Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #239736 > unrolled thread

sources.list 's security line

Back to article view | Back to linux.debian.user

Contents

  sources.list 's security line riveravaldez <riveravaldezmail@gmail.com> - 2021-09-06 12:00 +0200
    Re: sources.list 's security line "Andrew M.A. Cater" <amacater@einval.com> - 2021-09-06 12:10 +0200
      Re: sources.list 's security line Brian <ad44@cityscape.co.uk> - 2021-09-06 12:30 +0200
        Re: sources.list 's security line Brian <ad44@cityscape.co.uk> - 2021-09-06 13:40 +0200
    Re: sources.list 's security line Brian <ad44@cityscape.co.uk> - 2021-09-06 12:50 +0200
      Re: sources.list 's security line Toni Mas Soler <antomassol@protonmail.com> - 2021-09-06 13:00 +0200
      Re: sources.list 's security line Greg Wooledge <greg@wooledge.org> - 2021-09-06 14:40 +0200
        Re: sources.list 's security line Brian <ad44@cityscape.co.uk> - 2021-09-06 15:20 +0200
        Re: sources.list 's security line Brian <ad44@cityscape.co.uk> - 2021-09-06 19:10 +0200
    Re: sources.list 's security line Steve Dondley <s@dondley.com> - 2021-09-06 19:10 +0200
      Re: sources.list 's security line Jim Popovitch <jim@k4vqc.com> - 2021-09-07 01:30 +0200
        Re: sources.list 's security line "Andrew M.A. Cater" <amacater@einval.com> - 2021-09-07 09:30 +0200
        Re: sources.list 's security line Lee <ler762@gmail.com> - 2021-09-08 17:00 +0200
          Re: sources.list 's security line Ulf Volmer <u.volmer@u-v.de> - 2021-09-08 20:50 +0200
            Re: sources.list 's security line Greg Wooledge <greg@wooledge.org> - 2021-09-08 21:20 +0200
              Re: sources.list 's security line Ulf Volmer <u.volmer@u-v.de> - 2021-09-08 21:40 +0200

#239736 — sources.list 's security line

Hi,

after reading the various sources of documentation (handbook,
wiki, FAQs, Release Notes, etc.) I think I'm finding myself with
kinda four options for the security line in /etc/apt/sources.list
Those being:

deb http://security.debian.org/debian-security bullseye-security main

deb http://security.debian.org bullseye-security main

deb https://deb.debian.org/debian-security bullseye-security main

deb http://security.debian.org testing/updates main

Which would be the right one(s)?

Thanks a lot!

[toc] | [next] | [standalone]

#239737

On Mon, Sep 06, 2021 at 06:53:25AM -0300, riveravaldez wrote:
> Hi,
> 
> after reading the various sources of documentation (handbook,
> wiki, FAQs, Release Notes, etc.) I think I'm finding myself with
> kinda four options for the security line in /etc/apt/sources.list
> Those being:
> 
> deb http://security.debian.org/debian-security bullseye-security main
> 
> deb http://security.debian.org bullseye-security main
> 
> deb https://deb.debian.org/debian-security bullseye-security main
> 
> deb http://security.debian.org testing/updates main
> 
> Which would be the right one(s)?
> 
> Thanks a lot!
> 

deb http://deb.debian.org/debian bullseye main contrib non-free
deb-src http://deb.debian.org/debian bullseye main contrib non-free

deb http://deb.debian.org/debian-security/ bullseye-security main contrib non-free
deb-src http://deb.debian.org/debian-security/ bullseye-security main contrib non-free

deb http://deb.debian.org/debian bullseye-updates main contrib non-free
deb-src http://deb.debian.org/debian bullseye-updates main contrib non-free

[Including non-free]

>From https://wiki.debian.org/SourcesList - the canonical source on the Wiki

Hope this helps. All the very best, as ever,

Andy Cater

[toc] | [prev] | [next] | [standalone]

#239738

On Mon 06 Sep 2021 at 10:08:28 +0000, Andrew M.A. Cater wrote:

