May 2001 - openSUSE Security - openSUSE Mailing Lists

problems with TLD ...
by patric illi 16 May '01

16 May '01

Cheers Linux freaks I have a general question about TLD and ccTLD ( top level domains ), I am sorry for this post but I found no other resource to ask ! We have a two DNS Servers ( ns1.intersoft-networks.ch and ns2.intersoft-networks.ch ). Till now we only registered ".ch" domains. That was working fine. Some days ago I unsuccessfully tried to register a ".net" domain. The output always shows me an Error. My question now; is it possible that a TLD can't point to a ccTLD Nameserver ? So would it work if I register a TLD and configure it as master server ? thx in advance ! patric illi

1 0

SuSE Firewall
by Faessen Jean-Paul 16 May '01

16 May '01

Hi; Finally started (had to find out how first) my SuSE Firewall in SuSE 7.0. Of course,want to configure. So tried to run/open config in Vim and in text console. /etc/rc.conf.d/firewall.rc.config in text console: access debnied. So I run chmod u+x /etc/rc.conf.d/firewall.rc.config nothing happens. Went to Vim doesn't know /etc/ So,how to configure my freshstarted Firewall? Can I use kfirewall to do this? thank's..; Jean-Paul

4 5

do I need util-linux-2.11b-15.i386.rpm?
by omar castillo 16 May '01

16 May '01

i'm upgrading to the new 2.2.19 kernel due to security reasons. do I need util-linux-2.11b-15.i386.rpm?

3 2

Unwanted guest is trying to relay
by Togan Muftuoglu 16 May '01

16 May '01

I had this in my logs isguzar sendmail[5670]: f4FKqSd05670: ruleset=check_rcpt, arg1=<telu(a)telus.net>, relay=user115.mdi.ca [207.230.250.115], reject=550 5.7.1 <telu(a)telus.net>... Relaying denied Ok AFAIU he couldnot get the relay and from=<j6hd6hegh34(a)yahoo.com>, size=0, class=0, nrcpts=0, proto=SMTP, daemon=MTA, relay=user115.mdi.ca [207.230.250.115] but this one I did not get did he managed to use me as his relay or not. If he did what steps can I take to make life harder to outsiders I am using the sednmail 8.11.2-4 that comes with 7.1 -- Togan Muftuoglu

2 2

RE: [suse-security] somebody subscribed in the list has list in s pam filter
by Franziskus Scharpff 16 May '01

16 May '01

Hello Michael, maybe your Provider uses an open Relay for Maildelivery. I had this also a year ago, when Isend some mails via Strato to an account wich checks for open relay for Spam-Preventing. Franziskus > -----Original Message----- > From: Michael Rauter [mailto:rauter@ctos.de] > Sent: Mittwoch, 16. Mai 2001 10:59 > To: suse-security(a)suse.com > Subject: [suse-security] somebody subscribed in the list has list in > spam filter > > > Hello > > after my last posting, I received this mail. Maybe this > person (olaf.kionka(a)trianet.de) should be removed from list, > because list postings will be rejected... > > Regards > M. Rauter > > -----Ursprüngliche Nachricht----- > Von: FETCHMAIL-DAEMON(a)localhost.trianet.de > [mailto:FETCHMAIL-DAEMON@localhost.trianet.de] > Gesendet: Mittwoch, 16. Mai 2001 10:44 > > > Our spam filter rejected this transaction. > >

1 0

Re: [suse-security] Unwanted guest is trying to relay
by Togan Muftuoglu 16 May '01

16 May '01

* Paul Miles <paul.miles(a)padlondon.com> [010516 01:14]: > Throw away sendmail and install Exim. (http://www.exim.org) > > Exim is so much easier to setup, hence more likely to configure a secure > setup/ Many thanks for the informative answer to my question After checking my logs and reading the sendmail op.txt that was located in the docs directory I do not now think the person was able to do send a mail since SuSE sendmail is compiled with no relay option the unwanted guest could not achieved what he dreamed. -- Togan Muftuoglu

