- Talk - lists.gtalug.org

Raspberry Pi 4 Starter Kit - Ubiquiti Unifi controller software
by James Knott 10 May '21

10 May '21

I've been considering (because I have way too much time on my hands these days) getting a Raspberry Pi to run my Unifi access point controller software on. I would be doing this with Ubuntu or Raspian Linux. I currently run the controller on my desktop system (openSUSE). I assume a kit like this would be suitable. https://www.canakit.com/raspberry-pi-4-starter-kit.html

4 5

War Story: Fedora 33 update silently broke Dovecot (IMAP / POP3 server)
by D. Hugh Redelmeier 10 May '21

10 May '21

Only one of us uses IMAP / POP3. She stopped being able to pick up mail. The message was obscure: Thunderbird reported getting resets from the server. Detective work (leaving out the blind alleys): Look for funny messages in the server log. The right command is arcane: $ journalctl -b _SYSTEMD_UNIT=dovecot.service - -b means "since last boot". Very handy because the log can go back a long time. - _SYSTEMD_UNIT=dovecot.service: only messages about dovecot. Such an intuitive form. It won't work without the .service. It turns out that there is a shortform, -u or --unit=. May 04 14:07:12 redhop-mimosa-com dovecot[977]: config: Warning: please set ssl_dh=</etc/dovecot/dh.pem May 04 14:07:12 redhop-mimosa-com dovecot[977]: config: Warning: You can generate it with: dd if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dhparam -inform der > /etc/dovecot/dh.pem May 04 14:07:12 redhop-mimosa-com dovecot[977]: pop3-login: Error: Failed to initialize SSL server context: Can't load DH parameters (ssl_dh setting): error:1408518A:SSL routines:ssl3_ctx_ctrl:dh key too small: user=<>, rip=192.139.70.95, lip=192.139.70.82, session=<jkGQ8oTBnIDAi0Zf> May 04 15:30:28 redhop-mimosa-com dovecot[977]: pop3-login: Error: Failed to initialize SSL server context: Can't load DH parameters (ssl_dh setting): error:1408518A:SSL routines:ssl3_ctx_ctrl:dh key too small: user=<>, rip=192.139.70.95, lip=192.139.70.82, session=<SWRMHIbBmILAi0Zf> The first two messages were almost impossible to read because the were in yellow. It turns out that the first means that you have to edit /etc/dovecot/conf.d/10-ssl.conf and change #ssl_dh = </etc/dovecot/dh.pem to ssl_dh = </etc/dovecot/dh.pem /etc/dovecot/dh.pem was already there. OPTIONAL: /etc/dovecot/dh.pem specified a really weak Diffie-Hellman group. Your should probably strengthen it. I chose ffdhe2048, a weak one (2048 bits) that is still "OK". See: <https://wiki.mozilla.org/Security/Server_Side_TLS#Pre-defined_DHE_groups> You need it in PEM format. First save the old one. Then grab a new one: curl https://ssl-config.mozilla.org/ffdhe2048.txt > /etc/dovecot/dh.pem Then adjust ownership and permissions.

3 4

Re: [GTALUG] "DNS Wars"
by D. Hugh Redelmeier 10 May '21

10 May '21

| From: ac via talk <talk(a)gtalug.org> | And, there are additional dimensions to some of the issues raised in | the above post. I'm sure. It is both condensed and long-ish (at least for my web-tuned attention span). The blog entry contains an embedded YouTube video of a talk by Vixie that I'm only part way through. | Political changes to BIND, is one of the reasons I left | almost a decade ago. The general support for enabling walled gardens | and "custom" responses in open source communities by actually adding | code to a project, is, imnsho, simply wrong. I understand the vague idea but I'm not sure of the specific. And don't know about choices that have subtle consequences. I certainly don't know what issues are particularly concerning to you. | There are many other DNS issues not raised in this post, one obvious | example is that the overwhelming and vast majority of normal users | simply "searches" on GOOGLE for https://example.com - and | depending on "GOOGLE policy of that day" (as this changes) - users are | either directly redirtected to https://example.com - or users are shown | "search" results...(as, of course the user is "searching" because the | software vendors, a lot of the time the search engine itself, has | designed their software in this fashion as they want to control and own | every bit traveling on the wire. | | The "new" path Firefox is on, is so wrong. Actually that is mentioned. In Episode 2 and 3. | I can write a LOT more about this, but it is upsetting and emotional | for myself. I'm curious but powerless (as far as I know). I once attended an IETF meeting about DNSSec but that was long ago. Earlier our project had a fight about standardizing key distribution throught the reverse domain.

