April 2001 - openSUSE Security - openSUSE Mailing Lists

OT: amavis-perl-11 / amavisd-snapshot-20010407 released
by Rainer Link 11 Apr '01

11 Apr '01

Hi! Just as a short note: a new release of amavis-perl and a first snapshot of amavisd (amavis-perl running as daemon) are out :-) See www.amavis.org for release details and grab the source tarballs from there. If you're using SuSE 7.1 and want to play with some rpm's please have a look at ftp://ftp.suse.com/pub/people/link/amavis/SuSE/7.1/ (see INSTALL.TXT for some installation instructions). Both use the sendmail libmilter interface. As ppl keep asking me for content filtering: neither amavis-perl-11 nor amavisd-snapshot provide this - there was some discussion about it in our internal developer ML and our amavis-user ML. As I said, amavis 0.2.2 will provide some kind of content filtering. If you want to have a look at it you may grab some alpha-release at ftp://ftp.suse.com/pub/people/link/amavis/ - don't run this on a production maschine! I haven't worked on this since a month now because of some other stuff (amavis-perl/amavisd has had and still has a much higher priority). In general I recommend to use amavis-perl (or amavisd) as it's in most cases faster (esp. amavisd). *Please* send bugreports and so on regarding those rpm's directly to me. General questions about amavis should be send to amavis-user (please *not* to suse-security), see www.amavis.org for an subscription details. Thank you. Have fun :-) best regards, Rainer Link -- Rainer Link | SuSE - The Linux Experts link(a)suse.de | Developer of A Mail Virus Scanner (amavis.org) www.suse.de | Founder OpenAntiVirus Project (www.openantivirus.org)

1 0

kernel upgrade and traffix shaper
by stephane parenton 11 Apr '01

11 Apr '01

hi everyone, I was lurking for a short while, and I have a problem... I read more often that older kernels are to be upgraded for security reasons.... I'm allright with that :)) I downloaded the 2.4 kernel k_deflt_24-2.4.2-4.i386.rpm from the suse ftp. the box I'll upgrade the kernel is off line, it is supposed to replace an older box... so I don't have problem with breaking anything or stopping this and this...). first of all, i have an error message, but I will try to download the rpm again before to say anything... i just have a message "error: k_def...rpm cannot be installed"... the box is firewall/nat/dns, and I wanted to shape the traffic so our users won't down our bw... but as I'm not very easy (not easy at all...to be frank) at writing ipchains, I was wondering what problem i could face with new kernels... what would be the impacts, and if there were docs, or even updated howtos that dealt with this shaping/ipchains problems Regards stephane

1 0

ICQ over Linux firewall with ipchains
by Karlheinz Blank 11 Apr '01

11 Apr '01

Hello, We have set up a Linux firewall with kernel 2.2.16 and ipchains. While everthing else works fine, we have problems to establish a client-client connection between iqc2k clients (i.e. for chat requests). Is there a known solution for this? We already looked at the icq module for ipchains, but that does not work for icq2k. Setting up socks instead of ipchains is also not an option in our opinion. Any help is very much appreciated!!! Thanx in advance, Charlie & Dirk

3 2

unable to remove bind
by E-Lists 10 Apr '01

10 Apr '01

hello! I'm having this problem, i can´t remove bind (named) from my linux box, the massage says that i can't do an unlink of it. I'm working as superuser. Can anyone help me ?

2 1

SuSE Security Announcement: vim/gvim (SuSE-SA:2001:12)
by Thomas Biege 10 Apr '01

