ZDNet reports that Penguin Computing has released two new rack-mounted Linux servers and a new Linux workstation.

– By Grant Gross –

If you watch any television, you’ve probably seen the commercial called “The Heist” this fall. A panicking manager type leads police detectives into what appears to be an empty server room. “It’s the crime of the century!” the balding, middle-aged, middle manger exclaims over cheesy adventure-movie background music. “Everything’s gone!”

“What was stolen?” asks one of the cops.

“Everything,” the pointy-haired boss answers, “payroll, R&D, customer records …”

Of course, our hero, a scruffy-looking geek boy, saves the day. He points to a mainframe in the back of the room, and says, “We moved everything onto that one. It’s going to save us a bundle. I sent out an email … “

The music swells, and the announcer says something about IBM servers running Linux saving you a bundle. What the commercial doesn’t tell you is that the spendy IBM server in the commercial is running multiple copies of Linux at one time as virtual machines.

The concept of virtual machines — sometimes called virtualization, virtual environments or virtual servers — isn’t particularly new, with IBM’s VM operating system debuting 20-plus years ago. (The term “virtual machine” is also used to describe a VMware product that allows Linux and Windows to run side by side on a single machine.) But it’s gaining popularity as companies seek to rein in hardware and management costs, and in some cases, reduce rent paid for the space to house huge server farms.

The IBM commercial doesn’t say — and why should it? — that virtual machines can work well on low-cost servers and workstations, and at least a few companies — including VMware, SWsoft and Ensim — are pitching Linux VM-like technology for companies that can’t afford a $1 million-plus IBM zSeries mainframe. There’s even a Linux kernel-related project announced this fall that allows “virtual private servers” in Linux, and other Open Source projects. Other companies pitch technology such as virtual databases.

ConsultingTimes.com has an mpeg download of the Heist commercial, plus a recent cost comparison of IBM’s setup vs. Microsoft Exchange. The article suggests the IBM solution may not be more cost-effective than Microsoft Exchange for server functions at companies with fewer than 5,000 users. However, when you’re talking about a company with more than 25,000 users, the IBM mainframe’s power quickly drives down the cost per seat to far below the Microsoft cost.

What’s a virtual machine?

The virtual machine concept allows many copies of an operating system — in this case Linux — to run on one computer, but each acts independently. The companies pitching VM-like technology accomplish this in different ways, but generally, VMs can run stand-alone, or those operating systems can work together on the machine. The goal, says Susan DeKeukelaere, IBM’s program director for zSeries marketing, is to maximize the processing power of your hardware.

“That VM operating system has evolved over time to be extremely powerful,” DeKeukelaere says. “Today what we’re finding is there are customers who have have large number of distributed servers running different tasks. Now, what they’re finding is that the manageability of those gets to be very complicated as the number of those increases over time.”

Consolidating those servers into a single “footprint” can save server management costs, she says. In some cases, companies running IBM zSeries with Linux virtual machines are running hundreds, and even thousands, of images of Linux on one box.

DeKeukelaere says power consumption costs can be reduced, and space can also be a “big, big factor” in cost savings, “especially on the West Coast, as real estate was getting very expensive. You’ve literally got rooms full of servers that can take up a lot of real estate.”

John Krystynak, director of product marketing for VMWare, which is marketing virtualization on lower-cost Intel-based workstations and servers, says saving money on hardware is appealing, but more important, the VM technology allows customers to move functions between machines, in essence divorcing software and operating system decisions from hardware-buying decisions.

“What this virtual technology is doing is allowing people to say, ‘I don’t need to tie it together. I can do more than one thing on each machine safely, and I can move things around easily, so I don’t have to be tied to that platform,'” he adds.

Reducing hardware management costs can also be a big selling point to VM technology, Krystynak adds. “Nowadays, the problem is you turn around and you suddenly have 40 servers in an organization with 800 people,” he says. “Out of those 800 people, you have eight guys managing those servers. (IT directors) think, ‘What would I rather have — would I rather have 40 or 50 or 100 servers to manage or would rather have 10 more powerful, more controllable machines with more things running on them.’

