Re: dnssec-trigger + GNOME + NetworkManager integration

2015-07-01 Thread Paul Wouters
On Tue, 30 Jun 2015, Bastien Nocera wrote: Once DNSSEC is more widely deployed What is more widely deployed ? http://www.internetsociety.org/deploy360/wp-content/uploads/2013/04/2015-06-19-2015-06-19.png There are 991 zones in the root and 814 are signed and securely delegated.

Re: dnssec-trigger + GNOME + NetworkManager integration

2015-07-01 Thread Paul Wouters
On Tue, 30 Jun 2015, Michael Catanzaro wrote: I'm confused on one point: why would the user ever want to turn off DNSSEC validation (except to get past a for captive portal)? It sounds like you have no shortage of safeguards in place to make sure this always works: for it to break the user

Re: dnssec-trigger + GNOME + NetworkManager integration

2015-07-01 Thread Paul Wouters
On Wed, 1 Jul 2015, Michael Catanzaro wrote: Date: Wed, 1 Jul 2015 19:26:55 From: Michael Catanzaro mcatanz...@gnome.org To: devel@lists.fedoraproject.org Subject: Re: dnssec-trigger + GNOME + NetworkManager integration On Wed, 2015-07-01 at 18:40 -0400, Paul Wouters wrote: That's the same

Re: DNSSEC/unbound - boingboing.net failures

2015-06-30 Thread Paul Wouters
dnssec-trigger. It will be better for getting additional information. Also please see the reply by Paul Wouters to your previous email. Oh hey. I forgot that I posted this already, and didn't see the reply. Ugh, time for a vacation! -- Matthew Miller mat...@fedoraproject.org Fedora Project

Re: how do I diagnose dnssec/unbound issues?

2015-06-27 Thread Paul Wouters
Try using unbound-host which uses the same configuration file? Otherwise grep the logs for unbound or possibly increase verbosity to 2 or 3 in the conf file. If it happens again and you are comfortable with it, you can run unbound-control dump to get the full DNS cache which could tell what's

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-18 Thread Paul Wouters
On Thu, 18 Jun 2015, Dan Williams wrote: True. In fact with unbound it is pretty trivial to do. The equivalent unbound python code for that would be: import unbound ctx = unbound.ub_ctx() ctx.resolvconf(/this/networks/respresentation/of/resolv.conf) Hmm, that doesn't really allow for split

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-18 Thread Paul Wouters
On Thu, 18 Jun 2015, Dan Williams wrote: The drawbacks I see to dnssec-trigger here are: 2) provides only HTTPS IPC, perhaps because it works on all platforms. But a Linux-only solution would typically use a unix socket or D-Bus and be secured by Unix or D-Bus permissions instead of using

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-17 Thread Paul Wouters
On Wed, 17 Jun 2015, Tomas Hozza wrote: While I don't actually care, this might well be a sticking point for many people since their DNS information is going to an untrusted (to them) DNS server. Yeah, I tend to trust Fedora, but not everyone will. If you don't trust fedora infrastructure,

Re: GNOME captive portal helper (was Re: F23 System Wide Change: Default Local DNS Resolver)

2015-06-16 Thread Paul Wouters
On Tue, 16 Jun 2015, Bastien Nocera wrote: That’s what dnssec-trigger ideally _should_ do. What would it _actually_ do, e.g. with the current code? That's defined by login-command: in /etc/dnssec-trigger/dnssec-trigger.conf which we did not change from the default xdg-open. It uses the URL

Re: GNOME captive portal helper (was Re: F23 System Wide Change: Default Local DNS Resolver)

2015-06-15 Thread Paul Wouters
On Mon, 15 Jun 2015, Miloslav Trmač wrote: Detect it and show the sandboxed browser. If that means that the user has to type their Facebook password again, then the user is welcome to do that. I don't see why we should make it easier to track users, though. That’s what dnssec-trigger

Re: GNOME captive portal helper (was Re: F23 System Wide Change: Default Local DNS Resolver)

2015-06-15 Thread Paul Wouters
On Mon, 15 Jun 2015, Stephen John Smoogen wrote: Is the code on how ChromeOS or Android detects captivity part of the 'public' code? It seems to do a 'good' job in finding many captive portals so might be something to get an idea on how many weird ways things are out there. I think everyone

Re: GNOME captive portal helper (was Re: F23 System Wide Change: Default Local DNS Resolver)

2015-06-14 Thread Paul Wouters
On Sat, 13 Jun 2015, Michael Catanzaro wrote: There is one thing I don't understand. Surely the above is exactly what will happen if you were to get stuck behind a captive portal with Firefox or any normal browser? But portals still work reliably for users. You should visit more hotels. The

Re: GNOME captive portal helper (was Re: F23 System Wide Change: Default Local DNS Resolver)

2015-06-13 Thread Paul Wouters
On Sat, 13 Jun 2015, Michael Catanzaro wrote: Hm... the captive portal helper loads www.gnome.org but it only runs after NetworkManager has decided there is a captive portal. We can make this URL configurable at build time if there's really a problem, but I'm not sure there is, since it's not