10 Apr '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: vim/gvim Announcement-ID: SuSE-SA:2001:12 Date: Tuesday, April 10th, 2001 15.23 MEST Affected SuSE versions: 6.1, 6.2, 6.3, 6.4, 7.0, 7.1 Vulnerability Type: local privilege escalation Severity (1-10): 5 SuSE default package: yes Other affected systems: all system using vim/gvim Content of this advisory: 1) security vulnerability resolved: vim/gvim problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The text editor vim, Vi IMproved, was found vulnerable to two security bugs. 1.) a tmp race condition 2.) vim commands in regular files will be executed if the status line of vim is enabled in vimrc Both vulnerabilities could be used to gain unauthorized access to more privileges. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. vim: ---- i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/a1/vim-5.7-71.i386.rpm db368baa134c23b3578c8022a66d2703 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/vim-5.7-71.src.rpm 00cf66142e477e24824410c8bf9e8702 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/vim-5.7-73.i386.rpm 3a35734d8737c4f1e97ca9a6c1f68073 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/vim-5.7-73.src.rpm 6275c8d938a7254e648ba33765613573 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/vim-5.7-72.i386.rpm 7db6e43273fcfccf0f019246ba43fd05 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/vim-5.7-72.src.rpm f2d7177a61b1794068412ea687b9ecf6 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/vim-5.7-72.i386.rpm c12a03ff18235ea3421b18c48d6448af source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/vim-5.7-72.src.rpm b6e46176215691fc398fc6184e437a36 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/vim-5.7-71.i386.rpm a9f2154d991f9eb848dff3ffa1dcf430 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/vim-5.7-71.src.rpm 8e554dbfe786562204039358df810984 SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/vim-5.7-72.i386.rpm fcef6ade53f01ffe4cd8a7b8c033e176 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/vim-5.7-72.src.rpm e3d554b1354208ca6175c4757bab0373 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/a1/vim-5.7-54.sparc.rpm 6746fc4eafc91ba5fa6d6377f22efdbd source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/vim-5.7-54.src.rpm de427c49af200e5fefa62a39959eaaaf SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/vim-5.7-54.sparc.rpm 7648859cc6a584ce1a2715cf7bc34bdc source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/vim-5.7-54.src.rpm 934385ba01d59fc7bdd1bbaeca0cf260 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/a1/vim-5.7-57.alpha.rpm ebe9dfc83dd1294b83d6b3aaad92fca0 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/vim-5.7-57.src.rpm 038ab54d8a08f96b61118373f5e00948 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/vim-5.7-57.alpha.rpm 24d5f1365522d267650be44f80ab0b52 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/vim-5.7-57.src.rpm 0a7a5bbde8e645254f4a5bd6cd402943 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/vim-5.7-57.alpha.rpm b496518ea1640852e17ddb1274759fc4 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/vim-5.7-57.src.rpm 1760adfac8e70bff334d74330acbefed SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/vim-5.7-57.alpha.rpm dc633df2ac8fafa41c76d5c0216ed149 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/vim-5.7-57.src.rpm 610088cca725fec62a4e7d6f1b030af1 PPC PowerPC Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/vim-5.7-20.ppc.rpm 0b9ecb77901b15a90bf25623701d834b source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/vim-5.7-20.src.rpm 3224f60fa80f27a9fb249a69c0ceaf01 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/vim-5.7-19.ppc.rpm 2044541d409bd756a166a75515214ffa source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/vim-5.7-19.src.rpm cac70ab3c2dee163d490bd85126f70aa gvim: ----- i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/xap2/gvim-5.7-79.i386.rpm 066d163c43a6bb58f7a4a3770f179770 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/gvim-5.7-79.src.rpm e6e92c8c4de39bd3a5899a55d6003d82 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/xap1/gvim-5.7-79.i386.rpm 16973a740f4a1fc2f2a189f036a10fe9 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/gvim-5.7-79.src.rpm fecbd910f57b351e992f7b7015e3149b SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/xap1/gvim-5.7-78.i386.rpm 1700470566ac4fb2e5588771f07638ed source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/gvim-5.7-78.src.rpm 43a49e33acb8b9f017e6e5846ba636df SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/xap1/gvim-5.7-78.i386.rpm db2abf1a9414b36466eb3d1186df5a7e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/gvim-5.7-78.src.rpm 0b0b50b4987d594ee48a146e939f7152 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/xap1/gvim-5.7-77.i386.rpm 125171df7f45c80c10ea0fd52f944a6a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/gvim-5.7-77.src.rpm 634e7b355274aed0af0fd7ac83218d78 SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/xap1/gvim-5.7-78.i386.rpm 1d18996bf9666269db7893ae340e5642 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/gvim-5.7-78.src.rpm 9279a59d6eb1942186e1233c6f0ebcf1 Sparc Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/xap1/gvim-5.7-59.sparc.rpm d415a24027510882b68d4ddcf1970ab4 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/gvim-5.7-59.src.rpm 57bfa58f0f7c46354edc78f0fc694d43 AXP Alpha Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/xap1/gvim-5.7-57.alpha.rpm 4cd25502d4ac5067fc64cd917ebd9018 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/gvim-5.7-57.src.rpm 347a84634805a6efa1ebf76df2a8ddb5 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/xap1/gvim-5.7-57.alpha.rpm 5808f168b8632c85518d61ecec33e3d1 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/gvim-5.7-57.src.rpm 9402b1f0440b71a6aa0c1a60748dd26d SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/xap1/gvim-5.7-57.alpha.rpm b74d1cb6f7200d0bcf6ddbe1310e28c7 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/gvim-5.7-57.src.rpm 599e9ed0a326a9b86a6584f0a24ae4ad PPC PowerPC Paltform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/xap1/gvim-5.7-58.ppc.rpm 27e579ff062662425a3581da6d08bce9 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/gvim-5.7-58.src.rpm 42a9a5b423848bbe381251c15a095a65 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/xap1/gvim-5.7-57.ppc.rpm 07b386f3dbaca5c9b3f8c440ba59c782 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/gvim-5.7-57.src.rpm 4ddef3c55da33c3b548dd055d3d9b75b ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - We are in the process of preparing update packages for the man package which has been found vulnerable to a commandline format string bug. The man command is installed suid man on SuSE systems. When exploited, the bug can be used to install a different man binary to introduce a trojan into the system. As an interim workaround, we recommend to `chmod -s /usr/bin/man´ and ignore the warnings and errors when viewing manpages. - A bufferoverflow in sudo was discovered and fixed RPMs will be available as soon as possible. A exploit was not made public until now. - NEdit a GUI-style text editor needs an update due to a tmp race condition. The source code is currently being reviewed and new RPMs will be available within the next days. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOtMMyXey5gA9JdPZAQFnUwgAmiUtFvm1KydQIAQZKbQfSDdCL+gcpdJs 5NLVWTNGGL/pxP7y1l+7/kg107TrO7QKzfzfm/tKODu7m4jAvao8QMEnXP3GIzK5 jPSK7sckztfIsp7Rgom/yjgEZk2UrKbZadr5ASnen/QGuppsUL7qL8QvcCie2Ypv NYAIC44gdJBrZRC7joNAtOLoSOfNIR6Hj3wkbmKpWVKANCZPnLwLpXn/4rd9Xorz S0FKR+FzsigN7zHkeIzeqezYBTsBfBSsRomHpkiiPsGFKBYDDc6nWsPTLlOWinww Pj5VrcQ2sqZKW5RF4ET+w3v2GjGKRP/vcQMbP9qrIy8VNl9/MztskA== =C7Jm -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