1 0

vanished user accounts?
by Night Watcher 15 May '01

15 May '01

Hi all, i have the following problem on my three suse 7.0 and one 7.1 box, after a while when i wanted to log in under my test account, the message was, cannot switch to homedir (no access or something) i relogged in under my root account and then i wanted to correct this problem, i used midnight commander to look where the directory and user permissions of the /home/test account were, these stuff were correctly displayed: i found out that all the permissions still belonged to user test, this was very strange in my opinion, i thought well that is not right but reinstall might help, so i did that, and then my other three boxes suddenly displayed the same problem, all after 2 to 3 weeks, i am pretty sure that i didn't change the userpermissions on the machines ( i can make an mistake but not on 4 machines :)*) so i am guessing that it's an bug, removing the users and readding them does NOT work, so anyone, can u help me? or someone of the SuSE team : is this correcT? met vriendelijke groeten, with kind regards, Remko JC @ irc.super-chat.nl (tech-Admin) NightWatcher @ irc.grunn.org / irc2.grunn.org (IRCoperator) [DrL] Member [Grunn] Coders [Zyber] /* hope the day after you die is an nice one */ niets uit deze mail mag worden gecopieerd of aan derden gelezen laten worden zonder toestemming van de auteur. al deze emails vallen onder briefgeheim. wetboek van strafrecht. Nothing from this mail may be duplicated of may be read by others then the target name. you need authorization from the owner to duplicate it. these mails are secure and restricted confirming the dutch book of law _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

4 5

pop3 endcodes mail with netscape and suse7.x
by ingo＠cimdata.de 15 May '01

15 May '01

hi list, heare in my brillant english, a question: Wher coud I find some infos over: how I encodes the pop3 protocol (ssh?) so that I coud use encode mail with netscape? I coud'nt find something over it at www.obenssh.org, isint it the right cryptosoftwaere? -- []___¸ ######-\ O_-_-_O-\

3 2

ip_masq_h323
by Togan Muftuoglu 15 May '01

15 May '01

Hi, Suse kernel's do not have the ip_masq_h323 module, although someother distribution do have it. Is there any security reasons that the others have not noticed yet or is it just a preference by SuSE. If I compile it byself will I create headaches for myself if the answer to the first part is by preference. TIA -- Togan Muftuoglu

2 3

ipchains problem ?
by stephane parenton 15 May '01

15 May '01

hi, I have a SuSE 7.0 linux box that runs as DNS, filter and gateway. The filter is quite simple. and I 'experiencing troubles... The public ip adress is 62.161.161.253, and the internal lan is nat'ed and use the 192.168.0.x adresses. The computers from the lan can see almost all the internet except the sites that have ip's beginning with 62.*... What can be the trouble ?.... here's the filter i use. #!/bin/sh echo 1 > /proc/sys/net/ipv4/ip_forward /sbin/ipchains -F forward /sbin/ipchains -P forward DENY route add -net 62.161.161.192 netmask 255.255.255.224 gw 62.161.161.222 tr0:0 route add 192.168.0.3 gw 62.161.161.253 route add default gw 62.161.161.254 /sbin/ipchains -A forward -s 0.0.0.0/0.0.0.0 -d 62.161.161.194/255.255.255.255 -j ACCEPT /sbin/ipchains -A forward -s 0.0.0.0/0.0.0.0 -d 62.161.161.195/255.255.255.255 -j ACCEPT /sbin/ipchains -A forward -s 62.161.161.194/255.255.255.255 -d 0.0.0.0/0.0.0.0 -j ACCEPT /sbin/ipchains -A forward -s 62.161.161.195/255.255.255.255 -d 0.0.0.0/0.0.0.0 -j ACCEPT /sbin/ipchains -A forward -s 192.168.0.0/255.255.0.0 -d 0.0.0.0/0.0.0.0 -j MASQ TIA Stephane Parenton

