January 2004 - openSUSE Security - openSUSE Mailing Lists

Check Mail (Probable ATACK)
by João Reis 22 Jan '04

22 Jan '04

Hi to all, I have mail report made by the lire command and i see some strange things (or think they are). Here is a part of my log Summary of delivery for the most common domains. Sender's Domain Deliveries % Total % Domain Status -------------------------------------------- ---------- ------- -------- mkt-l21.net 4845 44.9 44.9 check_mail 4845 44.9 100.0 only-best-things.com 3633 33.7 33.7 check_mail 3633 33.7 100.0 The domains mkt-l21.net and only-best-things.com are unknown to me.... My pop3 port is open to the world but why are these domains always cheking their mail on my mail server? Is this a kind of atack to my machine ? How should i deny the access to these domains ? Thanks Joao Reis

1 0

Thank you for your inquiry. (fwd)
by Keith Roberts 22 Jan '04

22 Jan '04

Hi. I have just sent a message to the list, and got this email back. Anyone else on the list getting this spam again. Regards - Keith Roberts ---------- Forwarded message ---------- To: Keith Roberts <lists(a)kar.eclipse.co.uk> From: "maillist(a)promotionfactory.net" <maillist(a)promotionfactory.net> Subject: Thank you for your inquiry. Please reply to this e-mail to receive our current specials. If others should get this, include their e-mail also.

2 1

Re: [suse-security] closing port 6000
by Keith Roberts 22 Jan '04

22 Jan '04

Sorry about that. I originally hit the send button, instead of Ctrl-R, to read a file. I resent again to the list - sometimes my POST's to this list don't it make for some strange reason. I'm running SuSE 8.1, and have this script in /usr/X11/bin - the same place as startx. #!/bin/sh # # /usr/X11R6/bin/runX-no-listen # # a simple script wrapper to start the X11 server # without listening for tcp connections. # # last updated 2003-08-13 startx -- -nolisten tcp # end of wrapper On Thu, 22 Jan 2004 GarUlbricht7(a)netscape.net wrote: > To: Keith Roberts <lists(a)kar.eclipse.co.uk> > From: GarUlbricht7(a)netscape.net > Subject: Re: [suse-security] closing port 6000 > > Keith Roberts <lists(a)kar.eclipse.co.uk> wrote: > > > > >I've had problems with this too. > > > >My workaround what I use now is instead of starting Xwindows > >with startx from the console, I use the following script. > > > > > > > > > > > > > >On Tue, 20 Jan 2004, Lindomar Santos wrote: > > > >> To: david <david(a)radikalsystems.com> > >> From: Lindomar Santos <lindomar(a)pop-am.rnp.br> > >> Subject: Re: [suse-security] closing port 6000 > >> > -----<snip>---- > > Keith, > there was no script shown, > did you decide not to include it ??? > > Friendly greetings > > __________________________________________________________________ > New! Unlimited Netscape Internet Service. > Only $9.95 a month -- Sign up today at http://isp.netscape.com/register > Act now to get a personalized email address! > > Netscape. Just the Net You Need. >

1 0

/usr/sbin/compartment fails to chroot for non-root user
by Tom Knight 21 Jan '04

21 Jan '04

I'm trying to build a chroot jail for ssh for a user (called update), using /usr/sbin/compartment. The /etc/passwd entry for user "update" looks like this: update:x:5000:65534:Update User:/home/update:/bin/compart.jail /bin/compart.jail reads: #!/bin/bash strace -v -s 250 -ff -F -qix -o problem /usr/sbin/compartment --chroot /home/update.jail /bin/bash (That strace call is just there for debugging, of course...) * `su update` (the user) fails with the error "Error chrooting to /home/update.jail" * Any non-root user running `/usr/sbin/compartment --chroot /home/update.jail /bin/bash` fails with the same error. * Root _can_ run this file, and ends up in jail. Looking at the file "problem" that strace creates tells me that: <snip> [400e10cd] chroot("/home/update.jail") = -1 EPERM (Operation not permitted) [400e0702] brk(0x804f000) = 0x804f000 [400dae34] write(2, "Error chrooting to /home/update.jail\n", 37) = 37 [400e0702] brk(0x8052000) = 0x8052000 [400ace5d] time([1074677991]) = 1074677991 <snip> (The rest of the file can be given, of course) Okay, now if the user tries to simply `chroot /home/update.jail`, he gets the error: "chroot: cannot change root directory to /home/update.jail: Operation not permitted" The permissions on the directory /home/update.jail look like this: 0 drwxrwxrwx 7 update nogroup 224 2004-01-21 09:38 . 0 drwxr-xr-x 9 root root 216 2004-01-20 16:19 .. 4 -rw------- 1 update nogroup 45 2004-01-21 09:39 .bash_history 0 drwxr-xr-x 2 update nogroup 240 2004-01-21 08:54 bin 0 drwxr-xr-x 2 update nogroup 96 2004-01-20 16:00 dev 0 drwxr-xr-x 2 update nogroup 128 2004-01-21 09:08 etc 1 drwxr-xr-x 3 update nogroup 568 2004-01-21 09:20 lib 112 -rw-r--r-- 1 update nogroup 113188 2004-01-21 09:39 problem 0 drwxr-xr-x 4 update nogroup 96 2004-01-20 15:02 usr I don't think the update user's home direstory of /home/update makes a difference, I've changed it without any effect. I think I could probably use sudo to give update the ability to use chroot, but then I have a chroot user with slightly higher privs than is ideal. Any ideas on how to solve this? Tom. --------------- Tom Knight System Administration Officer Arts & Humanities Data Service Web: http://www.ahds.ac.uk Email: tom.knight(a)ahds.ac.uk Tel: (0)20 7928 7371

