ru>

Re: Manage network interfaces

2013-02-20T08:26:06

 > Hello, Can you tell me, please how to manage interfaces in OWL.
 > For example, I need eth0 to become eth1 and eth1 become eth0.

Hmmmm... possibly, `man nameif`?

 > As I see not with udev?

We don't use udev, as it's insecure. Also, properly configured system
doesn't need it.

 > And parameter HWADDR in ifcfg scripts does not help.

Do you actually need to change a MAC address? That's much easier:

ip link set dev eth0 address 00:11:22:33:44:55

 > Or show me, please, doc about this tip. Thank you!

In general, we should rewrite the network configuration scripts from
scratch... For now, personally I use the following quick-and-dirty
trick in init.d/network:

if [ -x /etc/rc.d/rc.network ]; then
  exec /etc/rc.d/rc.network $* || exit 0
fi

That allows me to perform a sort of exotic configuration like:

ip link set dev eth0 up
ip link set dev eth1 up

vconfig add eth1 100
ip link set dev eth1.100 up
brctl addbr lan
brctl addif lan eth0
brctl addif lan eth1.100
ip link set dev lan up
ip address add ... de

Manage network interfaces

а х — 2013-02-20T07:49:29

Hello,
Can you tell me, please how to manage interfaces in OWL. For example, I
need eth0 to become eth1 and eth1 become eth0. As I see not with udev? And
parameter HWADDR in ifcfg scripts does not help.
Or show me, please, doc about this tip.
Thank you!

Re: /etc/inittab exisits, yet reports none!

Igmar Palsenberg — 2013-01-03T19:55:32


That you can't locate /etc on a separate partition. It is required that it should be the root partition,
along with /sbin, /bin, and /lib{64} at least.



Igmar