2 1

"DNS Wars"
by D. Hugh Redelmeier 08 May '21

08 May '21

This blog post is more than a year old, but well worth the read. It may require too much background, but it shows how crucial DNS is to the internet and how it is evolving in scary ways. It opened my eyes. <https://blog.apnic.net/2019/11/04/dns-wars/> APNIC is the Asia-Pacific Network Information Centre. It it the organization that assigns IP addresses for the Asia-Pacific region. <https://en.wikipedia.org/wiki/APNIC>

2 1

Video of Evan's talk from the last meeting
by Alex Volkov 01 May '21

01 May '21

Hello everyone, The recording of the talk -- I've ditched my Linux desktops for Windows .... sorta with Evan Leibovitch Is available here -- https://youtu.be/HfranDwTZOU Alex.

6 7

Fwd: Developer job postings at TPL
by Giles Orr 30 Apr '21

30 Apr '21

Toronto Public Library has posted three developer positions (and some other tech jobs!): https://www.torontopubliclibrary.ca/about-the-library/library-jobs/ You'll find them titled "ITS Senior Specialist (Web & Mobile Development)." I've heard the pay may not look competitive, but there are other benefits: a strong union means when we tell you you'll be working a 35 hour week, we mean it. Equally important, I really like our team. Feel free to mail me off list if you have questions (I only really know about the developer positions, the others are in another area). -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

1 0

OpenWRT 21.02 is on it's way!
by Scott Sullivan 28 Apr '21

28 Apr '21

Release Candidate 1 for OpenWRT 21.02 dropped last week. https://downloads.openwrt.org/releases/21.02.0-rc1/ Notable Features that mattered to me: * Kernel Upgrade, 4.14.221 => 5.4.111 * Availability of more 10G NIC drivers (bnx2x) * UEFI boot images for x86 targets * Raspberry Pi 4 support I recently have been working on building out some beefier firewalls for two sites with Fiber services. I needed something that could do wireguard without being terribly CPU bound. I also wanted to support greater then 1Gbps networking. I went with some used Dell SFF 3020 machines. i5-4570, 4G RAM, and two low profile PCIe slots (x16 & x1). Paired with some surplus BCM57840 cards and Intel 1G cards, these are turning into robust firewall boxs. -- Scott Sullivan

1 0

Linus Torvalds Responds to Linux Banning University of Minnesota
by Aruna Hewapathirane 27 Apr '21

27 Apr '21

Hello Everybody, I am still trying to understand the reason 'why' would anyone even want to do this ? Here is some context: https://portswigger.net/daily-swig/ill-advised-research-on-linux-kernel-lan… And follow up from Linus himself: https://www.tomshardware.com/news/linus-torvalds-responds-to-linux-banning-… I am also thinking if these two guys actually managed to do this they should be part of the community responsible for linux security ? Or we just hang them high and pour honey all over them and set loose bees and wasps on them ? I am torn two ways. My heart says shoot them. My brain says hire them ? Sigh... Just thought everyone would want to know so sharing :-) Aruna

9 21

Re: [GTALUG] Linus Torvalds Responds to Linux Banning University of Minnesota
by El Fontanero 26 Apr '21

26 Apr '21

On 2021-04-26 11:21 a.m., ac via talk wrote: > On Mon, 26 Apr 2021 10:03:50 -0400 > El Fontanero via talk <talk(a)gtalug.org> wrote: > <snip lotsa really cool stuff here> >>> How about something like a go-fund-me kind of service that >>> distributes the money to the successful contract killer? >>> I am sure something can be done over a blockchain. >>> If we could add in spammers I would be most happy. >> Absolutely nauseating. Shocking and horrifying. >> "Zero tolerance" means at the very least, that advocating murder is >> cause for immediate and permanent banning from this list, is it not? >> No, Toronto does not have the prevalence of firearms in the hands of >> people who casually say they want people shot or the people who >> casually agree with them, but our cousins to the south are an >> extremely important lesson that we do not want to emulate. >> > who said anything about firearms/guns? > > most contract killers I see on movies use poison, some have a stringy > type thingy where they hook it over the victims heads, others use a > knife (apparently killing is then more personal or enjoyable - go > figure, there are so many really and truly weird people out there...) > > I saw a movie the other day where the evil people placed the to be > killed victim in a box with spikes... YIKES!! > > and, anyway, as I understand the original post, it is intended as > humour, okay, well I guess you have to be weird like me to read is as > such? > > or is this thread now truly in the weeds? Weeds, no. FBI watchlist, yes. Thanks a lot. Now I have to keep all this email to try to prove that I'm not a member of a terrorist organization. That's it for me. I wish I had unsubscribed before the incitements to murder, but now it's too late. I leave you to yourselves.