> On Mon, Sep 06, 2021 at 06:53:25AM -0300, riveravaldez wrote:
> > Hi,
> > 
> > after reading the various sources of documentation (handbook,
> > wiki, FAQs, Release Notes, etc.) I think I'm finding myself with
> > kinda four options for the security line in /etc/apt/sources.list
> > Those being:
> > 
> > deb http://security.debian.org/debian-security bullseye-security main
> > 
> > deb http://security.debian.org bullseye-security main
> > 
> > deb https://deb.debian.org/debian-security bullseye-security main
> > 
> > deb http://security.debian.org testing/updates main
> > 
> > Which would be the right one(s)?
> > 
> > Thanks a lot!
> > 
> 
> deb http://deb.debian.org/debian bullseye main contrib non-free
> deb-src http://deb.debian.org/debian bullseye main contrib non-free
> 
> deb http://deb.debian.org/debian-security/ bullseye-security main contrib non-free
> deb-src http://deb.debian.org/debian-security/ bullseye-security main contrib non-free
> 
> deb http://deb.debian.org/debian bullseye-updates main contrib non-free
> deb-src http://deb.debian.org/debian bullseye-updates main contrib non-free
> 
> [Including non-free]
> 
> >From https://wiki.debian.org/SourcesList - the canonical source on the Wiki

I've always thought contrib and non-free as not being supported by
the security team.

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#239742

On Mon 06 Sep 2021 at 11:21:03 +0100, Brian wrote:

[...]

> I've always thought contrib and non-free as not being supported by
> the security team.

I think I'll change my mind. The result of self-education follows: :)

 https://www.debian.org/security/faq#contrib

  ...If it is possible to fix the problem, and the package maintainer
  or someone else provides correct updated packages, then the security
  team will generally process them and release an advisory.

 https://www.debian.org/security/2020/dsa-4701

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#239740

On Mon 06 Sep 2021 at 06:53:25 -0300, riveravaldez wrote:

> Hi,
> 
> after reading the various sources of documentation (handbook,
> wiki, FAQs, Release Notes, etc.) I think I'm finding myself with
> kinda four options for the security line in /etc/apt/sources.list
> Those being:
> 
> deb http://security.debian.org/debian-security bullseye-security main
> 
> deb http://security.debian.org bullseye-security main
> 
> deb https://deb.debian.org/debian-security bullseye-security main
> 
> deb http://security.debian.org testing/updates main

The first and the third are legitimate lines. I am unsure about the
other two, particulary the last one.

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#239741

[Multipart message — attachments visible in raw view] — view raw

I use de 2n one with no problems.

My sources.list:
deb http://security.debian.org/ stable-security main non-free contrib
deb http://security.debian.org/ oldstable/updates main non-free contrib

Since in http://security.debian.org/dists/stable-security/ there is non-free floder, I keep it in my sources.list

Regards,

Toni Mas
GPG 3F42A21D84D7E950

Sent with ProtonMail Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

El dilluns, 6 de setembre 2021 a les 12:42, Brian <ad44@cityscape.co.uk> va escriure:

> On Mon 06 Sep 2021 at 06:53:25 -0300, riveravaldez wrote:
> 

> > Hi,
> > 

> > after reading the various sources of documentation (handbook,
> > 

> > wiki, FAQs, Release Notes, etc.) I think I'm finding myself with
> > 

> > kinda four options for the security line in /etc/apt/sources.list
> > 

> > Those being:
> > 

> > deb http://security.debian.org/debian-security bullseye-security main
> > 

> > deb http://security.debian.org bullseye-security main
> > 

> > deb https://deb.debian.org/debian-security bullseye-security main
> > 

> > deb http://security.debian.org testing/updates main
> 

> The first and the third are legitimate lines. I am unsure about the
> 

> other two, particulary the last one.
> 

> ------------------------------------------------------------------------------------------------------------
> 

> Brian.