2 1

portsentry.ignore syntax question
by jan meyer 10 Apr '01

10 Apr '01

Hi, I ran into trouble with the syntax of the "portsentry.ignore" file. It must be possible to put ip-ranges (e.g. 192.168.0.0/16 or 192.168.) in there but it didn't work out...? It only works with single IP entries like: 192.168.0.1 192.168.0.2 ... does somebody have a hint ? thanks jan meyer

2 1

making a tcp connection takes a long time
by Dirk Festerling 10 Apr '01

10 Apr '01

Hi all, we have a 192.168.0/24- and a 192.168.3/24-subnet here. They are linked to each other with two ethernet-routers, between these routers there is another network 192.168.2/24. Okay, the net between the routers doesn't have to be that big at all but it made setting up the routers easier. When we do a ssh-, telnet-, ftp-, ldap- or anything except a smb- or a http- connection between these subnets there is almost always a enormous delay before the connection is established (one minute or more). It takes no matter if a hostname or a IP-address ist used. But ICMP-Pakets just go fine. I think only TCP-pakets are affected and I'm not really sure, but this phenomom seems to happen only when connecting to SuSE-hosts (Most of our hosts are SuSE based but I set up some workstations with a floppy-distribution on boths subnets and connecting to them was just fine everytime I tried ist, doing ssh to the routers is also fine). Are there any parameters to set to make this configuration work? Disable Proctection for IP-Spoofing maybe? At the end of this mail I put the routing tables of the routers and the output of some traceroutes from one subnet to the other. thank you for having a look at this! Dirk Festerling - Bereich IT - Hotset Heizpatronen und Zubehör GmbH, Wefelshohler Str. 48, 58511 Lüdenscheid Tel: +49 2351 4302-601 Fax: +49 2351 4302-611 eMail: DFesterling(a)hotset.de ------------------------------------------ ping and traceroute do fine: 192.168.0.23# traceroute -n 192.168.3.2 traceroute to 192.168.3.2 (192.168.3.2), 30 hops max, 40 byte packets 1 192.168.0.158 1 ms 1 ms 0 ms 2 192.168.2.1 1 ms 1 ms 1 ms 3 192.168.3.2 2 ms 1 ms 1 ms 192.168.3.2# traceroute -n 192.168.0.23 traceroute to 192.168.0.23 (192.168.0.23), 30 hops max, 40 byte packets 1 192.168.3.1 1 ms 1 ms 1 ms 2 192.168.2.2 1 ms 1 ms 1 ms 3 192.168.0.23 2 ms 2 ms 2 ms the routing tables on the routers show up like this: 192.168.0.158# route -n Kernel routing table Destination Gateway Genmask Flags MSS Window Use Iface 192.168.3.0 192.168.2.1 255.255.255.0 UG 0 0 0 eth1 192.168.2.0 * 255.255.255.0 U 0 0 0 eth1 192.168.0.0 * 255.255.255.0 U 0 0 0 eth0 127.0.0.0 * 255.0.0.0 U 0 0 0 lo 192.168.3.1# route -n Destination Gateway Genmask Flags MSS Window Use Iface 192.168.3.0 * 255.255.255.0 U 0 0 0 eth1 192.168.2.0 * 255.255.255.0 U 0 0 0 eth0 192.168.0.0 192.168.2.2 255.255.255.0 UG 0 0 0 eth0 127.0.0.0 * 255.0.0.0 U 0 0 0 lo

