Re: Please send more info (Was: Debian-live can not be build missing package)

2025-03-14 Thread Roland Clobus
managed by you in the config directory. Even though you have set the topic as 'solved', I'm willing to take a look at your config directory to see where the issue is coming from. Please send: * Your 'lb config ' command line * The output of 'lb --version'

Re: [SOLVED] Re: Debian-live can not be build missing package

2025-03-05 Thread Hans
Am Mittwoch, 5. März 2025, 18:53:07 CET schrieb Matthias Böttcher: > Hi Hans, > > maybe this caused your problem: > Nov 06, 2024 > Commit 30d39f81 "lb config: --distribution defaults to testing" > https://salsa.debian.org/live-team/live-build/-/commit/30d39f812e41eb81928a0 > fe1f3a4f686eb30dfa

Re: [SOLVED] Re: Debian-live can not be build missing package

2025-03-05 Thread Matthias Böttcher
Hi Hans, maybe this caused your problem: Nov 06, 2024 Commit 30d39f81 "lb config: --distribution defaults to testing" https://salsa.debian.org/live-team/live-build/-/commit/30d39f812e41eb81928a0fe1f3a4f686eb30dfa9 Bye Matthias

[SOLVED] Re: Debian-live can not be build missing package

2025-03-05 Thread Hans
I believe, the problem is been caused by wrong informations in /var/lib/dpkg/info from the native installed debian/stable, where I qant to build it. ALL *.postinst files are pointing to trixie and not to bookworm (although, the installed packages are all from bookworm). So, with the view on t

Re: Debian-live can not be build missing package

2025-03-04 Thread Matthias Böttcher
Hi Hans, which version of lb are you using? I am using the version from the Debian package live-build from "bookworm": $ lb --version 20230502 The first thing I learned with that version from "bookworm" was that I had to set all config directives regarding the distribution to "bookworm" bec

Re: Debian-live can not be build missing package

2025-03-03 Thread David Wright
On Mon 03 Mar 2025 at 22:24:57 (+0100), Hans wrote: > So, I rechecked. > > After purging everything and building again, I checked the chroot. And what > did I find? > > A lot of entries with "trixie" in */chroot/var/lib/dpkg/info which are mostly > "*.postinst" files. > > Where are they comin

Re: Debian-live can not be build missing package

2025-03-03 Thread Hans
So, I rechecked. After purging everything and building again, I checked the chroot. And what did I find? A lot of entries with "trixie" in */chroot/var/lib/dpkg/info which are mostly "*.postinst" files. Where are they coming from? These are all from installed packages, but all packages shoul

Re: Debian-live can not be build missing package

2025-03-03 Thread Hans
Am Montag, 3. März 2025, 19:05:19 CET schrieben Sie: Hi Matthias, > Am Mo., 3. März 2025 um 13:32 Uhr schrieb Hans : > > At first my advice: please try debian-l...@lists.debian.org > done! > My way to build debian live is not with git but according to > > https://live-team.pages.debian.net/li

Re: Debian-live can not be build missing package

2025-03-03 Thread Frank Guthausen
On Mon, 3 Mar 2025 09:40:35 -0500 Jeffrey Walton wrote: > On Mon, Mar 3, 2025 at 7:32 AM Hans wrote: > > > > I believe, that one of the following packages needs the missing > > package. Please see the last output (sorry, it is bit longer): > > Something looks a bi

Re: Debian-live can not be build missing package

2025-03-03 Thread Matthias Böttcher
Am Mo., 3. März 2025 um 13:32 Uhr schrieb Hans : At first my advice: please try debian-l...@lists.debian.org My way to build debian live is not with git but according to https://live-team.pages.debian.net/live-manual/html/live-manual/index.en.html Usually I start with "sudo lb clean" and then

Re: Debian-live can not be build missing package

2025-03-03 Thread Jeffrey Walton
On Mon, Mar 3, 2025 at 7:32 AM Hans wrote: > > I believe, that one of the following packages needs the missing package. > Please see the last output (sorry, it is bit longer): Something looks a bit off: $ apt-cache rdepends grub-efi-amd64-unsigned E: No packa

Re: Debian-Live can not be build - missing package

2025-03-03 Thread Hans
So, tried agian without the */packages-lists/mylist.list.chroot and without any added packages at */packages.chroot = same issue again. This excludes the cause by any changes from me or by any added packages. It is proven, the issue is in the live-build environment itself. Hans

Re: Debian-Live can not be build - missing package

2025-03-03 Thread Hans
Good idea, Matthias, so I rechecked. There are only two packages in packages.chroot in the last build I sent the output from. These were "kali-undercover_2023" and "rustdesk-1.3.7". In both I checked the "control" file, but none of them pointed to or named "grub-efi-amd64-*". But to clear thi

