January 2009 - Hpc-admins - mailman3.cels.anl.gov

Re: [HPC-Admins] [CELS Sysadmins] Geek Beer
by Craig Stacey 30 Jan '09

30 Jan '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Gordon Biersch it is. I plan to take off around 5:30ish. == Craig On Jan 30, 2009, at 1:54 PM, Hunter Matthews wrote: > Gordon is fine for me > > On Jan 30, 2009, at 12:04 PM, Craig Stacey wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> Any suggestions on location tonight? >> == >> Craig >> >> >> >> -----BEGIN PGP SIGNATURE----- >> Version: GnuPG v1.4.8 (Darwin) >> >> iEYEARECAAYFAkmDQSsACgkQbVNGA3HOzQuLXACeOD8rMD1E0xvrUoIPwLwK7nkm >> 80sAoKfniRwSbuhHda8c29qUEse2m2mZ >> =5oOZ >> -----END PGP SIGNATURE----- >> _______________________________________________ >> This is the CELS Sysadmins mailing list. It is sent to memebers of: >> core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, >> systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. >> Do not subscribe directly to this list. Thanks. >> >> > > -- > Hunter Matthews Unix Administrator > Office: Bldg 221 Room B240 Argonne National Labs, MCS > Key: F0F88438 / FFB5 34C0 B350 99A4 BB02 9779 A5DB 8B09 F0F8 8438 > Never take candy from strangers. Especially on the internet. > > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkmDh20ACgkQbVNGA3HOzQuuSwCfTiRbZvsbkc6GMbF9gqhwPxtY JukAmwWbHDu9eu01x6NUpbfeYnVq9oID =m6BL -----END PGP SIGNATURE----- _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

1 0

[CELS Sysadmins] Geek Beer
by Craig Stacey 30 Jan '09

30 Jan '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Any suggestions on location tonight? == Craig -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkmDQSsACgkQbVNGA3HOzQuLXACeOD8rMD1E0xvrUoIPwLwK7nkm 80sAoKfniRwSbuhHda8c29qUEse2m2mZ =5oOZ -----END PGP SIGNATURE----- _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

1 0

Re: [HPC-Admins] [CELS Sysadmins] [mcs-internal #23315] [Fwd: [MediaWiki-announce] MediaWiki 1.13.3, 1.12.2, 1.6.11 security update]
by Kenneth Raffenetti 28 Jan '09

