October 2003 - openSUSE Security - openSUSE Mailing Lists

Probleme mit yppasswd
by Gordon Cichon 24 Oct '03

24 Oct '03

Hallo, ich habe hier ein frisch installiertes Suse 8.2 (CD-Version) mit einem Nis (yp) Server am laufen. Leider funktioniert das ändern der Passwörter nicht. Ich bekomme folgende Fehlermeldung: > gordon@andechs:~> yppasswd gordon > yppasswd is deprecated, use /usr/bin/passwd instead > > Changing password for gordon. > Old Password: > New password: > Re-enter new password: > Changing NIS password for gordon on veltins.catnet.et.tu-dresden.de. > Error while changing the NIS password. > Error: Password NOT changed > passwd: Authentication token manipulation error (Übrigens, mit /usr/bin/passwd ist es das ganz das Gleiche) Im syslog bekomme ich: > Oct 23 16:06:59 veltins rpc.yppasswdd[514]: update gordon (uid=1704) > from host 192.168.43.129 rejected > Oct 23 16:06:59 veltins rpc.yppasswdd[514]: Invalid password. Bei meinem gleichkonfigurierten Nis-Server unter Suse 7.1 geht das einwandfrei. Was ist denn da los? Warum geht das nicht? Vielen Dank für Eure Hilfe im Voraus. Viele Grüße, Gordon.

3 3

Problem mit rsh Authentifizierung(PAM?) oder Suche Alternative
by Gordon Cichon 24 Oct '03

24 Oct '03

Hallo, hier an unserer Universität unterhalten wir ein heterogenes Subnetz, in dem wir vor allem die Synthese und Simulation unserer digitalen Halbleiterschaltungen vornehmen. Leider kommen wir mit einer einzigen OS-Version nicht hin, und wir haben hier ein buntes Mischmasch von Betriebssystemen und Versionen. Zusammengehalten wird alles mit einer Konbination aus nis/autofs/samba, deren Server z.Zt. von Suse 7.1 auf Suse 8.2 umgestellt werden soll (ich hoffe immer noch auf eine hilfreiche Antwort auf meine frühere Mail bzgl. yppasswd ;-)). Unser Subnetz ist nach außen stark abgeschirmt, bei uns ist es viel wichtiger, daß die unterschiedlichen Systeme eng gekoppelt sind. Aus diesem Grund benutzen wir hier das System rlogin/rsh. Ssh wäre zwar sicherer, aber die damit zusammenhängenge Verschlüsselung würde die Performance zu stark beeinträchtigen. Ich suche nach einem System, mit dem man sich ohne Passwort und ohne Overhead auf einem anderen System einloggen kann. Dazu erscheint mir der Eintrag einer nis-netgroup in /etc/hosts.equiv die bequemste Lösung. Obwohl die netgroup per nis verteilt wird, und in nsswitch.conf eingetragen ist, beachtet der Suse rsh Server die Eintragung nicht. Eine Eintragung von @netgroup in ~/.rhosts funktioniert auch nicht. Die normale .rhosts Authentifizierung mit hostname und username funktioniert hingegen schon. Kann das sein, daß das irgendwie mit PAM zusammenhängt? Suse 8.2 hat eine Konfigurationsdatei für /etc/pam.d/rsh, in der Dinge stehen, die zu komplex sind, als das ich sie verstehen würde. Wie sagt man PAM, es soll die Nis netgroups verstehen? Woran könnte es sonst liegen? Gibt es ein anderes System als rsh, das das gleiche leistet? Viele Grüße, Gordon.

1 0

mysql_connect: Access denied
by Thomas Roth 24 Oct '03

24 Oct '03

Hello list, I've got that problem with mysql + php. Both run under SuSE 8.2, (php 4.3.1 as Apache module, mysql vers. 11.18). I have tried to follow the instructions, giving 'root' a password, setting up a mysql-user with fewer privileges etc. I have set up a table in db 'test' and put in some data. Now, when I try to connect via a php-script, access is denied: mysql_connect() [function.mysql-connect]: Access denied for user: 'roth@localhost' (Using password: NO) The first strange thing is that the username supplied to mysql_connect() in the script is not 'roth' (although this username exists on the system). Then I was somewhat successful by not supplying anything to the mysql_connect() function - until I realized that by default, there is a mysql-user '@localhost' without a password. Giving a password to '@localhost' of course leads with the access denial as above. I also found that the message ' Using password: NO' appears if you say on the commandline: 'mysql -u user' If you instead put int the -p ('mysql -u user -p '), you will be asked for the password, as it should be. But how can you do that via the web/apache/php? The only advice I've found is exactly what I did: to put the relevant data into the php script and use them in mysql_connect(). Somewhere I read that in case of an empty mysql_connect(), the identity of the apache-user will be used as the default mysql-user. But apache is definitly not running as the user that appears in the complaint above. Checking php.ini, I see that php runs in safe_mode. Well, I'm somewhat confused and would appreciate your help Thomas

