Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #170972 > unrolled thread
| Started by | Curt <curty@free.fr> |
|---|---|
| First post | 2016-08-11 18:00 +0200 |
| Last post | 2016-08-12 04:50 +0200 |
| Articles | 3 on this page of 43 — 15 participants |
Back to article view | Back to linux.debian.user
(OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-11 18:00 +0200
Re: (OT kinda) Newly-discovered TCP flaw Reco <recoverym4n@gmail.com> - 2016-08-11 18:30 +0200
Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-11 18:50 +0200
Re: (OT kinda) Newly-discovered TCP flaw Hugo Vanwoerkom <hvw59601@care2.com> - 2016-08-12 23:40 +0200
Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-13 11:10 +0200
Re: (OT kinda) Newly-discovered TCP flaw Reco <recoverym4n@gmail.com> - 2016-08-13 11:20 +0200
Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-13 17:20 +0200
Re: (OT kinda) Newly-discovered TCP flaw Pascal Hambourg <pascal@plouf.fr.eu.org> - 2016-08-13 11:20 +0200
Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-13 17:20 +0200
Re: (OT kinda) Newly-discovered TCP flaw Reco <recoverym4n@gmail.com> - 2016-08-13 11:20 +0200
Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-11 18:40 +0200
Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-11 19:00 +0200
Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-11 19:30 +0200
Re: (OT kinda) Newly-discovered TCP flaw Dan Ritter <dsr@randomstring.org> - 2016-08-11 19:00 +0200
Re: (OT kinda) Newly-discovered TCP flaw Nicolas George <george@nsup.org> - 2016-08-11 19:10 +0200
Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-11 20:00 +0200
Re: (OT kinda) Newly-discovered TCP flaw Doug <dmcgarrett@optonline.net> - 2016-08-11 20:50 +0200
Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-11 21:10 +0200
Re: (OT kinda) Newly-discovered TCP flaw Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-11 21:40 +0200
Re: (OT kinda) Newly-discovered TCP flaw Joe <joe@jretrading.com> - 2016-08-11 22:10 +0200
Re: (OT kinda) Newly-discovered TCP flaw deloptes <deloptes@gmail.com> - 2016-08-11 22:40 +0200
Re: (OT kinda) Newly-discovered TCP flaw Joe <joe@jretrading.com> - 2016-08-11 22:50 +0200
Re: (OT kinda) Newly-discovered TCP flaw deloptes <deloptes@gmail.com> - 2016-08-12 00:00 +0200
Re: (OT kinda) Newly-discovered TCP flaw Bob Weber <bobrweber@gmail.com> - 2016-08-12 00:00 +0200
Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-12 11:00 +0200
Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-12 12:00 +0200
Re: (OT kinda) Newly-discovered TCP flaw deloptes <deloptes@gmail.com> - 2016-08-12 12:50 +0200
Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-12 13:30 +0200
Re: (OT kinda) Newly-discovered TCP flaw deloptes <deloptes@gmail.com> - 2016-08-12 22:30 +0200
Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-12 14:30 +0200
Re: (OT kinda) Newly-discovered TCP flaw rhkramer@gmail.com - 2016-08-12 16:50 +0200
Re: (OT kinda) Newly-discovered TCP flaw Greg Wooledge <wooledg@eeg.ccf.org> - 2016-08-12 17:00 +0200
Re: (OT kinda) Newly-discovered TCP flaw Pascal Hambourg <pascal@plouf.fr.eu.org> - 2016-08-12 17:20 +0200
Re: (OT kinda) Newly-discovered TCP flaw Greg Wooledge <wooledg@eeg.ccf.org> - 2016-08-12 17:40 +0200
Re: (OT kinda) Newly-discovered TCP flaw rhkramer@gmail.com - 2016-08-12 17:40 +0200
Re: (OT kinda) Newly-discovered TCP flaw "John L. Ries" <jries@salford-systems.com> - 2016-08-12 18:40 +0200
Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-12 18:10 +0200
Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-12 18:00 +0200
The Debian/Ubuntu/Mint installer was Re: (OT kinda) Newly-discovered TCP flaw Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-13 01:10 +0200
Re: The Debian/Ubuntu/Mint installer was Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-13 05:20 +0200