“Yes, it does contribute to hardware cost savings, but in terms of overall cost — if you look at Gartner or or Giga or Forester –hardware and software is only 15 percent of overall cost, so there has to be another reason to do it,” he adds. “That other reason is people want to get their minds around this concept of much more manageable environments — reducing the complexity, adding flexibility, and that’s what this virtualization stuff does. It goes from, ‘I can reduce my hardware cost by 10 percent,’ to, ‘If I can reduce the cost of labor of managing the machine, the cost of operations, the amount of space the machines take up, and make the buying of machines more uniform,’ it can go from saving 10 or 15 percent of total cost to saving 40 percent of total cost.”

The advantage of Linux

Linux has a couple of advantages in a VM setting, according to DeKeukelaere and Krystynak. Because of its relatively small size, you can pack lots of instances of Linux on one machine, says DeKeukelaere.

Krystynak, whose company markets VM technology that works both with Windows and Linux, points to Linux’s cost as an advantage to those companies wanting to save money. He sees Linux VMs used most often for Web-serving or in scientific computing labs. “It’s free is the biggest advantage,” he says. “That means you can make as many virtual machines as you want without adding the new cost factor of adding another OS each time you make a virtual machine, where on the Windows side, you have to pay for licenses.”

But Krystynak also says there are companies, especially Fortune 1000 companies in the United States, still nervous about making the switch to Linux. “The (license) cost factor isn’t a platform-changing decision,” he says. “It’s just not big enough … If companies are already considering Linux, they will be happy about it.”

SWsoft aims at Web-hosting companies

For SWsoft, which focuses its Virtuozzo virtual Web-serving environment toward Web-hosting companies, Linux was the easy choice, says Craig Oda, v.p. of business development, because Linux is a much-used Web-hosting OS.

SWsoft, which announced the 2.0 version of Virtuozzo last week, is selling its virtual environment to Web-hosting companies as a way to pack more customers on each server. The company pitches Virtuozzo as “mainframe-like partitioning and manageability on the commodity hardware and operating systems,” and with large Web-hosting companies like Exodus struggling to make money, the industry needs a low-cost way to bring small- and medium-sized businesses to their customer base, Oda says.

SWsoft’s technology allows up to 800 copies of Web-hosting Linux on a single, Intel-based server, Oda says, each with its own root access, although it’d take a pretty powerful box for you to do that. “It’s like a mainframe on an x86 box,” he says. “What we’re doing on x86 is what IBM is doing on mainframes. The customer is paying through the nose for (IBM). Our solution is a quantum leap in cost savings for them.”

The company’s virtual environment, which Oda says has 11 patents pending, now runs only on Linux, but there’s a port to Solaris in progress, and the company eventually plans to offer it for Windows, too. SWsoft’s presentation on virtual environments already comes on Power Point.

Virtuozzo, along with the company’s HSPcomplete hosting automation package, allows automated HSP operations now very manual: management of hardware, updating and upgrading, Oda says. Customers can be moved from box to box, allowing a more efficient use of hardware, he adds.

Ensim

Like SWsoft, Ensim’s Private Server technology is aimed at Web-hosting companies and Internet service providers. The company’s product can “fractionalize” physical servers into as many as about 100 virtual Web servers, says Andy Kim, Ensim’s v.p. of marketing.

“As a service provider, I can take a box and split it up into four virtual servers and guarantee that each of the customers of the partitions have access to, at the minimum, one quarter of the computing resources,” Kim says. “But if the others are idle, they can use more than a quarter of their resources.”

Again, this allows more efficient use of hardware resources, Kim says. As many as 100 partitions can be useful for copying a relatively low-powered application, like a firewall, and running them all on one box.

Kim claims Ensim’s way of doing a virtual environment, by creating logical dedicated servers, sucks up fewer computing resources. The Private Server technology works on any Linux-based box, not just Intel-based, he says.

“The virtualization layer is optimized for performance, so it only imposes a very minimal overhead,” Kim says. “It gives the service provider the flexibility to take any Linux box and split it up. It can be a single CPU box, and they can split that up and offer different services on it.”

The patent-pending technology, he says, offers several “dimensions of isolation,” as he calls it. The virtual servers include performance and fault isolation, meaning that if there’s an OS-level fault on partition, the other virtual servers on the box would continue running. “I would be surprised to find others that guarantee 100% fault isolation, that’s the hardest thing to do, and at the same time, keep the performance overhead down below 5%.”