Re: GNOME captive portal helper (was Re: F23 System Wide Change: Default Local DNS Resolver)

2015-06-13 Thread Paul Wouters
On Sat, 13 Jun 2015, Andrew Lutomirski wrote: It'd be nice to not show http://www.gnome.org (the test URL we load, expecting to be hijacked) if the portal decides not to redirect you to a new URI (not sure how common that is), but I think we will have to or we can't fix this It could

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-12 Thread Paul Wouters
On Fri, 12 Jun 2015, Matthew Miller wrote: Another integration concern: the network config GUI (and ifcfg files, for that matter) let me list specific DNS servers. With this feature, are those used (and if so, how)? If not, is my configuration just silently ignored? I do not know if it is

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-12 Thread Paul Wouters
On 06/12/2015 11:10 AM, Petr Spacek wrote: HERE we need to coordinate with other parties who might want to write into the /etc/resolv.conf file. These include (but might not be limited to): NetworkManager initscripts dhclient libreswan ? resolved connman Option

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-12 Thread Paul Wouters
On 06/12/2015 12:53 PM, Dan Williams wrote: b) Broken networks: Some networks are so broken that even without captive portal they are not able to deliver DNSSEC data to the clients. In that case will try tunnel to other DNS servers on the Internet (Fedora Infra or public DNS root) and use

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-12 Thread Paul Wouters
On Fri, 12 Jun 2015, Matthias Clasen wrote: I've just installed dnssec-trigger on rawhide to try this out, and found that it breaks networking on my Workstation. I used to get a network connection on login, now I get a question mark in top bar, and a status icon with obsure menu options

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-12 Thread Paul Wouters
On Fri, 12 Jun 2015, Matthew Miller wrote: I personally find the anchor icon very confusing. As a non-expert in this area, it doesn't represent anything which seems relevant to me, and all of the right click menu options, once I figured out to right click, are obscure to me. Agreed. I don't

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-12 Thread Paul Wouters
On Fri, 12 Jun 2015, Andrew Lutomirski wrote: All that makes sense. Thanks. FWIW, I think that a little C program to spin up a namespace that's good enough to point a stateless Firefox instance at a captive portal login with overridden DNS nameserver settings would only be a couple of hundred

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-12 Thread Paul Wouters
On Fri, 12 Jun 2015, Dan Williams wrote: That is why HTTP redirection and DNS failure have to be detected by whatever is the hot spot detector. Both items weigh in on triggering a hotspot logon window. Agreed. But how does the DNS failure actually get relayed to the thing doing the HTTP

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-11 Thread Paul Wouters
On Thu, 11 Jun 2015, Dan Williams wrote: Unfortunately the Proposal doesn't say anything about how this will actually work, which is something NetworkManager needs to know. It also fails to address the failure cases where your local DNS doesn't support DNSSEC or is otherwise broken here out of

f22 screensaver/lockout issue requiring reboot :/

2015-06-10 Thread Paul Wouters
Hi, Am I the only one who is constantly locked out of their X session on fedora 22? Once the screen locks, it refuses my actual password to unlock. Even killing X with ctrl-alt-backspace doesn't help because it will just startup again in locked screen mode. I basically have to reboot every time

Re: f22 screensaver/lockout issue requiring reboot :/

2015-06-10 Thread Paul Wouters
I wrote: On 06/10/2015 09:04 AM, Paul Wouters wrote: Am I the only one who is constantly locked out of their X session on fedora 22? Once the screen locks, it refuses my actual password to unlock. Even killing X with ctrl-alt-backspace doesn't help because it will just

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-09 Thread Paul Wouters
On Tue, 9 Jun 2015, Matthew Miller wrote: One (new!) thing I'm concerned with, now that I've enabled it on my system, is the persistant tray notification. This is... confusing and ugly. Can we (for F23 if possible, and F24 if not) get better GNOME Shell integration here? That's been on the

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-03 Thread Paul Wouters
On Wed, 3 Jun 2015, Petr Spacek wrote: It is somewhat questionable whether DNS rebinding vulnerabilities are, in fact, a problem which should be solved at the client side. But Oh yes. DNS pinning in browser is just a band-aid and not proper solution. I would argue that DNS rebinding attack

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-03 Thread Paul Wouters
On Wed, 3 Jun 2015, Petr Spacek wrote: ???On 3.6.2015 13:45, Reindl Harald wrote: If you feel that the standard is broken then *please* continue with discussion on IETF's dnsop mailing list: https://www.ietf.org/mailman/listinfo/dnsop come on stop trolling that way because you know exactly

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-02 Thread Paul Wouters
On Tue, 2 Jun 2015, Simo Sorce wrote: and just because you have a local resolver firefox won't stop it's behavior It can, w/o a local resolver FF developers will definitely keep caching on their own, with a decent local resolver they can allow themselves to disable their own and go back to

