<div dir="ltr">Hi, I'm responding to myself because I'd a look to this link : <a href="http://ubuntuforums.org/showthread.php?p=4813109#post4813109">http://ubuntuforums.org/showthread.php?p=4813109#post4813109</a> and it's good. Phg <div class="gmail_quote">2008/7/25 <<a href="mailto:ubuntu-server-request@lists.ubuntu.com">ubuntu-server-request@lists.ubuntu.com</a>>: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Send ubuntu-server mailing list submissions to <a href="mailto:ubuntu-server@lists.ubuntu.com">ubuntu-server@lists.ubuntu.com</a> To subscribe or unsubscribe via the World Wide Web, visit <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-server" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-server</a> or, via email, send a message with subject or body 'help' to <a href="mailto:ubuntu-server-request@lists.ubuntu.com">ubuntu-server-request@lists.ubuntu.com</a> You can reach the person managing the list at <a href="mailto:ubuntu-server-owner@lists.ubuntu.com">ubuntu-server-owner@lists.ubuntu.com</a> When replying, please edit your Subject line so it is more specific than "Re: Contents of ubuntu-server digest..." Today's Topics: 1. Re: Server Team 20080722 meeting minutes (Ante Karamatic) 2. Re: Server Team 20080722 meeting minutes (Soren Hansen) 3. Re: Server Team 20080722 meeting minutes (Etienne Goyer) 4. Re: SSLv2 - do we really need it? (Michael Casadevall) 5. Re: Server Team 20080722 meeting minutes (Steve Langasek) 6. Re: SSLv2 - do we really need it? (Scott Kitterman) 7. Re: Server Team 20080722 meeting minutes (David Portwood) 8. Re: Server Team 20080722 meeting minutes (Soren Hansen) 9. How to change the kernel (Philippe Gayot) ---------------------------------------------------------------------- Message: 1 Date: Thu, 24 Jul 2008 13:09:39 +0200 From: Ante Karamatic <<a href="mailto:ivoks@grad.hr">ivoks@grad.hr</a>> Subject: Re: Server Team 20080722 meeting minutes To: <a href="mailto:ubuntu-devel@lists.ubuntu.com">ubuntu-devel@lists.ubuntu.com</a> Cc: <a href="mailto:ubuntu-server@lists.ubuntu.com">ubuntu-server@lists.ubuntu.com</a> Message-ID: <20080724130939.7cdaa1d9@titanium> Content-Type: text/plain; charset=US-ASCII On Wed, 23 Jul 2008 12:50:22 -0700 Scott Kitterman <<a href="mailto:ubuntu@kitterman.com">ubuntu@kitterman.com</a>> wrote: > Definitely. Let's drop it and drop it soon so we have some time to > deal with any packages that have problems. Patch is located here: <a href="http://www.init.hr/dev/openssl-nossl2.patch" target="_blank">http://www.init.hr/dev/openssl-nossl2.patch</a> ------------------------------ Message: 2 Date: Thu, 24 Jul 2008 15:05:32 +0200 From: Soren Hansen <<a href="mailto:soren@ubuntu.com">soren@ubuntu.com</a>> Subject: Re: Server Team 20080722 meeting minutes To: Steve Langasek <<a href="mailto:steve.langasek@ubuntu.com">steve.langasek@ubuntu.com</a>>, <a href="mailto:ubuntu-devel@lists.ubuntu.com">ubuntu-devel@lists.ubuntu.com</a>, <a href="mailto:ubuntu-server@lists.ubuntu.com">ubuntu-server@lists.ubuntu.com</a> Message-ID: <<a href="mailto:20080724130532.GA13441@ralph.linux2go.dk">20080724130532.GA13441@ralph.linux2go.dk</a>> Content-Type: text/plain; charset="us-ascii" On Wed, Jul 23, 2008 at 12:26:43PM -0700, Steve Langasek wrote: > On Wed, Jul 23, 2008 at 02:11:05PM -0400, Mathias Gug wrote: >> ivoks prepared patches for a couple of packages to disable sslv2 in >> their configuration. He