3 2

Re: [suse-security-announce] SuSE Security Announcement: cron
by Nix 15 May '01

15 May '01

At 10:48 PM 15/05/2001, you wrote: > Sebastian Krahmer has found the bug. It has been fixed by properly > dropping > the privileges before executing the editor. Nice work Sebastian. I've been waiting for the SuSE announcement since I saw your name on bugtraq. Good to see that SuSE's extra auditing pays off. Viel Spaß Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

SuSE Security Announcement: cron
by Sebastian Krahmer 15 May '01

15 May '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: cron-3.0.1-296 Announcement-ID: SuSE-SA:2001:17 Date: Tuesday, May 15th, 2001 14:30:00 CEST Affected SuSE versions: 7.1 Vulnerability Type: local privilege escalation Severity (1-10): 7 SuSE default package: yes Other affected systems: All UN*X systems using this package Content of this advisory: 1) security vulnerability resolved: crontab problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The crontab program is running setuser-id root and invokes the editor specified in the EDITOR environment variable, usually vi. If crontab discovers that the format of the edited file is incorrect, it executes the editor again but fails to drop its root privileges before. Therefore it is possible to execute arbitrary commands as root. Sebastian Krahmer has found the bug. It has been fixed by properly dropping the privileges before executing the editor. A possible temporary workaround is to remove the suid bit of the /usr/bin/crontab program: chmod -s /usr/bin/crontab. If you change the mode, you should also do so in the files /etc/permissions*. A permanent solution for the problem is to update the cron package from our ftp server. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/a1/cron-3.0.1-297.i386.rpm b51f3331fff5dac8474a51a1e7d22454 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/cron-3.0.1-297.src.rpm 495f7f5df30d28a0c6b078a9773fc799 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/a1/cron-3.0.1-316.sparc.rpm 4db292d0276badc0ae58fd6aeaab64c0 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/cron-3.0.1-316.src.rpm 16facdbbce03d43fa05d540b810d8636 AXP Alpha Platform: The SuSE-7.1 AXP-Alpha Edition does not suffer from this problem. PPC Power PC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/a1/cron-3.0.1-295.ppc.rpm 589e8575bbbee29a07319f5c5ada9bcc source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/cron-3.0.1-295.src.rpm ff747e2aee85a53e3a30827b33383a7d ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - The man program running setuser-id 'man' suffers from format string and bufferoverflow bugs. Updates are currently being built. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Sebastian Krahmer ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOwElIney5gA9JdPZAQHJ+Qf/Z6Q8ofh8j807uLChfv42lCkWmvOCfJLb S4Vg32n3P5oyFcb1J2qHUt+Dv1NlLuGGqsiUlCTNa6xqlt7pWBWQPtyRGnBUGDNh t+VjFBDzILMdIA5A1U25+JtChPXUXYJsvl/KCefoxfXpbiae3J5xqT9lPwe/Djez ZLBdsowmUV7s5lJKUyxrmHhTapLT4ksnunJ5bCmo/z86NMFFGvefeclcEFZ9/q7n rFX48x3vh4psCTJqRVFJoSFAYVfHuXDNuMj59p17JbK3TlVV63rFlk/+zSB+HlnU ddnacjnYfsQhdOhY/QJ68byk/GsusJTbDSHDFobFNgbEVyUmUFC3QQ== =OH6U -----END PGP SIGNATURE-----

3 4

Antwort: Re: [suse-security] Kernel security
by Alexander Schwartz 15 May '01

15 May '01

I think SuSE has the problem that is uses a patched (enhanced) kernel with IPSEC etc. enabled that make it more complicated than necessary. There are distributions like debian who keep things simple and that came up with a recent kernel a long time ago. Using debian, you can update your system with two command (apt-get update / apt-get upgrade) -- never seen that working on a SuSE-machine. Makes administration easy and reduces TOC. Mit freundlichen Grüßen Alexander Schwartz

2 1

Re: [suse-security] Driver Licence
by Alexander Schwartz 15 May '01

15 May '01

Hmm... a driver licencse covers use of cars on normal roads and in cities. But when you "drive" your "box" on the internet, its more like driving in the sahara and rainforest at the same time. A.

