- Arch-mirrors - lists.archlinux.org

critical rsync security release 3.4.0
by wahrwolf 14 Jan '25

14 Jan '25

We'd like to raise awareness about a rsync security release version 3.4.0-1 as described in our advisory [ASA-202501-1](https://security.archlinux.org/ASA-202501-1). In the most severe CVE, an attacker only requires anonymous read access to a rsync server, such as a public mirror, to execute arbitrary code on the machine the server is running on. Additionally, attackers can take control of a malicious server and read/write arbitrary files of any connected client. Sensitive data, such as OpenPGP and SSH keys, can be extracted, and malicious code can be executed by overwriting files such as `~/.bashrc` or `~/.popt`. We highly advise anyone who runs an rsync daemon or client prior to 3.3.1-1 to upgrade and reboot their systems immediately. As Arch Linux mirrors are mostly synchronized using rsync, we highly advise any mirror administrator to act immediately, even though the packages themselves are cryptographically signed. On Arch Linux infrastructure side we have secured all our affected servers and mirrors.

1 0

Re: Splitting the Arch Linux repo and archive server
by gromit 27 Dec '24

27 Dec '24

On 24/12/27 02:55PM, Kristian Klausen wrote: > Hi all, Hello everyone, > The DevOps team is working on splitting[0] the repo server and the archive > server, which are currently still located on the same box > (gemini.archlinux.org) This reason for splitting it is mainly due to I/O > issues and to ensure separation of concerns. Please see [1] and [2] for a > bit more context. > > We have already ordered the new repo server (AX41-NVMe[3] with an extra 1 TB > NVMe SSD) and switched the rsync endpoint for the mirrors 7 months ago[2], > so now the time has come to move the home of the repos from gemini to the > new repo server. > Christian and I are planning on taking a stab on this in a few hours, during > which the access to the repos will be cut off. We have now successfully finished the maintenance and all services should be reachable again as usual. If you still find things that are amiss please let us know! We still need to fix the archiving setup in the coming days, but the disruptive part of the maintenance work is done. === Information for Packagers === The new repo server has the following host keys, which can also be checked in our [ssh-hostkeys textfile][4]: 256 SHA256:uR8mRzpo828jM6U1jmdBxXvHEiDbuNSwpLur5odBrRA repos.archlinux.org (ECDSA) 256 SHA256:JApvSFU4OvaafW5ebe3ktmlp41WSsOffCkOBvtdNeDU repos.archlinux.org (ED25519) 3072 SHA256:wlSAfyb4o94izuemzbOILFeVPgDZd0Y9n890gq1pyxY repos.archlinux.org (RSA) 256 MD5:55:ee:72:27:c3:9d:f0:c3:89:b4:24:ff:75:dd:60:bf repos.archlinux.org (ECDSA) 256 MD5:90:98:6c:ee:72:b5:a6:dc:bf:ae:12:39:2e:99:b2:c4 repos.archlinux.org (ED25519) 3072 MD5:48:53:1e:51:81:7f:40:fd:ee:7c:dc:06:7c:98:a3:9e repos.archlinux.org (RSA) === Information for Mirror Admins === The rsync deamon is active again and mirroring should continue as usual! Cheers, Kristian and Christian [4]: https://gitlab.archlinux.org/archlinux/infrastructure/-/blob/master/docs/ss…

1 0

Fwd: Splitting the Arch Linux repo and archive server
by gromit 27 Dec '24

27 Dec '24

Dear Mirror Admins, we also want to inform you about the planned maintenance below. Cheers, Kristian & Christian Arch Linux DevOps Team

1 0

extra.db missing on multiple mirrors
by Niklas Yann Wettengel 29 Oct '24

29 Oct '24

Hi, I noticed the extra.db-file (/extra/os/x86_64/extra.db) is missing on multiple Tier 1 mirrors: - ftp.halifax.rwth-aachen.de - mirror.23m.com - mirror.selfnet.de maybe an upstream problem? Best Regards Niklas

