October 2002 - openSUSE Security - openSUSE Mailing Lists

compile freeswan on suse 8.1
by Andreas Marbet 17 Oct '02

17 Oct '02

Hello list, I know compiling questions are OT here but its about freeswan so you are the ones who perhaps had the same problem. I simply can't compile freeswan 1.98b (patched with x509 0.9.15) on a freshly installed suse 8.1 box. same thing worked well on several installations of suse 8.0. of course I could just take the rpm suse shipped on CD, but I really wonder what is going wrong. after submitting 'make menugo' or make 'xgo' it starts with kernelconfiguration then begins to compile and after about one hour (PIII 500MHz) it stops with an error. the last lines of out.kbuild are as follows: gcc -D__KERNEL__ -I/usr/src/linux-2.4.19.SuSE/include -Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fno-strict-aliasing -fno-common -fomit-frame-pointer -pipe -mpreferred-stack-boundary=2 -march=i586 -DMODULE -Ilibfreeswan -Ilibdes -Wall -Wpointer-arith -Wstrict-prototypes -DKBUILD_BASENAME=ipsec_tunnel -c -o ipsec_tunnel.o ipsec_tunnel.c In file included from /usr/src/linux-2.4.19.SuSE/include/linux/skbuff.h:27, from /usr/src/linux-2.4.19.SuSE/include/linux/netdevice.h:147, from ipsec_tunnel.c:38: /usr/src/linux-2.4.19.SuSE/include/linux/highmem.h: In function `bh_kmap': /usr/src/linux-2.4.19.SuSE/include/linux/highmem.h:22: warning: pointer of type `void *' used in arithmetic ipsec_tunnel.c: In function `ipsec_tunnel_start_xmit': ipsec_tunnel.c:995: warning: deprecated use of label at end of compound statement ipsec_tunnel.c:1728: warning: deprecated use of label at end of compound statement ipsec_tunnel.c:1748: too many arguments to function `ip_select_ident' make[3]: *** [ipsec_tunnel.o] Error 1 make[3]: Leaving directory `/usr/src/linux-2.4.19.SuSE/net/ipsec' make[2]: *** [_modsubdir_ipsec] Error 2 make[2]: Leaving directory `/usr/src/linux-2.4.19.SuSE/net' make[1]: *** [_mod_net] Error 2 make[1]: Leaving directory `/usr/src/linux-2.4.19.SuSE' anybody have an idea or successfully compiled it himself? Andreas

1 0

Re: [suse-security] /var/log/warn messages
by Thomas Lamy 17 Oct '02

17 Oct '02

No need to worry, it's just some kazaa client trying to connect to your ip. If you have no static ip, it maybe somebody who got your current ip before used kazaa Thomas Piet Roorda [mailto:prooroa@wanadoo.nl] wrote: > > is tyhis healthy or to worry? > piet > > Oct 17 12:20:13 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= > SRC=213.73.226.105 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 TTL=120 > ID=65004 DF PROTO=TCP SPT=1238 DPT=1214 WINDOW=8192 RES=0x00 > SYN URGP=0 OPT > (0204058401010402) > Oct 17 12:20:14 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= > SRC=213.73.226.105 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 > TTL=120 ID=749 > DF PROTO=TCP SPT=1238 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT > (0204058401010402) > Oct 17 12:36:06 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= > SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 > TTL=118 ID=23468 > DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT > (0204058401010402) > Oct 17 12:36:07 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= > SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 > TTL=118 ID=28588 > DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT > (0204058401010402) > Oct 17 12:36:07 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= > SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 > TTL=118 ID=32428 > DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT > (0204058401010402) > Oct 17 12:36:08 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= > SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 > TTL=118 ID=36012 > DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT > (0204058401010402) > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

/var/log/warn messages
by Piet Roorda 17 Oct '02

17 Oct '02

is tyhis healthy or to worry? piet Oct 17 12:20:13 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=213.73.226.105 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=65004 DF PROTO=TCP SPT=1238 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Oct 17 12:20:14 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=213.73.226.105 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=749 DF PROTO=TCP SPT=1238 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Oct 17 12:36:06 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 TTL=118 ID=23468 DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Oct 17 12:36:07 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 TTL=118 ID=28588 DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Oct 17 12:36:07 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 TTL=118 ID=32428 DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Oct 17 12:36:08 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 TTL=118 ID=36012 DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402)