1 0

problems with DoS
by Gediminas Grigas [home] 15 May '01

15 May '01

Hello, I`m recently under heavy attack from an l33t hax0r kiddie. Hes using lots of proxies to access my banner exchange (i mean real lots - hundrets and hundrets) - he was able to add new hosts faster than i was able to lock them out wit ipchains (like 10 hosts/min or so). So its ended by that i changed input policy to DENY and set ACCEPT only for lithuanian ISP`s (about 40 major subnets). But thats not solution, becouse system is now locked from outside Lithuania. However that kiddie started abusing my exchange from his real IP (an biggest ISP dial-up service). I cannot lock-out this ISP becouse i would lock 10.000 users as well. So i`m forced to monitor whats happening everytime and lock him once in a while, or server load will jump from 0.4 to 10.00 on my P-III 1Ghz host. I connot do anything in legal way - becouse we dont have anything in our law system against "l33t hax0rs", besides that isp has terrible support and monopoly, so it will probably even dont bother to respond to my requests. My question would be - is there an tool which could run with apache to automaticly lock host for some time if it tryies access system more that 10 times per minute or so? Could anybody pass me an idea how to fight against such attacks? On other hand - i remember someone once said that he has an "legal request to ISP against hackers" or so... some nice warning text to send to ISP on detection of intrusion or DoS. Could you please refer me to it? Sorry for my broken english. Hope you got the matter. P.S. Host running SuSE 7.1 with 2.2.x kernel Thanks -- Best regards, Gediminas Grigas Tel.: (2)226036; (86) 55362 Techninis direktorius Fax.: (2)627986 UAB "Dizaino kryptis" A.Jaksto 9-233, Vilnius, Lietuva 2001 mailto:gedas@kryptis.lt

5 4

man segfault
by Togan Muftuoglu 15 May '01

15 May '01

Hi I have read this on the securityfocus >Heap Based Overflow of man via -S option gives GID man. > Due to a slight error in a length check, the -S option to > man can cause a buffer overflow on the heap, allowing redirection of > execution into user supplied code. > man -S `perl -e 'print ":" x 100'` >redhat 7.0 with man-1.5h1-10 (default > package) and earlier. but running it on suse with man-2.3.10d69s-190 I also get the same thing $ man -S `perl -e 'print ":" x 100'` sometext Segmentation fault -- Togan Muftuoglu

1 0

Using SuSEfirewall for the internal lan
by Togan Muftuoglu 15 May '01

15 May '01

Hi I am getting 1 of probes to port 80 since yesterday to my home network which consists of SuSE 7.1 firewall/router serving 3 1 which are also running SuSE 7.1 and 1 Windows 98 laptop. Although firewall/router has ipchains blocking for all ports except forwarding port 25 can using ipchains firewall in the masquareded 5 increase my security and if so how will it affect the performance. I am planning to use Marc's SuSEfirewall-4.6 but I could not figure out what is my dev_world if I just say eth0 then it will get the address of the NIC but that is not how the packets are coming to the 0 lan since it is masquared. Any guidance is 0 TIA -- Togan Muftuoglu

1 0

Obtuse smtp
by Togan Muftuoglu 14 May '01

14 May '01

Hi I have enabled fort portwarding for port 25 on the firewall. I have the sendmail running on the masquareded machine 192.168.1.3. I have edited the inetd.conf as it says in the INSTALL smtp stream nowait root /usr/sbin/smtpd smtpd I have restarted inetd started smtpfwdd and this is what I am receiving in the messages smtp/tcp(2) bind:adress already in use ???? 1)I have chagned the sendmail option to -q10m in sendmail.rc.config 2) I could not find an init script for smtpfwdd 3) In order to use the anitspam rules it says smtpd should be compiled with CHECK_ADDRESS=1 is this the case for Suse TIA -- Togan Muftuoglu

2 2

Re: [suse-security] Kernel RPMs
by Roman Drahtmueller 14 May '01

14 May '01

> > Hi together, > > ftp://ftp.suse.com/pub/suse/i386/update/6.4/kernel/RPMs/ > > 7. To avoid complaints from the kernel about an old mount, update the > > util-linux (util for 7.0 and older), too, using rpm -Uhv <packname>. > > is the util-package "util-2.11b-0.i386.rpm" correctly packaged? > I'm missing 'setserial' after update. Right. This needs to be changed. Thanks for the note. > > Peter Wiersig > Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