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-02 Thread Paul Wouters
On Tue, 2 Jun 2015, David Howells wrote: I'm using dnsmasq to look up *.redhat.com addresses over VPN whilst looking up other addresses from my ISP. That is automatically handled for you if you use libreswan for your VPN and unbound is running. It will add a forward for the domain

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-02 Thread Paul Wouters
On Tue, 2 Jun 2015, David Howells wrote: Install a local DNS resolver trusted for the DNSSEC validation running on 127.0.0.1:53. This must be the only name server entry in /etc/resolv.conf. The automatic name server entries received via dhcp/vpn/wireless configurations should be stored

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-01 Thread Paul Wouters
On Mon, 1 Jun 2015, Tomas Hozza wrote: Yes, we think the change makes sense for Server. It is still beneficial from the security point of view to do the DNSSEC validation on Server. Agreed. Even though the configuration on Server will be static, dnssec-trigger + unbound can be used for

Re: F23 System Wide Change: Default Local DNS Resolver

2015-06-01 Thread Paul Wouters
On Mon, 1 Jun 2015, drago01 wrote: production. Yes, that's a glibc bug, and glibc should fix it. Nonetheless, bugs like that wouldn't matter as much if there were a local resolver. That's not how bugs should be dealt with ... if there is a bug it should be fixed where it is not duct taped

Re: Deprecation of ISC's DLV registry

2015-05-20 Thread Paul Wouters
On Wed, 20 May 2015, Tomas Hozza wrote: I received a heads-up from ISC that they are planning to deprecate their DLV registry (https://dlv.isc.org/) in the future. The use of ISC's DLV repository should be removed from any default configuration to prevent any issues in the future. I'm aware

Re: Testing request: gdm-on-Wayland on hybrid graphics laptops (esp. Macbooks)

2015-05-14 Thread Paul Wouters
I had gdm issues on my f19 to f22beta upgrade too. Startx worked. Worse, the lock screen cannot unlock. Claims wrong passwd. Killing Xorg just led to restarted locked screen. Only way out was init 1 Sent from my iPhone On May 14, 2015, at 16:01, Adam Williamson adamw...@fedoraproject.org

Re: /usr/share vs /usr/libexec

2015-04-22 Thread Paul Wouters
On Wed, 22 Apr 2015, Miloslav Trmač wrote: now I'm curious. Does it make more sense for these sort of scripts to live in /usr/libexec, or in /usr/share? /usr/libexec. From (info standards): `libexecdir' The directory for installing executable programs to be run by other programs

Your Outstanding Requests on closed bugs

2015-03-30 Thread Paul Wouters
Hi, So I get a regular reminder for Your Outstanding Requests However, a bunch of these are on closed bugs. It seems stuck somehow in thinking it needs something from me. For example: Bug 815617: PATCH: properly deal with crypt() returning NULL (1043 days old)

Re: Your Outstanding Requests on closed bugs

2015-03-30 Thread Paul Wouters
On Mon, 30 Mar 2015, Michael Cronenworth wrote: On 03/30/2015 08:39 AM, Paul Wouters wrote: There are currently no flags set at all. Check the flags on the attachment itself (your second link). Ohh. there is shows up. How odd. Thanks. Now at least I know how to get rid of it, although I

Re: Your Outstanding Requests on closed bugs

2015-03-30 Thread Paul Wouters
On Mon, 30 Mar 2015, Petr Šabata wrote: Bug 815617: PATCH: properly deal with crypt() returning NULL (1043 days old) https://bugzilla.redhat.com/show_bug.cgi?id=815617 https://bugzilla.redhat.com/attachment.cgi?id=585827action=edit This bug is already closed. And has no flags set. In

Re: Captive portal detection on wired connections - bug or feature?

2015-03-25 Thread Paul Wouters
On Wed, 25 Mar 2015, Adam Williamson wrote: Lots of people have been seeing it, it may be related to some issues with the Fedora infrastructure this afternoon (the check works by trying to contact a Fedora server). I've seen them regularly in the last few hours but I'm on hotel wifi, so it

Re: Why sysrq is limited to only sync command on official fedora kernel?

2015-02-25 Thread Paul Wouters
On Wed, 25 Feb 2015, Lennart Poettering wrote: Hmm? Syncing is allowed to my knowledge. C-a-d and gdm allow a clean reboot/poweroff. But sysrq does an abnormal reboot/poweroff, which we cannot allow. Similar, remounting read-only is also security senstive, which we cannot allow. Without being

Re: NowpPublishing fedora developer PGP keys in DNSSEC

2015-02-01 Thread Paul Wouters
On Sun, 1 Feb 2015, Björn Persson wrote: Paul Wouters wrote: paul@bofh:~$ openpgpkey --fetch pwout...@fedoraproject.org openpgpkey: /var/lib/unbound/root.anchor is not a file. Unable to use it as rootanchor Huh? turns out a bug in %post of unbound-libs. I pushed a fix into rawhide. I've