also sent an email on ubuntu-devel about >> disabling sslv2 directly in the openssl package. Discussion is >> ongoing, with a proposal to create an openssl-sslv2 package in >> universe that would be built with sslv2 enabled. > FWIW, I think creating an openssl-sslv2 package would be the worst > possible solution: duplicating security-sensitive code, and making it > available with lesser security support. I think dropping SSLv2 > support would be better. Err.. I don't think I follow. I imagine, we'd build the SSLv2-enabled packages from the same source package and just put the binary in universe? I believe someone in another thread gave specific examples of 3rd party stuff that needed SSLv2 to function. Forcing them to compile OpenSSL themselves seems worse to me. -- Soren Hansen | Virtualisation specialist | Ubuntu Server Team Canonical Ltd. | <a href="http://www.ubuntu.com/" target="_blank">http://www.ubuntu.com/</a> -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 307 bytes Desc: Digital signature Url : <a href="https://lists.ubuntu.com/archives/ubuntu-server/attachments/20080724/71dfe6cd/attachment-0001.pgp" target="_blank">https://lists.ubuntu.com/archives/ubuntu-server/attachments/20080724/71dfe6cd/attachment-0001.pgp</a> ------------------------------ Message: 3 Date: Thu, 24 Jul 2008 08:52:45 -0400 From: Etienne Goyer <<a href="mailto:etienne.goyer@canonical.com">etienne.goyer@canonical.com</a>> Subject: Re: Server Team 20080722 meeting minutes To: <a href="mailto:ubuntu-server@lists.ubuntu.com">ubuntu-server@lists.ubuntu.com</a> Message-ID: <<a href="mailto:48887B1D.1080706@canonical.com">48887B1D.1080706@canonical.com</a>> Content-Type: text/plain; charset=ISO-8859-1 Mathias Gug wrote: > ==== RAILS integration ==== > > macd reported that mod_rails has been packaged and uploaded to REVU. mathiaz > reviewed it and sent his feedback to Neil (the packager). Overall it looks > good. > > macd also mentioned the discussions he's having with the Debian maintainers > for ruby/rubygems that is taking place in bug 145267[8]. There was some > discussion about the issue which boils down to a PATH issue. The debian gems > and the source installed gems don't end up in the same place. Rails apps looks > in a specific place and rails isn't capable of looking in more than one place. > soren, macd and persia discussed the path issue and deferred it to #ubuntu- > server after the meeting. > > [8]: <a href="https://launchpad.net/bugs/145267" target="_blank">https://launchpad.net/bugs/145267</a> There was a guy speaking at Ubuntu Live 2007 about how he deployed Rails on Ubuntu. He have a blog post about some of the stuff he do to automate the work. He is working outside the packaging framework, so I do not know how much of it is applicable for us, but there it is: <a href="http://blog.railsmachine.com/2007/5/25/ann-machinify-stack-toolkit" target="_blank">http://blog.railsmachine.com/2007/5/25/ann-machinify-stack-toolkit</a> Right now, I understand he deploy mostly on CentOS + KVM, but does his development on Ubuntu + KVM so he must have a clue. I will try to poke him in joining the list and sharing his experience. -- Etienne Goyer, Senior Ubuntu System Support Analyst Ubuntu Certified Instructor Canonical, Ltd ------------------------------ Message: 4 Date: Wed, 23 Jul 2008 21:50:38 -0400 From: "Michael Casadevall" <<a href="mailto:sonicmctails@gmail.com">sonicmctails@gmail.com</a>> Subject: Re: SSLv2 - do we really need it? To: "Ante Karamatic" <<a href="mailto:ivoks@grad.hr">ivoks@grad.hr</a>> Cc: <a href="mailto:ubuntu-server@lists.ubuntu.com">ubuntu-server@lists.ubuntu.com</a>, <a href="mailto:ubuntu-devel@lists.ubuntu.com">ubuntu-devel@lists.ubuntu.com</a> Message-ID: <<a href="mailto:5a1037520807231850l5b0ce34k2a875fbef1688383@mail.gmail.com">5a1037520807231850l5b0ce34k2a875fbef1688383@mail.gmail.com</a>> Content-Type: text/plain; charset="iso-8859-1" Well, if a user has both Universe and Main enabled, if we have a openssl-sslv2, which is the same package expect with SSLv2 compiled in, all it needs is a Replaces/Conflicts/Provides which removes the sslv3-only package. That way, any users who need it (and those who need likely already know) are simply an aptitiude command away from having the necessary support. On Tue, Jul 22, 2008 at 9:43 AM, Ante Karamatic <<a href="mailto:ivoks@grad.hr">ivoks@grad.hr</a>> wrote: > On Tue, 22 Jul 2008 08:22:13 -0500 > "Dustin Kirkland" <<a href="mailto:kirkland@canonical.com">kirkland@canonical.com</a>> wrote: > > > And as soon as we get to the point where no packages depend on that, > > we remove it? > > Our packages shouldn't be the problem (I doubt we have sslv2-only > clients or servers). If there are problematic packages, then by > definition those problems are bugs. > > Problems are third party packages, like XYZ IMAP client from ABCD > company which supports only SSLv2 (I'm not aware of any program like > that, but you get my point). For sysadmins of servers which have > clients like that, openssl with SSLv2 is must have. > > I like the idea of additional package in universe. But how much > problems could that produce? > > -- > ubuntu-devel mailing list > <a href="mailto:ubuntu-devel@lists.ubuntu.com">ubuntu-devel@lists.ubuntu.com</a> > Modify settings or unsubscribe at: > <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel</a> > -------------- next part -------------- An HTML attachment was scrubbed... URL: <a href="https://lists.ubuntu.com/archives/ubuntu-server/attachments/20080723/9ff85d0c/attachment-0001.htm" target="_blank">https://lists.ubuntu.com/archives/ubuntu-server/attachments/20080723/9ff85d0c/attachment-0001.htm</a> ------------------------------ Message: 5 Date: Thu, 24 Jul 2008 11:02:44 -0700 From: Steve Langasek <<a href="mailto:steve.langasek@ubuntu.com">steve.langasek@ubuntu.com</a>> Subject: Re: Server Team 20080722 meeting minutes To: <a href="mailto:ubuntu-devel@lists.ubuntu.com">ubuntu-devel@lists.ubuntu.com</a>, <a href="mailto:ubuntu-server@lists.ubuntu.com">ubuntu-server@lists.ubuntu.com</a> Message-ID: <<a href="mailto:20080724180244.GV31253@dario.dodds.net">20080724180244.GV31253@dario.dodds.net</a>> Content-Type: text/plain; charset=us-ascii On Thu, Jul 24, 2008 at 03:05:32PM +0200, Soren Hansen wrote: > On Wed, Jul 23, 2008 at 12:26:43PM -0700, Steve Langasek wrote: > > On Wed, Jul 23, 2008 at 02:11:05PM -0400, Mathias Gug wrote: > >> ivoks prepared patches for a couple of packages to disable sslv2 in > >> their configuration. He also sent an email on ubuntu-devel about > >> disabling sslv2 directly in the openssl package. Discussion is > >> ongoing, with a proposal to create an openssl-sslv2 package in > >> universe that would be built with sslv2 enabled. > > FWIW, I think creating an openssl-sslv2 package would be the worst > > possible