August 2000 - openSUSE Security - openSUSE Mailing Lists

netscape 4.74
by H. Engelmann 07 Aug '00

07 Aug '00

Hi, everybody does upgrade to netscape 4.74. I did not see any announcements on this list. Did I miss something? regards H. Engelmann -- H. Engelmann, 089-289-28836, engelmann(a)lrz.de

2 1

FYI: Mozilla Crypto FAQ
by Steven T. Hatton 07 Aug '00

07 Aug '00

This was written by the guy who sold NSS to the DOD when he worked at Netscape. He is also one of the great champions of opening Mozilla source. Steve http://www.mozilla.org/crypto-faq.html

1 0

AW: AW: [suse-security] SuSE security reputation, etc..
by OKDesign oHG Security Webmaster 07 Aug '00

07 Aug '00

> Someone might install some scripts to USER account and for example copy > all input/output to a file, including su passwords. Good idea. But how should he manage to get this script started ? And even if the script IS started and running, I should see it when doing a ps, shouldn't I ? And I always do ps axf before doing any su-like thing. Any other holes ? --- Stephan

5 4

Re: [suse-security] kdesu -c kvt
by Roman Drahtmueller 07 Aug '00

07 Aug '00

Russell, > When invoking a root console via kdesu, root's path is inherited from the > user's path. > > PATH=/usr/local/bin:/usr/bin:/usr/X11R6/bin:/bin:/usr/games/bin:/usr/games:/opt > /gnome/bin:/opt/kde/bin:. > > I believe, it is considered bad security to have . in root's path. > > Thank you > Russell You are right. But the problem here is that the environment is inherited in the first place. This is inevitable since some env vars are needed for X authentication (if you don't want to work around this problem...). It is _your_ environment that is being passed to the application you run. If you do not want "." to show up in the path, then change your path, or do sth like kdesu -c "kvt -ls" # still, it depends on where you are when you # call it. You might also want to use konsole instead of kvt (bugs...). If you want to be sure that your root-environment is sane, then use su - to get a root shell. Omitting the "-" will pass on the environment. Basically, this is the same as what kdesu does. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

Re: [suse-security] SuSE security reputation, etc..
by Volker Kuhlmann 06 Aug '00

06 Aug '00

Kurt Seifried's article http://www.securityportal.com/cover/coverstory20000724.html is extremely good. To make SuSE's security better, I would like the relevant people at SuSE to pay attention to Kurt's suggestions. These points I find particularly noteworthy (some of my own): * Organise the ftp server better. Some rpms get put up without notice. * Distinguish between security (= important) and maintanance (= I care if I need to) updates * Use the mailing lists properly. Like RH, you could mark advisories as important (RHSA) or unimportant (RHBA). Any scheme will do. Although much improved, I am still not comfortable in trusting suse-sec-announce. Sorry, but redhat-watch inspires much more confidence. The not uncommon bugginess of SuSE's alerts doesn't help. * Use long file names in all advisories and web pages to make life easier ("which version do I have / need to get?). That mentally deficient 8.3 is very annoying. I have used personnal computers of varying types since 1983, and was *never* forced to use 8.3, and now I switch to SuSE... * Checking md5 sums of updated packages is tedious. The advisory's f87a61fe... ftp://suse/.../package-version.rpm is good to feed into wget, but that lines doesn't go into md5sum. As the sum in the advisory appears to be handpasted, or how can the large number of incorrect sums be explained?, the whole procedure is probably a waste of time anyway. USE GPG-SIGNING - NOW! On the positive - I am still using SuSE :-) Volker

3 2

Help needed for configuring firewall with YAST
by Franky GOETHALS 06 Aug '00

06 Aug '00

Hello all, Since i while i've remarked the following lines in my firewall-log : Jul 18 21:40:11 penguin dhcpcd[109]: sending DHCP_REQUEST for 213.224.69.28 to 195.130.132.18 Jul 18 21:40:11 penguin kernel: Packet log: input DENY eth0 PROTO=17 195.130.132.18:67 213.224.69.28:68 L=330 S=0x00 I=60193 F=0x4000 T=252 (#127) Jul 18 21:40:11 penguin dhcpcd[109]: DHCP_ACK received from (195.130.132.18) Does anyone can help me ? I appears to be in the 'critical' messages for the firewall. I would like to allow these requests through my firewall, but i didn't succeed. I'm trying to configure it with YAST & FW_- variables in the configuration-file. Thanks in advance, Franky. -- =================================== GOETHALS Franky Driegaaienstraat 104 B-9100 SINT-NIKLAAS B E L G I E Systeemingenieur Mainframe Tel./Fax : 32 - (0)3 / 776.10.09 GSM : 32 - (0)478 / 21.40.94 franky.goethals(a)pandora.be ===================================