Ensim’s technology allows easy migration between boxes, and has other management features, he says. “Our partitions are intelligent partitions, in that they’re containers that only only regulate the resources that partition is using, but they monitor the health of the applications, and they allow us to migrate applications from one partition to another.”

Ensim’s virtualization technology is available for Linux and Solaris, and the company’s 3-year-old Private Server technology has lead to partnerships with IBM, Sun and Compaq.

VMware

VMware is well-known in the Linux community for its VMware Workstation product that allows Linux and Windows to run at the same time on a box, largely for developers who are testing more than one OS environment. However, VMware also offers its GSX Server, which partitions servers to several virtual machines running Linux or Windows.

“We’re virtualizing the Intel architecture,” says Krystynak, director of product marketing. “We’re bring that (IBM zSeries) concept down to the Intel side.”

Krystynak says VMware tells customers they can put four to 20 virtual machines onto one box, but he stresses that these are complete operating systems, not just Web servers. Like competing products, these virtual machines are isolated from each other, so if one crashes, the others don’t.

Krystynak says the virtualization concept is starting to become popular across the range of platforms. “The thing that’s new, if you look at the high end with the mainframes and you look at the mid end with a departmental enterprise server, you’ve had techniques to do be able this all along because people make a big hardware investment and they want to be able to use it in more than one way,” he says. “Now, the reason it’s starting to gain popularity in a broader way is you actually can do it from a desktop all the way up to a data center. Frankly, the same thing that’s happened on mainframes where the hardware is clearly overpowering for two users, nowadays you can buy an Intel server and think the same way: ‘Man, the hardware really can do a lot more than just dedicating one app on it.’ So why not take advantage of that?”

Krystynak says the cost savings that virtual servers can bring is an appealing message, especially right now. “Companies are like, ‘If you don’t spend this money the next three months, you might have the privilege of working here six months from now.’ “

While VMware sells more Windows software, the company has several customers using GSX with Linux, Krystynak says. One example is Global Continuity, a disaster recovery service company. Global Continuity insures other company’s machines and provides immediate recovery or replacement of critical machines.

“It’s expensive do to this,” he says. “It’s kind of an insurance business, where basically you’re saying, ‘We know how often people fail, we know what the rate of failures is, and we know how many machines we need to cover.’ “

With GSX Server, Global Continuity can pack five or six customers on a single box, Krystynak says. When a customer’s system fails, Global Continuity copies the customer’s information onto one box and sends it out. “By eliminating the need to do one-to-one mirroring, they’re seriously reducing their hardware and maintenance costs.”

Virtual servers for the Linux kernel

In October, Linux developer Jacques Gelinas sent out an announcement about his vserver project, which he says allows users to “run general purpose virtual servers on one box, full speed!”

Gelinas wasn’t available for an interview, but his vserver project is explained at http://www.solucorp.qc.ca/miscprj/s_context.hc. There, Gelinas suggests that virtual servers can be used by anyone managing a server. He suggests another advantage in addition to cost savings: Easier security management of multiple servers.

“Linux computers are getting faster every day,” he writes. “So we should probably end up with less, more powerful servers. Instead we are seeing more and more servers. While there are many reasons for this trend (more services offered), the major issue is more related to security and administrative concerns. Is it possible to split a Linux server into virtual ones with as much isolation as possible between each one, looking like real servers, yet sharing some common tasks (monitoring, backup, ups, hardware configuration, …)? We think so.”

The current version of vserver is 0.9. It’s available for download and released under the GNU GPL.

MSNBC reports that “Microsoft Corp. chief software architect Bill Gates sent a company-wide memo earlier this week calling on developers to do a better job of writing safe, secure software. The memo comes just weeks after an embarassing flaw was found in the company’s flagship product, Windows XP. According to one security expert familiar with the memo, “It is an acknowledgement from Bill that `Wed’d better do this, or else.'””

The BBC is reporting that a US National Academy of Sciences report commissionned after the September 11th terrorist attacks is calling for laws to punish software makers who do not do enough to take care of security flaws in their software.

Anonymous Reader writes “Linux is well tuned for throughput-limited applications, but it is not well designed for deterministic response, though enhancements to the kernel are available to help or guarantee determinism. So-called real-time applications require, among other things, deterministic response. In this article at ELJonline, Kevin Dankwardt examine the nature of real-time applications and Linux’s strengths and weaknesses in supporting such applications.”

