FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Ubuntu > Ubuntu Development

 
 
LinkBack Thread Tools
 
Old 01-12-2009, 05:22 PM
"Joe Terranova"
 
Default Moving Asterisk into main

I want to make it easier to install Asterisk on Ubuntu Server.

Asterisk is, according to Wikipedia, "a software implementation of a
telephone private branch exchange (PBX) originally created in 1999 by
Mark Spencer of Digium. Like any PBX, it allows attached telephones to
make calls to one another, and to connect to other telephone services
including the public switched telephone network (PSTN) and Voice over
Internet Protocol (VoIP) services. Its name comes from the asterisk
symbol, '*'." [1]

You can use Asterisk to set up an extremely robust phone system which
can easily the replace proprietary PBXs -- for example, Cisco -- that
run most companies' phone systems. Trixbox and AsteriskNow are two
Linux distros, among several, that exist solely to make it easy to set
up and use Asterisk.

However, I want to make it easier for people to run Asterisk on Ubuntu
server; Ubuntu is my preferred distribution, and like many
administrators, I would rather use a general purpose server
distribution than a specialized distribution. I currently run Asterisk
on Ubuntu server both for my company's and my home phone systems, but
one issue that keeps companies from using Asterisk on Ubuntu is the
security risk: Asterisk isn't kept up-to-date with security fixes
because it isn't in the main repository.

In order to fix security vulnerabilities, I must build Asterisk from
source, and I have to recommend the same thing for those using Debian
or Ubuntu to run their Asterisk server. This is makes administering
Asterisk on Ubuntu difficult.

Do developers see any issues with moving Asterisk to the main
repository? The stable release, 1.4, is only updated for bug fixes and
security issues; maintaining Asterisk seems to be rather easy -- it
just needs to get done, regularly.

I am, of course, happy to help in any way I can.

[1] http://en.wikipedia.org/wiki/Asterisk_(PBX)

Sincerely,

Joe Terranova

--
ubuntu-devel mailing list
ubuntu-devel@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel
 
Old 01-13-2009, 06:40 PM
Kees Cook
 
Default Moving Asterisk into main

On Mon, Jan 12, 2009 at 01:22:48PM -0500, Joe Terranova wrote:
> one issue that keeps companies from using Asterisk on Ubuntu is the
> security risk: Asterisk isn't kept up-to-date with security fixes
> because it isn't in the main repository.

On the other hand, it's not entirely ignored, either. It has gotten
attention, but it does depend on interested community members to do the
patch hunting, backporting, and testing.

> Do developers see any issues with moving Asterisk to the main
> repository? The stable release, 1.4, is only updated for bug fixes and
> security issues; maintaining Asterisk seems to be rather easy -- it
> just needs to get done, regularly.

Moving it to main doesn't solve the resource problem: someone still
needs to do the updates, and resources are limited. I would recommend
creating a community of people that care about Asterisk, and getting
involved with motu-swat[1] to do the patch hunting, backporting, and
testing to go through the Security Update Procedures[2]. If the Ubuntu
asterisk package received continued support from folks, it might even
qualify for a MicroReleaseException[3]

> I am, of course, happy to help in any way I can.

Getting patches into the existing releases is the best way to solve this.
Please see[2], we'd love the help. I use asterisk myself and have
tended to hunt down patches for some of the more serious issues.

Thanks,

-Kees

[1] https://wiki.ubuntu.com/SecurityTeam/GettingInvolved
[2] https://wiki.ubuntu.com/SecurityUpdateProcedures
[3] https://wiki.ubuntu.com/StableReleaseUpdates/MicroReleaseExceptions

--
Kees Cook
Ubuntu Security Team

--
ubuntu-devel mailing list
ubuntu-devel@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel
 
Old 01-27-2009, 04:53 AM
"Brian J. Murrell"
 
Default Moving Asterisk into main

On Tue, 13 Jan 2009 11:40:57 -0800, Kees Cook wrote:
>
> On the other hand, it's not entirely ignored, either.

# apt-cache policy asterisk
asterisk:
Installed: 1:1.4.17~dfsg-2ubuntu1
Candidate: 1:1.4.17~dfsg-2ubuntu1
Version table:
*** 1:1.4.17~dfsg-2ubuntu1 0
500 http://apt.interlinx.bc.ca hardy/universe Packages

IIRC, some pretty serious security bulletins have been released since
that vintage.

> It has gotten
> attention, but it does depend on interested community members to do the
> patch hunting, backporting, and testing.

Indeed.

> Moving it to main doesn't solve the resource problem: someone still
> needs to do the updates, and resources are limited. I would recommend
> creating a community of people that care about Asterisk, and getting
> involved with motu-swat[1] to do the patch hunting, backporting, and
> testing to go through the Security Update Procedures[2].

Good idea. How does such a community usually get organized within the
Ubuntu community? Sure, somebody could just start a ML somewhere and
hope that enough interested people find it, but surely there must some
point of organization within Ubuntu to help kickstart this community.
I'd be interested in being a member.

> Getting patches into the existing releases is the best way to solve
> this. Please see[2], we'd love the help. I use asterisk myself

Ditto.

> and
> have tended to hunt down patches for some of the more serious issues.

Ditto. I suspect we are all treading the same paths and some community
here could help reduce the duplication of effort.

b.



--
ubuntu-devel mailing list
ubuntu-devel@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel
 

Thread Tools




All times are GMT. The time now is 04:11 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org