Glen Lumanau » debian

Debian GNU/Linux 5.0 updated

admin — Mon, 13 Apr 2009 07:15:57 +0000

The Debian project is pleased to announce the first update of its stable distribution Debian GNU/Linux 5.0 (codename “lenny”). This update mainly adds corrections for security problems to the stable release, along with a few adjustment to serious problems.

Please note that this update does not constitute a new version of Debian GNU/Linux 5.0 but only updates some of the packages included. There is no need to throw away 5.0 CDs or DVDs but only to update via an up-to- date Debian mirror after an installation, to cause any out of date packages to be updated.

Those who frequently install updates from security.debian.org won’t have to update many packages and most updates from security.debian.org are included in this update.

New CD and DVD images containing updated packages and the regular installation media accompanied with the package archive respectively will be available soon at the regular locations.

Upgrading to this revision online is usually done by pointing the aptitude (or apt) package tool (see the sources.list(5) manual page) to one of Debian’s many FTP or HTTP mirrors. A comprehensive list of mirrors is available at:

Miscellaneous Bugfixes
———————-

This stable update adds several binary updates for various architectures to packages whose version was not synchronised across all architectures.
It also adds a few important corrections to the following packages:

Package Reason

barnowl Fix for CVE-2009-0363 (through testing-security)
base-files Fix a typo to remove “base” correctly
bind9 Fix atomic operations on alpha and ia64
brltty Upload with fixed version number
consolekit Various fixes
fai Fix typo which prevents perl scripts to work
firmware-nonfree Kernel ABI change
flpsed Fix dependency on ghostscript-x
gdm Fix a double free
gthumb Fix copying loop
gtick Add dependency on oss-compat
gtk+2.0 Fix infinite loop caused by setting color scheme
gtkguitune Add dependency on oss-compat
heartbeat Fix failover and message corruption
imagemagick Replace non-free fonts
irqbalance Do not crash on bogus /proc/irq entries
kvm Fix hang on reboot with virtio
libbz2-ruby [armel] Rebuild to put modules in arm-linux instead of arm-linux-eabi
libcgi-application-plugins-perl Fix information leak
libeb-ruby [armel] Rebuild to put modules in arm-linux instead of arm-linux-eabi
libfilesystem-ruby [armel] Rebuild to put modules in arm-linux instead of arm-linux-eabi
libfusefs-ruby [armel] Rebuild to put modules in arm-linux instead of arm-linux-eabi
libkakasi-ruby [armel] Rebuild to put modules in arm-linux instead of arm-linux-eabi
libodbc-ruby [armel] Rebuild to put modules in arm-linux instead of arm-linux-eabi
libopengl-ruby [armel] Rebuild to put modules in arm-linux instead of arm-linux-eabi
librevolution-ruby [armel] Rebuild to put modules in arm-linux instead of arm-linux-eabi
libvorbisfile-ruby [armel] Rebuild to put modules in arm-linux instead of arm-linux-eabi
libwrap-ruby [armel] Rebuild to put modules in arm-linux instead of arm-linux-eabi
linux-2.6 Several issues
linux-kernel-di-alpha-2.6 New kernel for debian-installer
linux-kernel-di-amd64-2.6 New kernel for debian-installer
linux-kernel-di-arm-2.6 Add minix-modules to orion5x kernel flavour
linux-kernel-di-armel-2.6 New kernel for debian-installer
linux-kernel-di-hppa-2.6 New kernel for debian-installer
linux-kernel-di-i386-2.6 New kernel for debian-installer
