January 2003 - openSUSE Security - openSUSE Mailing Lists

27 Jan '03

1 0

squid authentifizierung von windows clients
by Markus Feilner 27 Jan '03

27 Jan '03

Hallo Liste, Ich habe eine Frage bezüglich Squid Proxy. Ich möchte Clients in einem Windows - Active Directory Netzwerk den Zugang zu Squid ermöglichen. Mit ldap_group_auth und einem gepatchten Squid 2.4 funktioniert das soweit ganz gut, ich kann sogar nur Usern aus der Gruppe WWW_users den Zugriff gewähren, allen anderen nicht. Gut, aber: Jeder User muß sich beim ersten Zugriff authentifizieren, extra am Proxy anmelden, obwohl er doch als Windows-User bereits im Netz angemeldet ist. Gibt es da eine Möglichkeit, die Windows-Authentifizierung für den Squid mit zu verwenden, so dass nicht jedesmal ein Login/Passwort Fenster erscheint? Danke! -- Mit freundlichen Grüßen Markus Feilner May you always grok in fullness! Beachten Sie bitte unsere neue Email-Adresse! ------------------------------------------------------------------------------------------------- Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

1 0

s: sch_htb.o for SuSE8.1 Kernel 2.4.19-4GB
by David Huecking 27 Jan '03

27 Jan '03

Hi list, does anybody provide the traffic shaping module shc_htb.o for the SuSE8.1 Pentium Kernel 2.4.19-4GB or does know where to get it? I read somewhere that patching the SuSE-Kernel with the htb-patch is not too simple. >From vanilla kernel 2.4.20 on htb is standard and it seems to work to force loading this module in SuSE 2.4.19-4GB, but I really don't want to take that risk of forcing. -- Eat, sleep and go running, David Huecking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216

1 0

password recovery!!!!!
by ΚΑΡΑΘΑΝΑΣΗΣ ΔΗΜΗΤΡΗΣ 27 Jan '03

27 Jan '03

Ηi. I am running suse linux 7.1 with sendmail, dns, mysql ..! I have a big problem. Yesterday I reboot my machine but when is starts it tells me to do fschk.ext2 manually. I did it. I reboot the machine, all the services went up but I can't login. The mail also prompts for incorrect password!!!! It looks like the /etc/passwd file corrupts!!!!! Is there a way to recover it. Please help. Is urgent!!!!

3 2

Re: [suse-security] Could a System Ooops be caused by failing to "re-start"?
by GarUlbricht7＠netscape.net 26 Jan '03

26 Jan '03

Hi List-- Does any one know if you have to "re-start" your macine after installing two new SuSE security patches: ppp and/or yast2-config-inet ? Reason for asking is I experienced my first "system ooops" on my SuSE 8.0 box (i586) on Saturday 1/25/03 I assuming it was something I did rather than effects of some mal-ware. However, with the hub-bub this weekend over major major connectivity problems caused by an exploit of vulnerability published in June 2002 which some Server admins had just ignored, I have been going through my logs, etc. I had downloaded two patches via YOU Friday nite: "yast2-config-inet (2.5.6-0)" and "ppp-19082 (2.4.-283) I then logged out to "the other user screen", and went to bed. However, I did not re-start my machine. Next day, I could not log back in. My system admin killed the machine, and then we did a power off/on, restart. I am now looking at logs but and studying "ksymoops" to make more sense out of my logs. In the meantime, I think what cause my Oooops was I did not re-start my machine after loading these two patches. I "re-call" that the "directions" that came with the patches said I need to "re-start" but I forgot, and now I can't find those directions. Am I right, did I need to "re-start"??? -- TIA Gar __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

2 1

Re: [suse-security] Lotus Notus Passthru port #
by willbr＠texoma.net 24 Jan '03

24 Jan '03

> Hi all > > Does anybody know what TCP port number lotus notes internet passthru uses ? > > > Andre Vorster > Business Print Centre > Tel: 012 349 2295 > Fax: 012 349 2299 I find what ports software is using by running tcpdump while running the program, sending a mail message in your case. You may need to open the firewall or stop it to get the return ports. This approach has been easier than surfing the Net to find ports if they are not on the list of assinged ports. http://www.iana.org/assignments/port-numbers Bill --------------------------------------------- This message was sent using Endymion MailMan. http://www.endymion.com/products/mailman/

