Daily Archives: February 12, 2024

Advisories

rear-2.7-8.fc38

Read Time:4 Minute, 24 Second

FEDORA-2024-49ddbf447d

Packages in this update:

rear-2.7-8.fc38

Update description:

Fri Feb 9 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-8
Sync with patches in CentOS Stream 9 (kudos to @pcahyna!) chronologically
from the latest:
Resolve libs for executable links in COPY_AS_IS, PR 3073
Skip invalid disk drives when saving layout PR 3047
Do not delete NetBackup logs in case of errors and save
/usr/openv/netbackup/logs to the restored system after a successful recovery
Add /usr/openv/var to COPY_AS_IS_NBU, fixes an issue seen
with NetBackup 10.2.0.1
Support saving and restoring hybrid BIOS/UEFI bootloader, PRs 3145 3136
Thu Feb 8 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-7
do not generate /etc/rear/os.conf during build
Wed Feb 7 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-6
copy the console= kernel arguments from the original system
Tue Feb 6 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-5
replace dhcp-client with dhcpcd (rhbz#2247060)
Tue Feb 6 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-4
make initrd accessible only by root (CVE-2024-23301)
Tue Feb 6 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-3
fix unusable recovery with newer systemd (rbhz#2254871)
Mon Feb 5 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-2
migrate to SPDX license format
properly use %license and %doc macros
use https in URLs
Fri Feb 2 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-1
rebase to version 2.7 (rhbz#2215778)
drop obsolete patches
rebase remaining patches
Fri Feb 2 2024 Lukáš Zaoral lzaoral@redhat.com – 2.6-14
Sync with patches in CentOS Stream 9 (kudos to @pcahyna!) chronologically
from the latest:
Backport PR 3061 to save LVM pool metadata volume size in disk layout
and restore it
Backport PR 3058 to skip useless xfs mount options when mounting
during recovery, prevents mount errors like “logbuf size must be greater
than or equal to log stripe size”
Add patch to force removal of lvmdevices, prevents LVM problems after
restoring to different disks/cloning. Upstream PR 3043
Add patch to start rsyslog and include NBU systemd units
Apply PR 3027 to ensure correct creation of the rescue environment
when a file is shrinking while being read
Backport PR 2774 to increase USB_UEFI_PART_SIZE to 1024 MiB
Apply upstream patch for temp dir usage with LUKS to ensure
that during recovery an encrypted disk can be unlocked using a keyfile
Backport upstream PR 3031: Secure Boot support for OUTPUT=USB
Correct a mistake done when backporting PR 2691
Backport PR2943 to fix s390x dasd formatting
Require s390utils-{core,base} on s390x
Apply PR2903 to protect against colons in pvdisplay output
Apply PR2873 to fix initrd regeneration on s390x
Apply PR2431 to migrate XFS configuration files
Exclude /etc/lvm/devices from the rescue system to work around a segfault
in lvm pvcreate
Avoid stderr message about irrelevant broken links
Changes for NetBackup (NBU) 9.x support
Backport PR2831 – rsync URL refactoring
fixes rsync OUTPUT_URL when different from BACKUP_URL
Apply PR2795 to detect changes in system files between backup
and rescue image
Apply PR2808 to exclude dev/watchdog* from recovery system
Backport upstream PRs 2827 and 2839 to pass -y to lvcreate instead of one “y”
on stdin
Apply PR2811 to add the PRE/POST_RECOVERY_COMMANDS directives
Recommend dosfstools on x86_64, needed for EFI System Partition
Backport PR2825 to replace defunct mkinitrd with dracut
Apply PR2580 to load the nvram module in the rescue environment in order
to be able to set the boot order on ppc64le LPARs
Backport PR2822 to include the true vi executable in rescue ramdisk
Apply PR2675 to fix leftover temp dir bug (introduced in backported PR2625)
Apply PR2603 to ignore unused PV devices
Apply upstream PR2750 to avoid exclusion of wanted multipath devices
Remove unneeded xorriso dep on s390x (no ISO image support there)
Apply upstream PR2736 to add the EXCLUDE_{IP_ADDRESSES,NETWORK_INTERFACES}
options
Add patch for better handling of thin pools and other LV types not supported
by vgcfgrestore
Sync spec changes and downstream patches from RHEL 8 rear-2.6-2
Fix multipath performance regression in 2.6, introduced by upstream PR #2299.
Resolves: rhbz1993296
On POWER add bootlist & ofpathname to the list of required programs
conditionally (bootlist only if running under PowerVM, ofpathname
always except on PowerNV) – upstream PR2665, add them to package
dependencies
Resolves: rhbz1983013
Backport PR2608:
Fix setting boot path in case of UEFI partition (ESP) on MD RAID
Resolves: rhbz1945869
Backport PR2625
Prevents accidental backup removal in case of errors
Resolves: rhbz1958247
Fix rsync error and option handling
Resolves: rhbz1930662