2 4

Re: [suse-security] How do Europeans build against BSAFE?
by Steven T. Hatton 06 Aug '00

06 Aug '00

Kurt Seifried wrote: > If you have to ask what it costs, you can't afford it. RSA is far from > checp. Depending on what you do with it it can cost a lot, especially > including it in products. I know of several companies (some pretty medium > sized to large) that would love to buy an RSA license for free products, if > you're open source it's damn unlikely (BTW when I mean a lot I'm talking > like 7 figures). > > > Steve > > -Kurt Kurt, My project uses BSAFE. Then I contract under the US DoD, so we have a few nickels throw at the project. The problem is the Bureaucracy is so messed up, they will waste a thousand man-hours to save a hundred bucks. And that is unfortunately a drastic understatement. When I need tools to do my job, I don't even bother asking procurement, it took over three yeast to get tape backup in place! NO LIE! Other distributions of Linux which go for about $200 come with some form of an RSA license. I believe at least one comes with a full developers version of BSAFE. I don't want another Linux distribution! I just want to be able to compile and use NSS and related tools. I don't want to distribute the stuff right now, and if I did, I'd work that out when it happened. First our Government says we can't export our cryptographic technology, so the rest of the world reproduces it for free, and now our Government makes it impossible to use it domestically! Hey, anybody in Germany or the UK hiring? Steve

2 4

sendmail
by Randy Suess 06 Aug '00

06 Aug '00

Is there are reason 6.4's sendmail/procmail creates the user mail files mode 600? I have a number of programs that expects it to be 640 group-id mail. I am pretty sure earlier 6.x's did it the old way.

5 6

How do Europeans build against BSAFE?
by Steven T. Hatton 06 Aug '00

06 Aug '00

Here in the states we are not leagally able to build http://www.mozilla.org/projects/security/pki/nss/buildnss.html without paying royalites to RSA. I can't seem to get RSA to take my money. In other words they don't return my calls and they don't respond to my emails. Come next month their pattem runs out and the opensource community can start distributin BSAFE emulations in the states. I'm wondering what you folks on the other side of the big pond do vis-a-vis RSA BSAFE when you want to build something like NSS. Has anybody done this? Prehaps with BSAFEeay? Steve

1 0

kdesu -c kvt
by Russell Evans 05 Aug '00

05 Aug '00

When invoking a root console via kdesu, root's path is inherited from the user's path. PATH=/usr/local/bin:/usr/bin:/usr/X11R6/bin:/bin:/usr/games/bin:/usr/games:/opt /gnome/bin:/opt/kde/bin:. I believe, it is considered bad security to have . in root's path. Thank you Russell

1 0

Re: [suse-security] SuSE security reputation, etc..
by rhoerbe＠netpromote.co.at 05 Aug '00

05 Aug '00

>% - by default, no shell user should be allowed to log in to ftp/telnet/pop >% using the same password or at all > >Here's what throws me. I understand you to say that the default should >be for a console-only system. Is that what you meant?? I also don't >know what you mean by "same password"... A very common setup for a system with remote maintenance is to use SSH for shell access. However, this is insecure, if you keep using ftp and pop for the same account with the same password. My setup is, to use separate accounts for different services. Quite inconvenient, unless you configure different password-dbs for ftp/pop/samba. Again, this is considerably more effort, and I doubt that many admins do this. Obviously, local access should not be limited. Rainer

4 3

reiserfs & quota
by Alexander Kühn 05 Aug '00

05 Aug '00

Hi folks, is there a way to enable quotas on reiserfs partitions ? When trying to mount /dev/md0 /home reiserfs usrquota 1 2 i get the bad option error, (i have a working ext2 with quota and ofcourse the /home is normal reiserfs already holding files). regards, Alexader. -- ======================================================================== # _ __ _ __http://home.htwm.de/akuehn/MPeople/MPeople.html# # / |/ /__ ____ _(_) /_ ____ _ dedicated to one of the best.. # # / / _ `/ _ `/ / / // / ' \ nagilum(a)chillout.org or +01776461165 # # /_/|_/\_,_/\_, /_/_/\_,_/_/_/_/ 68k/PPC: Amiga OS / NetBSD / Linux # # /___/ x86: Linux / FreeBSD / OpenBSD / Win 98 # ========================================================================