Re: NowpPublishing fedora developer PGP keys in DNSSEC

2015-01-29 Thread Paul Wouters
On Thu, 29 Jan 2015, Vít Ondruch wrote: Dne 28.1.2015 v 21:34 Paul Wouters napsal(a): openpgpkey --fetch pwout...@fedoraproject.org $ openpgpkey --fetch pwout...@fedoraproject.org Error: query data is not secured by DNSSEC - use --insecure to override It's time for you to start using

Re: NowpPublishing fedora developer PGP keys in DNSSEC

2015-01-29 Thread Paul Wouters
On Thu, 29 Jan 2015, Petr Spacek wrote: Fedora is probably the First to use OPENPGPKEY at a large scale. https://tools.ietf.org/html/draft-ietf-dane-openpgpkey-01 Paul, thank you for doing this experiment! I definitely support it. For people who do not watch dane-list closely, please keep

NowpPublishing fedora developer PGP keys in DNSSEC

2015-01-28 Thread Paul Wouters
Hi, Fedora is probably the First to use OPENPGPKEY at a large scale. https://tools.ietf.org/html/draft-ietf-dane-openpgpkey-01 Everyone[*] who added a GPG keyid in FAS has their key published now using the OPENPGPKEY specification. You can obtain a key using the openpgpkey command of the

Re: Now Publishing fedora developer PGP keys in DNSSEC

2015-01-28 Thread Paul Wouters
On Wed, 28 Jan 2015, Till Maas wrote: The keyid is part of the fingerprint, so with the fingerprint one can download the key and verify it. Therefore it is the only right thing to do. I'm not saying don't store the fingerprint, but use a separate field for that which is not the keyid field.

Re: F22 System Wide Change: Default Local DNS Resolver

2015-01-25 Thread Paul Wouters
On Tue, 13 Jan 2015, Neal Becker wrote: Just tried it on f21. Did: sudo systemctl enable dnssec-triggerd.service sudo systemctl start dnssec-triggerd.service host slashdot.org: [ works fine ] Now a local machine: host nbecker7 btw use dig, not host. host has been deprecated for many

[perl-Net-DNS/f20] * Tue Jan 20 2015 Paul Wouters pwout...@redhat.com - 0.82-1 - Updated to 0.82 Support for IPv6 lin

2015-01-25 Thread Paul Wouters
Summary of changes: 99b228c... * Tue Jan 20 2015 Paul Wouters pwout...@redhat.com - 0.82 (*) (*) This commit already existed in another branch; no separate mail sent -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel mailing list perl-devel

[perl-Net-DNS/f21] * Tue Jan 20 2015 Paul Wouters pwout...@redhat.com - 0.82-1 - Updated to 0.82 Support for IPv6 lin

2015-01-25 Thread Paul Wouters
Summary of changes: 99b228c... * Tue Jan 20 2015 Paul Wouters pwout...@redhat.com - 0.82 (*) (*) This commit already existed in another branch; no separate mail sent -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel mailing list perl-devel

orphaned bfgminer

2015-01-25 Thread Paul Wouters
Hi, I just orphaned bfgminer. It's a few years out of date now and it's just too low priority for my to pick it up. Paul -- devel mailing list devel@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/devel Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Plan of Record for Fedora 22 Network Install Media

2015-01-23 Thread Paul Wouters
On Fri, 23 Jan 2015, Stephen Gallagher wrote: In Fedora 22, we will be producing four network install ISOs: * Fedora Server - Server branding - Default environment group: Fedora Server - Auto-partitioning defaults: LVM on XFS (except /boot) - Responsible WG: Server WG I got bitten by the

Re: F22 System Wide Change: GNOME 3.16

2015-01-21 Thread Paul Wouters
On Wed, 21 Jan 2015, Igor Gnatenko wrote: On Wed, Jan 21, 2015 at 2:41 PM, Jaroslav Reznik jrez...@redhat.com wrote: = Proposed System Wide Change: GNOME 3.16 = https://fedoraproject.org/wiki/Changes/GNOME3.16 Update GNOME to the latest upstream release, 3.16. ** Follow upstream module

File Net-DNS-0.82.tar.gz uploaded to lookaside cache by pwouters

2015-01-20 Thread Paul Wouters
A file has been added to the lookaside cache for perl-Net-DNS: 95660d1f81ddd087639a6ea132b8 Net-DNS-0.82.tar.gz -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel mailing list perl-devel@lists.fedoraproject.org

[perl-Net-DNS] (2 commits) ...* Tue Jan 20 2015 Paul Wouters pwout...@redhat.com - 0.82-1 - Updated to 0.82 Support for IPv6 lin

2015-01-20 Thread Paul Wouters
Summary of changes: e21ccf2... - add changelog entry (*) 99b228c... * Tue Jan 20 2015 Paul Wouters pwout...@redhat.com - 0.82 (*) This commit already existed in another branch; no separate mail sent -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel

[perl-Net-DNS: 2/2] * Tue Jan 20 2015 Paul Wouters pwout...@redhat.com - 0.82-1 - Updated to 0.82 Support for IPv6 lin

2015-01-20 Thread Paul Wouters
commit 99b228c59a1eb756bf6a23e0d666ab5f13d7916c Author: Paul Wouters pwout...@redhat.com Date: Tue Jan 20 10:02:20 2015 -0500 * Tue Jan 20 2015 Paul Wouters pwout...@redhat.com - 0.82-1 - Updated to 0.82 Support for IPv6 link-local addresses with scope_id .gitignore|1

Re: F22 System Wide Change: Default Local DNS Resolver

2015-01-19 Thread Paul Wouters
On 01/19/2015 06:16 PM, Pete Zaitcev wrote: Can you tell why you're trying that. Everyone I talk to always go unbound, unbound, unbound... WHY? Unbound is plain broken and does not work, especially with DNSSEC. Can you explain exactly what does not work? Some of the largest ISPs in the US are

Re: against dnssec

2015-01-18 Thread Paul Wouters
On Sun, 18 Jan 2015, Neal Becker wrote: The articles author has responded here: http://sockpuppet.org/stuff/dnssec-qa.html This quote caught my attention: DNSSEC deployment guides go so far as to recommend against deployment of DNSSEC validation on end-systems. So significant is the

Re: against dnssec

2015-01-17 Thread Paul Wouters
On Sat, 17 Jan 2015, Björn Persson wrote: Both CAs and DNSSEC can be attacked by governments in different ways. The author thinks that DNSSEC is more vulnerable. I happen to disagree, but more importantly, those who feel that they need to can secure their keys both through DANE and with a

Re: against dnssec

2015-01-17 Thread Paul Wouters
On Sun, 18 Jan 2015, Kevin Kofler wrote: This is becoming rather of-topic for DNS. I think they key thing to remember is that DNSSEC reduces the number of parties that can send malicious or forged DNS messages from infinite to a few and where these few are also part of the current infinite.

Re: against dnssec

2015-01-15 Thread Paul Wouters
That article is terrible. I will respond to it later. It is definitely not a valid reason to revisit the fedora feature. Paul Sent from my iPhone On Jan 15, 2015, at 19:45, Neal Becker ndbeck...@gmail.com wrote: I personally know nothing of the subject, but found this article, I wonder if

Re: F22 System Wide Change: Default Local DNS Resolver

2015-01-13 Thread Paul Wouters
On Tue, 13 Jan 2015, Neal Becker wrote: How will this impact the following (common) situation? I carry my linux laptop between home and work. When at work, I need to use my employer's dns to lookup names of (non-public) local machines. When connecting to work, dnssec-trigger will probe the

Re: F22 System Wide Change: Set sshd(8) PermitRootLogin=no

2015-01-12 Thread Paul Wouters
On Mon, 12 Jan 2015, Przemek Klosowski wrote: There still needs to be an administrative access to the system, and the most common implementation by enabling 'sudo' on the non-privileged account. So, in a sense you are both right: this feature is just a small step rather than a security

Re: F22 System Wide Change: Set sshd(8) PermitRootLogin=no

2015-01-12 Thread Paul Wouters
On Mon, 12 Jan 2015, Przemek Klosowski wrote: First of all, I agree with you that PermitRootLogin without-password  is preferable. Good :) The discussion I am interested in is whether direct password root login should remain enabled. With root logins, all you have on the client machine

Re: F22 System Wide Change: Set sshd(8) PermitRootLogin=no

2015-01-12 Thread Paul Wouters
On Mon, 12 Jan 2015, P J P wrote: Agreed Paul, yet it does not mean cracking them would be as easy as slicing knife through butter. That too for every awkward joe trying their hands at it. It sounds like all one has to do is just guess the username, and it's game over. Exactly! Then we are

Re: F22 System Wide Change: Set sshd(8) PermitRootLogin=no

2015-01-09 Thread Paul Wouters
On Fri, 9 Jan 2015, DJ Delorie wrote: So if we truly want to address this feature, we should also disallow non-root user password based ssh logins. Do I get this right? You want to disallow any remote logins (which nowadays means using ssh)? No, he means that ssh connections should require

Re: F22 System Wide Change: Set sshd(8) PermitRootLogin=no

2015-01-08 Thread Paul Wouters
On Thu, 8 Jan 2015, Jaroslav Reznik wrote: = Proposed System Wide Change: Set sshd(8) PermitRootLogin=no = https://fedoraproject.org/wiki/Changes/SSHD_PermitRootLogin_no Change owner(s): P J P p...@fedoraproject.org and Fedora Security Team To disable remote root login facility in sshd(8) by

Re: F22 System Wide Change: Harden all packages with position-independent code

2015-01-08 Thread Paul Wouters
On Thu, 8 Jan 2015, Dhiru Kholia wrote: | Your package accepts/processes untrusted input. This seems to be about every package that I use, because I most if not all tools process untrusted data from the Internet. +1. This view is rapidly gaining traction and visibility in recent times.