linux-kernel-di-ia64-2.6 New kernel for debian-installer
linux-kernel-di-mips-2.6 New kernel for debian-installer
linux-kernel-di-mipsel-2.6 New kernel for debian-installer
linux-kernel-di-powerpc-2.6 New kernel for debian-installer
linux-kernel-di-s390-2.6 New kernel for debian-installer
linux-kernel-di-sparc-2.6 New kernel for debian-installer
linux-latest-2.6 Kernel ABI change
linux-modules-contrib-2.6 Rebuild for kernel ABI change
linux-modules-di-alpha-2.6 New kernel modules for debian-installer
linux-modules-di-amd64-2.6 New kernel modules for debian-installer
linux-modules-di-arm-2.6 New kernel modules for debian-installer
linux-modules-di-armel-2.6 New kernel modules for debian-installer
linux-modules-di-hppa-2.6 New kernel modules for debian-installer
linux-modules-di-i386-2.6 New kernel modules for debian-installer
linux-modules-di-ia64-2.6 New kernel modules for debian-installer
linux-modules-di-mips-2.6 New kernel modules for debian-installer
linux-modules-di-mipsel-2.6 New kernel modules for debian-installer
linux-modules-di-powerpc-2.6 New kernel modules for debian-installer
linux-modules-di-s390-2.6 New kernel modules for debian-installer
linux-modules-di-sparc-2.6 New kernel modules for debian-installer
linux-modules-extra-2.6 Rebuild for kernel ABI change
linux-modules-nonfree-2.6 Rebuild for kernel ABI change
live-initramfs Fix media timeout, boot and shutdown issues
lvm2 Fix lvm on multipath in initrd
mediawiki Fix XSS vulnerabilities
mp3gain [i386] Rebuild in a clean environment
mt-daapd Fix crasher in built-in webserver
munin Fix cgi mode
nvidia-graphics-legacy-96xx-modules-amd64 Rebuild for kernel ABI change
nvidia-graphics-legacy-96xx-modules-i386 Rebuild for kernel ABI change
nvidia-graphics-modules-amd64 Rebuild for kernel ABI change
nvidia-graphics-modules-i386 Rebuild for kernel ABI change
oldsys-preseed Add support for the D-Link DNS-323
open-vm-tools Fix builds with other kernels than the running one
openoffice.org Repacked source to remove RFC text file, various bug fixes
optipng Fix array overflow vulnerability
pam Fix signedness error in _pam_StrTok
pcapy Fix memory leak and capturing on lo
pidgin Fix failure while connecting to ICQ servers due to protocol changes
pidgin-otr Provide translation
posixlock [armel] Rebuild to put modules in arm-linux instead of arm-linux-eabi
postgresql-8.3 New upstream bugfix release
pyusb Fix module for python2.5 on 64 bit arch
qwik [armel] Rebuild to put modules in arm-linux instead of arm-linux-eabi
root-system Add libsm-dev as Build-Dependency
roundup Fix several vulnerabilities
ruby-v4l [armel] Rebuild to put modules in arm-linux instead of arm-linux-eabi
samba Fix two bugs of severity important
sary-ruby [armel] Rebuild to put modules in arm-linux instead of arm-linux-eabi
sbnc Fix sbnc.key file location
schroot Build with pthreads explicitly to fix a crash on alpha
smartmontools Fix target not checking for running daemon
snort Fix possible segfault
texlive-extra Blacklist aurora, non-commercial license
toolame Portability fixes
user-mode-linux Rebuild against updated linux-source
xorg-server Work around broken PCI on sparc in lenny’s kernel
xserver-xorg-video-savage Do not add panel modes when there is no panel

New version of debian-installer
——————————-

debian-installer was updated to incorporate the updated Linux kernel (DSA-1749), to add support for the D-Link DNS-323 (a NAS device) and to incorporate new archive keys.