Put TMPDIR on /var/tmp by default, otherwise it may lack space
RHBZ #1988420, upstream PR2664
Sync spec changes and downstream patches from RHEL 8
Require xorriso instead of genisoimage
Add S/390 support and forgotten dependency on the file utility
Backport upstream code related to LUKS2 support
Modify the cron command to avoid an e-mail with error message after
ReaR is installed but not properly configured when the cron command
is triggered for the first time
Changes for NetBackup (NBU) support, upstream PR2544

Add dependency on dhcp-client, RHBZ #1926451

Read More

Advisories

rear-2.7-8.fc39

Read Time:4 Minute, 24 Second

FEDORA-2024-a2f6e5ddb8

Packages in this update:

rear-2.7-8.fc39

Update description:

Fri Feb 9 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-8
Sync with patches in CentOS Stream 9 (kudos to @pcahyna!) chronologically
from the latest:
Resolve libs for executable links in COPY_AS_IS, PR 3073
Skip invalid disk drives when saving layout PR 3047
Do not delete NetBackup logs in case of errors and save
/usr/openv/netbackup/logs to the restored system after a successful recovery
Add /usr/openv/var to COPY_AS_IS_NBU, fixes an issue seen
with NetBackup 10.2.0.1
Support saving and restoring hybrid BIOS/UEFI bootloader, PRs 3145 3136
Thu Feb 8 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-7
do not generate /etc/rear/os.conf during build
Wed Feb 7 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-6
copy the console= kernel arguments from the original system
Tue Feb 6 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-5
replace dhcp-client with dhcpcd (rhbz#2247060)
Tue Feb 6 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-4
make initrd accessible only by root (CVE-2024-23301)
Tue Feb 6 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-3
fix unusable recovery with newer systemd (rbhz#2254871)
Mon Feb 5 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-2
migrate to SPDX license format
properly use %license and %doc macros
use https in URLs
Fri Feb 2 2024 Lukáš Zaoral lzaoral@redhat.com – 2.7-1
rebase to version 2.7 (rhbz#2215778)
drop obsolete patches
rebase remaining patches
Fri Feb 2 2024 Lukáš Zaoral lzaoral@redhat.com – 2.6-14
Sync with patches in CentOS Stream 9 (kudos to @pcahyna!) chronologically
from the latest:
Backport PR 3061 to save LVM pool metadata volume size in disk layout
and restore it
Backport PR 3058 to skip useless xfs mount options when mounting
during recovery, prevents mount errors like “logbuf size must be greater
than or equal to log stripe size”
Add patch to force removal of lvmdevices, prevents LVM problems after
restoring to different disks/cloning. Upstream PR 3043
Add patch to start rsyslog and include NBU systemd units
Apply PR 3027 to ensure correct creation of the rescue environment
when a file is shrinking while being read
Backport PR 2774 to increase USB_UEFI_PART_SIZE to 1024 MiB
Apply upstream patch for temp dir usage with LUKS to ensure
that during recovery an encrypted disk can be unlocked using a keyfile
Backport upstream PR 3031: Secure Boot support for OUTPUT=USB
Correct a mistake done when backporting PR 2691
Backport PR2943 to fix s390x dasd formatting
Require s390utils-{core,base} on s390x
Apply PR2903 to protect against colons in pvdisplay output
Apply PR2873 to fix initrd regeneration on s390x
Apply PR2431 to migrate XFS configuration files
Exclude /etc/lvm/devices from the rescue system to work around a segfault
in lvm pvcreate
Avoid stderr message about irrelevant broken links
Changes for NetBackup (NBU) 9.x support
Backport PR2831 – rsync URL refactoring
fixes rsync OUTPUT_URL when different from BACKUP_URL
Apply PR2795 to detect changes in system files between backup
and rescue image
Apply PR2808 to exclude dev/watchdog* from recovery system
Backport upstream PRs 2827 and 2839 to pass -y to lvcreate instead of one “y”
on stdin
Apply PR2811 to add the PRE/POST_RECOVERY_COMMANDS directives
Recommend dosfstools on x86_64, needed for EFI System Partition
Backport PR2825 to replace defunct mkinitrd with dracut
Apply PR2580 to load the nvram module in the rescue environment in order
to be able to set the boot order on ppc64le LPARs
Backport PR2822 to include the true vi executable in rescue ramdisk
Apply PR2675 to fix leftover temp dir bug (introduced in backported PR2625)
Apply PR2603 to ignore unused PV devices
Apply upstream PR2750 to avoid exclusion of wanted multipath devices
Remove unneeded xorriso dep on s390x (no ISO image support there)
Apply upstream PR2736 to add the EXCLUDE_{IP_ADDRESSES,NETWORK_INTERFACES}
options
Add patch for better handling of thin pools and other LV types not supported
by vgcfgrestore
Sync spec changes and downstream patches from RHEL 8 rear-2.6-2
Fix multipath performance regression in 2.6, introduced by upstream PR #2299.
Resolves: rhbz1993296
On POWER add bootlist & ofpathname to the list of required programs
conditionally (bootlist only if running under PowerVM, ofpathname
always except on PowerNV) – upstream PR2665, add them to package
dependencies
Resolves: rhbz1983013
Backport PR2608:
Fix setting boot path in case of UEFI partition (ESP) on MD RAID
Resolves: rhbz1945869
Backport PR2625
Prevents accidental backup removal in case of errors
Resolves: rhbz1958247
Fix rsync error and option handling
Resolves: rhbz1930662

