Search Results: "cas"

16 March 2010

Russell Coker: Starting with KVM

I ve just bought a new Thinkpad that has hardware virtualisation support and I ve got KVM running. HugePages The Linux-KVM site has some information on using hugetlbfs to allow the use of 2MB pages for KVM [1]. I put vm.nr_hugepages = 1024 in /etc/sysctl.conf to reserve 2G of RAM for KVM use. The web page notes that it may be impossible to allocate enough pages if you set it some time after boot (the kernel can allocate memory that can t be paged and it s possible for RAM to become too fragmented to allow allocation). As a test I reduced my allocation to 296 pages and then increased it again to 1024, I was surprised to note that my system ran extremely slow while reserving the pages it seems that allocating such pages is efficient when done at boot time but not so efficient when done later. hugetlbfs /hugepages hugetlbfs mode=1770,gid=121 0 0 I put the above line in /etc/fstab to mount the hugetlbfs filesystem. The mode of 1770 allows anyone in the group to create files but not unlink or rename each other s files. The gid of 121 is for the kvm group. I m not sure how hugepages are used, they aren t used in the most obvious way. I expected that allocating 1024 huge pages would allow allocating 2G of RAM to the virtual machine, that s not the case as -m 2048 caused kvm to fail. I also expected that the number of HugePages free according to /proc/meminfo would reliably drop by an amount that approximately matches the size of the virtual machine which doesn t seem to be the case. I have no idea why KVM with Hugepages would be significantly slower for user and system CPU time but still slightly faster for the overall build time (see the performance section below). I ve been unable to find any documents explaining in which situations huge pages provide advantages and disadvantages or how they work with KVM virtualisation the virtual machine allocates memory in 4K pages so how does that work with 2M pages provided to it by the OS? But Hugepages does provide a slight benefit in performance and if you have plenty of RAM (I have 5G and can afford to buy more if I need it) you should just install it as soon as you start. I have filed Debian bug report #574073 about KVM displaying an error you normally can t see when it can t access the hugepages filesystem [6]. Permissions open /dev/kvm: Permission denied
Could not initialize KVM, will disable KVM support One thing that annoyed me about KVM is that the Debian/Lenny version will run QEMU instead if it can t run KVM. I discovered this when a routine rebuild of the SE Linux Policy packages in a Debian/Unstable virtual machine took an unreasonable amount of time. When I halted the virtual machine I noticed that it had displayed the above message on stderr before changing into curses mode (I m not sure the correct term for this) such that the message was obscured until the xterm was returned to the non-curses mode at program exit. I had to add the user in question to the kvm group. I ve filed Debian bug report #574063 about this [2]. Performance Below is a table showing the time taken for building the SE Linux reference policy on Debian/Unstable. It compares running QEMU emulation (using the kvm command but without permission to access /dev/kvm), KVM with and without hugepages, Xen, and a chroot. Xen is run on an Opteron 1212 Dell server system with 2*1TB SATA disks in a RAID-1 while the KVM/QEMU tests are on an Intel T7500 CPU in a Thinkpad T61 with a 100G SATA disk [4]. All virtual machines had 512M of RAM and 2 CPU cores. The Opteron 1212 system is running Debian/Lenny and the Thinkpad is running Debian/Lenny with a 2.6.32 kernel from Testing.

	Elapsed	User	System
QEMU on Opteron 1212 with Xen installed	126m54	39m36	8m1
QEMU on T7500	95m42	42m57	8m29
KVM on Opteron 1212	7m54	4m47	2m26
Xen on Opteron 1212	6m54	3m5	1m5
KVM on T7500	6m3	2m3	1m9
KVM Hugepages on T7500 with NCurses console	5m58	3m32	2m16
KVM Hugepages on T7500	5m50	3m31	1m54
KVM Hugepages on T7500 with 1800M of RAM	5m39	3m30	1m48
KVM Hugepages on T7500 with 1800M and file output	5m7	3m28	1m38
Chroot on T7500	3m43	3m11	29

I was surprised to see how inefficient it is when compared with a chroot on the same hardware. It seems that the system time is the issue. Most of the tests were done with 512M of RAM for the virtual machine, I tried 1800M which improved performance slightly (less IO means less context switches to access the real block device) and redirecting the output of dpkg-buildpackage to /tmp/out and /tmp/err reduced the built time by 32 seconds it seems that the context switches for networking or console output really hurt performance. But for the default build it seems that it will take about 50% longer in a virtual machine than in a chroot, this is bearable for the things I do (of which building the SE Linux policy is the most time consuming), but if I was to start compiling KDE then I would be compelled to use a chroot. I was also surprised to see how slow it was when compared to Xen, for the tests on the Opteron 1212 system I used a later version of KVM (qemu-kvm 0.11.0+dfsg-1~bpo50+1 from Debian/Unstable) but could only use 2.6.26 as the virtualised kernel (the Debian 2.6.32 kernels gave a kernel Oops on boot). I doubt that the lower kernel version is responsible for any significant portion of the extra minute of build time. Storage One way of managing storage for a virtual machine is to use files on a large filesystem for it s block devices, this can work OK if you use a filesystem that is well designed for large files (such as XKS). I prefer to use LVM, one thing I have not yet discovered is how to make udev assign the KVM group to all devices that match /dev/V0/kvm-*. Startup KVM seems to be basically designed to run from a session, unlike Xen which can be started with xm create and then run in the background until you feel like running xm console to gain access to the console. One way of dealing with this is to use screen. The command screen -S kvm-foo -d -m kvm WHATEVER will start a screen session named kvm-foo that will be detached and will start by running kvm with WHATEVER as the command-line options. When screen is used for managing virtual machines you can use the command screen -ls to list the running sessions and then commands such as screen -r kvm-unstable to reattach to screen sessions. To detach from a running screen session you type ^A^D. The problem with this is that screen will exit when the process ends and that loses the shutdown messages from the virtual machine. To solve this you can put exec bash or sleep 200 at the end of the script that runs kvm. start-stop-daemon -S -c USERNAME --exec /usr/bin/screen -- -S kvm-unstable -d -m /usr/local/sbin/kvm-unstable On a Debian system the above command in a system boot script (maybe /etc/rc.local) could be used to start a KVM virtual machine on boot. In this example USERNAME would be replaced by the name of the account used to run kvm, and /usr/local/sbin/kvm-unstable is a shell script to run kvm with the correct parameters. Then as user USERNAME you can attach to the session later with the command screen -x kvm-unstable . Thanks to Jason White for the tip on using screen. I ve filed Debian bug report #574069 [3] requesting that kvm change it s argv[0] so that top(1) and similar programs can be used to distinguish different virtual machines. Currently when you have a few entries named kvm in top s output it is annoying to match the CPU hogging process to the virtual machine it s running. It is possible to use KVM with X or VNC for a graphical display by the virtual machine. I don t like these options, I believe that Xephyr provides better isolation, I ve previously documented how to use Xephyr [5]. kvm -kernel /boot/vmlinuz-2.6.32-2-amd64 -initrd /boot/initrd.img-2.6.32-2-amd64 -hda /dev/V0/unstable -hdb /dev/V0/unstable-swap -m 512 -mem-path /hugepages -append "selinux=1 audit=1 root=/dev/hda ro rootfstype=ext4" -smp 2 -curses -redir tcp:2022::22 The above is the current kvm command-line that I m using for my Debian/Unstable test environment. Networking I m using KVM options such as -redir tcp:2022::22 to redirect unprivileged ports (in this case 2022) to the ssh port. This works for a basic test virtual machine but is not suitable for production use. I want to run virtual machines with minimal access to the environment, this means not starting them as root. One thing I haven t yet investigated is the vde2 networking system which allows a private virtual network over multiple physical hosts and which should allow kvm to be run without root privs. It seems that all the other networking options for kvm which have appealing feature sets require that the kvm process be started with root privs. Is KVM worth using? It seems that KVM is significantly slower than a chroot, so for a basic build environment a secure chroot environment would probably be a better option. I had hoped that KVM would be more reliable than Xen which would offset the performance loss however as KVM and Debian kernel 2.6.32 don t work together on my Opteron system it seems that I will have some reliability issues with KVM that compare with the Xen issues. There are currently no Xen kernels in Debian/Testing so KVM is usable now with the latest bleeding edge stuff (on my Thinkpad at least) while Xen isn t. Qemu is really slow, so Xen is the only option for 32bit hardware. Therefore all my 32bit Xen servers need to keep running Xen. I don t plan to switch my 64bit production servers to KVM any time soon. When Debian/Squeeze is released I will consider whether to use KVM or Xen after upgrading my 64bit Debian server. I probably won t upgrade my 64bit RHEL-5 server any time soon maybe when RHEL-7 is released. My 64bit Debian test and development server will probably end up running KVM very soon, I need to upgrade the kernel for Ext4 support and that makes KVM more desirable. So it seems that for me KVM is only going to be seriously used on my laptop for a while. Generally I am disappointed with KVM. I had hoped that it would give almost the performance of Xen (admittedly it was only 14.5% slower). I had also hoped that it would be really reliable and work with the latest kernels (unlike Xen) but it is giving me problems with 2.6.32 on Opteron. Also it has some new issues such as deciding to quietly do something I don t want when it s unable to do what I want it to do.

