Hi,
Willing to tryout few virtualisations solutions in fedora, I downloaded the DVD ISO yesterday.
Just to be on the safe side, I checked the SHA1 sums : surprinsigly, there was an error, and verification failed. So, I went to another mirror, and downloaded a new DVD image. I checked it : verification failed.
Now, I just saw the warnings from fedora stating some servers had suffered unauthorised logins, and I'm wondering if these ISOs are hacked, corrupted or if it's just the SHA1 sums that are wrong on the fedora mirrors ?
Anyone could re-assure me ?
This is what I have (on cygwin, but this shouldn't be a problem, should it ?) :
$ sha1sum.exe Fedora-9-x86_64-DVD.iso 62a608efe79fe50fa60ce8ea9e78f46ebbcec60c *Fedora-9-x86_64-DVD.iso
$ md5sum Fedora-9-x86_64-DVD.iso* 378773de76587c2f1829b2dd86452a1a *Fedora-9-x86_64-DVD.iso 378773de76587c2f1829b2dd86452a1a *Fedora-9-x86_64-DVD.iso_old
$ grep DVD SHA1SUM f92576227484a4eeda0e86a497836c67c34d20ef Fedora-9-x86_64-DVD.iso
Thanks,
Frederic Schaer Tel. : +33 1 69 08 99 25 Fax : +33 1 69 08 31 47 CEA, IRFU, SEDI, Centre de Saclay, F-91191 Gif Sur Yvette, France
SCHAER Frederic <frederic.schaer <at> cea.fr> writes:
Just to be on the safe side, I checked the SHA1 sums : surprinsigly, there was an error, and verification failed. So, I went to another mirror, and downloaded a new DVD image. I checked it : verification failed.
[snip]
This is what I have (on cygwin, but this shouldn't be a problem, should it ?)
Try again with the -b (binary) option to sha1sum and md5sum. On Window$, that often matters.
Kevin Kofler
Hi,
Thanks, but it doesn't seem to change :
$ sha1sum.exe -b -c SHA1SUM sha1sum: the --binary and --text options are meaningless when veri Try `sha1sum --help' for more information.
$ sha1sum.exe -b Fedora-9-x86_64-DVD.iso 62a608efe79fe50fa60ce8ea9e78f46ebbcec60c *Fedora-9-x86_64-DVD.iso
$ grep DVD SHA1SUM f92576227484a4eeda0e86a497836c67c34d20ef Fedora-9-x86_64-DVD.iso
I should try to transfer the ISO to a linux host, to see if I have the same error...
-----Message d'origine----- De : fedora-list-bounces@redhat.com [mailto:fedora-list-bounces@redhat.com] De la part de Kevin Kofler Envoyé : vendredi 22 août 2008 18:36 À : fedora-list@redhat.com Objet : Re: corrupted ISOs, or wrong SHA1SUMs ??
SCHAER Frederic <frederic.schaer <at> cea.fr> writes:
Just to be on the safe side, I checked the SHA1 sums : surprinsigly,
there
was an error, and verification failed. So, I went to another mirror, and downloaded a new DVD image. I checked it : verification failed.
[snip]
This is what I have (on cygwin, but this shouldn't be a problem, should
it ?)
Try again with the -b (binary) option to sha1sum and md5sum. On Window$, that often matters.
Kevin Kofler
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
On Fri, Aug 22, 2008 at 06:28:00PM +0200, SCHAER Frederic wrote:
Hi,
Willing to tryout few virtualisations solutions in fedora, I downloaded the DVD ISO yesterday.
Just to be on the safe side, I checked the SHA1 sums : surprinsigly, there was an error, and verification failed. So, I went to another mirror, and downloaded a new DVD image. I checked it : verification failed.
Check the length of your downloaded ISO vs. what it _should_ be. Some http downloads will screw up with a >2GB file...
On Fri, 2008-08-22 at 22:11 -0500, Matt Domsch wrote:
Check the length of your downloaded ISO vs. what it _should_ be. Some http downloads will screw up with a >2GB file...
Likewise with trying to save such big files on some file systems, such as the *old* DOS/Windows one.
On Fri, Aug 22, 2008 at 11:46 PM, Tim ignored_mailbox@yahoo.com.au wrote:
On Fri, 2008-08-22 at 22:11 -0500, Matt Domsch wrote:
Check the length of your downloaded ISO vs. what it _should_ be. Some http downloads will screw up with a >2GB file...
