Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #237669 > unrolled thread

Debian Security

Back to article view | Back to linux.debian.user

Contents

  Debian Security Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-24 07:10 +0200
    Re: Debian Security <tomas@tuxteam.de> - 2021-07-24 10:50 +0200
      Re: Debian Security Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-24 17:50 +0200
        Re: Debian Security Georgi Naplatanov <gosho@oles.biz> - 2021-07-24 18:20 +0200
          Re: Debian Security Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-24 19:50 +0200
            Re: Debian Security The Wanderer <wanderer@fastmail.fm> - 2021-07-24 20:00 +0200
        Re: Debian Security tomas@tuxteam.de - 2021-07-24 19:20 +0200
    Re: Debian Security basti <basti@unix-solution.de> - 2021-07-24 11:20 +0200
    Re: Debian Security "Andrew M.A. Cater" <amacater@einval.com> - 2021-07-24 11:40 +0200
      Re: Debian Security Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-24 20:30 +0200
      Re: Debian Security Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-08-11 10:30 +0200
      Re: Debian Security Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-08-11 10:30 +0200

#237669 — Debian Security

[Multipart message — attachments visible in raw view] — view raw

Hi !
How would you copy the debian security update repository ?
I know it's not recommended.
But I'd like to do so.
-- 
Polyna-Maude R.-Summerside
-Be smart, Be wise, Support opensource development

[toc] | [next] | [standalone]

#237671

[Multipart message — attachments visible in raw view] — view raw

On Sat, Jul 24, 2021 at 01:07:24AM -0400, Polyna-Maude Racicot-Summerside wrote:
> Hi !
> How would you copy the debian security update repository ?

What do you mean by "copy the repository"? Make local copies of all the
packages in debian-security?

In that case, perhaps debmirror [1] is for you. Otherwise I haven't
understood what you are after.

Cheers

[1] https://manpages.debian.org/testing/debmirror/debmirror.1.en.html

 - t

[toc] | [prev] | [next] | [standalone]

#237678

[Multipart message — attachments visible in raw view] — view raw

Hi,


On 2021-07-24 4:49 a.m., tomas@tuxteam.de wrote:
> On Sat, Jul 24, 2021 at 01:07:24AM -0400, Polyna-Maude Racicot-Summerside wrote:
>> Hi !
>> How would you copy the debian security update repository ?
> 
> What do you mean by "copy the repository"? Make local copies of all the
> packages in debian-security?
> 
> In that case, perhaps debmirror [1] is for you. Otherwise I haven't
> understood what you are after.
> 
Yes, I'm talking about doing a local copies of all packages in
debian-security.
I've tried using debmirror and it seems to fail because there's a file
missing on the debian-security repository. So I get a error using apt
update afterward.
I'll make a copy with debmirror and write the exact error message.

I'm thinking maybe aptly would be the best way.

I simply want to have a local copy of the security updates so I can
install machine really fast with some limited bandwidth. And I can't use
apt-cache because I want this to be on a hard disk and independant of
the network.

I am not running a hospital, a defense installation, a nuclear
installation or a chemical warfare plant so all the things about "having
a risk someone would corrupt my debian-security update server" is a big
too much. The same risk would apply to the normal repository (that I
already make local copy).

> Cheers
> 
> [1] https://manpages.debian.org/testing/debmirror/debmirror.1.en.html
> 
>  - t
> 

-- 
Polyna-Maude R.-Summerside
-Be smart, Be wise, Support opensource development

[toc] | [prev] | [next] | [standalone]

#237679

On 7/24/21 6:47 PM, Polyna-Maude Racicot-Summerside wrot
> 
> I simply want to have a local copy of the security updates so I can
> install machine really fast with some limited bandwidth. And I can't use
> apt-cache because I want this to be on a hard disk and independant of
> the network.
> 

In such case you can use proxy like Squid.

[toc] | [prev] | [next] | [standalone]

#237681

[Multipart message — attachments visible in raw view] — view raw

Hi,

On 2021-07-24 12:11 p.m., Georgi Naplatanov wrote:
> On 7/24/21 6:47 PM, Polyna-Maude Racicot-Summerside wrot
>>
>> I simply want to have a local copy of the security updates so I can
>> install machine really fast with some limited bandwidth. And I can't use
>> apt-cache because I want this to be on a hard disk and independant of
>> the network.
>>
> 
> In such case you can use proxy like Squid.
> 

If you explain to me, how does a proxy work on a hard disk that I plug
into a computer when needed to do a install then I'll send you bitcoins.