SuSE: “The ‘at’ command reads commands from standard input for execution at a later time specified on the command line. If such an execution time is given in a carefully drafted (but wrong) format, the at command may crash as a result of a surplus call to free(). The cause of the crash is a heap corruption that is exploitable under certain circumstances since the /usr/bin/at command is installed setuid root.”

______________________________________________________________________________

                        SuSE Security Announcement

        Package:                at
        Announcement-ID:        SuSE-SA:2002:003
        Date:                   Wednesday, Jan 16th 2001 16:00 MET
        Affected SuSE versions: 6.4, 7.0, 7.1, 7.2, 7.3
        Vulnerability Type:     local privilege escalation
        Severity (1-10):        5
        SuSE default package:   yes
        Other affected systems: most Linux systems with the at package
                                installed

    Content of this advisory:
        1) security vulnerability resolved: at
           problem description, discussion, solution and upgrade information
        2) pending vulnerabilities, solutions, workarounds
        3) standard appendix (further information)

______________________________________________________________________________

1)  problem description, brief discussion, solution, upgrade information

    The 'at' command reads commands from standard input for execution at a
    later time specified on the command line. If such an execution time is
    given in a carefully drafted (but wrong) format, the at command may
    crash as a result of a surplus call to free(). The cause of the crash
    is a heap corruption that is exploitable under certain circumstances
    since the /usr/bin/at command is installed setuid root.

    A temporary workaround against the bug is to disable the at command for
    non-root users by removing the setuid-bit from the /usr/bin/at command.

    As a permanent solution it is recommended to install the update packages
    as listed for download below. In addition to the fixed heap corruption,
    file handling security has been improved by adding the O_EXCL (exclusive)
    option to an open(2) system call inside the at(1) code. We thank
    zen-parse for reporting this vulnerability.

    Please download the update package for your distribution and verify its
    integrity by the methods listed in section 3) of this announcement.
    Then, install the package using the command "rpm -Fhv file.rpm" to apply
    the update.


    i386 Intel Platform:

    SuSE-7.3
     ftp://ftp.suse.com/pub/suse/i386/update/7.3/ap1/at-3.1.8-459.i386.rpm
db3d2bd38f81667dcece38d1c4a86725
    source rpm:
     ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/at-3.1.8-459.src.rpm
82701057fc8ea3217800b0ab1e2e544b

    SuSE-7.2
     ftp://ftp.suse.com/pub/suse/i386/update/7.2/ap1/at-3.1.8-458.i386.rpm
91b759e6a8d433273c5567ed26735690
    source rpm:
     ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/at-3.1.8-458.src.rpm
3df6d6d708d4ef90515f6f1fbbdea5bf

    SuSE-7.1
     ftp://ftp.suse.com/pub/suse/i386/update/7.1/a1/at-3.1.8-458.i386.rpm
73eb22d5c958c17e264fd31ec339b763
    source rpm:
     ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/at-3.1.8-458.src.rpm
1303a1328f31313a62f5645f7cb476ef

    SuSE-7.0
     ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/at-3.1.8-459.i386.rpm
3179e64f87371d7864d1956ceb9bd020
    source rpm:
     ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/at-3.1.8-459.src.rpm
67efafe83908ac53fc54acac9a0f056b

    SuSE-6.4
     ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/at-3.1.8-458.i386.rpm
aaffed7c302b9ec42885087296c6f0a1
    source rpm:
     ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/at-3.1.8-458.src.rpm
374cf4374fbe1e66ab2e685aa0449034



    Sparc Platform:

    SuSE-7.3
     ftp://ftp.suse.com/pub/suse/sparc/update/7.3/ap1/at-3.1.8-356.sparc.rpm
ec76d45245ef917e22f5f1a863a89988
    source rpm:
     ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/at-3.1.8-356.src.rpm
40de9490a06bd294ad6a7f90e682c0cd

    SuSE-7.1
     ftp://ftp.suse.com/pub/suse/sparc/update/7.1/a1/at-3.1.8-356.sparc.rpm
27f575762c0b1643008968a167324347
    source rpm:
     ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/at-3.1.8-356.src.rpm
66546dc729e071039595a13d01feacfb