2 2

spammer removed
by Roman Drahtmueller 23 Oct '03

23 Oct '03

Hi, I have removed some @promotionfactory.net email address from our list - if you have seen any spam from them lately, it is because you have posted to suse-security(a)suse.com lately. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // Nail here | SUSE Linux AG - Security Phone: // for a new | Nürnberg, Germany +49-911-740530 // monitor! --> [x] | - -

1 0

Strength and weaknesses of different encryption algorithems?
by Emmerich Eggler 22 Oct '03

22 Oct '03

Hello I've seen that there are recommandations of key lengths for different usage (private, corporate, government). There are certainly also recommondation of encryption algorithmens for different usage. Can someone point me to a webpage that covers this kind of questions? TIA Emmerich

3 2

AW: [suse-security] mysql_connect: Access denied
by Junge, Stefan 22 Oct '03

22 Oct '03

Hi Thomas, which entries are in the mysql user table ? 1. Connect to your MySQL DB (Console) # mysql -> Does this work without any authentication ? 2. Select the mysql Database # \u mysql 3. Select another pager for a better view # pager 4. Lets have a look to your user table ... # SELECT * FROM USER; You should have an entry like this ... Host localhost, User "empty", Password "empty" and with appropriate privileges Is your user 'roth' listed here ? ONLY for testing !!! Create a user with full privileges to all ! mysql > grant all privileges on *.* to testuser@% identified by 'testpassword' with grant option; This command creates the user 'testuser' with the access privilege 'from everywhere' with the right to to bequest his rights. With this user should be able to connect to the database with your PHP Script. Don´t forget to remove the user 'testuser' with his privileges ! Note: MySQL has its own user system - independent from the system users. Maybe this is a first step... Good luck Stefan > -----Ursprüngliche Nachricht----- > Von: Thomas Roth [mailto:thomas.roth@physik.tu-darmstadt.de] > Gesendet: Dienstag, 21. Oktober 2003 20:33 > An: suse-security > Betreff: [suse-security] mysql_connect: Access denied > > > > Hello list, > > I've got that problem with mysql + php. Both run under SuSE > 8.2, (php 4.3.1 as > Apache module, mysql vers. 11.18). > I have tried to follow the instructions, giving 'root' a > password, setting up > a mysql-user with fewer privileges etc. I have set up a table > in db 'test' > and put in some data. Now, when I try to connect via a > php-script, access is > denied: > > mysql_connect() [function.mysql-connect]: Access denied for user: > 'roth@localhost' (Using password: NO) > > The first strange thing is that the username supplied to > mysql_connect() in > the script is not 'roth' (although this username exists on > the system). > > Then I was somewhat successful by not supplying anything to the > mysql_connect() function - until I realized that by default, > there is a > mysql-user '@localhost' without a password. Giving a password > to '@localhost' > of course leads with the access denial as above. > > I also found that the message ' Using password: NO' appears > if you say on > the commandline: 'mysql -u user' > If you instead put int the -p ('mysql -u user -p '), you > will be asked for > the password, as it should be. > But how can you do that via the web/apache/php? The only > advice I've found is > exactly what I did: to put the relevant data into the php > script and use them > in mysql_connect(). > > Somewhere I read that in case of an empty mysql_connect(), > the identity of the > apache-user will be used as the default mysql-user. But > apache is definitly > not running as the user that appears in the complaint above. > > Checking php.ini, I see that php runs in safe_mode. > > Well, I'm somewhat confused and would appreciate your help > > Thomas > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

ipsec freeswan - connection established successfully, but packets are dropped ...
by Markus Feilner 20 Oct '03