3 3

RE: [suse-security] vanished user accounts?
by Marco van Beek 14 May '01

14 May '01

You may also find that the system is saving the username/group as a number, and simply recreating the user doesn't mean they inherit the old permissions. I have noticed that when using YaST it often deletes and re-adds when you edit a username or group. Marco van Beek. -----Original Message----- From: Peer-Christoph Mettelem [SMTP:Peer-Christoph.Mettelem@bezreg-muenster.nrw.de] Sent: Monday, May 14, 2001 11:53 AM To: suse-security Subject: RE: [suse-security] vanished user accounts? never use test as username, dirname or something. It's a command and may cause problems. -----Original Message----- From: Night Watcher [mailto:theeagle84@hotmail.com] Sent: Monday, May 14, 2001 12:43 PM To: suse-security(a)suse.com Subject: [suse-security] vanished user accounts? Hi all, i have the following problem on my three suse 7.0 and one 7.1 box, after a while when i wanted to log in under my test account, the message was, cannot switch to homedir (no access or something) i relogged in under my root account and then i wanted to correct this problem, i used midnight commander to look where the directory and user permissions of the /home/test account were, these stuff were correctly displayed: i found out that all the permissions still belonged to user test, this was very strange in my opinion, i thought well that is not right but reinstall might help, so i did that, and then my other three boxes suddenly displayed the same problem, all after 2 to 3 weeks, i am pretty sure that i didn't change the userpermissions on the machines ( i can make an mistake but not on 4 machines :)*) so i am guessing that it's an bug, removing the users and readding them does NOT work, so anyone, can u help me? or someone of the SuSE team : is this correcT? met vriendelijke groeten, with kind regards, Remko JC @ irc.super-chat.nl (tech-Admin) NightWatcher @ irc.grunn.org / irc2.grunn.org (IRCoperator) [DrL] Member [Grunn] Coders [Zyber] /* hope the day after you die is an nice one */ niets uit deze mail mag worden gecopieerd of aan derden gelezen laten worden zonder toestemming van de auteur. al deze emails vallen onder briefgeheim. wetboek van strafrecht. Nothing from this mail may be duplicated of may be read by others then the target name. you need authorization from the owner to duplicate it. these mails are secure and restricted confirming the dutch book of law _________________________________________________________________ ________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. ----------------------------------------------------------------- ---- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

The curiose Mysql Problems
by Thomas Nowak 14 May '01

14 May '01

Hi list, May its a little bit OT but I don't understand the follow facts: First of all I usinig SuSE 6.4 and mysql. A nice feature of SuSE is the cleaning script which deletes file from the /tmp directory if they are not owned by root. The first Problem is, that mysql has in the standard installation his socket file in this location which is owned by the mysql user so this file is removed after one week. ( I havend found this error in the SuSE Support DB ! ) So I have put the socket file to /var/run ( In my opinion it should the perfect place ) :-) With "/sbin/init.d/mysql start" all is OK, but after each restart mysql will not automatic start. I had found that this is becaus the /var/run directory ist owned by root.uucp and has 775 pemissions, so mysql can't create the socket file as user mysql! But what is the great difference betwwen the start of the script /sbin/init.d/mysql from init and by "hand" as root In both cases I should be root or not? Bye Thomas