28 Jan '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This upgrade was actually quite a bit easier than I anticipated. Since there were no database updates, I just need to update the core wiki code. This is done. Please report any wiki issues to systems(a)mcs.anl.gov Ken Kenneth Raffenetti wrote: > Hi all, > > So it appears I copied the wrong list on this the first time around, so > here it goes again. > > I want to apply these Mediawiki updates next Wednesday (1/28) @ 5pm. I > estimate an outage of about an hour for all MCS and ALCF wikis. Are > there any objections to the time? > > Ken > > Kenneth Raffenetti wrote: >> Making a reminded to apply security patches to Mediawiki. > >> Ken > > ------------------------------------------------------------------------ > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > This is a security release of MediaWiki 1.13.3, 1.12.1 and 1.6.11. > Some of the security issues affect *all* versions of MediaWiki except > the versions released today, so all site administrators are encouraged > to upgrade. > > Users of the development (trunk) branch should upgrade to r44506 or later. > > David Remahl of Apple's Product Security team has identified a number > of security issues in MediaWiki. Subsequent analysis by the MediaWiki > development team led to further discoveries. The issues with a > significant impact are as follows: > > * An XSS vulnerability affecting all MediaWiki installations between > 1.13.0 and 1.13.2. [CVE-2008-5249] > * A local script injection vulnerability affecting Internet Explorer > clients for all MediaWiki installations with uploads enabled. > [CVE-2008-5250] > * A local script injection vulnerability affecting clients with SVG > scripting capability (such as Firefox 1.5+), for all MediaWiki > installations with SVG uploads enabled. [CVE-2008-5250] > * A CSRF vulnerability affecting the Special:Import feature, for all > MediaWiki installations since the feature was introduced in 1.3.0. > [CVE-2008-5252] > > These four vulnerabilities are all fixed in these releases. > > XSS (cross-site scripting) vulnerabilities allow an attacker to steal > an authorised user's login session, and to act as that user on the > wiki. The authorised user must visit a web page controlled by the > attacker in order to activate the attack. Intranet wikis are > vulnerable if the attacker can determine the intranet URL. > > Local script injection vulnerabilities are like XSS vulnerabilities, > except that the attacker must have an account on the local wiki, and > there is no external site involved. The attacker uploads a script to > the wiki, which another user is tricked into executing, with the > effect that the attacker is able to act as the privileged user. > > CSRF vulnerabilities allow an attacker to act as an authorised user on > the wiki, but unlike an XSS vulnerability, the attacker can only act > as the user in a specific and restricted way. The present CSRF > vulnerability allows pages to be edited, with forged revision > histories. Like an XSS vulnerability, the authorised user must visit > the malicious web page to activate the attack. > > David Remahl also reminded us of some security-related configuration > issues: > > * Since 1.11, by default, MediaWiki stores a backup of deleted images > in the images/deleted > directory. If you do not want these images to be publically > accessible, make > sure this directory is not accessible from the web. MediaWiki takes > some steps > to avoid leaking these images, but these measures are not perfect. > * Set display_errors=off in your php.ini to avoid path disclosure via > PHP fatal > errors. This is the default on most shared web hosts. > * Enabling MediaWiki's debugging features, such as > $wgShowExceptionDetails, may > lead to path disclosure. > > Users of MediaWiki 1.6.x (the last branch which supported PHP 4) are > strongly recommended to upgrade to PHP 5 and MediaWiki 1.13.3. It is > not necessary to upgrade to 1.6.11 first, just upgrade directly to the > latest version. > > Upgrade FAQ: > http://www.mediawiki.org/wiki/Manual:FAQ#Upgrading > > Full release notes: > http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_13_3/phase3/RELEASE-NO… > http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_12_2/phase3/RELEASE-NO… > http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_6_11/phase3/RELEASE-NO… > > > ********************************************************************** > MEDIAWIKI 1.13.3 > ********************************************************************** > Download: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.tar.gz > > Patch to previous version (1.13.2), without interface text: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.patch.gz > Interface text changes: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-i18n-1.13.3.patch.gz > > GPG signatures: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.tar.gz.sig > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.patch.gz.sig > http://download.wikimedia.org/mediawiki/1.13/mediawiki-i18n-1.13.3.patch.gz… > > Public keys: > https://secure.wikimedia.org/keys.html > > ********************************************************************** > MEDIAWIKI 1.12.2 > ********************************************************************** > Download: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.tar.gz > > Patch to previous version (1.12.1), without interface text: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.patch.gz > Interface text changes: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-i18n-1.12.2.patch.gz > > GPG signatures: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.tar.gz.sig > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.patch.gz.sig > http://download.wikimedia.org/mediawiki/1.12/mediawiki-i18n-1.12.2.patch.gz… > > Public keys: > https://secure.wikimedia.org/keys.html > > ********************************************************************** > MEDIAWIKI 1.6.11 > ********************************************************************** > Download: > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.tar.gz > > Patch to previous version (1.6.10): > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.patch.gz > > GPG signatures: > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.tar.gz.sig > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.patch.gz.sig > > Public keys: > https://secure.wikimedia.org/keys.html > > - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkmA5okACgkQvRJB9CBtvwjazACghwjG4BPVljMsXrBPBOj5xq88 4Z4An1s1i3yxaHBrkj3jbk+/M0BX7M6x =qyEz -----END PGP SIGNATURE----- _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

1 0

Re: [HPC-Admins] [CELS Sysadmins] [mcs-internal #23315] [Fwd: [MediaWiki-announce] MediaWiki 1.13.3, 1.12.2, 1.6.11 security update]
by Kenneth Raffenetti 27 Jan '09