Re: F22 System Wide Change: Harden all packages with position-independent code

2015-01-08 Thread Paul Wouters
On Thu, 8 Jan 2015, Stephen Gallagher wrote: Can we throw prelink out as well when we do this? Prelink is already gone. We haven't been running it since F19, IIRC. Oh. Spending too much time on RHEL, and not enough time to upgrade my desktop to a non-EOL fedora :) Thanks, Paul -- devel

Re: F22 System Wide Change: Set sshd(8) PermitRootLogin=no

2015-01-08 Thread Paul Wouters
On Thu, 8 Jan 2015, Przemek Klosowski wrote: If you want to fight that, you need to set PasswordAuthentication no and insist that people start using ssh keypairs instead. Singling out root is not affective against system compromises caused by brutce forcing passwords.

Re: System-wide crypto policy transition tracker

2015-01-07 Thread Paul Wouters
On Wed, 7 Jan 2015, Petr Spacek wrote: The tracker also contains a dependency on NSS respecting the system crypto policy: https://bugzilla.redhat.com/show_bug.cgi?id=1157720 I wonder what is your plan moving forward. Is it going to be 'TLS policy'? Or are you planning to generalize it in

Re: Join to Mozilla Location Service in Fedora

2014-11-06 Thread Paul Wouters
On Thu, 6 Nov 2014, Martin Stransky wrote: as you may know [0] Firefox in Fedora [1] is using Mozilla Location service [2] as a location provider instead of the Google one. I'd like to ask you to join the project, install the Mozilla Stumbler application [3] and help to improve the location

File Net-DNS-SEC-0.21.tar.gz uploaded to lookaside cache by pwouters

2014-10-31 Thread Paul Wouters
A file has been added to the lookaside cache for perl-Net-DNS-SEC: 4cd803cf77f853b3079fdf539aa92749 Net-DNS-SEC-0.21.tar.gz -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel mailing list perl-devel@lists.fedoraproject.org

[perl-Net-DNS-SEC] - Updated to 0.21, restores canonicalization of a RRSIG’s Signer Name

2014-10-31 Thread Paul Wouters
commit 8f8d1c603165a34c5086b1d250f80dc99193a09d Author: Paul Wouters pwout...@redhat.com Date: Fri Oct 31 11:00:36 2014 -0400 - Updated to 0.21, restores canonicalization of a RRSIG’s Signer Name .gitignore|1 + perl-Net-DNS-SEC.spec |7 +-- sources

[perl-Net-DNS-SEC/f21] (3 commits) ...- Updated to 0.21, restores canonicalization of a RRSIG’s Signer Name

2014-10-31 Thread Paul Wouters
Summary of changes: a76e169... * Sat Aug 16 2014 Paul Wouters pwout...@redhat.com - 0.20 (*) bc6ab3b... Perl 5.20 rebuild (*) 8f8d1c6... - Updated to 0.21, restores canonicalization of a RRSIG’s (*) (*) This commit already existed in another branch; no separate mail sent -- Fedora Extras

[perl-Net-DNS-SEC/f20: 3/3] Merge branch 'master' into f20

2014-10-31 Thread Paul Wouters
commit ffebbcb585f9c27052f6abbd5dc23365449694e3 Merge: 75f20d1 8f8d1c6 Author: Paul Wouters pwout...@redhat.com Date: Fri Oct 31 11:10:07 2014 -0400 Merge branch 'master' into f20 .gitignore|1 + perl-Net-DNS-SEC.spec |8 +++- sources |2 +- 3

[perl-Net-DNS-SEC/f20] (3 commits) ...Merge branch 'master' into f20

2014-10-31 Thread Paul Wouters
Summary of changes: bc6ab3b... Perl 5.20 rebuild (*) 8f8d1c6... - Updated to 0.21, restores canonicalization of a RRSIG’s (*) ffebbcb... Merge branch 'master' into f20 (*) This commit already existed in another branch; no separate mail sent -- Fedora Extras Perl SIG

[perl-Net-DNS-SEC/el6] - Updated to 0.21, restores canonicalization of a RRSIG’s Signer Name

2014-10-31 Thread Paul Wouters
commit 9945af6cd0dba15e41455f4b872ed07404d07cf1 Author: Paul Wouters pwout...@redhat.com Date: Fri Oct 31 11:13:53 2014 -0400 - Updated to 0.21, restores canonicalization of a RRSIG’s Signer Name .gitignore|1 + perl-Net-DNS-SEC.spec |5 - sources

File Net-DNS-0.81.tar.gz uploaded to lookaside cache by pwouters

2014-10-29 Thread Paul Wouters
A file has been added to the lookaside cache for perl-Net-DNS: 26375d4310beb108b0e2b3bf30403ee5 Net-DNS-0.81.tar.gz -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel mailing list perl-devel@lists.fedoraproject.org

[perl-Net-DNS] - Updated to 0.81, Fixes AXFR BADSIG and infinite recursion in Net::DNS::Resolver

