Savannah Back Online With Extra Security

← Back to Stories (view on slashdot.org)

Savannah Back Online With Extra Security

Posted by michael on Tuesday December 23, 2003 @03:52PM from the beefed-up dept.

depesz writes "As we can read here, savannah is back online. After several weeks of downtime, all security problems are resolved, and the service is again operational."

21 of 172 comments (clear)

Congratulations by xyzzy · 2003-12-23 15:54 · Score: 4, Insightful

On yet another slashdot posting with absolutely zero informative content (except possibly to people who already knew what the article meant).
1. Re:Congratulations by Jacek+Poplawski · 2003-12-23 20:20 · Score: 3, Informative
  
  I am afraid you are wrong. Savannah is very important website. Many free projects are hosted there (for example mldonkey), and with whole site disabled development was almost completly stoped for many days.
Savanah is back online again by rxed · 2003-12-23 15:55 · Score: 5, Funny

not anymore. is been slashdoted. :-)
1. Re:Savanah is back online again by xie · 2003-12-23 16:26 · Score: 5, Informative
  
  Actually they are back "online" but reading here it seems most things won't be functional till "early January 2004".
2. Re:Savanah is back online again by DAldredge · 2003-12-23 17:41 · Score: 3, Interesting
  
  The GNU project is probably still too busy getting rid of project maintainers that do not agree to use the restrictive, some would say unfree, GFDL.
  
  Just read my journal. It explains some of what has happened.
3. Re:Savanah is back online again by sg_oneill · 2003-12-24 01:27 · Score: 3, Informative
  
  The GNU project is probably still too busy getting rid of project maintainers that do not agree to use the restrictive, some would say unfree, GFDL.
  
  Just read my journal. It explains some of what has happened.
  
  Who modded that troll? Geez. Read the journal article. The guy just got booted as a Hurd maintainer because he was worried the GNU doc licence is to non-free.
  
  Also dude, you should submit your story onto newsforge or something. Its worrying.
  
  --
  Excuse the Unicode crap in my posts. That's an apostrophe, and slashdot is busted.
Questions by Scrameustache · 2003-12-23 15:58 · Score: 4, Insightful

What is Savahna?
Why was it not online?
Why should I care?
Where's the rocketpacks? We were promised rocketpacks...

--
You can't take the sky from me...
1. Re:Questions by mattjb0010 · 2003-12-23 16:05 · Score: 3, Funny
  
  What is Savahna?
  Why was it not online?
  Why should I care?
  
  Why don't you RTFA?
2. Re:Questions by Anonymous Coward · 2003-12-23 16:15 · Score: 5, Informative
  
  What is Savannah?
  Savannah is a sort of "home base" for GNU Project developers. They can set up web sites for their projects, CVS repositories, mailing lists, post want-ads for developers, etc.
  Why was it not online?
  Early this month / late last month the system was compromised in some way. I'm not sure if anything was actually damaged or not, but it's best to try to keep things as secure as possible. Hence it was taken offline, reinstalled, and new security procedures have been (and are being) developed.
  Why should I care?
  If you're not a GNU developer, it has little immediate impact on you. It's one of those "just sharing" stories. :-)
  Where's the rocketpacks?
  I don't know, but I know that I don't have them.
3. Re:Questions by erlenic · 2003-12-23 21:48 · Score: 5, Funny
  
  What is Savannah?
  Why was Savannah not online?
  From the looks of it, Google had no idea that the city of Savannah, GA in the US was offline. Come to think of it, neither did I. Well, I'm happy for everyone that lives there. I can't imagine living through several weeks of my city being offline.
Obligatory Stallman Lingo by toupsie · 2003-12-23 16:00 · Score: 5, Funny

Savannah wasn't hacked, it was GNU/0wn3d.

--
Strange women lying in ponds distributing swords is no basis for a system of government.
Xen for better speration then chroot? by redhat421 · 2003-12-23 16:01 · Score: 4, Interesting

When I looks a intrusions like this, I wonder if using something like Xen is a perfect fit for protecting projects from each other
or perhaps as a backup known good environment.
Answers by Anonymous Coward · 2003-12-23 16:19 · Score: 5, Informative

Savannah is GNU's answer to SourceForge. Some GNU people don't like some of SF's terms for usage, so they run their own sf-style site.

