November 2000 - openSUSE Security - openSUSE Mailing Lists

Samba problems with large files
by Stefan Suurmeijer 27 Nov '00

27 Nov '00

Hi, I'm experiencing a strange problem. I have installed SuSE 7.0 on an ASUS CuBX MB with a celeron 600, and use samba and ISC dhcpd. Everything works fine, except when I try to copy large (>100MB) files. I copied a ghost image to the SuSE box without problem (almost 500 MB). However, when I try to copy it from the SuSE box to another machine, SuSE totally freezes. Copying smaller (~10MB) files is no problem. I have all but ruled out a hardware conflict, so I'm running out of options. Has anyone on this list experienced a similar problem? TIA Stefan

2 2

FTP data can't go back through
by Olivier Hislaire 27 Nov '00

27 Nov '00

Hi - again :-) I am having trouble while connecting to ftp sites: I can connect and issue some commands, but 'dir' hangs: the firwall stops the result (data). My configuration is the following: public SuSE6.3 SuSE6.3 ftp client (192.168.32.7) ftp <---> ftp-proxy <---> firewall <---> (private server (192.168.32.193) LAN) As far as I can see, the firewall's log shows the following: input DENY eth0 proto=6 192.168.32.193:40000 192.168.32.7 (2042) L=60 S=0x08 I=42279 F=0x4000 T=64 SYN (#57) What firewall configuration directive should do it ? Any help appreciated. Olivier. ------------------------------------------------------------------------------------------------ Olivier Hislaire MSG International Email: O.Hislaire(a)msg-i.com 97 Avenue de Tervuren Phone: +32 (0)2 735.91.59 Ext. 55 1040 Brussels Fax: +32 (0)2 732.12.19 Belgium http://www.msg-i.com ------------------------------------------------------------------------------------------------

2 1

/tmp as homedirectory
by Peter Meijer 27 Nov '00

27 Nov '00

Hello all, I posted the following message on the second of October, but unfortunately got no answer. If I have missed something, I apologize. On the second of May 2000 Marc Heuse from SuSE posted an *updated* security announcement regarding the package "aaa_base": >>[...] 3. Solution 1) Update the package from our FTP server. 2) The root user will receive a email with the accounts listed which have a homedirectory in /tmp. You have to fix this by hand, because some installations might break if they rely on information saved in the (unsafe) /tmp homedirectory. The email will give more information what to do. [...]<< Of course I updated the package immediately. Unfortunately, however, I never got an eMail with information on how to do part 3.2 (I wonder if this happens only to me :-(; I do not find this problem on the list). Currently three users on my *server* system (SuSE 6.2 running httpd, ftpd, samba, and sendmail) have a homedirectory in /tmp: -- games (I haven' t installed any games...) -- wwwrun -- firewall (not installed on _this_ server...) Nobody's homedirectory is in /var/lib/nobody (nobody.nogroup). I changed that some time ago, following the instructions given in another security announcement by SuSE. My questions: What do I have to do in order to secure my system *without* breaking it up?! Should I delete the users 'games' and 'firewall'? Should I move the homedirectory of user 'wwwrun' to /var/lib/wwwrun (wwwrun.nogroup)? Thanks in advance! Kind regards, Peter -- Sent through GMX FreeMail - http://www.gmx.net

1 0

secumod
by mathias rockel 27 Nov '00

27 Nov '00

Hi! I just installed a SuSE 7.0 web server, following some of the securtiy guidelines pointed out on the SuSE site. They also recommended installing secumod, but the guide was written for SuSE 6.4 initially and I had MASSIVE probems when secumod was running, so I threw it out again. Has someone any positive experinece or is there a nice alternative to secumod ? mats

