date:20150304

Re: disk change-out and packages

2015-03-04 Thread Raf Czlonka

On Wed, Mar 04, 2015 at 01:22:55PM GMT, Ed Ahlsen-Girard wrote:

 First method: mount all the slices in /tree and run a series of cp -R
 as root. Files seemed to get there but something was not right with
 permissions when I tried booting the new disk, so I dropped back and
 did some research.

You have forgotten '-p' option - from 'man 1 cp':

Preserve in the copy as many of the modification time, access time,
file flags, file mode, user ID, and group ID as allowed by
permissions.

In the same manual, however, it reads:

 However, cp copies hard linked files as separate files.  To
 preserve hard links, use a utility such as pax(1) or tar(1)
 instead.

So using 'cp' to, effectively, mirror the disk, is not the best of
ideas.

 Reinstalled, mounted the new slices as before, and ran:
 
 #!/bin/sh
 
 tar -cXf - /* | tar -xpf - -C /tree
 tar -cXf - /home/* | tar -xpf - -C /tree/home 
 tar -cXf - /usr/* | tar -xpf - -C /tree/usr 
 tar -cXf - /usr/X11R6/* | tar -xpf - -C /tree/usr/X11R6 
 tar -cXf - /usr/local/* | tar -xpf - -C /tree/usr/local 
 tar -cXf - /usr/obj/* | tar -xpf - -C  /tree/usr/obj 
 tar -cXf - /usr/src/* | tar -xpf - -C /tree/usr/src 
 tar -cXf - /var/* | tar -xpf - -C /tree/var 
 
 I had copied the new disk's fstab so that the duids were right when I
 started from it.
 
 Results were interesting. I got another copy of /home inside
 /tree/home, as well as what I wanted in it, and youtube-dl turns out
 to make filenames too long for tar. Nevertheless, I could log in as
 myself. But running my usual packages at login didn't work: file not
 found.

That's because the syntax is wrong - your working directory ('-C')
should have been '/tree' in all of the above.

Also, drop the asterisk '*'.

You could have shortened it all to:

tar -cXf - / | tar -xpf - -C /tree
for i in /home /usr /var ; do tar -cf - $i | tar -xpf - -C /tree ; done

 Should I have not tried to save that much time?

You could have simply reinstalled OpenBSD on the new disk, copied the
crucial data (i.e. '/home') and reinstalled ports/packages, but copying
the data using 'tar' would have taken much less time... provided you got
it right the first time ;^)

 I thought tar | tar would get everything. Do I need to install the
 packages on the new disk? Is this a time that pkg_check is my friend?

Fix it using the above info, and reinstalling packages should not be
necessary.

Regards,

Raf

Does LibreSSL support RSA export-grade keys? - FREAK Attack

2015-03-04 Thread someone

Hello,

---

Does LibreSSL supports RSA export-grade keys? - FREAK Attack

Apple's SecureTransport and OpenSSL -- have a bug in them. This bug causes
them to accept RSA export-grade keys *even when the client didn't ask for
export-grade RSA.* The impact of this bug can be quite nasty: it admits a
'man in the middle' attack whereby an active attacker can force down the
quality of a connection, provided that the client is vulnerable *and *the
server supports export RSA.

The MITM attack works as follows:

1. In the client's Hello message, it asks for a standard 'RSA'
ciphersuite.
2. The MITM attacker changes this message to ask for 'export RSA'.
3. The server responds with a 512-bit export RSA key, signed with its
long-term key.
4. The client accepts this weak key due to the OpenSSL/SecureTransport
bug.
5. The attacker factors the RSA modulus to recover the corresponding RSA
decryption key.
6. When the client encrypts the 'pre-master secret' to the server, the
attacker can now decrypt it to recover the TLS 'master secret'.
7. From here on out, the attacker sees plaintext and can inject anything
it wants.

79 matches

Mail list logo