    SuSE-7.0
     ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/at-3.1.8-357.sparc.rpm
98007292769f55e4239b6922157bfa13
    source rpm:
     ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/at-3.1.8-357.src.rpm
2d20cdbb10680282596677aac3106f30



    AXP Alpha Platform:

    SuSE-7.1
     ftp://ftp.suse.com/pub/suse/axp/update/7.1/a1/at-3.1.8-360.alpha.rpm
df71ebf25a2252637ee1421d08779b8d
    source rpm:
     ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/at-3.1.8-360.src.rpm
b8b3a4f80e0d19e0211131ca58c1e0fe

    SuSE-7.0
     ftp://ftp.suse.com/pub/suse/axp/update/7.0/a1/at-3.1.8-361.alpha.rpm
0bc21b9ddc12746a17592fa74473bbf6
    source rpm:
     ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/at-3.1.8-361.src.rpm
4d93aa10b426224936e3de357540ea49

    SuSE-6.4
     ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/at-3.1.8-361.alpha.rpm
aeb76c2eb37f7e442c49c7ba3c5e44a5
    source rpm:
     ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/at-3.1.8-361.src.rpm
6d783c34eb0b855a96736e58d67bc053



    PPC Power PC Platform:

    SuSE-7.3
     ftp://ftp.suse.com/pub/suse/ppc/update/7.3/ap1/at-3.1.8-363.ppc.rpm
111bd6e813ef33265035b21d19776b49
    source rpm:
     ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/at-3.1.8-363.src.rpm
fa2ee9aca5b73009b1d9c90731265a19

    SuSE-7.1
     ftp://ftp.suse.com/pub/suse/ppc/update/7.1/a1/at-3.1.8-362.ppc.rpm
868a1662f751823432d3d881edd371cd
    source rpm:
     ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/at-3.1.8-362.src.rpm
d759233bfc2ce230e1c46d2ec0f15a73

    SuSE-7.0
     ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/at-3.1.8-362.ppc.rpm
7b12fe4b5f31434eb7cf3c0caae75811
    source rpm:
     ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/at-3.1.8-362.src.rpm
4c6e2724bb76e08be66831ed85c60f85

    SuSE-6.4
     ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/at-3.1.8-362.ppc.rpm
7ebc9a1fde97f5ac8226b9e17621a40b
    source rpm:
     ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/at-3.1.8-362.src.rpm
fa3c5e08703eb54b4f493de56ec837bb

______________________________________________________________________________

2)  Pending vulnerabilities in SuSE Linux Distributions and Workarounds:

  - clanlib
    dotslash@snosoft.com reported an environment variable copying buffer
    overflow in the clanlib package. If a program that is linked against
    the clanlib shared library is installed setuid or setgid, this error
    may lead to elevated privileges. In the case of SuSE Linux distributions,
    this is only the case for the methane package: It comes installed with a
    setgid bit to group "game", which is used to store highscores in group-
    writeable files. This setgid bit will be cleared in future releases of
    the SuSE Linux distribution. For already installed "methane" packages,
    we recommend to remove the setgid bit with the command
        chmod -s /usr/X11R6/bin/methane
    The methane package is not installed on SuSE systems by default, nor is
    the defective library "clanlib".


  - thttpd
    The thttpd daemon contained several off-by-one overflows. Due to internal
    organization of the variables affected by these overflows, they seem
    not exploitable. However, these bugs have been fixed. Please update to
    the newest thttpd packages.


  - pine
    The popular mail client "pine" was found vulnerable to an attack where
    shell metacharacters inside an URL could be used to execute arbitrary
    commands if pine passes the URL to an external viewer on the
    commandline. The pine packages on SuSE products are not vulnerable to
    this weakness because they contain a patch that works around this
    problem since it is not new.


  - xchat
    We are working on updates for the xchat packages in the SuSE Linux
    7.0 and 7.1 distributions that are vulnerable to an encoding bug
    while receiving and decoding ctcp datagrams. This bug can lead
    an xchat IRC client to execute IRC protocol specific commands to an
    IRC server such as channel mode changes.
______________________________________________________________________________

3)  standard appendix: authenticity verification, additional information

  - Package authenticity verification:

    SuSE update packages are available on many mirror ftp servers all over
    the world. While this service is being considered valuable and important
    to the free and open source software community, many users wish to be
    sure about the origin of the package and its content before installing
    the package. There are two verification methods that can be used
    independently from each other to prove the authenticity of a downloaded
    file or rpm package:
    1) md5sums as provided in the (cryptographically signed) announcement.
    2) using the internal gpg signatures of the rpm package.