4 5

Re: [suse-security] Auto-Updating-2
by Brock Hensley 21 Jan '04

21 Jan '04

I do not get emails... I have forwarding setup right (I get emails to root all the time) so I know thats not just my prob. What did you do to setup online update? PS. I'm using SuSe 9 -B Brock Hensley Hi-Tech Companies http://www.Hi-TechCompanies.com/ Phone: 269.488.7788x112 1.800.968.1155x112 Fax: 269.488.7799 Mobile: 269.267.5406 Jonathan Hull wrote: > Hi Brock, > > On my box, running Suse 8.2, I get e-mail (sent to > root) everytime online update runs, listing all of the > updates and which ones were installed. > > Thanks and hope this helps, > > Jonathan. > > P.S. for some reason, suse-security wont except my > e-mail, so I couldn't post this to the list. > > --- Brock Hensley <bhensley(a)hi-techcompanies.com> > wrote: > >>"... >> >>Unusual System Events >>=-=-=-=-=-=-=-=-=-=-= >>Jan 21 03:00:00 linux /USR/SBIN/CRON[31017]: (root) >>CMD (online_update ) >> >>..." >> >>Every wednesday at 3am this cron runs, but it is not >>in the crontab... >> >>I had configured YaSt2 at one point, through the >>"graphical" interface >>(gui through a terminal?), to auto-update, but I >>don't know if this is >>working or not... how can I make sure it is working, >>ie; get reports of >>success/failure/what it does? or how can i disable >>this yast2 completely >>so I can use the fou4s utility. I need a solution >>that will download and >>install updates on a regularly schedule, completely >>hands off. >> >>Thank You, >>-Brock Hensley >> >>-- >>Brock Hensley >>Hi-Tech Companies >>http://www.Hi-TechCompanies.com/ >>Phone: 269.488.7788x112 >> 1.800.968.1155x112 >>Fax: 269.488.7799 >>Mobile: 269.267.5406 >> >>This communication is intended solely for the use of >>the addressee and may contain information that is >>legally privileged, confidential or exempt from >>disclosure. If you are not the intended recipient, >>please note that any dissemination, distribution, or >>copying of this communication is strictly >>prohibited. Anyone who receives this message in >>error should notify the sender immediately and >>delete it from his or her computer. >> >>If you suspect e-mail abuse please contact >>abuse(a)hi-techcompanies.com >> >>Notice: Attachments are automatically scanned for >>viruses using the Kaspersky Engine. >> >> >> >>-- >>Check the headers for your unsubscription address >>For additional commands, e-mail: >>suse-security-help(a)suse.com >>Security-related bug reports go to security(a)suse.de, >>not here >> > > > > ===== > ~~ > Jonathan Hull > jon(a)hull.name > > __________________________________ > Do you Yahoo!? > Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes > http://hotjobs.sweepstakes.yahoo.com/signingbonus > > This communication is intended solely for the use of the addressee and may contain information that is legally privileged, confidential or exempt from disclosure. If you are not the intended recipient, please note that any dissemination, distribution, or copying of this communication is strictly prohibited. Anyone who receives this message in error should notify the sender immediately and delete it from his or her computer. If you suspect e-mail abuse please contact abuse(a)hi-techcompanies.com Notice: Attachments are automatically scanned for viruses using the Kaspersky Engine.