1 0

Updated packages and ghostview/ghostscript flaws
by Bonemach 17 Oct '02

17 Oct '02

Hi I recently visited the update-pages of suse and noticed a lot of security-related packages that are related to flaws in Ghostview and ghostscript. Some of these packages I have never heard of (like cmap-adobe or CID-keyed-fonts). What are these packages and what is wrong with it? The descriptions on the site are not very detailled. Why should I update this stuff ? I know of two vulnerabilities that are related to malicious pdf or ps documents. One is in ghostscript (CAN-2002-0363). http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0363 and another is in ghostview (CAN-2001-0832). http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0832 How do I know what packages fix one of these vulnerabilities (if they indeed do so)? Greetings Bone Machine (in despair) --- "Somebody got hurt" - The Pixies ---

4 3

public key encryption
by Dale Johnson 17 Oct '02

17 Oct '02

I am wondering if people would comment on a security configuration where a PGP public key and private key are both well known, but the private key is protected with a very strong passphrase. Let's assume that in this case, that is the only security I can guarantee. How safe would messages encrypted with the public key be? comments? Dale Johnson.

1 0

Susefirewall2 (suse 7.3)
by Piet Roorda 17 Oct '02

17 Oct '02

each time I do adsl-connect I have to stop my firewall2 and start it again otherwise everything blocks, why? piet

3 3

Samba, Firewall2, Windows XP
by Chuck 17 Oct '02

17 Oct '02

I am trying to get access to and from my Suse 8.0 pc via Samba to my Windows XP pc. I have gone through Yast2 and opened up port 139, but still no luck. When I bring the firewall down, it works fine, but I don't want to do that. Is there another piece I am missing. Thank-you for the help

4 3

RE: [suse-security] network privileges of user nobody??? how to configure???
by Steven Augart 17 Oct '02

17 Oct '02

ping drops its permissions as soon as it gets a raw socket open -- that's all it needs them for. If /etc/resolv.conf is set to rw-r----- root.dialout /etc/resolv.conf then that would nicely account for everything. By the time ping gets around to looking up the host name, it no longer has the privileges to read /etc/resolv.conf. --Steve Augart -----Original Message----- From: Steffen Dettmer [mailto:steffen@dett.de] Sent: Wednesday, October 16, 2002 2:27 AM -0700 (California time) To: SuSE Security Mailingliste Subject: Re: [suse-security] network privileges of user nobody??? how to configure??? Maybe some permissions are screwed up. I could imagine such effects when having a /etc/resolv.conf readable for dialout only. Well, my PING (SuSE 7.0 I believe) isn't dropping it's UID0, so you would probably need a "---r-----" root.dialout /etc/resolv.conf or such. Ohh, and please send the strace to me (PM) and not to the list!

1 0

sorry
by N1UAN Bob 16 Oct '02

16 Oct '02

sorry for this test but need to check my email from list Bob

2 1

SuSEfirewall2 The missing manual
by Togan Muftuoglu 16 Oct '02

16 Oct '02

Hi, As the subjects says "SuSEfirewall2 The missing manual" is a 40 page PDF document trying to explain the missing parts of information of SuSEfirewall2. http://dinamizm.ath.cx/articles/firewall2.pdf The file also available at Sourceforge so for faster downloads you may http://sourceforge.net/project/showfiles.php?group_id=42064&release_id=1166… This is version 0.8 Draft. I think I have covered almost all of it (sometimes two eyes is not enough). Before I release version 1.0 FINAL, I would like to receive input from people. It's not good if it is only my point of view as the document is trying to help anyone to configure SuSEfirewall2. So please use the Sourceforge Tracker for submitting comments, patches, bugs etc http://sourceforge.net/tracker/?atid=509170&group_id=42064&func=browse Thanks -- Togan Muftuoglu Unofficial SuSE FAQ Maintainer http://dinamizm.ath.cx

1 0