RE: [SECURITY] p7zip: CVE-2015-1038

2016-02-12 Thread Tony Kelman
> You probably need to connect to cygwin.com with ssh on the command line > once in order to accept the prompt about the changed (or unknown) host > key. You can then rely on cygport's canned use of ssh again. Bingo, that was it! Thanks Achim! `ssh cygwin.com` to add the known host and everything

Re: [SECURITY] p7zip: CVE-2015-1038

2016-02-12 Thread Achim Gratz
Tony Kelman writes: > I'm not very familiar with the intricacies of ssh auth options, as you > can probably guess. I tried removing ~/.ssh/known_hosts (backing up to > a different file name) but no change. Is there a cygport or sftp or ssh > option via command line or environment variable that I ca

RE: [SECURITY] p7zip: CVE-2015-1038

2016-02-10 Thread Tony Kelman
> What means "NMU"? Sorry, that's a Debian term for "non-maintainer upload." I don't know if we ever do those in Cygwin? > Recently the default configuration has been changed to only have hashes > in that file. You could change it back or use ssh management commands > to remove the existing entri

Re: [SECURITY] p7zip: CVE-2015-1038

2016-02-10 Thread Achim Gratz
Tony Kelman writes: > Thanks for the help Corinna. > > I don't have anything for sourceware or cygwin.com in > ~/.ssh/known_hosts, should I? Recently the default configuration has been changed to only have hashes in that file. You could change it back or use ssh management commands to remove the

Re: [SECURITY] p7zip: CVE-2015-1038

2016-02-10 Thread Corinna Vinschen
On Feb 9 14:48, Tony Kelman wrote: > >> I don't have anything for sourceware or cygwin.com in > >> ~/.ssh/known_hosts, should I? > > > > In theory, yes. It's usually collected the first time you connect to > > the host. The idea is to have a known key to compare the host against > > to disallow MI

RE: [SECURITY] p7zip: CVE-2015-1038

2016-02-09 Thread Tony Kelman
>> I don't have anything for sourceware or cygwin.com in >> ~/.ssh/known_hosts, should I? > > In theory, yes. It's usually collected the first time you connect to > the host. The idea is to have a known key to compare the host against > to disallow MITM attacks. Hm okay, what's the best way to get

Re: [SECURITY] p7zip: CVE-2015-1038

2016-02-09 Thread Corinna Vinschen
On Feb 8 17:42, Tony Kelman wrote: > >> Tony@LAPTOP-O230JCFF ~/github/cygwin-p7zip > >> $ cygport p7zip-15.09-2.cygport upload > > Uploading p7zip-15.09-2.x86_64 > > Running lftp sftp://cyg...@cygwin.com > >> Password: > >> cd: Fatal error: Host key verification failed > >

RE: [SECURITY] p7zip: CVE-2015-1038

2016-02-08 Thread Tony Kelman
>> Tony@LAPTOP-O230JCFF ~/github/cygwin-p7zip >> $ cygport p7zip-15.09-2.cygport upload > Uploading p7zip-15.09-2.x86_64 > Running lftp sftp://cyg...@cygwin.com >> Password: >> cd: Fatal error: Host key verification failed > > > The host key you stored for sourc

Re: [SECURITY] p7zip: CVE-2015-1038

2016-02-08 Thread Corinna Vinschen
On Jan 30 00:13, Tony Kelman wrote: > > Ack, will do today. Need to copy my ssh keys over to a new laptop, > > hopefully that > > will go smoothly and I've got all the build-deps installed. > > It didn't. Am I doing this wrong? (and should I move this to the main list?) > > $ eval `ssh-agent` >

Re: [SECURITY] p7zip: CVE-2015-1038

2016-01-30 Thread Tony Kelman
> Ack, will do today. Need to copy my ssh keys over to a new laptop, hopefully > that > will go smoothly and I've got all the build-deps installed. It didn't. Am I doing this wrong? (and should I move this to the main list?) $ eval `ssh-agent` Agent pid 12848 Tony@LAPTOP-O230JCFF ~/github/cygwi

RE: [SECURITY] p7zip: CVE-2015-1038

2016-01-29 Thread Tony Kelman
> Tony, > > A directory traversal vulnerability has been reported in p7zip-15.09. > Could you please spin a new release with the following patch: > > http://pkgs.fedoraproject.org/cgit/rpms/p7zip.git/plain/p7zip-15.09-CVE-2015-1038.patch > > -- > Yaakov Ack, will do today. Need to copy my ssh keys