Likewise with trying to save such big files on some file systems, such as the *old* DOS/Windows one.
BitTorrent clients can handle files in excess of 2 GB. Best to save to an NTFS formatted drive. If a torrent is too slow for you use wget.exe (version 1.10.2 or greater) from the command line. Use it with the -c option to ensure a complete download.
2008/8/24 Kam Leo kam.leo@gmail.com:
On Fri, Aug 22, 2008 at 11:46 PM, Tim ignored_mailbox@yahoo.com.au wrote:
On Fri, 2008-08-22 at 22:11 -0500, Matt Domsch wrote:
Check the length of your downloaded ISO vs. what it _should_ be. Some http downloads will screw up with a >2GB file...
Likewise with trying to save such big files on some file systems, such as the *old* DOS/Windows one.
BitTorrent clients can handle files in excess of 2 GB. Best to save to an NTFS formatted drive. If a torrent is too slow for you use wget.exe (version 1.10.2 or greater) from the command line. Use it with the -c option to ensure a complete download.
Fat32 drives have a file size limit of 4 GB.
On Sat, Aug 23, 2008 at 11:51 PM, Michael Jenkins darvedd@gmail.com wrote:
2008/8/24 Kam Leo kam.leo@gmail.com:
On Fri, Aug 22, 2008 at 11:46 PM, Tim ignored_mailbox@yahoo.com.au wrote:
On Fri, 2008-08-22 at 22:11 -0500, Matt Domsch wrote:
Check the length of your downloaded ISO vs. what it _should_ be. Some http downloads will screw up with a >2GB file...
Likewise with trying to save such big files on some file systems, such as the *old* DOS/Windows one.
BitTorrent clients can handle files in excess of 2 GB. Best to save to an NTFS formatted drive. If a torrent is too slow for you use wget.exe (version 1.10.2 or greater) from the command line. Use it with the -c option to ensure a complete download.
Fat32 drives have a file size limit of 4 GB.
-- Regards, Michael Jenkins
1) The maximum file size for FAT32 is actually one byte less than 4 GB. A single layer DVD can store 4.7 GB.
2) I was addressing the limitation of the file downloading application/plugin in older browsers and, for that matter, older versions of wget.
Hi All,
While I thank you for your answers, I'd just like to add that I'm no Linux beginner...
I just downloaded yet another *2* DVD images directly from Linux : - one using http://mirrors.fedoraproject.org/mirrorlist?path=pub/fedora/linux/releases/9... - the other one using the URL in my firefox download history : ftp://fr2.rpmfind.net//linux/fedora/releases/9/Fedora/x86_64/iso/Fedora-9-x86_64-DVD.iso
And you know what ?? 1st DVD image is correct, and second *IS incorrect*. These files differ ! And based on the SHA1SUM, I'm tempted to say the rpmfind one is corrupted.
I tried to see what are the binary differences between the 2 files : it looks like there is only one little difference :
File that is OK :
1AC4 3670: 8D CF 19 56 0A C6 AF 36 80 B3 38 94 05 F8 34 04 1AC4 3680: BA 4F 07 4C 9A E1 D3 01 8D 77 AC 3A BE D9 7B B5 1AC4 3690: 07 56 0D 9A A0 4D 2A 1C 7A C3 BE 80 EA 77 1B 94 1AC4 36A0: BA A1 77 98 7E 32 84 99 BB 43 67 0E 6C D8 00 A3
Files that are *NOT* OK : Windows one :
1AC4 3670: 8D CF 19 56 0A C6 AF 36 80 B3 38 94 05 F8 34 05 1AC4 3680: 3A 4F 5F 4C 82 E1 AA 81 85 77 AD F2 BC D7 7B 99 1AC4 3690: 07 51 ED 98 B8 4F 48 1C 8E 43 81 80 EA 77 1B 94 1AC4 36A0: BA A1 77 98 7E 32 14 99 BB 43 67 0E 6C D8 00 A3
Linux one : 1AC4 3670: 8D CF 19 56 0A C6 AF 36 80 B3 38 94 05 F8 34 04 1AC4 3680: BA 4F 07 4C 9A E1 D3 01 8D 77 AC 3A BE D9 7B B5 1AC4 3690: 07 56 0D 9A A0 4D 2A 1C 7A C3 BE 80 EA 77 1B 94 1AC4 36A0: BA A1 77 98 7E 32 84 99 BB 43 67 0E 6C D8 00 A3
That's the only difference vbindiff could find... and as you can see, 2 different differences are at the same address.
