July 2002 - openSUSE Security - openSUSE Mailing Lists

openssh 3.4p1-5 src.rpm has error in spec file
by Willy Weisz 09 Jul '02

09 Jul '02

The spec file of openssh-3.4p1-5.src.rpm has a spec file that contains the 2 lines: aclocal autoconf that produce an error and thus abort the build run. They should be deleted as the original tar ball that is the basis of the package doesn't contain a config.in file but already the aclocal.m4 file that aclocal is supposed to create. Regards Willy ----------------------------------------------------------- Willy Weisz European Centre for Parallel Computing at Vienna (VCPC) Liechtensteinstrasse 22 A-1090 Wien Tel: (+43 1) 4277 - 38824 Fax: (+43 1) 4277 - 38818 e-mail: weisz(a)vcpc.univie.ac.at

4 3

AW: [suse-security] apache do not start after upd
by Schoenwaelder Oliver 09 Jul '02

09 Jul '02

Hi, we're having almost the same problem: after the last update it's not possible to run both ssl and php4 modules. The first request leads to a segmentation fault as describe in emails before. And I tried with reinstalling all the updated again. For the moment we can work without SSL. So it's not really an issue for use. But maybe for others... Regards, Olly -----Ursprüngliche Nachricht----- Von: Oliver Bleutgen [mailto:meinbugtraq@gmx.net] Gesendet: Dienstag, 9. Juli 2002 11:08 An: admin(a)i-concept.de; suse-security(a)suse.com Betreff: Re: [suse-security] apache do not start after upd > Hi list, > I have a strange problem with apache 1.3.19 running on SuSE7.0: > After I have done the last security update from 18 June to apache > 1.3.19-115 I am not able to start the webserver with the mod_ssl > and/or mod_php (mod_php is for version php3). It is only possible to > start the webserver with "httpd -f /etc/httpd/httpd.conf" . If I start > the server with "/sbin/init.d/apache start" it seemed to be OK until I > do a request to the webserver: Then I got the message in the > apache-error-log: "[Mon Jul 8 18:32:50 2002] [notice] child pid 9736 > exit signal Segmentation fault (11)" and nothing happens in my > browser! The same thing happens if I start the server with "httpd -f > /etc/httpd/httpd.conf -D SSL". > If I try to start the server with the option "-D PHP" I got a message > "sqlinit: DBROOT must be set !!!" But the DBROOT is set! And the > server didn't start. > Anybody there who had the same problem and could help me? > Is it perhaps the php-modul which isn't supported anylonger? I need > this machine running php3 not php4 ! Ruediger, have you updated the mod_php etc. packages from 28.April 2001? See http://www.suse.de/de/support/download/updates/70_i386.html If not, do it and try again (with /sbin/init.d/apache start). This will solve the problem with the segfaults, and therefore maybe everything else is no issue anymore. cf. the thread "Apache upgrade from SuSE?" cheer -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

Yast2 (7.3) problems with YOU
by Patrick Sannes 09 Jul '02

09 Jul '02

Hello, I have a problem, my yast 2 from suse 7.3 wont online update anymore. Sometimes it brakes the connection at the beginning of YOU sometimes after downloading +/- 3 pakages informations. Someone can help me with this. I need the security updates. Patrick

2 1

RE: [suse-security] Password Encryption
by Peer Stefan 09 Jul '02

09 Jul '02

From: "Christian Röpke" [mailto:christian.roepke@directbox.com] > i know, that it is very important to hold my system clean. yepp :) > but many systems are not clean and then the cracker hasn't > any chance to crack the shadow-file, if the passwords are > encrypted by des3 or aes. even des3 and aes are "crackable". it's important to not be able to derive the password from the encrypted string, which means you need one-way hash functions like md5, sha, or whatever you like (sha is considered more secure than md5). if there really is an attack against the md5-algorithm (with real i mean useable agains real live systems) then we're all in big big trouble. most weaknesses of an algorithm are theoratically and [mostly] unuseable against real live systems. > and these algorithms are the state of the art not 3des or des3 (it's the same) - it's not state of the art, although it's widely used. (it's just des 3 times with 2 different keys (there are 3 possible ways to use the keys: 1-1-2, 1-2-1, 2-1-1), which equals a key-length of 112 bits which is somewhat weak). it is used because of its speed for session-keys, not for passwords. > christian > > p.s. : it exits a attack against md5, but i can't describe > details at the moment, i ask my prof. i really want to know more about this attack. please ask your professor and post the details ;-) regards, stefan

