| 1 |
So to avoid "spamming" with 20+ Thank You emails I'll send out just one and thank you all collectively for the information provided (I hope this isn't rude - I'm not sure of proper protocol in this situation). |
| 2 |
|
| 3 |
I have a lot more insight now and some new ideas of where I need to look to learn more. This is a great community and it reflects in the OS - I don't know why I waited so long to try Gentoo.(??)! |
| 4 |
-john |
| 5 |
|
| 6 |
-----Original Message----- |
| 7 |
From: Mansour Moufid [mailto:mansourmoufid@×××××.com] |
| 8 |
Sent: Tuesday, April 06, 2010 10:15 PM |
| 9 |
To: gentoo-security@l.g.o |
| 10 |
Subject: Re: [gentoo-security] portage/rsync question |
| 11 |
|
| 12 |
On Tue, Apr 6, 2010 at 2:56 PM, Butterworth, John W. |
| 13 |
<jbutterworth@×××××.org> wrote: |
| 14 |
> If someone makes a change to a copy of a program (say a backdoor added to |
| 15 |
> apache) hosted on a public mirror, will the sync’ing between the public |
| 16 |
> mirror and the main rotation mirror determine that it's corrupted (via 'bad' |
| 17 |
> checksum) on the public-mirror side and replace it? |
| 18 |
|
| 19 |
Package files themselves aren't part of the Portage tree (i.e. they |
| 20 |
aren't hosted by the Portage mirrors). Only the ebuilds (and |
| 21 |
accompanying metadata files) are. Ebuilds (generally) will point to |
| 22 |
the package files on public websites. |
| 23 |
|
| 24 |
If an attacker has access to the package files (say at apache.org), |
| 25 |
then your local Portage would indeed notice the corruption. On the |
| 26 |
other hand, if they have access to the ebuilds and Manifest files of |
| 27 |
the mirror you rsync to, Portage checks protect against nothing. At |
| 28 |
that point, unless the attacker also controls the mirror server's |
| 29 |
syncing with the main Gentoo tree, then yes, any malicious changes |
| 30 |
would be overwritten during its next sync. That's not something to |
| 31 |
count on. |
| 32 |
|
| 33 |
-- |
| 34 |
Mansour Moufid |
Archives