2 2

md5 & su problem
by Nikolai Dahlem 10 Apr '01

10 Apr '01

Hi, I changed authentification on my 7.1 to md5, but now su is broken. I added md5 to /etc/pam.d/su, but I doesn't work. any ideas ? regards Nikolai Dahlem

2 1

Modify "login welcomes" in telnet, ssh, pop...
by Ramon Acedo 10 Apr '01

10 Apr '01

I'd like to know where are the files containing the message that you see when you telnet a machine, for example: the "Welcome to SuSe Linux 6.4" when you telnet the machine, the same for the ssh and the same for the pop, because when you telnet the pop port it shows you the version. I'd like to hide the versions of de deamons at my servers from the outside. Thanks!

3 2

Timeout waiting for input from host1.SUSE.com
by S.T.Ryder 10 Apr '01

10 Apr '01

Hi list, I keep getting this message in my mail log: "timeout waiting for input from host1.SUSE.com" and I have not got mail from the list all day. Anyone got any clues?? Thanks, S.T.Ryder mailto:stryder@facestech.com +-------------------------------+-------------------------------------+

2 2

Re: [suse-security] Firewall
by mgchw＠t-online.de 10 Apr '01

10 Apr '01

Hi! maybe u'd like to have a look at: http://www.linuxdoc.org/HOWTO/IPCHAINS-HOWTO.html bye chris

1 0

FTP daemons
by Morsal Roudbay 09 Apr '01

09 Apr '01

Which FTP daemon for Linux is currently the one with least security holes? Morsal

16 29

SuSE Security Announcement: xntp (SuSE-SA:2001:10)
by Roman Drahtmueller 09 Apr '01

