September 2003 - openSUSE Security - openSUSE Mailing Lists

Linux hard & soft solutions
by Radu Voicu 09 Sep '03

09 Sep '03

Dear List Colleagues, As a former SuSE reseller in Romania, I took the liberty to introduce you this opportunity that you may have to increase your presence and sales in our country: http://www.load.ro/index_en.html - The first edition of Linux Hardware and Software Solutions Expo in Romania I hope that you may not consider this e-mail as spam. Best regards, Radu Voicu

1 0

Re: [suse-security] KLIPS Debugging no longer supported in Suse 8.2 ????
by r.maurizzi＠digitalpha.it 09 Sep '03

09 Sep '03

> It seems that KLIPS debugging is no longer possible since > SuSE 8.2. NAT-Traversal patch isn't enabled, too. > What's the point behind this change?? Probably, the fact that in 2.4.22 crypto routine were added in the kernel, and IPSEC changed a lot. > I've tried installing the km_freeswan package and compiling > stuff there but just get compile errors. You should: - install the kernel sources for your running kernel - copy the config for your running kernet to the source dir (usually, go in /usr/src/linux, and do zcat /proc/config.gz > .config) - "make menuconfig" and check the options. Save the config and do "make dep" - go in /usr/src/kernel_modules/zz_freeswan - type "make insert", this inserts the IPSEC patches in the kernel tree - go back in /usr/src/linux, do "make menuconfig" and go in the Network Option to check the IPSEC settings - recompile the kernel :-) Beware: doing so will trash all other SuSE kernel modules that are added independently from the main kernel sources... check that you do not use any module that have its sources in a km_*.rpm packages, and eventually compile it. Ciao, Rob! P.S. If someone has a better way to do some of the things II explained here, comments and corrections are VERY welcome :-)

1 0

KLIPS Debugging no longer supported in Suse 8.2 ????
by J J 09 Sep '03

09 Sep '03

It seems that KLIPS debugging is no longer possible since SuSE 8.2. What's the point behind this change?? More importantly, how do I fix this so I can get critical debugging information out once more and set up my VPN!! I've tried installing the km_freeswan package and compiling stuff there but just get compile errors. Help!! C. Peto _________________________________________________________________ Find a cheaper internet access deal - choose one to suit you. http://www.msn.co.uk/internetaccess

1 0

k_deftl 2.4.20-100 problems accessing IIS sites through OpenBSD 3.4 Beta firewall
by Sigfred Håversen 08 Sep '03

08 Sep '03

SuSE clients running k_deftl kernel 2.4.20-100 have problems accessing some Microsoft IIS web servers, if they are behind an OpenBSD 3.4 Beta firewall with packet normalizations using the new "reassemble tcp" option in "scrub". After reinstalling the default kernel for the 8.2 Pro from the DVD, the problem goes away. Non-IIS sites does not have this problem. Some more information about this option may be found (with URL broken in three lines) : http://www.openbsd.org/cgi-bin/man.cgi?query=pf.conf&apropos=0 &sektion=0&manpath=OpenBSD+Current&arch=i386&format=html #TRAFFIC+NORMALIZATION /Sigfred For your information, here is the e-mail I sent to the OpenBSD packet filter mailing list : Not sure if this should be reported as a bug or not, so please bear with me. A "scrub on $ext_if reassemble tcp" will deny some SuSE clients access to some Microsoft IIS webservers. This appears to be an issue with SuSE's latest kernel (2.4.20-100) only. I'm not sure it it's the IIS servers themselves or some other strange things happening, but the following sites (using IIS, according to netcraft.com) cannot be browsed : www.zmag.org www.svd.se www.dustin.se www.xp-data.com www.itpower.se While the following works www.mentice.com The Windows, Mac and OpenBSD clients behind the firewall can access those sites just fine. If I use "scrub on $ext_if", then there is no problems with SuSE clients. I rebuilt kernel/userland yesterday using -current.

