Lese-Ansicht

OpenSSH-Sicherheitslücke RegreSSHion

Dem Forscherteam von Qualys ist es gelungen, eine ältere Sicherheitslücke in OpenSSH, die schon eigentlich längst geschlossen war, erneut auszunutzen. Die neue Lücke wird als CVE-2024-6387 geführt und ist deswegen brisant, weil Sie bei Erfolg dem Angreifer Root-Rechte ohne vorherige Authentifizierung ermöglicht. Die nötigen Bedingungen für ein Ausnutzen der Lücke sind allerdings nicht ganz trivial.

Die gesamte Erläuterung der Sicherheitslücke ist im Bericht von Qualys umfangreich erläutert wollen. Wenn wir es schaffen, werden wir diesen schon Mittwoch im Risikozone-Podcast detaillierter erläutern.

So viel sei gesagt: die Lücke existierte schon mal als CVE-2006-5051, wurde dann gefixt und konnte jetzt (erstmals) ausgenutzt werden, da der eigentlich kritische Teil 2020 wieder versehentlich eingebaut wurde. Der Fehler selber baut darauf, dass syslog() zur Protokollierung asynchron aufgerufen wird, obwohl die Funktion nicht "async-signal-safe" ist. Kann ein Angreifer Timingeigenschaften ausnutzen, wird er in die Lage versetzt, Code einzuschleusen, der in einem privilegierten Teil von OpenSSH ausgeführt wird. Der Zeitaufwand ist allerdings hierfür nicht zu unterschätzen, da das Codefragment nur bei einem Verbindungstimeout aufgerufen wird.

Es ist gemäß des Qualys-Berichtes hervorzuheben:

  • Die OpenSSH-Versionen vor 4.4p1 (2006) sind angreifbar, sofern sie nicht explizit gepatcht wurden.
  • Die OpenSSH-Versionen zwischen 4.4p1 und 8.5p1 (2021) hatten nicht den besagten Code drin.
  • Die OpenSSH-Versionen ab 8.5p1 hatten den Code wieder drin.
  • Mit OpenSSH 9.8p1 wurde die Lücke gepatcht.

Mit anderen Worten: abhängig von eurem System ist die Schwachstelle vorhanden, weswegen ihr in eure Distribution schauen solltet, ob es Updates gibt.

OpenSSH ist nichtsdestotrotz im Hinblick auf seine Rolle und Exposition eines der sichersten Programme der Welt. Die Software ist ein sehr stringent abgesicherter Dienst, der u. a. auf Sandboxing-Mechansimen setzt, um den Umfang der Codesegmente, die als root ausgeführt werden, gering zu halten. Diese Lücke ist eine der seltenen Situationen, in der trotzdem ein Security-Bug vorhanden ist. Dabei ist eine Ausnutzung vergleichsweise aufwändig.

  •  

Ückück und das Fediverse: Fedicamp

Sommer, Sonne, Fediverse. Bereits zum 3. Mal findet das Fedicamp in Gedelitz statt. Was ist so besonders an dem freien Netzwerk, dass sich jedes Jahr Menschen nicht nur online sondern auch offline treffen und ihren Urlaub miteinander verbringen?

  •  

Europe needs Free Software to master its digital infrastructure

Europe needs Free Software to master its digital infrastructure

The FSFE calls upon the European Commission to use Free Software to ensure a secure and resilient digital infrastructure. Software freedom will also benefit the economy, civil society and democracy.

The Free Software Foundation Europe (FSFE) provided last evening its input to the European Commission's consultation on the white paper "How to master Europe’s digital infrastructure needs?". As an advocate for software freedom, the FSFE underscores the crucial role of Free Software in building secure and resilient digital infrastructure for Europe while strengthening economy, democracy and civil society alike.

Challenges around digital infrastructure occur at global, regional and local levels, often revolving around control and access. Collaboration and openness are playing just as important role as the capability and skills to swiftly and effectively fix issues. Challenges addressed by the White paper could be addressed by redirecting IT investments in software freedom instead of procuring closed source, proprietary software. This approach not only boosts the European IT landscape and creates jobs but also saves costs and resources in the medium and long term by avoiding the need to repeatedly reinvent the the wheel.