2 1

Re: [suse-security] SuSE security reputation, etc..
by rhoerbe＠netpromote.co.at 05 Aug '00

05 Aug '00

To add to that, it would be interesting to compare OS by "vulnerabilites by architectural flaws". At the top of my head, I know a few for NT and related products (display driver run on kernel ring, PPTP-security, ..). I assume, that MS would win this "market share execise" easily. anyway, Moody seems to be on the MS payroll. On the other side, Linux distributors could do even better. My wishlist for Suse: - configure security level (like harden_suse questions) with yast, and make it more granular. - by default, no shell user should be allowed to log in to ftp/telnet/pop using the same password or at all - have an installation option, that compares installed packages versus ftp.suse.com and lists known vulnerabilites and available fixes, and does updates on request I think, that a lot of security can be gained my making defaults more secure, or easy, selectable installation options. Few systems get the attention, that they should .. Rainer Frank Hart <frhart(a)home.nl> Sent by: hart(a)pingala.netpromote.co.at 02.08.00 20:31 To: cc: suse-security(a)suse.com Subject: Re: [suse-security] SuSE security reputation, etc.. Len Rose wrote: > http://www.abcnews.go.com/sections/tech/FredMoody/moody.html > It really sucks that SuSE wasn't even mentioned. What really sucked was that this article is a total piece of crap. Based on the number of vulnerability's mr. Moody qualified a total OS. Also he adds the vulnerabilities of every linux distro but that is nonsence, cause there's a big chance a vulnerablility found in eg RedHat also affects SuSE. -- SuSE Linux 6.4 -o) | Like the ski resort of girls looking for Kernel 2.2.16 /\ | husbands and husbands looking for girls, the on a i686 _\_v | situation is not as symmetrical as it might mailto:frhart@home.nl | seem. -- Alan McKay --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

12 13

dual boot
by ksemat＠wawa.eahd.or.ug 05 Aug '00

05 Aug '00

hi everyone, I am having a problem configuring lilo to dual boot SuSE and freebsd can anyone give me pointers. I have already done it successfully with windows and OS/2 but freebsd seems to be a problem. Or is there another boot loader I could use? Noah ksemat(a)eahd.or.ug

2 3

Firewall problem
by wil van der wee 04 Aug '00

04 Aug '00

Hi All, I' am using SuSe 6.2, and try to get firewall to work. There is a script in /sbin/init.d/firewall When I fill out FW_START etc. in /etc/rc.config I get a error when the system boots like this: --------------------------------------------------------- Starting firewall v2.2 Open SMTP access to: 192.168.1.99 Open DNS access to: 192.168.1.99 Load transparent proxy (incoming traffic) /sbin/ipchains: host/network `-j' not found Try `/sbin/ipchains -h' or '/sbin/ipchains --help' for more information. /sbin/ipchains: host/network `-j' not found Try `/sbin/ipchains -h' or '/sbin/ipchains --help' for more information. Locked UDP ports: 1:1023 Locked TCP ports: 1:1023 Filters for incoming traffic loaded Load transparent proxy (outgoing traffic) /sbin/ipchains: host/network `-j' not found Try `/sbin/ipchains -h' or '/sbin/ipchains --help' for more information. /sbin/ipchains: host/network `-j' not found Try `/sbin/ipchains -h' or '/sbin/ipchains --help' for more information. No restrictions for outbound traffic Filters for outgoing traffic loaded ---------------------------------------------------------------------- 192.168.1.99 is my local eth0 card. Can somebody help me with this. Any help suggestions welcome. BiBi Wil

1 0

Kernel version in the upcoming SuSE 7.0 release
by devel＠master.kparker.org 04 Aug '00

04 Aug '00

Hello, I just re-visited the SuSE web site and found the following (www.suse.com/products/susesoft/70news/70datapro.html) about the upcoming SuSE 7.0 release and was dismayed to find that 7.0 is to come with Kernel 2.2.14, which has almost enough holes in it to qualify it as Swiss Cheese. Why not 2.2.16, at least? (Yes, I realize 2.4.0 is still pre-release). Speaking of Kernel 2.4.0-test5, are there special SuSE patches I need to apply if I want to try it out with 6.4? Has anyone at SuSE packaged it as an RPM? Thanks in advance and best regards, Ken Parker (happy user of 6.4)