2 1

Re: [GTALUG] Linus Torvalds Responds to Linux Banning University of Minnesota
by Aruna Hewapathirane 25 Apr '21

25 Apr '21

On Sun, Apr 25, 2021 at 6:01 AM ac via talk <talk(a)gtalug.org> wrote: > > It is EVIL to represent yourself as something you are not. > Agreed and once again these are just 'my' layman thoughts on this. Misrepresentation I feel and think is forgivable ? We have all done it at some point on our lives ? Me without knowing I was actually doing so and was rather abruptly and suddenly made to realise this. I apologized, they accepted. No harm done, we moved on - together! But pre-meditated and strategically planned careful introduction of vulnerabilities into the kernel is most definitely not. So like I said before we find them and we shoot them. The community are justifiably pissed-off me being one. > > I am sure there are many who would like to see the operating system > which drives the Internet, FAIL on a desperate and massive scale. > There will always be such people. We need to work in unity and solidarity. And that work is based on trust. And when this trust is literally shot to hell well... we shoot them again ? > It is EVIL to knowingly sabotage open source in this manner. > Agreed 110% again. > > I hope and wish that ALL Opens Source Programmers BAN University of > Minnesota for LIFE. > Umm.. that is extreme ? Two people did this ? These two people do not make up the University ? And there have been earlier patches made in good faith that so far seem legit and vulnerability free ? Again if an academic institute is able to submit 'useful' patches that 'fix' real problems that should be welcome ? But then I understand no one will ever trust anything coming from Minnesiota ever again. > > I am sure that there are many Nation States or LARGE corporations that > has, in the past, infiltrated many open source projects in this same > fashion and I am sure that they are all EVIL for the damage and > destruction they cause to human freedom on a planetary scale. > > Deception, power, control and narcissistic. Hire these types of people? > > Hell No! > > Listen, do you remeber one of Linus's most famous quotes ? He said and I quote: "See, you not only have to be a good coder to create a system like Linux, you have to be a sneaky bastard too." So all I am saying is these two 'gentlemen' who introduced the vulnerabilities that can be exploited at a later time knew what they were doing so we can learn from them, document everything, analyse and ensure this does not have a wash-rinse-repeat pattern ? And we can always shoot them again after we find what we need to know ? Forgive me I did some digging and the reason was I really wanted to know 'where' this 'passion' was coming from. And what I find says you're from South Africa and the email came through Germany ? Hell GTALUG has people all over the planet ? Yikes.. > They, and their institution, are now known worldwide for being > ethically challenged. > You and me both want them dead but calmer minds ( like GregKH ) will prevail :-) In solidarity - Aruna > > On Sat, 24 Apr 2021 11:55:00 -0400 > Aruna Hewapathirane via talk <talk(a)gtalug.org> wrote: > > > Hello Everybody, > > > > I am still trying to understand the reason 'why' would anyone even > > want to do this ? > > > > Here is some context: > > > https://portswigger.net/daily-swig/ill-advised-research-on-linux-kernel-lan… > > > > And follow up from Linus himself: > > > https://www.tomshardware.com/news/linus-torvalds-responds-to-linux-banning-… > > > > I am also thinking if these two guys actually managed to do this they > > should be part of the community responsible for linux security ? Or > > we just hang them high and pour honey all over them and set loose > > bees and wasps on them ? > > > > I am torn two ways. My heart says shoot them. My brain says hire them > > ? Sigh... > > > > Just thought everyone would want to know so sharing :-) > > > > Aruna > > --- > Post to this mailing list talk(a)gtalug.org > Unsubscribe from this mailing list > https://gtalug.org/mailman/listinfo/talk >

2 1