Finalmente, no dia 22 (estou um pouco atrasado aqui), a turma do Fedora admitiu que a segurança de dois servidores foi comprometida, mas nem foi nada muito sério. Agora tudo parece já estar sob controle. Tudo bem, essas coisas acontecem. O que me deixou realmente p*#$ da vida foi o Frields ficar escondendo o jogo. Eu fiquei aqui, imaginando mil coisas. Acho que todos os usuários do Fedora prenderam a respiração por alguns dias, sem saber ao certo o que estava acontecendo. Custava explicar a situação? Para que tanto mistério?
Achei essa situação toda um absurdo. O ITWire caiu pesado sobre o Fedora, criticando a declaração de Frields de que o alerta foi meio exagerado justamente devido ao respeito que o Fedora tem por seus usuário… dá um tempo! É respeito deixar os usuários boiando, com medo, sem saber o que está acontecendo? Cadê a abertura do Fedora?
Fiquei tão preocupado com a situação que parei de usar o Fedora para o meu trabalho por alguns dias. Como não sabia o que estava acontecendo, fiz uma instalação do Mandriva em uma partição separada, e se querem saber, gostei, e estou postando agora do Mandriva.
Segue o email relatando a situação, para preciação dos caros leitores:
Infrastructure report, 2008-08-22 UTC 1200
- From: “Paul W. Frields” <stickster gmail com>
- To: fedora-announce-list <fedora-announce-list redhat com>
- Subject: Infrastructure report, 2008-08-22 UTC 1200
- Date: Fri, 22 Aug 2008 08:00:02 -0400
Last week we discovered that some Fedora servers were illegally accessed. The intrusion into the servers was quickly discovered, and the servers were taken offline. Security specialists and administrators have been working since then to analyze the intrusion and the extent of the compromise as well as reinstall Fedora systems. We are using the requisite outages as an opportunity to do other upgrades for the sake of functionality as well as security. Work is ongoing, so please be patient. Anyone with pertinent information relating to this event is asked to contact fedora-legal redhat com One of the compromised Fedora servers was a system used for signing Fedora packages. However, based on our efforts, we have high confidence that the intruder was not able to capture the passphrase used to secure the Fedora package signing key. Based on our review to date, the passphrase was not used during the time of the intrusion on the system and the passphrase is not stored on any of the Fedora servers. While there is no definitive evidence that the Fedora key has been compromised, because Fedora packages are distributed via multiple third-party mirrors and repositories, we have decided to convert to new Fedora signing keys. This may require affirmative steps from every Fedora system owner or administrator. We will widely and clearly communicate any such steps to help users when available. Among our other analyses, we have also done numerous checks of the Fedora package collection, and a significant amount of source verification as well, and have found no discrepancies that would indicate any loss of package integrity. These efforts have also not resulted in the discovery of additional security vulnerabilities in packages provided by Fedora. Our previous warnings against further package updates were based on an abundance of caution, out of respect for our users. This is also why we are proceeding with plans to change the Fedora package signing key. We have already started planning and implementing other additional safeguards for the future. At this time we are confident there is little risk to Fedora users who wish to install or upgrade signed Fedora packages. In connection with these events, Red Hat, Inc. detected an intrusion of certain of its computer systems and has issued a communication to Red Hat Enterprise Linux users which can be found at http://rhn.redhat.com/errata/RHSA-2008-0855.html. This communication states in part, "Last week Red Hat detected an intrusion on certain of its computer systems and took immediate action. While the investigation into the intrusion is on-going, our initial focus was to review and test the distribution channel we use with our customers, Red Hat Network (RHN) and its associated security measures. Based on these efforts, we remain highly confident that our systems and processes prevented the intrusion from compromising RHN or the content distributed via RHN and accordingly believe that customers who keep their systems updated using Red Hat Network are not at risk. We are issuing this alert primarily for those who may obtain Red Hat binary packages via channels other than those of official Red Hat subscribers." It is important to note that the effects of the intrusion on Fedora and Red Hat are *not* the same. Accordingly, the Fedora package signing key is not connected to, and is different from, the one used to sign Red Hat Enterprise Linux packages. Furthermore, the Fedora package signing key is also not connected to, and is different from, the one used to sign community Extra Packages for Enterprise Linux (EPEL) packages. We will continue to keep the Fedora community notified of any updates. Thank you again for your patience.
Escrito por robertobech 
Escrito por robertobech 
Escrito por robertobech 