June 2002 - openSUSE Security - openSUSE Mailing Lists

Kaspersky AntiVirus Trouble - solved !?
by as_sec 04 Jun '02

04 Jun '02

Hi list, according to my posting this morning, i tried the same at home, ....it works fine (as you said Rainer) well, i tought my SuSE at work is similar to my home box (wrong!), now i am looking for the differences....thanx so far to all Andreas

1 0

VPN-Connection.
by Benjamin.Grogg＠isc-ejpd.admin.ch 04 Jun '02

04 Jun '02

Hi, I can established a VPN-Connection from the Internet through my Firewall to my VPN-Server (SuSE 8.0 Kernel 2.4.18). The Authenticate works correctly. The only wrong thing is that I loose my connection after a few seconds. Log-File: pppd[22572]: sent [LCP EchoReq id=0x4 magic=0xe5e560e9] pppd[22572]: rcvd [LCP EchoRep id=0x4 magic=0x16f709d7] pppd[22572]: sent [LCP EchoReq id=0x5 magic=0xe5e560e9] pppd[22572]: rcvd [LCP EchoRep id=0x5 magic=0x16f709d7] pppd[22572]: sent [LCP EchoReq id=0x6 magic=0xe5e560e9] pppd[22572]: sent [LCP EchoReq id=0x7 magic=0xe5e560e9] pppd[22572]: sent [LCP EchoReq id=0x8 magic=0xe5e560e9] pppd[22572]: No response to 3 echo-requests pppd[22572]: Serial link appears to be disconnected. pppd[22572]: cbcp_lowerdown pppd[22572]: Script /etc/ppp/ip-down started (pid 22621) Summary of lsmod : ppp_async 6080 0 (autoclean) ppp_mppe 20128 0 ppp_generic 14984 0 [bsd_comp ppp_async ppp_mppe] Last but not least the option-file : name mein_server_name lock mtu 1490 mru 1490 proxyarp auth +chap #+chapms +chapms-v2 ipcp-accept-local ipcp-accept-remote lcp-echo-failure 3 lcp-echo-interval 5 deflate 0 mppe-128 mppe-stateless debug What's wrong with my config? Why I loose always my connection? Thanks in advance Rocksteady

1 0

Passwords displayed in clear text upon expiring
by michael stone 04 Jun '02

04 Jun '02

When adding a new user, I set their password as expired so they have to change it at first login. chage -d 0 <username> But at their first login, when it prompts for the old password then the new one, they are echoed. Bug, or am I missing something? Thanks. -- Michael Stone Linux / High Performance Computing Administrator The University of Texas at Austin Mechanical Engineering Department ETC 3.130 ph: 471.5951 agentsmith(a)mail.utexas.edu

3 3

Re: [SLE] Re: [suse-security] NSA SELinux
by JW 03 Jun '02

03 Jun '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 JM >JW writes: JM >I Hope this helps, it is hard to tell what this thread is about. It is about applying the SE Linux security patches to the the SuSE kernel 2.4.18 for 8.0. Currently, the NSA (the SE-Linux authors) work with RedHat. Some work has ben done before on patchign a SuSEsystem to work with SE-Linux, but no one has (yet) gotten very far. I dearly hope to change that... - -- - ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE89/3sQ5u80xXOLBcRAgksAJ4lLaPamFTUx/hkhZOJn+lqdv/2uQCfRQKE w5WGBDPonWHvtpiI++rKp00= =YSZC -----END PGP SIGNATURE-----