5 7

unsuscribe
by Martin Aicher 04 Aug '00

04 Aug '00

unsuscribe

2 1

Re: [suse-security] SuSE security reputation, etc..
by Simon 04 Aug '00

04 Aug '00

On Thu, 3 Aug 2000, you wrote: > One of our developers hacked autorpm to work with SuSE Linux as well. You > can get the RPM from here (within the nex few hours, mirroring to the > outside may take a while): > http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.noarch.rpm > http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.src.rpm > This package already includes a suse-update configuration. Enjoy! I checked the dependencies, and discovered that I don't have perl_net installed - nor can I find that package on the distribution CDs or on any SuSE site. Besides, I have to admit that enabling this feature on a production server seems somewhat scaring to me (especially since site-hijacking and other DNS troubles are not so uncommon in these days...). I'd probably try it for a while on a user's workstation. Greetings, Simon. ==================== Dr. Simone Grabstein listuser(a)egontek.net ====================

3 2

NFS vs. cronjobs
by Christian Mudra 04 Aug '00

04 Aug '00

Hi, I'm running kernel 2.2.16 on SuSE 6.4. As NFS-server I'm using the kernel-based nfsd. Every night at 0:00 o'clock, the cron-jobs of SuSE are running both on the nfs-clients and on the server. Every night, beginning at 0:15 a.m. I get every 15 min a mail from each client with the content (same like on console): YPBINDPROC_DOMAIN: Domain not bound I checked all the scripts that are running (/usr/lib/cron/run-crons, /usr/lib/secchk/*, /etc/cron.daily/aaa_base*),but there I see no influence to NFS. Logging in to a client takes a lot (5++ min) of time. After a short time or work (things that cause network traffic), everything is okay: 64 bytes from 131.246.*.*: icmp_seq=120 ttl=255 time=1000.802 ms 64 bytes from 131.246.*.*: icmp_seq=123 ttl=255 time=1307.996 ms 64 bytes from 131.246.*.*: icmp_seq=124 ttl=255 time=308.237 ms 64 bytes from 131.246.*.*: icmp_seq=125 ttl=255 time=2038.028 ms 64 bytes from 131.246.*.*: icmp_seq=126 ttl=255 time=1038.427 ms 64 bytes from 131.246.*.*: icmp_seq=127 ttl=255 time=38.693 ms 64 bytes from 131.246.*.*: icmp_seq=128 ttl=255 time=9317.865 ms 64 bytes from 131.246.*.*: icmp_seq=129 ttl=255 time=8318.299 ms 64 bytes from 131.246.*.*: icmp_seq=130 ttl=255 time=7318.521 ms 64 bytes from 131.246.*.*: icmp_seq=131 ttl=255 time=6318.699 ms 64 bytes from 131.246.*.*: icmp_seq=132 ttl=255 time=5318.947 ms 64 bytes from 131.246.*.*: icmp_seq=133 ttl=255 time=4319.162 ms 64 bytes from 131.246.*.*: icmp_seq=134 ttl=255 time=3319.374 ms 64 bytes from 131.246.*.*: icmp_seq=135 ttl=255 time=2319.922 ms 64 bytes from 131.246.*.*: icmp_seq=136 ttl=255 time=1320.099 ms 64 bytes from 131.246.*.*: icmp_seq=137 ttl=255 time=320.298 ms 64 bytes from 131.246.*.*: icmp_seq=138 ttl=255 time=0.270 ms 64 bytes from 131.246.*.*: icmp_seq=139 ttl=255 time=0.262 ms 64 bytes from 131.246.*.*: icmp_seq=140 ttl=255 time=0.254 ms This ping was started directly after such a login - so you see, after about 2 1/2 min of just being logged in the network is back to normal. Logging in to such a slowed down machine is only possible as root, not as user (user authentification uses NIS). But as security policy we wanted to allow root login only via su, not remote, not on console. As long as this problem exists, at least root login on console must be allowed ... Additionally sometimes there are messages like that in the syslog: Aug 4 11:44:47 mycomp kernel: nfs: task 1674 can't get a request slot Aug 4 11:44:49 mycomp kernel: nfs: task 1681 can't get a request slot Aug 4 11:44:59 mycomp kernel: nfs: server OK So, my question is: How can I avoid these nfs-problems? Has somebody also experienced problems like this? And why does that begin on every client just after the cronjobs finished? Ideas? Greetings, Christian. ---------------------------------------------------------------------------- Christian Mudra Just remember what your mother always told you: mudra(a)informatik.uni-kl.de "When you open windows you let in bugs". AG Wiehagen, Universität Kaiserslautern

