December 2002 - openSUSE Security - openSUSE Mailing Lists

dependency problems updating KDE3 on SuSE 8.0
by Bob Vickers 05 Dec '02

05 Dec '02

Dear All, There is a whole bunch of linked KDE3 security updates which will not install on SuSE 8.0 because of dependency problems. The root of this seems to be: # rpm -Fhv kdelibs3-3.0.4-5.i386.rpm error: failed dependencies: qt3 >= 3.0.4 is needed by kdelibs3-3.0.4-5 # rpm -q qt3 qt3-3.0.3-15 But I can't find a newer version of qt3 on the ftp site. I have reported this to SuSE some time ago and Roman promised some fixed versions; in the mean time is there a safe way of applying these fixes? Regards, Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

2 1

Re: [suse-security] Help needed/Permissions SuSE 7.3
by Philippe Vogel 05 Dec '02

05 Dec '02

> > Hi! > > > > I did a bloody error. > > I made a permissions script to be executed in a special directory (my > > ftp-dir) but I executed it by webmin, so no path was set and the script > > changed all default permissions on / recursively. > > SuSEconfig brought me some control over the system back and even chowned > > /usr/lib to root:bin. > > Does anybody know the default permissions on SuSE 7.3 or to wich > > mailinglist I could write this? > By the looks of it, you can use rpm to re-set the permissions of all installed > packages to what they should be. Obviously, I'm a little reluctant to test > this ;-) Have a look at the rpm manual, particularly the --setperms option. Seems like I did it working with your help! I wrote a small script and took all the packages from the installogs. The script looked like this example: PACKAGES="test test1 ... lastone" for i in "$PACKAGES"; rpm --setperms $i done Many thanks! Philippe

1 0

Source RPM for cyrus of SuSE IMAP Server 1.1 needed
by Torge Szczepanek 05 Dec '02

05 Dec '02

Hi! I have here an old SuSE IMAP Server 1.1 Installation for which I cannot find the second CD with source rpms. Can anyone provide me the cyrus source rpm?!? -- Torge Szczepanek <suse-security(a)szczepanek.de>

1 0

Computer "forgot" its IP (SuSe 8.0)
by Jean-Mathias Griessmeier 05 Dec '02

05 Dec '02

Hello! One of our computers suddenly "lost" its identity and assumed it had a (foreign) IP-adress. After reboot it had its old identity again, but I am worried. What has happened? Have we been hacked, or is this a known bug? Details: We are running SuSe 8.0 on several machines with SuSefirewall2. The only service we accept from outside is ssh. Someone with external_IP is regularly canning our computers on ports 80, 57, 21. 12h after one of these scans ONE of our machines seemed to believe it was THAT machine which scanned us, i.e. it could be connected to normally (via ssh machine_name), but the prompt was user@erternal_ip (instead of user@machine_name) Also the who am i command gave external_ip!user ... date But the file system was still acessible (I tried ll). As stated above, after reboot everything seemed normal again (using find -mount -mmin -600 -type f -print I could not detect any files altered between the scan 12h before and the reboot). Strange also that only one of the scanned machines was affected (identical configuration). How dangerous is this? BTW, how unsafe is openssh protocol 1 exactly? Thanks a lot, Jean-Mathias

1 0

Help needed/Permissions SuSE 7.3
by Philippe Vogel 05 Dec '02

05 Dec '02

Hi! I did a bloody error. I made a permissions script to be executed in a special directory (my ftp-dir) but I executed it by webmin, so no path was set and the script changed all default permissions on / recursively. SuSEconfig brought me some control over the system back and even chowned /usr/lib to root:bin. Does anybody know the default permissions on SuSE 7.3 or to wich mailinglist I could write this? Philippe

3 2

Re: [suse-security] firewall setup fails in suse7.1
by GarUlbricht7＠netscape.net 05 Dec '02

05 Dec '02

"gclinux"--- You have gotten (at least) two replies to your request for help. I will add a third...regarding "firewall setup fails in SuSE 7.1." Consider (for now) "unplugging your linux box from the net." That reduces the need to have the firewall running, and you can learn how to use "shell" commands as well as either KDE or Gnome (I use KDE and like it, my son prefer Gnome for his "gui" interface...) With regard to your first question, I call it the log-in splash screen --- which is the first screen I see after the initial "kernel scripts" run. I assume you have already set-up an account for yourself and are not running as "root" If you haven't -- that is the first security measure you should take. The next is update your system using either "YOU" or "fou4s" to get the latest security patches for your distro. Further, even though you laid you some serious money for your Dlink 704p router & ADSL, you might want to consider 'upgrading" to SuSE 8.0 (which is what I got) or 8.1 as the mannuals get better with the latter series. (Note: at some point SuSE will stop supporting 7.1) Given for now you are running 7.1, besure to read Togan FAQ < TITLE="http://dinamizm.ath.cx/>" TARGET="_blank">http://dinamizm.ath.cx/>. He answers a lot of questions on on setting up firewall on 7.1 machines. If you follow Claus Weber's suggestions (in reply to Patrick), I have the following additional comments: Claus Weber <claus.weber(a)jambit.com> wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > >Hi, > >> >> so i guess theres no way around to going to >> /etc/sysconfig and editing a file called SuSEfirewall2 . >> one of the first 3 or 4 paragrafs deals with internal or >> external interfaces. you might try and put them both to >> eth0. hth > >If you're behind a router, then maybe SuSEfirewall2 isn't >the tool you need at all. Just use this, if your Linux-Box >acts as a router. Look at "Personal Firewall", this should >work better in your case. If you decide to follow his suggestion, then "unload" "SuSEfirewall2" using YAST and install "Personal Firewall" I know, it is available for Suse 8.0 (e.g. Personal-firewall-1.2-48 RPM for noarch). I don't know about 7.1. http://www-isia.cma.fr/fr/presentation/materiel/pc_linux/base_logiciels/bas… Other solutions are Bastile and Harden SuSE... but I suggest unplugging from the net and getting comfortable with linux and then setting up your "firewall box" using Linux and your own personal box to do what ever... Note: IMHO if you don't have two boxes, separated by a DMZ, then it is not a firewall. Togan explains that in his FAQ. HTH Gar PS NOTE: some protocols may fail if the personal-firewall is active. Among these are ftp (PORT mode), irc (DCC mode, CTCP), quake, real-audio, real-video and others that open secondary connections or that use UDP datagrams. ************************************************* Subject: [suse-security] firewall setup fails in suse7.1 Date: Tue, 3 Dec 2002 16:18 EST From: "gclinux" <gclinux(a)telusplanet.net> To: <suse-security(a)suse.com> hi list, I'm new to linux, upon bootup before the gui login (whats that called in linux? anyway), i get a message saying the firewall script needs to know the external internet interface. How do i fix this in simple terms. I don't have any luck figuring out what the manuals are trying to say. I have suse7.1 , behind a dlink 704p router & ADSL. Unfortunately I am still a gui moron, I have been through yast 2 many times and have been able to enable most of the items the manuals mention, but i still can't find how to tell the firewall script the external internet interface. tyi __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

