February 2004 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] Iptables PREROUTING
by Stefan.Junge＠ssi-schaefer.de 04 Feb '04

04 Feb '04

Hi Vincent, Try yast2 -> System -> Sysconfig Editor -> Network -> Base -> IP here you will find a select box IP_FORWARD. Set it to 'yes'. With best regards, Stefan > -----Ursprüngliche Nachricht----- > Von: Vincent Lee [mailto:vincent.lee@vs-pro.com] > Gesendet: Mittwoch, 4. Februar 2004 03:50 > An: suse-security(a)suse.com > Betreff: [suse-security] Iptables PREROUTING > > Dear all, > > I am new to SuSE. I would like to setup the MS netmeeting for > a computer which behind SuSE firewall. When I made change on > the nat, I cannot get it through. It seems that the IP > forwarding is disabled by SuSE. Can anyone tell me how can I > enable it? > > Best Regards, > > Vincent

1 0

Re: [suse-security] [Announcement] New fou4s release - 0.11.2
by GarUlbricht7＠netscape.net 04 Feb '04

04 Feb '04

Juan Erbes <jerbes(a)arnet.com.ar> wrote: >When i execute fou4s, i got the error: >cat: /etc/suseservers: No such file or directory > >¿From who obtain the /etc/suseservers file? > >GarUlbricht7(a)netscape.net wrote: > >>Markus Gaugusch <markus(a)gaugusch.at> wrote: >> >>> Fou4s (Fast OnlineUpdate for SuSE) is an alternative implementation >>> of YOU >>>(YaST Online Update) and is aimed at admin users that want updates as >>> painless and automated as possible. >>> But it can also be useful for desktop users. >>> I've used it to update mozilla, gnome, kde and rpms from >>> packman.links2linux.org as well. >>> >>>See: http://fou4s.gaugusch.at/ >>> >>>for more information. >>> >>-----<Snip>--- ----<and snip again>----- > Hi Juan, Sorry I cause some confussion. I should have just sent my mail to Markus and not post it on the security list, because what I was saying was it appeared to me that his download site was working. Be that as it may, Several things I didn't say: 1. I had my "ftp" coonection to the net up and running. 2. Prior to executing the command, I started a shell. 3. And I logged in as root, usisng "sux -" I had also previously downloaded and installed the "fou4s.rpm: from: http://fou4s.gaugusch.at/download.shtml So what I was doing was installing a patch. See: http://fou4s.gaugusch.at/ For more info. Sorry again for any confusion I caused:( fou4s Is great and I hope you get it installed. Hope this helps, Gar -- Then I was __________________________________________________________________ New! Unlimited Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Act now to get a personalized email address! Netscape. Just the Net You Need.

1 0

[Announcement] New fou4s release - 0.11.2
by Markus Gaugusch 03 Feb '04

03 Feb '04

Fou4s (Fast OnlineUpdate for SuSE) is an alternative implementation of YOU (YaST Online Update) and is aimed at admin users that want updates as painless and automated as possible. But it can also be useful for desktop users. I've used it to update mozilla, gnome, kde and rpms from packman.links2linux.org as well. See http://fou4s.gaugusch.at/ for more information. Now the bad part :-) Lars Ellenberg has found a potential security problem that is fixed in this release: RPM pre/postinstall scripts were executed with a group writable umask and GID fou4s. Although no unprivileged user should be member of group fou4s (it is thought for administrators who want to run fou4s with a non-root rights, and not for normal users), I recommend to check your machines and fix broken permissions. Please note, that group fou4s has NO members with the default settings! The commands below are an example for checking. I exclude /var because according to my tests it is not affected by the bug. You can also only exclude /var/cache/fou4s and /var/log/fou4s.log, if you want to be sure. # check files find / -group fou4s | grep -v '^/var/' | xargs ls -la # fix rights, if you are satisfied with above results find / -group fou4s | grep -v '^/var/' | xargs chmod g-w # fix owner - don't fix before fixing rights or no match is found there!! find / -group fou4s | grep -v '^/var/' | xargs chgrp root Martin Köhling has also found a potential problem. Versions of fou4s before 0.11.0 didn't recognise the latest kdebase3-SuSE update because of a slightly different formatting of the update description file. Fou4s 0.11.0 and newer automatically find the missed update, so you are encouraged to get the latest version. (Try fou4s --auto --checkfou4s). Apart from the above, this release contains mostly bugfixes for the --export and --host options. German and French information texts (--language=german) are now shown correctly (Unicode decoding, thanks to Matthias Andree for this!). Some non-SuSE packages that caused update problems because of different arch (e.g. i386 instead of i586) also work now. kind regards, Markus Gaugusch -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \

1 0

Identical http request in log file
by Andreas Jägermann 03 Feb '04

03 Feb '04

Hi list, I've experienced strange entries in the transfer.log of my apache 1.3.23. This apache is protected via .htaccess files and is the only service I provide to selected users. The entries look like this: aaa.bbb.ccc.ddd - - [31/Jan/2004:00:01:29 +0100] "GET / HTTP/1.1" 401 494 65.166.64.132 - - [31/Jan/2004:00:01:30 +0100] "GET / HTTP/1.1" 401 494 aaa.bbb.ccc.ddd - - [31/Jan/2004:00:09:00 +0100] "GET / HTTP/1.1" 401 494 217.169.46.98 - - [31/Jan/2004:00:09:01 +0100] "GET / HTTP/1.1" 401 494 aaa.bbb.ccc.ddd - - [31/Jan/2004:00:17:41 +0100] "GET / HTTP/1.1" 401 494 65.245.128.68 - - [31/Jan/2004:00:17:42 +0100] "GET / HTTP/1.1" 401 494 aaa.bbb.ccc.ddd is the ip of one of my users who is just accessing the htaccess-dialog. Every request that is made, is doubled from a different ip. If the user logs in with a valid account then the "doubled" request gets a 401. Is this a security problem at my site? How can I prevent this without limiting access to certain ip addresses? I'm using SuSE 8.0 with all patches applied. Any hint is appreciated. Thanks in advance. Regards, Andreas

4 7

RE: [suse-security] RAID5 on SuSE 9.0
by David Soltero-Lugo 03 Feb '04

03 Feb '04

Already 4 hours testing with out errors!!! It has to be the raid!! Any other thoughts? David -----Original Message----- From: Michael Wirth [mailto:micha@linux-install.de] Sent: Tuesday, February 03, 2004 8:39 AM To: David Soltero-Lugo Subject: Re: [suse-security] RAID5 on SuSE 9.0 David, > Jan 15 22:27:39 linux kernel: raid5: resync finished. > Jan 15 22:47:40 linux kernel: Unable to handle kernel paging request at > virtual address 000011e6 > Jan 15 22:47:40 linux kernel: printing eip: > Jan 15 22:47:40 linux kernel: c7c13ddc > Jan 15 22:47:40 linux kernel: *pde = 00000000 > Jan 15 22:47:40 linux kernel: Oops: 0002 2.4.21-166-athlon #1 Thu Dec 18 > 18:24:05 UTC 2003 > Jan 15 22:47:40 linux kernel: CPU: 0 > Jan 15 22:47:40 linux kernel: EIP: > 0010:[ipv6:mipv6_functions_R874e5304+51758556/804608079] Tainted: P > Jan 15 22:47:40 linux kernel: EIP: 0010:[<c7c13ddc>] Tainted: P > Jan 15 22:47:40 linux kernel: EFLAGS: 00010296 > Jan 15 22:47:40 linux kernel: eax: 00000000 ebx: 08073fc0 ecx: 00000000 > edx: 08073fd0 > Jan 15 22:47:40 linux kernel: esi: 00000030 edi: c7c13eba ebp: c7c13fa4 > esp: c7c13dc4 > Jan 15 22:47:40 linux kernel: ds: 0018 es: 0018 ss: 0018 > Jan 15 22:47:40 linux kernel: Process man (pid: 3459, stackpage=c7c13000) ^^^^^^^^^^^ This is almost certainly not a kernel bug, but a dirty RAM component. Try running memtest86 overnight. Then get a printout and contact your dealer for new RAMs. Process man should never cause a kernel Oops... Greetings and good luck............Michael --- --- Michael Wirth linux-install Mühlehof 20 Phone: +49-7073-802 72119 Ammerbuch Fax: +49-7073-500282 wirth(a)linux-install.de Web: http://www.linux-install.de/