Re: The Debian/Ubuntu/Mint installer was Re: (OT kinda) Newly-discovered TCP flaw Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-13 10:50 +0200
Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-12 05:00 +0200
Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-12 04:50 +0200
Page 3 of 3 — ← Prev page 1 2 [3]
| From | Lisi Reisz <lisi.reisz@gmail.com> |
|---|---|
| Date | 2016-08-13 10:50 +0200 |
| Subject | Re: The Debian/Ubuntu/Mint installer was Re: (OT kinda) Newly-discovered TCP flaw |
| Message-ID | <s5CNH-6WW-9@gated-at.bofh.it> |
| In reply to | #171053 |
On Saturday 13 August 2016 04:11:19 Gene Heskett wrote: > On Friday 12 August 2016 19:02:15 Lisi Reisz wrote: > > On Friday 12 August 2016 16:57:09 Gene Heskett wrote: > > > If that works, I will STFU about their broken installer, if not, > > > that campaign to get it fixed to work with a pre-partitioned disk > > > will continue. > > > > It does in general work with a pre-partitioned disk. Anyhow it works > > for me, and many others. We have still not established why it doesn't > > work for you; but you have to admit Gene that since the problem > > appears personal to you, it just MAY be to do with you and not the > > installer???? I agree it may not, but we haven't established exactly > > what you do that is different from the rest of us, so no-one can tell. > > > > Most of the rest of us are sometimes guilty of PEBKAC or, whisper it > > low, and heaven forfend, a senior moment or two (or three). ;-) > > > > Lisi > > Shush now Lisi, you're giving away all my secrets. ;-) The next time I > try, I will have the Official guide to properly setting up a static > network according to the *buntu guru's under my left hand. Succeeding > in that, then we follow another similar doc I've printed out to try to > make a pre-formatted GPT disk usable without giving up and letting the > installer partition it AND format it to suit itself. I have done exactly that, without any difficulty at all: partitioned using Gparted then installed on those partitions. I rather think that the problem is that you try to skip the partitioner. You can't do that. You have to assign the partitions to where you want them via the partitioner, but you can tell the partitioner not to do anything or format anything, at least in Debian. And I imagine that Ubuntu is the same, anyhow in the alternate installer. But you have to tell the installer which partition to use for what, e.g. sda1 for /home and sda2 for / , and you do that with the partitioner. Lisi > Which usually > winds up with something too small... > > I am not always the P in PEBKAC... > > Cheers, Gene Heskett
[toc] | [prev] | [next] | [standalone]
| From | Gene Heskett <gheskett@shentel.net> |
|---|---|
| Date | 2016-08-12 05:00 +0200 |
| Message-ID | <s5aRr-4fz-1@gated-at.bofh.it> |
| In reply to | #170994 |
On Thursday 11 August 2016 16:35:06 deloptes wrote: > Joe wrote: > > On Thu, 11 Aug 2016 20:31:37 +0100 > > > > Lisi Reisz <lisi.reisz@gmail.com> wrote: > >> I copied and pasted the commands exactly, and ran them as root, and > >> got an echo of net.ipv4.tcp_challenge_ack_limit = 999999999 in > >> response to the first and a blank return in response to the second. > >> I don't know the significance. > > > > Go and read /proc/net/ipv4... and it should show the changed value. > > > > I believe the echo means it worked. I also believe it needs to be > > added to /etc/sysctl.conf (without the 'sysctl -p') to be redone on > > boot. It seems to affect every current Debian up to sid. > > I don't see it in the /proc tree (kernel 4.6.4 on jessie) > > # ls -1 /proc/net/ip* > /proc/net/ip6_flowlabel > /proc/net/ip_tables_matches > /proc/net/ip_tables_names > /proc/net/ip_tables_targets > /proc/net/ipv6_route > > and on the firewall (2.6.26.2 wheezy) > > sysctl -w net.ipv4.tcp_challenge_ack_limit=999999999 > sysctl: cannot stat /proc/sys/net/ipv4/tcp_challenge_ack_limit: No > such file or directory > > I don't understand if it is bad. > > on the file server (kernel 3.2.0 jessie) > > cat /proc/sys/net/ipv4/tcp_challenge_ack_limit > 999999999 > > interesting ... > > Do you have recommendations? It looks like you have it right. > regards Cheers, Gene Heskett -- "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) Genes Web page <http://geneslinuxbox.net:6309/gene>