“The European digital infrastructure, the European tech market, the IT skills of Europeans and civil society would greatly benefit if investments in software adhered to the principle of “Public money? Public Code!” We need software that fosters the sharing of good ideas and solutions. Like this we will be able to manage and improve IT services and digital infrastructure all over Europe. We need software that guarantees freedom of choice, access, and competition. We need software that helps public administrations regain full control of their critical digital infrastructure, allowing them to become and remain independent from a handful of companies. Therefore, laws and programs are needed, that publicly financed software developed for public sector must be made publicly available under a Free Software licence. Investment in the Free Software ecosystem will pay off quickly while strengthening Europe infrastructure, economy, democracy and civil society alike.” , demands Alexander Sander, FSFE’s Senior Policy Consultant.

The "Public Money? Public Code!" initiative aims to establish Free Software as the standard for publicly funded software. The "Public Money? Public Code!" initiative of the Free Software Foundation Europe is supported by over 200 organizations and administrations.

Support FSFE

  •  

Debian 10 "buster" LTS erreicht End of Life (EoL)

Kurz notiert: Debian 10 mit dem Codenamen "buster" erreicht heute das End of Life. Die Unterstützung wurde bis 2022 vom Debian-Team bereitgestellt und dann bis zum heutigen Tage durch das LTS-Team sichergestellt. Damit wurde Debian 10 knapp fünf Jahre durchgängig unterstützt.

Debian 10 wurde am 6. Juli 2019 und somit vor knapp fünf Jahren veröffentlicht. Ausgeliefert wurde das Betriebssystem mit dem Linux-Kernel 4.19. Der letzte Point-Release erfolgte am 10. September 2022, damit endete auch der klassische Security-Support.

Anschließend hat das LTS-Team die Unterstützung am 1. August 2022 mit einer Teilmenge von Architekturen (amd64, i386, amd64, armhf) übernommen, damit Nutzer wichtige Sicherheitsupdates noch erhalten und die Gelegenheit haben, auf den Folge-Release umzustellen. Diese Unterstützung läuft am heutigen Tage aus.

Es ist somit an der Zeit, auf Debian 11 mit dem Codenamen "bullseye" umzustellen. Die Migrationsanleitung ist in den Release Notes für Debian 11 zu finden. Hier wird auch erläutert, mit welchen Breaking Changes zu rechnen ist. Wie üblich, lässt sich der Release über die APT-Konfiguration anheben, gefolgt von einem Upgrade über APT. Die wichtigste Änderung dabei ist, dass das Security-Archiv ein neues Layout hat. Ich habe einige Systeme schon aktualisiert, dabei gab es bei mir keine Probleme. Das sollte auch bei anderen Systemen keine Schwierigkeiten bereiten, wenn sich an den offiziellen Debian-Paketquellen orientiert wird. Die Backports sollte man aber kontrollieren, wenn z. B. ein Backports-Kernel genutzt wurde, um WireGuard schon mit Debian 10 nutzen zu können (erst Debian 11 hat eine Kernelversion, in der WireGuard integriert ist).

Aktuell werden vom Debian-Team die Versionen 11 (bullseye) und 12 (bookworm) als Hauptversionen gepflegt. Das LTS-Team ist eine Gruppe von Freiwilligen, die sich zum Ziel gesetzt hat, eine fünfjährige Unterstützung für Debian-Versionen sicherzustellen. Wer eine zehnjährige Unterstützung benötigt, kann auf entgeltliche ELTS-Angebote wie z. B. von Freexian zurückgreifen.

  •  

Video: Selfhosting mit ownCloud

Bei ownCloud handelt es sich, ähnlich wie bei Nextcloud, um eine Datei-Synchronisationslösung, die aus einem Server- und einem Client-Teil besteht. Der Serverteil kannst du bei dir zu Hause im Selfhosting betreiben.

  •  

Ist zu viel FLATPAK wirklich gut? Probleme mit Flatpak und Flathub und Installationsempfehlung

💾

In diesem Video zeigt Jean, welche Probleme es mit Flatpaks und dem Flathub-Repository gibt und ob es noch eine Daseinsberechtigung für Flatpak gibt.
Wenn Du das Video unterstützen willst, dann gib bitte eine Bewertung ab, und schreibe einen Kommentar. Vielen Dank!


