infrastructure November 2008

infrastructure@lists.fedoraproject.org

46 participants
71 discussions

[Fwd: Fedora wiki login issues]
by Ignacio Vazquez-Abrams 25 Nov '08

25 Nov '08

For your consideration. -------- Forwarded Message -------- > From: Tim Abbott <tabbott(a)MIT.EDU> > To: webmaster(a)fedoraproject.org > Subject: Fedora wiki login issues > Date: Tue, 25 Nov 2008 12:27:18 -0500 (EST) > > Hello, > > I just registered for an account (username: tabbott) with the Fedora > Account System, but the Fedora Wiki refuses to let me login, giving "Login > error: Incorrect password entered. Please try again.". I am quite > confident that I am providing the same password to the Fedora Wiki and the > Fedora Account System (with which I have tested logging out and in again); > is there some sort of delay for information to propagate to the Fedora > Wiki? > > -Tim Abbott -- Ignacio Vazquez-Abrams <ivazqueznet(a)gmail.com>

2 1

Re: Fixing CSRF exploits in Infrastructure
by John (J5) Palmieri 25 Nov '08

25 Nov '08

I've read the document and it is pretty well thought out. A couple of comments - for the JavaScript parts wouldn't that be better to setup as an included file which also pulls in a JS library? Just so people aren't copying and pasting? That way you will also be able to extend the functionality if need be and app developers would have to worry about one line of code instead of 10. As for myfedora this is pretty straight forward as we can use the middleware layer to inject the javascript variables and do the hashing and double authentication. Most of our modification requests will be going over json so a javascript layer would work there too. We can then simply have our proxies pass the hash onto the ProxyClients. It is still a chain of trust where you trust our servers have implemented the protocol correctly and we aren't just hashing the cookie when it has to pass it to the proxy client. The only way to fix the man in the middle trust issue would be to have the client somehow sign the session hash, but even then, the client would have to register a public key on a server you trust. ----- "Toshio Kuratomi" <a.badger(a)gmail.com> wrote: > Greetings all, > > I've been researching the CSRF exploit and how it affects our web > apps > recently. The short story is that our code is pretty open to this at > the moment. I've written up a proposal for fixing this but it will > require a lot of coding so I'd love to have some more eyes on it to > make > sure I'm not making any stupid mistakes. > > The proposal is here:: > https://fedorahosted.org/fas/wiki/CSRF > > The ticket for the overall CSRF fixing is here:: > https://fedorahosted.org/fedora-infrastructure/ticket/992 > > I consider fixing this to be a fairly high priority so I'll be > starting > work on implementing this for a few pkgdb methods very soon. > Assuming > the technique works we'll need to port every method that can change > data > in every app to use this. > > -Toshio > > > _______________________________________________ > Fedora-infrastructure-list mailing list > Fedora-infrastructure-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-infrastructure-list -- -- John (J5) Palmieri Software Engineer Red Hat, Inc.

2 1

Change request
by Mike McGrath 25 Nov '08

25 Nov '08

I need to add the following: AddType image/svg+xml .svg AddType image/svg+xml .svgz AddEncoding gzip .svgz <FilesMatch \.svgz$> <IfModule mod_gzip.c> mod_gzip_on No </IfModule> </FilesMatch> Into a general config file for our app servers. At present it is in our wiki config. This is causing problems for some of our docs sites that use svg that are not on a machine that are on the wiki. -Mike

4 3

release day change request
by Mike McGrath 25 Nov '08

25 Nov '08

Ugh, well poop. proxy3 was built with the wrong arch and we didn't realize it until today. We've taken it out of rotation. I'd like to: 1) rebuild proxy3 as i686 2) leave it out of rotation unless we need it. can I get 2 +1's? In theory it can add 25% capacity to how many requests we can serve in a given time. We may not need it. -Mike

4 4

proper way to update /var/lib/puppet/application/mirrors/releases.txt
by Jesse Keating 25 Nov '08

25 Nov '08

This looks like it is its own git repo, but apparently you need to be in the sysadmin-web group to edit this. I'm not in the group, so in order for me to manage this we either need to add me to the group (yuck, more groups) or move this to a different ownership set, or something else. Either way a couple things need to be done to the file. 1) removing F10 Preview and Beta 2) adding F10 itself. These will need to be done by the release tomorrow. -- Jesse Keating Fedora -- Freedom² is a feature! identi.ca: http://identi.ca/jkeating