1 0

SuSE 7.0 shuts down after three beeps
by thunder7＠xs4all.nl 27 Nov '00

27 Nov '00

I recently upgraded to SuSE 7.0 (the evaluation version), and it has now done an automatich sort of shutdown every day it's been running. There are three short beeps and then the screen gets black and the 'power' light on the computer starts blinking. For all I can see the computer is dead - it doesn't react to anything short of the reset button. Now I am fairly convinced this isn't some kind of virus on my installation CD, but what else can it be? I've used a kernel (2.2.18pre23) which is a 'known-good' kernel - it didn't crash SuSE 6.2. There are no messages in /var/log/messages. The apmd daemon is not running, in fact, there's almost nothing running: UID PID PPID C STIME TTY TIME CMD root 1 0 0 06:19 ? 00:00:05 init root 2 1 0 06:19 ? 00:00:04 [kflushd] root 3 1 0 06:19 ? 00:00:00 [kupdate] root 4 1 0 06:19 ? 00:00:00 [kpiod] root 5 1 0 06:19 ? 00:00:01 [kswapd] root 151 1 0 06:32 ? 00:00:00 /sbin/kerneld root 239 1 0 06:32 ? 00:00:00 /usr/sbin/ipppd pidfile /var/run root 273 1 0 06:32 ? 00:00:00 /usr/sbin/syslogd root 277 1 0 06:32 ? 00:00:01 /usr/sbin/klogd -c 1 at 360 1 0 06:32 ? 00:00:00 /usr/sbin/atd root 375 1 0 06:32 ? 00:00:00 /usr/sbin/inetd root 384 1 0 06:32 ? 00:00:00 /usr/sbin/lpd root 430 1 0 06:32 ? 00:00:00 /usr/sbin/sshd root 439 1 0 06:32 ? 00:00:00 /usr/sbin/cron qmails 463 1 0 06:32 ? 00:00:00 qmail-send qmaill 465 463 0 06:32 ? 00:00:00 splogger qmail root 466 463 0 06:32 ? 00:00:00 qmail-lspawn ./Mailbox qmailr 467 463 0 06:32 ? 00:00:00 qmail-rspawn qmailq 468 463 0 06:32 ? 00:00:00 qmail-clean root 539 1 0 06:32 tty1 00:00:00 login -- root root 540 1 0 06:32 tty2 00:00:00 login -- root root 541 1 0 06:32 tty3 00:00:00 login -- jurriaan root 542 1 0 06:32 tty4 00:00:00 login -- jurriaan root 543 1 0 06:32 tty5 00:00:00 /sbin/mingetty tty5 root 544 1 0 06:32 tty6 00:00:00 /sbin/mingetty tty6 root 545 1 0 06:32 tty7 00:00:00 /sbin/mingetty tty7 root 546 1 0 06:32 tty8 00:00:00 /sbin/mingetty tty8 root 547 1 0 06:32 tty9 00:00:00 /sbin/mingetty tty9 root 548 1 0 06:32 tty10 00:00:00 /sbin/mingetty tty10 root 593 539 0 07:06 tty1 00:00:00 -bash root 774 540 0 07:07 tty2 00:00:00 -bash jurriaan 1653 541 0 07:08 tty3 00:00:00 -bash jurriaan 2321 542 0 07:09 tty4 00:00:00 -bash jurriaan 2766 2321 1 07:11 tty4 00:00:09 slrn --spool jurriaan 5299 1653 0 07:23 tty3 00:00:00 mutt jurriaan 5300 5299 0 07:24 tty3 00:00:00 sh /usr/local/bin/vi72 /tmp/mutt jurriaan 5350 5300 0 07:24 tty3 00:00:00 vi -s /usr/local/etc/vi_textwidt jurriaan 5351 5350 0 07:26 tty3 00:00:00 /bin/bash -c ( ps -ef) >/tmp/voj jurriaan 5352 5351 0 07:26 tty3 00:00:00 ps -ef The computer shuts down even if it is running computations, which makes no sense to me. If there is anybody here who can relate the three beeps to anything, please let me know. Searching the web or SuSE's support database didn't help. Jurriaan -- As of next week, passwords will be entered in Morse code. GNU/Linux 2.2.18pre23 SMP 2x999 bogomips load av: 0.12 0.04 0.05

1 0

harden_suse disables lpd
by Bo Jacobsen 26 Nov '00

26 Nov '00

I have a problem with harden_suse using SuSE70 that also was present in SuSE6.4: After having run harden_suse (only saying yes to question 1, 2, 4 and 7) and editing /etc/rc.config making sure that lpd would run at startup, I was no longer able to print to my remote printserver. Running undo_harden_suse did not help. The following error was found in /var/log/message: lpd: apsfilter: unable to print job .... nothing else. I have tried to invoke lpd -f with the debug option but no aparent error messages apears. !!------------------------------------------------------------- When I edit /etc/lpd.conf and changes user=lp to user=root it starts working again !!!?. !!------------------------------------------------------------- If you know what the problem is please let me know. Thanks in advance Bo Jacobsen bjc(a)image.dk

3 3

RE: [suse-security] Weird X-Authentication-Warning ???
by ralf.vroomen＠itplus.nl 26 Nov '00

26 Nov '00

>define >(`confPRIVACY_FLAGS',`authwarnings,needmailhelo,novrfy,noexpn,noetrn,noverb ')dnl > >in your linux.mc file in /etc/mail and change it to: > >"define (`confPRIVACY_FLAGS',`needmailhelo,novrfy,noexpn,noetrn,noverb')dnl" Doesn't this just disable the warnings? If so... are they safe to ignore? m>m4 linux.mc >sendmail.cf >and copy this new sendmail.cf to /etc. Now... Aaaaah.. and have my sendmail.cf screwed up! >Alternatively, change the appropriate lines in >linux.mc and run /sbin/SuSEconfig (which installs a new sendmail.cf in case >linux.mc has changed). I don't use SuSEconfig to create my sendmail configuration. I have a cf generated not by linux.mc:) Can't I change "O PrivacyOptions=authwarnings" inside sendmail.cf to "O PrivacyOptions="? Ralf.

