http://bugzilla.novell.com/show_bug.cgi?id=551282 User pagan13@estreet.com added comment http://bugzilla.novell.com/show_bug.cgi?id=551282#c1 --- Comment #1 from Joseph Short 2009-10-30 03:21:03 MDT --- I need to add that the printing on this same all-in-one works, from both the server and remotely from the laptop. The only thing broken is networked scanning. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 User pagan13@estreet.com added comment http://bugzilla.novell.com/show_bug.cgi?id=551282#c3 Joseph Short changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW CC| |pagan13@estreet.com Info Provider|pagan13@estreet.com | --- Comment #3 from Joseph Short 2009-10-30 12:04:51 MDT --- Yes. Yast advises you to update after a kernel update, and I always do that. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 User jsmeix@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=551282#c4 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jsmeix@novell.com Component|Network |Kernel AssignedTo|jsmeix@novell.com |bnc-team-screening@forge.pr | |ovo.novell.com --- Comment #4 from Johannes Meixner 2009-11-05 00:51:27 MST --- Shouldn't it be assigned to the kernel people when a kernel update broke it? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 zhu rensheng changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-screening@forge.pr |kernel-maintainers@forge.pr |ovo.novell.com |ovo.novell.com -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 User pagan13@estreet.com added comment http://bugzilla.novell.com/show_bug.cgi?id=551282#c6 Joseph Short changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW Info Provider|pagan13@estreet.com | --- Comment #6 from Joseph Short 2009-11-10 04:24:59 MST --- How do you do that? I'll need to know how to acquire the old kernel, and also need to know which computer to put it on, the server or the client, or both. That kernel is not the one on the original install disk, it's been upgraded several times since GM. Also, the power supply/charger on my laptop (the client) went bad, so it will be a few days before I have a new one and can try out a test. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282#c8 Joseph Short changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW Info Provider|pagan13@estreet.com | --- Comment #8 from Joseph Short 2009-11-17 22:42:42 UTC --- I finally got the use of my notebook back, so I was able to test this. 1. I downgraded the kernel on the notebook. Result: failure 2. With notebook at downgraded version, I downgraded the server. Same result 3. I re-upgraded the notebook and tested. Same result As all four states are tested between these two machines with complete failure to detect or use the scanner, we can probably assume that the problem is not the kernel. Rather, either some other package is responsible or some part of the update hosed-up a configuration file somewhere deep in the bowels of either (or both) machine. As a side note, I have an old Thinkpad A20 I've been using for testing. It now has the newly-released 11.2 (i586 KDE) and is connected to the same net. It also doesn't see the scanner, yet the printer works (HP OfficeJet 6310 All-In-One). -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282#c10 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO Info Provider| |pagan13@estreet.com --- Comment #10 from Johannes Meixner 2009-11-18 10:04:48 UTC --- See http://en.opensuse.org/SDB:Configuring_Scanners_from_SUSE_LINUX_9.2 "Trouble-Shooting (Debugging)" how to provide debug-messages. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c11 Joseph Short changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW Info Provider|pagan13@estreet.com | --- Comment #11 from Joseph Short 2009-12-02 00:42:57 UTC --- Sorry for taking so long, unavoidable circumstances. There is no test procedure for the network connection in that web page, so I had to make up my own using clues from the page and links from it. Here is what I did: In the web page, under network scanning/saned, I found a reference, in a warning, to read "man saned" Doing that, under "RESTRICTIONS" I found the line: "In addition to the control connection (port 6566) saned also uses a data connection. The port of this socket is selected by the operating system and can't be specified by the user currently. This may be a problem if the connection must go through a firewall (packet filter). If you must use a packet filter, make sure that all ports > 1024 are open on the server for connections from the client." That reference to network ports gave me what I needed to experiment. This is what I did next: 1. Opened tcp ports 1024-7999 on the server. (For some reason, I had 8000:8001 programmed into the manual tcp port list, even though I have http and https server options enabled.) Tried to scan, instead of "searching for scanner" dialog box hanging for a long time, it came up immediately with a "scanner not found" message. I then re-installed the scanner driver on the server. Tried scanning again and the behavior of xsane reverted to its previous state: hanging on the searching box before finally getting the not found error message. I went back to the server and found that the tcp port setting changed to 1024:6565 6567:8001. I reset ports to 1024:7999 8000:8001 and set the allowed clients to 192.168.0.0/8 (from 127.0.0.0/8). Tried another preview scan. The xsane dialog actually came up. I clicked the acquire preview button and the scanner scanned, then hung. I tried some more port settings, then just shut the firewall down. Ran full scanning tests, and found all network scanning completely restored (remember, FIREWALL OFF). It appears the server firewall is not being set up properly to allow networked scanning. In addition, it was actually altered during or by the update in such a way as to break network scanning capability. That man page says there are ports, for data use, that cannot be set by the user, and I can find no reference to what they are. I hope this helps. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c13 Joseph Short changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P2 - High Status|RESOLVED |REOPENED Resolution|INVALID | --- Comment #13 from Joseph Short 2009-12-02 11:51:53 UTC --- I don't know where to start. Here is what I think I understand: The firewall is SUPPOSED to be active. That protects my computer from internet predators. "External Zone" is anything outside the computer. "Internal Zone" is anything inside the computer. I have no clue what "Demilitarized Zone" is. It doesn't seem to be used for anything. Saned is only supposed to allow scanning on the local network (usually 192.168.0.x). I don't know how to defeat that (not that I really need to). I noted that tcp 6566, activated and tested it. It only allowed partial functionality, and did not permit complete scans. This is not cleared up. Those directions do not fix network scanning. As I mentioned before, the only I can get network scanning to work properly is to shut down/turn off/deactivate the entire firewall. CLEARLY, there is a port that saned is using/expecting that it is not opening in the external zone of the firewall, since the internal zone is wide open. If this belongs, somehow, to security/firewall, please reassign it there. I am relying on you guys knowing which component is at fault. To summarize: network scanning is not fixed. Being required to scan with the firewall disabled/off forces an unacceptable breach of security and will open my server to hackers. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c17 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |NEEDINFO Info Provider| |pagan13@estreet.com --- Comment #17 from Johannes Meixner 2009-12-02 15:59:14 UTC --- Now I have the issue back :-( I cannot fix how saned works. It uses a random port for data transfer. That is how it is designed by the SANE project. I also cannot fix how our firewall works because its defaults are perfectly reasonable: By default it protects access from the "EXT" zone and allows access only for the "INT" zone. Finally I will never even open random ports in the "EXT" zone via the YaST scanner setup only to make scanning via network "just work" for the price of a totally insecure firewall setup which would be in the end the same as having no firewall running at all. In the end I cannot do anything here. Joseph Short, perhaps what you actually need is explanation what "External Zone" and "Internal Zone" means regarding firewall and a description how to set up your firewall accordingly? Is this what you ask for? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c19 --- Comment #19 from Joseph Short 2009-12-02 22:24:59 UTC --- SUMMARY OF PREVIOUS POST: 1. Before the update, network scanning worked. 2. After the update, network scanning is broken. 3. Network scanning works only when firewall is shut down. 4. Saned setup is supposed to set TCP 6566. It does not set it. 5. Even when you set TCP 6566 manually, saned setup deletes it. 6. I will run any test you ask and deliver any test result you want. 7. If the current version of saned cannot be repaired so that it actually does what is designed to do, can we (or at least I) go back to the previous version that is not broken? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c21 Joseph Short changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |REOPENED Info Provider|pagan13@estreet.com | --- Comment #21 from Joseph Short 2009-12-03 09:05:09 UTC --- Johannes, My network scanning used to work. My firewall has ALWAYS been active. I check it periodically to make sure it is up and working. I know it worked before and after. I NEVER leave a computer exposed like that. After the update, network scanning is broken and no longer works. That looks like a bug. My network on this side of my router (192.168.0.x) is trusted. I have to set this in the saned setup as 192.168.0.0/24, that's what that setting is for. That tells saned that any client it can see with an ip of 192.168.0.(anything) can be trusted for scanning. There is no other setup for network scanning. Please send me documentation for setting up openSUSE 11.1 firewall. That's an 11.1 version of openSUSE. I've never had to do more setting up of a firewall than the normal allowing http for a web server; they just haven't (until now) required that much maintenance. What I really DON"T understand is why you think I did something bad to the firewall to break network scanning, when I did NOTHING more than allow a software update. This is massively frustrating. **By the way: 1. If scanning can not be done securely through the network, how is it that PRINTING is accomplished safely? On the same HP all-in-one device? And: 2. If scanning is supposed to be done completely without a firewall, why would saned's own documentation specify that TCP 6566 be set in that firewall? If there's no firewall running, no port would be blocked and nobody would bother with setting TCP 6566. (Remember, this is just explicitly unblocking a port, it doesn't have anything to do with port routing.) I suspect the other port(s) used by saned are ones that are not normally blocked by a standard firewall. ***Maybe you could send me the range of those other ports that saned chooses randomly. I can test this and see if opening that range enables scanning. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c23 Joseph Short changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |REOPENED Info Provider|pagan13@estreet.com | --- Comment #23 from Joseph Short 2009-12-04 07:46:17 UTC --- Johannes, I spent the entire day on this. I got it to work, but I need for you to read the entire post. It contains some very important information. You were right that the network scanning will only work if the Internal Zone is active on the network interface. Please remember that most people only have one interface, and only one Zone can connect to that one interface. This is important because the Internal Zone is set up by default with every service, port and protocol enabled and wide open. The Internal Zone is essentially a fire-gaping-hole rather than a firewall. The way to correct this is to uncheck that little box at the bottom of the "Allowed Services" page labeled "Protect Firewall from Internal Zone." This clears all that greyed-out stuff and lets you put in all the stuff you want to allow while blocking all the rest. Otherwise, you have no firewall. Remember, most people, like me, have only one network interface to work with -- we cannot connect outside services to a separate interface. The other part is VERY IMPORTANT! When working with an environment where network scanning takes place on the same interface/zone as, for example, web browsing, you must manually open port TCP 6566 and open the Dynamic ports 49152:65535 on TCP, UDP, and RPC. If you don't, scanning will not work. I found the Dynamic ports reference at: http://www.iana.org/assignments/port-numbers The random ports that saned uses are in there. (Prior to my problems, I didn't have to set any ports, nor did I have to use Internal Zone. Something changed between the firewall, saned and Yast2 and broke my network scanning. It is now restored.) Another very important point is this: Sometimes when something gets changed (usually through Yast2), no change becomes active until the computer is rebooted. For example, during my testing, I changed the firewall back to External from Internal. Network scanning still worked -- until I rebooted the server. It took another hour or so of testing before I realized that the change from Internal to External did not register until the reboot. I'd be surprised if no one else noticed this, but maybe most people just note it and don't say anything. I have some recommendations here: 1. Either have the network scanning setup in Yast2 make the necessary changes to the firewall, or at least inform the user that those firewall changes need to be made -- what they are and how to do it. I realize that this incurs a slight security risk, but remember, most people have only one interface, and saned is designed to accept only requests from the trusted, and specified, subnet (usually 192.168.x.x). 2. Include an option for opening the Dynamic Ports (49152:65535) with an explanation as to why you might need to do that and with the usual security warnings. 3. If this problem won't or can't be fixed, at least provide documentation accessible from a "help" button to help a user patch it together and make it work. I'll be happy to write something to help out (most of it is right here). 4. Recommend (with a pop-up box) a reboot after changes in network operations and services to make sure those changes become active. This will save a lot of hair-pulling and gnashing of teeth by people who haven't yet discovered this "feature." Thank you -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c25 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |NEEDINFO Info Provider| |lnussel@novell.com --- Comment #25 from Johannes Meixner 2009-12-08 12:18:51 UTC --- Ludwig, see comment #23 and comment #24 above. Could you recommend a reasonable firewall config so that scanning via network is possible even when the firewall is active for the INT zone? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c30 --- Comment #30 from Christian Boltz 2009-12-12 01:45:51 CET --- (In reply to comment #26)

There is no special conntrack module as for ftp