1 0

Kernel RPMs
by Roman Drahtmueller 14 May '01

14 May '01

Hi together, As some of you may have seen, I've just put the kernel RPMs for the Intel i386 distributions 6.3, 6.4, 7.0 and 7.1 in place. You can find them at ftp://ftp.suse.com/pub/suse/i386/update/6.3/kernel/RPMs/ ftp://ftp.suse.com/pub/suse/i386/update/6.4/kernel/RPMs/ ftp://ftp.suse.com/pub/suse/i386/update/7.0/kernel/RPMs/ ftp://ftp.suse.com/pub/suse/i386/update/7.1/kernel/RPMs/ for download. The announcement is waiting to be published, but you get the preliminary version. A kernel update is not rocket science, but it is more sensitive than exchanging a package that you have never heard of for a stupid tempfile race. You should carefully follow each step before you reboot your machine for the freshly installed kernel to become active. We decided to update the kernel packages on all supported distributions to the most recent version 2.2.19 instead of fixing the known security bugs with patches. Tons of other problems have been fixed with the release of the 2.2.19 kernel, and we believe that this is the most stable kernel in the 2.2 release row. To find out which package to download use the command rpm -qf `awk '/^image =/ { print $3 }' < /etc/lilo.conf` Additional stuff can be found in the respective misc/ directory under ftp://ftp.suse.com/pub/suse/i386/update/<distvers>/kernel/misc, such as the .config used for kernel configuration, the output of the compile run and the specfile for the RPM packages. To install the kernel, proceed as follows: 1. Download the kernel rpm for your installation. 2. Install the kernel using the command rpm -Uhv k_deflt.rpm or whatever the command necessary for your installation (see above). It may be necessary to either deinstall the old kernel package and modules package or to use the "--force --nodeps" commandline options for rpm in addition to -Uhv. 3. If you use an Adaptec aic7xxx scsi host adapter, please change "aic7xxx" in INITRD_MODULES on top of /etc/rc.config to read "aic7xxx_old". 4. Execute mk_initrd An error indicates that the initrd is not written to disk. It is possible that your machine will not boot if you have a scsi system. 5. Execute lilo If you did not change the line starting with "initrd" in /etc/lilo.conf, then the freshly created init-Ramdisk will be loaded together with the kernel by lilo upon system boot. This initrd contains the drivers that are necessary for the kernel to mount the root filesystem of the system. On scsi systems, you can't boot without the modules contained in the initrd. 6. If you use lvm, update the lvm package as well. It is contained in the same directory as the kernel rpms. 7. To avoid complaints from the kernel about an old mount, update the util-linux (util for 7.0 and older), too, using rpm -Uhv <packname>. 8. The 7.0 distribution contained a bug in the glibc that is triggered by 2.2.19. The bug may result in mounted nfs filesystems to report -EIO when listing directories in some rare cases. Get the update package for shlibs (the other sub-packages are not needed) from i386/update/7.0/a1/shlibs.rpm, and install it, again, using "rpm -Uhv <packname>". Keep your machine in a quiet state during this upgrade; if at all possible, bring the machine into single user mode, using the command "init 1" Execute "ldconfig" after completion of the rpm command. 9. Execute init 6 or shutdown -r now # which is the same without warning ...and if it fails, drop me a mail, please. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

7 15

https
by Dietmar Strasdat 14 May '01

14 May '01

Hello suse-security-list, i have installed a suse 7.0 with squid 2.3 stable 3 and Marcs firewall script 4.5. For ftp is proxy suite installed and so long it works fine. But i can t connect to a https url. in firewall.rc.config: FW_SERVICES_INTERNAL_TCP="22 25 53 80 110 119 443 3128" Any hints? -- Best regards, Dietmar mailto:earthmate@gmx.net

1 0

Re: [suse-security] shadow doesn't work anymore with kernel 2.2.19
by Togan Muftuoglu <toganm 13 May '01

13 May '01

* Thomas Schweikle <tschweikle(a)fiducia.de> [010514 02:30]: > In this case someting must have gone wrong updating KDE, Kernel, and X. Any > hint, where I might look? I do not know the answer and its better to hit reply all so the list gets the mail as well incerasing your chance to get answer -- Togan Muftuoglu

1 0

shadow doesn't work anymore with kernel 2.2.19
by Thomas Schweikle 13 May '01

13 May '01

Hi! I've noticed shadow not working anymore since I've installed kernel 2.2.19. Passwords changed will be entered into /etc/passwd directly, even if the shadow-package is installed. Anyone else noticed this? -- Thomas

2 1