Links:
-------------------------------------

Programme auf Linux installieren: https://www.youtube.com/watch?v=35cgN_dPgGw

Linux-Guides Merch*: https://linux-guides.myspreadshop.de/
Professioneller Linux Support*: https://www.linuxguides.de/linux-support/
Linux-Arbeitsplatz für KMU & Einzelpersonen*: https://www.linuxguides.de/linux-arbeitsplatz/
Linux Mint Kurs für Anwender*: https://www.linuxguides.de/kurs-linux-mint-fur-anwender/
Offizielle Webseite: https://www.linuxguides.de
Forum: https://forum.linuxguides.de/
Unterstützen: http://unterstuetzen.linuxguides.de
Mastodon: https://mastodon.social/@LinuxGuides
X: https://twitter.com/LinuxGuides
Instagram: https://www.instagram.com/linuxguides/
Kontakt: https://www.linuxguides.de/kontakt/

Inhaltsverzeichnis:
-------------------------------------

0:00 Begrüßung
1:00 Vorteil von Flatpak
2:57 Beispiel des Linux-Assistant
4:53 Kritikpunkt 1: hoher Ressourcenverbrauch
7:50 Kritikpunkt 2: zweifelhaftes Berechtigungssystem
9:44 Flatpak mit dem Terminal
12:21 Kritikpunkt 3: Integration mit anderen Anwendungen
13:20 Keine man page Unterstützung
14:27 Flathub als Fluch und Segen
17:41 Einschub: zip Anwendungen installieren
20:40 Fazit zu Flathub
22:10 Normale Installation statt Flatpak
23:50 Anwendungen unter Linux installieren
25:03 FAZIT: Hat Flatpak noch eine Daseinsberechtigung?
27:56 Image-basierte Systeme
30:28 Verabschiedung


Haftungsausschluss:
-------------------------------------
Das Video dient lediglich zu Informationszwecken. Wir übernehmen keinerlei Haftung für in diesem Video gezeigte und / oder erklärte Handlungen. Es entsteht in keinem Moment Anspruch auf Schadensersatz oder ähnliches.

*) Werbung
  •  

Viertausend

Wir feiern vier Jahre GNU/Linux.ch mit 4000 Artikeln und einem grossen Dank an die Community. Unser Geschenk an euch hat einen Namen: FOSSWELT.org

  •  

📚 Python (3. Aufl.) erschienen

Soeben ist die dritte Auflage meines Python-Bestsellers erschienen:

Für die 3. Auflage habe ich das Buch im Hinblick auf die Python-Version 3.12 aktualisiert. Neu hinzugekommen ist das Kapitel »Python lernen mit KI-Unterstützung«. Es zeigt, wie Ihnen ChatGPT oder ein vergleichbares KI-Tool beim Erlernen von Python helfen kann. Ebenfalls neu ist ein Abschnitt zur Nutzung von Python direkt in Excel.

Viele Beispiele aus der Praxis sowie Übungsaufgaben helfen dabei, Python ohne allzu viel Theorie kennenzulernen. Im handlichen Taschenbuchformat ist das Buch auch unterwegs ein idealer Begleiter. Mehr Details zum Buch gibt es hier:

https://kofler.info/buecher/python/

  •  

Interview with last year's YH4F winner, Davide Rorato

Interview with last year's YH4F winner, Davide Rorato

After six months of programming there are only a few days left until the end of Youth Hacking 4 Freedom 2024. We are very excited to see this year's projects and to learn more about the participants and their work during the past months. Before we dive into the new projects, let us take a deeper look at last year's winner, Davide Rorato.

Davide presenting his winning project, 'ArduPlot', at the Award ceremony in Brussels, October 2023

Davide programmed the tool "ArduPlot", a real-time serial plotter that automatically adjusts itself to your use case. ArduPlot provides a nice graphical overview of the sensor data from any Arduino board. But let us hear all about ArduPlot from its developer.

FSFE: Hi Davide, thank you very much for your time. Before we learn more about "ArduPlot" we want to learn more about you and your skills. What was your first experience with programming, and how did you start learning to write code?

Davide: My first ever experience with programming was creating Automator scripts. Automator is an application that lets you create a sequence of actions such as keyboard presses and mouse movements that can be recorded and then played back without the need to write any code (it’s actually a lot more powerful but I used it in a very basic way).

The next thing I started to experiment with was coding on an Arduino UNO that I borrowed from my older brother. When it wasn't in use I would write simple programs by copying them from a book of ready-made projects and adapting them to suit my needs. This gradually evolved into me wanting to know more about programming and electronics, and a couple of years later, during summer vacation, I thought it would be fun to actually learn how to code, so I opened up YouTube and followed the first C++ tutorial I could find.