Hmmm, Ludwig, what's this then? ;-) # lsmod |grep sane nf_conntrack_sane 7892 0 nf_conntrack 102912 6 nf_conntrack_sane,nf_conntrack_ipv6,[...] (I never tested if it works, but it exists.) Joseph, does scanning work if you setup your firewall as I described in comment #24? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c32 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P4 - Low Status|REOPENED |NEEDINFO Info Provider| |lnussel@novell.com Summary|After whatever software |Firewall settings to make |update the firewall runs |scanning via network |which made scanning via |possible with active |network impossible |firewall Severity|Normal |Enhancement --- Comment #32 from Johannes Meixner 2009-12-15 09:10:13 UTC --- Let's see if reasonable firewall settings are possible to allowe scanning via network even with active firewall. Regarding a specific port range for saned, see "man saned": ----------------------------------------------------------------- The saned.conf configuration file contains both options for the daemon and the access list. data_portrange = min_port - max_port Specify the port range to use for the data connection. Pick a port range between 1024 and 65535; don't pick a too large port range, as it may have performance issues. Use this option if your saned server is sitting behind a firewall. If that firewall is a Linux machine, we strongly recommend using the Netfilter nf_conntrack_sane module instead. ----------------------------------------------------------------- I do not understand the "instead" therein. It looks as if usage of nf_conntrack_sane would mean that one cannot use data_portrange in /etc/sane.d/saned.conf additionally? By the way: I do not understand how a (presumably small) port range could make it more secure. I would think that the smaller the port range, the easier it is for an eavesdropper to sniff packages and the easier for an attacker to attack a system because he knows the ports of interest in advance? Regardless of the port range for the data connection: The saned listens on the well-known port "sane-port" (6566) and according to "man saned" ------------------------------------------------------------------ First and foremost: saned is not intended to be exposed to the internet or other non-trusted networks. Make sure that access is limited by ... a firewall setup. ------------------------------------------------------------------ so that first and foremost our firewall setup must protect port 6566 against access from the Internet any any other non-trusted networks. Ludwig, wouldn't only the one following manual setting by the user FW_TRUSTED_NETS="192.168.1.0" be already sufficient and a reasonable firewall setting to make scanning via network possible even with active firewall (provided that the 192.168.1.0 network is trusted by the user)? If yes, I could implement in yast2-scanner that the user can enter his trusted networks and then yast2-scanner would append those values to FW_TRUSTED_NETS in /etc/sysconfig/SuSEfirewall2. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c34 --- Comment #34 from Johannes Meixner 2009-12-15 10:53:03 UTC --- I assume you mean something like having in /etc/sane.d/saned.conf ------------------------------------------------------------------- data_portrange = 10000 - 10100 ------------------------------------------------------------------- together with a /etc/sysconfig/SuSEfirewall2.d/services/sane which contains accordingly ------------------------------------------------------------------- TCP="sane-port 10000:10100" ------------------------------------------------------------------- But this alone is not sufficiently secure because this alone just opens ports 6566 and 10000 - 10100 for any access from any host or network. Therefore additionally I need a firewall setup to protect access to those posts from any non-trusted hosts and networks i.e. I need a firewall setup to allow access to those posts only from explicitely stated trusted hosts and/or networks. How can I do the latter? By the way: Meanwhile I think the whole basic firewall setup based upon ports is mostly useless. I think the basic firewall setup might be better based "first and foremost" upon trusted hosts and networks. Reasoning: For the INT zone it does not make sense because an active firewall for "INT" makes it effectively "EXT" (see comment #26). Opening ports in the EXT zone does also make not much sense because allow any access from any host or network to particular ports does not provide any protection for this ports. As far as I see the only reason for a firewall setup based upon ports is when certain services are listening but access should be allowed only to some of them (e.g. allow access to the HTTP server but do not allow access to whatever other running server). But when no access is allowed to a service, why is its server process listening at all on the outer network (e.g. why is the server not only listening on the loopback interface)? In contrast when I could specify via basic firewall setup which hosts and networks are trusted (all others are then untrusted), the question which ports/services are allowed to be accessed from the trusted hosts and networks is of secondary importance (by default all ports/services are allowed to be accessed from trusted hosts and networks). -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c36 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |ASSIGNED Platform|i686 |All --- Comment #36 from Johannes Meixner 2009-12-15 13:14:08 UTC --- Thanks a lot! "if you want a configuration that makes sense use separate zones" is exactly what I also think (see comment #22). Trusted networks should have well separated network interfaces so that those network interfaces can be assigned to the INT zone to have the trusted network well separated from the rest. Anything else is a problematic mix-up of trusted and non-trusted stuff in one same network environment. I will enhance the help text in yast2-scanner accordingly so that users hopefully better understand what they may set up in which particular kind of their network environments. I will not implement support for sophisticated firewall setup in problematic network environments in yast2-scanner. Such kind of firewall setup must be done via yast2-firewall which is THE tool for a more sophisticated firewall setup. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c38 --- Comment #38 from Johannes Meixner 2009-12-16 08:12:37 UTC --- FYI: "man saned" is not related to SuSEfirewall and/or openSUSE because "man saned" shows the current upstream man page from the SANE project sane-backends sources "as is". By the way: http://www.sane-project.org/man/saned.8.html seems to be outdated because the content there is what I remember from older sane-backends versions, in particular the "RESTRICTIONS" part therein. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c40 --- Comment #40 from Johannes Meixner 2009-12-16 08:34:12 UTC --- FYI regarding "By the way" in comment #38: I filed an upstream bug report regarding "man/saned.8.html on the website looks outdated" https://alioth.debian.org/tracker/index.php?func=detail&aid=312165&group_id=30186&atid=410366 -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c42 --- Comment #42 from Ludwig Nussel 2009-12-16 10:02:42 CET --- (In reply to comment #41)

Ludwig, could you describe or point to documentation how /etc/sysconfig/SuSEfirewall2.d/services/* files do support *_ACCEPT_RELATED_* because /etc/sysconfig/SuSEfirewall2.d/services/TEMPLATE reads "Only the variables TCP, UDP, RPC, IP and BROADCAST are allowed" and the only possible values for each of those variables is a "space separated list of allowed ... ports".

Gotcha! :-) You are not on 11.2 and you didn't install the updates for 11.1. Meanwhile that paragraph looks like this: # Only the variables TCP, UDP, RPC, IP, BROADCAST, RELATED and # MODULES are allowed. More may be supported in the future. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c44 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED --- Comment #44 from Johannes Meixner 2009-12-23 14:45:48 UTC --- Fixed in YaST SVN revision 60192. New version 2.19.0 with this RPM changelog entry: -------------------------------------------------------------------- - Replaced overcomplicated but nevertheless mostly useless code for using the YaST SuSEFirewall module by simple generic code in a ShowFirewallPopup function in the same way as it works for yast2-printer (compare Novell/Suse Bugzilla bnc#549065) and enhanced the help text "Regarding Firewall", (see Novell/Suse Bugzilla bnc#551282). -------------------------------------------------------------------- The enhanced the help text "Regarding Firewall" is: -------------------------------------------------------------------- Regarding Firewall Clients contact the saned via the sane-port (TCP port 6566) but scanning data is transferred via an additional random port. Therefore is is not sufficient for scanning via network to open only port 6566 in the firewall. You can specify a port range for the data connection in the saned config file /etc/sane.d/saned.conf via an entry like 'data_portrange = 30000 - 30100' and then open port 6566 and the port range 30000:30100 in the firewall. The default firewall settings protect your host from external access. Allowing access from the external network (i.e. for the external zone) does not make sense because scanning documents requires physical scanner access by trusted users. On the other hand the default firewall settings allow any access from an internal (i.e. trusted) network unless you have firewall protection enabled for the internal zone. But an active firewall for the internal zone (i.e. for the trusted network zone) does usually also not make much sense because this makes the internal zone effectively the same as the external zone. The simplest and most secure way to do scanning via network is when the trusted network has a well separated network interface to have the trusted network well separated from the rest. Then those network interface can be assigned to the internal zone via the YaST Firewall setup module and scanning via network will work without any further firewall setup. Anything else may result a problematic mix-up of trusted and non-trusted network traffic in one same network environment. For example when both the internal network and the connection to the Internet happens via one same 'router-box' device. In such a case the 'router-box' device is the crucial point (in particular the crucial point of possible failure) regarding network security. In any case a plain opening of a port for the external zone is dangerous because it allows access from any foreign host to those port but does not provide any protection for the service which is accessed via this port (e.g. the saned). Instead of plain opening of ports for arbitrary access one should additionally specify in the firewall setup from which hosts and networks the access is allowed. The YaST Firewall setup module can also be used for such kind of more sophisticated firewall setup. -------------------------------------------------------------------- -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=551282 http://bugzilla.novell.com/show_bug.cgi?id=551282#c46 --- Comment #46 from Johannes Meixner 2010-01-21 16:46:34 UTC --- In YaST SVN revision 60474: Reduced the too long help text 'regarding firewall' (see comment #44) but added a link to 'SDB:CUPS and SANE Firewall settings' at http://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.