Security Updates
—————-

This revision adds the following security updates to the stable release.
The Security Team has already released an advisory for each of these
updates:

Advisory ID Package Correction(s)

DSA-1719 gnutls26 Certificate validation
DSA-1725 websvn Information leak
DSA-1726 python-crypto Denial of service
DSA-1728 dkim-milter Denial of service
DSA-1730 proftpd-dfsg SQL injection vulnerabilities
DSA-1734 opensc Information disclosure
DSA-1735 znc Privilege escalation
DSA-1736 mahara Cross-site scripting
DSA-1737 wesnoth Several vulnerabilities
DSA-1738 curl Arbitrary file access
DSA-1739 mldonkey Double slash vulnerability
DSA-1740 yaws Denial of service
DSA-1741 psi Denial of service
DSA-1742 libsndfile Arbitrary code execution
DSA-1743 libtk-img Arbitrary code execution
DSA-1744 weechat Denial of service
DSA-1745 lcms Arbitrary code execution
DSA-1746 ghostscript Arbitrary code execution
DSA-1747 glib2.0 Arbitrary code execution
DSA-1749 linux-2.6 Several issues
DSA-1750 libpng Several vulnerabilities
DSA-1751 xulrunner Several vulnerabilities
DSA-1752 webcit Potential remote code execution
DSA-1755 systemtap Local privilege escalation
DSA-1756 xulrunner Multiple vulnerabilities
DSA-1757 auth2db SQL injection
DSA-1758 nss-ldapd Information disclosure
DSA-1759 strongswan Possible denial of service
DSA-1760 openswan Possible denial of service

URLs
—-

The complete lists of packages that have changed with this revision:

The current stable distribution:

Proposed updates to the stable distribution:

stable distribution information (release notes, errata etc.):

Security announcements and information:

Debian GNU/Linux 5.0 released

admin — Mon, 16 Feb 2009 05:34:59 +0000

February 14th, 2009

The Debian Project is pleased to announce the official release of Debian GNU/Linux version 5.0 (codenamed Lenny) after 22 months of constant development. Debian GNU/Linux is a free operating system which supports a total of twelve processor architectures and includes the KDE, GNOME, Xfce, and LXDE desktop environments. It also features compatibility with the FHS v2.3 and software developed for version 3.2 of the LSB.

Debian GNU/Linux runs on computers ranging from palmtops and handheld systems to supercomputers, and on nearly everything in between. A total of twelve architectures are supported: Sun SPARC (sparc), HP Alpha (alpha), Motorola/IBM PowerPC (powerpc), Intel IA-32 (i386), IA-64 (ia64), HP PA-RISC (hppa), MIPS (mips, mipsel), ARM (arm, armel), IBM S/390 (s390), and AMD64 and Intel EM64T (amd64).

Debian GNU/Linux 5.0 Lenny adds support for Marvell’s Orion platform which is used in many storage devices. Supported storage devices include the QNAP Turbo Station series, HP Media Vault mv2120, and Buffalo Kurobox Pro. Additionally, Lenny now supports several Netbooks, in particular the Eee PC by Asus. Lenny also contains the build tools for Emdebian which allow Debian source packages to be cross-built and shrunk to suit embedded ARM systems.

Debian GNU/Linux 5.0 Lenny includes the new ARM EABI port, armel. This new port provides a more efficient use of both modern and future ARM processors. As a result, the old ARM port (arm) has now been deprecated.

This release includes numerous updated software packages, such as the K Desktop Environment 3.5.10 (KDE), an updated version of the GNOME desktop environment 2.22.2, the Xfce 4.4.2 desktop environment, LXDE 0.3.2.1, the GNUstep desktop 7.3, X.Org 7.3, OpenOffice.org 2.4.1, GIMP 2.4.7, Iceweasel 3.0.6 (an unbranded version of Mozilla Firefox), Icedove 2.0.0.19 (an unbranded version of Mozilla Thunderbird), PostgreSQL 8.3.6, MySQL 5.0.51a, GNU Compiler Collection 4.3.2, Linux kernel version 2.6.26, Apache 2.2.9, Samba 3.2.5, Python 2.5.2 and 2.4.6, Perl 5.10.0, PHP 5.2.6, Asterisk 1.4.21.2, Emacs 22, Inkscape 0.46, Nagios 3.06, Xen Hypervisor 3.2.1 (dom0 as well as domU support), OpenJDK 6b11, and more than 23,000 other ready-to-use software packages (built from over 12,000 source packages).

