- Heroes

email from forums captured as spam by provider
by Felix Miata 08 Jun '24

08 Jun '24

For many weeks now, virtually every email notifying of a forum thread update is being captured by Earthlink's "Known spam" folder. Trying to get EL to do anything about it has been futile. This totally destroys ability to maintain participation in an active thread, absent keeping that thread open in one tab to the virtual exclusion of all else. To actually see such, I must use webmail to open the "Known spam" folder to either open one then, or mark it as "not spam" to have it arrive where it should have gone in the first place. What may have changed in the sending of these emails some weeks or months ago that may need attention? -- Evolution as taught in public schools is, like religion, based on faith, not based on science. Team OS/2 ** Reg. Linux User #211409 ** a11y rocks! Felix Miata

2 1

Meeting minutes
by Christian Boltz 06 Jun '24

06 Jun '24

Hello, here are the minutes of today's meeting: 2024-06-06 heroes meeting Attendees: Christian, Georg, Gertjian, Dominik, Bill - IAM meeting (replacing idp-portal) - so far, only high-level discussions * SUSE wants to split employee and community accounts * probably own Kanidm for openSUSE * firstyear helping with design - fail2ban on code.o.o work in progress - improved monitor.o.o page - prometheus monitoring now covers everything icinga monitored (and more!), icinga will be removed - release notes sync job now uses the official documentation repo directly - most machines are now highstate-able (no local changes that would be overwritten) - couple of pagure/code.o.o related issues fixed - Incorporate oS members as part of the user group for simplified management? https://progress.opensuse.org/issues/160508 - disable stale Heroes accounts - contact users who did not authenticate to the Heroes VPN for >= 6 months - if no response + login within a month, disable Heroes IDM account and revoke the corresponding VPN client certificate -- Bill's VPN never worked, he needs to get re-setup https://progress.opensuse.org/issues/161132 - Content-Security-Policy (CSP) - good idea in general - we'll work on it, but it probably takes some time - a few services that include "random"/user-defined external content will be interesting[tm] Regards, Christian Boltz -- <jjohansen> its a bug tracker, developers aren't supposed to look at those things :) [from #apparmor]

1 0

Reminder: Heroes meeting on Thursday
by Christian Boltz 04 Jun '24

04 Jun '24

Hello, the next heroes meeting will be on Thursday (2024-06-06) at 18:00 UTC / 20:00 CEST in https://meet.opensuse.org/heroes This time, we have two additional topics, see yourself on https://progress.opensuse.org/issues/159861 - and feel free to add any topic you want to discuss. Regards, Christian Boltz -- In C we had to code our own bugs. In C++ we can inherit them. [Prof. Gerald Karam]

1 0

Re: New Mirror in Lisbon, Portugal
by Bernhard M. Wiedemann 07 May '24

07 May '24

On 07/05/2024 02.24, Tomás Leite de Castro wrote: > Hi, > > I’m operating some mirrors in Lisbon, Portugal and I would like to add openSUSE to the list of public mirrors available at this server. > I don’t know if my previous email got somehow lost. > Mirror URL https://mirror.leitecastro.com/opensuse > It’s available via rsync, http(s) and ipv4 and ipv6 enabled. > This mirror is connected at 20Gbps and with a generous 8TB NVMe cache. No traffic, or geo limitations. > > Please let me know if you require any additional information, I now added your mirror https://download.opensuse.org/app/server/mirror.leitecastro.com It seems to be only the second mirror in PT after ftp.rnl.tecnico.ulisboa.pt You can sync repos from rsync://stage-main-repos.opensuse.org/ and for what is not on there (e.g. debug, ports, repositories), use the slower rsync://stage.opensuse.org/ The mirrors mailing list is for notifying mirror operators. Rather admin(a)opensuse.org is the way to get a mirror added. Ciao Bernhard M.

1 0

Meeting minutes
by Christian Boltz 02 May '24

02 May '24

Hello, here are the minutes of today's meeting: Attendees: Christian, Doug, Jim, Georg Status reports: - no update on GDPR, added clarification to Wiki - Doug provided update on bugzilla regarding communication needs from SUSE IT - Weblate being migrated to SaaS - https://status.opensuse.org/#scheduled-43 -> prefer to keep i18n.o.o redirect - monitoring/alerting for HAProxy and zypper (update/reboot status), nginx/httpd in progress - known_hosts repository + SSHFP records for all machines (generated using a script upon creation of new VMs) - repaired media upload in Matrix - work on NetBox - work on Mailman search index issue - SUSE IAM UCS replacement: https://progress.opensuse.org/issues/159798 - SUSE helping with new debuginfod setup Issues: - multiple users reporting sporadic issues with cdn.o.o * for example https://progress.opensuse.org/issues/159108 Regards, Christian Boltz -- Trusting a claim within the email itself that it's virus-free is kind of like trusting a politician who goes on TV and says, "I am not a crook." [Jay Hennigan in mailop]