3 3

RE: [suse-security] RAID5 on SuSE 9.0
by David Soltero-Lugo 03 Feb '04

03 Feb '04

Yes, module aic7xxx (2) 29160 AND 19160! On kernel 2.4.21-166-athlon -----Original Message----- From: Guido Tschakert [mailto:guido.tschakert@src-gmbh.de] Sent: Tuesday, February 03, 2004 9:28 AM To: David Soltero-Lugo Subject: Re: [suse-security] RAID5 on SuSE 9.0 David Soltero-Lugo wrote: > > I am trying to setup a 9.0Pro machine using 4 scsi discs on a RAID5 > (software based) but I am having troubles with it. If I boot on runlevel 1 > the system does not crash, but if I boot over another runlevel, the system > will freeze after a while with a Oops message, related to ipv6 driver, > raid5.o, ssh, or other. Here are some of the Oops, This is a brand new > installation with almost everything default!!! > > Thanks for any help you can give! > > David > > ############################################################################ > # > > Jan 15 22:27:39 linux kernel: md: md0: sync done. > Jan 15 22:27:39 linux kernel: raid5: resync finished. > Jan 15 22:47:40 linux kernel: Unable to handle kernel paging request at > virtual address 000011e6 > Jan 15 22:47:40 linux kernel: printing eip: > Jan 15 22:47:40 linux kernel: c7c13ddc > Jan 15 22:47:40 linux kernel: *pde = 00000000 > Jan 15 22:47:40 linux kernel: Oops: 0002 2.4.21-166-athlon #1 Thu Dec 18 > 18:24:05 UTC 2003 > Jan 15 22:47:40 linux kernel: CPU: 0 > Jan 15 22:47:40 linux kernel: EIP: > 0010:[ipv6:mipv6_functions_R874e5304+51758556/804608079] Tainted: P > Jan 15 22:47:40 linux kernel: EIP: 0010:[<c7c13ddc>] Tainted: P > Jan 15 22:47:40 linux kernel: EFLAGS: 00010296 > Jan 15 22:47:40 linux kernel: eax: 00000000 ebx: 08073fc0 ecx: 00000000 > edx: 08073fd0 > Jan 15 22:47:40 linux kernel: esi: 00000030 edi: c7c13eba ebp: c7c13fa4 > esp: c7c13dc4 > Jan 15 22:47:40 linux kernel: ds: 0018 es: 0018 ss: 0018 > Jan 15 22:47:40 linux kernel: Process man (pid: 3459, stackpage=c7c13000) > Jan 15 22:47:40 linux kernel: Stack: 08073fc8 c7c13ddc 00000008 08073fd4 > 00033f8d 00000000 11e68900 00000000 > Jan 15 22:47:40 linux kernel: 00000028 00000000 c8765848 c7c13f24 > 00000016 c875cb26 c7c13eba c875c3f0 > Jan 15 22:47:40 linux kernel: c328e470 c7c13fa4 c7c13ea4 00000016 > 11e68900 00000000 0002c39a 00000000 > Jan 15 22:47:40 linux kernel: Call Trace: > [keybdev:__insmod_keybdev_O/lib/modules/2.4.21-166-athlon/kernel/dri+4265276 > 528/96] (216) [cached_lookup+24/112] (120) [vfs_readdir+169/176] (12) > Jan 15 22:47:40 linux kernel: Call Trace: [<c328e470>] (216) > [<c0154798>] (120) [<c0159369>] (12) > Jan 15 22:47:40 linux kernel: [filldir64+0/288] (20) > [sys_getdents64+91/181] (08) [filldir64+0/288] (32) [sys_fcntl64+93/192] > (36) > Jan 15 22:47:40 linux kernel: [<c01599f0>] (20) [<c0159b6b>] (08) > [<c01599f0>] (32) [<c0158acd>] (36) > Jan 15 22:47:40 linux kernel: [system_call+51/56] (60) > ############################################################################ > > Which kind of scsi-controller do you use? The Modul for adaptec (aic7xxx) is a little bit buggy (a lot of backporting from Kernel 2.6, which leads to a lot of error messages) A friend of mine had tried it and went back to SuSE 8.1. -- mit freundlichen Grüßen, Guido Tschakert ___________________________________________________________________ SRC Security Research & Consulting GmbH Graurheindorfer Str. 149a Tel: +49-228-2806-138 53117 Bonn Mobil:+49-160-3671422 http://www.src-gmbh.de Fax: +49-228-2806-199