Re: Debian-Live can not be build - missing package

2025-03-03 Thread Matthias Böttcher
On 2025-03-03 David Wright wrote: > On Sun 02 Mar 2025 at 20:32:24 (+0100), Hans wrote: > > > The only thing I got, was the message from "lb build", that a ncessary > > package > > could not be downloaded. And the necessary package was named > > "grub-efi-amd64- > > unsigned". > > That suggests t

Re: Debian-live can not be build missing package

2025-03-03 Thread Hans
Hello again, I believe, that one of the following packages needs the missing package. Please see the last output (sorry, it is bit longer): Building dependency tree... Done Reading state information... Done The following additional packages will be installed

Re: Debian-Live can not be build - missing package

2025-03-02 Thread David Wright
On Sun 02 Mar 2025 at 20:32:24 (+0100), Hans wrote: > The only thing I got, was the message from "lb build", that a ncessary > package > could not be downloaded. And the necessary package was named "grub-efi-amd64- > unsigned". That suggests to me (with no experience of this) that its a script

Re: Debian-Live can not be build - missing package

2025-03-02 Thread Hans
ase excuse, I am not able to give any more information at the moment. Best Hans > Presumably you meant "remove the dependency /on/ the missing > package". Can you help us by /naming/ the package that depends > on grub-efi-amd64-unsigned. > > Cheers, > David.

Re: Debian-Live can not be build - missing package

2025-03-02 Thread David Wright
On Sun 02 Mar 2025 at 17:44:37 (+0100), Hans wrote: > So my idea was just to write to the live-file-maintainers, to ask them, to > remove the dependency of the missing package in theire configurations or > point > it to another package, i.E. grub-efi-amd64-signed. Presumably you m

Re: Debian-Live can not be build - missing package

2025-03-02 Thread Hans
ng it from testing will force to add lots of other packages from testing, too. This is a lot of work and a big chance, to make mistakes. So my idea was just to write to the live-file-maintainers, to ask them, to remove the dependency of the missing package in theire configurations or point it

Re: Debian-Live can not be build - missing package

2025-03-02 Thread Matthias Böttcher
possible to build debian-live/stable (bookworm). The > reason is a > > > missing package in bookworm: grub-efi-amd64-unsigned. > > > > > > I rechecked and yes, it is no more in bookworm. > > > > Hi Hans, > > > > I'm sorry, but here are debian us

Re: Debian-Live can not be build - missing package

2025-03-02 Thread Matthias Böttcher
- shim-signed depends on grub-efi-amd64-bin > > > Dear maintainers, > > > > it is no more possible to build debian-live/stable (bookworm). The reason > > is a > > missing package in bookworm: grub-efi-amd64-unsigned. > > > > I rechecked and yes, it

Re: Debian-Live can not be build - missing package

2025-03-02 Thread Matthias Böttcher
> Dear maintainers, > > it is no more possible to build debian-live/stable (bookworm). The reason is a > missing package in bookworm: grub-efi-amd64-unsigned. > > I rechecked and yes, it is no more in bookworm. Hi Hans, I'm sorry, but here are debian users, not maintaine

Debian-Live can not be build - missing package

2025-02-25 Thread Hans
Dear maintainers, it is no more possible to build debian-live/stable (bookworm). The reason is a missing package in bookworm: grub-efi-amd64-unsigned. I rechecked and yes, it is no more in bookworm. Of course, I could download it as single package and put it in packages.chroot, but there are a

Re: Bug: missing package

2021-03-15 Thread Celejar
On Sun, 14 Mar 2021 21:20:39 -0400 Jude DaShiell wrote: > Why is frobtads missing from debian repositories? The frobtads package > makes it possible for those living outside of g.u.i. land to play tads > games on the console. frobtads is in Debian non-free, in Sid and Jessie: https://packages

Re: Bug: missing package

2021-03-14 Thread Nito
On Sun, Mar 14, 2021 at 21:20:39 -0400, Jude DaShiell wrote: > Why is frobtads missing from debian repositories? Looking at the tracker, the package is held back by "failure to build from source" bugs, which are considered RC critical: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=836934 h

Bug: missing package

2021-03-14 Thread Jude DaShiell
Why is frobtads missing from debian repositories? The frobtads package makes it possible for those living outside of g.u.i. land to play tads games on the console.

