Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4690 > unrolled thread

Re: [SECURITY] [DSA 3547-1] imagemagick security update

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [SECURITY] [DSA 3547-1] imagemagick security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-04-12 13:40 +0200
    Re: [SECURITY] [DSA 3547-1] imagemagick security update "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-04-12 14:00 +0200
      Re: [SECURITY] [DSA 3547-1] imagemagick security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-04-13 07:40 +0200
        Re: [SECURITY] [DSA 3547-1] imagemagick security update "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-04-13 07:50 +0200
          Re: [SECURITY] [DSA 3547-1] imagemagick security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-04-13 08:20 +0200
    Re: [SECURITY] [DSA 3547-1] imagemagick security update Luciano Bello <luciano@debian.org> - 2016-04-12 14:20 +0200
      Re: [SECURITY] [DSA 3547-1] imagemagick security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-04-12 17:10 +0200
        Re: [SECURITY] [DSA 3547-1] imagemagick security update Drake Wilson <drake@dasyatidae.net> - 2016-04-12 17:40 +0200
        Re: [SECURITY] [DSA 3547-1] imagemagick security update "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-04-12 17:40 +0200
          Re: [SECURITY] [DSA 3547-1] imagemagick security update "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-04-12 19:10 +0200
            Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-12 19:40 +0200
              Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-12 21:20 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Michael Stone <mstone@debian.org> - 2016-04-12 21:40 +0200
                  Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-13 01:30 +0200
                    Re: [SECURITY] [DSA 3547-1] imagemagick security update Julien Cristau <jcristau@debian.org> - 2016-04-13 11:00 +0200
                      Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-13 14:50 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-12 21:50 +0200
                  Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-13 02:00 +0200
                    Re: [SECURITY] [DSA 3547-1] imagemagick security update Michael Stone <mstone@debian.org> - 2016-04-13 04:20 +0200
                      Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-13 07:40 +0200
                        Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-13 15:00 +0200
                          Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-14 11:10 +0200
            Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-12 19:40 +0200
            Re: [SECURITY] [DSA 3547-1] imagemagick security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-04-13 08:10 +0200
              Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-13 09:00 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Alexander Neilson <alexander@neilson.net.nz> - 2016-04-13 12:30 +0200
                  Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-14 11:20 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-13 14:50 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Scott Blaydes <scott@nettek.io> - 2016-04-13 15:10 +0200
                  Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-14 11:20 +0200

Page 2 of 2 — ← Prev page 1 [2]

#4716

On Wed, Apr 13, 2016, at 02:32, Peter Palfrader wrote:
> On Tue, 12 Apr 2016, Michael Stone wrote:
> 
> > On Tue, Apr 12, 2016 at 08:56:35PM -0300, Henrique de Moraes Holschuh wrote:
> > >Then, maybe we should consider a better way to deal with areas where you
> > >get only one choice out of geoip?
> > 
> > Reach out to the relevant team outlining your issues (e.g., lack of IPv6
> > connectivity)? Advising people to hard code security mirrors isn't the right
> > solution.
> 
> There's also nothing inherently wrong with just having a single address
> in an RRSet.

It means a single point of failure for that region: e.g. if the mirror
is stale, everything in that region will hit the same stale mirror, be
them users using apt, or "unrecommended" leaf mirrors of
debian-security.  This makes it harder for an user to work around the
breakage (they would need to use an unofficial security mirror from a
different region as the backup source for security updates).

Well, it is not a common issue, and it will be even less common if
someone manages to implement the staleness check.

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique de Moraes Holschuh <hmh@debian.org>

[toc] | [prev] | [next] | [standalone]

#4720

On Wed, 13 Apr 2016, Henrique de Moraes Holschuh wrote:

> On Wed, Apr 13, 2016, at 02:32, Peter Palfrader wrote:
> > There's also nothing inherently wrong with just having a single address
> > in an RRSet.
> 
> It means a single point of failure for that region:

A desynchronized set isn't any better.

-- 
                            |  .''`.       ** Debian **
      Peter Palfrader       | : :' :      The  universal
 https://www.palfrader.org/ | `. `'      Operating System
                            |   `-    https://www.debian.org/

[toc] | [prev] | [next] | [standalone]

#4698

On Tue, Apr 12, 2016, at 14:06, Adam D. Barratt wrote:
> Judging from your e-mail address, I'm going to assume that the answer is 
> that security.debian.org resolved to 150.203.164.61.
> 
> Apparently there was an issue with syncing to that mirror. The sysadmin 
> team have triggered a manual sync, so things should be up-to-date now.

