November 2003 - openSUSE Security - openSUSE Mailing Lists

FreeS/WAN unresolved symbol
by Stefano Bertotti 06 Nov '03

06 Nov '03

Hello, running FreeS/WAN on SuSE 9.0 Professional I have the following results: Nov 6 04:14:41 linux ipsec_setup: Starting FreeS/WAN IPsec 1.99... Nov 6 04:14:47 linux ipsec_setup: /lib/modules/2.4.21-99-default/kernel/net/ipv4/ipsec/ipsec.o: unresolved symbol ipsec_sa_acquire_R098996dd Nov 6 04:14:47 linux ipsec_setup: /lib/modules/2.4.21-99-default/kernel/net/ipv4/ipsec/ipsec.o: unresolved symbol sysctl_ipsec_debug_ipv4_Rfed0a615 Nov 6 04:14:47 linux ipsec_setup: /lib/modules/2.4.21-99-default/kernel/net/ipv4/ipsec/ipsec.o: unresolved symbol spd_find_by_selector_R8280444c Nov 6 04:14:47 linux ipsec_setup: /lib/modules/2.4.21-99-default/kernel/net/ipv4/ipsec/ipsec.o: unresolved symbol ipsec_sa_update_lifetime_R44ee2b99 Nov 6 04:14:47 linux ipsec_setup: /lib/modules/2.4.21-99-default/kernel/net/ipv4/ipsec/ipsec.o: unresolved symbol sysctl_ipsec4_icmp_Rd8641165 Nov 6 04:14:47 linux ipsec_setup: /lib/modules/2.4.21-99-default/kernel/net/ipv4/ipsec/ipsec.o: unresolved symbol ipsec_sa_kmalloc_R94edf987 Nov 6 04:14:47 linux ipsec_setup: /lib/modules/2.4.21-99-default/kernel/net/ipv4/ipsec/ipsec.o: unresolved symbol ipsec_sp_put_R894e59b4 Nov 6 04:14:47 linux ipsec_setup: /lib/modules/2.4.21-99-default/kernel/net/ipv4/ipsec/ipsec.o: unresolved symbol ipsec_sp_get_R16cde940 Nov 6 04:14:47 linux ipsec_setup: /lib/modules/2.4.21-99-default/kernel/net/ipv4/ipsec/ipsec.o: unresolved symbol ipsec_sa_put_Raf4438b8 Nov 6 04:14:47 linux ipsec_setup: /lib/modules/2.4.21-99-default/kernel/net/ipv4/ipsec/ipsec.o: unresolved symbol sadb_find_by_sa_index_R2f7bced7 Nov 6 04:14:47 linux ipsec_setup: /lib/modules/2.4.21-99-default/kernel/net/ipv4/ipsec/ipsec.o: unresolved symbol sysctl_ipsec4_tos_R7213d7a3 Nov 6 04:14:47 linux ipsec_setup: /lib/modules/2.4.21-99-default/kernel/net/ipv4/ipsec/ipsec.o: unresolved symbol sysctl_ipsec_replay_window_Rc6f48b8b Nov 6 04:14:47 linux ipsec_setup: /lib/modules/2.4.21-99-default/kernel/net/ipv4/ipsec/ipsec.o: unresolved symbol sa_index_init_R8b6efd49 Is there a patch to fix this problem ? Thanks in advance, Ste

2 1

SUSE 9.0 Wireless Broken
by Benjamin Arai 05 Nov '03

05 Nov '03

OK, I have been using SUSE for a couple of versions now and my wireless cards all worked in SUSE 8.2. Orinoco Cisco 350 Xircom In SUSE 9.0 they all detect but for some reason I can not turn them on. I am not sure what is going on but I think that there is a bug in the yast config somewhere in the new version. When I attempt to turn on the cards the system cannot find it. I have tried wlan-pcmcia, eth0, eth1, wlan0, and etc. I know that some of the names I tried may have been invalid but I am getting despirate. Also, I tried installing 8.2 and installing the wirless card and it worked. Then I tried upgrading to 9.0 and it still worked, so I am assuming there is something wrong with the configuration of new wireless cards. I did cardctl ident and everything else. The card is there and it does detect correctly but it just doesn't work. Help!!! -- Benjamin Arai Araisoft Corp. benjamin(a)araisoft.com Phone: (626) 390-8973

