February 2003 - openSUSE Security - openSUSE Mailing Lists

YOU error from SLES 8
by intraRedes 17 Feb '03

17 Feb '03

When trying to on-line update from SLES 8 I receive the following error Retrieving patch-3624: "Optional update for glibc" Error: Can't get files. No problems with others patches, could this be my problem ? -- Jorge D. Buchmann | jbuchmann(a)intraredes.com | intraRedes S.R.L. | http://www.intraredes.com

2 1

f-prot virusscanner for email ?
by MichaelHoeller＠t-online.de 16 Feb '03

16 Feb '03

Hello, until now I don't scan my Linux only system for viruses, but since I get more and more MS Word Documents which I open with OpenOffice I fear that I get macro viruses, since OO convertes quite well. Do I need to be afraid of these viruses? With Windows I used in the past f-prot (www.fprot.org) to scan my system, this is now also availabel for linux. How is the experience with this program? I thought of installing the f-prot start command in KMail so that the Mail directory will be scanned when a Mail is received. I this a good idea or is thee a better solution for a dialin connecton? Sorry when these questions are ot so prefessisonal - I still work on the bases of linux. Thanks a lot Michael

7 8

netdate/ntpdate/ntpd, was: [suse-security] gone - logout
by Ulrich Roth 16 Feb '03

16 Feb '03

Hi, > nah, you should use ntpdate instead of netdate: > > "netdate" will set ANY time it receives and > "ntpdate" will validate the time and moves the clock slowly > to the right time No, ntpdate gets the time from a time server and sets the clock to the time it just received from the server, no matter how much the difference is. ntpd (or xntpd) behaves like you described it. In the rcscript for ntpd first ntpdate is called once to set the correct time during the boot process, then ntpd is started to keep the time up to date. If you have a running system with a big time difference, and you want to correct it slowly and not at once, do NOT start ntpd using the rcscript, but start it manually (see which command they use in the rcscript in the "start" section). Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

3 2

Forwarding Problems
by Paul Dorn 12 Feb '03

12 Feb '03

I have a Suse 8.1 install. All of my addresses are public. The Suse machine is the firewall and behind a router. The problem seems to be that the Suse machine will not forward packets. It can talk to the router and to the local network but nothing crosses over. /proc/sys/net/ipv4/ip_forward is 1 I have tried this two ways. SuSEfirewall2 following ll prompts to attempt to setup an OPEN forwarding bridge (to test) and also with rules in place. Neither seem to work. I also installed firewall builder and tried to setup a routing firewall with that. I have been building firewalls in RedHat for a couple of years and have never tried to do this in SUSE and am quite stuck. There is a good deal of inertia regarding staying with SUSE so I would appreciate any suggestions you can make short of reverting to Redhat. Thanks! -- -Paul Dorn http://www.HelpdeskGenius.com Call for Linux support today: 866-365-7401

4 3

the kernel....
by J.Weewer 11 Feb '03

11 Feb '03

I was just reading this, but I'm just curious if the suse 8.1 kernel is vunarable for this... cause I saw 7.2 in the list... and only saw that 2.4.20 wasn't vunarable... and 8.1 uses 2.4.19 as kernel version... http://online.securityfocus.com/bid/6115/info/ Jacques

1 0

Appropriate place for port forward rules
by Daniel Bye 11 Feb '03

11 Feb '03

Hi all, I have just inherited a SuSE 8.0 firewall box and need to add a rule to allow our developers to gain direct access to various web servers out there in the wild. Not ordinarily a problem, except that we also use transparent proxying so our home workers don't need to reconfig their laptops to gain web access over the VPN or the LAN. So, we have added a rule so that the developers can point their browser at http://${hostname}:50000/ and it will be redirected by the firewall to http://${hostname}:80. It seems to work, and so in order not to lose the config, I am trying to figure out which config file is the best place to put the rule so it comes back at next boot time. Where would you recommend I put the rule? The custom config file at /etc/sysconfig/scripts/SuSEfirewall-custom seems the most obvious place to me, but I cannot decide which section it best belongs in. Again, based on pure guesswork, my inlination is to put it in the fw_custom_before_masq() section, but my iptables experience is not what it could be (coming from ipfw on FreeBSD, a much simpler tool, but equally not as flexible). I have read such documentation as I can find about SuSEfirewall2 configuration, but it has not brought me any closer to making the decision! Any insight would be much appreciated. Dan -- Daniel Bye PGP Key: ftp://ftp.slightlystrange.org/pgpkey/dan.asc PGP Key fingerprint: 3D73 AF47 D448 C5CA 88B4 0DCF 849C 1C33 3C48 2CDC _ ASCII ribbon campaign ( ) - against HTML, vCards and X - proprietary attachments in e-mail / \