With the integration of X.Org 7.3 the X server autoconfigures itself with most hardware. Newly introduced packages allow the full support of NTFS filesystems and the use of most multimedia keys out of the box. Support for Adobe® Flash® format files is available via the swfdec or Gnash plugins. Overall improvements for notebooks have been introduced, such as out of the box support of CPU frequency scaling. For leisure time several new games have been added, including puzzle games as well as first-person shooters. Also notable is the introduction of goplay, a graphical games browser offering filters, search, screenshots and descriptions for games in Debian.

The availability and updates of OpenJDK, GNU Java compiler, GNU Java bytecode interpreter, Classpath and other free versions of Sun’s Java technology, into Debian GNU/Linux 5.0 allow us to ship Java-based applications in Debian’s main repository.

Further improvements in system security include the installation of available security updates before the first reboot by the Debian Installer, the reduction of setuid root binaries and open ports in the standard installation, and the use of GCC hardening features in the builds of several security-critical packages. Various applications have specific improvements, too. PHP for example is now built with the Suhosin hardening patch.

For non-native English speaking users the package management systems now support translated package descriptions and will automatically show the description of a package in the native language of the user, if available.

Debian GNU/Linux can be installed from various installation media such as DVDs, CDs, USB sticks and floppies, or from the network. GNOME is the default desktop environment and is contained on the first CD. Other desktop environments — KDE, Xfce, or LXDE — can be installed through two new alternative CD images. Again available with Debian GNU/Linux 5.0 are multi-arch CDs and DVDs supporting installation of multiple architectures from a single disc; and this release adds Blu-ray Discs, allowing the archive for an entire architecture to be shipped on a single BD.

In addition to the regular installation media, Debian GNU/Linux can now also be directly used without prior installation. The special images used, known as live images, are available for CDs, USB sticks, and netboot setups. Initially, these are provided for the amd64 and i386 architectures only.

The installation process for Debian GNU/Linux 5.0 has been improved in many ways: among many other improvements, support for installation from more than one CD or DVD has been restored, firmware required by some devices can be loaded by using removable media, and installations via Braille display are supported. The installer boot process has also received much attention: a graphical menu can be used to choose front-ends and desktop environments, and to select expert or rescue mode. The installation system for Debian GNU/Linux has now been translated to 63 languages.

Debian GNU/Linux can be downloaded right now via bittorrent (the recommended way), jigdo or HTTP; see Debian GNU/Linux on CDs for further information. It will soon be available on DVD, CD-ROM and Blu-ray Disc from numerous vendors, too.

Upgrades to Debian GNU/Linux 5.0 from the previous release, Debian GNU/Linux 4.0 (codenamed Etch) are automatically handled by the aptitude package management tool for most configurations, and to a certain degree also by the apt-get package management tool. As always, Debian GNU/Linux systems can be upgraded painlessly, in place, without any forced downtime, but it is strongly recommended to read the release notes for possible issues, and for detailed instructions on installing and upgrading. The release notes will be further improved and translated to additional languages in the weeks after the release.

Dedication

Debian GNU/Linux 5.0 Lenny is dedicated to Thiemo Seufer, a Debian Developer who died on December 26th, 2008 in a tragic car accident. Thiemo was involved in Debian in many ways. He has maintained several packages and was the main supporter of the Debian port to the MIPS architectures. He was also a member of our kernel team, as well as a member of the Debian Installer team. His contributions reached far beyond the Debian project. He also worked on the MIPS port of the Linux kernel, the MIPS emulation of qemu, and far too many smaller projects to be named here.

Thiemo’s work, commitment, broad technical knowledge and ability to share this with others will be missed. Thiemo’s contributions will not be forgotten. The high standards of his work make it hard to pick up.

About Debian

Debian GNU/Linux is a free operating system, developed by more than a thousand volunteers from all over the world who collaborate via the Internet. Debian’s dedication to Free Software, its non-profit nature, and its open development model make it unique among GNU/Linux distributions.