After getting accustomed to the basics, when I got an idea for a project, I would start coding until I found a problem I didn't know how to tackle. I then googled and tried every way possible to make the program work until it did.

FSFE: Can you remember when you first used Free Software?

Davide: I think my first contact with Free Software was with the OpenOffice suite, followed by the Arduino IDE. Of course at first I didn't realise what Free Software meant, and I was simply glad I could use the software for free, but as years passed I came to really appreciate the ethical principles of Free Software.

FSFE: How did you find out about this contest?

Davide: It was thanks to my IT teacher, who told my class about this contest when the first edition of YH4F started. I actually participated in the first edition of YH4F as well, but I didn’t manage to win, and seeing the quality of the projects that did it was clear why, they were amazing!

FSFE: Why did you decide to join YH4F?

Davide: The first year I decided to join because I thought it would be an excellent opportunity to do a bigger project, and in turn learn a lot of new things that I didn't have an opportunity to before. Had I not participated in the first edition, I wouldn’t have been able to create ArduPlot the following year.

For the second edition of the contest, I actually didn't have any plans to submit a project, but incidentally I had been working on ArduPlot to help with the debugging of a robot for a school project, so the day of the submission deadline I thought: “Well, I got nothing to lose so I might as well submit this!”. I can safely say I did not regret that decision!

ArduPlot graphical output of the input from an Arduino board

FSFE: And before we talk a bit more about ArduPlot, what did you enjoy the most about this contest?

Davide: The thing I enjoyed the most was the open-ended nature of the contest. Any type of Free Software can be created and submitted, with no restriction to a specific type or theme, letting everyone work on something they are passionate about at the moment.

FSFE:This is nice to hear, however we also know that this can be quite a challenge for some to find "their perfect project". Here as you said it is very important to find something you are passionate about, or a problem you want to fix. And of course, the YH4F team is there to help you to come up with an idea. Now for some more detailed questions about ArduPlot. Can you explain how ArduPlot works and how you came up with the idea?

Davide: I created ArduPlot from a need to analyse different types of data coming from a microcontroller for an autonomous robotics project one of my classmates and I were developing. The robot had all kinds of sensors on it, and we needed to split fast paced data from the sensors, that required a specific visualisation (line graph, heatmap), from the less frequent text logs. If these two things are mixed together in a single text console, it’s much harder to see what’s happening at a glance.

What ArduPlot does is split this data in two: when it recognises a data packet, it gets analysed and displayed as a visualisation. For any other case the data gets redirected to a text console.

FSFE: What was the biggest challenge or problem you faced when developing your idea?

Davide: The main challenge I faced was reading data from the microcontroller reliably, which meant reading, parsing and displaying it faster than the data coming in, which isn’t a problem with low data rates, but as they get higher issues start to appear if everything isn’t properly implemented.

FSFE:It sounds like you were already somehow familiar with microcontrollers before you started ArduPlot. Have you worked with the data from microcontrollers before?

Davide: Yes, but in past projects I didn’t need this type of detailed visual feedback. The Serial Plotter in the Arduino IDE sufficed most of the time, because I had a couple of sensors at most attached to the microcontroller.

FSFE: Are there any problems that ArduPlot has solved for you when working with this kind of data?

Davide: ArduPlot made it possible to see through the 'eyes' of the robot in real time and discover and fix bugs faster. For example, if a sensor got slightly moved and suddenly the robot started to work badly, we instantly knew what went wrong at a glance by looking at the data.

FSFE: What motivated you to keep working on ArduPlot during the programming period?

Davide: The main motivation was the fact that I actually needed the program I was developing, and without ArduPlot, debugging the code of the robot would have been much more time-consuming.

FSFE: Have you continued to work on your project in recent months?

Davide: Yes, but not as much as I wanted to. I have lots of ideas for features I want to implement (and bugs that need to be fixed) but during the past months I have been busy with other projects, and most importantly university, which I have prioritised.

Nevertheless, since the contest ended I’ve added Windows support, I fixed a couple of critical bugs, optimised heatmap rendering, added friendly USB device names alongside the serial device’s location on Linux and added serial output, which was the last thing keeping ArduPlot from reaching feature parity with the Arduino integrated serial terminal/plotter, but with the addition of other quality of life improvements, such as auto reconnect and, of course, the ability to plot graphs on demand!

FSFE: And last but not least, is there anything you would tell new participants to do or not to do?