solution: duplicating security-sensitive code, and making it > > available with lesser security support. I think dropping SSLv2 > > support would be better. > Err.. I don't think I follow. I imagine, we'd build the SSLv2-enabled > packages from the same source package and just put the binary in > universe? I believe someone in another thread gave specific examples of > 3rd party stuff that needed SSLv2 to function. Forcing them to compile > OpenSSL themselves seems worse to me. Oh. That's much more sensible than the strawman I'd apparently constructed in my mind. :-) Do you have a pointer to the examples of stuff still needing SSLv2? I hadn't seen any listed on ubuntu-devel. -- Steve Langasek Give me a lever long enough and a Free OS Debian Developer to set it on, and I can move the world. Ubuntu Developer <a href="http://www.debian.org/" target="_blank">http://www.debian.org/</a> <a href="mailto:slangasek@ubuntu.com">slangasek@ubuntu.com</a> <a href="mailto:vorlon@debian.org">vorlon@debian.org</a> ------------------------------ Message: 6 Date: Thu, 24 Jul 2008 16:03:47 -0400 From: Scott Kitterman <<a href="mailto:ubuntu@kitterman.com">ubuntu@kitterman.com</a>> Subject: Re: SSLv2 - do we really need it? To: <a href="mailto:ubuntu-server@lists.ubuntu.com">ubuntu-server@lists.ubuntu.com</a> Message-ID: <<a href="mailto:200807241603.48170.ubuntu@kitterman.com">200807241603.48170.ubuntu@kitterman.com</a>> Content-Type: text/plain; charset="utf-8" On Wednesday 23 July 2008 21:50, Michael Casadevall wrote: Top posting fixed ... > On Tue, Jul 22, 2008 at 9:43 AM, Ante Karamatic <<a href="mailto:ivoks@grad.hr">ivoks@grad.hr</a>> wrote: > > On Tue, 22 Jul 2008 08:22:13 -0500 > > > > "Dustin Kirkland" <<a href="mailto:kirkland@canonical.com">kirkland@canonical.com</a>> wrote: > > > And as soon as we get to the point where no packages depend on that, > > > we remove it? > > > > Our packages shouldn't be the problem (I doubt we have sslv2-only > > clients or servers). If there are problematic packages, then by > > definition those problems are bugs. > > > > Problems are third party packages, like XYZ IMAP client from ABCD > > company which supports only SSLv2 (I'm not aware of any program like > > that, but you get my point). For sysadmins of servers which have > > clients like that, openssl with SSLv2 is must have. > > > > I like the idea of additional package in universe. But how much > > problems could that produce? > > > Well, if a user has both Universe and Main enabled, if we have a > openssl-sslv2, which is the same package expect with SSLv2 compiled in, all > it needs is a Replaces/Conflicts/Provides which removes the sslv3-only > package. > > That way, any users who need it (and those who need likely already know) > are simply an aptitiude command away from having the necessary support. > So SSLv2 is not sufficiently cryptographically secure for Main, but it's OK for Universe? I know Canonical does not promise security support for Universe and it's mostly done by the community, but I don't think there is a difference in the desired security level between Main and Universe. My view is that if SSLv2 is OK for Universe, we should just leave it as is and suck up the pain of updating the individual applications. Scott K ------------------------------ Message: 7 Date: Thu, 24 Jul 2008 16:55:52 -0500 From: David Portwood <<a href="mailto:dzp@bellsouth.net">dzp@bellsouth.net</a>> Subject: Re: Server Team 20080722 meeting minutes To: Etienne Goyer <<a href="mailto:etienne.goyer@canonical.com">etienne.goyer@canonical.com</a>> Cc: <a href="mailto:ubuntu-server@lists.ubuntu.com">ubuntu-server@lists.ubuntu.com</a> Message-ID: <1216936552.30988.2.camel@wk5> Content-Type: text/plain On Thu, 2008-07-24 at 08:52 -0400, Etienne Goyer wrote: > Mathias Gug wrote: > > ==== RAILS integration ==== > > > > macd reported that mod_rails has been packaged and uploaded to REVU. mathiaz > > reviewed it and sent his feedback to Neil (the packager). Overall it looks > > good. > > > > macd also mentioned the discussions he's having with the Debian maintainers > > for ruby/rubygems that is taking place in bug 145267[8]. There was some > > discussion about the issue which boils down to a PATH issue. The debian gems > > and the source installed gems don't end up in the same place. Rails apps looks > > in a specific place and rails isn't capable of looking in more than one place. > > soren, macd and persia discussed the path issue and deferred it to #ubuntu- > > server after the meeting. > > > > [8]: <a href="https://launchpad.net/bugs/145267" target="_blank">https://launchpad.net/bugs/145267</a> > > There was a guy speaking at Ubuntu Live 2007 about how he deployed Rails > on Ubuntu. He have a blog post about some of the stuff he do to > automate the work. He is working outside the packaging framework, so I > do not know how much of it is applicable for us, but there it is: > > <a href="http://blog.railsmachine.com/2007/5/25/ann-machinify-stack-toolkit" target="_blank">http://blog.railsmachine.com/2007/5/25/ann-machinify-stack-toolkit</a> > > > Right now, I understand he deploy mostly on CentOS + KVM, but does his > development on Ubuntu + KVM so he must have a clue. I will try to poke > him in joining the list and sharing his experience. > Would be great to get another head in this. His post does seem to indicate he is outside of packaging, but may have osme insight on the deployment side of a sample app. > > -- > Etienne Goyer, Senior Ubuntu System Support Analyst > Ubuntu Certified Instructor > Canonical, Ltd > ------------------------------ Message: 8 Date: Fri, 25 Jul 2008 08:29:25 +0200 From: Soren Hansen <<a href="mailto:soren@ubuntu.com">soren@ubuntu.com</a>> Subject: Re: Server Team 20080722 meeting minutes To: <a href="mailto:ubuntu-server@lists.ubuntu.com">ubuntu-server@lists.ubuntu.com</a>, <a href="mailto:ubuntu-devel@lists.ubuntu.com">ubuntu-devel@lists.ubuntu.com</a> Cc: Steve Langasek <<a href="mailto:steve.langasek@ubuntu.com">steve.langasek@ubuntu.com</a>> Message-ID: <<a href="mailto:20080725062925.GA14103@ralph.linux2go.dk">20080725062925.GA14103@ralph.linux2go.dk</a>> Content-Type: text/plain; charset="us-ascii" On Thu, Jul 24, 2008 at 11:02:44AM -0700, Steve Langasek wrote: >> I believe someone in another thread gave specific examples of 3rd >> party stuff that needed SSLv2 to function. Forcing them to compile >> OpenSSL themselves seems worse to me. > Do you have a pointer to the examples of stuff still needing SSLv2? I > hadn't seen any listed on ubuntu-devel. I've tried looking through the ubuntu-server and ubuntu-devel{,-discuss} mailing list archives, and I can't seem to find it. Same for my irclogs. I appear to be making it all up. I suppose if noone can come up with a single example of anything that requires SSLv2, then