5 4

RFC Final Comment Period: Mirror definition - Proposal for new mirror administration routines and mirror requirements
by pitastrudl 01 Oct '24

01 Oct '24

An RFC has now entered its Final Comment Period. In 14 days, discussion will end and the proposal will either be accepted, rejected or withdrawn: https://gitlab.archlinux.org/archlinux/rfcs/-/merge_requests/29 Please visit the above link for discussion. Summary: Before this proposal, all tasks surrounding mirrors were manual and in free-text form. This RFC therefore outlines the definitions and guidelines surrounding both becoming but also maintaining and decommissioning a mirrors in a new format using TOML and GitLab.

1 0

repo.jing.rocks summer maintenance
by Jing Luo 14 Sep '24

14 Sep '24

Hello all, repo.jing.rocks will have a "summer maintenance" intermittently from 2024-09-15 00:00 UTC to 2024-09-23 15:00 UTC. This is to replace some drives and improve stability and robustness in general, so hopefully it will continue to serve the community for years. The maintenance window is long because I have a $dayjob and I need to pick the music to play when I work on servers. Ideally you _should_ see no service interruption, but it may serve stale mirrors for a few hours at a time during the week. This is because I plan to remount the NFS backend readonly but point it to the backup storage, before the main storage server is shutdown. But as all sysadmins know sometimes sh*t happens because life is just a sh*tshow. So let's all be prepared, if you use repo.jing.rocks as your upstream. Sorry for the inconvenience. *** repo.jing.rocks is a mirror site that mirrors many free software projects and distros, 110 TB in total, namely debian, archlinux, fedora, ubuntu, devuan, trisquel, linux-libre, dragora, parabola, openbsd, etc. It is probably the largest mirror collection in Japan, also a T1 mirror of archlinux, using residential 10Gbps internet and 100% renewable energy. -- Jing Luo About me: https://jing.rocks/about/ GPG Fingerprint: 4E09 8D19 00AA 3F72 1899 2614 09B3 316E 13A1 1EFC

1 0

arch.takehiko.pl - unavilability and moving note
by a＠takehiko.pl 05 Sep '24

05 Sep '24

2 1

mirror.selfnet.de new IPv6 address
by Lukas Kramer 13 Aug '24

13 Aug '24

Hi all, we will soon migrate mirror-1.server.selfnet.de to the new IPv6 address 2a0e:3c0:0:400::52. Can you add this as another address to the allowlist and only remove the current address 2001:7c7:2100:400::52 once we've completed the migration to ensure a smooth transition? Best Regards, Lukas

3 3

ftp.acc.umu.se domain move
by Niklas Edmundsson 29 Jul '24

29 Jul '24

Hi all! The official host/mirror name for the mirror provided by Academic Computer Club (ACC) has changed to mirror.accum.se as ACC is moving to a new domain. Official name changes from ftp.acc.umu.se to mirror.accum.se. The old host name will continue to work for quite some time (years), but downstream mirrors should move to using a non-acc.umu.se name. Since we are lazy sysadmins, we have also registered the ac2.se (ACC=AC^2) domain and lots of aliases so ftp.ac2.se also works. Background: Umeå University has decided that non-official services are no longer allowed to exist as a sub domain to umu.se. As a consequence of this we are moving all services from the acc.umu.se domain. While not related to the domain move, we'd also like to inform you that the file archive now enjoys 200 Gbps connectivity to SUNET. On behalf of the ACC file archive admins, /Nikke -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Niklas Edmundsson, Admin @ {ACC,HPC2N} | nikke(a)accum.se --------------------------------------------------------------------------- "I'd prefer the non-smoking lifeboat, please." =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

1 0

arch.takehiko.pl - unavilability note
by a＠takehiko.pl 09 Jul '24

09 Jul '24

1 0