Russell Coker: Thinkpad T61

I ve now had my new Thinkpad T61 [1] for almost a month. The letters on the keyboard are not even starting to wear off which is unusual, either this Thinkpad is built with harder plastic than the older ones or I m typing more softly. Memory The first thing I did after receiving it was to arrange a RAM upgrade. It shipped with two 1GB DDR2 666MHz PC2-5300 SODIMM modules and as I want to run KVM I obviously need a lot more than that. The Intel Chipset page on Wikipedia is one of the resources that documents the Intel GM965 chipset as supporting up to 8G of RAM. Getting 4G in two 2G modules seemed like a bad idea as that would limit future expansion options and also result in two spare modules. So I decided to get a 4G module for a total of 5G of RAM. I ve updated my RAM speed page with the test results of this system [2], I get 2,823MB/s with a matched pair of DIMMs and 2,023MB/s with a single DIMM. But strangely with a pair of unmatched DIMMs Memtest86+ reported 2,823MB/s I wonder whether the first 2G of address space is interleaved for best performance and the last 3G runs at 2,023MB/s. In any case I think that losing 29% of the maximum RAM speed would be an acceptable trade-off for saving some money and I can always buy another 4G DIMM later. I had to order a DDR2-800MHz PC2-6400 module because they are cheaper than the PC2-5300 modules and my Thinkpad works equally well with either speed. I have used the spare 1G SODIMM in my EeePC701 which takes the same RAM presumably because the EeePC designers found PC2-5300 modules to be cheaper than slower modules (I think that the 701 was at the time it was released the slowest PC compatible system that was selling in quantity). The EeePC gets only 798MB/s out of the same memory. My document about Memtest86+ results has these results and more [2]. I noticed that if I run Memtest86+ booted from a USB flash device then inserting or removing a USB device can cause memory errors, but if I boot memtest86+ from a CD it seems to work correctly. So it seems that Memtest86+ doesn t disable some aspect of USB hardware, this might be considered a bug or it might just be a don t do that issue. Misc To get the hardware virtualisation working (needed to load the kvm_intel kernel module) I had to enable it in the BIOS and then do a hard reset (power off). Telling the BIOS to save and reboot was not adequate. This would be a BIOS bug, it knew that I had changed the virtualisation setting so it should have either triggered a hard reset or instructed me to do so. The default configuration of Debian/Lenny results in sound not working, I had to run alsaconf as suggested on the Debian Etch on Thinkpad T61 howto [3] which solved it. Generally I m happy with this system, the screen resolution is 1680*1050 which has 20% more pixels than the 1400*1050 screen on my Thinkpad T41p, it s a lot faster for CPU operations and should be a lot faster for video when I get the drivers sorted out (currently it s a lot slower), and I have virtualisation working again. But when you buy a system that s much like the last one but 6 years newer you expect it to be better. Generally the amount of effort involved in the process of buying a new system, upgrading the RAM to the desired specs, installing Linux and tweaking all the options is enough to make me want to wait at least another 6 years before buying another. Part of the reason for this difficulty is that I want to get so much functionality from the machine, a machine with more modest goals (such as a Netbook) takes a lot less time to configure. Problems There is Bluetooth hardware which is apparently enabled by default. But a quick search didn t turn up any information on how to do the basic functions, I would like to just transfer files from my mobile phone in the same way that I transfer files between phones. The video card is a nVidia Corporation Quadro NVS 140M (rev a1). 3D games seem slow but glxgears reports 300fps. It doesn t have Xvideo support which appears to be the reason why mplayer won t allow resizing it s display area unless run with the -zoom option, and it s also got performance problems such that switching between virtual desktops will interrupt the sound on a movie that mplayer is playing although when alsaplayer is playing music the sound isn t interrupted. Also when I play a Youtube video at twice the horizontal and vertical resolution it takes half of one CPU core. It s a pity that I didn t get an Intel video controller. It seems that Debian is soon going to get the Nouveau NVidia drivers so hopefully video performance will improve significantly when I get them [4]. The next thing I have to do is to get the sound controls working. The older Thinkpads that I used had hardware controls, the T41p that was my previous system had buttons for increasing and decreasing the volume and a mute button that interacted directly with the hardware. The down-side of this was that there was no way for the standard software to know what the hardware was going to do, the up-side was that I could press the mute button and know that it would be silent regardless of what the software wants. Now I have the same buttons on my T61 but they don t do anything directly, they just provide key-press events. According to showkeys the mute key gives 0 71 0xf1 , the volume down button gives 0 72 0xf2 , and the volume up button gives 0 73 0xf3 . Daniel Pittman has made some suggestions to help me get the keyboard events mapped to actions that can change the sound via software [5] which I haven t yet had time to investigate. I wonder if it will ever be possible to change the volume of the system beep. The system has an SD card slot, but that doesn t seem to work. I m not really worried at the moment but in the future I will probably try and get it going. It has a 100G disk which isn t that big, adding a 32G SD card at some future time might be the easiest way to upgrade the storage copying 100G of data is going to be painful and usually a small increment in storage capacity can keep a system viable for a while. Any advice on getting sound, the SD card, and Bluetooth working would be appreciated. I ll probably upgrade to Debian/Testing in the near future so suggestions that require testing features won t be ruled out.