[toc] | [prev] | [next] | [standalone]

#239743

On Mon, Sep 06, 2021 at 11:42:52AM +0100, Brian wrote:
> On Mon 06 Sep 2021 at 06:53:25 -0300, riveravaldez wrote:
> > after reading the various sources of documentation (handbook,
> > wiki, FAQs, Release Notes, etc.) I think I'm finding myself with
> > kinda four options for the security line in /etc/apt/sources.list
> > Those being:
> > 
> > deb http://security.debian.org/debian-security bullseye-security main
> > 
> > deb http://security.debian.org bullseye-security main
> > 
> > deb https://deb.debian.org/debian-security bullseye-security main
> > 
> > deb http://security.debian.org testing/updates main
> 
> The first and the third are legitimate lines. I am unsure about the
> other two, particulary the last one.

The fourth one is definitely wrong, because the repository changed
from foo/updates to foo-security during the bullseye release cycle.

The second one *appears* to work, or at least, I get something that
doesn't look totally wrong when I paste http://security.debian.org
and bullseye-security into a browser's URL bar, and then put /dists/
in between them.

But that doesn't make it a good idea to use the second one, because
who knows whether it will continue working into the future.

Also, there's the wee little fact that testing is no longer a synonym
for bullseye, and therefore even if the fourth one *did* work, it
wouldn't be equivalent to the other three.

So, that really leaves us with two:

  deb http://security.debian.org/debian-security bullseye-security main

  deb https://deb.debian.org/debian-security bullseye-security main

The difference between these two is which mirror network (and really,
which mirroring *paradigm*) is used.  The first one uses a DNS round
robin that points to a rather limited set of servers, easily overloaded
when there's a huge security update (e.g. a kernel).

The other one uses the deb.debian.org infrastructure with its fancy DNS
SRV records and so on.  See <http://deb.debian.org/> for details.

I'm not sure when debian-security got added to the deb.debian.org
infrastructure; it's pretty new, I think.  Thus, a lot of people may
not even know that it's an option.

[toc] | [prev] | [next] | [standalone]

#239744

On Mon 06 Sep 2021 at 08:34:44 -0400, Greg Wooledge wrote:

> On Mon, Sep 06, 2021 at 11:42:52AM +0100, Brian wrote:
> > On Mon 06 Sep 2021 at 06:53:25 -0300, riveravaldez wrote:
> > > after reading the various sources of documentation (handbook,
> > > wiki, FAQs, Release Notes, etc.) I think I'm finding myself with
> > > kinda four options for the security line in /etc/apt/sources.list
> > > Those being:
> > > 
> > > deb http://security.debian.org/debian-security bullseye-security main
> > > 
> > > deb http://security.debian.org bullseye-security main
> > > 
> > > deb https://deb.debian.org/debian-security bullseye-security main
> > > 
> > > deb http://security.debian.org testing/updates main
> > 
> > The first and the third are legitimate lines. I am unsure about the
> > other two, particulary the last one.
> 
> The fourth one is definitely wrong, because the repository changed
> from foo/updates to foo-security during the bullseye release cycle.
> 
> The second one *appears* to work, or at least, I get something that
> doesn't look totally wrong when I paste http://security.debian.org
> and bullseye-security into a browser's URL bar, and then put /dists/
> in between them.
> 
> But that doesn't make it a good idea to use the second one, because
> who knows whether it will continue working into the future.

It is always a good idea to go with the flow in cases like this.
 
> Also, there's the wee little fact that testing is no longer a synonym
> for bullseye, and therefore even if the fourth one *did* work, it
> wouldn't be equivalent to the other three.
> 
> So, that really leaves us with two:
> 
>   deb http://security.debian.org/debian-security bullseye-security main
> 
>   deb https://deb.debian.org/debian-security bullseye-security main
> 
> The difference between these two is which mirror network (and really,
> which mirroring *paradigm*) is used.  The first one uses a DNS round
> robin that points to a rather limited set of servers, easily overloaded
> when there's a huge security update (e.g. a kernel).
> 
> The other one uses the deb.debian.org infrastructure with its fancy DNS
> SRV records and so on.  See <http://deb.debian.org/> for details.
> 
> I'm not sure when debian-security got added to the deb.debian.org
> infrastructure; it's pretty new, I think.  Thus, a lot of people may
> not even know that it's an option.

I have

  deb http://deb.debian.org/debian-security bullseye-security main

but acknowledge that the Release Notes for bullseye has

  deb https://deb.debian.org/debian-security bullseye-security main

IMO, either is suitable, but there is an opinion that the second is to
be preferred because many users expect to be given https transport to
use.

