https://bugzilla.novell.com/show_bug.cgi?id=811188 https://bugzilla.novell.com/show_bug.cgi?id=811188#c1 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO InfoProvider| |dpbasti@wp.pl OS/Version|SUSE Other |openSUSE 12.3 --- Comment #1 from Johannes Meixner 2013-04-02 12:57:52 CEST --- You wrote "I enabled the cups service in the firewall module of yast". Please describe in more detail how exactly you did it. I wonder how you did this because since a longer time (since openSUSE 11.3) the cups RPM package does no longer provide /etc/sysconfig/SuSEfirewall2.d/services/cups so that there is no longer a predefined service "cups" available in the YaST firewall module. On my openSUSE 12.3 system, there is no file /etc/sysconfig/SuSEfirewall2.d/services/cups In other words: Since a longer time we do no longer support to remove firewall protection from CUPS easily. Reason: In almost all cases (when the external zone is accessible from a non-trusted network, in particular from the Internet) it is plain wrong to remove firewall protection from CUPS in the external zone. For background information see https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings In exceptional cases if you really need CUPS to be accessible from the external zone (when your particular external zone is only accessible from trusted networks), you must do the firewall settings that are appropriate in your particular case manually. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=811188 https://bugzilla.novell.com/show_bug.cgi?id=811188#c3 --- Comment #3 from Johannes Meixner 2013-04-02 14:48:52 CEST --- See https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=811188 https://bugzilla.novell.com/show_bug.cgi?id=811188#c5 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW CC| |jsmeix@suse.com Component|Printing |YaST2 InfoProvider|dpbasti@wp.pl | AssignedTo|jsmeix@suse.com |locilka@suse.com Summary|adding cups to allowed |yast2-firewall: system |services in the firewall |unaccessible via interface |does not allow broadcasting |in internal zone QAContact|jsmeix@suse.com |jsrain@suse.com --- Comment #5 from Johannes Meixner 2013-04-05 12:31:10 CEST --- Having the interface for the trusted network in the internal zone worked all the time for me and it still works for me under openSUSE 12.3 but only if I set up SuSEfirewall2 manually and not with the YaST firewall module. When I run the YaST firewall module and therein I only set my interface "eth0" (the only existing interface except "lo") to be in the internal zone (I leave all other settings as defaults) and let the YaST firewall module start SuSEfirewall2, then I can no longer access this machine in any way via network (my ssh session on a remote host hangs and it even does no longer respond to a "ping"). In particular CUPS browsing information from remote CUPS servers cannot come in. In contrast when I start SuSEfirewall2 manually as root using # /sbin/SuSEfirewall2 start it works as it did all the time in the past. In particular I get CUPS browsing information from remote CUPS servers via "eth0" with this interface in the internal zone. Therefore the issue is likely a bug in the YaST firewall module or perhaps in a lower level YaST functionality that is reladed to starting and stopping services, compare bnc#800492 My openSUSE 12.3 system it up to date: ----------------------------------------------------------------------------- # zypper -v update Verbosity: 1 Initialising Target Checking whether to refresh metadata for openSUSE-12.3-Non-Oss Checking whether to refresh metadata for openSUSE-12.3-Oss Checking whether to refresh metadata for openSUSE-12.3-Update Checking whether to refresh metadata for openSUSE-12.3-Update-Non-Oss Loading repository data... Reading installed packages... Force resolution: No Nothing to do. ----------------------------------------------------------------------------- I re-assign it to the maintainer of the YaST firewall module for further analysis what exactly goes wrong in YaST here. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=811188 https://bugzilla.novell.com/show_bug.cgi?id=811188#c7 Lukas Ocilka changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |locilka@suse.com AssignedTo|locilka@suse.com |bnc-team-screening@forge.pr | |ovo.novell.com --- Comment #7 from Lukas Ocilka 2013-05-02 12:35:19 UTC --- Unfortunately I'm not a cups maintainer. Firewall does nothing special to cups. It allows opening ports, services, setting up broadcast, etc. But it has no built-in support for cups. If anybody, the cups maintainer has to tell which ports have to be open an in which way. Additionally SuSEfirewall2 maintainer could tell you how to do what's needed. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=811188 https://bugzilla.novell.com/show_bug.cgi?id=811188#c9 --- Comment #9 from Johannes Meixner 2013-05-02 15:04:53 CEST --- Regarding attachment#537671 Do not do such settings! Read https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=811188 https://bugzilla.novell.com/show_bug.cgi?id=811188#c13 Lukas Ocilka changed: What |Removed |Added ---------------------------------------------------------------------------- InfoProvider|locilka@suse.com |lnussel@suse.com --- Comment #13 from Lukas Ocilka 2013-06-25 09:29:29 UTC --- Although I'm a maintained of YaST Firewall (UI frontend for SuSEfirewall2), I have to admit, I don't know what you have to change in SuSEfirewall2. Maybe Ludwig could tell us more. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=811188 https://bugzilla.novell.com/show_bug.cgi?id=811188#c15 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |DUPLICATE --- Comment #15 from Johannes Meixner 2013-07-04 09:16:37 CEST --- As I wrote in comment#8 my comment#5 describes what the actual issue is as far as I reproduced it at that time. According to https://bugzilla.novell.com/show_bug.cgi?id=804894#c8 (bnc#804894 is a duplicate of bnc#807507) it seems the patch provided in bnc#807507 fixes it. I assume Ludwig Nussel can no longer reproduce it because he has the patch provided in bnc#807507 I don't think it is correct to close this bug as WONTFIX, see https://bugzilla.novell.com/page.cgi?id=fields.html#status "WONTFIX The problem described is a bug which will never be fixed." Instead I think it is a duplicate of bnc#804894 and bnc#807507. *** This bug has been marked as a duplicate of bug 804894 *** http://bugzilla.novell.com/show_bug.cgi?id=804894 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.