Now comes the warning and the question: is this a hack ???
There's no more windows/cygwin question here... Is there any fedora security guy who could assure me ISOs were not modified (and who could explain those differences) ? Is there another (security ?) list that should be contacted regarding this subject ?
Thanks
SCHAER Frederic wrote:
Hi All,
While I thank you for your answers, I'd just like to add that I'm no Linux beginner...
I just downloaded yet another *2* DVD images directly from Linux : - one using http://mirrors.fedoraproject.org/mirrorlist?path=pub/fedora/linux/releases/9...
- the other one using the URL in my firefox download history :
ftp://fr2.rpmfind.net//linux/fedora/releases/9/Fedora/x86_64/iso/Fedora-9-x86_64-DVD.iso
I can confirm that the ISO on fr2.rpmfind.net is bad.
However:
I've fetched a good and a bad DVD, loopmounted both, and did a
# diff -urN /mnt/good /mnt/bad
and one file differs:
Binary files good/Packages/eclipse-pde-3.3.2-11.fc9.x86_64.rpm and bad/Packages/ eclipse-pde-3.3.2-11.fc9.x86_64.rpm differ
Testing the signatures:
mk@mk>rpm --checksig /mnt/good/Packages/eclipse-pde-3.3.2-11.fc9.x86_64.rpm /mnt/good/Packages/eclipse-pde-3.3.2-11.fc9.x86_64.rpm: (sha1) dsa sha1 md5 gpg OK mk@mk>rpm --checksig /mnt/bad/Packages/eclipse-pde-3.3.2-11.fc9.x86_64.rpm /mnt/bad/Packages/eclipse-pde-3.3.2-11.fc9.x86_64.rpm: (sha1) dsa sha1 MD5 GPG NOT OK
So what's in eclipse-pde?
It doesn't look "dangerous" to me - now if it were openssh AND had a good signature things would be different...
Mogens
Ah great, thanks a lot for this check :)
I had'nt yet thought about diff'in the 2 DVD trees... OK, doesn't look bad to me either, I prefer that.
Thanks again :]
-----Message d'origine----- De : fedora-list-bounces@redhat.com [mailto:fedora-list-bounces@redhat.com] De la part de Mogens Kjaer Envoyé : lundi 25 août 2008 12:32 À : For users of Fedora Objet : Re: corrupted ISOs, or wrong SHA1SUMs ?? *WARNING*
SCHAER Frederic wrote:
Hi All,
While I thank you for your answers, I'd just like to add that I'm no Linux beginner...
I just downloaded yet another *2* DVD images directly from Linux : - one using
http://mirrors.fedoraproject.org/mirrorlist?path=pub/fedora/linux/releases/ 9/Fedora/x86_64/iso/Fedora-9-x86_64-DVD.iso&country=FR&redirect=1
- the other one using the URL in my firefox download history :
ftp://fr2.rpmfind.net//linux/fedora/releases/9/Fedora/x86_64/iso/Fedora-
9-x86_64-DVD.iso
I can confirm that the ISO on fr2.rpmfind.net is bad.
However:
I've fetched a good and a bad DVD, loopmounted both, and did a
# diff -urN /mnt/good /mnt/bad
and one file differs:
Binary files good/Packages/eclipse-pde-3.3.2-11.fc9.x86_64.rpm and bad/Packages/ eclipse-pde-3.3.2-11.fc9.x86_64.rpm differ
Testing the signatures:
mk@mk>rpm --checksig /mnt/good/Packages/eclipse-pde-3.3.2-11.fc9.x86_64.rpm /mnt/good/Packages/eclipse-pde-3.3.2-11.fc9.x86_64.rpm: (sha1) dsa sha1 md5 gpg OK mk@mk>rpm --checksig /mnt/bad/Packages/eclipse-pde-3.3.2-11.fc9.x86_64.rpm /mnt/bad/Packages/eclipse-pde-3.3.2-11.fc9.x86_64.rpm: (sha1) dsa sha1 MD5 GPG NOT OK
So what's in eclipse-pde?
It doesn't look "dangerous" to me - now if it were openssh AND had a good signature things would be different...
Mogens
-- Mogens Kjaer, Carlsberg A/S, Computer Department Gamle Carlsberg Vej 10, DK-2500 Valby, Denmark Phone: +45 33 27 53 25, Fax: +45 33 27 47 08 Email: mk@crc.dk Homepage: http://www.crc.dk
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list