Re: how to force a "hold" on a missing package during an apt-get upgrade

2015-03-21 Thread Bob Proulx
Michael Biebl wrote: > Am 21.03.2015 um 17:36 schrieb tandread: > > but a later "apt-get --ignore-missing" insists > > on fetching what mysql-* was dpkg-purged > > > > I have tried a semi-fix of getting a > > "--get-selections", adding the purged packages > > as "hold" and doing a "--set-selection

Re: how to force a "hold" on a missing package during an apt-get upgrade

2015-03-21 Thread Liam O'Toole
On 2015-03-21, tandread wrote: > dear debian users, > > I really need to have a program compiled from source > (that is, a src dir, not a debian source package) > Let's say, the mysql server source distribution > > I can remove the mysql-* deb packages with > "dpkg --purge --force-depends" > (I k

Re: how to force a "hold" on a missing package during an apt-get upgrade

2015-03-21 Thread Michael Biebl
Am 21.03.2015 um 17:36 schrieb tandread: > dear debian users, > > I really need to have a program compiled from source > (that is, a src dir, not a debian source package) > Let's say, the mysql server source distribution > > I can remove the mysql-* deb packages with > "dpkg --purge --force-depe

how to force a "hold" on a missing package during an apt-get upgrade

2015-03-21 Thread tandread
dear debian users, I really need to have a program compiled from source (that is, a src dir, not a debian source package) Let's say, the mysql server source distribution I can remove the mysql-* deb packages with "dpkg --purge --force-depends" (I know this causes dangling lib*.so dependencies,

Re: missing package long descriptions

2014-01-26 Thread Zenaan Harkness
On 1/27/14, Brian wrote: > On Mon 27 Jan 2014 at 09:52:03 +1100, Zenaan Harkness wrote: > >> On 1/27/14, Brian wrote: >> > >> > And if you comment out file:/// sources and uncomment the iiNet >> > sources? >> > No updating, of course. >> >> Package descriptions show again; similarly if I have bot

Re: missing package long descriptions

2014-01-26 Thread Brian
On Mon 27 Jan 2014 at 09:52:03 +1100, Zenaan Harkness wrote: > On 1/27/14, Brian wrote: > > > > And if you comment out file:/// sources and uncomment the iiNet sources? > > No updating, of course. > > Package descriptions show again; similarly if I have both sources uncommented. We'll have A=

Re: missing package long descriptions

2014-01-26 Thread Zenaan Harkness
On 1/27/14, Brian wrote: > On Sun 26 Jan 2014 at 20:39:42 +1100, Zenaan Harkness wrote: > >> OK, /var/lib/apt/lists/ currently contains the Translation-en files >> for _both_ my Internet/iiNet sources entry, _and_ my local file:/// >> repo entry. >> >> Now, when I change the sources.list to point

Re: missing package long descriptions

2014-01-26 Thread Brian
On Sun 26 Jan 2014 at 20:39:42 +1100, Zenaan Harkness wrote: > OK, /var/lib/apt/lists/ currently contains the Translation-en files > for _both_ my Internet/iiNet sources entry, _and_ my local file:/// > repo entry. > > Now, when I change the sources.list to point to local file:/// > sources, comm

Re: missing package long descriptions

2014-01-26 Thread Chris Bannister
CC'ing de...@lists.debian.org On Sun, Jan 26, 2014 at 08:39:42PM +1100, Zenaan Harkness wrote: > > Now, when I change the sources.list to point to local file:/// > sources, commenting out the iiNet sources, and _not_ doing an apt-get > update, then package long descriptions disappear! Even thoug

Re: missing package long descriptions

2014-01-26 Thread Zenaan Harkness
TADA! Repeatability: On 1/26/14, Zenaan Harkness wrote: > On 1/26/14, Brian wrote: >> On Sun 26 Jan 2014 at 04:52:10 +1100, Zenaan Harkness wrote: >> >>> I'm currently home and running on local repo. >> >> With >>deb ftp://ftp.iinet.net.au/debian/debian sid main contrib non-free >> >> as the

Re: missing package long descriptions

2014-01-25 Thread Zenaan Harkness
On 1/26/14, Brian wrote: > On Sun 26 Jan 2014 at 04:52:10 +1100, Zenaan Harkness wrote: > >> I'm currently home and running on local repo. > > With >deb ftp://ftp.iinet.net.au/debian/debian sid main contrib non-free > > as the only line in sources.list do you have >ftp.iinet.net.au_debian_

Re: missing package long descriptions

2014-01-25 Thread Brian
On Sun 26 Jan 2014 at 04:52:10 +1100, Zenaan Harkness wrote: > I'm currently home and running on local repo. With deb ftp://ftp.iinet.net.au/debian/debian sid main contrib non-free as the only line in sources.list do you have ftp.iinet.net.au_debian_debian_dists_sid_main_i18n_Translation

