Package update / download very slow.

[RimBlock]

Now I have sorted out the laptop to boot from USB stick I decided to put ubuntu-8.04.1 on my desktop PC as a dual boot along with my current XP Pro install.

The install went smoothly with manual resize of my XP boot drive and partitioning the free space. It copied and installed the files then prompted for a reboot. After the reboot, Grub worked fine. I then went to the update manager after login and kicked off the update packages job.

Now it gets slow. Very, very slow. 99 downloads are listed for update.

Some of the files download very quickly but every now and then a file will just stop downloading and sit there for 5+ minutes with no more progress. The size of the file does not matter. It has happened during download of 130K files as well as 8+MB files.

I have an 8Mbit ADSL line at home and have no problems with browsing or downloading via XP or with me D-Link DNS-323 NAS running Transmission.

I had the same with the laptop when I installed ubuntu to that but it never took anywhere near as long. After about 3 hours it had only done about 30 packages so I had to leave it going all night.

I hope this is not normal and yes, I appreciate the nature of the internet, locals, server availability and bandwidth all have an effect but this just seemed to be very strange. It was almost like it was dropping the connection and having to reget an IP address from my DHCP server and then re-establish the connection but as it is all pretty much windows based it is hard to see what is happening underneath.

Can anyone confirm if this is normal behaviour and when I may find any logs.

Cheer
RB

 

[BillytheImpaler]

I find this happening to me sometimes, but only when I'm at work. I assumed that the higher-up network admins were shaping traffic or something similar.

You might want to try changing repositories. Perhaps you'll get better performance from a different set of servers.

While I'm on the subject, does anyone know of a method or system for seamlessly and automatically using apt over an SSL encrypted connection? If so I could test my packet shaping theory.

 

[GarethDW]

Which repository were you using? I find that the oxford University repository is the fastest for me, and if for some reason that's slow I grab stuff from ticklers.org.

edit: forget those... I just saw your location. I had assumed you were based in the UK. Obviously choosing something a bit closer to home would be faster than a UK-based repository.

 

[GarethDW]

While I'm on the subject, does anyone know of a method or system for seamlessly and automatically using apt over an SSL encrypted connection? If so I could test my packet shaping theory.

Afraid not, Billy... but it's a good question that I'd be interested to find out about too.

 

[GarethDW]

Have you looked into using SecureApt, Billy? I wasn't even aware it existed until now, but it seems it's been around for a while.

I can't access the Ubuntu resources because we block https traffic at my work (so we can spy on people's internet activity ) but there's a Debian page about it...

http://wiki.debian.org/SecureApt

Apologies if this is something you're already well aware of

**********

edit: scrub that... looks like it doesn't use https to download the updates after all, just verifies they've been signed once you've downloaded them.

**********

edit #2: Been digging around a bit, and from the looks of things, it's only the commercial distros that offer updates via https. I suppose that's understandable considering the hardware costs associated.

Dragging this thread even further off topic, here's an interesting article about how repositories can be used to identify machines running vulnerable versions of packages that the admin is completely unaware of.

http://www.cs.arizona.edu/people/justin/packagemanagersecurity/attacks-on-package-managers.html

Briefly, the maintainer of the repository purposefully doesn't upgrade to the latest version of package x despite the previous version containing a known vulnerability. Users then update but will only be offered the outdated version. They happily install the buggy version - which as far as their package manager is aware is the latest version - and everything installs normally because it is correctly signed, etc... The maintainer of the repository now has a list of IP addresses where a specific version of an application that is known to contain a vulnerability is installed, so can be targetted for attack.

The beauty of this is that the admin of a compromised machine isn't likely to think that the maintainer of the repository is the culprit. Who would honestly have considered the repository maintainer instead of some random attacker is responsible?

The answer, as the article says, is to always use official sources for updates... something I'm guilty of not always doing.

 

[Una]

You could tunnel your connection out using ssh if you got a box outside your network.

Dragging this thread even further off topic, here's an interesting article about how repositories can be used to identify machines running vulnerable versions of packages that the admin is completely unaware of.

http://www.cs.arizona.edu/people/justin/packagemanagersecurity/attacks-on-package-managers.html

Briefly, the maintainer of the repository purposefully doesn't upgrade to the latest version of package x despite the previous version containing a known vulnerability. Users then update but will only be offered the outdated version. They happily install the buggy version - which as far as their package manager is aware is the latest version - and everything installs normally because it is correctly signed, etc... The maintainer of the repository now has a list of IP addresses where a specific version of an application that is known to contain a vulnerability is installed, so can be targetted for attack.

The beauty of this is that the admin of a compromised machine isn't likely to think that the maintainer of the repository is the culprit. Who would honestly have considered the repository maintainer instead of some random attacker is responsible?

The answer, as the article says, is to always use official sources for updates... something I'm guilty of not always doing.

Uh thats pretty obvious really. If you install things from an untrusted source then you deserve what you get really. However linux rocks in this respect that packages are signed.. it still relies on the notion of trust. In windows its very easy to ignore the warnings... Lots of software does not do secure updates. You could always evilgrade (http://www.infobyte.com.ar/down/isr-evilgrade-Readme.txt) someone if your that way inclined