Put TMPDIR on /var/tmp by default, otherwise it may lack space
RHBZ #1988420, upstream PR2664
Sync spec changes and downstream patches from RHEL 8
Require xorriso instead of genisoimage
Add S/390 support and forgotten dependency on the file utility
Backport upstream code related to LUKS2 support
Modify the cron command to avoid an e-mail with error message after
ReaR is installed but not properly configured when the cron command
is triggered for the first time
Changes for NetBackup (NBU) support, upstream PR2544

Add dependency on dhcp-client, RHBZ #1926451

Read More

Advisories

USN-6631-1: WebKitGTK vulnerabilities

Read Time:15 Second

Several security issues were discovered in the WebKitGTK Web and JavaScript
engines. If a user were tricked into viewing a malicious website, a remote
attacker could exploit a variety of issues related to web browser security,
including cross-site scripting attacks, denial of service attacks, and
arbitrary code execution.

Read More

News

Secure networking starts (and ends) at the endpoint

Read Time:3 Minute, 34 Second

One step behind

The last decade has been challenging for the cyber industry. Attackers always seem to have the upper hand while defenders play catch up. It’s common to point to the ever-accelerating frequency and sophistication of attacks, siloed security that creates gaps, and a shortage of skilled cyber professionals as rationale for this lagging position. All are true but none represent the core reason for our current situation. 

The reason we are where we are is because of cloud computing. Don’t get me wrong, cloud computing has been and continues to be profoundly beneficial. It enabled digital transformation that reshaped how we do business. But it is also a huge disruptor that turned traditional, centralized computing and data networking models on their head, forcing carriers and network suppliers alike to innovate and adapt or risk obsolescence. And as networking models shifted, from centralized to distributed, so too did security, but always at a lagging pace. 

With cloud computing, distributed networking, and cloud-based security becoming standard, organizations must reassess their cybersecurity approach. It is imperative that they adopt comprehensive end-to-end solutions that align with the evolving landscape of cloud computing and connectivity to address their cyber challenges. 

Cloud computing’s cascading effect

It’s always been about data – where data lives and how it is accessed by users. Shifts in data residency and access have triggered a series of events, beginning with:

Our introduction to the cloud

Server virtualization and cloud compute infrastructure, frequently referred to as infrastructure as a service (IaaS), ushered in low cost, flexible, and resource efficient computing via virtual machines (VMs)
Growth in cloud computing shifted focus to new ways that enabled users, whether in offices (sites) or at home (remote users), to access the data required to perform their job duties

Cloud adoption led to new networking models

Networks were re-architected to align with shifting data residency, from centralized data centers to distributed cloud infrastructure
This transition included moving from MPLS/datacenter designs to SD-WAN with Internet breakouts and hybrid or multi-cloud solutions 

Network security transformation lagged

As data networking models evolved so too did network security, but at a lagging pace
Over time, the expansion of cloud-delivered security solutions helped organizations to align and optimize network security within this new cloud and networking environment

But this new data and networking paradigm requires consideration beyond network security 

Endpoint security has become more critical to consider in this new age of cloud computing and network connectivity where the focus is now squarely on enabling users on laptops, desktops, and mobile devices (endpoints) to access data on cloud servers and VMs (also endpoints)
Endpoints bookend this continuum of users accessing data on cloud workloads, and as an essential part of the communications flow, they must be considered when designing an end-to-end security solution

Doubling down on the cloud

We have come a long way from the initial cloud use case of test/dev. We’ve since moved to running production-grade applications in the cloud and are now entering the next phase of cloud application development – microservices and containerization. As the cloud becomes increasingly foundational to your organization, it is crucial to prioritize robust security for all cloud workloads. This includes ensuring top-performing endpoint security not only for VMs but also for cloud containers.

