<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Quick word about me: I've worked previously in Unix security for a financial services multinational. I'm an MSc candidate in Computer Security and Forensics and will be working for Illumos SoC on IKE this summer.<div><br></div><div>I'm happy to help sort this out.</div><div><br></div><div>Cheers,</div><div>Bayard</div><div><div><br><div>Begin forwarded message:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; font-size:medium; color:rgba(0, 0, 0, 1);"><b>From: </b></span><span style="font-family:'Helvetica'; font-size:medium;">Alasdair Lumsden <<a href="mailto:alasdairrr@gmail.com">alasdairrr@gmail.com</a>><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; font-size:medium; color:rgba(0, 0, 0, 1);"><b>Date: </b></span><span style="font-family:'Helvetica'; font-size:medium;">28 April 2011 12:20:03 GMT+01:00<br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; font-size:medium; color:rgba(0, 0, 0, 1);"><b>To: </b></span><span style="font-family:'Helvetica'; font-size:medium;">OpenIndiana Infrastructure mailing list <<a href="mailto:oi-infra@openindiana.org">oi-infra@openindiana.org</a>><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; font-size:medium; color:rgba(0, 0, 0, 1);"><b>Subject: </b></span><span style="font-family:'Helvetica'; font-size:medium;"><b>Re: [oi-infra] distribution integrity measures</b><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><font class="Apple-style-span" color="#000000"><b><br></b></font></div><div>Hi Bayard,<br><br>Probably not - OI Infra is for those people looking after the server instances, of which there aren't that many people at present.<br><br>I'd recommend re-posting to oi-dev!<br><br>Cheers,<br><br>Alasdair<br><br>On 28 Apr 2011, at 10:39, Bayard Bell wrote:<br><br><blockquote type="cite">Have I contacted the right list for this question?<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">On 23 Apr 2011, at 15:41, Bayard Bell <<a href="mailto:buffer.g.overflow@googlemail.com">buffer.g.overflow@googlemail.com</a>> wrote:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><blockquote type="cite">I've been getting up to speed on OpenIndiana/Illumos, and one of things that's struck me so far is what I take to be gaps in distribution integrity measures. I thought I'd start with oi-infra rather than oi-discuss, as this list seems to have more direct ownership. This is a first post, so please forgive me if this isn't the right forum.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">What I've noticed is a number of variations on the basic problem that there are quite a lot of opportunities to MITM downstream consumers via name-service based attacks or, what is rather less of a risk, session hijacking, creating risks of arbitrary content injection. My recollection is that OpenSolaris signed packages and made extensive use of ssh keys to provide mitigations, and there don't appear to be equivalent measures in OpenIndiana release or package distribution and source mirrors, many of which provide neither transport security nor signing. (Just to summarise what I see: OpenIndiana packages aren't signed, the OpenIndiana mirror of the Illumos source is only available by plain http, mirrors seem to rsync unsigned content without transport security, and the checksums for the distribution ISOs are only available by plain http.)<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">My question is more or less whether this is a known and accepted risk that reflects where the project is in coming up to speed or something more of an oversight.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Cheers,<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Bayard<br></blockquote></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">_______________________________________________<br></blockquote><blockquote type="cite">oi-infra mailing list<br></blockquote><blockquote type="cite"><a href="mailto:oi-infra@openindiana.org">oi-infra@openindiana.org</a><br></blockquote><blockquote type="cite"><a href="http://openindiana.org/mailman/listinfo/oi-infra">http://openindiana.org/mailman/listinfo/oi-infra</a><br></blockquote><br><br>_______________________________________________<br>oi-infra mailing list<br><a href="mailto:oi-infra@openindiana.org">oi-infra@openindiana.org</a><br><a href="http://openindiana.org/mailman/listinfo/oi-infra">http://openindiana.org/mailman/listinfo/oi-infra</a><br></div></blockquote></div><br></div></body></html>