{"id":3002,"date":"2012-11-17T14:13:06","date_gmt":"2012-11-17T20:13:06","guid":{"rendered":"http:\/\/icesquare.com\/wordpress\/?p=3002"},"modified":"2014-07-06T18:42:21","modified_gmt":"2014-07-06T23:42:21","slug":"freebsd-org-was-compromised","status":"publish","type":"post","link":"https:\/\/icesquare.com\/wordpress\/freebsd-org-was-compromised\/","title":{"rendered":"FreeBSD.org Was Compromised. What Should You Do Next?"},"content":{"rendered":"

In case you are not aware this bad news. FreeBSD.org was compromised<\/a> on September 17, 2012. Good news is that the compromise was caused by a human error (a stupid developer leaked a SSH private key somewhere), which has nothing to do with the code quality of the FreeBSD<\/strong>. \ud83d\ude42 Bad news is that this may affect you if you use port. \ud83d\ude41\n<\/p>\n

<\/div>\n

The compromise is believed to have occurred due to the leak of an SSH key from a developer who legitimately had access to the machines in question, and was not due to any vulnerability or code exploit within FreeBSD.<\/p><\/blockquote>\n

<\/div>\n

We unfortunately cannot guarantee the integrity of any packages available for installation between 19th September 2012 and 11th November 2012, or of any ports compiled from trees obtained via any means other than through svn.freebsd.org or one of its mirrors. Although we have no evidence to suggest any tampering took place and believe such interference is unlikely, we have to recommend you consider reinstalling any machine from scratch, using trusted sources.<\/p><\/blockquote>\n

In short, the port tree was affected from September 19, 2012 to November 11, 2012. If you downloaded the ports in between this period, you are likely a victim of this incident. \ud83d\ude41 Here is how to clean up the mess:<\/p>\n