2014-10-29 Thread Paul Wouters
commit 4139f5a64ca15acd715c6ad73aaea278142492d7 Author: Paul Wouters pwout...@redhat.com Date: Wed Oct 29 10:47:39 2014 -0400 - Updated to 0.81, Fixes AXFR BADSIG and infinite recursion in Net::DNS::Resolver .gitignore|1 + perl-Net-DNS.spec |5 - sources

[perl-Net-DNS/f21: 2/2] - add changelog entry

2014-10-29 Thread Paul Wouters
commit e21ccf2a3aeab8e2631e62d3465300e18e6ffe29 Author: Paul Wouters pwout...@redhat.com Date: Wed Oct 29 11:28:18 2014 -0400 - add changelog entry perl-Net-DNS.spec |1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/perl-Net-DNS.spec b/perl-Net-DNS.spec index

[perl-Net-DNS/f21] (2 commits) ...- add changelog entry

2014-10-29 Thread Paul Wouters
Summary of changes: 4139f5a... - Updated to 0.81, Fixes AXFR BADSIG and infinite recursion (*) e21ccf2... - add changelog entry (*) This commit already existed in another branch; no separate mail sent -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel

[perl-Net-DNS/f20] (2 commits) ...- add changelog entry

2014-10-29 Thread Paul Wouters
Summary of changes: 4139f5a... - Updated to 0.81, Fixes AXFR BADSIG and infinite recursion (*) e21ccf2... - add changelog entry (*) (*) This commit already existed in another branch; no separate mail sent -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel

[perl-Net-DNS/f19] (2 commits) ...- add changelog entry

2014-10-29 Thread Paul Wouters
Summary of changes: 4139f5a... - Updated to 0.81, Fixes AXFR BADSIG and infinite recursion (*) e21ccf2... - add changelog entry (*) (*) This commit already existed in another branch; no separate mail sent -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel

Re: planned bind-pkcs11 changes in F20+

2014-09-25 Thread Paul Wouters
On Thu, 25 Sep 2014, Tomas Hozza wrote: I would like to inform everyone about changes I plan to do in Fedora 20+ due to Bug 1097752 (Support for native PKCS#11 interface - needed by FreeIPA). Currently there is a bind-pkcs11 package which includes couple of utilities needed for working with

File Net-DNS-0.80.tar.gz uploaded to lookaside cache by pwouters

2014-09-22 Thread Paul Wouters
A file has been added to the lookaside cache for perl-Net-DNS: 035632d787c037e8cf8cd2beba71c684 Net-DNS-0.80.tar.gz -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel mailing list perl-devel@lists.fedoraproject.org

[perl-Net-DNS] * Mon Sep 22 2014 Paul Wouters pwout...@redhat.com - 0.80-1 - Updated to 0.80 with Too late to ru

2014-09-22 Thread Paul Wouters
commit dc8c20aad230792e8bba24ff8935301d7720cfbd Author: Paul Wouters pwout...@redhat.com Date: Mon Sep 22 12:02:56 2014 -0400 * Mon Sep 22 2014 Paul Wouters pwout...@redhat.com - 0.80-1 - Updated to 0.80 with Too late to run INIT block fix and new force_v6 option .gitignore

[perl-Net-DNS/f21] (2 commits) ...* Mon Sep 22 2014 Paul Wouters pwout...@redhat.com - 0.80-1 - Updated to 0.80 with Too late to ru

2014-09-22 Thread Paul Wouters
Summary of changes: 0ac0ea7... Perl 5.20 rebuild (*) dc8c20a... * Mon Sep 22 2014 Paul Wouters pwout...@redhat.com - 0.80 (*) (*) This commit already existed in another branch; no separate mail sent -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel

[perl-Net-DNS/f20] (2 commits) ...* Mon Sep 22 2014 Paul Wouters pwout...@redhat.com - 0.80-1 - Updated to 0.80 with Too late to ru

2014-09-22 Thread Paul Wouters
Summary of changes: 0ac0ea7... Perl 5.20 rebuild (*) dc8c20a... * Mon Sep 22 2014 Paul Wouters pwout...@redhat.com - 0.80 (*) (*) This commit already existed in another branch; no separate mail sent -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel

[perl-Net-DNS/f19] (2 commits) ...* Mon Sep 22 2014 Paul Wouters pwout...@redhat.com - 0.80-1 - Updated to 0.80 with Too late to ru

2014-09-22 Thread Paul Wouters
Summary of changes: 0ac0ea7... Perl 5.20 rebuild (*) dc8c20a... * Mon Sep 22 2014 Paul Wouters pwout...@redhat.com - 0.80 (*) (*) This commit already existed in another branch; no separate mail sent -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel

Re: Systemd boot issue

2014-09-09 Thread Paul Wouters
On Tue, 9 Sep 2014, P J P wrote: I've been trying to boot into kernel-3.16.0 on a F19 machine. But it just stops after saying Is it a familiar issue to anyone? Is there a way to debug what Systemd is doing after printing above message?? I had similar issues, and I'm still on 3.14.7-100

