Názory k článku
Servery Fedory a RH napadeny [update]
-
Za poslední týden jsem většinu zpráviček napsal já. Zprávičky na abíčku nečtu právě proto, aby mě někdo nemohl takhle obviňovat. Dá se ovšem očekávat, že autoři zpráviček jak tady tak na abíčku budou používat stejné zdroje, takže to je jen o tom kdo je zadá dřív. Jestli máš nějaký důkaz, že někdo kopíruje zprávičky z abíčka, tak ho prosím uveď, jinak to je jen bezhlavé očerňování autorů zpráviček. -
Zdravim,
me je celkem jedno, kde se objevi zprava driv, dulezite je, ze se nakonec objevi vsude, cilem je prece informovat o vsem vsechny, ja nechci chodit po 10ti webech s tim, ze teprve pak si mohu byt jist, ze mi nic duleziteho neuteklo... Takze si myslim, ze by bylo lepsi, kdyby autori i techto zpravicek chodili ke konkurenci a trebas nekopirovali "cut and paste", ale pokud zjisti, ze konkurence ma neco, co zde neni, tak nastudovat i treba neco vic a dodat sem... myslim, ze aktualnost a uplnost je nejdulezitejsi. -
Karel (neregistrovaný)Pokud napadáte dvoudenní zpoždění, tak se k vám přidávám. Také bych rád, aby to tu bylo dříve.
Pokud napadáte, že se tu objeví ta samá informace, pak bych vás rád odkázal na to, co to vlastně zprávičky jsou a k čemu slouží. Když to řeknu ve zkratce - k tomu, abych sám nemusel pročítat více různých serverů a přesto se odzvěděl o tom "důležitém". Osobně jsem svěřil svou budoucnost do rukou root.cz a spoléhám, že nic důležitého nevynechají, natož pak s výmluvou "o tom si můžete přečíst jinde". -
Miroslav SuchýStříbrný podporovatelMohu se zeptat, co tu vsichni mate s tim zpozdenim? Navic dvoudennim?
Podivejte se na data tech odkazovanych zprav! Ta zpravicka zaostavala radove hodiny za officialnim oznamenim. A dve hodiny za abickem. Pritom zpravicka byla vkladana na oba servery ve stejnou dobu. Jenom holt na abicku ji odsouhlasili o dve hodiny drive. -
Paul W. Frields adresátom fedora-announc.
Last week we discovered that some Fedora servers were illegally
accessed. The intrusion into the servers was quickly discovered, and the
servers were taken offline.
Security specialists and administrators have been working since then to
analyze the intrusion and the extent of the compromise as well as
reinstall Fedora systems. We are using the requisite outages as an
opportunity to do other upgrades for the sake of functionality as well
as security. Work is ongoing, so please be patient. Anyone with
pertinent information relating to this event is asked to contact
fedora-legal@redhat.com.
One of the compromised Fedora servers was a system used for signing
Fedora packages. However, based on our efforts, we have high confidence
that the intruder was not able to capture the passphrase used to secure
the Fedora package signing key. Based on our review to date, the
passphrase was not used during the time of the intrusion on the system
and the passphrase is not stored on any of the Fedora servers.
While there is no definitive evidence that the Fedora key has been
compromised, because Fedora packages are distributed via multiple
third-party mirrors and repositories, we have decided to convert to new
Fedora signing keys. This may require affirmative steps from every
Fedora system owner or administrator. We will widely and clearly
communicate any such steps to help users when available.
Among our other analyses, we have also done numerous checks of the
Fedora package collection, and a significant amount of source
verification as well, and have found no discrepancies that would
indicate any loss of package integrity. These efforts have also not
resulted in the discovery of additional security vulnerabilities in
packages provided by Fedora.
Our previous warnings against further package updates were based on an
abundance of caution, out of respect for our users. This is also why we
are proceeding with plans to change the Fedora package signing key. We
have already started planning and implementing other additional
safeguards for the future. At this time we are confident there is little
risk to Fedora users who wish to install or upgrade signed Fedora
packages.
In connection with these events, Red Hat, Inc. detected an intrusion of
certain of its computer systems and has issued a communication to Red
Hat Enterprise Linux users which can be found at
http://rhn.redhat.com/errata/RHSA-2008-0855.html. This communication
states in part, "Last week Red Hat detected an intrusion on certain of
its computer systems and took immediate action. While the investigation
into the intrusion is on-going, our initial focus was to review and test
the distribution channel we use with our customers, Red Hat Network
(RHN) and its associated security measures. Based on these efforts, we
remain highly confident that our systems and processes prevented the
intrusion from compromising RHN or the content distributed via RHN and
accordingly believe that customers who keep their systems updated using
Red Hat Network are not at risk. We are issuing this alert primarily for
those who may obtain Red Hat binary packages via channels other than
those of official Red Hat subscribers."
It is important to note that the effects of the intrusion on Fedora and
Red Hat are *not* the same. Accordingly, the Fedora package signing key
is not connected to, and is different from, the one used to sign Red Hat
Enterprise Linux packages. Furthermore, the Fedora package signing key
is also not connected to, and is different from, the one used to sign
community Extra Packages for Enterprise Linux (EPEL) packages.
We will continue to keep the Fedora community notified of any updates.
Thank you again for your patience.
--
Paul W. Frields
gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233 5906 ACDB C937 BD11 3717
http://paul.frields.org/ - - http://pfrields.fedorapeople.org/
irc.freenode.net: stickster @ #fedora-docs, #fedora-devel, #fredlug
--
fedora-announce-list mailing list
fedora-announce-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-announce-list