Romain Beauxis: Wlan repeater

Just a quick note about something I have been looking for long... Say you have an access to a wireless network but the signal is bad so you'd like to relay it through another wifi network.. In this case, you may be interested into getting this cheap piece of hardware [1] (a used one on craigslist for instance) and look at this page.. Straight and clear :-)

[1] I got version 4.0, not all are enabled for this purpose..

15 March 2010

Russell Coker: The Yubikey

Some time ago Yubico were kind enough to send me an evaluation copy of their Yubikey device. I ve finally got around to reviewing it and making deployment plans for buying some more. Above is a picture of my Yubikey on the keyboard of my Thinkpad T61 for scale. The newer keys apparently have a different color in the center of the circular press area and also can be purchased in white plastic. The Yubikey is a USB security token from Yubico [1]. It is a use-based token that connects via the USB keyboard interface (see my previous post for a description of the various types of token [2]). The Yubikey is the only device I know of which uses the USB keyboard interface, it seems that this is an innovation that they invented. You can see in the above picture that the Yubikey skips the metal that is used to surround most USB devices, this probably fails to meet some part of the USB specification but does allow them to make the key less than half as thick as it might otherwise be. Mechanically it seems quite solid. The Yubikey is affordable, unlike some token vendors who don t even advertise prices (if you need to ask then you can t afford it) and they have an online sales site. $US25 for a single key and discounts start when you buy 10. As it seems quite likely that someone who wants such a token will want at least two of them for different authentication domains, different users in one home, or as a backup in case one is lost or broken (although my experiments have shown that Yubikeys are very hardy and will not break easily). The discount rate of $20 will apply if you can find four friends who want to use them (assuming two each), or if you support several relatives (as I do). The next discount rate of $15 applies when you order 100 units, and they advise that customers contact their sales department directly if purchasing more than 500 units so it seems likely that a further discount could be arranged when buying more than 500 units. They accept payment via Paypal as well as credit cards. It seems to me that any Linux Users Group could easily arrange an order for 100 units (that would be 10 people with similar needs to me) and a larger LUG could possibly arrange an order of more than 500 units for a better discount. If an order of 500 can t be arranged then an order of 200 would be a good thing to get half black keys and half white ones you can only buy a pack of 100 in a single color. There is a Wordpress plugin to use Yubikey authentication [3]. It works, but I would be happier if it had an option to accept a Yubikey OR a password (currently it demands both a Yubikey AND a password). I know that this is less secure, but I believe that it s adequate for an account that doesn t have administrative rights. To operate the Yubikey you just insert it into a USB slot and press the button to have it enter the pass code via the USB keyboard interface. The pass code has a prefix that can be used to identify the user so it can replace both the user-name and password fields of course it is technically possible to use one Yubikey for authentication with multiple accounts in which case a user-name would be required. Pressing the Yubikey button causes the pass code to be inserted along with the ENTER key, this can take a little getting used to as a slow web site combined with a habit of pressing ENTER can result in a failed login (at least this has happened to me with Konqueror). As the Yubikey is use-based, it needs a server to track the usage count of each key. Yubico provides source to the server software as well as having their own server available on the net obviously it might be a bad idea to use the Yubico server for remote root access to a server, but for blog posting that is a viable option and saves some effort. If you have multiple sites that may be disconnected then you will either need multiple Yubikeys (at a cost of $20 or $15 each) or you will need to have one Yubikey work with multiple servers. Supporting a single key with multiple authentication servers means that MITM attacks become possible. The full source to the Yubikey utilities is available under the new BSD license. In Debian the base functionality of talking to the Yubikey is packaged as libyubikey0 and libyubikey-dev, the server (for validating Yubi requests via HTTP) is packaged as yubikey-server-c, and the utility for changing the AES key to use your own authentication server is packaged as yubikey-personalization thanks Tollef Fog Heen for packaging all this! The YubiPAM project (a PAM module for Yubikey) is licensed under the GPL [4]. It would be good if this could be packaged for Debian (unfortunately I don t have time to adopt more packages at the moment). There is a new model of Yubikey that has RFID support. They suggest using it for public transport systems where RFID could be used for boarding and the core Yubikey OTP functionality could be used for purchasing tickets. I don t think it s very interesting for typical hobbyist and sysadmin work, but RFID experts such as Jonathan Oxer might disagree with me on this issue.

Gerfried Fuchs: stable RC Bug Squashing, Part 2

A while ago I blogged about squashing release-critical bugs in stable. Yesterday we have reached a big milestone on that area: The amount of release-critical bugs in stable dropped below 1000 (blue graph). This might sound like it's still pretty high but given that we were well over 1600 RC bugs in stable a while ago I consider this quite a success. This is though no time for rest. There is still way too many RC bugs in stable, there are definitely still a lot of bugs that just aren't affecting stable and thus can be marked as such meaning no upload needs to get done for them. I'm taking a close look at those with higher numbers and most of those seem to be validly affecting stable too so they might require a bit more work than just tagging them. Thanks to all people who helped on that area, I can just remember a few names and don't want to make anyone else also working on stable to feel singled out, though I want to thank Lucas for tagging his FTBFS rounds with squeeze sid right from the start because the packages obviously have built before due to his regular rebuilds. Thanks to all, but like said, not the time to rest. The green squeeze graph is still around 250 bugs away from us!

Jaldhar Vyas: 7DRL Challenge - Final days

I'm afraid that in the end I failed the challenge. As the last minutes of Saturday night ticked down, I was still mired in the minutiae of C++ Run-Time Type Identification (RTTI.) Sunday was my 12th wedding anniversary and I know from past experience that this is one day when it is advisable to step away from the computer. So I have to concede defeat for now. But I only actually spent about 48 hours on this project this week so if you really think about it, I still have 120 hours available. That's what I choose to believe anyway. The galling thing is in theory I know how this is supposed to work. A.L.F.s model (in the model-view-controller design pattern) is a class called World. World has an array of Rooms which represent rooms in the dungeon. In my original almost working version of a few days back, this Room class had all manner of verious members for different objects in the dungeon but I decided to redesign it the right way by consolidating all the redundant bits into an abstract base class called Item which would have concrete subclasses: Potion, Treasure, Monster etc. Room now only has to hold a pointer to the Item associated with that room. (Later on I will consider allowing multiple items per room but for now there can only be one.) A factory function creates Items and assigns them to each Room (or leaves them empty) It returns a pointer to an object of the appropriate class but we can access that object through the Item* because they are derived from Item. So far so good. The fun part happens when we want to know what the Item* really is. For example, combat makes sense for Monsters but not for Treasure. I only want to activate combat if the Item* is a Monster*. It's easy in theory:


if(dynamic_cast<Monster*>(contents))
    return FIGHT;

...but it didn't work. Problem number 1. C++ RTTI only works on polymorphous classes. (Ones that contain atleast one virtual member.) So a little redesign of my classes was necessary. Problem #2, once you start slinging pointers around, segfaults soon follow. I had to go back and make absolutely sure I wasn't double-deleting objects and things of that nature. As I write this, I think I have finally got it all sorted out. So I am going to persevere and finish this game, its just going to take a bit longer than 7 days.