1 0

YOU kernel update - need to rebuild modules?
by Markus Lorch 08 Sep '03

08 Sep '03

Hi, I am running a dual-Xeon system with Suse 8.2 Kernel 2.4.20, YOU recently installed a new kernel (and kernel sources) with security updates after which our IBM 4758 crypto coprocessor stopped working (no longer visible to the pkcs11 library). the 4758 was still accessible with utility functions though. The old module (also compiled for 2.4.20 on the same system) was still loadable. I've tried to recompile the cryptolx.o (the IBM4758 driver mod) but receive an incompatible version number when I try to load it: It reports that it was compiled for kernel 2.4.20-4GB but we are now running 2.4.20-64GB-SMP (the system was always running a SMP kernel) When I force-load the new module the module loads and reports fine but the system completely freezes upon an attempted access to the 4758 without any messages. Is there something in /usr/src/linux that I need to manually update? (it seems like the whole source tree was replaced by the YOU update, is there maybe a problem in the new source tree?) The module source includes linux/modversions.h ... do I need to change something? How can I built a kernel from scratch using the SuSE default kernel configuration (Just want to change back to 4GB in case thats the source of my trouble) Any tips/similar experiences would be greatly appreciated? Thanks Markus

2 2

8.2 i386 boot.iso different between FTP sites
by J. Lewis Muir 08 Sep '03

08 Sep '03

The 8.2 i386 boot CD ISO image (boot/boot.iso) does not seem to be the same on all FTP servers. The file sizes are the same but the MD5 hashes are not. Here are the MD5 hashes I computed for the boot.iso file from 4 different FTP sites: ftp://ftp.suse.com/pub/suse/i386/8.2/boot/boot.iso 0aa2a5c7038c67c4df0893301711cd53 ftp://mirror.mcs.anl.gov/pub/ftp.suse.com/i386/8.2/boot/boot.iso 0aa2a5c7038c67c4df0893301711cd53 ftp://chuck.ucs.indiana.edu/linux/suse/suse/i386/8.2/boot/boot.iso 453e986395cb861df4a1e64340570e1c ftp://ftp-linux.cc.gatech.edu/pub/suse/suse/i386/8.2/boot/boot.iso 453e986395cb861df4a1e64340570e1c The first 2 are the same and the last 2 are the same, but they are not all the same. The cmp program reports the following differences: $ cmp -l boot.iso-suse boot.iso-chuck 441139 377 333 441141 377 2 441142 110 324 441143 333 11 441144 110 2 441145 2 6 441146 324 2 441147 11 324 441148 2 11 441149 6 2 441150 2 6 441151 324 377 441152 11 110 441153 2 377 441154 6 110 boot.iso-suse is from ftp.suse.com and boot.iso-chuck is from chuck.ucs.indiana.edu. Why is this? Thanks, -J. Lewis Muir

2 1

uptime of a server
by mailinglists 08 Sep '03

08 Sep '03

Hi my primary dns server was up for 500 days. Now I see in top that it's been up for only 3 days. No trace of reboot neither in messages nor in last log. Does top start over at 0 if a certain amount of up-days have been reached? Or how do I have to interprete that? thanks a lot Philipp

5 4

Sendmail
by Dirk Borchers 08 Sep '03

08 Sep '03

Hello, I installed SuSE Pro 8.2 with the minimum configuration. Because I have no experience with Postfix I deinstalled it and put Sendmail onto the system. Unfortunately I get a lot of error messages in /var/log/warn: sendmail[10501]: OTP unavailable because can't read/write key database /etc/opiekeys: No such file or directory How can I fix this? Dirk

3 2

AW: [suse-security] uptime of a server
by mailinglists 08 Sep '03

08 Sep '03

> On Sep 8, mailinglists <mailinglists(a)belfin.ch> wrote: > > my primary dns server was up for 500 days. Now I see in top > that it's > > been up for only 3 days. No trace of reboot neither in > messages nor in > > last log. Does top start over at 0 if a certain amount of > up-days have > > been reached? Or how do I have to interprete that? > I think there is an overflow at around 480 days. Look at /proc/uptime, > > maybe there is another value there. 637.73 548.78 is the value I rebooted the box. It said it was up more than 500 days. Last time I checked the counter was at 494. So I guess it just starts over at 0 when the counter is at 500. Philipp

1 0

AW: [suse-security] Bind update denied
by Ulrich Roth 08 Sep '03

08 Sep '03

Hi, > > In my log it apears several lines which indicate that for a specific > > host (192.168.1.12) the named daemon had denied an update. > This is a "feature" of some (newer) windows versions, that > try to register their name in the nameserver that they got configured (e.g. > via dhcp). I > think there is a registry key to disable this behaviour, this should help > you to fix the problem. There is a checkbox at the bottom of the advanced settings of the TPC/IP protocols's properties (Win2k). Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth at impact dot de

1 0