April 2007 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] Updates for 9.3
by Sven.Hartrumpf＠FernUni-Hagen.de 03 May '07

03 May '07

Hi all. Novell announced that 9.3 updates end on 2007-04-15 and that a last kernel update will be available at the end of 2007-04. Any news on this? (Today's "SUSE Security Summary Report" did not mention this issue.) Greetings Sven

5 10

[opensuse-security] Weird encrypted filesystem problem.
by Carlos E. R. 02 May '07

02 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have bumped into a weird problem with encrypted filesystems. It appears there are two incompatible types that use the same options in the cryptotab file. It's difficult to explain. I have replaced an old disk wit a bigger one. The old one had an encrypted partition predating SuSE 9.2. Over the time, I have created other partitions and copied files to encrypted filesystems in DVD, and never had problems. However, I discovered, after switching to the new disk, that although I could load the new encrypted partition, I was unable to load any of the old ones. In order to mount any of those encrypted filesystems, first I have to mount the obsolete (pre 9.2) one, then the rest - except that in that case, I'm unable to mount the new one. For example. I boot, and the "/etc/init.d/boot.crypto" script mounts the main encrypted partition fine. I then manually try to mount one of the auxiliaries: nimrodel:~/cripta.problem # losetup -a /dev/loop0: [000d]:2484 (/dev/disk/by-id/ata-ST3320620A_5QF2M56F-part15) encryption=CryptoAPI/twofish-cbc nimrodel:~/cripta.problem # mount /mnt/crypta.x/ Password: mount: /dev/loop1: can't read superblock However, if edit the /etc/cryptotab to mount the obsolete one (I had to copy it over from the old disk for this purpose): /dev/loop1 /Grande/oldcriptadevicefile /A60/cripta xfs twofishSL92 noatime and now, I mount it: nimrodel:~/cripta.problem # /etc/init.d/boot.crypto start Activating crypto devices using /etc/cryptotab ... Please enter passphrase for /Grande/oldcriptadevicefile: Switching to SuSE 9.2 loop_fish2 compatibility mode. Please enter passphrase for /Grande/oldcriptadevicefile: fsck 1.38 (30-Jun-2005) /sbin/fsck.xfs: XFS file system. See the notice about 9.2 compatibility mode? Once this mode is activated, I can mount any of the partitions or backups I created during last year: (fstab) /biggy/crypta.bck_f.x0 /mnt/crypta.x xfs noauto,loop,encryption=twofish256 0 0 nimrodel:~/cripta.problem # mount /mnt/crypta.x/ Password: nimrodel:~/cripta.problem # mount /mnt/dvd.crypta.x/ Password: nimrodel:~/cripta.problem # mount | grep encryption /dev/hda15 on /cripta type xfs (rw,noatime,loop=/dev/loop0,encryption=twofish256) /Grande/oldcriptadevicefile on /A60/cripta type xfs (rw,noatime,loop=/dev/loop1,encryption=twofishSL92) /biggy/crypta.bck_f.x0 on /mnt/crypta.x type xfs (rw,loop=/dev/loop2,encryption=twofish256) /dev/hdc on /mnt/dvd.crypta.x type xfs (ro,noexec,nosuid,nodev,loop=/dev/loop3,encryption=twofish256) nimrodel:~/cripta.problem # losetup -a /dev/loop0: [000d]:2484 (/dev/disk/by-id/ata-ST3320620A_5QF2M56F-part15) encryption=CryptoAPI/twofish-cbc /dev/loop1: [0314]:177 (/Grande/oldcriptadevicefile) encryption=twofish256 /dev/loop2: [1650]:135 (/biggy/crypta.bck_f.x0) encryption=twofish256 /dev/loop3: [000d]:5490 (/dev/dvd) encryption=twofish256 See? everything is mounted, old, medium, new (remember that "loop1" is in 9.2 compatibility mode, explicitly). The thing is, I first have to mount the new partition, using "encryption=twofish256". Second thing, I have to mount the old one, using "encryption=twofishSL92", which switches something in the system to "SuSE 9.2 loop_fish2 compatibility mode". Finally, I can mount the new partitions using "encryption=twofish256" as well, but which were created while there was already a mounted partition in 9.2 mode (during last year). That is, it seems that if twofishSL92 is active, new partitions in twofish256 need the old mode to be active to be able to mount! If not, they give errors: Filesystem "loop1": Disabling barriers, not supported by the underlying device XFS mounting filesystem loop1 XFS: Log inconsistent (didn't find previous header) XFS: failed to find log head XFS: log mount/recovery failed: error 5 XFS: log mount failed Feb 11 01:04:58 nimrodel kernel: XFS: Log inconsistent (didn't find previous header) Feb 11 01:04:58 nimrodel kernel: XFS: failed to find log head Feb 11 01:04:58 nimrodel kernel: XFS: log mount/recovery failed: error 5 Feb 11 01:04:58 nimrodel kernel: XFS: log mount failed My problem is now that I have to keep using the old compatibility mode! I have to keep this in the cryptotab file, and in that precise order: /dev/loop0 /dev/disk/by-id/ata-ST3320620A_5QF2M56F-part15 /cripta xfs twofish256 noatime /dev/loop1 /Grande/oldcriptadevicefile /A60/cripta xfs twofishSL92 noatime And I will have to keep for ever that twofishSL92 file I do not want, simply in order to activate the old compatibility mode so that I can mount my backup dvds which do not use twofishSL92 but twofish256, but still need twofishSL92! Or, can I change some definition in the cryptotab file so that I can mount "twofish256" filesystems that require "twofishSL92" to be previously activated? - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFzmwLtTMYHG2NR9URAk9uAJ0f15fnbFkuPOoUAtUWlhMwiVJrywCfbOId jeUDB7zXgVOWM3pkJGUo2UQ= =ZKI4 -----END PGP SIGNATURE----- --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 22