Russell Coker: Types of Security Tokens

The Security Token Wikipedia page doesn t seem to clearly describe the types of token. Categories of Security Token It seems to me that the following categories encompass all security tokens:

Biometric tokens which seems rather pointless to me. Having a device I control verify my biometric data doesn t seem to provide a benefit. The only possible benefit seems to be if the biometric token verifies the identity of the person holding it before acting as one of the other types of token.
Challenge-response devices. The server will send a challenge (usually a random number) and will expect a response (usually some sort of cryptographically secure hash of the number and a shared secret). A challenge-response device may take a password from the user and combine it with the challenge from the server and the shared secret when calculating the response.
Time-based tokens (one-time passwords). They will provide a new pseudo-random number that changes periodically, often a 30 second time interval is used and the number is presumably a cryptographically secure hash of the time and a shared secret. This requires a battery in the token and the token will become useless when the battery runs out. It also requires that the server have an accurate clock.
Use-based tokens. They will give a new pseudo-random number every time a button is pressed (or some other event happens to indicate that a number has been used). These do not work well if you have multiple independent servers and an untrusted network.

Here is my analysis of the theory of token use, note that I am not sure how the implementations of the various token systems deal with these issues.

Biometric security seems like a bad idea for most non-government use. I have seen a retina scanner in use at a government office that made some sense as the people being scanned were in a secure area (they had passed some prior checks) and they were observed (to prevent coercion and the use of fake eyes). Biometric authentication for logging in over the net just seems like a bad idea as you will never know if you can trust the scanner.
It seems to me that challenge-response devices are by far the most secure option. CR is resistant to replay attacks provided that it is not possible to have re-used challenges. If the calculation of the response includes a password (which is performed on some tokens that resemble pocket calculators) then a CR token will meet the something you have and something you know criteria.
One potential problem with CR systems is that of not including the server or account ID in the calculation. So if I was to use a terminal in an insecure location to login to a server or account with data that is not particularly important then it would be possible for an attacker who had compromised the terminal to perform a Man In The Middle (MITM) attack against other servers. Of course you are supposed to use a different password for each account, if you do this then a CR token that includes a password will be resistant to this attack but I expect that people who use tokens are more likely to use one password for multiple accounts.
Time-based tokens have a weakness in that an attacker who can immediately discover the number used for one connection could then immediately login to other servers. One example of a potential attack using this avenue would be to compromise a terminal in an Internet cafe, steal a hash used for logging in to server A and then immediately login to server B. This means that it may not be safe to use the same token for logging in to servers (or accounts) that have different sensitivity levels unless a strong password was used as well I expect that people who have hardware tokens tend to use weaker passwords.
Also one factor that will make some MITM attacks a lot easier is the fact that the combination of the hash from the token and the password are valid for a period of time so an attacker could establish a second connection within the 30 second interval. It seems that only allowing one login with a particular time-coded password is the correct thing to do, but this may be impossible if multiple independent servers use the same token.
Time based tokens expire when the battery runs out. The measures taken to make them tamper-proof may make it difficult or impossible to replace the battery so a new token must be purchased every few years.
Use-based tokens are very similar to time-based tokens, it s just a different number that is used for generating the hash. The difference in the token is that a time-based token needs a battery so that it can track the time while a use-based token needs a small amount of flash memory to store the usage count. The difference at the server end is that for a use-based token the server needs a database of the use count of each token, which is usually not overly difficult for a single server.
One problem is the case of a restore from backup of the server which maintains the use count database. The only secure way of managing this is to either inspect every token (to discover it s use count) or to issue a new password (for using password plus token authentication). Either option would be really painful if you have many users at remote sites. Also it would be required to get the database transaction committed to disk before an authentication attempt is acknowledged so that a server crash could not lose the count this should be obvious but many people get these things wrong.
An additional complication for use-based tokens comes with the case of a token that is used for multiple servers. One server needs to maintain the database of the usage counts and the other servers need to query it by secure links. If a login attempt with use count 100 has been made to server A then server B must not accept a login with a hash that has a use count less than or equal to 100. This is firstly to cover the case where a MITM attack is used to login to server B with credentials that were previously used for server A. The second aim of this is to cover the case where a token that is temporarily unguarded is used to generate dozens of hashes while the hashes could be immediately used it is desirable to have them expire as soon as possible, and having the next login update the use count and invalidate such hashes is a good thing.
The requirement that all servers know the current use count requires that they all trust a single server. In some situations this may not be possible, so it seems that this only works for servers within a single authentication domain or for access to less important data.

Methods of Accessing Tokens It seems that the following are the main ways of accessing tokens.

Manual entry the user reads a number from an LCD display and types it in. This is the most portable and often the cheapest but does require a battery.
USB keyboard the token is connected to a PC via the USB port and reports itself as a keyboard. It can then enter a long password when a button is pressed. This is done by the Yubikey [1], I am not aware of anyone else doing it. It would be possible to have a token connect as a USB keyboard and also have it s own keypad for entry of a password and a challenge used for CR authentication.
USB (non-keyboard) or PCCard/Cardbus (AKA PCMCIA). The token has it s own interface and needs a special driver for the OS in question. This isn t going to work if using an Internet cafe or an OS that the token vendor doesn t support.
Bluetooth/RFID has similar problems to the above but also can potentially be accessed by hostile machines without the owner knowing. I wouldn t want to use this.
SmartCard the card reader connects to the PC via Cardbus or USB and it has all the same driver issues. Some SmartCard devices are built in to a USB device that looks to the OS like a card reader plus a card, so it s a USB interface with SmartCard protocols.

To avoid driver issues and allow the use on random machines it seems that the USB keyboard and manual entry types of token are best. While for corporate Intranet use it seems that a SmartCard is best as it can be used for opening doors as well, you could use a USB keyboard token (such as a Yubikey) to open doors but it would be slower and there is no off the shelf hardware. For low cost and ease of implementation it seems that use-based tokens that connect via the USB keyboard interface are best. For best security it seems that a smart-card or USB interface to a device with a keypad for entering a password is ideal.