3 6

How to go about mixing kernel patches...
by JW 03 Jun '02

03 Jun '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I hope no one minds tme posting this here, if you do, flame away. My first difficulty is applying the SE Linux patch to the SuSE-patched kernel. I applied lsm-2.4-2002050211.patch.gz to vanila 2.4.18 and they apply perfectly. I applied it to linux-2.4.18-SuSE and got some errors, producing the following rejects: linux-2.4.18.SuSE/fs/dquot.c.rej linux-2.4.18.SuSE/fs/namei.c.rej linux-2.4.18.SuSE/fs/inode.c.rej linux-2.4.18.SuSE/mm/memory.c.rej linux-2.4.18.SuSE/mm/mprotect.c.rej linux-2.4.18.SuSE/mm/filemap.c.rej linux-2.4.18.SuSE/net/socket.c.rej linux-2.4.18.SuSE/arch/i386/kernel/entry.S.rej linux-2.4.18.SuSE/arch/ia64/kernel/entry.S.rej linux-2.4.18.SuSE/init/main.c.rej linux-2.4.18.SuSE/kernel/fork.c.rej linux-2.4.18.SuSE/kernel/sched.c.rej linux-2.4.18.SuSE/Makefile.rej linux-2.4.18.SuSE/include/linux/fs.h.rej Or if this helps any: jw:/work/dl/se_linux/se_build/linux-2.4.18.SuSE # zcat ../../opt5/all-opt-4-together/patches/lsm-2.4-2002050211.patch.gz | patch -s -p1 1 out of 3 hunks FAILED -- saving rejects to file Makefile.rej 1 out of 1 hunk FAILED -- saving rejects to file arch/i386/kernel/entry.S.rej 1 out of 1 hunk FAILED -- saving rejects to file arch/ia64/kernel/entry.S.rej Reversed (or previously applied) patch detected! Assume -R? [n] Apply anyway? [n] 1 out of 1 hunk ignored -- saving rejects to file fs/binfmt_elf.c.rej 1 out of 2 hunks FAILED -- saving rejects to file fs/dquot.c.rej 1 out of 3 hunks FAILED -- saving rejects to file fs/inode.c.rej 1 out of 22 hunks FAILED -- saving rejects to file fs/namei.c.rej 1 out of 6 hunks FAILED -- saving rejects to file include/linux/fs.h.rej 1 out of 2 hunks FAILED -- saving rejects to file init/main.c.rej 1 out of 4 hunks FAILED -- saving rejects to file kernel/fork.c.rej 1 out of 7 hunks FAILED -- saving rejects to file kernel/sched.c.rej 1 out of 3 hunks FAILED -- saving rejects to file mm/filemap.c.rej 1 out of 1 hunk FAILED -- saving rejects to file mm/memory.c.rej 1 out of 2 hunks FAILED -- saving rejects to file mm/mprotect.c.rej 1 out of 15 hunks FAILED -- saving rejects to file net/socket.c.rej At this point I'm presuming the the correct course of action is to diff those files one at a time between the "good" patched {.c|.h} files and the "bad" suse-patched {.c|.h} files. Would there be any benefit to try to do the opposite, i.e. apply the LSM patches first, and the SuSE patches second? I'm a little worried since I have to mix 3 patches actually. I suppose there's not much chance of the actual se-linux patches applying to my mixed lsm/suse kernel? Sorry to ask such basic questions, I've never had to do something like this before -- but I'm detirmined to do it right. If any one has advise as far as how to go about this, I'd really appreciate hearing from you. Thanks! - - -- - - ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8+DebQ5u80xXOLBcRAnC3AJ0WJLFJ5BBvH+O1QR7vDKlrAjHj5QCgl7bT ptAtzKpfP4CohTP4UE7pwO4= =YSt4 -----END PGP SIGNATURE-----

5 7

Announce: Project to port SE Linux to SuSE 8.0
by JW 01 Jun '02

01 Jun '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I don't have any idea how far I'll get with this, but I've decided to at least try real hard to get SE Linux to work on SuSE. It seems that there's a few SuSE-users around (besides myself) who want to use SE Linux, so I've start a mailing list and web site hoping that maybe we can work together. Web site (nothing fancy): http://se-linux-suse.cedarcreeksoftware.com/ Mailing list: I don't have any listserve installed currently, so for now, if you want to "join" the mailing list just send me a message telling me what address you want subscribed, and I'll add you to the list. My idea is to post patches and RPMs to the web site as I (and others) manage to build them. If anyone already has anything (SuSE-specific) they want put up on the site, please send the files directly to me via email. If enough interest is shown, I expect to be able to get more "normal" file sharing/mailing list features, maybe CVS. I think this is good enough for now, until there's proven interest. If anyone is aware of any legal issues with this, please notify me ASAP. Since the project's only purpose is to collaborate with fellow SuSE users on SE-Linux, I think I should be fine, but I'd rather be safe then sorry. If possible, I would apprecite hearing from one of the NSA people that this is at least un-officially 'permissable' (I have no expectations of receiving official acknowledgment of any kind). Thanks... hopefully we'll get somewhere with this. - - -- - - ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8+Bz2Q5u80xXOLBcRArdiAJwNZSnJUQ9WYcCoCH80X0+NyodonwCeNn9O yMBPl8o5WLXSiFnbkG7n/0o= =GSnC -----END PGP SIGNATURE-----

1 1

port 1214
by PR 01 Jun '02

01 Jun '02

I can't find port 1214 in /etc/services but still I don't like the fact it is accepted. What should I do do have it dropeed or rejected? piet Jun 1 22:00:58 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=212.64.124.28 DST=213.17.34.237 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=16629 DF PROTO=TCP SPT=63959 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Jun 1 22:00:59 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=212.64.124.28 DST=213.17.34.237 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=18165 DF PROTO=TCP SPT=63960 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Jun 1 22:01:00 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=212.64.124.28 DST=213.17.34.237 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=19701 DF PROTO=TCP SPT=63961 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Jun 1 22:01:02 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=212.64.124.28 DST=213.17.34.237 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=22517 DF PROTO=TCP SPT=63963 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402)

2 3

IPCHAINS -> IPTABLES on SuSE 7.2
by chemiegott＠gmx.net 01 Jun '02

01 Jun '02

Dear Mailinglist ! On our SuSE 7.2-Webserver has IPCHAINS and SuSEfirewall run. Today I've updated from Kernel 2.2 to 2.4 and replaced IPCHAINS with IPTABLES and SuSEfirewall with SuSEfirwall2. All run very well, but one problem remains. With the old configurations, the Users inside my LAN (IP: 192.168.0.x) were able to connect the server (IP: 192.168.0.100 internal, IP:196.123.22.100 external) directly without a proxy or anything else. With the upgrade this is not possible anymore, but i don't want to change anything on the workstations. Do you have any idea, how the Users inside can reach 196.123.22.100 directy. I've tried it with masquerading, but it doesn't work. Thanx in advance, Michael -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 3