2 2

stability problem with VPN between SuSE 8.1 and Cisco PIX515
by Philipp Rusch 11 Feb '03

11 Feb '03

Hello all, we sucessfully setup up a VPN between two sites with a SuSE 8.1 system on one end and a Cisco PIX 515 on the other. I take care of the SuSE system ... I use FREES/WAN 1.98b, we had to use preshared keys because of the policy on the main site, we have a dial-up on our (remote ) site, with a fixed IP and a callback- setup via ISDN, we do BOD (2x64k) with ibod. Main site is having a leased line with 2 MBit and a subnet with 16 "real" ip adresses behind the router. The problem: IPSec is talking perfectly to the other site on the first startup. Tunnel is built up and we can use the systems on the other site perfectly. But: we have a timeout, so if the line is idle for more than 90 seconds, we take the dial-up link down. If we take it up now again, the tunnel is not renegotiated properly, that is, my logs show that freeswan tries, but does not get the right responses in time. The other site swears, that they are doing this correctly, I doubt this. As a workaround, I tried to include the "rcipsec restart" command in the IP-UP and "rcipsec stop" command in the IP-DOWN skripts of the ISDN link. But I dont think this is very elegant, I somehow miss a possibility to control the ISDN link from within FREES/WAN. Has anybody tried something similar and can advise ? Thank you in advance, Philipp Rusch

2 1

gone - logout
by Pep Serrano 11 Feb '03

11 Feb '03

Hello friends, I getting scared when I read the following lines on my "last": pep@montblanc:~> last pep pts/1 Sun Feb 2 20:02 still logged in pep pts/0 Sun Feb 2 20:00 still logged in P***(*** ****P***h*** ********P******* Thu Jan 1 01:00 gone - no logout pep pts/2 Sat Feb 1 23:43 - 23:44 (00:00) pep pts/2 Sat Feb 1 23:35 - 23:37 (00:01) pep pts/1 Sat Feb 1 23:34 - 23:44 (00:10) simon pts/0 pooladsl-a-25-7. Sat Feb 1 22:55 - 01:14 (02:19) camio pts/0 Sat Feb 1 20:59 - 21:55 (00:55) P***h*** ****P***(*** ***** Thu Jan 1 01:00 gone - no logout ... Anyone has any idea where does it come from? I'm going to research in detail in every log file. Any suggestions about what to look for? Thanks, Pep.

9 15

How to open a protocol with SuSEfirewall2
by T. Ermlich 09 Feb '03

09 Feb '03

Hello there, maybe I misunderstood the SuSEfirewall2 describtions, but how to open a protocol? Ports are opened eg. by the lines FW_SERVICES_EXT_TCP="..." FW_SERVICES_EXT_UDP="..." But how to handle protocols? Thanks in advance! c y Torsten

3 4

Re: [suse-security] apache log "GET http://irc.stealth.net:5558"
by Richard Barrington 09 Feb '03

09 Feb '03

Someone is seeing if your apache will proxy for them. If you are using virtual hosting, and have a default virtual host set, it likely returned that. >Hello, in my apache log I find > >**.**.***.*** - - [08/Feb/2003:21:23:46 +0100] "GET >http://irc.stealth.net:5558/ HTTP/1.1" 200 362 > >What is happening here? I don't host an irc server. How can apache return >a page that does not exist but is a website or irc server ((as judged by >the 200 response)? Is this an error in my setup? Thanks, Ruud

1 0