Arch Linux

lapsio

Member

From: Warsaw

Registered: 2015-09-30

Posts: 50

Arch - enable https-only upgrades

Hello

I'm using Arch as VPS hosting OS and I'm trying to limit its interaction with WAN as much as possible. However it's Arch so I suppose it's not really wise idea to cut it from internet completely as it'd prevent updates and due to quite rolling release nature of Arch it's probably really bad idea. I already lost one Arch machine during upgrade after 3 years because everything exploded.

So I'd like to enable only https mirrors and explicitly add them to firewall allowed addresses. I'm able to open dst addresses basing both on IPs and DNS names. As environment provides DNSSec enabled DNS server i think second option seems to be safer. So how do I allow only https mirrors and how can i check their hostnames to configure firewall?

Last edited by lapsio (2017-02-24 18:22:34)

eschwartz

Fellow

Registered: 2014-08-08

Posts: 4,097

Re: Arch - enable https-only upgrades

The mirrorlist includes both HTTP and HTTPS mirrors (and FTP or RSYNC, even), so, generate an HTTPS-only mirrorlist....

I don't know why you care though, since all packages are PGP-signed and invalid or untrusted signatures on the repo packages are a fatal error.

---

Managing AUR repos The Right Way -- aurpublish (now a standalone tool)

lapsio

Member

From: Warsaw

Registered: 2015-09-30

Posts: 50

Re: Arch - enable https-only upgrades

I enabled only https repositories but on older Arch installation I'm getting error:

error: failed retrieving file 'archlinuxfr.db' from repo.archlinux.fr : Connection timed out after 10000 milliseconds
error: failed to update archlinuxfr (download library error)

jasonwryan

Anarchist

From: .nz

Registered: 2009-05-09

Posts: 30,424

Website

Re: Arch - enable https-only upgrades

So you profess to be concerned about security, and you enable archlinux.fr?

Moving to NC...

---

Arch + dwm   •   Mercurial repos  •   Surfraw

Registered Linux User #482438

lapsio

Member

From: Warsaw

Registered: 2015-09-30

Posts: 50

Re: Arch - enable https-only upgrades

What is archlinux.rf? I don't remember enabling it. It's AUR? I needed one packet from it once but I don't need it any longer.

After removing yaourt and x2x which was from AUR it still asks about it ._.

EDIT: Okay solved it I removed archlinux.fr. Thanks for pointing out an issue somehow I forgot I enabled AUR on this machine long time ago.

Last edited by lapsio (2017-02-24 19:23:46)

eschwartz

Fellow

Registered: 2014-08-08

Posts: 4,097

Re: Arch - enable https-only upgrades

archlinuxfr is not "the AUR". Also, it doesn't use the mirrorlist, so so no wonder this (horribly broken) repo is being firewalled...

---

Managing AUR repos The Right Way -- aurpublish (now a standalone tool)

jasonwryan

Anarchist

From: .nz

Registered: 2009-05-09

Posts: 30,424

Website

Re: Arch - enable https-only upgrades

So this isn't an Arch install, but one of those spinoffs that comes with additional repos "helpfully" configured?

---

Arch + dwm   •   Mercurial repos  •   Surfraw

Registered Linux User #482438

lapsio

Member

From: Warsaw

Registered: 2015-09-30

Posts: 50

Re: Arch - enable https-only upgrades

I think I need to reinstall this machine anyways then... I mean well this one with archlinuxfr was mentioned DNSSec server in network, another machine, but uh... I installed X server and lots of unnecessary garbage here I don't really remember now, but there may be lots of other misconfigurations that could put machine in danger. I thought I removed all this junk but leaving something like this unnoticed suggests that my actions were only partially successful and It's probably impossible now to find out what exactly remains from old flaws. It was my first arch machine I've ever set up after working exclusively with OpenSUSE which has installed like... EVERYTHING out of box (~16gb of soft) and moving to minimalistic, single purpose systems was quite hard for me back then :V So I thought X server and x2x and xpra and VNC and open X server ports so on, so on... are absolutely, totally necessary for headless DNS server...

On OpenSUSE it was quite normal that home laptop has intalled Apache and Avahi and bind server and KVM, Virtualbox and Xen all in one, because well it always had installed absolutely everything ever... So i just tried to install everything on Arch... Just like it was done on OpenSUSE xD

Welp. Mistakes were made.

Last edited by lapsio (2017-02-24 19:52:03)