| 00:04.21 | *** join/#debianppc Curalton (~thomas@134.76.62.145) |
| 00:05.45 | skel | how do I connect to a remote machine running X? I know its something with startx I think |
| 00:08.59 | sourdough | skel X -query host |
| 00:11.35 | skel | sourdough: ah. |
| 00:11.35 | skel | sourdough: ty =] |
| 00:11.57 | skel | can I do that while in X locally? can I have that come up on :1 or something? |
| 00:16.05 | sourdough | erm generally no |
| 00:16.26 | sourdough | default config forbids non-console users from running X |
| 00:16.46 | sourdough | but on console yeah you can run more then one server |
| 00:17.02 | sourdough | X -query host :1 should work |
| 00:17.22 | skel | ok I'll give that a shot, was trying from within X =P |
| 00:17.29 | skel | sourdough: thank you |
| 00:17.34 | sourdough | yeah thats forbidden by default |
| 00:17.43 | sourdough | otherwise users could ssh in and run all the X servers they want |
| 00:20.15 | skel | ah |
| 00:20.16 | skel | yeah |
| 00:21.08 | sourdough | hmm |
| 00:21.26 | sourdough | i wonder if its possible to use ipsec on something that is entirely netbooted from nfs.. |
| 00:23.24 | *** join/#debianppc ianw (ianw@mingus.disy.cse.unsw.EDU.AU) |
| 00:43.53 | *** join/#debianppc dmp (~dmp@81-86-127-215.dsl.pipex.com) |
| 00:45.50 | *** join/#debianppc pook (~pook@pook.kicks-ass.org) |
| 00:54.13 | piranha | skel could have used Xnest. |
| 00:55.26 | piranha | sourdough: I've thought about making an initrd image with enough utilities to configure IPsec, mount an NFS filesystem, and pivot_root to the filesystem. |
| 00:56.12 | piranha | Not entirely netbooted, but I don't see how you could securely do IPsec on a computer without local storage. |
| 01:03.24 | sourdough | piranha yeah, you can't just generate new random keys on boot could you? |
| 01:03.48 | sourdough | im trying to come up with a way to have a secure X terminal |
| 01:04.11 | piranha | sourdough: I guess you could. Hmm... |
| 01:04.12 | *** join/#debianppc valhalla_ (~valhalla@pcp01780124pcs.howard01.md.comcast.net) |
| 01:04.25 | sourdough | i don't really know how ipsec works, and the docs ive found so far suck |
| 01:05.38 | piranha | I guess the server doesn't need to know the terminal's key ahead of time, because the user at the terminal will authenticate with a password for xdm (or whatever). |
| 01:05.58 | piranha | But the terminal should have the key for the server, so that someone can't play MitM between the terminal and server. |
| 01:06.17 | piranha | That's why I wanted to make such an initrd image, too. Secure X terminals. |
| 01:06.56 | sourdough | initrd isn't secure thouhg |
| 01:06.59 | sourdough | anyone can get it via tftp |
| 01:07.18 | sourdough | and ipsec must be in in place before xdm auth, or else the users password is compromised |
| 01:07.42 | sourdough | would the temrinal need just a public key fro the srever? |
| 01:07.53 | sourdough | if thats the case the boottime initrd would be ok, nothing sensitive |
| 01:08.11 | piranha | Well, I was planning on putting the initrd image on a floppy or CD-ROM or CF card. |
| 01:08.19 | sourdough | etherboot can do openssl sig verification on hte boot image too, if its possible to burn etherboot onto a EEPROM in the terminal |
| 01:08.46 | sourdough | piranha thats no secure either, anyone can take the flopy from thier terminal and do whatever with it |
| 01:09.34 | piranha | Well, CF card with IDE adapter then, to clarify. |
| 01:09.56 | sourdough | well the terminal is still fully under the contorl of the user |
| 01:10.08 | sourdough | anything you put in it is compromised |
| 01:10.43 | sourdough | does that server key really need to be kept secret? isnt it just a public key |
| 01:10.54 | sourdough | like a ssh public key, you cna publish those all over with no risk |
| 01:10.59 | piranha | That's what I had in mind, a public key. |
| 01:11.08 | sourdough | tftp is fine for that then |
| 01:11.31 | sourdough | so how does the terminal at boot generate encryption keys and get everything going? |
| 01:12.45 | piranha | I could understand how it could generate a keypair, but I don't know how it could transfer it to the server. |
| 01:12.54 | piranha | Without something evil and prone to break. =) |
| 01:13.07 | sourdough | so the server needs a copy of the terminals public key? |
| 01:13.11 | sourdough | and vise versa? |
| 01:13.54 | piranha | I guess. That's what I was going to do for my initrd image. |
| 01:14.15 | sourdough | how does the initrd get keys to the server though? |
| 01:14.23 | piranha | But that wouldn't work for tftp, since the terminal needs its private key. And if you don't trust the user, then the user could tamper with the system to get the private key. |