I've said "I want this to be independent of the network".
-- 
Polyna-Maude R.-Summerside
-Be smart, Be wise, Support opensource development

[toc] | [prev] | [next] | [standalone]

#237682

[Multipart message — attachments visible in raw view] — view raw

On 2021-07-24 at 13:44, Polyna-Maude Racicot-Summerside wrote:

> Hi,
> 
> On 2021-07-24 12:11 p.m., Georgi Naplatanov wrote:
> 
>> On 7/24/21 6:47 PM, Polyna-Maude Racicot-Summerside wrot
>> 
>>> I simply want to have a local copy of the security updates so I
>>> can install machine really fast with some limited bandwidth. And
>>> I can't use apt-cache because I want this to be on a hard disk
>>> and independant of the network.
>> 
>> In such case you can use proxy like Squid.
> 
> If you explain to me, how does a proxy work on a hard disk that I
> plug into a computer when needed to do a install then I'll send you
> bitcoins.
> 
> I've said "I want this to be independent of the network".

It's possible that that may have been interpreted as referring to
*external* networks, i.e., network traffic that goes across hardware
that is not 100% under your control.

For a lot of people and uses, it would be entirely reasonable to set up
a local computer to act as a Debian mirror or proxy, and then have other
computers talk to that one when downloading the packages for
installation rather than going out to the Internet or any public mirror.

If your context is one where that sort of local-network setup isn't
viable or for some reason isn't suitable, fair enough, but the necessary
information to conclude that wasn't made available in your problem
statement.

(And the fact that you said "limited bandwidth" does seem to indicate
that there is some network activity expected to be involved, so the
possibility of bringing in a local-network cache in order to minimize
external-network traffic does seem like a reasonable thing to suggest.)

-- 
   The Wanderer

The reasonable man adapts himself to the world; the unreasonable one
persists in trying to adapt the world to himself. Therefore all
progress depends on the unreasonable man.         -- George Bernard Shaw

[toc] | [prev] | [next] | [standalone]

#237680

[Multipart message — attachments visible in raw view] — view raw

On Sat, Jul 24, 2021 at 11:47:41AM -0400, Polyna-Maude Racicot-Summerside wrote:
> Hi,
> 
> 
> On 2021-07-24 4:49 a.m., tomas@tuxteam.de wrote:

[...]

> Yes, I'm talking about doing a local copies of all packages in
> debian-security.

I see.

> I've tried using debmirror and it seems to fail because there's a file
> missing on the debian-security repository. So I get a error using apt
> update afterward.
> I'll make a copy with debmirror and write the exact error message.

OK.

> I'm thinking maybe aptly would be the best way.
> 
> I simply want to have a local copy of the security updates so I can
> install machine really fast with some limited bandwidth. And I can't use
> apt-cache because I want this to be on a hard disk and independant of
> the network.

AFAIK, apt-cacher-ng has an offline mode and you can prime it while
it is online, so perhaps it's best of both worlds. Warning: I never
used its offline mode (I use it "online" extensively for spinning
up images and there it is nearly no-fuss).

Cheers
 - t

[toc] | [prev] | [next] | [standalone]

#237672

hello,

what are your intentions?
would an apt-cacher be an option?
so you can download it once and distribute it several times.

Am 24.07.21 um 07:07 schrieb Polyna-Maude Racicot-Summerside:
> Hi !
> How would you copy the debian security update repository ?
> I know it's not recommended.
> But I'd like to do so.
> 

[toc] | [prev] | [next] | [standalone]

#237673

On Sat, Jul 24, 2021 at 01:07:24AM -0400, Polyna-Maude Racicot-Summerside wrote:
> Hi !
> How would you copy the debian security update repository ?
> I know it's not recommended.
> But I'd like to do so.
> -- 
> Polyna-Maude R.-Summerside
> -Be smart, Be wise, Support opensource development
> 

In general, this is a very bad idea because - and only because - you don't want
the possibility of machines getting incorrect / out of date fixes.
Security-critical things are security-critical - trying to maintain one
canonical source of truth where uploads are moderated and from a known source
is hard. Forcing people to go to the one source solves that problem in one
sense (and may also lessen the risk of some Evil Hacker maintaining a 
security repository stuffed with malware and spoofing).
[Having said all that: I've a feeling that security.d.o is actually a set
of servers to serve Europe/Asia/N. America behind the content delivery
network.]

If you really, really, really want to do it properly: I'd suggest approaching
the people in charge of security.d.o, having a conversation about exactly
what you want to do, why and for how many people. You'd probably need to 
assure tham that your mirror will be relatively secure from attack - so their
machines are not at risk - and then arrange for some form of push mirroring, 
so that they push updates to you at their convenience. This means that they
will need the ability to have an account on your machine sufficiently to
use ssh and forced commands to push the updates.

Debian mirrors in general are updated about four times a day and it's 
asynchronous. Pushed updates mean that everyone gets a drip feed of updates
whenever they're published. This is how several of us currently run private
mirrors for the main Debian distribution.