    1) execute the command
        md5sum 
after you downloaded the file from a SuSE ftp server or its mirrors.
       Then, compare the resulting md5sum with the one that is listed in the
       announcement. Since the announcement containing the checksums is
       cryptographically signed (usually using the key security@suse.de),
       the checksums show proof of the authenticity of the package.
       We disrecommend to subscribe to security lists which cause the
       email message containing the announcement to be modified so that
       the signature does not match after transport through the mailing
       list software.
       Downsides: You must be able to verify the authenticity of the
       announcement in the first place. If RPM packages are being rebuilt
       and a new version of a package is published on the ftp server, all
       md5 sums for the files are useless.

    2) rpm package signatures provide an easy way to verify the authenticity
       of an rpm package. Use the command
        rpm -v --checksig 
to verify the signature of the package, where  is the
       filename of the rpm package that you have downloaded. Of course,
       package authenticity verification can only target an uninstalled rpm
       package file.
       Prerequisites:
        a) gpg is installed
        b) The package is signed using a certain key. The public part of this
           key must be installed by the gpg program in the directory
           ~/.gnupg/ under the user's home directory who performs the
           signature verification (usually root). You can import the key
           that is used by SuSE in rpm packages for SuSE Linux by saving
           this announcement to a file ("announcement.txt") and
           running the command (do "su -" to be root):
            gpg --batch; gpg build@suse.de" upon installation or upgrade, provided that
           the package gpg is installed. The file containing the public key
           is placed at the toplevel directory of the first CD (pubring.gpg)
           and at  ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de .


  - SuSE runs two security mailing lists to which any interested party may
    subscribe:

    suse-security@suse.com
-   general/linux/SuSE security discussion.
            All SuSE security announcements are sent to this list.
            To subscribe, send an email to
                suse-security-subscribe@suse.com>.

    suse-security-announce@suse.com
-   SuSE's announce-only mailing list.
            Only SuSE's security annoucements are sent to this list.
            To subscribe, send an email to
                suse-security-announce-subscribe@suse.com>.

    For general information or the frequently asked questions (faq)
    send mail to:
        suse-security-info@suse.com> or
        suse-security-faq@suse.com> respectively.

    =====================================================================
    SuSE's security contact is security@suse.com> or security@suse.de>.
    The security@suse.de> public key is listed below.
    =====================================================================
______________________________________________________________________________

    The information in this advisory may be distributed or reproduced,
    provided that the advisory is not modified in any way. In particular,
    it is desired that the cleartext signature shows proof of the
    authenticity of the text.
    SuSE GmbH makes no warranties of any kind whatsoever with respect
    to the information contained in this security advisory.

Type Bits/KeyID    Date       User ID
pub  2048R/3D25D3D9 1999-03-06 SuSE Security Team security@suse.de>
pub  1024D/9C800ACA 2000-10-19 SuSE Package Signing Key build@suse.de>

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see  http://www.gnupg.org

mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU
F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS
FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW
tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It
Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF
AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+
3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk
YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP
+Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR
8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U
8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S
cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh
ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB
UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo
AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n
KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohc
BBMRAgAcBQI57vSBBQkDwmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8s
AJ98BgD40zw0GHJHIf6dNfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQ
EQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACe
OO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vf
iUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEI
SZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9g
TPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23p
QUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1y
PqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IX
SzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd9DYJ8UUT
mIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Via5/gO7fJ
EpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13CNZZNZfD
qnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp271hhQBe
RmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlEt5ucTXst
Zy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMGB/9g+9V3
ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZwrbSTM5Lp
C/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6TtIJlGG6pq
UN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFLrWn7mfoG
x6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5HRKMWpO+M
9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMag8zFbpeq
PQUsDv9V7CAJ1dbriEwEGBECAAwFAjnu9JIFCQPCZwAACgkQqE7a6JyACspLIgCb
BQd/++0pB9yZWDhqxHtTpdCXRsAAnik7bYHlTxQfohiXYsEJcWrDn7l8
=ojbD
-----END PGP PUBLIC KEY BLOCK-----

ZDNet: “The faster version 2.0 of the Universal Serial Bus connection technology, the center of some controversy with Windows, has been incorporated into the latest test version of Linux. Linus Torvalds, founder and leader of the Linux operating-system project, released version 2.5.2 of the ‘kernel,’ or core software, Monday, including initial support for USB 2.0.” Read more here.