Stop using cvsup\/csup to update your port. Use portsnap instead.<\/p>\n

If you already used portsnap, do the following:<\/p>\n

\r\nsudo portsnap fetch extract\r\nsudo portsnap upgrade\r\n<\/pre>\n
If you have no idea what is portsnap, here is a quick tutorial:<\/p>\n
First, install the portmaster and portupgrade. Port-Upgrade downloads the new ports to your server and Port-Master updates your applications based on the downloaded ports.<\/p>\n
\r\nsudo pkg_add -r portupgrade portmaster\r\n<\/pre>\n
Download all ports. Notice that this is one-time work.<\/p>\n
\r\nsudo portsnap fetch extract\r\n<\/pre>\n
If you decide to update your port tree, run the following:<\/p>\n
\r\nsudo portsnap fetch update\r\n<\/pre>\n
Or if you like to run it in a cron job, run the following instead:<\/p>\n
\r\nsudo nano \/etc\/crontab\r\n\r\n#Run every three hours\r\n0       *\/3     *       *       *       root    portsnap -I cron update && pkg_version -vIL= >\/dev\/null 2>&1\r\n<\/pre>\n
Now you have an updated port tree. Next you will need to update your applications based on your local port tree:<\/p>\n
\r\nsudo portmaster -Dai\r\n<\/pre>\n
That’s it.<\/p>\n
And remember, NEVER put your SSH private key in a public area.<\/p>\n
–Derrick<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
In case you are not aware this bad news. FreeBSD.org was compromised on September 17, 2012. Good news is that the compromise was caused by a human error (a stupid Continue Reading →<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[94,146,7,144,6,69],"tags":[171],"class_list":["post-3002","post","type-post","status-publish","format-standard","hentry","category-computer-problems-computer-help-pc-support","category-everyday-computer-problem","category-freebsd","category-sever-problem","category-technology","category-troubleshooting-technology","tag-freebsd"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/p1sqzr-Mq","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":2181,"url":"https:\/\/icesquare.com\/wordpress\/freebsd-updateinstalling-updates-install-usrsrcliblibcgenlibc_dlopen-c-no-such-file-or-directory\/","url_meta":{"origin":3002,"position":0},"title":"[FreeBSD-update]Installing updates…install: \/\/\/usr\/src\/lib\/libc\/gen\/libc_dlopen.c: No such file or directory","author":"Derrick","date":"December 23, 2011","format":false,"excerpt":"When I tried to upgrade my FreeBSD system today, I received a last minute Christmas gift from the FreeBSD team. :-) #sudo freebsd-update fetch Looking up update.FreeBSD.org mirrors... 4 mirrors found. Fetching metadata signature for 8.2-RELEASE from update4.FreeBSD.org... done. Fetching metadata index... done. Inspecting system... done. Preparing to download files...\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":3295,"url":"https:\/\/icesquare.com\/wordpress\/freebsdproblem-to-update-curl-7-31-0\/","url_meta":{"origin":3002,"position":1},"title":"[FreeBSD]Problem to Update cURL-7.31.0","author":"Derrick","date":"August 6, 2013","format":false,"excerpt":"When I tried to update the cURL to cURL 7.31.0 today for my FreeBSD, it stopped and gave the following error messages: configure: using CFLAGS: -O2 -pipe -DLDAP_DEPRECATED -fno-strict-aliasing configure: CFLAGS error: CFLAGS may only be used to specify C compiler flags, not macro definitions. Use CPPFLAGS for: -DLDAP_DEPRECATED configure:\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":3736,"url":"https:\/\/icesquare.com\/wordpress\/this-rsync-lacks-old-style-compress-due-to-its-external-zlib-try-zz\/","url_meta":{"origin":3002,"position":2},"title":"This rsync lacks old-style –compress due to its external zlib.  Try -zz.","author":"Derrick","date":"September 15, 2014","format":false,"excerpt":"When I tried to run rsync (3.1.1) on my FreeBSD box today, the following message caught my attention: #rsync -avzr --rsh=\"ssh -c arcfour\" --delete --compress-level=9 sourcemachine:\/source\/ \/target\/ This rsync lacks old-style --compress due to its external zlib. Try -zz. Continuing without compression. Basically, rsync suggests that you should use the\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2616,"url":"https:\/\/icesquare.com\/wordpress\/upgrade-freebsd-8-to-9\/","url_meta":{"origin":3002,"position":3},"title":"How to Upgrade FreeBSD from 8 to 9","author":"Derrick","date":"January 9, 2013","format":false,"excerpt":"Upgrading FreeBSD is very easy. Thanks for the simple architecture design and the disconnection between the kernel and the applications (ports), the whole process takes around 15 to 45 minutes. The coolest thing is that the system down time is very short. In my case, the down time was only\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":3309,"url":"https:\/\/icesquare.com\/wordpress\/sftp-without-ssh-shell-access-2\/","url_meta":{"origin":3002,"position":4},"title":"SFTP Without SSH Shell Access","author":"Derrick","date":"October 7, 2013","format":false,"excerpt":"I got an interesting question today. Our client needs to access to the server via SFTP, but they want to disable to the access to the SSH shell. Assuming that you are fully aware of the potential issues of doing it, such ask security risk etc, here is how to\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":923,"url":"https:\/\/icesquare.com\/wordpress\/freebsd-or-linux\/","url_meta":{"origin":3002,"position":5},"title":"FreeBSD or Linux in 6 Simple Questions","author":"Derrick","date":"February 18, 2016","format":false,"excerpt":"FreeBSD or Linux FreeBSD or Linux (Ubuntu\/RHEL)? This is a very old question. It's like asking iPhone or Android. There is no short answer. It all depends on your situation. To make things easier, I am going to break it down into six simple questions to help you making decision.\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/posts\/3002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/comments?post=3002"}],"version-history":[{"count":20,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/posts\/3002\/revisions"}],"predecessor-version":[{"id":3663,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/posts\/3002\/revisions\/3663"}],"wp:attachment":[{"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/media?parent=3002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/categories?post=3002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/tags?post=3002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}