20 Oct '03

Hello List, I am using SuSE 8.2 on two systems, together with freeswan ipsec. Both systems run: kernel 2.4.20-4GB freeswan 1.99_0.9.23 I have configured freeswan successfully with a Server-and-roadwarrior setup using Certs. By successfully I mean: in /var/log/messages I find a line like --------- Oct 16 21:54:26 Server ipsec__plutorun: 004 "VPN-ERMER" #2: STATE_QUICK_I2: sent QI2, IPsec SA established --------- or similar after starting ipsec on both systems and there are definitely no errors on both servers. On the server side we have the subnet x.x.89.0 to be accessible, on the roadwarrior side (which is connected via dsl) we have the x.x.0.0 subnet connected. My Problem: When i try to ping from one subnet to the other (of course from a different member of the subnet, not the machine running ipsec), the packets are routed correctly to the ipsec device, but there they vanish: ---------------------------- Server:/ # tcpdump -i ipsec0 tcpdump: listening on ipsec0 22:25:17.996878 217.229.160.84 > x.x.89.0: icmp: echo request (DF) 22:25:18.996902 217.229.160.84 > x.x.89.0: icmp: echo request (DF) 22:25:19.996909 217.229.160.84 > x.x.89.0: icmp: echo request (DF) (...) no answer is given to the ping and on the other side of the tunnel, nothing arrives - this happens to every packet that is sent to the tunnel, no matter which port, protocol and destination. As far as i can see, the packets are dropped, before they are given to ppp0: ----------------------------- Server:/ # ifconfig ipsec0 ipsec0 Link encap:IPIP Tunnel HWaddr inet addr:217.229.160.84 Mask:255.255.255.255 UP RUNNING NOARP MTU:16260 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:2002 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) ---------------------------- I stopped all Firewall rules, and checked the ipsec configuration over and over, but i can't find a solution. Can anyone help me? If you need, I can post both my ipsec.conf files and barfs, but i didn't want to cause big traffic. Perhaps someone already knows the solution.... Thanks!! -- Mit freundlichen Grüßen Markus Feilner -- Linux Solutions, Training, Seminare und Workshops - auch Inhouse Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

7 13

SuSEfirewall 2 configuration - computer name problem
by Andrei Bintintan 18 Oct '03

18 Oct '03

Hi I saw there was a little discuttion about suse firewall and samba, but I have another problem here. First of all I'm new in linux, so sorry if I ask stupid things... everyone has to learn right? I have a server in LAN which is web, mail, db server. Samba is also installed. Everything worked fine, but when I activate suse firewall I cannot see the computer name anymore. I have access with samba, I can ping the server but only with the IP address of the server, not with the name. Shortly the server name is not recognized anymore. I waste a lot of time with this... and I couldn't find the problem. The strange part is that I installed the same configuration under vmware and it works fine. I activated port 53 (domain name) but still doesn't work. Please advise. Thanx in advance. Andy.

2 1

fou4s - Fast OnlineUpdate for SuSE 0.10.0
by Markus Gaugusch 14 Oct '03

14 Oct '03

Hi, I'm happy to announce the final release of fou4s 0.10.0. For those who do not know, this software is meant to be an alternative for YOU (YaST OnlineUpdate), especially designed for administrators that need to keep many machines up-to-date in a convenient way. But I also use it on my desktop machines, so you may do so as well ;-) Since the last version many things have changed (hopefully, they have become better :) * SuSE 9.0 support * 2-level caching for even faster updates * Bandwidth limiting for downloads [--limit] * Check remote hosts for needed updates, even if fou4s is not installed there (you just need to be able to read the RPM database) [--host] * More support for foreign updates (packman, ...; hint: use --end!) * Files that are fully retrieved are no longer tried to be resumed * The language of the update descriptions can be chosen [--language] * New output formatting and summary Because of internal changes, the GpdList option should no longer be used. Just add your rsync servers to the Server= list (blank separated or add another Server= line) and run fou4s -u, etc as if it were a normal server. If you are updating to SuSE 9.0, please do a fou4s update FIRST, because the old version is not compatible. If you have already upgraded, run fou4s --auto --checkf -g, to install the new fou4s without signature checking (or just install the new fou4s version with rpm -Uvh ...). As usual, the software can be downloaded from http://fou4s.gaugusch.at/. Previous fou4s users are notified automatically, if the checkfou4s option is set in the cronjob. have a lot of fun ... Markus PS: For everyone who has not seen Terminator III: Machines will take over the world, if we don't keep our computers protected! -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

1 0

test plz ignore
by Arjen Runsink 13 Oct '03

13 Oct '03

ignore

1 0