Yellow Dog: “In early December we put out numerous errata updates for YDL 2.1.
Unfortunately, we forgot to send any information to this list about the
updates.”

From:	 Dan Burcaw <dburcaw@terrasoftsolutions.com>
To:	 yellowdog-updates@lists.yellowdoglinux.com
Subject: [yellowdog-updates] Yellow Dog Linux 2.1 Errata
Date:	 Wed, 16 Jan 2002 06:46:25 -0700

Hi all,

In early December we put out numerous errata updates for YDL 2.1.
Unfortunatly, we forgot to send any information to this list about the 
updates.

The following were updated:

glibc/gcc/binutils
yaboot
squid
diffutils
openssh
sendmail
printtool
ucd-snmp
tetex

For more details see: 
http://www.yellowdoglinux.com/resources/errata_ydl21.shtml



Dan Burcaw
Terra Soft Solutions, Inc.
dburcaw@terrasoftsolutions.com

“Continuing the business relationship that began with technology
transfer of The MITRE Corporation’s Spitfire intrusion-detection software last Fall, Open Channel
Software (OCS) announced that its Open Channel Foundation (OCF) nonprofit arm is hosting five new
applications from MITRE at www.openchannelfoundation.org, beginning today.”Just as it did with Spitfire – which has enjoyed more than 1,200 downloads since OCF began
Web-hosting the product last September – MITRE created these technologies in response to highly
specific market demands. For example, the McLean, VA-based not-for-profit national technology
resource developed Spitfire in conjunction with the U.S. Air Force. The product has been highly
successful in military exercises for the Naval Security Group, as well as the U.S. Army’s Land
Information Warfare Activity, and also has been installed in the U.S. House of Representatives.

As a not-for-profit company operating federally funded research and development centers, MITRE
faces some real challenges in transferring technology,” says Gerard Eldering, director of the
Technology Transfer Office at The MITRE Corporation. “While we want our technology to be widely
used and to become available and supported for our sponsors, we must also maintain MITRE’s
objectivity,” he says.

“Furthermore, MITRE’s culture is very collaborative and open, and our researchers often prefer the
‘Open Source’ type of software release as one way to transfer our technologies, in the public interest,”
states Eldering. “The Open Channel Foundation provides a great solution for technology transfer that
fits nicely into our culture. While MITRE can release the software as open source, our government
customers have a potential vendor to turn to for support,” he notes, adding that, “In the end,
MITRE-developed software becomes available, affordable and supportable, while preserving our
objectivity.”

“JOSIT and WOSIT”
New MITRE-developed applications include “building-block” software toolkits called JOSIT (Java
Observation Simulation Inspection Toolkit) and WOSIT (Widget Observation Simulation Inspection
Tool), upon which other applications may be based.

JOSIT is an open Application Programmer’s Interface (API) for implementing applications written in the
Java programming language. JOSIT seamlessly integrates with any Java application written using
Sun Microsystem’s standard library of Java graphical objects. JOSIT observes user actions, inspects
the state of objects, and scripts graphical events.

Possible applications for JOSIT include logging of interface actions to analyze efficiency of tasks,
support needed interface changes and automated step by step instructions, as well as creating user
manuals. Also, JOSIT can be used in real-time user monitoring for enabling intelligent tutoring
systems, Intelligent Computer Aided Instruction (ICAI), Computer Based Training (CBT) and intelligent
checklists, as well as for synchronization of application sharing

The Widget Observation Simulation Inspection Tool (WOSIT) allows communication with a program’s
graphical user interface. WOSIT provides the means to observe user actions and inspect the
properties of items on a program’s user interface and, potentially, simulate those user actions. WOSIT
requires no modifications to a program’s source code or recompiling of any program. It runs
transparently, in the background, while using negligible disk space, memory, and processor time.

