Re: ntpd vulnerabilities

According to Roger Marquis: > For now openntpd is the recommended solution but a more minimal client > might be preferable depending on implementation specifics. The only Last time I checked, it does not do NTP4 (the protocol), only NTP3. -- Ollivier ROBERT -=- FreeBSD: The Power to

Re: ntpd vulnerabilities

being worked on. -- Ollivier ROBERT -=- FreeBSD: The Power to Serve! -=- robe...@keltia.freenix.fr In memoriam to Ondine : http://ondine.keltia.net/ ___ freebsd-security@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-secur

Re: ntpd 4.2.4p8 - up to date?

On 2 Nov 2013, at 20:24, Karl Pielorz wrote: So as I'd kind of guessed - it's not really vanilla 4.2.4p8 that it's running, it's based on 4.2.4p8 with additional patches that have been applied by FreeBSD, to address the applicable notifications? Yes. __

Re: NTP security hole CVE-2013-5211?

5 (the one I imported a few weeks ago) and have a look at 4.2.7. -- Ollivier ROBERT -=- FreeBSD: The Power to Serve! -=- robe...@keltia.net In memoriam to Ondine, our 2nd child: http://ondine.keltia.net/ ___ freebsd-security@freebsd.org mailing list h

Re: security/openssl speed issues

lysis, thank you. I must admit it is not always easy to see how openssl works, it is a bit, ahem, messy around there :) > I will submit a patch to OpenSSL to not make the documentation of the > -elapsed option dependent on defines... Thanks. -- Ollivier ROBERT -=- FreeBSD: The Power

Re: security/openssl speed issues

According to Ollivier Robert: > Notice the CDRIOCINITWRITER? My run does not show these: so after these > lines, there are no "sessions" available and cryptodev is in fact not used. Note to oneself, do not try to kdump a 9.1 trace file on a 9.2 system. Forget the CDRIOCINITW

Re: security/openssl speed issues

argument 2709 openssl CALL close(0x4) 2709 openssl RET close 0 - Making progress... -- Ollivier ROBERT -=- FreeBSD: The Power to Serve! -=- robe...@keltia.freenix.fr In memoriam to Ondine : http://ondine.keltia.net/ ___ freebsd-security@freebsd.org mai

Re: security/openssl speed issues

nssl because of > this.. Yeah, that seems the second issue, the first one being that even with aesni/cryptodev out of the picture, 1.0.1 is still slower than 0.9.8... -- Ollivier ROBERT -=- FreeBSD: The Power to Serve! -=- robe...@keltia.freenix.fr In memoriam to

security/openssl speed issues

till 42% diff and no "aesni" usage at all!? I'm guessing we have an issue there... Thanks, -- Ollivier ROBERT -=- FreeBSD: The Power to Serve! -=- robe...@keltia.net In memoriam to Ondine, our 2nd child: http://ondine.keltia.net/ ___ freebsd-

Re: bind9 and CVE-2013-4854

According to Peter Losher: > Note that this week ISC have announced going forward that RRL will > be integrated into the mainline BIND releases. Excellent, thanks Peter! -- Ollivier ROBERT -=- FreeBSD: The Power to Serve! -=- robe...@keltia.freenix.fr In memoriam to Ondine

Re: bind9 and CVE-2013-4854

According to Mathieu Arnold: > There is a new patchset for both bind versions though. > http://ss.vix.su/~vjs/rrlrpz.html Excellent, will update. -- Ollivier ROBERT -=- FreeBSD: The Power to Serve! -=- robe...@keltia.freenix.fr In memoriam to Ondine : http://ondine.kelt

Re: bind9 and CVE-2013-4854

According to Mark Boolootian: > Thank you very much for that. Does this include the RRL/RPZ patches? The -P1 patch seems to apply and run on the -P2 version (security patch is very isolated to one line). -- Ollivier ROBERT -=- FreeBSD: The Power to Serve! -=- robe...@keltia.freenix.fr

bind9 and CVE-2013-4854

no longer receive testing or security fixes from ISC. For current information on which versions are actively supported, please see http://www.isc.org/downloads/software-support-policy/bind-software-status/. -- Ollivier ROBERT -=- FreeBSD: The Power to Serve! -=- robe...@keltia.freenix.fr In m

Re: Recent security announcement and csup/cvsup?

n maintain private > repository with pkgng or not? I don't know what portsnap does with things like .svn/.hg (from different VCS). If it does not remove them, use hg/git/svn to "merge" from the official portsnap tree into your own. If it does, just rsync periodically fro

Re: Recent security announcement and csup/cvsup?

rtsnap (and /usr/ports for that matter). -- Ollivier ROBERT -=- FreeBSD: The Power to Serve! -=- robe...@keltia.net In memoriam to Ondine, our 2nd child: http://ondine.keltia.net/ ___ freebsd-security@freebsd.org mailing list http://lists.freebsd.org/mailm

Re: FreeBSD needs Git to ensure repo integrity [was: 2012 incident]

> If at all, we'd need a lean and mean distributed SCM program > like Mercurial or Git, but written in C that we could add to base. > Any volunteers? We don't have svn in base either. Your point? -- Ollivier ROBERT -=- FreeBSD: The Power to Serve! -=- robe...@keltia.net In

Re: ntpd 4.2.4p8

According to Ollivier Robert: > Yes. It is in the works. For those not following the commit logs, I updated ntpd to 4.2.4p8 in head. For the release branches, a patch will be released (as we do not update whole programs in these). After two weeks, it will be merged to stable/8. 4.2.6 (or

Re: ntpd 4.2.4p8

According to pluknet: Are there plans on updating contrib/ntp to the latest version? Yes. It is in the works. -- Ollivier ROBERT -=- FreeBSD: The Power to Serve! -=- robe...@keltia.freenix.fr In memoriam to Ondine : http://ondine.keltia.net