Date: Tue, 20 Sep 2005 19:11:53 +0200
From: Martin Schulze <joey@infodrom.org.>
Subject: Debian Security Host Bandwidth Saturation
Message-ID: <20050920171153.GB1074@finlandia.infodrom.north.de.>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
User-Agent: Mutt/1.5.9i
X-Debian: PGP check passed for security officers
Priority: urgent
Resent-Message-ID: <iFZFyD.A._WE.R_EMDB@murphy.>
Reply-To: listadmin@SECURITYFOCUS.COM
Mail-Followup-To: bugtraq@securityfocus.com
To: bugtraq@securityfocus.com
Resent-Date: Tue, 20 Sep 2005 13:07:13 -0500 (CDT)
Resent-From: list@murphy.debian.org (Mailing List Manager)
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
The Debian Project http://www.debian.org/
Security Host Bandwidth Saturation press@debian.org
September 20th, 2005 http://www.debian.org/News/2005/20050920
- ------------------------------------------------------------------------
Debian Security Host Bandwidth Saturation
The recently released security update of XFree86 in DSA 816 for sarge
and woody has caused the host security.debian.org to saturate its
100MBit/s network connection entirely. Due to the large number of X
packages, the gross size of these packages and the high number of
users who need to install the update, the server is busy sending out
updates which exhaust its total outgoing bandwidth.
This incident happens before new a security infrastructure is in place
which would have avoided this. At the moment we ask our users to
accept delays in their update until the situation is relaxed again.
Yesterday morning, at about 11 o'clock (CEST, i.e. UCT +0200) the
files for the security update DSA 816 (XFree86) were installed on the
public security server. The result was similar to a distributed
denial of service since literally thousands of users tried to fetch
the updates. Since then the host saturates its network connection
entirely.
Independent of this there have been discussions about restructuring
the security infrastructure in order to provide a more failsafe
solution, that can also deal with high bandwidth peaks better than a
single machine.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFDMEKxW5ql+IAeqTIRArhRAKCrWBXrPLxEjI4TaAO0EysV3O8iGQCfTBC1
AcXjiglPKxS8wGqKzbHAeB0=
=iLq8
-----END PGP SIGNATURE-----
