Re: [suse-security] SuSE-SA:2002:023
Joerg Mayer <jmayer@loplof.de> writes:
Sorry, but on the three machines I have now tested it on, it doesn't. They are all running SuSE 8.0. One of them with the SuSE 2.4.18-4GB kernel, one with 2.4.18 and one with 2.4.19-rc1. On all of them I get the following message, when I start sshd: This platform does not support both privilege separation and compression Compression disabled -- Best regards Christian Laursen
That's another problem - Olaf and Solar Designer have made a backwards compatibility patch for the older distributions. I have removed this patch from the 8.0 package earlier today (yesterday) because 8.0 doesn't come with 2.2 kernels any more.
It's on our wishlist as well, yes. Compression is desireable whereever your link is weaker than your CPU. The 8.0 package has another bug that needs a fix: Key generation in the start script. It's a bit of a mess...
Christian Laursen
Thanks, Roman. -- - - | Roman Drahtmüller <draht@suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -
[...]
It's on our wishlist as well, yes. Compression is desireable whereever your link is weaker than your CPU.
yes yes... Adding the patch again right now since anon mmaps might not be supported at compile-time on one or more machines in our build farm. This is messy. Expect the update package for 8.0 as soon as it has passed our testing team.
The 8.0 package has another bug that needs a fix: Key generation in the start script. It's a bit of a mess...
Fixed. Roman. -- - - | Roman Drahtmüller <draht@suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -
* Roman Drahtmueller; <draht@suse.de> on 03 Jul, 2002 wrote:
Are we expecting a newer package then openssh-3.4p1-4 as when I start sshd on a 8.0 machine I get the following message "This platform does not support both privilege separation and compression Compression disabled" Thanks -- Togan Muftuoglu Unofficial SuSE FAQ Maintainer http://dinamizm.ath.cx
...is on the way. The packages has been built on a 2.2 machine. :-( Roman. -- - - | Roman Drahtmüller <draht@suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -
As I know from an announcement V3.4 should have compression enabled. The early 3.3 had no support and no full pam-support. If they did not get it working in 3.4, other features may not work as well. This would be a bad thing! If true, the V3.4 is still a beta or alpha! Even the exploit was not that discussed, were the problem is. Official posts on www.openssh.orgh say, that old version with SuSE Standard-seetings are not affected! So why update to an incompleted fix? Second thing is, why does SuSE build packages for 2.4 kernel on 2.2 machines (this was done for openssh 3.4, as I read all posts)? Philippe
On Wed, 2002-07-03 at 05:32, Philippe Vogel wrote:
What exactly is the problem with Openssh 3.4 and SUSE 8.0? I compiled it on my system when it come out and both UsePrivilegeSeparation and Compression worked fine. Charles -- "...Unix, MS-DOS, and Windows NT (also known as the Good, the Bad, and the Ugly)." (By Matt Welsh)
Our build farm builds packages in chrooted environments. This is one out of 4000 cases where the running kernel version matters, and, frankly, we think it's braindead. We have had another problem almost two years ago where a build script in some package remounted /proc read-only in the chroot environment. No problem for 2.2 kernels, the /proc outside the chroot is untouched. In 2.4 though, all mounted proc filesystems change options. If you want to have that kind of flexibility, you have to workaround some problems sometimes.
Philippe
Thanks, Roman. -- - - | Roman Drahtmüller <draht@suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -
* Roman Drahtmueller wrote on Wed, Jul 03, 2002 at 11:55 +0200: Well, I know it's OT, but I think it's interesting :)
The kernel running at build time does matter? Why that?! And will the next kernel upgrade have ssh as dependency or what?
What does this mean? I do not understand it. oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.
That's another problem - Olaf and Solar Designer have made a backwards compatibility patch for the older distributions. I have removed this patch from the 8.0 package earlier today (yesterday) because 8.0 doesn't come with 2.2 kernels any more.
It's on our wishlist as well, yes. Compression is desireable whereever your link is weaker than your CPU. The 8.0 package has another bug that needs a fix: Key generation in the start script. It's a bit of a mess...
Christian Laursen
Thanks, Roman. -- - - | Roman Drahtmüller <draht@suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -
[...]
It's on our wishlist as well, yes. Compression is desireable whereever your link is weaker than your CPU.
yes yes... Adding the patch again right now since anon mmaps might not be supported at compile-time on one or more machines in our build farm. This is messy. Expect the update package for 8.0 as soon as it has passed our testing team.
The 8.0 package has another bug that needs a fix: Key generation in the start script. It's a bit of a mess...
Fixed. Roman. -- - - | Roman Drahtmüller <draht@suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -
* Roman Drahtmueller; <draht@suse.de> on 03 Jul, 2002 wrote:
Are we expecting a newer package then openssh-3.4p1-4 as when I start sshd on a 8.0 machine I get the following message "This platform does not support both privilege separation and compression Compression disabled" Thanks -- Togan Muftuoglu Unofficial SuSE FAQ Maintainer http://dinamizm.ath.cx
...is on the way. The packages has been built on a 2.2 machine. :-( Roman. -- - - | Roman Drahtmüller <draht@suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -
As I know from an announcement V3.4 should have compression enabled. The early 3.3 had no support and no full pam-support. If they did not get it working in 3.4, other features may not work as well. This would be a bad thing! If true, the V3.4 is still a beta or alpha! Even the exploit was not that discussed, were the problem is. Official posts on www.openssh.orgh say, that old version with SuSE Standard-seetings are not affected! So why update to an incompleted fix? Second thing is, why does SuSE build packages for 2.4 kernel on 2.2 machines (this was done for openssh 3.4, as I read all posts)? Philippe
On Wed, 2002-07-03 at 05:32, Philippe Vogel wrote:
What exactly is the problem with Openssh 3.4 and SUSE 8.0? I compiled it on my system when it come out and both UsePrivilegeSeparation and Compression worked fine. Charles -- "...Unix, MS-DOS, and Windows NT (also known as the Good, the Bad, and the Ugly)." (By Matt Welsh)
participants (6)
-
Charles Philip Chan -
Christian Laursen -
Philippe Vogel -
Roman Drahtmueller -
Steffen Dettmer -
Togan Muftuoglu