2 1

MFilter Announce (was - weird seccheck-0.9-35 behaviour)
by nix＠cotse.com 04 Aug '00

04 Aug '00

OK guys, it's been over a month since I was asked to submit info about this script, but I have been a little busy, anyways, better late than never! There is now a homepage (sorta..) up at http://sourceforge.net/project/?group_id=5609 and a mailing list at mfilter-devel(a)lists.sourceforge.net Note: This program is stable and running in production at several sites, however there are several "possible" buffer overflows in the source atm. I have not had a chance to fix them since they were pointed out to me a few days ago by the programmer at the desk behind me :) Here is a bit of a description on how it works: The gateway has a deamon program running called SMTPD that accepts all incoming email, whether its from inside our network (Exchange Server) or from outside sources. The STMPD program dumps this email into a folder on the linux server called INCOMING (/usr/spool/smtpd/incoming). A different program background job SMTP-VIRUS (usr/sbin/smtp-virus) periodically checks the INCOMING folder and runs anything it finds in there through the Linux AVP Virus checker. AVP on Linux is installed in the /usr/local/avp folder. If the message is virus free, it is then moved to the SCANNED folder (/usr/spool/smtpd/scanned) The main SENDMAIL program periodically checks the SCANNED folder, works out who the messages are destined for, and sends them on to their destination. This whole process looks to take only 30 seconds or so (depending on the size of the emails). If a message in the INCOMING folder is found to be virus infected, it is instead moved to the BAD folder (/usr/spool/smtpd/bad). Anything in the BAD folder is scanned again by the program SMTP-BADMAIL (/usr/sbin/smtp-badmail) to find out exactly what it is infected with. The same program generates a warning email which goes to the original sender of the email and also gets copied to the admin account on our exchange box. The original recipient of the file is not notified. At this point, the infected email is moved to the BAD_ARCHIVE folder (/usr/spool/smtpd/bad_archive) where it stays until we delete it. The basic diagram below gives a good idea of the flow of the process. ALL EMAILS -> SMTPD -> INCOMING FOLDER -> SMTP-VIRUS (VIRUS CHECKER) -> VIRUS FREE -> SCANNED FOLDER -> DELIVERED TO RECIPIENT VIA SENDMAIL | --> INFECTED -> BAD FOLDER -> SMTP-BADMAIL sends warning emails -> BAD_ARCHIVE The SMTP-VIRUS and SMTP-BADMAIL programs are perl scripts (equivalent to a dos batch file), and these can be edited with PICO to make adjustments. If you wish to change the warning message, it can be found in the smtp-badmail file (pico /usr/sbin/smtp-badmail). AVP is set to automatically update itself every 4 hours via the CRON job /usr/local/avp/update.sh. This file connects to a local AVP FTP site and grabs any files newer than its own, so we are essentially only a few hours away from the latest update all the time. The update.sh file gets its settings from the /usr/local/avp/avp.pkg text file, which tells it what site to connect to etc. Have alot of Fun!!!!! Peter Nixon nix(a)cotse.com (Note: this is a new address) > -----Original Message----- > From: Rainer Link [mailto:link@foo.fh-furtwangen.de] > Sent: Friday, 7 July 2000 9:48 > To: Peter Nixon > Subject: Re: [suse-security] weird seccheck-0.9-35 behaviour > > > Peter Nixon wrote: > > Hi! > > Sorry, no answer to your question :-) > > > I am using seccheck-0.9-35 on SuSE 6.4 with all available > security options > > and updates. > > This machine also runs squid,sendmail,smtpd,AVP and BIND > > > 178 ? S 0:00 /bin/su - mail -c /usr/sbin/smtp-virus > > 191 ? S 0:48 \_ perl /usr/sbin/smtp-virus > > 5689 ? S 0:00 \_ sh -c /usr/local/avp/AvpLinux > > /var/spool/smtpd/incoming/smtpdvI0vSs >> > /var/tmp/smtpdvI0vSs.191/scanlog > > 5690 ? R 0:00 \_ /usr/local/avp/AvpLinux > > /var/spool/smtpd/incoming/smtpdvI0vSs > > 183 ? S 0:02 /usr/sbin/smtpfwdd -u mail -g daemon -d > > /var/spool/smtpd/scanned > > What's smtp-virus? Is it your own solutions (maybe GPL'ed)? Thanks for > your information. > (P.S. If it's GPL I would like to add it to lavp.sourceforge.net) > > best regards, > Rainer Link > -- > Rainer Link | Student of Computer Networking > > rainer(a)w3.to | University of Applied Sciences, Furtwangen, > Germany > rainer.w3.to | http://www.computer-networking.de/ >