It was offline because it was compromised, presumably by the brk() hole recently discovered in Linux 2.4.x. (Fixed in the latest version.)

You should care because now the authors of your favorite GNU software can be more productive. It also has serious implications to Linux 2.4 security.

I don't know anything about rocket packs.
What took them so long? by keesh · 2003-12-23 16:20 · Score: 4, Informative

It took them weeks to realise that they'd been owned and months to fix anything. I think they need a few lessons from the Gentoo people...
1. Re:What took them so long? by Mr.Ned · 2003-12-24 04:08 · Score: 3, Insightful
  
  The Debian people, no slouches, didn't notice right away, and may not have if there hardware didn't react poorly to the rootkit. The Gentoo compromise was on a completely different scale - to restore the computer to working order, they just plowed the hard drive, reinstalled, and then copied the data from other mirrors. Unfortunately, this is not so easy for Savannah - they host a lot of projects and aren't just running rsync. Savannah wasn't just another mirror, it was the central repository.
Re:Security ? by damiam · 2003-12-23 16:31 · Score: 5, Informative

It's quite likely that that's a vendor version (from Debian stable?) that has had all relevant bugfixes and patches backported by the vendor. I really doubt they'd use the vanilla 1.3.26.

--
It's hard to be religious when certain people are never incinerated by bolts of lightning.
Re:Obvious enough by GoofyBoy · 2003-12-23 16:31 · Score: 3, Insightful

1. What is Savannah?
2. What was the security problems?
3. Why should I or Developers care about this?
4. Why was it down for several weeks?

Not something that can be answered with moving a mouse around and 1/2 a second.

--
The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
Whoops - wrong Savannah by Anomalous+Cowturd · 2003-12-23 17:32 · Score: 4, Funny

As we can read here, savannah is back online. After several weeks of downtime, all security problems are resolved, and the service is again operational.

So, was I the only person who read the headline, *and* the blurb, and immediately thought of something completely different?

--
Java: the bastard demon spawn of C++ and Ada
Re:Debian still down by Ben+Hutchings · 2003-12-24 00:01 · Score: 4, Interesting

Debian has gradually been bringing services back online as the relevant files are verified and new passwords and keys generated. They are also tightening security in some ways, e.g. dropping pserver access to CVS servers. Alioth and www.debian.org are the latest services to be restored.
grsecurity? by curious.corn · 2003-12-24 00:19 · Score: 3, Informative

grsecurity is a promising mechanism to un-root a linux kernel based system: ipaddr, user or group based roles open or deny access to privileged operations without ever having uid=0 to begin with. It's a bit complicated to use but the system can auto-learn and generate these policies. Also, the system includes PaX which does some neat things like scramble the stack to thwart buffer overflows, non executable pages, etc... I've played with both (well, Mandrake secure kernels have grsec compiled in, not shure about pax) and although I still can't figure out (read: "ready made & nicely packaged ;-)") all of it but it does give the warm & fuzzy feeling it makes a difference...

--
Mi domando chi Ã il mandante di tutte le cazzate che faccio - Altan
That's not what I call "back online" by Fefe · 2003-12-24 01:26 · Score: 3, Interesting

a) they firewalled ICMP echo (WTF?!?)
b) cvs pserver is not available and apparently never will be again. So I went through my checked out gcc source tree and changed all the CVS/Root files to their new scheme, but it didn't work, "directory not found".
c) I would have double checked with the webcvs, but that's also not operational.
d) The other option would have been to download a snapshot from the download area, but the download areas are also not available. OK ok, for gcc the download area is somewhere else, but for all the other projects?!

This begs the question: what _is_ back online? The web server with the note that they are back online?

So they discovered that pserver has security bugs. No, really? The solution is to provide pserver cvs in a chroot with a uid that can't write anything and maybe use systrace to disallow nasty operations.

Sorry, folks, but I don't like people who discontinue all the important features and then say it's for security reasons. That's bullshit.
I would help, but I didn't see them asking for help anywhere.