1 0

Problems starting SuseFirewall during Bootprocess
by Kai Ulrich 24 Jan '03

24 Jan '03

Hey After I intalled the kernel update k_atlon-2.4.19-167 I got following message during the bootprocess : Starting Firewall Initialization (phase 2 of 3) <notice>'/etc/init.d/rc5.d/S07hotplug start' exits with status 0 <notice>/etc/init.d/rc5.d/S09SuSEfirewall2_setup start <notice>pidofproc: ipppd 524 /etc/init.d/rc5.d/S09SuSEfirewall2_setup: line 74: 735 Killed $SUSEFWALL start >/dev/null 2>&1 failed Any Ideas ? Frendly Regards Kai PS : MY /etc/init.d/rc5.d/S09SuSEfirewall2_setup : #! /bin/sh # Copyright (c) 2000-2002 SuSE GmbH Nuernberg, Germany. # # Author: Marc Heuse <marc(a)suse.de> # # /etc/init.d/SuSEfirewall2_setup # ### BEGIN INIT INFO # Provides: SuSEfirewall2_setup # Required-Start: SuSEfirewall2_init $network $local_fs # X-UnitedLinux-Should-Start: route dhclient # Required-Stop: $local_fs # X-UnitedLinux-Should-Stop: # Default-Start: 3 4 5 # Default-Stop: 0 1 2 6 # Short-Description: SuSEfirewall2 phase 2 # Description: SuSEfirewall2_setup does some basic setup and is the # phase 2 of 3 of the SuSEfirewall initialization. ### END INIT INFO # X-SuSE-Dep-Only SUSEFWALL="/sbin/SuSEfirewall2" test -x $SUSEFWALL || exit 5 test -r /etc/sysconfig/SuSEfirewall2 || exit 6 . /etc/rc.status rc_reset case "$1" in start) echo -n "Starting Firewall Initialization " echo -n '(phase 2 of 3) ' $SUSEFWALL start > /dev/null 2>&1 rc_status -v ;; stop) echo -n "Shutting down the Firewall " test "$FW_STOP_KEEP_ROUTING_STATE" = "yes" || echo -n "(and disabling routing) " $SUSEFWALL stop > /dev/null 2>&1 rc_status -v ;; restart|force-reload) $0 start rc_status ;; try-restart|reload) ($0 status) >/dev/null 2>&1 || exit 7 $0 start rc_status ;; restart2) # the restart2 argument is used by yast2 to not open any ports # while the filter rules are being rewritten. RLVL=`/sbin/runlevel | sed 's/. //'` if [ ! -e /etc/init.d/rc${RLVL}.d/S??SuSEfirewall2_setup ]; then $SUSEFWALL stop > /dev/null 2>&1 fi $SUSEFWALL start > /dev/null 2>&1 ;; long-status) echo "Checking the status of SuSEfirewall2 " $SUSEFWALL status || rc_failed 3 ;; status) echo -n "Checking the status of SuSEfirewall2 " iptables -L reject_func >/dev/null 2>&1 || rc_failed 3 rc_status -v ;; *) echo "Usage: $0 {start|stop|status|restart|reload|force-reload}" exit 1 ;; esac # Set exit status rc_exit

1 0

Re: WELCOME to suse-security-announce@suse.com
by keith.anthony.roberts＠bigfoot.com 24 Jan '03