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#239752

On Mon 06 Sep 2021 at 08:34:44 -0400, Greg Wooledge wrote:

[...]

> Also, there's the wee little fact that testing is no longer a synonym
> for bullseye, and therefore even if the fourth one *did* work, it
> wouldn't be equivalent to the other three.

With only

  http://security.debian.org bullseye/updates main

or

  http://deb.debian.org bullseye/updates main

in sources.list your "even if" is substantiated.

  root@bullseye:~# apt update 
  E: Type 'http://deb.debian.org' is not known on line 7 in source list /etc/apt/sources.list
  E: The list of sources could not be read.

The updates service has been switched off for bullseye.

For all those users who "know what they are doing" when upgrading, this
may be seen as a wake-up call.

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#239751

On 2021-09-06 05:53 AM, riveravaldez wrote:
> Hi,
> 
> after reading the various sources of documentation (handbook,
> wiki, FAQs, Release Notes, etc.) I think I'm finding myself with
> kinda four options for the security line in /etc/apt/sources.list
> Those being:
> 
> deb http://security.debian.org/debian-security bullseye-security main
> 
> deb http://security.debian.org bullseye-security main
> 
> deb https://deb.debian.org/debian-security bullseye-security main
> 
> deb http://security.debian.org testing/updates main
> 
> Which would be the right one(s)?
> 
> Thanks a lot!

I can't say for sure whether this is "right" or not but this is what I 
have in my sources.list:

deb http://security.debian.org/debian-security bullseye-security main
deb-src http://security.debian.org/debian-security bullseye-security 
main

I haven't had any problems or errors with this.

[toc] | [prev] | [next] | [standalone]

#239763

On September 6, 2021 5:05:45 PM UTC, Steve Dondley <s@dondley.com> wrote:
> On 2021-09-06 05:53 AM, riveravaldez wrote:
> > Hi,
> > 
> > after reading the various sources of documentation (handbook,
> > wiki, FAQs, Release Notes, etc.) I think I'm finding myself with
> > kinda four options for the security line in /etc/apt/sources.list
> > Those being:
> > 
> > deb http://security.debian.org/debian-security bullseye-security main
> > 
> > deb http://security.debian.org bullseye-security main
> > 
> > deb https://deb.debian.org/debian-security bullseye-security main
> > 
> > deb http://security.debian.org testing/updates main
> > 
> > Which would be the right one(s)?
> > 
> > Thanks a lot!
> 
> I can't say for sure whether this is "right" or not but this is what I 
> have in my sources.list:
> 
> deb http://security.debian.org/debian-security bullseye-security main
> deb-src http://security.debian.org/debian-security bullseye-security 
> main
> 

security.d.o and deb.d.o are both hosted on fastly servers, albeit
different sets of servers. What is interesting to me is that the DNS for
security.d.o is operated by Debian whereas the DNS for deb.d.o is run by
fastly.  I'm not sure that it matters but it is a significant difference
between the two.

-Jim P.

[toc] | [prev] | [next] | [standalone]

#239769

On Mon, Sep 06, 2021 at 07:29:19PM -0400, Jim Popovitch wrote:
> On September 6, 2021 5:05:45 PM UTC, Steve Dondley <s@dondley.com> wrote:
> > On 2021-09-06 05:53 AM, riveravaldez wrote:
> > > Hi,
> > > 
> > > after reading the various sources of documentation (handbook,
> > > wiki, FAQs, Release Notes, etc.) I think I'm finding myself with
> > > kinda four options for the security line in /etc/apt/sources.list
> > > Those being:
> > > 
> > > deb http://security.debian.org/debian-security bullseye-security main
> > > 
> > > deb http://security.debian.org bullseye-security main
> > > 
> > > deb https://deb.debian.org/debian-security bullseye-security main
> > > 
> > > deb http://security.debian.org testing/updates main
> > > 
> > > Which would be the right one(s)?
> > > 
> > > Thanks a lot!
> > 
> > I can't say for sure whether this is "right" or not but this is what I 
> > have in my sources.list:
> > 
> > deb http://security.debian.org/debian-security bullseye-security main
> > deb-src http://security.debian.org/debian-security bullseye-security 
> > main
> > 
> 
> security.d.o and deb.d.o are both hosted on fastly servers, albeit
> different sets of servers. What is interesting to me is that the DNS for
> security.d.o is operated by Debian whereas the DNS for deb.d.o is run by
> fastly.  I'm not sure that it matters but it is a significant difference
> between the two.
> 