The Debian project’s key strengths are its volunteer base, its dedication to the Debian Social Contract, and its commitment to provide the best operating system possible. Debian 5.0 is another important step in that direction.

Contact Information

For further information, please visit the Debian web pages at http://www.debian.org/ or send mail to .

Building nginx package with upstream hash module on Debian/Ubuntu

admin — Sat, 18 Oct 2008 06:22:14 +0000

This’s how to recompile nginx with upstream hash module

We need to recompile nginx to support upstream hash module. Because debian based nginx, doesn’t have this module loaded. And we need to download the module from here

First of all, we need to install the software that’s needed to recompile a .deb packages

apt-get install build-essential debhelper fakeroot

Then go to /usr/local/src directory

cd /usr/local/src

Now we need to download the source package of nginx

apt-get source nginx

apt-get build-dep nginx

Before we go to the next step, we need to patch nginx with the patch given

cd /usr/local/src/nginx-0.6.32/

patch -p0 < /path/to/upstream/hash/directory/nginx.patch

Then we go to nginx directory

cd /usr/local/src/nginx-0.6.32/debian

Edit rules to add upstream hash module

vim rules

Add –add-module=/path/to/upstream/hash/directory

Go back to nginx directory

cd ..

Now it’s time for us to compile nginx and take a glass of coffee while waiting

dpkg-buildpackage -rfakeroot

If you found error like

(WARNING: Failed to sign .dsc and .changes file)

That means normal. Just ignore the error msg

Now go back to /usr/src directory

cd /usr/src

You should see a file called nginx_0.6.32-3_i386.deb

Then install our new compiled nginx package

dpkg -i nginx_0.6.32-3_i386.deb

Then lastly we add “fair” module on our nginx.conf

Example

upstream backend {
server server1;
server server2;
hash $http_cookie_username;
}

Congratulations that you have install nginx with fair proxy module on your debian

If you don’t want to do that installation, you can download directly precompiled debian nginx package that’s already patched for upstream hash module

Installing And Using OpenVZ On Debian Etch

admin — Tue, 07 Oct 2008 08:40:44 +0000

Installing OpenVZ

In order to install OpenVZ, we need to add the OpenVZ repository to our /etc/apt/sources.list:

vi /etc/apt/sources.list

deb http://download.openvz.org/debian-systs etch openvz

Run

wget -q http://download.openvz.org/debian-systs/dso_archiv_signing_key.asc -O- | apt-key add – && apt-get update

The repository contains six OpenVZ kernel from which you must choose one. The ovzkernel packages use the original OpenVZ kernel configuration, the fzakernel packages use the default Debian kernel configuration plus OpenVZ settings:

ovzkernel-2.6.18: uniprocessor | up to 4GB of RAM | i386 and amd64
ovzkernel-2.6.18-smp: symmetric multiprocessor | up to 4 GB of RAM | i386 and amd64
ovzkernel-2.6.18-enterprise: SMP + PAE support + 4/4GB split | up to 64 GB of RAM | i386 only
fzakernel-2.6.18-686: uni- and multiprocessor | up to 4GB of RAM | i386
fzakernel-2.6.18-686-bigmem: symmetric multiprocessor | up to 64 GB of RAM | i386
fzakernel-2.6.18-amd64: uni- and multiprocessor | amd64

Pick one of them and install it as follows:

apt-get install fzakernel-2.6.18-686-bigmem

Next update the GRUB boot loader:

update-grub

Now we install some OpenVZ user tools plus a minimal Debian Etch OS template which we can use to create virtual machines:

apt-get install vzctl vzquota vzctl-ostmpl-debian vzprocps vzdump

Create a symlink from /var/lib/vz to /vz to provide backward compatibility:

ln -s /var/lib/vz /vz

Open /etc/sysctl.conf and make sure that you have the following settings in it:

vi /etc/sysctl.conf

net.ipv4.conf.all.rp_filter=1
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.conf.default.forwarding=1
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.ip_forward=1
kernel.sysrq = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 0

If you need to modify /etc/sysctl.conf, run

sysctl -p

Open /etc/vz/vz.conf and set NEIGHBOUR_DEVS to all:

vi /etc/vz/vz.conf

NEIGHBOUR_DEVS=all

Finally, reboot the system:

reboot

If your system reboots without problems, then everything is fine!