09 Apr '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: xntp Announcement-ID: SuSE-SA:2001:10 Date: Monday, April 9th 22:30 MEST Affected SuSE versions: (6.0, 6.1, 6.2), 6.3, 6.4, 7.0, 7.1 Vulnerability Type: remote root compromise Severity (1-10): 8 SuSE default package: no Other affected systems: systems using xntp in newer versions Content of this advisory: 1) security vulnerability resolved: xntp problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information xntp is the network time protocol package widely used with many unix and linux systems for system time synchronization over a network. An exploit published by Przemyslaw Frasunek demonstrates a buffer overflow in the control request parsing code. The exploit allows a remote attacker to execute arbitrary commands as root. All versions as shipped with SuSE Linux are affected by the buffer overflow problem. A temporary workaround is to kill the daemon and to set the variable START_XNTPD in the file /etc/rc.config to "no" so that the daemon will not be started again upon reboot of the system. Correct the system time manually if necessary or adjust the time by running ntpdate from a cron job on a regular basis. We believe that this problem is generally underestimated since the xntpd daemon tends to get forgotten over the years of a system's life- time once installed and configured. The xntpd daemon is not started by default in SuSE Linux distributions. We strongly recommend to immediately update the xntp package on each system where the daemon is installed, configured and running. Note: The xntp update packages for most distributions have been available for download since Friday last week. The packages for all 6.4 and 7.0 version distributions had to be rebuilt due to a specfile bug that did not show up earlier and that caused a delay in building packages. This bug causes the rpm subsystem to complain about the release number of the package. Now that this bug is corrected, you might find yourself having installed a package where there is a newer version of the package on the ftp server. However, regardless of the package release number, all published packages fix the currently known security problems in the xntpd network time daemon. Note: The source rpm of xntp in newer distributions generates two packages: xntp.rpm and xntpdoc.rpm. It is not necessary to update the xntpdoc package which is why we do not provide the update packages on our ftp server. The xntpdoc package only contains the documentation for the xntp package and did not change in this updated package. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. SPECIAL INSTALL INSTRUCTIONS: ============================== The xntpd daemon must be restarted for the new package to become active after the installation of the update rpm. You can do this by running the command kill -15 `pidof xntpd` as root. After performing the upgrade using the rpm command above, you can restart the xntpd: rcxntpd start You should now see the new daemon synchronizing in your syslogs, depending on where you configured the daemon to write its logs to. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/xntp-4.0.99f-34.i386.rpm 9e39ca8f7b01fef22766463b8295e25d source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/xntp-4.0.99f-34.src.rpm dfa51b46c92b917353f52e5d83863478 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/xntp-4.0.99f-37.i386.rpm 4293ad8a3e084ec5d773bbcab8380c08 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/xntp-4.0.99f-37.src.rpm 745b894dcb6a97caa36f97858a51e279 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/xntp-4.0.99f-38.i386.rpm 8001ac19d0ee812be82b6b066b4313d5 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/xntp-4.0.99f-38.src.rpm 7d56618cba3d768aa53246f39158987d SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/xntp-4.0.98d-1.i386.rpm 2f5d7b43b167c6acf13f68b13b1b7989 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/xntp-4.0.98d-1.src.rpm 11182e5e8c3769e6f9498ade9fcbe1fc SuSE-6.2 (unsupported platform) ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/xntp-4.0.93a-18.i386.rpm 5b55d179e3d4a0c57513bed03013c1a9 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/xntp-4.0.93a-18.src.rpm dbb7c833ddc25b0bde406b4319d4106f SuSE-6.1 (unsupported platform) ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/xntp-4.0.92c-1.i386.rpm baa93b55a4eaa486968fa6285f04c865 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/xntp-4.0.92c-1.src.rpm 06f0174e8934e3ce6f419284564a7c91 Sparc Platform: SuSE-7.1 The xntp packages for the SuSE-7.1 sparc distribution are currently pending for being built. They will be available on the ftp server as soon as they are built. The packages are gpg-signed using the key <build(a)suse.de> that should have been installed on your system upon system installation/upgrade. Use the command `rpm --checksig xntp.rpm´ to verify this signature once the packages are available for download. In the meanwhile, please use the temporary workaround as described above. SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/xntp-4.0.99f-19.sparc.rpm bea9ea6a88ae68f27962d1b9ad866eac source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/xntp-4.0.99f-19.src.rpm 83243db2982126e1a6ba371ef6dcf59b AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/xntp-4.0.99f-22.alpha.rpm e410a96c44f12ba3d51a4f1f3e056fcd source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/xntp-4.0.99f-22.src.rpm 61ed8e66753868735cd14e94cb295718 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/xntp-4.0.99f-22.alpha.rpm 9460bd3eaf5500c0184d9394b8b86627 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/xntp-4.0.99f-22.src.rpm 5c62ef99f064b687047087562cfe54ca SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/xntp-4.0.98d-1.alpha.rpm ad8c8494f0aaa06a1690e4edcaa43904 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/xntp-4.0.98d-1.src.rpm 743fe2aba27f1801ac5b14cff2f2edb6 SuSE-6.1 (unsupported platform) ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/xntp-4.0.92c-40.alpha.rpm d400eeecb9bd0b4347f3fe58f7f90fee source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/xntp-4.0.92c-40.src.rpm e2d01c31542ebbf8c740b820a6372ad1 PPC Power PC Platform: SuSE-7.1 The xntp packages for the SuSE-7.1 ppc distribution are currently pending for being built. They will be available on the ftp server as soon as they are built. The packages are gpg-signed using the key <build(a)suse.de> that should have been installed on your system upon system installation/upgrade. Use the command `rpm --checksig xntp.rpm´ to verify this signature once the packages are available for download. In the meanwhile, please use the temporary workaround as described above. SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/xntp-4.0.99f-21.ppc.rpm 2d82e8f63df84cb409df7659437c1177 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/xntp-4.0.99f-21.src.rpm a0bce6c36cf30da1aa587e03103a01f6 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/xntp-4.0.99f-21.ppc.rpm fe9082268bdf53dddcaad075284f899b source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/xntp-4.0.99f-21.src.rpm 1940b97593e3e134487d294a721e350d ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - kernel Please expect security updates of the Linux kernel soon. To resolve all currently known security problems in the Linux kernel, update the kernel manually to version 2.2.19 or wait until the SuSE update rpm packages for the supported distributions 6.3, 6.4, 7.0 and 7.1 are ready to be used and available for download. - more updates In addition to the kernel update, please expect more packages to see security updates. Currently, this involves vim, mc and sudo. - bind8 The update packages for the 7.0 sparc distribution is available. ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/bind8-8.2.3-39.sparc.rpm c7e2a95bd4b90d03207ffc3a9880c36c source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/bind8-8.2.3-39.src.rpm 5d4d4b608f2a8a3e61f7dc6917254f4f The SuSE-7.1 sparc distribution was published after the bugs in bind8 were corrected. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOtIdLXey5gA9JdPZAQGX0Af/RbqT5xox/JWc6gz7QGxA/TCKrLvk3rO3 RBesK0QJ/GqEWZh3CI81CyXCHZiyOkKzmUo5+BhX5NU4OnmuvVokofTk/cAQxh1M 6HzcUySvNrru79VwSuFE1nFGuyzWSDkKAAgD2/mP0fSporpinJTeVJm/JkXH3jau sOq+eIzhi7grtnVgbIueGR8mGrAg8COLlCx7GjYLd+VQxeS+eOtT16sLY4gMDV43 RDzpRA5dWFh48KGkncA5/0Cuvs46LTmBkVDgyflgyG1h+dmrSlfXSvoLyo08lupy ekFi4zg2H91Bb7SX0FFs456R42S02arJyld2/xm8IR9fkR18Ve12gg== =6ds6 -----END PGP SIGNATURE-----