Davide: Build something you are passionate about and that other people would find useful or cool, but most importantly have fun doing it!

FSFE:Thank you Davide for your time, it was a pleasure to meet you in the Youth Hacking 4 Freedom contest.

The 2024 edition of Youth Hacking 4 Freedom is still going on now! The coding period ends on 30 June. The next edition will start on 01.01.2025. You can already register now. Check out the YH4F website to find out all the details of this competition or feel free to reach out to the organisers via mail!

Support FSFE

  •  

Defending DMA against Apple: The FSFE signs joint position paper

Defending DMA against Apple: The FSFE signs joint position paper

Together with nine stakeholders organisations, the FSFE has submitted a joint position paper to the European Commission, with whom we are working on the implementation of the Digital Markets Act. This paper, supported by legal and data-backed arguments, addresses Apple’s non-compliance with the law, particularly concerning software freedom, alternative Free Software app stores and interoperability obligations.

CC-BY-SA 4.0. by Rahak for FSFE. Limitations to Free Software, vendor lock-in, and lack of control over personal data are current hurdles faced by end-users in digital markets

The Digital Markets Act (DMA) regulates large tech companies in the EU, setting the main rules for designating gatekeepers and enforcing their obligations. As a designated “gatekeeper”, Apple was required to present a strategy for complying with the DMA. Since March 2024, the European Commission (EC) has been investigating it for non-compliance.

Following a series of interventions, in order to assist the DMA enforcement procedure, the FSFE signed a joint position to the EC, highlighting the main problematic aspects of Apple in relation to Free Software.

As far as the FSFE is concerned, the main points relate to:

  • Software freedom: By blocking side-loading of apps and the unfettered installation of alternative app stores, Apple is violating Art.6(4). Concretely, paragraph 4 obliges the gatekeeper to provide users with the possibility to easily install apps from other sources than the gatekeeper’s own software application store. Recital (41) clarifies that the gatekeeper is prohibited from undermining or restricting that possibility in any way.
  • Vendor lock-in vs interoperability: By hampering effective interoperability with of hardware functions, the company is violating Art. 6(7). Apple has introduced an opaque and non-accountable system to grant interoperability that impedes Free Software projects to effectively access hardware and software functions of devices. The DMA prescribes the opposite: interoperability should be granted free of charge and effectively, so third parties can enjoy the same privileged access to hardware and software as the gatekeepers.

The FSFE welcomes the EC’s efforts in finding Apple to be in breach of the law. However, this is only the first step in a regulatory process aimed at reducing the company’s monopolistic control over devices.

Apple threatens Free Software – please help protecting software freedom!

The DMA includes several provisions directly impacting Free Software. It mandates “gatekeepers” to allow installing of software (sideloading), to enable alternative app stores and repositories to be used in devices, and several interoperability obligations, allowing third party developers to access the same hardware functions as the gatekeepers.

Apple’s unfair behaviour against Free Software highlights the critical need to monitor the implementation of the DMA. The FSFE collaborated with F-Droid, the AppFair project, and other interoperability experts to scrutinize Apple’s DMA compliance, and it’s impact on Free Software. Since then, we coordinated several expert workshops with stakeholders, discussed with regulators in FOSDEM, had official meetings with the EC’s DMA team, and submitted a comprehensive position to the EC detailing several problematic elements in the Apple compliance that will harm the Free Software.

Free Software is key for a democratic society and we should not allow gatekeepers to threaten our rights and freedoms. Apple has a huge revenue from blocking Free Software on iOS, and has dedicated a lot of resources to interpret the DMA as it deems fit. For instance, Apple publicly stated that iPhones and iPads are not general purpose computers, and users are not allowed to run the software they want.

Holding companies like Apple accountable under the DMA is a complicated, time-consuming and resource-intensive activity. It can even be a dangerous one as the risk of retaliation is real. We face it with courage and determination. If you are not yet an FSFE supporter, please join our cause today.

Defending Free Software against large corporations takes a long time, maybe more than a decade.Our long-term commitment includes engaging with Free Software communities across Europe, conducting research and analysis for legal and policy positions, participating in official hearings, and we are getting prepared to be involved in strategic litigation.

Inflation is hitting everyone, especially organizations like ours that rely on individual donations. Your regular support is vital to help us continue standing up to those who seek to circumvent the law and undermine our freedoms.

Donate now

Support FSFE

  •  
❌