Já to chápu tak, že jestli se jedná o útok zevnitř, tak mirrory jim nepomůžou, protože můžou obsahovat stejný závadný obsah jako je na hlavním serveru. Ale nic o tom nevím, nechci tady plašit :-) Jinak mirrorů Fedory je hromada.
mirrory jsou. problemy ale maji servery ktere klientum zprostredkovavaji seznam techto mirroru. takze docasna rucni uprava yum.repos.d/ smerem na konkretni mirror by to mohla resit
The Fedora Infrastructure team continues to work on the issues we
discovered earlier this week. Right now, we're getting the account
system restored to service, along with some of the application servers.
We're also taking advantage of the outages to upgrade a few systems at
the same time.
Some services such as the Account System and the wiki should return to
normal over the weekend, but we expect outages to continue for some
other systems. Please be patient as we continue to work the problem.
"The Fedora Infrastructure team is currently investigating an issue in the infrastructure systems. That process may result in service outages, for which we apologize in advance. We're still assessing the end-user impact of the situation, but as a precaution, we recommend you not download or update any additional packages on your Fedora systems."
Many were caught by surprise when there was a widespread outage of Fedora Project infrastructure during the week. The earliest symptoms noticed included an inability to access Koji (see e.g. this FWN#139 "Koji from Behind a Firewall") or obtain updates with yum. A general announcement by Paul Frields followed[1] quickly on Thursday 14th and stated that an "issue in the infrastructure systems [was] being investigated and might] result in service outages[.]" Somewhat ominously it concluded "[..] as a precaution, we recommend you not download or update any additional packages on your Fedora systems." This led some to speculate[2] that there might be a security problem.
Further announcements or explanations were not forthcoming for days, except for a post to @fedora-infrastructure which suggested[3] that the problem was causing a lot of hard work. Paul Frields posted another update[4] on Sat 16th. This succinctly stated that the wiki and FAS should be back soon but that the application servers would take a bit longer.
As of Sunday evening it became obvious that a very major amount of work was being undertaken to recover from the problem. It is worth noting that the email lists and the wiki were functional most of the time thanks to the commitment of their administrators.
Koji from Behind a Firewall
A query was made[1] by Victor Lazzarini about how to connect to Koji using the CLI from behind a firewall. He wondered specifically how to set up a proxy connection. He added that he was seeing an error when using a web browser but was[2] unable to provide it due to the general outage in Fedora infrastructure.
Mike Bonnet answered[3] that Koji did not have direct proxy support but that it used only ports 80 (http) and 443(https) as these are generally open. He explained that it would be "a significant amount of effort" to support proxies directly. Unfortunately Vincent had to report[4] that his institution forced everything through a proxy due to being "paranoid about security" and he was stuck with either setting up an open access machine or working from home.
A possibility for the web browser error was supplied[5] by Andrew Price as an ssl_error_handshake_failure_alert which he had seen prior to the general outage.
Our team has been hard at work for several days now, restoring services
in the Fedora infrastructure. We started with what we identified as
Fedora's "critical path," those systems required to restore minimum
daily operation. That work to be completely finished by the end of the
day. We then move on to our other value services to complete them as
soon as possible.
Please give the infrastructure team the time they need to do this
demanding work. They have been doing a spectacular job and deserve the
absolute highest credit.
The systems that are now back online and usable include the following:
* Puppet, Xen and FAS hosts
* app1, app3, and app4
* database and proxy servers
* the majority of the Xen guest machines
* serverbeach5, serverbeach4
* Fedora Hosted**
The systems that should be available very soon:
* asterisk1 and collab1
* cvs1
* builders, x86 and ppc
* Fedora People
We know the community is awaiting more detail on the past week's
activities and their causes. We're preparing a timeline and details and
will make them available in the near future. We appreciate the
community's patience, and will continue to post updates to the
fedora-announce-list as soon as possible.
= = =
** New SSH fingerprint for Fedora Hosted:
e6:b3:68:51:98:2d:4c:dc:63:27:46:65:51:d5:f0:7a