1 0

Auto-Updating-2
by Brock Hensley 21 Jan '04

21 Jan '04

"... Unusual System Events =-=-=-=-=-=-=-=-=-=-= Jan 21 03:00:00 linux /USR/SBIN/CRON[31017]: (root) CMD (online_update ) ..." Every wednesday at 3am this cron runs, but it is not in the crontab... I had configured YaSt2 at one point, through the "graphical" interface (gui through a terminal?), to auto-update, but I don't know if this is working or not... how can I make sure it is working, ie; get reports of success/failure/what it does? or how can i disable this yast2 completely so I can use the fou4s utility. I need a solution that will download and install updates on a regularly schedule, completely hands off. Thank You, -Brock Hensley -- Brock Hensley Hi-Tech Companies http://www.Hi-TechCompanies.com/ Phone: 269.488.7788x112 1.800.968.1155x112 Fax: 269.488.7799 Mobile: 269.267.5406 This communication is intended solely for the use of the addressee and may contain information that is legally privileged, confidential or exempt from disclosure. If you are not the intended recipient, please note that any dissemination, distribution, or copying of this communication is strictly prohibited. Anyone who receives this message in error should notify the sender immediately and delete it from his or her computer. If you suspect e-mail abuse please contact abuse(a)hi-techcompanies.com Notice: Attachments are automatically scanned for viruses using the Kaspersky Engine.

1 0

Sendmail TLS package for 9.0
by Drew J. Como 21 Jan '04

21 Jan '04

All, Does anyone have a TLS-enabled Sendmail package for SuSE 9.0? I have been searching high and low and cannot come up with one (other than building Sendmail from scratch.) I've checked the FTP's and all I found was the base package. Please advise. Thanks! ============================================ Drew J. Como Phone: 631-434-6600 Systems Administrator Fax: 631-434-7800 dcomo(a)bascom.com Web: www.bascom.com BASCOM Global Internet Services, Inc. -------------------------------------------- "When quality is the goal, winning is guaranteed."

6 9

RE: [suse-security] closing port 6000
by Hemsley, Trevor 21 Jan '04

21 Jan '04

You can add bind-adress = 127.0.0.1 under the [mysqld] heading in /etc/my.cnf -----Original Message----- From: Markus Gaugusch [mailto:markus@gaugusch.at] Sent: 20 January 2004 22:34 To: gregor Cc: SuSE-Security Subject: Re: [suse-security] closing port 6000 On Jan 20, gregor <linuxELCH(a)gmx.de> wrote: > I also had the problem until now, but this solution works for me too. > The only ports open at this time are ssh / 22 and mysql / 3306, and i want to > close port 3306. > could you please tell me how to do this? Add to the init script /etc/init.d/mysql in the else branch of the start) section the following line (between the other options) --bind-address=127.0.0.1 \ (don't forget the trailing backslash!) I really wonder, why this isn't even configurable with a config file/yast...? Markus -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \ -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] Amavis... interesting
by Arjen Runsink 21 Jan '04

21 Jan '04

Hi Brad I am cc'ing this to the list too. Quoting brad(a)crisp.net: > Did you, perhaps, spell 'amaia' wrong? I did a search for it on > Sourceforge, > but came up empty. I'm going to be setting up an amavis proxy > shortly, which > is why I ask... Yes, it should be Maia http://www.renaissoft.com/projects/maia/index.php BB, Arjen

1 0

closing port 6000
by david 20 Jan '04

20 Jan '04

how do i close the port 6000 ? i had try editing the /etc/X11/xdm/Xservers, and /opt/kde3/share/config/kdm/ Xservers, and add the "-nolisten tcp" switch but nothing happens... is there another configuration file to close this port ? Thanks

10 12

Re: [suse-security] closing port 6000 (fwd)
by Keith Roberts 20 Jan '04

20 Jan '04

Take Two! here is the script I use to start the Xwindow system, without X listening for incoming tcp connections. #!/bin/sh # # /usr/X11R6/bin/runX-no-listen # a simple script wrapper to start the X11 server # without listening for tcp connections. # last updated 2003-08-13 startx -- -nolisten tcp # end of wrapper works ok for me under SuSE 8.1 pro HTH Keith Roberts ---------- Forwarded message ---------- To: david <david(a)radikalsystems.com> From: Lindomar Santos <lindomar(a)pop-am.rnp.br> Subject: Re: [suse-security] closing port 6000 Hi David, You have to edit /etc/opt/kde3/share/config/kdm/Xservers :0 local /usr/X11R6/bin/X :0 vt07 -nolisten tcp ps: In suse box 8.2 __|__ By Lindomar, o---*--(*)--*---o http://wecanstopspam.org On Tue, 20 Jan 2004, david wrote: > I dont want to filter the port, I want to close it > i dont understand why i easly can close port 6000 on slackware and mandrake > but suse just cant > > > On Tuesday 20 January 2004 9:03 am, Philippe Vogel wrote: > > > david wrote: > > > > is there another configuration file to close this port ? > > > > > > /etc/opt/kde3/share/config/kdm > > > > > > This may/should be a link (or /opt/... should be) > > > > With yast you can configure there is no remote access to X. > > > > If you want to have ports not closed but in steath mode you will have to > > patch iptables with the grsecurity iptables-patch (you will need kernel > > sources as well). > > This patch implements steathmode for filtering (afaik this will even not > > work with ack-packets scans). > > > > Philippe > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