1 0

RE: [suse-security] RAID5 on SuSE 9.0
by David Soltero-Lugo 03 Feb '04

03 Feb '04

I did think that, but with SuSE 8.2 didn't have that problem, neither with 8.1, 8.0, 7.3, on the same machine!!!. IF I load runlevel 1 and then change to runlevel5 there is NO problem the problems start when Jan 15 22:27:39 linux kernel: raid5: resync finished. This happens!! But anyway I will be trying the memtest. Thanks! David -----Original Message----- From: Michael Wirth [mailto:micha@linux-install.de] Sent: Tuesday, February 03, 2004 8:39 AM To: David Soltero-Lugo Subject: Re: [suse-security] RAID5 on SuSE 9.0 David, > Jan 15 22:27:39 linux kernel: raid5: resync finished. > Jan 15 22:47:40 linux kernel: Unable to handle kernel paging request at > virtual address 000011e6 > Jan 15 22:47:40 linux kernel: printing eip: > Jan 15 22:47:40 linux kernel: c7c13ddc > Jan 15 22:47:40 linux kernel: *pde = 00000000 > Jan 15 22:47:40 linux kernel: Oops: 0002 2.4.21-166-athlon #1 Thu Dec 18 > 18:24:05 UTC 2003 > Jan 15 22:47:40 linux kernel: CPU: 0 > Jan 15 22:47:40 linux kernel: EIP: > 0010:[ipv6:mipv6_functions_R874e5304+51758556/804608079] Tainted: P > Jan 15 22:47:40 linux kernel: EIP: 0010:[<c7c13ddc>] Tainted: P > Jan 15 22:47:40 linux kernel: EFLAGS: 00010296 > Jan 15 22:47:40 linux kernel: eax: 00000000 ebx: 08073fc0 ecx: 00000000 > edx: 08073fd0 > Jan 15 22:47:40 linux kernel: esi: 00000030 edi: c7c13eba ebp: c7c13fa4 > esp: c7c13dc4 > Jan 15 22:47:40 linux kernel: ds: 0018 es: 0018 ss: 0018 > Jan 15 22:47:40 linux kernel: Process man (pid: 3459, stackpage=c7c13000) ^^^^^^^^^^^ This is almost certainly not a kernel bug, but a dirty RAM component. Try running memtest86 overnight. Then get a printout and contact your dealer for new RAMs. Process man should never cause a kernel Oops... Greetings and good luck............Michael --- --- Michael Wirth linux-install Mühlehof 20 Phone: +49-7073-802 72119 Ammerbuch Fax: +49-7073-500282 wirth(a)linux-install.de Web: http://www.linux-install.de/