Re: missing package long descriptions

2014-01-25 Thread Zenaan Harkness
On 1/26/14, Brian wrote: > On Sun 26 Jan 2014 at 03:03:05 +1100, Zenaan Harkness wrote: > >> Why would the Translation-en file disappear when I use the >> Internet-based sources.list entry? > > What is the output of 'ls -l /var/lib/apt/lists/'? $ ls -l /var/lib/apt/lists/ total 55204 -rw-r- 1

Re: missing package long descriptions

2014-01-25 Thread Brian
On Sun 26 Jan 2014 at 03:03:05 +1100, Zenaan Harkness wrote: > Why would the Translation-en file disappear when I use the > Internet-based sources.list entry? What is the output of 'ls -l /var/lib/apt/lists/'? -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of

Re: missing package long descriptions

2014-01-25 Thread Zenaan Harkness
On 1/26/14, Brian wrote: > On Sat 25 Jan 2014 at 23:32:19 +1100, Zenaan Harkness wrote: > >> Any pointers appreciated, > > The output you got would be obtained if the Translation-en file for main > in /var/lib/apt/lists/ was missing. When I change to Internet-based sources.list entry, the long de

Re: missing package long descriptions

2014-01-25 Thread Brian
On Sat 25 Jan 2014 at 23:32:19 +1100, Zenaan Harkness wrote: > Any pointers appreciated, The output you got would be obtained if the Translation-en file for main in /var/lib/apt/lists/ was missing. -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe

missing package long descriptions

2014-01-25 Thread Zenaan Harkness
Here's my (sid, not wheezy :) sources.list only line: deb ftp://ftp.iinet.net.au/debian/debian sid main contrib non-free This is temporary, normally I run off a usb which houses my local repo, so that line normally looks like a deb file:///... type line. Having made this change, I no longer have

Re: Reporting missing package during install

2013-12-18 Thread Andrei POPESCU
On Mi, 18 dec 13, 13:11:30, Tom H wrote: > > At home, people can run "sudo bash" (or more appropriately, "sudo -s" > or "sudo -i") but we can't do that at my current job or other at my > previous jobs. Is this requirement for logging purposes? Kind regards, Andrei -- http://wiki.debian.org/FAQs

Re: sudo security Was: Reporting missing package during install

2013-12-18 Thread Tom H
On Sat, Dec 14, 2013 at 10:25 AM, Gian Uberto Lauri wrote: >> On 14/dic/2013, at 09:09, Nemeth Gyorgy wrote: >> 2013-12-13 17:22 keltezéssel, John Hasler írta: ...must have successfully authenticated to execute a sudo command once >>> >>> Within the last 15 minutes. >> >> ... from

Re: Reporting missing package during install

2013-12-18 Thread Tom H
On Fri, Dec 13, 2013 at 4:50 PM, Gian Uberto Lauri wrote: > Tom H writes: >> In the corporate environments where I work, we are about 70 sysadmins >> in my location and about half as much in another. We all sudo to root >> on our more or less 11,000 systems. So by your reckoning we have 100 >> c

proper use of sudo (Re: sudo security Was: Reporting missing package during install)

2013-12-17 Thread Joel Rees
On Mon, Dec 16, 2013 at 7:40 PM, Gian Uberto Lauri wrote: > Joel Rees writes: > > On Wed, Dec 11, 2013 at 5:39 PM, Gian Uberto Lauri wrote: > > > [...] > > > Maybe I failed expressing that I am not completely against sudo, there > > > are several good sudo usages and even "caching" the authen

Re: sudo security Was: Reporting missing package during install

2013-12-16 Thread Joel Rees
On Wed, Dec 11, 2013 at 8:28 PM, Chris Bannister wrote: > On Tue, Dec 10, 2013 at 11:50:00PM +0100, Gian Uberto Lauri wrote: >> >> What makes root special is not the name but the numerical user id and group >> id, bot set to zero. See /etc/passwd. > > Don't you have to be logged in to do that? S

Re: sudo security Was: Reporting missing package during install

2013-12-16 Thread Gian Uberto Lauri
Joel Rees writes: > On Wed, Dec 11, 2013 at 5:39 PM, Gian Uberto Lauri wrote: > > [...] > > Maybe I failed expressing that I am not completely against sudo, there > > are several good sudo usages and even "caching" the authentication has > > its very legitimate uses, and the -k and -K flags h

Re: sudo security Was: Reporting missing package during install

2013-12-16 Thread Joel Rees
On Wed, Dec 11, 2013 at 5:39 PM, Gian Uberto Lauri wrote: > [...] > Maybe I failed expressing that I am not completely against sudo, there > are several good sudo usages and even "caching" the authentication has > its very legitimate uses, and the -k and -K flags help a lot in this, > even if some

Re: coloured prompt for root (was ... Re: Reporting missing package during install)