1 0

DENY or REJECT port 113 request
by Togan Muftuoglu 09 Apr '01

09 Apr '01

Hi everyone, A few days ago I had asked why I had su much scans for port 113 well I kind of find the answer as this happens more when I send emails. I have found the following information as it also slows smtp service. The suggesstion is as follows To solve this problem: 1)reconfigure the e-mail server to stop querying identd info 2)reconfigure the firewall to RST all those connections 3)reconfigure the firewall to allow this protocol, but this would be a BAD IDEA because identd/AUTH reveals a HUGE amount of information about your UNIX machines. Now I do not want to do option 1 since I don't think I am ready to play with sendmail.cf. I do not want to do option three since it is written in captial letters. So I am only left with option 2. If possible to do so; how can I can make it just to accept for SMTP ident requsst but deny or reject (whichever is recommended)for all others ? If not possible then DENY or REJECT which option would be better to increase performance. #IDENTD $IPCHAINS -A input -p tcp -s $REMOTENET -d $OUTERNET 113 -j DENY -l $IPCHAINS -A input -p udp -s $REMOTENET -d $OUTERNET 113 -j DENY -l TIA -- Togan Muftuoglu

2 1

Firewall
by Maximiliano A. Benitez 09 Apr '01

09 Apr '01

Where i can help about setup Firewall, I can`t find help anywhere in the net

1 0

FireWall... and InternalNetwork
by mash＠myfuckingnet.com 09 Apr '01

09 Apr '01

Hello.... I would like to know better what my FireWall logs are telling me... Where can i read what PROTO=6 or PROTO=17 mean? Also, I need to put some better rules... I (in theory DENY all packets comming from DEV_WORLD) have some log inputs with PROTO=6 and PROTO=17 comming from that device... on my internal network... i started with 1:65535 on TCP and UDP.... :-D jeje,,, i know i'm kind of crazy but.... in theory.... i will not accept anything from Internet.... just from my internal network.... As you can see... i need to read more... Can someone guide me a bit on what might be happening...??? Thanks... Tomás

3 2

I need help about setup firewall
by Maximiliano A. Benitez 09 Apr '01

09 Apr '01

I Have Linux Suse 7.1 Kernel 2.2.16 and i help about this how setup my Wan (Internet) and my LAN (Local Network) In my firewall. In the ethernet eth1 i have WAN in the eth0 LAN I need the firewall in the wan, because my server mail and web in the wan. Sorry about my english

3 2

Winsock Error 10054, UDP, ICMP
by Sven Westenberg 09 Apr '01

09 Apr '01

Hi, our LAN (NT4 SP6a clients) is connected by a linux (SuSE 7.0) firewall (SuSEFirewall 2.6) and proxy (Squid 2.3.3) to the internet. We have a mail server (on an NT machine), which kicks the mails with the ETRN command from our ISP. After connecting to the ISPs mail server the connection is reset by peer (winsock error 10054). Without the firewall, everything works fine! This problem seems to occur, because our mail server sends UDP packages to the ISPs mail server. These packages are blocked by the firewall. Then, the firewall sends back ICMP port unreachable packets, which reset the connection. In the firewall logs, I can not determine any denied packages?! My questions: 1. What/Why UDP packages/ports? 2. Does every mail server use UDP packages in order to kick mails? 3. Other error? Because nothing is logged. Thanks CU Sven