2 1

Re: [suse-security] apache do not start after upd
by Oliver Bleutgen 09 Jul '02

09 Jul '02

(Sorry for the long quote, but I think it helps to avoid confusion in this case.) > I have been forced to install the stuff from scratch, using mod_ssl, > mod_php > and apache directly from original locations. > Change into mod_ssl directory, do a (fix path to new apache sources) > ./configure --with-apache=../apache_1.3.26/ --with-ssl=SYSTEM > --with-mm=SYST > EM > change into apache-dir and do a > ./configure --prefix=<you new > path> --enable-rule=EAPI --enable-module=all --enable-shared=max > --<various > prefixes for SuSE directorys, > i.e. --libexecdir=/usr/lib/apache --sysconfdir=/etc/httpd etc...> > --<suexec > if desired> > then build apache with make, copy the ssl-certs and httpd you are > currently > using into a temp dir, make a backup of /usr/lib/apache and the > /sbin/init.d/apache script and uninstall all SuSE rpms. make install, > restore certs, .conf and init script, copy the missing modules from the > backup of /usr/lib/apache into the new libexec dir (use a cp -i, no > overwrite of new modules), > change into mod_php and do a configure with loads of options, make, make > install. > This is not quick but dirty, but all modules work for me. Take your time > to > fix path, get the smaller module sources and recompile them if you wish. > If > the httpd refuses to start, remove all <IfDefine> and <IfModule> > statements >>from httpd.conf and comment the stuff you're not using out (i.e.backhand, > dav), starting the server with simply ./httpd > Maybe this helps busted 7.0 users to switch to sources :-) I am also a 7.0 user and didn't need to do all that. Please look at the recent posting to this list, esp. "Apache upgrade from SuSE ?" cheers, oliver

1 0

Re: [suse-laptop] 3com 11Mbps WLAN OfficeConnect
by Markus Kohli 09 Jul '02

09 Jul '02

Am Dienstag, 9. Juli 2002 14.41 schrieb igor boehm: > Hi Markus > > I had the same problem with a 3Com 3CRWE737 96B-E1 which is a wireless > PCMCIA card. Look at the SuSE homepage and get the PCMCIA update RPM and > install it. after that it should work just fine ;-) The PCMCIA update does > basically the following: It uses the Orinoco Drivers instead of the wlan-ng > drivers and that is in my opinion just what you need in order to get you > WLAN PCMCIA card running. > Hope it works ;-) > Nope, that don't help. My problem looks like this: Jul 9 14:49:54 karlchen cardmgr[12914]: unsupported card in socket 1 Jul 9 14:49:54 karlchen kernel: cs: memory probe 0xa0000000-0xa0ffffff: clean. Jul 9 14:49:55 karlchen cardmgr[12914]: product info: "3Com", "3CRSHPW_96 Wireless LAN PC Card" Jul 9 14:49:55 karlchen cardmgr[12914]: manfid: 0x0101, 0x0696 function: 6 (network) Thanks anyway... Markus -- Avoid messes: cover cat before microwaving.

1 1

[suse-security] Password Encryption
by "Christian Röpke" 09 Jul '02

09 Jul '02

Hello @all, after my installation of suse linux 8.0 yast2 ask me, whether i encrypt my passwords with DES or MD5. i think, both of these algorithms are not secure !!! 1. DES is a encryption algorithmen, that is cracked by NSA (ca. 1990) (also by other secret services) and by the electronic frontier foundation (1999). this algorithm is NOT secret today (des-cracker : about 100.000 dollar) 2. MD5 is a hash-function, so you can't encrypt any passwords with this algorithm. question : where is the passowrd security by suse linux ??? greetings christian röpke __________________________________________________ Gestalte Dein eigenes Handy-Logo unter http://www.yesms.de Ihre eMails auf dem Handy lesen - ohne Zeitverlust - 24h/Tag eMail, FAX, SMS, VoiceMail mit http://www.directbox.com