Unless you are a bank / government agency / pharmaceutical company that 
keeps all critical systems airgapped and entirely isolated from the Internet, 
maintaining a separate security mirror may be more trouble than it's worth
in my opinion.

All the very best, as ever,

Andy Cater

[toc] | [prev] | [next] | [standalone]

#237683

[Multipart message — attachments visible in raw view] — view raw

Hi,

On 2021-07-24 5:33 a.m., Andrew M.A. Cater wrote:
> On Sat, Jul 24, 2021 at 01:07:24AM -0400, Polyna-Maude Racicot-Summerside wrote:
>> Hi !
>> How would you copy the debian security update repository ?
>> I know it's not recommended.
>> But I'd like to do so.
>> -- 
>> Polyna-Maude R.-Summerside
>> -Be smart, Be wise, Support opensource development
>>
> 
> In general, this is a very bad idea because - and only because - you don't want
> the possibility of machines getting incorrect / out of date fixes.
> Security-critical things are security-critical - trying to maintain one
> canonical source of truth where uploads are moderated and from a known source
> is hard. Forcing people to go to the one source solves that problem in one
> sense (and may also lessen the risk of some Evil Hacker maintaining a 
> security repository stuffed with malware and spoofing).
> [Having said all that: I've a feeling that security.d.o is actually a set
> of servers to serve Europe/Asia/N. America behind the content delivery
> network.]
> 
> If you really, really, really want to do it properly: I'd suggest approaching
> the people in charge of security.d.o, having a conversation about exactly
> what you want to do, why and for how many people. You'd probably need to 
> assure tham that your mirror will be relatively secure from attack - so their
> machines are not at risk - and then arrange for some form of push mirroring, 
> so that they push updates to you at their convenience. This means that they
> will need the ability to have an account on your machine sufficiently to
> use ssh and forced commands to push the updates.
> 
> Debian mirrors in general are updated about four times a day and it's 
> asynchronous. Pushed updates mean that everyone gets a drip feed of updates
> whenever they're published. This is how several of us currently run private
> mirrors for the main Debian distribution.
> 
> Unless you are a bank / government agency / pharmaceutical company that 
> keeps all critical systems airgapped and entirely isolated from the Internet, 
> maintaining a separate security mirror may be more trouble than it's worth
> in my opinion.
> 
Thanks for all those explanation.
I was thinking about using maybe aptly and signing my own repository.
This wouldn't be a direct copy of security updates @ debian.org but
would be my own.
I understand the risk involved but I can assume this risk.
The same way I assume some risk and choose to go on the safe side for other.
For example, I don't encrypt my hard disk partition, that's a choice I
assume.
But I do use SSH on my home network instead of password.

There's no risk of "evil hacker" but as I install Debian into people's
home and some of them have limited bandwidth, even paying big extras for
GB when you are in the deep country side. So I can't assume the customer
can have access to the security updates that will be installed after the
normal Debian installation.

Already that they'll need to keep themselves up to date and this will
incur some fees, it's better if I limit those at installation.

> All the very best, as ever,
> 
> Andy Cater
> 
> 

-- 
Polyna-Maude R.-Summerside
-Be smart, Be wise, Support opensource development

[toc] | [prev] | [next] | [standalone]

#238488

[Multipart message — attachments visible in raw view] — view raw

Hi,
Sorry Andrew for the CC.
This one wasn't done on purpose.

Your message was saved in draft and I did a mistake for the sending.