2013-12-14 Thread Chris Bannister
On Wed, Dec 11, 2013 at 02:13:18PM +0100, Gian Uberto Lauri wrote: > Chris Bannister writes: > > > This is in a tty, so don't know what will happen in an xterm or other > > virtual terminal. > > The virtual terminals usually honour ANSI escape sequences. For sure > xterm, the rxvt family and th

Re: sudo security Was: Reporting missing package during install

2013-12-14 Thread Gian Uberto Lauri
The same terminal or the same shell? -- Gian Uberto Lauri Messaggio inviato da un tablet > On 14/dic/2013, at 09:09, Nemeth Gyorgy wrote: > > 2013-12-13 17:22 keltezéssel, John Hasler írta: >>> ...must have successfully authenticated >>> to execute a sudo command once >> >> Within the last 15

Re: sudo security Was: Reporting missing package during install

2013-12-14 Thread Nemeth Gyorgy
2013-12-13 17:22 keltezéssel, John Hasler írta: >> ...must have successfully authenticated >> to execute a sudo command once > > Within the last 15 minutes. ... from the same terminal. Don't forget this criteria because it is important. -- --- Friczy --- 'Death is not a bug, it's a feature'

Re: sudo security Was: Reporting missing package during install

2013-12-13 Thread Gian Uberto Lauri
Tom H writes: > On Thu, Dec 12, 2013 at 9:40 AM, Gian Uberto Lauri wrote: > > Bob Proulx writes: > >> > >> Right. Because normal users can't change the system time. > > > > Sorry, wrong. With 'folk ALL=(ALL) ALL', user folk can run as root ANY > > program including 'date -s'. Or at least '

Re: Reporting missing package during install

2013-12-13 Thread Gian Uberto Lauri
Tom H writes: > In the corporate environments where I work, we are about 70 sysadmins > in my location and about half as much in another. We all sudo to root > on our more or less 11,000 systems. So by your reckoning we have 100 > critical accounts but that's not how our internal and external

Re: sudo security Was: Reporting missing package during install

2013-12-13 Thread John Hasler
Tom H writes: > ...must have successfully authenticated > to execute a sudo command once Within the last 15 minutes. > ...and it must be possible for users to modify the system time without > entering a password." Which is, of course, not the case on Debian. -- John Hasler jhas...@newsguy.com

Re: sudo security Was: Reporting missing package during install

2013-12-13 Thread Tom H
On Thu, Dec 12, 2013 at 9:40 AM, Gian Uberto Lauri wrote: > Bob Proulx writes: >> >> Right. Because normal users can't change the system time. > > Sorry, wrong. With 'folk ALL=(ALL) ALL', user folk can run as root ANY > program including 'date -s'. Or at least 'sudo bash', and then live > happy w

Re: sudo security Was: Reporting missing package during install

2013-12-13 Thread Tom H
On Wed, Dec 11, 2013 at 10:56 PM, Ralf Mardorf wrote: > > http://www.paritynews.com/2013/03/05/762/sudo-authentication-bypass-vulnerability-emerges/ > > But note! The Chaos Computer Club does publish howtos using sudo on > Linux: http://muc.ccc.de/uberbus:ubd > > I don't think the Chaos Computer C

Re: Reporting missing package during install

2013-12-13 Thread Tom H
On Tue, Dec 10, 2013 at 7:59 AM, Gian Uberto Lauri wrote: > Tom H writes: >> On Mon, Dec 9, 2013 at 8:09 AM, Gian Uberto Lauri wrote: >>> If some users needed to have the root power for a small set of >>> operation, then sudo would give them that extact power, no more no >>> less. >>> >>> What

Re: sudo security Was: Reporting missing package during install

2013-12-13 Thread Gian Uberto Lauri
Bob Proulx writes: > Gian Uberto Lauri wrote: > > Bob Proulx writes: > > > How would this be accomplished? (Answer cannot contain a use of sudo! > > > No circular logic please.) > > > ... > > > Right. Because normal users can't change the system time. > > > > Sorry, wrong. With 'folk A

Re: sudo security Was: Reporting missing package during install

2013-12-12 Thread Bob Proulx
Gian Uberto Lauri wrote: > Bob Proulx writes: > > How would this be accomplished? (Answer cannot contain a use of sudo! > > No circular logic please.) > > ... > > Right. Because normal users can't change the system time. > > Sorry, wrong. With 'folk ALL=(ALL) ALL', user folk can run as root AN