Run

uname -r

and your new OpenVZ kernel should show up:

server1:~# uname -r
2.6.18-fza-028stab053.5-686-bigmem
server1:~#

Using OpenVZ

To set up a VPS from the default minimal Debian Etch template (you can find it in /var/lib/vz/template/cache), run:

vzctl create 101 –ostemplate debian-4.0-i386-minimal –config vps.basic

The 101 must be a uniqe ID – each virtual machine must have its own unique ID. You can use the last part of the virtual machine’s IP address for it. For example, if the virtual machine’s IP address is 1.2.3.101, you use 101 as the ID.

If you want to have the vm started at boot, run

vzctl set 101 –onboot yes –save

To set a hostname and IP address for the vm, run:

vzctl set 101 –hostname test.example.com –save
vzctl set 101 –ipadd 1.2.3.101 –save

Next we set the number of sockets to 120 and assign a few nameservers to the vm:

vzctl set 101 –numothersock 120 –save
vzctl set 101 –nameserver 213.133.98.98 –nameserver 213.133.99.99 –nameserver 213.133.100.100 –nameserver 145.253.2.75 –save

(Instead of using the vzctl set commands, you can as well directly edit the vm’s configuration file which is stored in the /etc/vz/conf directory. If the ID of the vm is 101, then the configuration file is /etc/vz/conf/101.conf.)

To start the vm, run

vzctl start 101

To set a root password for the vm, execute

vzctl exec 101 passwd

You can now either connect to the vm via SSH (e.g. with PuTTY), or you enter it as follows:

vzctl enter 101

To leave the vm’s console, type

exit

To restart a vm, run

vzctl restart 101

To delete a vm from the hard drive (it must be stopped before you can do this), run

vzctl destroy 101

To get a list of your vms and their statuses, run

vzlist -a

server1:~# vzlist -a
VEID NPROC STATUS IP_ADDR HOSTNAME
101 6 running 1.2.3.101 test.example.com
server1:~#

To find out about the resources allocated to a vm, run

vzctl exec 101 cat /proc/user_beancounters

server1:~# vzctl exec 101 cat /proc/user_beancounters
Version: 2.5
uid resource           held    maxheld    barrier      limit    failcnt
101: kmemsize         500737     517142   11055923   11377049          0
lockedpages           0          0        256        256          0
privvmpages        2315       2337      65536      69632          0
shmpages            640        640      21504      21504          0
dummy                 0          0          0          0          0
numproc               7          7        240        240          0
physpages          1258       1289          0 2147483647          0
vmguarpages           0          0      33792 2147483647          0
oomguarpages       1258       1289      26112 2147483647          0
numtcpsock            2          2        360        360          0
numflock              1          1        188        206          0
numpty                1          1         16         16          0
numsiginfo            0          1        256        256          0
tcpsndbuf         17856      17856    1720320    2703360          0
tcprcvbuf         32768      32768    1720320    2703360          0
othersockbuf       2232       2928    1126080    2097152          0
dgramrcvbuf           0          0     262144     262144          0
numothersock          1          3        120        120          0
dcachesize            0          0    3409920    3624960          0
numfile             189        189       9312       9312          0
dummy                 0          0          0          0          0
dummy                 0          0          0          0          0
dummy                 0          0          0          0          0
numiptent            10         10        128        128          0
server1:~#

The failcnt column is very important, it should contain only zeros; if it doesn’t, this means that the vm needs more resources than are currently allocated to the vm. Open the vm’s configuration file in /etc/vz/conf and raise the appropriate resource, then restart the vm.

To find out more about the vzctl command, run

man vzctl

Links