24 Jan '03

On Fri, 24 Jan 2003 keith.anthony.roberts(a)bigfoot.com wrote: > > Hi there! > > I have tried twice to remove my bigfoot email address from the list > without any success. > > Can you please remove me from the four mailing list that I'm on. > > this one and: > > suse-programming-e > suse-security > taskjuggler-devel > > > My limit of 25 forwarded emails per day via bigfoot is being exceeded, and > I could be losing important email. > > When you have removed me then I will resubscribe using an alternative > direct email address. > > Many thanks K. Roberts. > > > On 27 Dec 2002 suse-security-announce-help(a)suse.com wrote: > > > Hi! This is the ezmlm program. I'm managing the > > suse-security-announce(a)suse.com mailing list. > > > > I'm working for my owner, who can be reached > > at suse-security-announce-owner(a)suse.com. > > > > Acknowledgment: I have added the address > > > > keith.anthony.roberts(a)bigfoot.com > > > > to the suse-security-announce mailing list. > > > > Welcome to suse-security-announce(a)suse.com! > > > > Please save this message so that you know the address you are > > subscribed under, in case you later want to unsubscribe or change your > > subscription address. > > > > To unsubscribe, send a message to: > > > > <suse-security-announce-unsubscribe-keith.anthony.roberts=bigfoot.com(a)suse.com> > > > > > > --- Administrative commands for the suse-security-announce list --- > > > > I can handle administrative requests automatically. Please > > do not send them to the list address! Instead, send > > your message to the correct command address: > > > > For help and a description of available commands, send a message to: > > <suse-security-announce-help(a)suse.com> > > > > To subscribe to the list, send a message to: > > <suse-security-announce-subscribe(a)suse.com> > > > > To remove your address from the list, just send a message to > > the address in the ``List-Unsubscribe'' header of any list > > message. If you haven't changed addresses since subscribing, > > you can also send a message to: > > <suse-security-announce-unsubscribe(a)suse.com> > > > > For addition or removal of addresses, I'll send a confirmation > > message to that address. When you receive it, simply reply to it > > to complete the transaction. > > > > If you need to get in touch with the human owner of this list, > > please send a message to: > > > > <suse-security-announce-owner(a)suse.com> > > > > Please include a FORWARDED list message with ALL HEADERS intact > > to make it easier to help you. > > > > --- Enclosed is a copy of the request I received. > > > > Return-Path: <keith.anthony.roberts(a)bigfoot.com> > > Received: (qmail 26714 invoked from network); 27 Dec 2002 21:49:03 -0000 > > Received: from unknown (HELO Cantor.suse.de) (213.95.15.193) > > by 0 with SMTP; 27 Dec 2002 21:49:03 -0000 > > Received: from mk-smarthost-1.mail.uk.tiscali.com (mk-smarthost-1.mail.uk.tiscali.com [212.74.114.37]) > > by Cantor.suse.de (Postfix) with ESMTP id CA863148BF > > for <suse-security-announce-sc.1041025541.aocenfbadfanfmanmehf-keith.anthony.roberts=bigfoot.com(a)suse.com>; Fri, 27 Dec 2002 22:49:02 +0100 (MET) > > Received: from [62.64.220.224] (helo=dial-62-64-220-224.access.uk.tiscali.com) > > by mk-smarthost-1.mail.uk.tiscali.com with esmtp (Exim 4.10) > > id 18S2LL-000P9r-00 > > for suse-security-announce-sc.1041025541.aocenfbadfanfmanmehf-keith.anthony.roberts=bigfoot.com(a)suse.com; Fri, 27 Dec 2002 21:48:36 +0000 > > Date: Fri, 27 Dec 2002 22:47:33 +0000 (GMT) > > From: keith.anthony.roberts(a)bigfoot.com > > X-Sender: root(a)topaz.SysAdmin > > To: suse-security-announce-sc.1041025541.aocenfbadfanfmanmehf-keith.anthony.roberts=bigfoot.com(a)suse.com > > Subject: Re: confirm subscribe to suse-security-announce(a)suse.com > > In-Reply-To: <1041025541.23890.ezmlm(a)suse.com> > > Message-ID: <Pine.LNX.4.10.10212272247100.190-100000(a)topaz.SysAdmin> > > MIME-Version: 1.0 > > Content-Type: TEXT/PLAIN; charset=US-ASCII > > > > > > > > On 27 Dec 2002 suse-security-announce-help(a)suse.com wrote: > > > > > Hi! This is the ezmlm program. I'm managing the > > > suse-security-announce(a)suse.com mailing list. > > > > > > I'm working for my owner, who can be reached > > > at suse-security-announce-owner(a)suse.com. > > > > > > To confirm that you would like > > > > > > keith.anthony.roberts(a)bigfoot.com > > > > > > added to the suse-security-announce mailing list, please send > > > an empty reply to this address: > > > > > > suse-security-announce-sc.1041025541.aocenfbadfanfmanmehf-keith.anthony.roberts=bigfoot.com(a)suse.com > > > > > > Usually, this happens when you just hit the "reply" button. > > > If this does not work, simply copy the address and paste it into > > > the "To:" field of a new message. > > > > > > This confirmation serves two purposes. First, it verifies that I am able > > > to get mail through to you. Second, it protects you in case someone > > > forges a subscription request in your name. > > > > > > > > > --- Administrative commands for the suse-security-announce list --- > > > > > > I can handle administrative requests automatically. Please > > > do not send them to the list address! Instead, send > > > your message to the correct command address: > > > > > > For help and a description of available commands, send a message to: > > > <suse-security-announce-help(a)suse.com> > > > > > > To subscribe to the list, send a message to: > > > <suse-security-announce-subscribe(a)suse.com> > > > > > > To remove your address from the list, just send a message to > > > the address in the ``List-Unsubscribe'' header of any list > > > message. If you haven't changed addresses since subscribing, > > > you can also send a message to: > > > <suse-security-announce-unsubscribe(a)suse.com> > > > > > > For addition or removal of addresses, I'll send a confirmation > > > message to that address. When you receive it, simply reply to it > > > to complete the transaction. > > > > > > If you need to get in touch with the human owner of this list, > > > please send a message to: > > > > > > <suse-security-announce-owner(a)suse.com> > > > > > > Please include a FORWARDED list message with ALL HEADERS intact > > > to make it easier to help you. > > > > > > --- Enclosed is a copy of the request I received. > > > > > > Return-Path: <keith.anthony.roberts(a)bigfoot.com> > > > Received: (qmail 23885 invoked from network); 27 Dec 2002 21:45:41 -0000 > > > Received: from unknown (HELO Cantor.suse.de) (213.95.15.193) > > > by 0 with SMTP; 27 Dec 2002 21:45:41 -0000 > > > Received: from turing.suse.de (Turing.suse.de [213.95.15.200]) > > > by Cantor.suse.de (Postfix) with ESMTP id 53381145FC > > > for <suse-security-announce-subscribe(a)suse.com>; Fri, 27 Dec 2002 22:45:41 +0100 (MET) > > > Date: Fri, 27 Dec 2002 22:45:41 +0100 > > > From: keith.anthony.roberts(a)bigfoot.com > > > Message-Id: <200212272145.gBRLjf611824(a)turing.suse.de> > > > To: undisclosed-recipients: ; > > > > > > >