3 2

好康報乎你知
by 艾咪 05 Nov '03

05 Nov '03

charset="CHINESEBIG5"

1 0

Re: Squid ldap auth
by Markus Feilner 05 Nov '03

05 Nov '03

Hello Dzac, Hello List, That's a question i was asked about pretty often... so I post it also to this list... Am Dienstag, 4. November 2003 18:45 schrieb Dzac: > Hello, > > I was wondering if you can send me your squid.conf file for the > squid_ldap_auth configruation. I need it urgently to setup with the > collaboration server here in my office. > > Your help is much appreciate. > > thanx, > > Dzac. I must look for the config only for ldap-auth, We skipped ldap-auth, because there was apparently no easy possibility for single-sign-on to ADS. This config is for: squid doing auth against an ADS Server and permits access only to users belonging to group www_users in ADS, who have successfully auth-ed. furthermore it runs in two instances (sorry - correct english?) and uses dansguardian for contentfiltering and sarg for logfile analysis via webmin. I would apreciate any constructive feedback, which helps to make it more secure! prerequisites (which work in my case, ;-) may be not up to date) suse 8.1 + all possible development tools ;-) - don't forget to deinstall them afterwards ! squid-2.5-stable 1,2,3 - work all, don't know about beta 3.0 - [self-compiled, because of a lack of a rpm with appropriate support for needed auth modules.] samba > 2.2.7 - prefer 2.2.8 or newer, it's safer! You need winbind! dansguardian 2.6.1-3 ---------------squid.conf------------------------------ logfile_rotate 7 hierarchy_stoplist cgi-bin ? #X.X.X.X. must be ip of your box! http_port X.X.X.X:8080 http_port 127.0.0.1:3128 cache_peer 127.0.0.1 parent 8081 0 no-query no-digest no-netdb-exchange\ default visible_hostname XXXXX acl QUERY urlpath_regex cgi-bin \? no_cache deny QUERY auth_param basic children 5 auth_param basic realm Squid proxy-caching web server auth_param basic credentialsttl 2 hours acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl SSL_ports port 443 563 acl Safe_ports port 80 acl Safe_ports port 21 acl Safe_ports port 443 563 acl Safe_ports port 70 acl Safe_ports port 210 acl Safe_ports port 1025-65535 acl Safe_ports port 280 acl Safe_ports port 488 acl Safe_ports port 591 acl Safe_ports port 777 acl CONNECT method CONNECT http_access allow localhost http_access allow manager localhost http_access deny manager http_access deny !Safe_ports auth_param ntlm program /usr/sbin/wb_ntlmauth auth_param ntlm children 5 auth_param ntlm max_challenge_reuses 0 auth_param ntlm max_challenge_lifetime 2 minutes acl masosoft url_regex -i "/etc/squid/badlist" http_access deny CONNECT !SSL_ports acl erlaubt url_regex -i "/etc/squid/goodlist" http_access deny masosoft acl unwanted_files urlpath_regex -i \.eml$ \.exe$ \.vbs$ \.vb$ # Auth with perl skript wbinfo_group.pl acl test proxy_auth REQUIRED external_acl_type wb_group %LOGIN /usr/sbin/wbinfo_group.pl acl aclname external wb_group WWW_USERS http_access allow erlaubt http_access allow manager localhost http_access deny manager http_access deny !Safe_ports http_access deny unerwünschte_dateien http_access deny CONNECT !SSL_ports http_access allow aclname http_access deny all http_reply_access allow all icp_access allow all coredump_dir /var/squid/cache #error_directory /usr/local/squid/share/errors/German cache_mgr squid cache_effective_user squid cache_effective_group users -- Mit freundlichen Grüßen Markus Feilner -- Linux Solutions, Training, Seminare und Workshops - auch Inhouse Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

1 0

RE: [suse-security] Messenger 6
by Knut Erik Hauslo 05 Nov '03

05 Nov '03

See if you can find something here: Windows Messenger in Windows XP: Working With Firewalls and Network Address Translation Devices http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodt echnol/winxppro/deploy/worki01.asp Cheers -----Original Message----- From: Ariel Sabiguero [mailto:asabigue@fing.edu.uy] Sent: Wednesday, November 05, 2003 8:41 AM To: suse-security(a)suse.com Subject: [suse-security] Messenger 6 Hi! I have been using gnugk to manage h323 through a gatekeeper/proxy, but I am not able to work it out with the new messenger. I am natting a 10.0.0.0/24 network, and some users *want* to use only the newest messenger, that I was not able to configure to detect or use the gatekeeper.... Has anyone found a solution? Either conntrack, proxy or whatever? Regards. Ariel -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] FreeSwan <-> CheckPoint
by J J 05 Nov '03