| 01:14.25 | sourdough | hardcoded secret keys on the initrd is not at all secure |
| 01:14.40 | sourdough | you can't trust the user |
| 01:15.21 | sourdough | using ipsec in this manner would be pointless if all 200 users can comproise itr trivially |
| 01:15.30 | *** join/#debianppc pook (~pook@pook.kicks-ass.org) |
| 01:15.41 | sourdough | maybe it would be easier to just rewrite XDMCP to be a secure protocol.. |
| 01:16.54 | sourdough | ive heard of kerberos X but i cna't find any docs on how it works or if it would even help here |
| 01:17.48 | *** join/#debianppc madmardigan (hxhbks@67.118.197.154) |
| 01:18.00 | sourdough | what it all boils down to, is this, if you trust the user don't bother with ipsec since you trust them not to sniff the network |
| 01:18.13 | sourdough | if not, then secret keys in the hands of hte user is no better |
| 01:18.35 | piranha | Well, I wanted IPsec for paranoia of compromised systems on the same Ethernets as the terminal and server. |
| 01:18.36 | madmardigan | do op's from this channel have any connections with the op's from #debian? |
| 01:20.26 | sourdough | madmardigan not really |
| 01:20.49 | sourdough | madmardigan simonrvn is op on #debian too i think |
| 01:21.53 | sourdough | piranha i think generating new keys on boot is the only sensible way |
| 01:21.54 | madmardigan | i was wondering because i've been banned from #debian, and i have no idea why... know of a way for me to get back into the channel? |
| 01:22.54 | sourdough | 12 #debian ballard.fr 15923 *!*@67.118.197.154 |
| 01:23.02 | sourdough | hmm you on dynamic IP? |
| 01:23.14 | madmardigan | i'm behind a router |
| 01:23.29 | sourdough | did you get banned or just find yourself banned today? |
| 01:23.40 | madmardigan | i just found myself banned today |
| 01:23.48 | sourdough | perhaps someone else on your network was causing problems |
| 01:23.52 | madmardigan | haven't been in the channel for a few weeks at least |
| 01:24.00 | madmardigan | damn |
| 01:24.15 | sourdough | who else is on your network? (would have that same ip mask) |
| 01:24.44 | madmardigan | no one else that would use irc |
| 01:25.15 | sourdough | i only know two of the ops there,, both don't seem to be around |
| 01:25.46 | madmardigan | ok... thanks for helping anyway |
| 01:26.10 | sourdough | looks like it was put in place 15923 seconds ago if that helps |
| 01:26.10 | *** join/#debianppc pook (~pook@pook.kicks-ass.org) |
| 01:27.03 | madmardigan | ok |
| 01:27.40 | madmardigan | who are the two ops you know? just in case i'm able to find them. |
| 01:27.54 | sourdough | walters and simonrvn |
| 01:28.01 | madmardigan | thanks |
| 01:28.05 | sourdough | chanserv access #debian list gives you the full listing |
| 01:28.14 | sourdough | there are 20 |
| 01:28.19 | madmardigan | cool |
| 01:28.23 | sourdough | well 19 one looks like abot |
| 01:30.07 | sourdough | piranha does ipsec always have to be configured manually on both machines for the two to communicate? or is there any means for machines to negotiate a connection (like ssh) |
| 01:31.21 | piranha | sourdough: The only negotiation mechanism I am aware of is FreeS/WAN's Opportunistic Encryption. But I'm not entirely sure how that works, and it's non-standard. |
| 01:32.00 | sourdough | doesn't seem too difficult to devise something really.. |
| 01:39.27 | *** join/#debianppc [MA]MTM84 (~MTM84@ca-fulrtn-cuda1-c1a-123-a.anhmca.adelphia.net) |
| 01:41.00 | *** join/#debianppc gin_ (~gin@HSE-Montreal-ppp104028.qc.sympatico.ca) |
| 01:41.30 | gin_ | whats the best type of partition to use that can be seen by osx and the linux kernel? |
| 01:41.55 | sourdough | UFS works readonly in linux |
| 01:42.05 | sourdough | HFS+ works well enough on both no |
| 01:42.05 | gin_ | fat32? |
| 01:42.22 | sourdough | macos doesn't like to mount FAT on apple partition tables |
| 01:42.38 | sourdough | id use HFS+ for an exchange partition at htis point |
| 01:42.56 | gin_ | really? i thought it was risky to use hfs? |
| 01:42.59 | gin_ | hfs+ |
| 01:43.02 | sourdough | HFS yeah |
| 01:43.08 | sourdough | HFS+ not nearly so |
| 01:43.26 | sourdough | i wouldn't mount your osx / nor do something dumb like make /home HFS+ |
| 01:43.36 | sourdough | but as a exchange part its fine |
| 01:43.42 | gin_ | ok |
| 01:43.47 | gin_ | thanks |
| 01:43.50 | sourdough | the version in 2.4 seems to be ok |
| 01:43.57 | gin_ | im using 2.6.2 |
| 01:44.02 | gin_ | hows that one? |
| 01:44.04 | sourdough | 2.6 doesn't have support for it |
| 01:44.09 | gin_ | hmm |
| 01:44.10 | sourdough | and the patches are broken presently |
| 01:52.23 | *** join/#debianppc Bor_Ed (~ari@dd205.netikka.fi) |