3 3

Congratulations to Nigel Jones
by Mike McGrath 25 Nov '08

25 Nov '08

I'm happy to announce I've just approved Nigel Jones in to the sysadmin-main group. He's the first new member we've had to that group since Ricky Zhou was approved in May earlier this year. For those that don't know sysadmin-main is for our core dedicated admins. It typically takes many months (sometimes years) of commitment to get in to this group. Nigel is on his way to doing a great job with re-inventing our monitoring environment. He's spent a lot of time on many of our bits of infrastructure and regularly puts in many hours a week doing Fedora related tasks. He's a great volunteer and we're happy and lucky to have him on. Nigel is currently based out of Brisbane which makes him the first non-US member to be in sysadmin-main. This is an important change in focus for us and greatly helps the stability/coverage of our environment. Thanks Nigel! -Mike

9 8

Re: Change Request - Update Website Languages
by Nigel Jones 25 Nov '08

25 Nov '08

+1, I find it a bit disappointing that French & Dutch is getting removed, but if we can't help it, we can't help it. Also, I'd point out that the SOP says that standard release procedures don't need to be voted on/announced (unless I misread it) - Nigel ----- Original Message ----- From: "Ricky Zhou" <ricky(a)fedoraproject.org> To: fedora-infrastructure-list(a)redhat.com Sent: Tuesday, November 25, 2008 9:47:19 PM GMT +10:00 Brisbane Subject: Change Request - Update Website Languages Hi, I need to update all of the language.conf files for the final set of languages for the F10 website. This is necessary for the release, so can I get two +1s? The config patch is available at http://ricky.fedorapeople.org/0001-Update-all-website-languages.patch Thanks, Ricky _______________________________________________ Fedora-infrastructure-list mailing list Fedora-infrastructure-list(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-infrastructure-list

1 0

Change Request - Update Website Languages
by Ricky Zhou 25 Nov '08

25 Nov '08

Hi, I need to update all of the language.conf files for the final set of languages for the F10 website. This is necessary for the release, so can I get two +1s? The config patch is available at http://ricky.fedorapeople.org/0001-Update-all-website-languages.patch Thanks, Ricky

2 1

Informal survey
by Mike McGrath 25 Nov '08

25 Nov '08

Hey guys, completely voluntary but I thought I'd ask because I'm curious For personal use, how many of you use something like linode or slicehost or an individual provider? If you do use a provider which one is it? For me, I do use one and I use slicehost. -Mike

10 15

Bodhi 10k bug
by Luke Macken 24 Nov '08

24 Nov '08

As some of you may have noticed, the last batch of updates contained 209 updates with the ID of 'FEDORA-2008-10000'. This is is due to a flaw in the way bodhi's PackageUpdate.assign_id() method finds the current update with the highest id. Presently, it does a PackageUpdate.select(..., orderBy=PackageUpdate.q.updateid). Since PackageUpdate.updateid is a unicode column, and due to the fact that u'FEDORA-2008-10000' < u'FEDORA-2008-9999', this started to fail miserably. Attached is a patch that has the assign_id method order the query by the date_pushed DateTimeCol in order to find the highest updateid. However, it seems that SQLObject completely ignore milliseconds: if datetime: def DateTimeConverter(value, db): return "'%04d-%02d-%02d %02d:%02d:%02d'" % ( value.year, value.month, value.day, value.hour, value.minute, value.second) The problem with this is that we must now take into account multiple updates that were pushed at the same second. The "proper" way to fix this is at the model level, and probably to use an integer for the updateid column. I'm in the process of finishing up the SQLAlchemy port, which will properly solve this problem. In the mean time, this hack will not require any database changes. This patch also includes a test case for this 10k bug. [lmacken@x300 bodhi]$ nosetests bodhi/tests/test_model.py:TestPackageUpdate.test_id . ---------------------------------------------------------------------- Ran 1 test in 0.084s OK Once approved and applied, I will push out a fixed package (to releng2 only), fix the existing updates from the last push, and send out an errata containing the new update IDs. +1's ? luke

4 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure November 2008