Re: Reporting missing package during install

2013-12-12 Thread Ralf Mardorf
On Thu, 2013-12-12 at 22:14 +0900, Osamu Aoki wrote: > 'sudo sh' is as easy on finger (no shift) and do not feel as bad. Doesn't it have any side-effects? I wonder about the prompt of an Arch Linux install. [rocketmouse@archlinux ~]$ ls -l /bin/sh lrwxrwxrwx 1 root root 4 Aug 25 14:06 /bin/sh

Re: Reporting missing package during install

2013-12-12 Thread Reco
On Thu, 12 Dec 2013 22:14:50 +0900 Osamu Aoki wrote: > On Sun, Dec 08, 2013 at 09:09:53PM -0500, Neal Murphy wrote: > > On Sunday, December 08, 2013 07:27:41 PM Andrei POPESCU wrote: > > > On Du, 08 dec 13, 19:14:49, Neal Murphy wrote: > > > > For me, I usually set up 'sudo su' > > > > > > sudo

Re: Reporting missing package during install

2013-12-12 Thread Osamu Aoki
On Sun, Dec 08, 2013 at 09:09:53PM -0500, Neal Murphy wrote: > On Sunday, December 08, 2013 07:27:41 PM Andrei POPESCU wrote: > > On Du, 08 dec 13, 19:14:49, Neal Murphy wrote: > > > For me, I usually set up 'sudo su' > > > > sudo has the '-s' and '-i' switches, why mix with 'su'? > > > > Kind re

Re: sudo security Was: Reporting missing package during install

2013-12-12 Thread Iain M Conochie
On 12/12/13 11:43, Gian Uberto Lauri wrote: Iain M Conochie writes: > > I got it about 20 years ago. Is it enough? > Mayeb - just maybe ;) Indeed, never be sure! :) > > You say it. It is not bullet proof. The bullet has already pierced the > > target once. Therefore it may happen again

Re: sudo security Was: Reporting missing package during install

2013-12-12 Thread Gian Uberto Lauri
Iain M Conochie writes: > > I got it about 20 years ago. Is it enough? > Mayeb - just maybe ;) Indeed, never be sure! :) > > You say it. It is not bullet proof. The bullet has already pierced the > > target once. Therefore it may happen again. > May - but not assured. Indeed. You usually p

Re: sudo security Was: Reporting missing package during install

2013-12-12 Thread Iain M Conochie
On 12/12/13 08:20, Gian Uberto Lauri wrote: Iain M Conochie writes: > On 11/12/13 08:01, Gian Uberto Lauri wrote: > > > Encrypt your hard disk. > > > > Hoping that the encryption you use has no backdoor. > You do understand what the peer review process is right? I got it about 20 yea

OT: sudo security Was: Reporting missing package during install

2013-12-12 Thread Ralf Mardorf
On Thu, 2013-12-12 at 10:40 +0100, Gian Uberto Lauri wrote: > sudo date 2101 > > and feel younger ;) That's a shoddy trick. I always wonder about that man: "Foreman said he had no plans to resume his career as a boxer, but then announced in February 2004 that he was training for one more com

Re: sudo security Was: Reporting missing package during install

2013-12-12 Thread Gian Uberto Lauri
Bob Proulx writes: > Right. Because normal users can't change the system time. Sorry, wrong. With 'folk ALL=(ALL) ALL', user folk can run as root ANY program including 'date -s'. Or at least 'sudo bash', and then live happy with a shell executed with the root id. If your /etc/sudoers contains

Re: sudo security Was: Reporting missing package during install

2013-12-12 Thread Gian Uberto Lauri
Ralf Mardorf writes: > http://www.paritynews.com/2013/03/05/762/sudo-authentication-bypass-vulnerability-emerges/ The attack described in the post is the kind of hijack I thought about. > But note! The Chaos Computer Club does publish howtos using sudo on > Linux: http://muc.ccc.de/uberbus:ubd

Re: sudo security Was: Reporting missing package during install

2013-12-12 Thread Gian Uberto Lauri
Iain M Conochie writes: > On 11/12/13 08:01, Gian Uberto Lauri wrote: > > > Encrypt your hard disk. > > > > Hoping that the encryption you use has no backdoor. > You do understand what the peer review process is right? I got it about 20 years ago. Is it enough? > Although not a > magic

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Gian Uberto Lauri
Ralf Mardorf writes: > On Wed, 2013-12-11 at 15:33 +0100, Gian Uberto Lauri wrote: > > > You need to inform yourself, to know that there's a callback for > > > the danger to life baby bottle. > > > > Ouch, InsufficentEnglishSkillException! Could you help me please :) > > Assumed a bab

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Bob Proulx
Ralf Mardorf wrote: > http://www.paritynews.com/2013/03/05/762/sudo-authentication-bypass-vulnerability-emerges/ In the article: ... it must be possible for users to modify the system time without entering a password. How would this be accomplished? (Answer cannot contain a use of sudo! No