05 Nov '03

You don't have to change ipsec.conf Instead change ipsec.secrets Where you have a line that says... aaa.bbb.ccc.ddd www.xxx.yyy.zzz : PSK "Rumpelstielzchen" I am assuming that aaa.bbb.ccc.ddd is the external (internet) IP address of the Checkpoint box and www.xxx.yyy.zzz is the external (internet) IP address of your Freeswan gateway? I can't see what you have in your ipsec.conf for the leftid value because you have written leftid=@.... ...that's fine - no point in telling mailing list private details! Just use whatever you have there in your ipsec.secrets file instead of the external (internet) IP address of your Freeswan gateway. Make sure to include the @ symbol as well!! So your ipsec.secrets file will look something like... # Must be same on both; generate on one and copy to the other. aaa.bbb.ccc.ddd @.... : PSK "Rumpelstielzchen" And that should be all that you need! Because you have not changed ipsec.conf you will not need to restart ipsec but you will need to use this command... ipsec auto --rereadsecrets ...so that the pluto daemon will re read the secrets file. Then try to bring up the connection again and tell us what happens! Good luck, Carl >From: "Thorsten Marquardt" <thom(a)kaupp.chemie.uni-oldenburg.de> >To: c_peto(a)hotmail.com (J J) >Subject: Re: [suse-security] FreeSwan <-> CheckPoint >Date: Tue, 4 Nov 2003 19:36:48 +0000 (MEST) > >Hi, > > > > > Yes. > > > > The lookup of PSKs in ipsec.secrets uses "leftid" not "left" if it can. > > > > It's confusing because if you don't set "leftid" then it will default to >the > > same value as "left"! > >I'm not sure that I understand you right. So would you advice me to delete >leftid >from ipsec.conf or build an ipsec.secrets like: > >[...] ># Must be same on both; generate on one and copy to the other. >@the.left.id @the.right.id : PSK "Rumpelstielzchen" > >thank you so far. > >Thom > >-- > >------------------------------------------------------------------- >bye bye (c) by Thom | Thorsten Marquardt > | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de > | Member of the pzt project. > | http://kaupp.chemie.uni-oldenburg.de/pzt >------------------------------------------------------------------- > > _________________________________________________________________ On the move? Get Hotmail on your mobile phone http://www.msn.co.uk/msnmobile

2 2

Messenger 6
by Ariel Sabiguero 05 Nov '03

05 Nov '03

Hi! I have been using gnugk to manage h323 through a gatekeeper/proxy, but I am not able to work it out with the new messenger. I am natting a 10.0.0.0/24 network, and some users *want* to use only the newest messenger, that I was not able to configure to detect or use the gatekeeper.... Has anyone found a solution? Either conntrack, proxy or whatever? Regards. Ariel

1 0

RE: Re: [suse-security] suse to be bought by novell
by Barry Gill 05 Nov '03

05 Nov '03

Mathias Homann <admin(a)eregion.de> wrote the Nov 4, 2003 5:01 PM: > no, but the "OMG we're all going to die" thread is over there... > /me points at the suse-linux mailing list. Not sure why the panic yet. Novell has had a very long and involved history with Linux, and has been a strong commercial supporter of the opensource movement. Why assume that SuSE will stop its good work because Novell is interested in it? All the real server stuff is not free, the desktop connectors etc etc are not free. Sure, many of us can get by on the freeware GPL stuff, but Novell will take (as they are with Ximian, my desktop of choice) SuSE commercial products and pump money into making them huge contenders in the marketplace. Keeping the Opensource movement alive is crucial to keep programming skills and new ideas moving up and up... my 2c...

