Home Home > 2008 > 07 > 16
Sign up | Login

Deprecation notice: openSUSE Lizards user blog platform is deprecated, and will remain read only for the time being. Learn more...

Archive for July 16th, 2008

openSUSE Gets the JeOS

July 16th, 2008 by

openSUSE is great for the desktop, great for the server, and now it’s ready to take on appliances — and we don’t mean toasters and blenders. No, we’re talking about software appliances — virtual machine images that come pre-configured with the application you want to use, without any of the hassle normally associated with installing an application.

If you’re interested in building a virtual appliance, or have another use for a minimal operating system, read on to learn about openSUSE LimeJeOS.

What is LimeJeOS?

LimeJeOS is the openSUSE version of JeOS. The term JeOS (“Just enough Operating System”) refers to a customized operating system that precisely fits the needs of a particular application. LimeJeOS includes only the pieces of an operating system required to support a particular application and any other third-party components contained in the appliance. This makes the appliance smaller, more efficient, more secure, and offers better performance than an application running under a full, general-purpose operating system.

As the name suggests, “LimeJeOS” itself is not an appliance or an operating system; it is just the base for various possible appliances. LimeJeOS contains just the very basic parts of an operating system. The major goal is to make the system as small as possible while providing the possibility to install additional software. A LimeJeOS system itself is not very useful without additional packages. Besides an editor (a stripped version of vi) it just contains a package manager that allows the actual applications to be installed. Of course all the usual repositories can be used for that purpose; just with a regular, full-size Linux distribution.

What is the difference between SLE JeOS and LimeJeOS?

SUSE Linux Enterprise JeOS relates to LimeJeOS just like openSUSE relates to SLES. In fact, SLE JeOS is built from the latest version of SLES while LimeJeOS is built from the latest version of openSUSE. While LimeJeOS provides the latest state of the openSUSE distribution, SLE JeOS will offer all the services and support that is also available for SLES.

Which one should you use? If you’re working on a virtual appliance for a project that won’t require commercial support, and you want to track the latest in open source, openSUSE is the version for you.

If you’re working on a project that’s likely to need support, then you probably want to go with SUSE Linux Enterprise JeOS.

Where can I get LimeJeOS?

LimeJeOS is built using kiwi. The configuration files are managed via Subversion and are available at: https://forgesvn1.novell.com/svn/opensuse/trunk/distribution/images/LimeJeOS/

In the future we plan to create a regular package (RPM) and add it to the openSUSE build service, so that the latest version is always created automatically with the latest software versions in openSuSE.

How to build LimeJeOS?

Check out the current version of LimeJeOS using the following commands:

svn co https://forgesvn1.novell.com/svn/opensuse/trunk/distribution/images/LimeJeOS

Make sure you have the needed kiwi packages installed. You will need at least: kiwi, kiwi-tools and kiwi-desc-vmxboot and/or kiwi-desc-xenboot from http://download.opensuse.org/repositories/openSUSE:/Tools/. When those conditions are met, building the openJeOS images is accomplished by just running the “./build.sh” script from the LimeJeOS repository.

./build.sh

Please note that the build process will need at least twice as much diskspace as the final images, so you’ll need around 2 GB of free disk space at this time to build Lime JeOS.

After you have booted the virtual system, log in as user “root” with password “linux”.

Posted in Distribution, Server, Virtualization | 5 Comments »

Meeting By The Pond

July 16th, 2008 by

It’s been two weeks since our last soirée, so without further ado The next openSUSE-GNOME project meeting will take place at the official #opensuse-gnome IRC channel tomorrow Thursday: 2008/07/17 16:00 UTC (18:00 CEST)

For an overview what time this is in different timezones, use:

http://www.timeanddate.com/worldclock/fixedtime.html?day=17&month=07&year=2008&hour=16&min=0&sec=0&p1=0

Topics being covered are:

  • Feature review
  • Policy review
  • Pattern review
  • Patch tagging day
  • Package submission changes

Remember EVERYONE is welcome, new/old, hacker/user etc.  So please come along and join the fun, fancy dress and fishing rods are optional.

Tags:
Posted in Events, GNOME, Marketing | Comments Off on Meeting By The Pond

Package Management Security on openSUSE

July 16th, 2008 by

There has been a report (with further information at this page and at the FAQ) looking at package management security on various distributions that IMO was rather condensed in its summary report and therefore raised some false alarms for various distributions including openSUSE.

Ludwig, one of our security experts, sent out a mail with a reaction to the report and I’d like to point out some of the things from the report and how it’s handled in the openSUSE 11.0 distribution.

Let me state first the major lines of defense that openSUSE uses:

  • Package downgrade is not possible, YaST will not do this automatically and therefore many of the attacks (installing an old and vulnerable package) are not possible.
  • The openSUSE download redirector serves the metadata from a known and trusted source.  I advise everybody to use the download redirector via http://download.opensuse.org.
  • The openSUSE updates have both cryptographically signed packages and cryptographically signed meta data – and YaST check these signatures and reject files that do not match the signature.

The described attacks are:

  • “Replay Attack: Metadata Replay”: Not possible since the openSUSE download redirector serves the metadata from a central location.  The only chance here would be a man-in-the-middle attack but this would not help since YaST will not do a package downgrade.
  • “Replay Attack:Mirror Control”: Yes, it’s easy to become an openSUSE mirror but this will not degrade your security since the metadata comes from the download redirector and we only redirect to mirrors that contain the right version of a package – and the redirector monitors that the mirrors contain the right files.  YaST is designed with mirrors going out of date or getting corrupted in mind.
  • Attacks called “Extraneous Dependencies”, “Unsatisfiable Dependencies”, “Provides Everything” on the other attacks page: Let me cite the page where it mentions protection against these attack: “The easiest way is to use a package manager that signs the repository metadata (like APT or YaST)”.
  • “Endless Data Attack”: This is basically a denial of service attack which the admin will soon notice and can then take appropriate action.  It cannot happen for metadata since those come from the download redirector but it could happen with openSUSE for packages since we do download the complete file and do not use the file size information contained in the metadata yet.  This is something we plan to address for our next release.

Note that when I speak about YaST I mean everything that uses the openSUSE package management library libzypp which includes YaST, zypper and the updater applets.

Note also that the FAQ has a question about the download redirector: “Q: What about OpenSUSE’s download redirector? Does it increase or decrease my security? A: OpenSUSE’s download redirector increases the user’s security…”.  I’d like to thank Christoph Thiel, Marcus Rückert and Peter Pöml for their work over the years on the redirector.  Peter is the current maintainer and did the last rewrite including the serving of metadata.

Note: if you use SUSE Linux enterprise products, then only servers owned by Novell are used via secure https connections which avoid all these attacks.

Our package management and security experts have been reviewing and improving the security aspects of the package management stack continuously – and the report shows that they were successfull.

Posted in Distribution, Security, Software Management, YaST | Comments Off on Package Management Security on openSUSE