[toc] | [prev] | [next] | [standalone]
| From | Gene Heskett <gheskett@shentel.net> |
|---|---|
| Date | 2016-08-12 04:50 +0200 |
| Message-ID | <s5aHM-4bR-23@gated-at.bofh.it> |
| In reply to | #170988 |
On Thursday 11 August 2016 15:31:37 Lisi Reisz wrote: > On Thursday 11 August 2016 20:06:26 Gene Heskett wrote: > > On Thursday 11 August 2016 15:44:24 Doug wrote: > > > On 08/11/2016 12:50 PM, Gene Heskett wrote: > > > > On Thursday 11 August 2016 12:47:09 Nicolas George wrote: > > > > CC:ing emc-developers, and trinity-users who may not yet be > > > > aware of this tcp attack vector thats quite dangerous. And my > > > > post to trinity-users was in error, so this corrects it. > > > > > > > >> Le quintidi 25 thermidor, an CCXXIV, Gene Heskett a écrit : > > > >>> to add should be changed to forward slashes: > > > >> > > > >> You are wrong, sysctl supports both slashes and dots as > > > >> separators. > > > >> > > > >> Regards, > > > > > > > > I changed it back Nicolas, and sysctl -p now returns: > > > > root@coyote:/etc/init.d# sysctl -p > > > > sysctl: cannot stat /proc/sys//net.ipv4.tcp_challenge_ack_limit: > > > > No such file or directory > > > > > > > > Put the slashes back and I get this: > > > > root@coyote:/etc/init.d# sysctl -p > > > > .net.ipv4.tcp_challenge_ack_limit = 999999999 > > > > > > > > Which I assume is the correct response. And yet the echo shows > > > > all dots. > > > > > > > > WTH? Ahh, my bad, no damned biscuit, an extra leading slash > > > > snuck in. But if a dot and a slash are the same to sysctl, I > > > > should have a file in the wrong place? But I do not. /net is > > > > empty. It is in the right place now. And cats the correct value. > > > > > > > > Sorry about the confusion everybody. > > > > > > > > Cheers, Gene Heskett > > > > > > Running PCLOS. I put in the original command with dots. When I run > > > sysctl.p from a root environment I get no response, but no error > > > either. Don't know the significance of that. > > > > > > --doug > > > > Neither do I Doug, sorry. See the announcement on /. today & read > > the link to the post from the guys that found it that is in the > > story, UCsomething IIRC, see below. A closer read may answer it. > > > > <https://ucrtoday.ucr.edu/39030> > > > > And please keep things like this on the list you read it from. A PM > > is unfair to the other readers of the list you read it on, so I'll > > cc the three lists it was cross posted to as it sounds pretty > > serious to me. > > > > And I just noted that the sysctl command you quoted above is > > incorrect, its sysctl -p, not sysctl.p. > > > > Maybe that helps? > > I copied and pasted the commands exactly, and ran them as root, and > got an echo of net.ipv4.tcp_challenge_ack_limit = 999999999 in > response to the first and a blank return in response to the second. I > don't know the significance. > > Lisi cat that file Lisi. Thats in /proc/sys/net.ipv4.tcp_challenge_ack_limit. I think we did as we were told if it contains those 9 9's. Cheers, Gene Heskett -- "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) Genes Web page <http://geneslinuxbox.net:6309/gene>
[toc] | [prev] | [standalone]
Page 3 of 3 — ← Prev page 1 2 [3]
Back to top | Article view | linux.debian.user
csiph-web