1 0

Winsock Error 10054, UDP, ICMP
by Sven Westenberg 09 Apr '01

09 Apr '01

Hi, our LAN (NT4 SP6a clients) is connected by a linux (SuSE 7.0) firewall (SuSEFirewall 2.6) and proxy (Squid 2.3.3) to the internet. We have a mail server (on an NT machine), which kicks the mails with the ETRN command from our ISP. After connecting to the ISPs mail server the connection is reset by peer (winsock error 10054). Without the firewall, everything works fine! This problem seems to occur, because our mail server sends UDP packages to the ISPs mail server. These packages are blocked by the firewall. Then, the firewall sends back ICMP port unreachable packets, which reset the connection. In the firewall logs, I can not determine any denied packages?! My questions: 1. What/Why UDP packages/ports? 2. Does every mail server use UDP packages in order to kick mails? 3. Other error? Because nothing is logged. Thanks CU Sven

1 0

Port-Scans(english now!)
by Dominic Burger 09 Apr '01

09 Apr '01

Hello List, first of all sorry for posting in german, I totally forgot that this list is in englisch. Because I've read several times in this list that there're port scans on many machines when a new bug in known, I want to close on my LinuxBox(SuSE 6.4, Server for a small LAN, Gateway for Internet) using ipchains; I also want to close those ports which are used by BO2K, NetBUS,... Where can I find a list which ports are use by BO2K,... and where a list which bugs "open" which ports ?(I've already checked /etc/services and /etc/protocols but there're always new bugs and BO2k-like porgrams.) Thanks for your help Dominic Burger

3 2

suse firewall
by Franz Pfisterer 09 Apr '01

09 Apr '01

Hi, I'm using the suse firewal 2.1-5 on SuSE 6.4, Kernel 2.2.16 I have disabled all incoming packets except DNS, xntp. Watching the firewal-log, there are a lot of DENYs the whole day. But since a few days sometimes packets are accepted from ip-addresses I don't know, as shown below. Apr 8 23:41:09 linux3 kernel: Packet log: input ACCEPT ippp1 PROTO=1 62.224.186.168:8 217.2.57.22:0 L=36 S=0x00 I=60136 F=0x0000 T=123 (#20) What does this say? Is it needed to change some firewall rules? Thanks in advance, Franz

2 1

[suse-security] pgp 6.5.8-problem
by da_bug 07 Apr '01

07 Apr '01

Hi! I don't know if this is the right place to ask, but pgp is security related so I will give it at try. ;-) I wanted to compile the sourcecode of pgp 6.5.8 from http://www.pgpi.org/products/pgp/versions/freeware/unix/6.5.8/ - but it failed with this error: /usr/i486-suse-linux/bin/ld: cannot find -lPGPui collect2: ld returned 1 exit status make: *** [pgp] Error 1 (system SuSE 7.1, Kernel 2.4.2) The same error also appears in some newsgroups but I didn't found any solution for it... -- So if any member of this list successfully compiled pgp 6.5.8 for Linux I would like to know about it. -- Bye.

3 3

ipchains Regel will nicht
by f.dittberner＠molnet.de 07 Apr '01

07 Apr '01

Hi Liste, ich hab ein Problem mit ipchains, ich möchte den Port 65535 freigeben, weil ich habe hier meine Firewall, diese soll Zugriff auf einen NFS-Server haben, das mounten und so klappt, die Regeln funktionieren alle. Nur wenn dann eine Datei kopieren will bleibt sie hängen. Die Regel: /sbin/ipchains -A output -j ACCEPT -i eth0 -p tcp --sport 65535 /sbin/ipchains -A input -j ACCEPT -i eth0 -p tcp --sport 65535 Ergebniss... Packet log: output DENY eth0 PROTO=17 192.168.111.254:65535 192.168.111.2:6553 L=1304 S=0x00 I=6778 F=0x0172 T=64 (#40) Frank Dittberner

3 2

iptables
by Ralf Freisinger 07 Apr '01

07 Apr '01

Hello All, perhaps can someone tell me the rules to forward requests to an official ip, set up as a virtual net dev on a firewall (eth0:1) to an inoff. adress behind the firewall (DMZ) port 80 (www-server)? Thanks in advance Ralf