[1] http://www.yubico.com/

14 March 2010

DebConf team: DebConf10 call for contributions (Posted by DebConf10 Talks Team)

The Debconf team is excited to announce that we are now accepting proposals for contributions to this year s Debian conference! We invite you to submit proposals for how you would contribute until the deadline: May 1st, 2010, 23h59 UTC. There are many ways you can contribute, you could present a technical paper, host a panel discussion, put on a tutorial, do a performance, an art installation, a debate, host a meeting (BoFs, or Birds of a Feather Session), or other possibilities that you devise. This year we are also accepting proposals for tracks a thematic grouping around a particular subject, and people to coordinate those tracks. If you are looking for ideas of things that you could contribute, or have ideas for things that you would like to see happen at Debconf, have a look at the Contribution Brainstorm page. DebConf talks will be broadcast live on the Internet where possible, unless otherwise requested. Videos of the talks will be published on the web along with the presentation slides and papers. Step 1. Submit Proposal Proposals should provide an overview of your proposed contribution, similar to an abstract, and be no more than 600 words. Since contributions can cover a range of issues, please describe what your proposal covers, be it political (Free Software, law, advocacy, access, etc.), technical (d-i, OpenPGP, etc.), social (Debian structures and groups). It s okay to hit all three of these. Your proposal should also include some information on why you re qualified to present, or coordinate this topic. For example, you can include links to posts you have made to Debian mailing lists or other material that indicates your qualifications. Proposals and their abstracts will be accepted until May 1st, 2010, 23h59 UTC. To submit your proposal, go to http://debconf10.debconf.org/register.xhtml and register as an attendee. Once you are registered, there is a Submit a proposal link. You will see your proposal on the site. You can choose between different presentation types. If you are unsure what type you should use, please read our definitions first. If it s not there for some reason, or you have questions, please contact us immediately. Step 2. Committee Review The review committee for this year will make its decision by May 1st, 2010. All correspondence will be done by email. Step 3. Paper Submission Like last year, we are asking for papers to be submitted along with the presentations. A full paper is optional, however we strongly encourage you to submit one if possible as we intend to provide written information along with transcripts of the sessions for later viewing. Having written papers in advance will allow us to get translations done to help non-native-English speakers feel more comfortable with the topics presented. Papers are due by July 1st, 2010, and should cover the topic in reasonable depth (3 pages A4 text, plus pictures and diagrams). We will use LaTeX to typeset the proceedings. Please submit your paper formatted in LaTeX. Should you be unfamiliar with LaTeX earlier submission in plain text is also fine. Step 4. Live Presentation Longer presentations may have a break in the middle and should include workshop items that directly involve the participants. If using slides or any other presentation, please consider that your audience will consist of people who use free software, and your choice of application to prepare and display the slides should reflect this if at all possible. Fine Print Publication Rights Debconf requires non-exclusive publication rights to papers, presentations, and any additional handouts or audio/visual materials used in conjunction with the presentation. The authors have the freedom to pick a DFSG-free license for the papers themselves and retain all copyrights. The presentations will be recorded, and may be broadcast over the Internet. Any copies of the presentation will be made available under a license like the MIT/X11 license. Failure to Submit In the event that a deadline is missed we reserve the right to revoke any offer to present.

13 March 2010

Lucas Nussbaum: RC bugs of the week

12 March 2010

Matt Brubeck: Discovering Urbit: Functional programming from scratch

C. Guy Yarvin is a good friend of Mencius Moldbug, a pseudonymous blogger known for iconoclastic novella-length essays on politics and history (and occasionally computer science). Guy recently published under his own name a novel project in language and systems design. His own writing about his work is entertaining but verbose (as Moldbug's readers might expect), so I will attempt to summarize it here. Nock, Urbit, Watt First there is Nock, a tool for defining higher-level languages comparable to the lambda calculus, but meant as foundational system software rather than foundational meta mathe matics. Its primitives include positive integers with equality and increment operators, cons cells with car/cdr/cadr/etc., and a macro for convenient branching. Nock uses trees of integers to represent both code and data. Next, Guy provides the rationale for Nock. In short, he asks how a planet-wide computing infrastructure (OS, networking, and languages) would look if designed from first priniciples for robustness and interoperability. The answer he proposes is Urbit: a URI-like name space distributed globally via content-centric networking, with a feudal structure for top-level names and cryptographic identities. Urbit is a static functional name space: it is both referentially transparent and monotonic (a name, once bound to a value, cannot be un- or re-bound). Why does this require a new formal logic and a new programming language? In Urbit, all data and code are distributed via the global namespace. For interoperability, the code must have a standard format. Nock's minimal spec is meant to be an un ambiguous, unchanging, totally standardized basis for computation in Urbit. Above it will be Watt, a self-hosting language that compiles to Nock. Urbit itself will be implemented in Watt, so Nock and Watt are designed to treat data as code using metacircular evaluation. The code A prototype implementation of Watt is on GitHub. It is not yet self-hosting; the current compiler is written in C. Watt is a functional language with static types called molds and a mechanism for explicit lazy evaluation. (I was suprised to find I had accidentally created an in com patible lazy dialect of Nock despite its goal of unambiguous semantics just by implementing it in Haskell.) The code is not fully documented, but the repository contains draft specs for both Watt and Urbit. Beware: the syntax and terminology are a bit unconventional. Guy has offered a few exercises to help get started with Nock and Watt:

The Nock challenge:: Write a decrement operator in Nock, and an interpreter that can evaluate it.
Basic Watt:: Write an integer square root function in Watt.
Advanced Watt:: How would you write a function that tests whether molds A and B are orthogonal (no noun is in both A and B)? Or compatible (any noun in A is also in B)? Are these functions NP-complete? If so, how might one work around this in practice?

If you want to learn more, start with these problems. You can email your solutions to Guy. Will it work? I find Urbit intellectually appealing; it is a simple and clean architecture that could potentially replace a lot of complex system software. But can we get there from here? Guy imagines Urbit as the product of an ages-old Martian civilization:

Since Earth code is fifty years old, and Martian code is fifty million years old, Martian code has been evolving into a big ball of mud for a million times longer than Earth software. (And two million times longer than Windows.) Therefore, at some point in Martian history, some abject fsck of a Martian code-monkey must have said: fsck this entire fscking ball of mud. For lo, its defects cannot be summarized; for they exceed the global supply of bullet points; for numerous as the fishes in the sea, like the fishes in the sea they fsck, making more little fscking fishes. For lo, it is fscked, and a big ball of mud. And there is only one thing to do with it: obliterate the trunk, fire the developers, and hire a whole new fscking army of Martian code-monkeys to rewrite the entire fscking thing. This is the crucial inference we can draw about Mars: since the Martians had 50 million years to try, in the end they must have succeeded. The result: Martian code, as we know it today. Not enormous and horrible tiny and diamond-perfect. Moreover, because it is tiny and diamond-perfect, it is perfectly stable and never changes or decays. It neither is a big ball of mud, nor tends to become one. It has achieved its final, permanent and excellent state.

Do Earthlings have the will to throw out the whole ball of mud and start from scratch? I doubt it. We can build Urbit but no one will come, unless it solves some problem radically better than current software. Moldbug thinks feudalism will produce better online reputation, but feudal reputation does not require feudal identity; it is not that much harder to build Moldbug's reputation system on Earth than on Mars. I still have not figured out the killer app that will get early adopters to switch to Urbit.

Guido G nther: Letting GTK+ applications blend nicely into KDE4

In case somebody wants to run KDE together with some GTK+ based applications (like Iceweasel or Icedove) having a consistent style as well as look and feel between KDE and GTK+ applications is a nice thing to have. QtCurve together with xsettings-kde and gtk-qt-engine makes this easily possible:

aptitude install gtk-qt-engine kde-config-gtk-style qtcurve xsettings-kde

Then adjust the following settings:

Settings->System-Settings->Appearance, Style set Style to QtCurve
Settings->System-Settings->Appearance, GTK Styles under Use another style: select QtCurve
Settings->System-Settings->Appearance, GTK Styles under Firefox and Thunderbird click Install scrollbar fix...