1 0

Reminder: Heroes meeting on Thursday
by Christian Boltz 30 Apr '24

30 Apr '24

Hello, our next meeting will be on Thursday (2024-05-02 at 18:00 UTC / 20:00 CEST in https://meet.opensuse.org/heroes I just created the meeting ticket with the usual topics at https://progress.opensuse.org/issues/159816 As usual, feel free to add topics you want to discuss. https://progress.opensuse.org/issues/159798 might be an interesting topic to add ;-) Regards, Christian Boltz -- Die Meldung verwirrt mich: Es sieht so aus, als würde sich Adobe um die Sicherheit von Software bemühen, aber die Downloadseiten für Flash und Acrobat Reader sind immer noch online. Irgendwas stimmt da nicht. [http://www.heise.de/security/news/foren//forum-225780/msg-21658708/ read/]

1 0

Changes to the Heroes VPN
by Georg Pfuetzenreuter 23 Apr '24

23 Apr '24

Hello! We are implementing changes to the Heroes OpenVPN. There are three changes - two are already implemented, and you likely did not notice - the other is breaking and requires changes in your client configuration after the 12th of April (one week from now)! SHORT version: On April 12th, please visit the Admin Wiki and update your OpenVPN client configuration with the latest examples: Native OpenVPN: https://progress.opensuse.org/projects/opensuse-admin-wiki/wiki/VPN#OpenVPN… NetworkManager: https://progress.opensuse.org/projects/opensuse-admin-wiki/wiki/VPN#Network… Afterwards, delete any files containing Heroes credentials in plain text. VERBOSE version: 1. BREAKING: Removal of compression On April 5th, LZO compression will be disabled on the OpenVPN server. If you want to connect on or after this day, you will have to remove the respective option from your OpenVPN client configuration: With native OpenVPN: ``` comp-lzo ``` With NetworkManager: ``` compress=lzo ``` If you do not remove this option after it has been disabled on the server, you will receive error messages like "Bad LZO decompression header byte: xxx" blocking you from working in the Heroes network! This change is implemented due to inherent security issues with compression in OpenVPN: https://community.openvpn.net/openvpn/wiki/Compression. 2. Non-breaking: Removal of user/password authentication and change of ciphers Previously we used two layers of authentication for OpenVPN: - LDAP username/password - client certificates The LDAP layer is removed as it often encourages users to store sensitive data (i.e. the same passphrase also used for sudo elevation to root on our systems!) in plain text and does not yield a security benefit given the existing use of client certificates. Additionally, we adjust the ciphers to make use of hardware acceleration and to decrease CPU load as well as latency for users in remote locations far away from our data center. These changes have already been implemented and are compatible with existing clients - however we still ask you to remove the following lines from your client configuration: With native OpenVPN: ``` auth-user-pass.* cipher AES-256-CBC data-ciphers AES-256-CBC ``` With NetworkManager: ``` username=.* password-flags=.* cipher=AES-256-CBC [vpn-secrets] password=.* ``` Make sure to also delete any files containing the plain text credentials, such as the file previously passed as an argument to "auth-user-pass". You can already implement the changes mentioned in point 2 now, or you do it together with the mandatory change mentioned in point 1 on April 12th. All these changes are tracked and explained in https://progress.opensuse.org/issues/151492. Thanks for collaborating! If you have any questions, please let me know. Georg

3 8

SSH host keys
by Georg 23 Apr '24

23 Apr '24

Hi everyone, for additional security, we disable DSA and RSA host keys on all infra.opensuse.org machines in favor of Ed25519 and ECDSA. If you use a modern operating system, you likely do not notice this change, and you likely already trust either one of the more modern keys for the machines you work with. To ensure the authenticity of your SSH connections, I recommend only connecting to hosts the keys of which you verified. I started a repository containing an automatically generated known_hosts file with trusted entries for all of our Salt managed machines - you can incorporate this into your own known_hosts file. It is now also possible to use DNS based verification using SSHFP records, which are automatically generated for all machines - whilst this is preferred over maintaining known_hosts entries, it requires additional considerations in your client side setup. The generated known_hosts file as well as instructions for utilizing the SSHFP records can be found in this repository (from within the Heroes VPN): https://gitlab.infra.opensuse.org/infra/ssh_known_hosts Note the thor.infra.opensuse.org jump servers are already configured for strict host key checking and DNS verification. Best, Georg

3 2

Pontifex backups on backup.i.o.o
by Georg Pfuetzenreuter 20 Apr '24

20 Apr '24

Hi! I found about 760G worth of log file backups from back when Pontifex still connected to backup.i.o.o. I assume you don't need it, but since it's a lot of data I rather ask - can I delete it? :-) Cheers, Georg

2 3

CA certificates package
by Georg Pfuetzenreuter 13 Apr '24

13 Apr '24

Hi, as we are slowly fading out FreeIPA I renamed the "ca-certificates-freeipa-opensuse" package to "ca-certificates-opensuse". The new package obsoletes the old one, meaning if you have the openSUSE:infrastructure repository installed on a machine, you will see the replacement happen automatically during your next up/dup. Whilst at it, I also pushed the package to a new dedicated project, openSUSE:infrastructure:CA [1], in addition to openSUSE:infrastructure. This might be useful if you want to keep the root certificate up to date without keeping our big repository on your workstation. Note that no source/certificate files were changed. Cheers, Georg [1] https://build.opensuse.org/project/show/openSUSE:infrastructure:CA

1 0