1 0

RE: [suse-security] RAID5 on SuSE 9.0
by David Soltero-Lugo 03 Feb '04

03 Feb '04

NO, es una maquina con un motherboard Tyan! Pero el problema no es con el ethernet, pues si la subo runlevel 1 y luego la cambio a runlevel 5 el raid5 en software NO trata de hacer el sync de los 4 disco y por lo tanto NO se jangea! Pero entonces NO tengo el raid funcionando!!! David -----Original Message----- From: Manuel Balderrábano [mailto:garibolo@wanadoo.es] Sent: Tuesday, February 03, 2004 8:31 AM To: David Soltero-Lugo Subject: Re: [suse-security] RAID5 on SuSE 9.0 Hola, David. (Asumo que hablas español.) ¿Se trata de un servidor IBM, por casualidad? Tuve un priblema idéntico al tuyo, y al final era la forma en que la BIOS manejaba el driver de la ethernet integrada en placa. Lo solucioné instalando una ethernet PCI, y ahora todo va como la seda! Un saludo. ----- Original Message ----- From: "David Soltero-Lugo" <david(a)hpcf.upr.edu> To: <suse-security(a)suse.com> Sent: Tuesday, February 03, 2004 10:14 AM Subject: [suse-security] RAID5 on SuSE 9.0 > > > I am trying to setup a 9.0Pro machine using 4 scsi discs on a RAID5 > (software based) but I am having troubles with it. If I boot on runlevel 1 > the system does not crash, but if I boot over another runlevel, the system > will freeze after a while with a Oops message, related to ipv6 driver, > raid5.o, ssh, or other. Here are some of the Oops, This is a brand new > installation with almost everything default!!! > > Thanks for any help you can give! > > David > > ############################################################################ > # > > Jan 15 22:27:39 linux kernel: md: md0: sync done. > Jan 15 22:27:39 linux kernel: raid5: resync finished. > Jan 15 22:47:40 linux kernel: Unable to handle kernel paging request at > virtual address 000011e6 > Jan 15 22:47:40 linux kernel: printing eip: > Jan 15 22:47:40 linux kernel: c7c13ddc > Jan 15 22:47:40 linux kernel: *pde = 00000000 > Jan 15 22:47:40 linux kernel: Oops: 0002 2.4.21-166-athlon #1 Thu Dec 18 > 18:24:05 UTC 2003 > Jan 15 22:47:40 linux kernel: CPU: 0 > Jan 15 22:47:40 linux kernel: EIP: > 0010:[ipv6:mipv6_functions_R874e5304+51758556/804608079] Tainted: P > Jan 15 22:47:40 linux kernel: EIP: 0010:[<c7c13ddc>] Tainted: P > Jan 15 22:47:40 linux kernel: EFLAGS: 00010296 > Jan 15 22:47:40 linux kernel: eax: 00000000 ebx: 08073fc0 ecx: 00000000 > edx: 08073fd0 > Jan 15 22:47:40 linux kernel: esi: 00000030 edi: c7c13eba ebp: c7c13fa4 > esp: c7c13dc4 > Jan 15 22:47:40 linux kernel: ds: 0018 es: 0018 ss: 0018 > Jan 15 22:47:40 linux kernel: Process man (pid: 3459, stackpage=c7c13000) > Jan 15 22:47:40 linux kernel: Stack: 08073fc8 c7c13ddc 00000008 08073fd4 > 00033f8d 00000000 11e68900 00000000 > Jan 15 22:47:40 linux kernel: 00000028 00000000 c8765848 c7c13f24 > 00000016 c875cb26 c7c13eba c875c3f0 > Jan 15 22:47:40 linux kernel: c328e470 c7c13fa4 c7c13ea4 00000016 > 11e68900 00000000 0002c39a 00000000 > Jan 15 22:47:40 linux kernel: Call Trace: > [keybdev:__insmod_keybdev_O/lib/modules/2.4.21-166-athlon/kernel/dri+4265276 > 528/96] (216) [cached_lookup+24/112] (120) [vfs_readdir+169/176] (12) > Jan 15 22:47:40 linux kernel: Call Trace: [<c328e470>] (216) > [<c0154798>] (120) [<c0159369>] (12) > Jan 15 22:47:40 linux kernel: [filldir64+0/288] (20) > [sys_getdents64+91/181] (08) [filldir64+0/288] (32) [sys_fcntl64+93/192] > (36) > Jan 15 22:47:40 linux kernel: [<c01599f0>] (20) [<c0159b6b>] (08) > [<c01599f0>] (32) [<c0158acd>] (36) > Jan 15 22:47:40 linux kernel: [system_call+51/56] (60) > ############################################################################ > > > -- > Check the headers for your unsubscription address > For additional commands send e-mail to suse-linux-e-help(a)suse.com > Also check the archives at http://lists.suse.com > Please read the FAQs: suse-linux-e-faq(a)suse.com > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