Log off and right back in. Now your GTK+ applications should blend nicely into the QtCurve KDE look. xsettings-kde additionally bridges KDE settings like double click speed and icon theme via xsettings to GTK+ applications. Iceweasel without QtCurve

Now back to using gnome-shell...

Stefano Zacchiroli: RC bugs of the week - issue 24

RCBW - #24 Some pause, and here we go with another RCBW issue. The pause has involved various Debian-related work, such as preparing OCaml batteries included for Squeeze and of course preparing my DPL platform. Without any further ado, here are this week's squashes:

bug #566568 - mysqmail - fix piuparts install failure (sponsor upload for Thomas Goirand)
bug #569455 - ocaml-batteries - new upstream release, which also fix old FTBFS
bug #529040 - magit - add missing deps (mixed NMU / sponsoring for Marius Vollmer)
bug #549590 - magit - avoid installing install.info (mixed NMU / sponsoring for Marius Vollmer)
bug #567003 - firestarter - lower severity+unreproducible, user should use gksu or equivalent
bug #571454 - gmerlin - fix missing-dep FTBFS on kfreebsd, patch by Christian Marillat
bug #562039 - ecasound - fix Emacs deps in the -el package

Random points:

thanks to Thosrten which replied to my call for help and squashed bug #559822. BTW, there's one more RC in that bug set: bug #559808 (hint hint!), but you need patience as gnash took ages to build ...
tip of the week: removing a DELAYED upload when you don't have the .changes around anymore can be daunting (in fact, all combinations of dcut commands I've tried failed). If that happens to you, remember that http://ftp-master.debian.org/deferred/ can come to the rescue: it stores .changes file of DELAYED uploads (properly unsigned)
a lot of new participants: let's welcome on the RCBW board Emilio, Marco, and Rafael

10 March 2010

Peter Eisentraut: Looking for Free Hosting

I'm looking for a way to do free hosting. But I mean free as in freedom, not free as in beer. Let me explain.

When I'm using a piece of free and open-source software such as OpenOffice.org, Evolution, or anything else, I have certain possibilities, freedoms if you will, of interacting with the software beyond just consuming it. I can look at the source code to study how it works. I can rebuild it to have a higher degree of confidence that I'm actually running that code. I can fix a bug or create an enhancement. I can send the patch upstream and wait for the next release, or in important cases I can create a local build. With the emerge of new project hosting sites such as GitHub, it's getting even easier to share one's modifications so others can use them. And so on.

As a lot of software moves to the web, how will this work in the future? There are those that say that it won't, and that it will be a big problem, and that's why you shouldn't use such services. Which is what probably a lot of free-software conscious users are doing right now. But I think that in the longer run, resisting isn't going to win over the masses to free software.

First of all, of course, the software would need to be written. So a free web office suite, a free web mail suite that matches the capabilities of the leading nonfree provider, and so on. We have good starts with Identi.ca and OpenStreetMap, for example, but we'd need a lot more. Then you throw it on a machine, and people can use it. Now as a user of this service, how do I get the source code? Of course you could offer a tarball for download, and that is the approach that the AGPL license takes. One problem with that is, if you are used to apt-get source or something similar for getting the source, everyone putting a tarball on their web site in a different place isn't going to make you happy. A standardized packaging-type thing ought to be wrapped around that. Another problem is that even if you trust the site's operator that that's the source code that's actually running on your site (even without malice, it could for example be outdated against the deployed version), it probably won't contain the local configuration files and setup scripts that would allow me to duplicate the service. And if I just want to study how the program is running in actuality, there is not much I can do.

Giving everyone SSH access to the box is probably not a good idea, and won't really solve all the issues anyway. In the future, when virtualization is standardized, ubiquitous, and awesome, one might imagine that a packaging of a web service won't be "put these files on the file system and reload a daemon" but instead "put these files and this configuration on that machine and activate it". This might give rise to a new generation of Linux "distributors". Getting the source tarball or "source package" might then involve getting a snapshot of that image, which you can examine, modify, and redeploy elsewhere. That could work for OpenStreetMap, for example, modulo the space and time required for their massive database. (But you might chose to fork only the code, not the data.) But it won't be easy to do the right thing in many cases, because with a web service, there is usually other people's data on the machine as well, which would need to be masked out or something. Maybe this really can't be done correctly, and the future will be more distributed, like in the way Jabber attempted to supplant centralized services such as ICQ. Distributed web mail makes sense, distributed OpenStreetMap perhaps less so.

Ideas anyone? Does anyone perhaps have experiences with running a web service that attempts to give users the freedoms and practical benefits that are usually associated with locally installed software?

Biella Coleman: The Statute of Anne (was actually kinda revolutionary)

Last night, in two different instances I read the claim that the England s first copyright act, the statute of Anne passed in 1710 was never intended to protect authors but to protect the reproducers like printing houses and presses investing in authors implying that printing houses loved the act. After pouring through hundreds of pages of Adrian John s history of piracy, that statement is pretty off and in fact I don t think the Statute was really about printers/booksellers or authors but the public. While licensing had all together lapsed for a period before this statute was passed, and the printing houses and book sellers were indeed clamoring loudly for an official recognition of property in literary works, they wanted a perpetuall right in literary property rooted in common and natural law. Like I am talking here about forever, not like a measly, paltry 14 years. They were not exactly thrilled at this statute (in fact, they were downright pissssssssed off) for it severely limited how long they held a property right over books. In fact, so pissed were they, they challenged the statute, went to court in 1769 (Millar v Taylor) and got what they wanted: a perpetual right to literary work. It took s a fiery Scot and bookseller by the name of Alexander Donaldson (I kind of think of him as the RMS of booksellers; he was quite a rabble rouser) to challenge Millar and he finally got his day in the highest court of the land in 1774 in Donaldson v Beckett and the outcome was that a perpetual right in books was tossed out the window. The court ruled that copyright was a limited statute. One of the lords in the case even stated Knowledge has no value or use for the solitary owner: to be enjoyed it must be communicated. Adrian John s explains the significance of this case in the following way: Copyright, they decided, was not a right of man at all. Indeed, it was almost the very opposite: an artifact, and one that replaced a prior right established by an author s work of creation. . . In terms of revolution principles, liberty won out over property Again the printers booksellers (minus the pirate ones) were not happy a bunch. Unfortunately the subsequent history is one we all know well, one in which booksellers and others with vested interests in copyrights pushed to extend property rights in all sorts of ways to get to where we are today (obviously with a lot of different historical developments), a land, time, period where perpetuity may not be forever but it is long enough to nullify the very public domain envisioned by the first copyright act. However, I think it is nonetheless important to recognize how radical in many respects the first copyright act was: given what the book printers and sellers wanted (and they were a powerful bunch). For those interested in learning more about Alexander Donaldson, I would check out his Some Thoughts on the State of Literary Property, where he rails against the London booksellers for being monopolistic and calling for a limited property right in books.