2 1

being scanned for port 113
by Togan Muftuoglu 07 Apr '01

07 Apr '01

Hi everyone, Since the 6th of april I am getting quite a lot of scans to port 113 from various ports 4331 4629 46409 46413 46422 and 1085 . I was able to find 1085 which is webobjects but the others I could not find any info. Can some one guide me what are these for or are they trojan ports TIA Apr 6 22:41:16 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4331 212.156.196.226:113 L=60 S=0x00 I=21011 F=0x4000 T=59 SYN (#22) Apr 6 22:41:19 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4331 212.156.196.226:113 L=60 S=0x00 I=21030 F=0x4000 T=59 SYN (#22) Apr 6 22:41:25 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4331 212.156.196.226:113 L=60 S=0x00 I=21034 F=0x4000 T=59 SYN (#22) Apr 6 22:41:37 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4331 212.156.196.226:113 L=60 S=0x00 I=21039 F=0x4000 T=59 SYN (#22) Apr 6 23:11:16 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4629 212.156.196.226:113 L=60 S=0x00 I=40551 F=0x4000 T=59 SYN (#22) Apr 6 23:11:19 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4629 212.156.196.226:113 L=60 S=0x00 I=40585 F=0x4000 T=59 SYN (#22) Apr 6 23:11:25 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4629 212.156.196.226:113 L=60 S=0x00 I=40647 F=0x4000 T=59 SYN (#22) Apr 6 23:11:37 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4629 212.156.196.226:113 L=60 S=0x00 I=40736 F=0x4000 T=59 SYN (#22) Apr 6 23:13:01 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 210.93.217.129:3895 212.156.196.226:111 L=60 S=0x00 I=15280 F=0x4000 T=39 SYN (#38) Apr 6 23:13:04 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 210.93.217.129:3895 212.156.196.226:111 L=60 S=0x00 I=16390 F=0x4000 T=39 SYN (#38) Apr 6 23:30:08 gardiyan kernel: Packet log: input DENY eth1 PROTO=17 212.216.224.236:137 212.156.196.226:137 L=78 S=0x00 I=57407 F=0x0000 T=103 (#38) Apr 6 23:30:10 gardiyan kernel: Packet log: input DENY eth1 PROTO=17 212.216.224.236:137 212.156.196.226:137 L=78 S=0x00 I=57663 F=0x0000 T=103 (#38) Apr 6 23:30:11 gardiyan kernel: Packet log: input DENY eth1 PROTO=17 212.216.224.236:137 212.156.196.226:137 L=78 S=0x00 I=57919 F=0x0000 T=103 (#38) Apr 6 23:30:31 gardiyan kernel: Packet log: input DENY eth1 PROTO=17 212.216.224.236:137 212.156.196.226:137 L=78 S=0x00 I=61247 F=0x0000 T=103 (#38) Apr 6 23:30:32 gardiyan kernel: Packet log: input DENY eth1 PROTO=17 212.216.224.236:137 212.156.196.226:137 L=78 S=0x00 I=61503 F=0x0000 T=103 (#38) Apr 6 23:30:34 gardiyan kernel: Packet log: input DENY eth1 PROTO=17 212.216.224.236:137 212.156.196.226:137 L=78 S=0x00 I=61759 F=0x0000 T=103 (#38) Apr 6 23:41:54 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 211.92.50.170:21 212.156.196.226:21 L=40 S=0x00 I=39426 F=0x0000 T=13 SYN (#38) Apr 7 00:15:16 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 193.140.140.104:46409 212.156.196.226:113 L=60 S=0x00 I=0 F=0x4000 T=59 SYN (#22) Apr 7 00:15:25 gardiyan last message repeated 2 times Apr 7 00:17:17 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 193.140.140.104:46413 212.156.196.226:113 L=60 S=0x00 I=0 F=0x4000 T=59 SYN (#22) Apr 7 00:17:25 gardiyan last message repeated 2 times Apr 7 00:18:47 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 193.140.140.104:46422 212.156.196.226:113 L=60 S=0x00 I=0 F=0x4000 T=59 SYN (#22) Apr 7 00:18:56 gardiyan last message repeated 2 times Apr 7 00:26:16 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:1085 212.156.196.226:113 L=60 S=0x00 I=17580 F=0x4000 T=58 SYN (#22) Apr 7 00:26:19 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:1085 212.156.196.226:113 L=60 S=0x00 I=17612 F=0x4000 T=58 SYN (#22) Apr 7 00:26:25 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:1085 212.156.196.226:113 L=60 S=0x00 I=17679 F=0x4000 T=58 SYN (#22) Apr 7 00:26:37 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:1085 212.156.196.226:113 L=60 S=0x00 I=17755 F=0x4000 T=58 SYN (#22) -- Togan Muftuoglu

2 1