1 0

Excessive dropped connection attempts
by Hans-Peter Jansen 04 Nov '03

04 Nov '03

Hi, after updating to 9.0 Prof. and refining my firewall setup, I noticed excessive dropped connection attempts to ascending ports from 4 hosts this sunday in my logs. Since this troubled me a little, I wrote a python script in order to analyse such circumstances and take countermeasures (reconnect to tdsl). Here's, what it found so far: 42775 dropped connections during Oct 28 04:24:06 and Nov 04 04:05:43 Host 217.255.167.30 : 13058 [30.5%] 30.167.255.217.in-addr.arpa domain name pointer pD9FFA71E.dip.t-dialin.net. TCP: 13058 attempts during Nov 01 19:38:50 and Nov 02 14:53:12 from DPT 64241 Host 217.236.138.232: 5029 [11.8%] 232.138.236.217.in-addr.arpa domain name pointer pD9EC8AE8.dip0.t-ipconnect.de. TCP: 5029 attempts during Nov 01 19:38:50 and Nov 02 04:24:14 from DPT 64241 Host 217.255.173.8 : 2259 [5.3%] 8.173.255.217.in-addr.arpa domain name pointer pD9FFAD08.dip.t-dialin.net. TCP: 2259 attempts during Nov 02 14:53:26 and Nov 02 18:13:17 from DPT 64241 Host 217.236.138.135: 1209 [2.8%] 135.138.236.217.in-addr.arpa domain name pointer pD9EC8A87.dip0.t-ipconnect.de. TCP: 1209 attempts during Nov 02 16:26:29 and Nov 02 18:13:08 from DPT 64241 53.370 lines processed in 1:04 min Note, that the dns lookups are done this evening. It appears, that all attempts origin from a single port: 64241 and that host1 lost its connection around 14:53:12, and restarted its scan at 14:53:26 as host3. I've reconnected dsl around 18:14. This qualifies as a dump, brute force, but nevertheless hostile attack, doesn't it? What would you do in such a case? Somebody, who tried to sue such an orginator, may listening here? Pete

1 0

Re: [suse-security] Trace user logins in SAMBA
by J J 04 Nov '03

04 Nov '03

Thank you Ian! Does that solve your question João Reis? As Ian has kindly pointed out, at log level one you can see a connection to the netlogon share. This is probably a very good indicator of a login. The windows domain login will look at this share for net login batch scripts/profiles, etc. during the domain login process. So use something like... sed -ne '/make_connection/{;N;/netlogon/p;}' /var/log/smbd.log ...or use Perl or a shell script or something like that (my sed scripting is poor!) Having looked further I've got a nasty suspicion that the alternative is to debug IPC$ type RPC calls!! :o >From: Ian David Laws <ian(a)the-laws-clan.de> >Reply-To: ian(a)the-laws-clan.de >To: suse-security(a)suse.com >Subject: Re: [suse-security] Trace user logins in SAMBA >Date: Tue, 4 Nov 2003 19:22:40 +0100 > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >On Tuesday 04 November 2003 13:10, J J wrote: > > My knowledge is somewhat sketchy and from Samba 2.2.1a so forgive me if > > it's no use. > > ><snip> >Entering this "log file = /var/log/%m.log" in the smb.log >this make for each indivual Windoze machine a log. When someone logs in >from >that machine you should find this information > [2003/03/04 18:02:45, 1] smbd/service.c:make_connection(615) > xxxx (192.168.100.4) connect to service netlogon as user xxxx (uid=502, >gid=100) (pid 24501) >And that is at log level = 1 > >Ian > >- -- >A child of five would understand this. >Send someone to fetch a child of five. >Groucho Marx > >- ---------------------------------------------------- >This mail has been scanned for virus by >AntiVir for UNIX >Copyright (C) 1994-2003 by H+BEDV Datentechnik GmbH. >PGP ID: 589F8449 >Fingerprint: EB1C FACF 6BEB 540E 8AC0 F04E 2A25 A2F1 589F 8449 >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.0.6 (GNU/Linux) >Comment: For info see http://www.gnupg.org > >iD8DBQE/p+5wKiWi8VifhEkRAiLUAKCLk7F1B9CMqfBjqs7gmrqw7rB2ggCeI6cx >ME6JymmNzT/bkKSXKderoCg= >=Wlvx >-----END PGP SIGNATURE----- > > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > _________________________________________________________________ Tired of 56k? Get a FREE BT Broadband connection http://www.msn.co.uk/specials/btbroadband

1 0