Key considerations

As you plan your future in the cloud, keep these key considerations in mind:

Communications continuum: The new communications continuum consists of users on workstations and mobile devices accessing and utilizing data residing in the cloud, within workloads (servers/VMs/containers).

Endpoint significance: Endpoints bookend this continuum so as you consider network security in your modern network and cloud environment, don’t leave endpoint security to chance.

Evaluation and procurement: Assess and procure top performing endpoint security solutions, while ensuring they excel not only on Windows endpoints but also on Linux, given that cloud workloads operate on both Windows and Linux operating systems. Be aware that some solutions may lack feature parity and performance on Linux compared to Windows.

Container security assurance: In addition to robust performance on Linux endpoints, confirm that your chosen endpoint security solutions provide an agent for Kubernetes clusters to secure your cloud containers as well.
 

Read More

News

Secure networking starts (and ends) at the endpoint

Read Time:3 Minute, 34 Second

One step behind

The last decade has been challenging for the cyber industry. Attackers always seem to have the upper hand while defenders play catch up. It’s common to point to the ever-accelerating frequency and sophistication of attacks, siloed security that creates gaps, and a shortage of skilled cyber professionals as rationale for this lagging position. All are true but none represent the core reason for our current situation. 

The reason we are where we are is because of cloud computing. Don’t get me wrong, cloud computing has been and continues to be profoundly beneficial. It enabled digital transformation that reshaped how we do business. But it is also a huge disruptor that turned traditional, centralized computing and data networking models on their head, forcing carriers and network suppliers alike to innovate and adapt or risk obsolescence. And as networking models shifted, from centralized to distributed, so too did security, but always at a lagging pace. 

With cloud computing, distributed networking, and cloud-based security becoming standard, organizations must reassess their cybersecurity approach. It is imperative that they adopt comprehensive end-to-end solutions that align with the evolving landscape of cloud computing and connectivity to address their cyber challenges. 

Cloud computing’s cascading effect

It’s always been about data – where data lives and how it is accessed by users. Shifts in data residency and access have triggered a series of events, beginning with:

Our introduction to the cloud

Server virtualization and cloud compute infrastructure, frequently referred to as infrastructure as a service (IaaS), ushered in low cost, flexible, and resource efficient computing via virtual machines (VMs)
Growth in cloud computing shifted focus to new ways that enabled users, whether in offices (sites) or at home (remote users), to access the data required to perform their job duties

Cloud adoption led to new networking models

Networks were re-architected to align with shifting data residency, from centralized data centers to distributed cloud infrastructure
This transition included moving from MPLS/datacenter designs to SD-WAN with Internet breakouts and hybrid or multi-cloud solutions 

Network security transformation lagged

As data networking models evolved so too did network security, but at a lagging pace
Over time, the expansion of cloud-delivered security solutions helped organizations to align and optimize network security within this new cloud and networking environment

But this new data and networking paradigm requires consideration beyond network security 

Endpoint security has become more critical to consider in this new age of cloud computing and network connectivity where the focus is now squarely on enabling users on laptops, desktops, and mobile devices (endpoints) to access data on cloud servers and VMs (also endpoints)
Endpoints bookend this continuum of users accessing data on cloud workloads, and as an essential part of the communications flow, they must be considered when designing an end-to-end security solution

Doubling down on the cloud

We have come a long way from the initial cloud use case of test/dev. We’ve since moved to running production-grade applications in the cloud and are now entering the next phase of cloud application development – microservices and containerization. As the cloud becomes increasingly foundational to your organization, it is crucial to prioritize robust security for all cloud workloads. This includes ensuring top-performing endpoint security not only for VMs but also for cloud containers.

Key considerations

As you plan your future in the cloud, keep these key considerations in mind:

Communications continuum: The new communications continuum consists of users on workstations and mobile devices accessing and utilizing data residing in the cloud, within workloads (servers/VMs/containers).

Endpoint significance: Endpoints bookend this continuum so as you consider network security in your modern network and cloud environment, don’t leave endpoint security to chance.

Evaluation and procurement: Assess and procure top performing endpoint security solutions, while ensuring they excel not only on Windows endpoints but also on Linux, given that cloud workloads operate on both Windows and Linux operating systems. Be aware that some solutions may lack feature parity and performance on Linux compared to Windows.

Container security assurance: In addition to robust performance on Linux endpoints, confirm that your chosen endpoint security solutions provide an agent for Kubernetes clusters to secure your cloud containers as well.
 

Read More