Security.d.o is a critical resource - I can see that Debian would want
to be in close control of that - you don't want someone hijacking your
source of security updates for the world.. 

deb.d.o is a scalable service so I can see that Fastly could look after that
as an alias to whatever the pool happens to be at any one given moment.

All best,

Andy C. 
can see how Fastly would want 


> -Jim P.
> 
> 

[toc] | [prev] | [next] | [standalone]

#239793

On 9/6/21, Jim Popovitch wrote:
   [.. snip lots ..]
> security.d.o and deb.d.o are both hosted on fastly servers, albeit
> different sets of servers. What is interesting to me is that the DNS for
> security.d.o is operated by Debian whereas the DNS for deb.d.o is run by
> fastly.  I'm not sure that it matters but it is a significant difference
> between the two.

Are you using a dnssec validating resolver?

It'd be nice of somebody that understands dnssec would double-check,
but it looks like name lookups for security.debian.org has dnssec
enabled and not enabled for deb.debian.org

Lee

[toc] | [prev] | [next] | [standalone]

#239797

On 08.09.21 16:50, Lee wrote:

> Are you using a dnssec validating resolver?
> 
> It'd be nice of somebody that understands dnssec would double-check,
> but it looks like name lookups for security.debian.org has dnssec
> enabled and not enabled for deb.debian.org

deb.debian.org is a CNAME and this CNAME is correctly DNSSEC validated.
But this CNAME points to an A record outside of debian.org which is not
secured by DNSSEC.

Best regards
Ulf

[toc] | [prev] | [next] | [standalone]

#239798

On Wed, Sep 08, 2021 at 08:28:18PM +0200, Ulf Volmer wrote:
> On 08.09.21 16:50, Lee wrote:
> 
> > Are you using a dnssec validating resolver?
> > 
> > It'd be nice of somebody that understands dnssec would double-check,
> > but it looks like name lookups for security.debian.org has dnssec
> > enabled and not enabled for deb.debian.org
> 
> deb.debian.org is a CNAME and this CNAME is correctly DNSSEC validated.
> But this CNAME points to an A record outside of debian.org which is not
> secured by DNSSEC.

Apt uses SRV records, so:

unicorn:~$ dig +short SRV _http._tcp.deb.debian.org
10 1 80 debian.map.fastlydns.net.

It still points outside of *.debian.org, but the CNAME part doesn't
matter.  At least, not for apt in a recent Debian release in the
absence of a proxy.

[toc] | [prev] | [next] | [standalone]

#239799

On 08.09.21 21:12, Greg Wooledge wrote:
> On Wed, Sep 08, 2021 at 08:28:18PM +0200, Ulf Volmer wrote:
>> On 08.09.21 16:50, Lee wrote:
>>
>>> Are you using a dnssec validating resolver?
>>>
>>> It'd be nice of somebody that understands dnssec would double-check,
>>> but it looks like name lookups for security.debian.org has dnssec
>>> enabled and not enabled for deb.debian.org
>>
>> deb.debian.org is a CNAME and this CNAME is correctly DNSSEC validated.
>> But this CNAME points to an A record outside of debian.org which is not
>> secured by DNSSEC.
> 
> Apt uses SRV records, so:
> 
> unicorn:~$ dig +short SRV _http._tcp.deb.debian.org
> 10 1 80 debian.map.fastlydns.net.
> 
> It still points outside of *.debian.org, but the CNAME part doesn't
> matter.  At least, not for apt in a recent Debian release in the
> absence of a proxy.

That may be true, but finally debian.map.fastlydns.net is not DNSSEC
validated.

Best regards
Ulf

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web