[opensuse-security]
by Ron Joffe 26 Apr '07

26 Apr '07

Hey folks, I have a SLES-9 server which is running vpn software that creates a tunnel utilizing tun0 network devices. I access the tunnels from a number of other machines on a local network via default routes to this SLES-9 server. I would like to setup the SuSEFirewall on this particular machine. I have not been able to figure out the combination of configuration values which will allow the SLES-9 to still allow routing from the local network to the tun0 device. Any suggestions as to which items to look at? Next question (and the reason I want the firewall up in the first place). I want to only allow a certain set of ip's on my local network to access the tun0 device on the SLES-9 server. I want to limit the ip's of devices which can route through this box. Thanks, Ron --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] Re: [suse-security-announce] SUSE Security Announcement: XFree86,Xorg (SUSE-SA:2007:027)
by Frank Steiner 24 Apr '07

24 Apr '07

Hi, Marcus Meissner wrote > ______________________________________________________________________________ > > SUSE Security Announcement > > Package: XFree86, Xorg > ... > SUSE LINUX 10.1: > ... > ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/xorg-x11-libs-6.9.0-50.32.… this update kills opera-9.10-3.2 (the last update for 10.1 if I'm not wrong). Opera just segfaults when starting. Reverting to xorg-x11-libs-6.9.0-50.17 makes opera run again. On x86_64, the same happens with the xorg-x11-libs-32bit.rpm. cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. * --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 2

[opensuse-security] important update ! FW: [Clamav-announce] announcing ClamAV 0.90.2
by Dörfler Andreas 13 Apr '07

13 Apr '07

dear suse and clamav users, please take notice: > **Important note**: on April 16th CHM, CAB and PDF handlers will be > disabled for 0.90 and 0.90.1 users through the dynamic engine > configuration module (DCONF). Please upgrade to 0.90.2 immediately. greetings andy > -----Original Message----- > From: clamav-announce-bounces(a)lists.clamav.net > [mailto:clamav-announce-bounces@lists.clamav.net] On Behalf > Of Luca Gibelli > Sent: Friday, April 13, 2007 3:30 AM > To: ClamAV Announce > Subject: [Clamav-announce] announcing ClamAV 0.90.2 > > > Dear ClamAV users, > > Changes in this release include some security fixes in CHM, > CAB and PDF > code and better handling of network problems in freshclam. > > Please see ChangeLog for complete list of changes. > > **Important note**: on April 16th CHM, CAB and PDF handlers will be > disabled for 0.90 and 0.90.1 users through the dynamic engine > configuration module (DCONF). Please upgrade to 0.90.2 immediately. > > -- > The ClamAV team (http://www.clamav.net/team) > > -- > Luca Gibelli (luca _at_ clamav.net) - ClamAV, a GPL > anti-virus toolkit > [Tel] +1 706 7054022 [Fax] +1 706 5345792 [IM] nervous/jabber.linux.it > PGP key id 5EFC5582 @ key server || http://www.clamav.net/gpg/luca.gpg > _______________________________________________ > http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-announce > --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

3 3

[opensuse-security] Apparent NFS related crash on SLES 10?
by Stephan Jansen 07 Apr '07

07 Apr '07

Hi, If are on the linux-poweredge mailing list then sorry for the duplicate post. I posting this to suse-security because this problem seems like an effective denial of service. We have started seeing what I think are NFS related crashes on a PowerEdge 2900. The machine ran fine during testing for about a month and a half and the first week of production. After about a week it crashed a few times, then ran fine again for about three weeks. Now it's crashing frequently. It seems to be NFS related, I'm fairly sure I triggered the crash on two or three occasions by installing a large number of RPMs from a directory NFS mounted from the server. It never logs anything to syslog, it locks up hard and does not respond to ping or the keyboard. The only "fix" is to cycle power. The only log is in the ESM log. Here's what it says each time it crashes: -> omreport system esmlog Embedded System Management (ESM) Log Health : Ok Embedded System Management Log contains... Severity : Critical Date and Time : Fri Apr 6 16:59:39 2007 Description : System Software event: run-time critical stop was asserted I've talked at length with Dell tech support but the only thing that has been resolved so far is that it does not seem to be a hardware issue. Has anyone else seen this problem? Any fixes or workarounds? Here's more information on the server: OS: SLES 10 x86_64 with all available updates installed Kernel: 2.6.16.27-0.9-smp FS type: xfs Export options: rw,sync,wdelay,insecure,subtree_check Hardware: 2 x 2.33 GHz Xeon 5140 PowerEdge 2900 RAM 4 GB This machine is, among other things, an NFS server to a group of about 100 machines, mostly SuSE/OpenSuSE 10.0, 10.1, 10.2 and a smaller number of OSX machines. The main filesystem that is exported is the users home directory which is a RAID 5 disk composed of 4 300 GB SAS disks attached to a PERC 5/i controller. -- ----- Stephan

1 0