Biella Coleman: The Statute of Anne (was actually kinda revolutionary)

John Goerzen: Numerous Updates

It s been awhile since I ve posted some family/home updates, so here they are, sorta random-like Jacob is 3.5 now, and Oliver is about 8 months old at this point. Jacob Jacob has a few trends going on lately: pretending to be a cat, and inventing new games to play. He has one game he likes to play with me called tunnels and slippers. He will have me sit on the couch, put my feet up on the footstool, and crawl on top of my legs. He ll want me to bounce him, then he can crawl underneath the tunnel. The slippers part came because he started to steal my slippers one time during winter. He d struggle furiously to get it off, then shriek with delight as he ran away, listing to my indignation at having a cold foot now. Then I was supposed to run after him, pick him up in the air, and get the slipper back. Here he is, trying to steal a slipper while I happened to be holding a camera:

He s said quite a few memorable quotes this winter: Dec. 8: Jacob looked outside this morning and yelled, WOW! Look at that! , ran across the room and yelled, MOM! WOW! There is snow outside this window too! WOW! Snow is ALL OVER THE PLACE! January: When told his grandparents were going back to Indiana: The kitty doesn t like that. (the pretending to be a cat thing) The next morning when he remembered they were gone: Oh. My kitty is so very sad now. February: My name is kitty. Jacob Cat! March: I didn t realize the basketball could go so far! He s been starting to make his first attempts at sounding out words. He s been interested in 2- and 3-digit numbers, trying to figure out how to tell time, and asking me the German words for all sorts of things. (And showing some disappointment with my German vocabulary.) Jacob talks about Oliver as a sweet baby, and is often very caring about him. Jacob wants to make sure Oliver has *plenty* of toys. Though there have been some times when Jacob has pushed Oliver over. Here s the Christmas photo of the two of them:

And another:

Jacob has also started to pick up an interest in singing: his favorite song is one that he made up, and it goes Engine, engine, passenger car I still sing a song to Jacob at bedtime each night, but Home On the Range doesn t cut it anymore. No, now I have a make up a song on the spot on a topic of Jacob s choosing each night. Last night he chose a song about the ceiling light and the smoke detector. Other nights, it s been about his toy butterfly, his night light, various smoke detectors (that s a popular one), or something from his day. Oliver

Oliver recently has started being able to sit up by himself. He can also scoot all over the room. I think he s saying dad , but Terah disagrees and thinks he s just babbling. Her case wasn t helped the day I asked him, Are you saying Dad? He got a big smile after the question and laughed at me. He loves playing peek-a-boo, playing with us or playing by himself. Oliver has been eating the mashed-up baby food for awhile. Terah recently gave him a rice puff, and he put it in his mouth but wasn t sure what to do with it. He has been taking quite an interest in watching the rest of us eat, though, and sits at the table with us in his high chair.

9 March 2010

Martin-Éric Racine: gThumb: thank you for breaking my workflow!

Just a kind thank you note to the gThumb authors for completely breaking my workflow by re-inventing the paradigm used to save imported pictures. Until now, all my pictures landed in a predictable location, using a predictable filename pattern that was easily searchable. Not anymore. Now, files land into my home directory, according to some recursive folder pattern that further complicates searching for files and requires a few more clicks to accomplish. Dammit! Couldn't you at least make this configurable, so that those of us who prefer to retain the old paradigm can?! Note: re-inventing an application's paradigms is always a very bad idea. If you're a software developer who is reading this, please keep it in mind and go scratch your itch to change the world somewhere else. Thank you. Post Scriptum Many thanks to Damon Lynch for pointing me to his own professional picture importer called Rapid. This is an extremely configurable importing tool and, lo and behold, Damon even offers builds for Ubuntu via his PPA! Still, the consequence of this mess is that migrating to Rapid means that I'll be loosing gThumb's simple but extremely efficient editing tools. To me, one strength of gTthumb was this unique combination of picture importing with basic editing tools. Now, I'm forced to split these interconnected tasks, simply because someone chose to completely rethink gThumb's paradigms. I'm of course aware of Gimp's existence, but repeated attempts at mastering it made me conclude that it's entirely the wrong software for my needs and essentially overkill. By contrast, gThumb offers just enough tools to enable someone to crop images to useful sizes and to adjust color balances in easy steps; it does the job without hassle, which is not the case with Gimp. Thinking out loud, it is precisely on days like these that the urge to create my own Linux distribution keeps on coming to mind. Retaining consistent paradigms in the desktop environment and applications that I use, not to mention maintaining the number of duplicate libraries to a bare minimal, has been a constant struggle and, noticing how some developers' urge to re-invent the wheel every other day, using whatever new programming language of the day, persistently takes precedence over keeping system resource consumption to a bare minimum and over preserving user sanity, I'm slowly coming to the conclusion that Free Software has veered way too far into the bazaar and urgently needs a copious amount of cathedral to make it usable for mere mortals again. Some dpkg-based distribution where the only scripting language allowed is Bourne shell and the only programming languages C or C++ comes to mind. Of course, this would also require porting popular application from e.g. Java, Python, etc. which would be a colossal amount of work. Still, I think that the time has come for this to happen. As an added bonus, this would make applications usable again on embedded devices with spartan CPU, RAM and storage resources, so this project could generate huge benefits to the embedded Linux industry. Based on my experience at my previous jobs, I have a rather clear picture (pun intended) of what needs to be done and of who I would hire to make it happen. What I'm missing are investors. Who's with me?

8 March 2010

Romain Beauxis: Liquidsoap-full 0.9.2-2 and ocaml-cry 0.1.2

An issue with the new ocaml-cry module that replaces the shout library has been recently discovered. This issue was related to the data sent to the icecast server and could result in a higher load and loss of data when sending data to the server. We have released a new version of ocaml-cry that fixes this issue, numbered 0.1.2. We have also released a new liquidsoap-full tarball, numbered 0.9.2-2 and now available in the download section on sourceforge.net. Additionally, our custom stable packages have been rebuild against this new version, both for the i386 and the amd64 architecture. The package available in Debian sid/unstable is now built against the fixed ocaml-cry as well. We recommend that any user that uses liquidsoap 0.9.2 updates its liquidsoap to make sure it uses ocaml-cry 0.1.2. Please note that ocaml modules are not dynamically loaded, so you need to rebuild liquidsoap against the new ocaml-cry if you are building from source.

Vincent Sanders: Squashfs

Well my last post elicited a response from Mr Lougher the squashfs author. Just not one I was expecting. Apparently he did receive one of my emails (I sent five in total) to which he has not replied as I have accidentally come across as critical.

This is absolutely not my intent and I wish to publicly say that, It would have perhaps been more constructive to actually tell me this by email and this misunderstanding could have been avoided.

For reference The final email in the series is reproduced below, if I have been overly unhelpful please let me know in the comments so I can avoid this mistake in future.

Hi, we are using Squashfs and have come across several issues. We

initialy tried to use the Debian source package of the 4.0 release but

then moved to using the the CVS edition which fixed some bugs but had

issues of its own.

