ftp://ftp.slackware.com

Lufbery · 08-25-2010, 12:32 PM

Hi all,

Yes, anonymous login (username "anonymous" and e-mail address for password) should work. I just tried it too and got the same error -- "530 Limit reached. Visit http://www.slackware.com/getslack/ for mirrors." -- that rg3 got.

Yes, it would be nice to get the .asc and MD5sums from the official site to check downloaded packages when there's an update.

However, slackware.osuosl.org seems to work just fine.

Regards,

Alien Bob · 08-25-2010, 04:21 PM

Quote:

Originally Posted by Lufbery

Yes, it would be nice to get the .asc and MD5sums from the official site to check downloaded packages when there's an update.

As long as you have the Slackware GPG key, an .asc file from any mirror location should be as good as the one from slackware.com. There is no way the .asc file can be manipulated without getting errors in the "gpg --verify" step later on.

Eric

rg3 · 08-26-2010, 02:32 AM

Again, you can treat slackware.osuosl.org as the master site. However, it's relevant to point out that, from the paranoid security point of view, it's not as simple as verifying the .asc file from any mirror. When there are security updates, a hypothetical evil mirror could just rename the old package file and signature, and it will not give any errors when verifying the signature. The user may or may not notice they're still using the vulnerable version.

There are two solutions that make sense. One is to download the CHECKSUMS.md5 files and their signatures, verifying those signatures, and then checking the MD5 sums of the downloaded packages. A second solution is to download the signatures from a master site, like slackware.osuosl.org, even when you download the packages themselves from a normal mirror.

I think it's worth pointing out these details.

wildwizard · 08-26-2010, 04:45 AM

Quote:

Originally Posted by rg3

There are two solutions that make sense.

Option 3

Subscribe to the Slackware security mailing list and get the md5's emailed to you as well as notice that an update is available.

Alien Bob · 08-26-2010, 06:26 AM

Quote:

Originally Posted by rg3

Again, you can treat slackware.osuosl.org as the master site. However, it's relevant to point out that, from the paranoid security point of view, it's not as simple as verifying the .asc file from any mirror. When there are security updates, a hypothetical evil mirror could just rename the old package file and signature, and it will not give any errors when verifying the signature. The user may or may not notice they're still using the vulnerable version.

There are two solutions that make sense. One is to download the CHECKSUMS.md5 files and their signatures, verifying those signatures, and then checking the MD5 sums of the downloaded packages. A second solution is to download the signatures from a master site, like slackware.osuosl.org, even when you download the packages themselves from a normal mirror.

I think it's worth pointing out these details.

While you can spoof a .md5 file (by messing with the package and then re-generating the .md5 file) you can never spoof a GPG signature (the .asc file) because re-generating the content of the .asc file requires that you have Patric Volkerding's private GPG key plus his password in your possession.

Therefore, if a .asc file validates (gpg --verify) then you can be certain that you have the unmodified package, even if the .asc file was downloaded from a shady mirror site.

Eric

wildwizard · 08-26-2010, 06:53 AM

Quote:

Originally Posted by Alien Bob

Therefore, if a .asc file validates (gpg --verify) then you can be certain that you have the unmodified package, even if the .asc file was downloaded from a shady mirror site.

Eric his method does actually work

You can simply rename the old file and it's .asc file to be the same as the newer patched version and they will verify perfectly.

The trick is not changing the data but rather making someone think they are getting a newer version when in fact they are keeping the same old version.

Code:

michael@indigo:/mnt/disk2/temp$ gpg -v --verify my-fake-package.txz.asc                
gpg: armor header: Version: GnuPG v1.4.10 (GNU/Linux)
gpg: assuming signed data in `my-fake-package.txz'
gpg: Signature made Fri 25 Jun 2010 15:54:12 EST using DSA key ID 40102233
gpg: using PGP trust model
gpg: Good signature from "Slackware Linux Project <security@slackware.com>"
gpg: binary signature, digest algorithm SHA1

Alien Bob · 08-27-2010, 10:16 AM

Yes but that still gives you an actual original unmodified Slackware package. No harmful code will be installed.

But I get your point, and that is why there is also a CHECKSUMS.md5.asc file which allows you to validate the CHECKSUMS.md5 file as authentic and that verified & validated CHECKSUMS.md5 file in turn allows you to check the md5sum of every individual package. There is no way around that. If you rename a package it will get caught by a check of the md5sums.

Eric

Alien Bob · 08-27-2010, 10:21 AM

FYI -

Anonymous FTP access to ftp.slackware.com was flakey, but that has been fixed now. Go and check it out. it works again.

Eric

Lufbery · 08-29-2010, 05:41 PM

Yup! It works fine now. Thanks!