Other (leaf ?) .au mirrors also seem to be stale:
mirror.aarnet.edu.au, mirror.cse.unsw.edu.au

Either those mirrors are not refreshing at an acceptable rate for
something that carries /debian-security, or we have a wider issue than a
single .au mirror missing a push.

We don't have leaf (non-push) mirrors in the geo-ip list for
security.debian.org, do we?

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique de Moraes Holschuh <hmh@debian.org>

[toc] | [prev] | [next] | [standalone]

#4709

Hi again,

Yes, as at ~ 0810 +0800 (0010 UTC) today; the server address below was 
resolving to the IP Address that you correctly assumed:

  URI: 
http://security.debian.org/debian-security/pool/updates/main/i/imagemagick/

  IP Address: 150.203.164.61  (at my Australian location).

The imagemagick security update did not show up until somewhere between; 
~0730 to 0808 +0800(UTC+8) (~2330 to 0008 +0000(UTC)) this morning - a 
delay of more than 24 hours - hence my concern.

Given that this is not the first occurrence, what options does the 
Debian community have available to prevent this problem from arising 
again in the future?

Yours sincerely,
Bjoern.


On 13/04/16 01:06, Adam D. Barratt wrote:
> On 2016-04-12 16:35, Adam D. Barratt wrote:
>> On 2016-04-12 15:42, Bjoern Nyjorden wrote:
>>> Hi Luciano and others,
>>>
>>> AS AT: 2230(+0800) (1430(+0000)):
>>>
>>>   * Imagemagick  version 8:6.7.7.10-5+deb7u4 is STILL NOT AVAILABLE at:
>>>
>>>
>>> http://security.debian.org/debian-security/pool/updates/main/i/imagemagick/
>>>
>>>
>>>   * Aptitude (or apt-get) is unable to update as a result
>>
>> You could answer the question I asked a few hours ago...
>
> Judging from your e-mail address, I'm going to assume that the answer is
> that security.debian.org resolved to 150.203.164.61.
>
> Apparently there was an issue with syncing to that mirror. The sysadmin
> team have triggered a manual sync, so things should be up-to-date now.
>
> Regards,
>
> Adam

[toc] | [prev] | [next] | [standalone]

#4711

On Wed, 13 Apr 2016, Bjoern Nyjorden wrote:

> Given that this is not the first occurrence,

I think it is, actually.  As often is the case in the swiss-cheese
model, here all the holes lined up and the update of this security
mirror was delayed for about two days.

We can identify at least four causal factors.  Probably more, if we
look a bit further.
 (1) The scripts Debian uses to mirror repositories treat the mirroring
     hierarchy as a tree.  The failure of any node or link will cause
     the subtrey(s) under the failed component to not receive updates.
 (2) There is an ongoing network outage between where the australian
     mirror is and its upstream mirror in the US.
 (3) The scripts that automatically update the security rotation only
     check if a server is online and responds to http requests - it
     does not check if a mirror is current.
 (4) The nagios warning was missed in all the noise, and the relevant
     teams are overworked and busy.

>                                              what options does the Debian
> community have available to prevent this problem from arising again in the
> future?

Fixing (1) would be really nice.  It requires somebody to sit down and
design and implement something better.

Re (2), we are temporarily syncing the .au mirror from a different
machine while the network outage is being traced down by the relevant
NOCs.

Expanding mini-nag[1] to do something about (3) would be nice too.

Cheers,

[1]
  https://anonscm.debian.org/cgit/mirror/dsa-mini-nag.git/tree/
  also see
  https://anonscm.debian.org/cgit/mirror/dsa-auto-dns.git/tree/
-- 
                            |  .''`.       ** Debian **
      Peter Palfrader       | : :' :      The  universal
 https://www.palfrader.org/ | `. `'      Operating System
                            |   `-    https://www.debian.org/

[toc] | [prev] | [next] | [standalone]

#4713

> On 13/04/2016, at 18:50, Peter Palfrader <weasel@debian.org> wrote:
> 
>> On Wed, 13 Apr 2016, Bjoern Nyjorden wrote:
>> 
>> Given that this is not the first occurrence,
> 
> I think it is, actually.  As often is the case in the swiss-cheese
> model, here all the holes lined up and the update of this security
> mirror was delayed for about two days.
> 
> We can identify at least four causal factors.  Probably more, if we
> look a bit further.
> (1) The scripts Debian uses to mirror repositories treat the mirroring
>     hierarchy as a tree.  The failure of any node or link will cause
>     the subtrey(s) under the failed component to not receive updates.
> (2) There is an ongoing network outage between where the australian
>     mirror is and its upstream mirror in the US.
> (3) The scripts that automatically update the security rotation only
>     check if a server is online and responds to http requests - it
>     does not check if a mirror is current.
> (4) The nagios warning was missed in all the noise, and the relevant
>     teams are overworked and busy.