1 0

Re: [suse-security] Firewall on Cd
by Lucio Solorzano 04 Dec '02

04 Dec '02

Hi Jörn, Thanks for your help, I found the config files and edit, all ok for that, but the firewall not work correctly. This is what i`m doing: Step 1/8: I chose eth1 - intranet device Step 2/8: I check Enable Ip forward Step 3/8: Blank Step 4/8: Blank Step 5/8: TCP Ports selected smtp, domain, http, https, 3128, 8481 UDP Ports selected domain, 1588, 6024, 6026, 6028, 6030 Step 6/8: TCP Ports selected smtp, domain, http, https Step 7/8: Blank It`s correct ??? Thanks ----- Original Message ----- From: "Jörn Ott" <white(a)ott-service.de> To: <lsolorzano(a)cidelsa.com.pe> Sent: Wednesday, December 04, 2002 9:59 AM Subject: Re: [suse-security] Firewall on Cd > Hi Lucio, > > > > Hello friends, > > Some of you uses firewall On CD? > > I installed it for a client of mine and it is acceptable. > > [...] > > What I must do is to allow that firewall lets pass the packages for > > ports UDP 1588, 6024 and 8481 TCP and forward to the 192,168,0,48 IP > > commit (IP of infogate), this me says the people to it who provide > > infogate. > > If you are looking at the fas module SuSEfirewall, you can open ports > at the 4th step of that config module. As the ports you are mentioning > are not listed, you must edit some config files first (quotuing the > help window which should be on your screen when you use fas): > "Die Pakete, deren Zielport einem ausgewählten Port bei 'TCP-Ports' > oder 'UDP-Ports' entspricht, dürfen direkt auf die Firewall. Wählen Sie > die Ports aus, über die die Pakete direkt auf die Firewall gelangen. > Sollen weitere Ports freigegeben werden, die nicht aufgelistet sind, > dann müssen Sie die entsprechende Konfigurationsdatei editieren: > TCP: /etc/fas/TCPServices.conf > UDP: /etc/fas/UDPServices.conf > ------------- > > HTH > Jörn > > > ------------------------------------------------------------ > Jörn Ott Telefon: (0 22 24) 94 08 - 73 > EDV Service & Beratung Telefax: (0 22 24) 94 08 -74 > Lohfelder Str. 33 E-Mail: mailto:white@ott-service.de > 53604 Bad Honnef WWW: http://www.ott-service.de/ >

1 0

rescuedisk (7.3)
by Piet Roorda 04 Dec '02

04 Dec '02

my rescuedisk of 7.3 has an old tune2fs so I downloaded a more recent one hoping the option ^O will be supported, but the file is to big so when I gzip it I get: 2881+0 records in 2880+0 records uit so I did gzip -9 but then my system is stuck what I want to establish is going from et3 to ext2 so partition magic can look at my Hdisk. fdisk claims there is a partition I made with bad blocks or so I guess 'cause it hangs between 609 and 12xx anyone any input here? piet

1 0

About inetd
by ISLERO77＠telefonica.net 04 Dec '02

04 Dec '02

Hello, I'm using a Firewall for FTP, that it's called by inetd daemon. When I make FTP to a local direction it works, but if I make ftp to an external direction (Internet) the inetd daemon doesn't work, I can access to the ftp direction but inetd isn't used. Could anybody tell me which service is used when I go to an external direction? Thanks Torres.

3 2

Firewall on Cd
by Lucio Solorzano 04 Dec '02

04 Dec '02

Hello friends, Some of you uses firewall On CD? I have a problem without solution, is the following one: The Firewall On CD me left it formed and working, everything without problems, until the last week in which they brought to the company an equipment Infogate 3020 for telephon calls by IP (between us, it works excellent). Profit not to cause that this equipment Infogate works after my firewall, I don`t have the support of the supplier. Without firewall the equipment this works perfectly. What I must do is to allow that firewall lets pass the packages for ports UDP 1588, 6024 and 8481 TCP and forward to the 192,168,0,48 IP commit (IP of infogate), this me says the people to it who provide infogate. Thanks to all,

2 1