27 Jan '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just a reminder that I'm still planning to do this upgrade tomorrow. Here is the list of wikis that will be affected by the approximate 1 hour of downtime. bionet.mcs.anl.gov cgat-wiki.mcs.anl.gov dev.globus.org igsb-core.mcs.anl.gov nek5000.mcs.anl.gov water.cogkit.org wiki.cogkit.org wiki.globus.org wiki.igsb.org wiki-internal.igsb.org wiki.iwire.org wiki.lcrc.anl.gov wiki.mcs.anl.gov wiki.alcf.anl.gov wiki-internal.alcf.anl.gov Please let me know before 5pm tomorrow if this will be a problem. Thanks, Ken Kenneth Raffenetti wrote: > Hi all, > > So it appears I copied the wrong list on this the first time around, so > here it goes again. > > I want to apply these Mediawiki updates next Wednesday (1/28) @ 5pm. I > estimate an outage of about an hour for all MCS and ALCF wikis. Are > there any objections to the time? > > Ken > > Kenneth Raffenetti wrote: >> Making a reminded to apply security patches to Mediawiki. > >> Ken > > ------------------------------------------------------------------------ > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > This is a security release of MediaWiki 1.13.3, 1.12.1 and 1.6.11. > Some of the security issues affect *all* versions of MediaWiki except > the versions released today, so all site administrators are encouraged > to upgrade. > > Users of the development (trunk) branch should upgrade to r44506 or later. > > David Remahl of Apple's Product Security team has identified a number > of security issues in MediaWiki. Subsequent analysis by the MediaWiki > development team led to further discoveries. The issues with a > significant impact are as follows: > > * An XSS vulnerability affecting all MediaWiki installations between > 1.13.0 and 1.13.2. [CVE-2008-5249] > * A local script injection vulnerability affecting Internet Explorer > clients for all MediaWiki installations with uploads enabled. > [CVE-2008-5250] > * A local script injection vulnerability affecting clients with SVG > scripting capability (such as Firefox 1.5+), for all MediaWiki > installations with SVG uploads enabled. [CVE-2008-5250] > * A CSRF vulnerability affecting the Special:Import feature, for all > MediaWiki installations since the feature was introduced in 1.3.0. > [CVE-2008-5252] > > These four vulnerabilities are all fixed in these releases. > > XSS (cross-site scripting) vulnerabilities allow an attacker to steal > an authorised user's login session, and to act as that user on the > wiki. The authorised user must visit a web page controlled by the > attacker in order to activate the attack. Intranet wikis are > vulnerable if the attacker can determine the intranet URL. > > Local script injection vulnerabilities are like XSS vulnerabilities, > except that the attacker must have an account on the local wiki, and > there is no external site involved. The attacker uploads a script to > the wiki, which another user is tricked into executing, with the > effect that the attacker is able to act as the privileged user. > > CSRF vulnerabilities allow an attacker to act as an authorised user on > the wiki, but unlike an XSS vulnerability, the attacker can only act > as the user in a specific and restricted way. The present CSRF > vulnerability allows pages to be edited, with forged revision > histories. Like an XSS vulnerability, the authorised user must visit > the malicious web page to activate the attack. > > David Remahl also reminded us of some security-related configuration > issues: > > * Since 1.11, by default, MediaWiki stores a backup of deleted images > in the images/deleted > directory. If you do not want these images to be publically > accessible, make > sure this directory is not accessible from the web. MediaWiki takes > some steps > to avoid leaking these images, but these measures are not perfect. > * Set display_errors=off in your php.ini to avoid path disclosure via > PHP fatal > errors. This is the default on most shared web hosts. > * Enabling MediaWiki's debugging features, such as > $wgShowExceptionDetails, may > lead to path disclosure. > > Users of MediaWiki 1.6.x (the last branch which supported PHP 4) are > strongly recommended to upgrade to PHP 5 and MediaWiki 1.13.3. It is > not necessary to upgrade to 1.6.11 first, just upgrade directly to the > latest version. > > Upgrade FAQ: > http://www.mediawiki.org/wiki/Manual:FAQ#Upgrading > > Full release notes: > http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_13_3/phase3/RELEASE-NO… > http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_12_2/phase3/RELEASE-NO… > http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_6_11/phase3/RELEASE-NO… > > > ********************************************************************** > MEDIAWIKI 1.13.3 > ********************************************************************** > Download: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.tar.gz > > Patch to previous version (1.13.2), without interface text: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.patch.gz > Interface text changes: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-i18n-1.13.3.patch.gz > > GPG signatures: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.tar.gz.sig > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.patch.gz.sig > http://download.wikimedia.org/mediawiki/1.13/mediawiki-i18n-1.13.3.patch.gz… > > Public keys: > https://secure.wikimedia.org/keys.html > > ********************************************************************** > MEDIAWIKI 1.12.2 > ********************************************************************** > Download: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.tar.gz > > Patch to previous version (1.12.1), without interface text: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.patch.gz > Interface text changes: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-i18n-1.12.2.patch.gz > > GPG signatures: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.tar.gz.sig > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.patch.gz.sig > http://download.wikimedia.org/mediawiki/1.12/mediawiki-i18n-1.12.2.patch.gz… > > Public keys: > https://secure.wikimedia.org/keys.html > > ********************************************************************** > MEDIAWIKI 1.6.11 > ********************************************************************** > Download: > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.tar.gz > > Patch to previous version (1.6.10): > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.patch.gz > > GPG signatures: > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.tar.gz.sig > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.patch.gz.sig > > Public keys: > https://secure.wikimedia.org/keys.html > > - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkl/mvwACgkQvRJB9CBtvwhriACgrMCGo69YaUg7JzD5tkWYuXlt KlMAnRMKpcW1OqmWwfHWkSg77+CPv6a6 =6/3k -----END PGP SIGNATURE----- _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

1 0

Fargo Brazilian Jiu-jitsu Academy taken 2009 by storm!
by Fargo Brazilian Jiu-Jitsu 23 Jan '09

23 Jan '09

1 0

Fargo Brazilian Jiu-jitsu Academy
by fargobjj＠yahoo.com 17 Jan '09

17 Jan '09

1 0