1 0

Re: [suse-security] apache + mod_frontpage
by Thorsten Marsen 24 Jan '03

24 Jan '03

NOT FOUND schrieb am 24.01.03 02:23:26: > Hi Frank, > > I don't know what happened to some people when they read words like "Windows" and "Front Page". In my opinion, thats a little bit stupid and beyond of reality - Windows *CLIENTS* are there Linux will never get there, because people like Ruprecht (Sorry, but my mum have no time und understand to rebuild my kernel next time). Hey Ruprecht, why so unfriedly? Just think about it and help, if you have the knowledge: Give a productive hint or be quite, ok?. So simple. > > Frank, I'm running SuSE 8.1 and there you can find packages and therefore descriptions regarding Front Page Server Extensions. You can find there mod_frontpage and the Front Page Server extensions 4.0 / 5.0. Be aware to make a decision about Extensions 2000 *OR* 2002 - I think 2002 is much more safe - and may be strongly recommened for that - but requires a httpd-Patch! I think SuSE 8.1 have one - but that httpd is outdated and mission importand features (but this is to be proofed). Another starting point may be http://home.edo.uni-dortmund.de/~chripo/about/index.html. > > I have played a little bit around with SuSEs FPSE but don't succeeded. I think there is no other possibility as to rebuild the Apache with the patch included - there may be another way, I don't know. Ok, this may help you not so much. Maybe a try more the next week and iit would be very kind of you when you counld tell me in the case you succeed in the meanwhile. > > Thanks, > Thorsten. > > ================================================= > > Hi Franck, > > > I must install mod_frontpage, it isn't for me but for a client :( > > Your problem. Say the client it should take proper thinks and not > so a bullshit !!. An argument is the security risks in Frontpage and > the IE-Area. Have a look to the pages of Mr.Larholm and you know what I mean. > > You are not supported from me. > > Regards, > Ruprecht > > ---------------------------------- > Ruprecht Helms IT-Service und Softwareentwicklung > > Tel/Fax.: +49[0]7621 16 99 16 > Homepage: http://www.rheyn.de > email: info(a)rheyn.de > ---------------------------------- > ______________________________________________________________________________ Wir benachrichtigen Sie uber neue E-Mails, wo immer Sie moechten. WEB.DE FreeMail - http://freemail.web.de/features/?mc=021186

5 7

Security rpm question
by DJ 24 Jan '03

24 Jan '03

Hi, Is there anything in a suse security rpm that identifies itself as a "security fix"? I was reviewing in YAST the installed software. I searched and looked at samba, susehelp, cups, and mysql... all of which had security announcements. Just by looking at YAST's presentation of the rpm data, I was trying to determine if I could tell if the fix was a "security fix". I couldn't, and I just wanted to verify that this is correct with the experts on this list. Thank you. -- __________________________ DJ mailto: linux_programmer(a)hotmail.com

6 5