YUM security issues...

[Josh Bressers]

On 29 July 2008, "Domsch, Matt" wrote:
> On Tue, Jul 29, 2008 at 11:35:03AM -0500, Justin Cappos wrote:
> >    I was wondering if any changes have been made or are planned for
> >    MirrorManager (i.e. preventing mirrors from arbitrary grabbing parts
> >    of the address space).   We're submitting the final version of our
> >    paper soon (the version that will appear in print) and I'd like to
> >    include any updates about this.
> 
> As for "arbitrary grabbing of address space", I'm open to ideas.
> Perhaps a /16 is too large for "anyone" to be able to grab - e.g. could
> should limit the auto-granted size by some amount.  However, it
> doesn't eliminate the concern.  If Mallory wants to attack
> specifically Alice, he only need know the addresses Alice is likely to
> be coming from and add those in, even one-at-a-time.
> 
> Restricting to a /16 seemed reasonable to me.  A good balance of "big
> enough to be useful", yet small enough that it can't affect too many
> people.  Larger allocations are available on request, by showing some
> form of ARIN assignment.  Still, one could request such and run a
> mirror inside that assignment that is still malicious.  And I'm not
> willing to throw out this very useful feature, for fear someone could
> use it for evil.
> 

I think this is fine, and even desirable in most instances.  As long as yum
will try the next mirror in the list if the primary one is outdated, this
becomes a non issue.

If anything, I'd suggest you advertise this feature more.  I had no idea
MirrorManager could do this, and I suspect there are a number of
organizations that could benefit from knowing this.

Thanks.

-- 
    JB