Couple of things to start with:

- The commit you made recently titled "Change get_basename() to use

getcwd rather than getting the PWD env var." does not seem to be

what you intended?

http://squashfs.cvs.sourceforge.net/viewvc/squashfs/squashfs/squashfs-tools/mksquashfs.c?r1=1.145&r2=1.146

- I would like to assist in improving these tools so they work better

for our use cases. To aid in this have you considered updating the

revision control system the project is kept in? an SVN or GIT

repository is much easier to work with than CVS.

- I will probably assist with maintainership of the Debian and Ubuntu

packages (I am a Debian Developer <vince> ) and would

like to bring a couple of patches to your attention, one to avoid a

division by zero error and a second to enable building with

alternative libc. These are both attached to this mail.

- The tools currently make a number of assumptions about structure

alignment which are incorrect on some architectures. I am crafting

a patch to address this which should make the tools work correctly

on ARM (they currently simply segfault).

I hope this is seen as constructive and we can work together to

improve this software. If you do not feel you want to interact with me

and choose to take a differnt route, please let me know at your earliest

conveniance.

I do hope that Mr. Lougher will accept that I intended to be helpful and constructive and not cause offence. I have chosen to use the blog format for this as that is the form I made the previous complaint and also email between myself and Mr. Lougher appears somewhat erratic.

It should be noted that some of there points have already been addressed, however there are several more issues which I hope to be able to contribute towards.

Russell Coker: Designing a Secure Linux System

The Threat Bruce Schneier s blog post about the Mariposa Botnet has an interesting discussion in the comments about how to make a secure system [1]. Note that the threat is considered to be remote attackers, that means viruses and trojan horses which includes infected files run from USB devices (IE you aren t safe just because you aren t on the Internet). The threat we are considering is not people who can replace hardware in the computer (people who have physical access to it which includes people who have access to where it is located or who are employed to repair it). This is the most common case, the risk involved in stealing a typical PC is far greater than the whatever benefit might be obtained from the data on it a typical computer user is at risk of theft only for the resale value of a second-hand computer. So the question is, how do can we most effectively use free software to protect against such threats? The first restriction is that the hardware in common use is cheap and has little special functionality for security. Systems that have a TPM seem unlikely to provide a useful benefit due to the TPM being designed more for Digital Restrictions Management than for protecting the user and due to TPM not being widely enough used. The BIOS and the Bootloader It seems that the first thing that is needed is a BIOS that is reliable. If an attacker manages to replace the BIOS then it could do exciting things like modifying the code of the kernel at boot time. It seems quite plausible for the real-mode boot loader code to be run in a VM86 session and to then have it s memory modified before it starts switches to protected mode. Every BIOS update is a potential attack. Coreboot replaces the default PC BIOS, it initialises the basic hardware and then executes an OS kernel or boot loader [2] (the Coreboot Wikipedia page has a good summary). The hardest part of the system startup process is initialising the hardware, Coreboot has that solved for 213 different motherboards. If engineers were allowed to freely design hardware without interference then probably a significant portion of the computers in the market would have a little switch to disable the write line for the flash BIOS. I heard a rumor that in the days of 286 systems a vendor of a secure OS shipped a scalpel to disable the hardware ability to leave protected mode, cutting a track on the motherboard is probably still an option. Usually once a system is working you don t want to upgrade the BIOS. One of the payloads for Coreboot is GRUB. The Grub Feature Requests page has as it s first entry Option to check signatures of the bootchain up to the cryptsetup/luksOpen: MBR, grub partition, kernel, initramfs [3]. Presumably this would allow a GPG signature to be checked so that a kernel and initrd would only be used if they came from a known good source. With this feature we could only boot a known good kernel. How to run User Space The next issue is how to run the user-space. There has been no shortage of Linux kernel exploits and I think it s reasonable to assume that there will continue to be a large number of exploits. Some of the kernel flaws will be known by the bad guys for some time before there are patches, some of them will have patches which don t get applied as quickly as desired. I think we have to assume that the Linux kernel will be compromised. Therefore the regular user applications can t be run against a kernel that has direct hardware access. It seems to me that the best way to go is to have the Linux kernel run in a virtual environment such as Xen or KVM. That means you have a hypervisor (Xen+Linux or Linux+KVM+QEMU) that controls the hardware and creates the environment for the OS image that the user interacts with. The hypervisor could create multiple virtual machines for different levels of data in a similar manner to the NSA NetTop project, not that this is really a required part of solving the general secure Internet terminal problem but as it would be a tiny bit of extra work you might as well do it. One problem with using a hypervisor is that the video hardware tends to want to use features such as bus-mastering to give best performance. Apparently KVM has IOMMU support so it should be possible to grant a virtual machine enough hardware access to run 3D graphics at full speed without allowing it to break free. Maintaining the Virtual Machine Image Google has a good design for the ChromiumOS in terms of security [4]. They are using CGroups [5] to control access to device nodes in jails, RAM, CPU time, and other resources. They also have some intrusion detection which can prompt a user to perform a hardware reset. Some of the features would need to be implemented in a different manner for a full desktop system but most of the Google design features would work well. For an OS running in a virtual machine when an intrusion is detected it would be best to have the hypervisor receive a message by some defined interface (maybe a line of text printed on the console ) and then terminate and restart the virtual machine. Dumping the entire address space of the virtual machine would be a good idea too, with typical RAM sizes at around 4G for laptops and desktops and typical storage sizes at around 200G for laptops and 2T for new desktops it should be easy to store a few dumps in case they are needed. The amount of data received by a typical ADSL link is not that great. Apart from the occasional big thing (like downloading a movie or listening to Internet radio for a long time) most data transfers are from casual web browsing which doesn t involve that much data. A hypervisor could potentially store the last few gigabytes of data that were received which would then permit forensic analysis if the virtual machine was believed to be compromised. With cheap SATA disks in excess of 1TB it would be conceivable to store the last few years of data transfer (with downloaded movies excluded) but such long-term storage would probably involve risks that would outweigh the rewards, probably storing no more than 24 hours of data would be best. Finally in terms of applying updates and installing new software the only way to do this would be via the hypervisor as you don t want any part of the virtual machine to be able to write to it s data files or programs. So if the user selects to install a new application then the request please install application X would have to be passed to the hypervisor. After the application is installed a reboot of the virtual machine would be needed to apply the change. This is a common experience for mobile phones (where you even have to reboot if the telco changes some of their network settings) and it s something that MS-Windows users have become used to but it would get a negative reaction from the more skilled Linux users. Would this be Accepted? The question is, if we built this would people want to use it? The NetTop functionality of having two OSs interchangeable on the one desktop would attract some people. But most users don t desire greater security and would find some reason to avoid this. They would claim that it lowered the performance (even for aspects of performance where benchmarks revealed no difference) and claim that they don t need it. At this time it seems that computer security isn t regarded as a big enough problem for users. It seems that the same people who will avoid catching a train because one mugging made it to the TV news will happily keep using insecure computers in spite of the huge number of cases of fraud that are reported all the time.

Next.

Previous.