RAID5 on SuSE 9.0
by David Soltero-Lugo 03 Feb '04

03 Feb '04

I am trying to setup a 9.0Pro machine using 4 scsi discs on a RAID5 (software based) but I am having troubles with it. If I boot on runlevel 1 the system does not crash, but if I boot over another runlevel, the system will freeze after a while with a Oops message, related to ipv6 driver, raid5.o, ssh, or other. Here are some of the Oops, This is a brand new installation with almost everything default!!! Thanks for any help you can give! David ############################################################################ # Jan 15 22:27:39 linux kernel: md: md0: sync done. Jan 15 22:27:39 linux kernel: raid5: resync finished. Jan 15 22:47:40 linux kernel: Unable to handle kernel paging request at virtual address 000011e6 Jan 15 22:47:40 linux kernel: printing eip: Jan 15 22:47:40 linux kernel: c7c13ddc Jan 15 22:47:40 linux kernel: *pde = 00000000 Jan 15 22:47:40 linux kernel: Oops: 0002 2.4.21-166-athlon #1 Thu Dec 18 18:24:05 UTC 2003 Jan 15 22:47:40 linux kernel: CPU: 0 Jan 15 22:47:40 linux kernel: EIP: 0010:[ipv6:mipv6_functions_R874e5304+51758556/804608079] Tainted: P Jan 15 22:47:40 linux kernel: EIP: 0010:[<c7c13ddc>] Tainted: P Jan 15 22:47:40 linux kernel: EFLAGS: 00010296 Jan 15 22:47:40 linux kernel: eax: 00000000 ebx: 08073fc0 ecx: 00000000 edx: 08073fd0 Jan 15 22:47:40 linux kernel: esi: 00000030 edi: c7c13eba ebp: c7c13fa4 esp: c7c13dc4 Jan 15 22:47:40 linux kernel: ds: 0018 es: 0018 ss: 0018 Jan 15 22:47:40 linux kernel: Process man (pid: 3459, stackpage=c7c13000) Jan 15 22:47:40 linux kernel: Stack: 08073fc8 c7c13ddc 00000008 08073fd4 00033f8d 00000000 11e68900 00000000 Jan 15 22:47:40 linux kernel: 00000028 00000000 c8765848 c7c13f24 00000016 c875cb26 c7c13eba c875c3f0 Jan 15 22:47:40 linux kernel: c328e470 c7c13fa4 c7c13ea4 00000016 11e68900 00000000 0002c39a 00000000 Jan 15 22:47:40 linux kernel: Call Trace: [keybdev:__insmod_keybdev_O/lib/modules/2.4.21-166-athlon/kernel/dri+4265276 528/96] (216) [cached_lookup+24/112] (120) [vfs_readdir+169/176] (12) Jan 15 22:47:40 linux kernel: Call Trace: [<c328e470>] (216) [<c0154798>] (120) [<c0159369>] (12) Jan 15 22:47:40 linux kernel: [filldir64+0/288] (20) [sys_getdents64+91/181] (08) [filldir64+0/288] (32) [sys_fcntl64+93/192] (36) Jan 15 22:47:40 linux kernel: [<c01599f0>] (20) [<c0159b6b>] (08) [<c01599f0>] (32) [<c0158acd>] (36) Jan 15 22:47:40 linux kernel: [system_call+51/56] (60) ############################################################################ -- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq(a)suse.com

1 0

[OT] Bind9 not resolving the first time round ...
by Ray Leach 03 Feb '04

03 Feb '04

Hi All I use SuSE 9.0 on my firewall. I am having issues with Bind9 not resolving host the first time round. If the same wuery is issued within a few seconds, then it resolves correctly. I did a bit of research at google.com and came across a few list postings (of various lists) which suggest that bind9 is to blame. Are there currently any such known issues with bind 9.2.2 on SuSE 9.0? Their suggestions were to go back to bind8. Regards Ray -- -- Raymond Leach <raymondl(a)knowledgefactory.co.za> Network Support Specialist http://www.knowledgefactory.co.za "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 --

1 0