2 1

Re: [suse-security] Problems with YaST+sendmail
by Simon 04 Aug '00

04 Aug '00

--- Christian Mudra <c_mudra(a)informatik.uni-kl.de> wrote: > It's annoying to re-install a working sendmail.cf > each time I use YaST, > especially as there a several linux machines in our > workgroup running. > > Any ideas to prevent/fix these behaviours? Try "Do not install /etc/sendmail.cf" option, in sendmail configuration under Yast. Or just change SENDMAIL_TYPE to "no" in /etc/rc.config.d/sendmail.rc.config. Greetings, Simon. =============== Dr. Simone Grabstein listuser(a)egontek.net ===============

1 0

/proc
by mgribov＠kplab.com 04 Aug '00

04 Aug '00

Hi, as one of security meausures, I learned that it is a good idea to do chmod 550 /proc/sys and chmod 550 /proc/net. First question I have, is this true? It seems right, because ordinary users cannot view network or system information, which is not a bad thing. Second question is, I implemented the above, but after a reboot permisions were back to standard ( I believe 555). How come? Thanks Max

3 4

Antwort: [suse-security] Problems with YaST+sendmail
by andreas.baetz＠herma.de 04 Aug '00

04 Aug '00

Christian Mudra wrote: > I experienced problems with YaST and sendmail. Every time I use YaST > to change the installation (Choose/Install packages), change something > and leave this submenu back to the main menu, a new sendmail.cf > is written. When I change something else with YaST, e.g. System > administration, a warning is written, that sendmail.cf was edited by hand, > and _my_ sendmail.cf is not overwritten. Did you check that SENDMAIL_TYPE="no" is set in /etc/rc.config.d/sendmail.rc.config ? Then it shouldn`t touch your sendmail configuration. Keep in mind that you have to have this file though, since it is read in /sbin/init.d/sendmail (you need at least the SENDMAIL_ARGS). Andreas ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

1 0

Problems with YaST+sendmail
by Christian Mudra 04 Aug '00

04 Aug '00

Hi, I experienced problems with YaST and sendmail. Every time I use YaST to change the installation (Choose/Install packages), change something and leave this submenu back to the main menu, a new sendmail.cf is written. When I change something else with YaST, e.g. System administration, a warning is written, that sendmail.cf was edited by hand, and _my_ sendmail.cf is not overwritten. Here in our installation it is needed not to use the MX-record for smtp, for which I don't see a way to make that known to YaST. Also another behaviour: Using an adapted /etc/mail/linux.mc for creating a sendmail.cf file I added a define(`SMTP_MAILER_FLAGS', `0') to /etc/mail/linux.mc. Compiling with m4, this line is not taken care of, I get exactly the same result with and without that define. Both with Solaris 2.5/2.7 it works and adds the 0 to the mailer flags. (e.g. Msmtp, P=[IPC], F=mDFMuX0, S=11/31, R=21, E=\r\n, L=990, ..) ^ It's annoying to re-install a working sendmail.cf each time I use YaST, especially as there a several linux machines in our workgroup running. Any ideas to prevent/fix these behaviours? Greetings, Christian. PS: I'm using YaST 1.05.2 on SuSE 6.4. ---------------------------------------------------------------------------- Christian Mudra Just remember what your mother always told you: mudra(a)informatik.uni-kl.de "When you open windows you let in bugs". AG Wiehagen, Universität Kaiserslautern

1 0

Problems with /var/log/messages
by Geert-Jan.Laat-de＠dsm-group.com 04 Aug '00

04 Aug '00

I'm having the following problem: Whenever cron gzip's my messages file, all logging to the "new" messages file is stopped, no information is entered. The only solution I found sofar is rebooting the machine, there has to be a simpler solution ! Best regards, Geert-Jan de Laat

6 6