With mention to the above. Specifically (4). Is there a mailing list / group / volunteer place for people interested in helping with network operations? 

In $DayJob I work doing monitoring and management of networks and while my coding is still rough I think this would be a way I could contribute to helping Debian and I would be keen to. 

As an aside I would also be keen to help on 1-3 as best as I could however I will need to work on my programming and getting to understand the existing code before I could usefully help with 1 or 4

Apologies if this is too off topic or if this is answered clearly elsewhere. 

Regards
Alexander

[toc] | [prev] | [next] | [standalone]

#4722

On Wed, 13 Apr 2016, Alexander Neilson wrote:

> > (4) The nagios warning was missed in all the noise, and the relevant
> >     teams are overworked and busy.
> 
> With mention to the above. Specifically (4). Is there a mailing list /
> group / volunteer place for people interested in helping with network
> operations? 

This is mostly handled by DSA (the debian system admin team) who are all
volunteers and do it in their spare time.  The IRC channel is #debian-admin
on OFTC.  There is a #debian-admin-bots that gets fed the nagios
warnings from https://nagios.debian.org/ (dsa-guest:*).

https://anonscm.debian.org/cgit/mirror/dsa-nagios.git/ has the nagios
config and checks.
-- 
                            |  .''`.       ** Debian **
      Peter Palfrader       | : :' :      The  universal
 https://www.palfrader.org/ | `. `'      Operating System
                            |   `-    https://www.debian.org/

[toc] | [prev] | [next] | [standalone]

#4715

On Wed, Apr 13, 2016, at 03:50, Peter Palfrader wrote:
> We can identify at least four causal factors.  Probably more, if we
> look a bit further.
>  (1) The scripts Debian uses to mirror repositories treat the mirroring
>      hierarchy as a tree.  The failure of any node or link will cause
>      the subtrey(s) under the failed component to not receive updates.
>  (2) There is an ongoing network outage between where the australian
>      mirror is and its upstream mirror in the US.
>  (3) The scripts that automatically update the security rotation only
>      check if a server is online and responds to http requests - it
>      does not check if a mirror is current.
>  (4) The nagios warning was missed in all the noise, and the relevant
>      teams are overworked and busy.

Thank you for that information.

If we ever manage to fix (3), this would alleviate most of my worries
over a single mirror being returned in the geo-ip RRSET for some areas
of the Internet.

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique de Moraes Holschuh <hmh@debian.org>

[toc] | [prev] | [next] | [standalone]

#4717

[Multipart message — attachments visible in raw view] — view raw

On 4/13/16 1:50 AM, Peter Palfrader wrote:
> On Wed, 13 Apr 2016, Bjoern Nyjorden wrote:

>  (4) The nagios warning was missed in all the noise, and the relevant
>      teams are overworked and busy.
> 
>>                                              what options does the Debian
>> community have available to prevent this problem from arising again in the
>> future?
> Expanding mini-nag[1] to do something about (3) would be nice too.

Who do we need to talk to about requirements and tasks to help out with
things like this? I am not a coder, but would love to help out where I can.

Thank you,
Scott Blaydes

-- 
Scott Blaydes
scott@nettek.io
325-455-0118    Encrypted email preferred.
GPG: 4A8BD92C

[toc] | [prev] | [next] | [standalone]

#4721

On Wed, 13 Apr 2016, Scott Blaydes wrote:

> >  (3) The scripts that automatically update the security rotation only
> >      check if a server is online and responds to http requests - it
> >      does not check if a mirror is current.

> > Expanding mini-nag[1] to do something about (3) would be nice too.
> 
> Who do we need to talk to about requirements and tasks to help out with
> things like this? I am not a coder, but would love to help out where I can.

mini-nag runs a limited set of nagios checks as configured in the
auto-dns hosts file.

So what we'd need is a nagios check that tells us for a given host
whether its (security) mirror is current.

Stop by in #debian-admin on OFTC if you want to help.

Cheers,
-- 
                            |  .''`.       ** Debian **
      Peter Palfrader       | : :' :      The  universal
 https://www.palfrader.org/ | `. `'      Operating System
                            |   `-    https://www.debian.org/

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.security

csiph-web