“ART . . . SAILE???”
Preliminary applications of MITRE’s JOSIT and WOSIT toolkits include its Synchronous and
Asynchronous Interactive Learning Environment (SAILE) and its Asynchronous Replay Tool (ART).
These software solutions can help provide a general approach to sharing tools and promoting
collaborative learning and problem-solving, according to Douglas Curry, vice president of business
development at Open Channel Software.

“Research has shown that classroom learning improves significantly when a student participates in
learning activities with small groups of peers. This educational value of student collaboration has led to
the development of computer-supported collaborative learning (CSCL) tools,” says Curry.

“These tools enrich learning in a setting that encourages students to communicate with their peers. In
typical web-based collaborative learning environments, however, it is not always possible for all
learners to gather and participate in a learning activity at the same time,” Curry states, adding, “This is
where MITRE’s two new products, SAILE and ART, fulfill terrific market needs.”

Since asynchronous learning must be addressed, it is envisioned that Synchronous and Asynchronous
Interactive Learning Environment (SAILE) will provide rich asynchronous services to web-based
students. And, since a key component of this environment is the use of Replay to enhance
asynchronous learning, Asynchronous Replay Tool (ART) will provide persistence of objects and
actions over time.

“MINNIE and SLAPS”
The purpose of MITRE’s new Minirouter project is to demonstrate the feasibility of using commercial
products and open source software to create an “on-the-move,” general-purpose communications
capability suitable for use in tactical environments. The Minirouter provides a standard Internet
Protocol (IP) interface that can be used to connect any host computer running an IP suite to one of
several types of commercial or military satellite terminals. These terminals are chosen to be small,
rugged, and capable of being mounted to a vehicle and operating while on the move.

Meanwhile, SLAPS (System Logfile Analysis and Profiling Service) is a MITRE-developed collection of
utilities used to provide a centralized syslog log collection and analysis system for servicing
distributed heterogeneous client/server computing environments. SLAPS peruses systems logs looking
for critical messages, using three filters: Filter 1 determines whether a message is based on keywords.
Filter 2 determines whether a message is one that can be ignored, and Filter 3 determines whether a
message is one of interest, as pre-defined by the network administrator.

# # #

About the MITRE Corporation
MITRE is a not-for-profit national technology resource that provides systems engineering, research
and development, and information technology support to the government. It operates federally funded
research and development centers for the Department of Defense, the Federal Aviation Administration
and the Internal Revenue Service, with principal locations in Bedford, Massachusetts and McLean,
Virginia. The goal of MITRE’s technology transfer program is to ensure that its technology is broadly
applied for the benefit of government sponsors and the general public alike. For further information on
the organization’s available technologies, go to MITRE’s technology transfer home page
(http://www.mitre.org/tech_transfer/), or contact Gerard Eldering at 703-883-6053.

About Open Channel Software
Open Channel Software (OCS) is an Internet-based organization that publishes, distributes, and
commercializes software created at academic and research institutions, serving as a central
clearinghouse for high-quality, technically advanced scientific applications. By hosting these
programs in an open-source environment, OCS is able to monitor market activity and identify
breakthrough opportunities with strong commercial potential for appropriate hosted applications. At that
point, revenues can be generated by providing needed support services to commercially sponsored
programs targeted for success.

The OCS Web site offers truly innovative, cutting-edge programs focused around certain categories,
or Disciplines. OCS actively promotes the software that it sponsors, in order to build and maintain a
community of involved users. If software has sufficient commercial viability, OCS provides the
resources that are required to bring that software to commercial distribution, proactively markets it, and
offers fee-based support and services to its customers. Please contact OCS by visiting
http://www.openchannelsoftware.org or by phoning 773-334-8177, to learn more about Open Channel
Software, the Open Channel Foundation, its software Disciplines, products and services, or to become
a participating author/developer.

NOTE: All product names mentioned in this news release are brands or registered trademarks of their
respective owners.

From BusinessWire: WHAT: IDC Research reveals a 45-80 percent lower total cost of
ownership (TCO) for Linux on the Intel architecture over
RISC/Unix environments.

WHEN: 10:00-11:00 a.m. EST, Wednesday, January 23, 2002

WHO: Al Gillen, International Data Corporation (IDC) Research
Director, System Software; and Michael Tiemann, Red Hat Chief
Technology Officer