On 2021-08-11 4:21 a.m., Polyna-Maude Racicot-Summerside wrote:
> Hi,
> 
> On 2021-07-24 5:33 a.m., Andrew M.A. Cater wrote:
>> On Sat, Jul 24, 2021 at 01:07:24AM -0400, Polyna-Maude Racicot-Summerside wrote:
>>> Hi !
>>> How would you copy the debian security update repository ?
>>> I know it's not recommended.
>>> But I'd like to do so.
>>> -- 
>>> Polyna-Maude R.-Summerside
>>> -Be smart, Be wise, Support opensource development
>>>
>>
>> In general, this is a very bad idea because - and only because - you don't want
>> the possibility of machines getting incorrect / out of date fixes.
>> Security-critical things are security-critical - trying to maintain one
>> canonical source of truth where uploads are moderated and from a known source
>> is hard. Forcing people to go to the one source solves that problem in one
>> sense (and may also lessen the risk of some Evil Hacker maintaining a 
>> security repository stuffed with malware and spoofing).
>> [Having said all that: I've a feeling that security.d.o is actually a set
>> of servers to serve Europe/Asia/N. America behind the content delivery
>> network.]
>>
>> If you really, really, really want to do it properly: I'd suggest approaching
>> the people in charge of security.d.o, having a conversation about exactly
>> what you want to do, why and for how many people. You'd probably need to 
>> assure tham that your mirror will be relatively secure from attack - so their
>> machines are not at risk - and then arrange for some form of push mirroring, 
>> so that they push updates to you at their convenience. This means that they
>> will need the ability to have an account on your machine sufficiently to
>> use ssh and forced commands to push the updates.
>>
>> Debian mirrors in general are updated about four times a day and it's 
>> asynchronous. Pushed updates mean that everyone gets a drip feed of updates
>> whenever they're published. This is how several of us currently run private
>> mirrors for the main Debian distribution.
>>
>> Unless you are a bank / government agency / pharmaceutical company that 
>> keeps all critical systems airgapped and entirely isolated from the Internet, 
>> maintaining a separate security mirror may be more trouble than it's worth
>> in my opinion.
>>
> Thanks for all those explanation.
> I was thinking about using maybe aptly and signing my own repository.
> This wouldn't be a direct copy of security updates @ debian.org but
> would be my own.
> I understand the risk involved but I can assume this risk.
> The same way I assume some risk and choose to go on the safe side for other.
> For example, I don't encrypt my hard disk partition, that's a choice I
> assume.
> But I do use SSH on my home network instead of password.
> 
> There's no risk of "evil hacker" but as I install Debian into people's
> home and some of them have limited bandwidth, even paying big extras for
> GB when you are in the deep country side. So I can't assume the customer
> can have access to the security updates that will be installed after the
> normal Debian installation.
> 
> Already that they'll need to keep themselves up to date and this will
> incur some fees, it's better if I limit those at installation.
> 
>> All the very best, as ever,
>>
>> Andy Cater
>>
>>
> 

-- 
Polyna-Maude R.-Summerside
-Be smart, Be wise, Support opensource development

[toc] | [prev] | [next] | [standalone]

#238490

[Multipart message — attachments visible in raw view] — view raw

Hi,

On 2021-07-24 5:33 a.m., Andrew M.A. Cater wrote:
> On Sat, Jul 24, 2021 at 01:07:24AM -0400, Polyna-Maude Racicot-Summerside wrote:
>> Hi !
>> How would you copy the debian security update repository ?
>> I know it's not recommended.
>> But I'd like to do so.
>> -- 
>> Polyna-Maude R.-Summerside
>> -Be smart, Be wise, Support opensource development
>>
> 
> In general, this is a very bad idea because - and only because - you don't want
> the possibility of machines getting incorrect / out of date fixes.
> Security-critical things are security-critical - trying to maintain one
> canonical source of truth where uploads are moderated and from a known source
> is hard. Forcing people to go to the one source solves that problem in one
> sense (and may also lessen the risk of some Evil Hacker maintaining a 
> security repository stuffed with malware and spoofing).
> [Having said all that: I've a feeling that security.d.o is actually a set
> of servers to serve Europe/Asia/N. America behind the content delivery
> network.]
> 
> If you really, really, really want to do it properly: I'd suggest approaching
> the people in charge of security.d.o, having a conversation about exactly
> what you want to do, why and for how many people. You'd probably need to 
> assure tham that your mirror will be relatively secure from attack - so their
> machines are not at risk - and then arrange for some form of push mirroring, 
> so that they push updates to you at their convenience. This means that they
> will need the ability to have an account on your machine sufficiently to
> use ssh and forced commands to push the updates.
> 
> Debian mirrors in general are updated about four times a day and it's 
> asynchronous. Pushed updates mean that everyone gets a drip feed of updates
> whenever they're published. This is how several of us currently run private
> mirrors for the main Debian distribution.
> 
> Unless you are a bank / government agency / pharmaceutical company that 
> keeps all critical systems airgapped and entirely isolated from the Internet, 
> maintaining a separate security mirror may be more trouble than it's worth
> in my opinion.
> 
Thanks for all those explanation.
I was thinking about using maybe aptly and signing my own repository.
This wouldn't be a direct copy of security updates @ debian.org but
would be my own.
I understand the risk involved but I can assume this risk.
The same way I assume some risk and choose to go on the safe side for other.
For example, I don't encrypt my hard disk partition, that's a choice I
assume.
But I do use SSH on my home network instead of password.

There's no risk of "evil hacker" but as I install Debian into people's
home and some of them have limited bandwidth, even paying big extras for
GB when you are in the deep country side. So I can't assume the customer
can have access to the security updates that will be installed after the
normal Debian installation.

Already that they'll need to keep themselves up to date and this will
incur some fees, it's better if I limit those at installation.

> All the very best, as ever,
> 
> Andy Cater
> 
> 

-- 
Polyna-Maude R.-Summerside
-Be smart, Be wise, Support opensource development

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web