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Ralf Mardorf
http://www.paritynews.com/2013/03/05/762/sudo-authentication-bypass-vulnerability-emerges/ But note! The Chaos Computer Club does publish howtos using sudo on Linux: http://muc.ccc.de/uberbus:ubd I don't think the Chaos Computer Club folks would write a howto using sudo, if sudo would be a securi

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Brian
On Wed 11 Dec 2013 at 21:04:48 +0100, Gian Uberto Lauri wrote: > Gentleman, the exploits are unknown to you, not to the black market > that supplies those investing in "not perfectly legitimate software". > Should I quote stuxnet one more time or you took the time to read how > it reached it's not

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Iain M Conochie
On 11/12/13 08:01, Gian Uberto Lauri wrote: > Encrypt your hard disk. Hoping that the encryption you use has no backdoor. You do understand what the peer review process is right? Although not a magic bullet, it can help weed this out. Choose a *very* good password. For the encryption, I

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Gian Uberto Lauri
Gentleman, the exploits are unknown to you, not to the black market that supplies those investing in "not perfectly legitimate software". Should I quote stuxnet one more time or you took the time to read how it reached it's not-network-connected intended targets? -- Gian Uberto Lauri Messaggi

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Ralf Mardorf
On Wed, 2013-12-11 at 15:33 +0100, Gian Uberto Lauri wrote: > > You need to inform yourself, to know that there's a callback for > > the danger to life baby bottle. > > Ouch, InsufficentEnglishSkillException! Could you help me please :) Assumed a baby bottle does poison the milk, because the

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Brian
On Wed 11 Dec 2013 at 09:11:56 +0100, Gian Uberto Lauri wrote: > Brian writes: > > > We do not worry about serious, unpublicised exploits. Their existance is > > of little consquence for your argument as your "attackers" would not > > know about them. > > Are you kidding? About attackers bei

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Gian Uberto Lauri
Ralf Mardorf writes: > On Wed, 2013-12-11 at 14:07 +0100, Gian Uberto Lauri wrote: > > It happens that appliances are called back by manufacturers due safety > > issues. > > Debian and other distros provide security updates _and_ much more > important, analog to a product callback, homepages

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Ralf Mardorf
On Wed, 2013-12-11 at 14:07 +0100, Gian Uberto Lauri wrote: > It happens that appliances are called back by manufacturers due safety > issues. Debian and other distros provide security updates _and_ much more important, analog to a product callback, homepages with news about the distro. You need t

coloured prompt for root (was ... Re: Reporting missing package during install)

2013-12-11 Thread Gian Uberto Lauri
Chris Bannister writes: > This is in a tty, so don't know what will happen in an xterm or other > virtual terminal. The virtual terminals usually honour ANSI escape sequences. For sure xterm, the rxvt family and the libvte-based ones do. But with virtual terminals you can do something like hav

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Gian Uberto Lauri
Ralf Mardorf writes: > On Wed, 2013-12-11 at 09:39 +0100, Gian Uberto Lauri wrote: > > Let's suppose that Debian+Ubuntu get the largest share of the > > installed end user desktops. > > The tendency is that seemingly newbies start using pre-build Linux > environments and use Linux as they wo

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Gian Uberto Lauri
Chris Bannister writes: > On Tue, Dec 10, 2013 at 11:50:00PM +0100, Gian Uberto Lauri wrote: > > > > What makes root special is not the name but the numerical user id and > > group id, bot set to zero. See /etc/passwd. > > Don't you have to be logged in to do that? Gentleman??? I was si

coloured prompt for root (was ... Re: Reporting missing package during install)

2013-12-11 Thread Chris Bannister
On Tue, Dec 10, 2013 at 11:11:34PM +, Lisi Reisz wrote: > On Tuesday 10 December 2013 06:39:17 Tom H wrote: > > You can't trust yourself with sudo but you can trust yourself with > > su or login root access... > > I have to make a conscious effort to become root. This reduces the > risk that

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Ralf Mardorf
On Wed, 2013-12-11 at 09:39 +0100, Gian Uberto Lauri wrote: > Let's suppose that Debian+Ubuntu get the largest share of the > installed end user desktops. The tendency is that seemingly newbies start using pre-build Linux environments and use Linux as they would use Windows, IOW without self-respo

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Chris Bannister
On Tue, Dec 10, 2013 at 11:50:00PM +0100, Gian Uberto Lauri wrote: > > What makes root special is not the name but the numerical user id and group > id, bot set to zero. See /etc/passwd. Don't you have to be logged in to do that? The issue was that there would be only one exploitable account, i