File Net-DNS-0.79.tar.gz uploaded to lookaside cache by pwouters

2014-08-24 Thread Paul Wouters
A file has been added to the lookaside cache for perl-Net-DNS: 252243422646818e0889713553d61832 Net-DNS-0.79.tar.gz -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel mailing list perl-devel@lists.fedoraproject.org

[perl-Net-DNS] - Updated to 0.79 with OPENPGPKEY RRtype support

2014-08-24 Thread Paul Wouters
commit 866d6b4c3b3a9a4c69285cc7171b78bd3983e877 Author: Paul Wouters pwout...@redhat.com Date: Sun Aug 24 12:38:25 2014 -0400 - Updated to 0.79 with OPENPGPKEY RRtype support .gitignore|1 + perl-Net-DNS.spec |7 +-- sources |2 +- 3 files changed, 7

[perl-Net-DNS/f20] (2 commits) ...- Updated to 0.79 with OPENPGPKEY RRtype support

2014-08-24 Thread Paul Wouters
Summary of changes: ab5b77f... - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_M (*) 866d6b4... - Updated to 0.79 with OPENPGPKEY RRtype support (*) (*) This commit already existed in another branch; no separate mail sent -- Fedora Extras Perl SIG

[perl-Net-DNS/f19] (2 commits) ...- Updated to 0.79 with OPENPGPKEY RRtype support

2014-08-24 Thread Paul Wouters
Summary of changes: ab5b77f... - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_M (*) 866d6b4... - Updated to 0.79 with OPENPGPKEY RRtype support (*) (*) This commit already existed in another branch; no separate mail sent -- Fedora Extras Perl SIG

[perl-Net-DNS/f21] - Updated to 0.79 with OPENPGPKEY RRtype support

2014-08-24 Thread Paul Wouters
Summary of changes: 866d6b4... - Updated to 0.79 with OPENPGPKEY RRtype support (*) (*) This commit already existed in another branch; no separate mail sent -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel mailing list perl-devel@lists.fedoraproject.org

Re: default local DNS caching name server

2014-07-13 Thread Paul Wouters
On Sun, 13 Jul 2014, quickbooks office wrote: DNS over SSL does NOT work - I get no connectivity whatsoever after following the below steps. Tracking bug at https://bugzilla.redhat.com/show_bug.cgi?id=1119050 Can you please tell me what am I doing wrong? There seems to be some regression

File Net-DNS-0.78.tar.gz uploaded to lookaside cache by pwouters

2014-07-11 Thread Paul Wouters
A file has been added to the lookaside cache for perl-Net-DNS: 38862c7df536b514c5eec9004b57aa70 Net-DNS-0.78.tar.gz -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel mailing list perl-devel@lists.fedoraproject.org

[perl-Net-DNS] * Sat Jul 12 2014 Paul Wouters pwout...@redhat.com - 0.78-1 - Updated to 0.78, various bugfixes an

2014-07-11 Thread Paul Wouters
commit 87172eb2d318fce30c5360bff814fc2b5eade775 Author: Paul Wouters pwout...@redhat.com Date: Fri Jul 11 21:12:02 2014 -0400 * Sat Jul 12 2014 Paul Wouters pwout...@redhat.com - 0.78-1 - Updated to 0.78, various bugfixes and multiline TXT rdata printing support .gitignore

[perl-Net-DNS/f20] (3 commits) ...* Sat Jul 12 2014 Paul Wouters pwout...@redhat.com - 0.78-1 - Updated to 0.78, various bugfixes an

2014-07-11 Thread Paul Wouters
Summary of changes: 572b22e... - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass (*) 78ef7a8... - Updated to 0.77, a quickfix release fixing AXFR support (*) 87172eb... * Sat Jul 12 2014 Paul Wouters pwout...@redhat.com - 0.78 (*) (*) This commit already existed in another branch

[perl-Net-DNS/f19] (3 commits) ...* Sat Jul 12 2014 Paul Wouters pwout...@redhat.com - 0.78-1 - Updated to 0.78, various bugfixes an

2014-07-11 Thread Paul Wouters
Summary of changes: 572b22e... - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass (*) 78ef7a8... - Updated to 0.77, a quickfix release fixing AXFR support (*) 87172eb... * Sat Jul 12 2014 Paul Wouters pwout...@redhat.com - 0.78 (*) (*) This commit already existed in another branch

Re: I'll take tinyca2 (was Re: [ACTION REQUIRED] Retiring packages for Fedora 21 v3)

2014-07-02 Thread Paul Wouters
On Wed, 2 Jul 2014, Peter Hanecak wrote: I would like to take over tinyca2. I do not see anywhere on the list why the maintainers left it. So I'll check the procedures and also other sources and take it. According to Koji[1], some F21 build was successful last month so hopefully there wont

<    1   2   3   4   5   >