5 5

Weird X-Authentication-Warning ???
by ralf.vroomen＠itplus.nl 26 Nov '00

26 Nov '00

Hi! A little weird problem here. I have a SuSE 7.0 box (dell.broeders.yi.org) running sendmail set up to receve incoming email for @broeders.yi.org and dump them in the corresponding local users mail boxes. So now users can pop or imap to it to get there mail. All working well, but (there's the but ;) , there is a litte error in each message receved: ## Here it begins ## Return-Path: <owner-roxiowin(a)LISTSERV.ROXIO.COM> Received: from localhost ([127.0.0.1]) by broeders.yi.org (8.10.2/8.10.2) with ESMTP id eANA09r07802 for <ervee@localhost>; Thu, 23 Nov 2000 11:00:09 +0100 ## Here is the error I don't understand ## X-Authentication-Warning: dell.broeders.yi.org: Host [127.0.0.1] claimed to be localhost ## The rest ## Received: from pop.dds.nl by localhost with POP3 (fetchmail-5.4.0) for ervee@localhost (single-drop); Thu, 23 Nov 2000 11:00:09 +0100 (CET) Received: from shaman.dds.nl (shaman.dds.nl [194.109.21.25]) by feline.dds.nl (8.10.1/8.10.1) with ESMTP id eAN98Di13751; Thu, 23 Nov 2000 10:08:13 +0100 (MET) Received: from cherry.ease.lsoft.com (cherry.ease.lsoft.com [209.119.0.109]) by shaman.dds.nl (8.9.1/8.9.1) with ESMTP id KAA27408; Thu, 23 Nov 2000 10:12:46 +0100 (MET) Received: from peach (209.119.0.4) by cherry.ease.lsoft.com (LSMTP for Digital Unix v1.1b) with SMTP id <17.001F0C68(a)cherry.ease.lsoft.com>; Thu, 23 Nov 2000 4:05:49 -0500 Received: from LISTSERV.ROXIO.COM by LISTSERV.ROXIO.COM (LISTSERV-TCP/IP release 1.8d) with spool id 190411 for ROXIOWIN(a)LISTSERV.ROXIO.COM; Thu, 23 Nov 2000 04:04:37 -0500 Approved-By: deirdre_straughan(a)ROXIO.COM Received: from 208.236.45.160 by PEACH.EASE.LSOFT.COM (SMTPL release 1.0d) with TCP; Thu, 23 Nov 2000 04:00:29 -0500 Received: from aimexc02.corp.adaptec.com ([162.62.62.40]) by redfish.adaptec.com (8.8.8+Sun/8.8.8) with ESMTP id AAA19614 for <roxiowin(a)listserv.roxio.com>; Thu, 23 Nov 2000 00:55:28 -0800 (PST) Received: from roxio.com (ws108-66.corp.adaptec.com [162.62.108.66]) by aimexc02.corp.adaptec.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2650.21) id WAY1150C; Thu, 23 Nov 2000 01:00:25 -0800 X-Mailer: Mozilla 4.76 [en]C-CCK-MCD {Sony} (Win98; U) X-Accept-Language: en MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <3A1CDCB7.DEB7DFA1(a)roxio.com> Date: Thu, 23 Nov 2000 01:00:39 -0800 Reply-To: "Deirdre' Straughan" <deirdre_straughan(a)ROXIO.COM> Sender: Roxio for Windows <ROXIOWIN(a)LISTSERV.ROXIO.COM> From: "Deirdre' Straughan" <deirdre_straughan(a)ROXIO.COM> Subject: [ROXIOWIN] The VideoCD Story: Part 1 To: ROXIOWIN(a)LISTSERV.ROXIO.COM X-UIDL: 633a48b5b1c8fc6d834b4e7c7a7038f7 ## End ## So: "X-Authentication-Warning: dell.broeders.yi.org: Host [127.0.0.1] claimed to be localhost" is the. Has this something to do with it: "X-UIDL: 633a48b5b1c8fc6d834b4e7c7a7038f7" ??? Tips are welcome :) ThanX, Ralf Vroomen I.T.Plus bv Holland

4 3

openssh rpm problems
by Norbert Preining 24 Nov '00

24 Nov '00

I just want to inform SuSE that the openssh-2.3.0p1 has some problems because it is compiled with libexecdir=/usr/lib and therefor ssh-add searches for ask-pass in /usr/lib and not in /usr/lib/ssh, where it is installed. You have to fix this with --libexecdir=%{prefix}/lib/ssh instead of --libexecdir=%{prefix}/lib Best wishes Norbert -- ciao norb +-------------------------------------------------------------------+ | Norbert Preining http://www.logic.at/people/preining | | University of Technology Vienna, Austria preining(a)logic.at | | DSA: 0x09C5B094 (RSA: 0xCF1FA165) mail subject: get [DSA|RSA]-key | +-------------------------------------------------------------------+

1 0

suse irc support channel
by vladimir m. bondarev 24 Nov '00

24 Nov '00

Hello. some time ago i'd talked with someone about suse irc support and information channel, but i've lost his email :( so i want to write here about that. i want to make suse irc channel at efnet. i will make all necessary stuff myself, but i need some help from SuSe. first of all i need programmers help to write info bot for channel. and also i need to talk with suse administrators to make some irc bots, that will host this channel, i'll write scripts for them myself and do other things, just need shell accounts to put bots there. if you are insterested, please, contact me. Friday, November 24, 2000 -- vladimir m. bondarev, icq uin: 62393277 paradox team web: http://scene.org.ru

4 6