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Gian Uberto Lauri
Ralf Mardorf writes: > On Di, 2013-12-10 at 23:54 +0100, Gian Uberto Lauri wrote: > > Clever attacks manifest themselves a long time after the "infection" in > > order > > to poison backups. And backup media may fail when they are most needed. > > That's an effect of Murphy's law :). > > R

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Gian Uberto Lauri
Brian writes: > We do not worry about serious, unpublicised exploits. Their existance is > of little consquence for your argument as your "attackers" would not > know about them. Are you kidding? > If what you are referring to is what I think it is then no machines were > ever harmed. Not

Re: sudo security Was: Reporting missing package during install

2013-12-11 Thread Gian Uberto Lauri
> Encrypt your hard disk. Hoping that the encryption you use has no backdoor. > Choose a *very* good password. For the encryption, I suppose. That once one has his hands on the hardware there is no user/prom/bios password stopping his intrusion. > Unless they are a honey trap - and then you

Re: sudo security Was: Reporting missing package during install

2013-12-10 Thread Ralf Mardorf
On Di, 2013-12-10 at 23:54 +0100, Gian Uberto Lauri wrote: > Clever attacks manifest themselves a long time after the "infection" in order > to poison backups. And backup media may fail when they are most needed. > That's an effect of Murphy's law :). Read about my backup strategy below. Only one

Re: sudo security Was: Reporting missing package during install

2013-12-10 Thread Brian
On Tue 10 Dec 2013 at 23:50:00 +0100, Gian Uberto Lauri wrote: > > > > On 10/dic/2013, at 20:46, Brian wrote: > > > Quite possibly this is a technique which is tried but, in a default > > install, Debian does not provide any faulty services. > > > > You are never sure about not-yet publicize

Re: sudo security Was: Reporting missing package during install

2013-12-10 Thread Neal Murphy
On Tuesday, December 10, 2013 05:56:24 PM Lisi Reisz wrote: > On Tuesday 10 December 2013 16:50:54 Nate Bargmann wrote: > > I presume that entering a password in those fields results in root > > having its own password and the first user account not being a > > member of the sudo group. > > That i

Re: Reporting missing package during install

2013-12-10 Thread Lisi Reisz
On Tuesday 10 December 2013 06:39:17 Tom H wrote: > You can't trust yourself with sudo but you can trust yourself with > su or login root access... I have to make a conscious effort to become root. This reduces the risk that I will accidentally do something extra foolish. I do not have root lo

Re: sudo security Was: Reporting missing package during install

2013-12-10 Thread Gian Uberto Lauri
Clever attacks manifest themselves a long time after the "infection" in order to poison backups. And backup media may fail when they are most needed. That's an effect of Murphy's law :). -- Gian Uberto Lauri Messaggio inviato da un tablet > On 10/dic/2013, at 21:54, Ralf Mardorf wrote: > >> On

Re: sudo security Was: Reporting missing package during install

2013-12-10 Thread Gian Uberto Lauri
> On 10/dic/2013, at 20:46, Brian wrote: > Quite possibly this is a technique which is tried but, in a default > install, Debian does not provide any faulty services. > You are never sure about not-yet publicized exploits. And some time ago there was a problem with sone ssh code that should

Re: sudo security Was: Reporting missing package during install

2013-12-10 Thread Lisi Reisz
On Tuesday 10 December 2013 16:50:54 Nate Bargmann wrote: > I presume that entering a password in those fields results in root > having its own password and the first user account not being a > member of the sudo group. That is what I assumed, but as a result of this thread I just tested. I have

Re: sudo security Was: Reporting missing package during install

2013-12-10 Thread Ralf Mardorf
On Di, 2013-12-10 at 21:44 +, Brian wrote: > On Tue 10 Dec 2013 at 15:32:57 -0600, Nate Bargmann wrote: > > > I was guessing that it refered to Display 0:0 of the X server as the > > discussion centered on running X as root at one point. > > May I withdraw my "More than likely"? There has to

Re: sudo security Was: Reporting missing package during install

2013-12-10 Thread Brian
On Tue 10 Dec 2013 at 15:32:57 -0600, Nate Bargmann wrote: > I was guessing that it refered to Display 0:0 of the X server as the > discussion centered on running X as root at one point. May I withdraw my "More than likely"? There has to be a time when the guessing has to cease, -- To UNSUBSCR

Re: sudo security Was: Reporting missing package during install

2013-12-10 Thread Nate Bargmann
I was guessing that it refered to Display 0:0 of the X server as the discussion centered on running X as root at one point. - Nate -- "The optimist proclaims that we live in the best of all possible worlds. The pessimist fears this is true." Ham radio, Linux, bikes, and more: http://www.n0nb.

  1   2   >