3 2

RE: [suse-security] Password Encryption
by Peer Stefan 09 Jul '02

09 Jul '02

hi, From: "Christian Röpke" [mailto:christian.roepke@directbox.com] > Hello @all, > > after my installation of suse linux 8.0 yast2 ask me, whether > i encrypt my passwords with DES or MD5. > > i think, both of these algorithms are not secure !!! DES is not secure, though it's still widely used (3des and some other derivates) > 1. DES is a encryption algorithmen, that is cracked by NSA > (ca. 1990) (also by other secret services) and by the > electronic frontier foundation (1999). this algorithm is NOT > secret today (des-cracker : about 100.000 dollar) the algorithm should never be the [only] secret. > 2. MD5 is a hash-function, so you can't encrypt any passwords > with this algorithm. no, but you don't have to store the password. whenever you type your password the md5-sums will be compared, so if you don't know the secret, you'll stay locked out. and there is no mathematical function to deduct the password from the sum. > question : where is the passowrd security by suse linux ??? this algorithms are not suse-specific, it's state of the art in unix. /etc/passwd is a very old file and it's structure did not change [much] since the 70ies. nowadays passwords are [should be] shadowed, in order to prevent users from reading the encrypted strings and deciphering them. if that's still not the security you want, feel free to implement whatever pam-authentication you want. regards, stefan

1 0

Re: [suse-security] apache do not start after upd
by ic_admin 09 Jul '02

09 Jul '02

Hi Armin, thanks, you are right. I was in vacancies and didn't read all the secure mails until now. My problem is now solved really quick, many thanks for this info. Regards Ruediger Armin Schöch wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi Rüdiger ! > > >>After I have done the last security update from 18 June to apache >>1.3.19-115 I am not able to start the webserver with the mod_ssl and/or >>mod_php (mod_php is for version php3). It is only possible to start the >>webserver with "httpd -f /etc/httpd/httpd.conf" . >>If I start the server with "/sbin/init.d/apache start" it seemed to be >>OK until I do a request to the webserver: Then I got the message in the >>apache-error-log: "[Mon Jul 8 18:32:50 2002] [notice] child pid 9736 >>exit signal Segmentation fault (11)" and nothing happens in my browser! >>The same thing happens if I start the server with "httpd -f >>/etc/httpd/httpd.conf -D SSL". >> > > This has been discussed on this list last week. Have a look at the > archives at: > http://lists.suse.com/ > > Short summary: > There has been an update for a number of apache modules in april. > Install the newest versions of the modules from the SuSE FTP-server > and you should be fine. > > HTH, > Armin > > - -- > Am Hasenberg 26 office: Institut für Atmosphärenphysik > D-18209 Bad Doberan Schloss-Straße 6 > Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY > Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 > WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.6 (GNU/Linux) > Comment: Weitere Infos: siehe http://www.gnupg.org > > iD8DBQE9KeSlG8Xv4GxznLoRAu+KAKCporlZejqCyOnR7b8MLC/60vMcDgCgrfVB > xyrTedaGQBBVL2VsVcpy4FM= > =JlJh > -----END PGP SIGNATURE----- > > > > >

1 0

Re: [suse-security] apache do not start after upd
by Oliver Bleutgen 09 Jul '02

09 Jul '02

> Hi list, > I have a strange problem with apache 1.3.19 running on SuSE7.0: > After I have done the last security update from 18 June to apache > 1.3.19-115 I am not able to start the webserver with the mod_ssl and/or > mod_php (mod_php is for version php3). It is only possible to start the > webserver with "httpd -f /etc/httpd/httpd.conf" . > If I start the server with "/sbin/init.d/apache start" it seemed to be > OK until I do a request to the webserver: Then I got the message in the > apache-error-log: "[Mon Jul 8 18:32:50 2002] [notice] child pid 9736 > exit signal Segmentation fault (11)" and nothing happens in my browser! > The same thing happens if I start the server with "httpd -f > /etc/httpd/httpd.conf -D SSL". > If I try to start the server with the option "-D PHP" I got a message > "sqlinit: DBROOT must be set !!!" But the DBROOT is set! And the server > didn't start. > Anybody there who had the same problem and could help me? > Is it perhaps the php-modul which isn't supported anylonger? I need this > machine running php3 not php4 ! Ruediger, have you updated the mod_php etc. packages from 28.April 2001? See http://www.suse.de/de/support/download/updates/70_i386.html If not, do it and try again (with /sbin/init.d/apache start). This will solve the problem with the segfaults, and therefore maybe everything else is no issue anymore. cf. the thread "Apache upgrade from SuSE?" cheer

1 0