I guess it's all a moot point and we can just disable it, and deal with the fallout if any should turn up. -- Soren Hansen | Virtualisation specialist | Ubuntu Server Team Canonical Ltd. | <a href="http://www.ubuntu.com/" target="_blank">http://www.ubuntu.com/</a> -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 307 bytes Desc: Digital signature Url : <a href="https://lists.ubuntu.com/archives/ubuntu-server/attachments/20080725/75a3ff3f/attachment-0001.pgp" target="_blank">https://lists.ubuntu.com/archives/ubuntu-server/attachments/20080725/75a3ff3f/attachment-0001.pgp</a> ------------------------------ Message: 9 Date: Fri, 25 Jul 2008 12:29:02 +0200 From: "Philippe Gayot" <<a href="mailto:phgayot@gmail.com">phgayot@gmail.com</a>> Subject: How to change the kernel To: <a href="mailto:ubuntu-server@lists.ubuntu.com">ubuntu-server@lists.ubuntu.com</a> Message-ID: <<a href="mailto:ecb0dcfd0807250329i7260a6bfkf20449a2359fa74d@mail.gmail.com">ecb0dcfd0807250329i7260a6bfkf20449a2359fa74d@mail.gmail.com</a>> Content-Type: text/plain; charset="utf-8" Hi, To learn about "ubuntu-server", I want to install this OS on a notebook Dell D505 (Pentium M) and I have this error : "This kernel requires the following features not present on the CPU : 0:6 Unable to boot - please use a kernel appropriate for your CPU" How to choose & to install the good kernel ? Thanks -- Ph. Gayot -------------- next part -------------- An HTML attachment was scrubbed... URL: <a href="https://lists.ubuntu.com/archives/ubuntu-server/attachments/20080725/819986a1/attachment.htm" target="_blank">https://lists.ubuntu.com/archives/ubuntu-server/attachments/20080725/819986a1/attachment.htm</a> ------------------------------ -- ubuntu-server mailing list <a href="mailto:ubuntu-server@lists.ubuntu.com">ubuntu-server@lists.ubuntu.com</a> <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-server" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-server</a> More info: <a href="https://wiki.ubuntu.com/ServerTeam" target="_blank">https://wiki.ubuntu.com/ServerTeam</a> End of ubuntu-server Digest, Vol 31, Issue 29 ********************************************* </blockquote></div> -- Ph. Gayot <div style="border: 1px solid gray; position: absolute; left: 0px; top: 0px; width: 16px; height: 16px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAABnRSTlMA+QD7AP7IFnaXAAAACXBIWXMAAA7EAAAOxAGVKw4bAAACfUlEQVR4nD2Sy0uUYRTGn/N+71wcnaYxL0gpNSm56WZEKCkRRJv6F4qIIqxNq7AoKmgTbbrRxlpEuamgAqmVRpQUFDVdnLLMSsX7jM7Fb77vvZwWoz0cOAee5/esDjxlPWV9becLpverYmZme+/N4siM1tqWXE/Z4vKB0lLaLiyapnMzz764zLz2zAwze8oWmT1mj1kxe8xFZgkAgGWUB2noQlXsyGDyUuO+Rh+AkOR8n1dPU6Zv1LxL65CNvD9AnrIlhgEpyQFo+5Obl3d36vuZuQGuO1++o4HC0v04jq23vZqyJYABIchPPYyEC+13NzWEx3q6EnB/5yfKg4ldMCAH5k4ye/iBwLKYDQUFrT/48mi6p2u/P5ZEoErmP5U8BjgWMk3Vy4CkYMFRqR8AOFJX/PU4uLoFRgs7yv8br72v6N4vALCkUFbNPfoc2rYOgBOvDydaoV0YT8ZWUW6SJYmCzhVzZR0JwQTHIHtjYMWhjSK8WWfeAHkgA3JhPFFRi9k+AnKnnsffHrOGBRyyp1/Ioy3MoFUbkHkN+PrztE7nES2gWkgxRGmUXdkLCzCEM1HwB6dlVRQEC1BNBMjpkyOmNjVNQ4M0ln2XokqIQACWAUjzatz5mpXXP/iJmExlVH9c9w8U3Fwa5KIqfvHvyg5ZnPomqpvBACBNkGhk3j07QIY1yOTVKHyKxoOVlbGDX+q7ivjpGO+FqG2GBQBSzAudvf6tDxY2F3G8LWsq236qZAMaJxJXFzC8ADtdGDeBPb3QDICKygpJAGh57Gz3ZPfHNSdc/JnzpsaVV4FoR3DnhSXg/y8tSZCZHcbQcQ612WhroL6dysMASmkA/wALgWlRuJztiwAAAABJRU5ErkJggg==); background-repeat: no-repeat; background-color: rgb(238, 238, 238); cursor: pointer; z-index: 65535; display: none;"> </div></div>