maybe off topic, ports ftp
by piet 20 Jan '04

20 Jan '04

as for the apache server one can use port 8080 instead of 80. Is something likewise possible for ftp (pureftp in my case) to use something else as 20&21 say 8020&8021 or so. I would like to ftp to my server but it shouldn't be to obvious. Another question I struggle with how to configure ftp & apache in such a way that I can drag and drop files by means a browser on a remote box to upload files to the server after a login. with regards, piet

10 15

Hi
by poeml＠suse.de 20 Jan '04

20 Jan '04

Test =) rdlfhqs -- Test, yep.

20 25

Re: ALERT - GroupShield ticket number OB7_1074610853_SV0023_1 was generated
by Philippe Vogel 20 Jan '04

20 Jan '04

Here you see a working header check (as my mail did not include any attachement): > Action Taken: > The message was quarantined and replaced with a text informing the recipient > of the action taken. > > To: > suse-security(a)suse.com <suse-security(a)suse.com> > > From: > Philippe Vogel <filiaap(a)freenet.de> > > Sent: > 853835904,29613926 > > Subject: > [suse-security] Amavis... interesting > > Attachment Details:- > > Attachment Name: N/A > File: Infected.msg > Infected? Yes It is only checked wheather or not some context is inside a mail. > Repaired? No > Blocked? No > Deleted? No > Virus Name: Suspicious IFrame.a Philippe

1 0

Online Update Security
by Zoran Cvetkovic 20 Jan '04

20 Jan '04

Hallo, Suse's online update is using http or ftp to download patches and updated packages from numerous mirrors. What cryptographical checks are done to the downloaded packages to ensure that they are what they pretend to be? I belive that rpms buildin signatures are used? Am I right, or are other precautions done by YOU? Is there any documentation about that ? best regards Zoran Cvetkovic

3 2

Sophos Anti-Virus IDE alert: W32/Bagle-A (fwd)
by Keith Roberts 19 Jan '04

19 Jan '04

Perhaps Suse needs to scan all mail for this list for viruses? Some information here. ---------- Forwarded message ---------- To: notification(a)lists.sophos.com From: Sophos Alert System <notification-return(a)lists.sophos.com> Subject: Sophos Anti-Virus IDE alert: W32/Bagle-A Name: W32/Bagle-A Aliases: W32.Beagle.A@mm, Win32.Bbgle.A@mm Type: Win32 worm Date: 19 January 2004 A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the March 2004 (3.79) release of Sophos Anti-Virus. Sophos has received several reports of this worm from the wild. Information about W32/Bagle-A can be found at: http://www.sophos.com/virusinfo/analyses/w32baglea.html Download the IDE file from: http://www.sophos.com/downloads/ide/bagle-a.ide Download all the IDE files available for the current version of Sophos Anti-Virus in a single compressed file. The file is available in two formats: Zip file: http://www.sophos.com/downloads/ide/ides.zip Self-extracting file: http://www.sophos.com/downloads/ide/ides.exe Read about how to use IDE files at http://www.sophos.com/downloads/ide/using.html --------------------------------------------------------------------- To unsubscribe, email: notification-unsubscribe(a)lists.sophos.com For additional commands, email: notification-faq(a)lists.sophos.com

2 1

The Eclipse Internet VIRUSshield Service Detected VIRUS (W32/Bagle@MM) in mail to you (from <suse-security-return-21086-lists=kar.eclipse.co.uk@suse.com>)
by Keith Roberts 19 Jan '04

19 Jan '04

Greetings! Nice to know my ISP detected and blocked this virus from the list. FYI ---------- Forwarded message ---------- To: undisclosed-recipients: ; From: virusalert(a)eclipse.net.uk Subject: The Eclipse Internet VIRUSshield Service Detected VIRUS (W32/Bagle@MM) in mail to you (from <suse-security-return-21086-lists=kar.eclipse.co.uk(a)suse.com>) VIRUS ALERT We are sorry, but it appears you have been sent an email that contained virus: W32/Bagle@MM The email was NOT delivered. This is for information only, no further action is required. Sender: (<suse-security-return-21086-lists=kar.eclipse.co.uk(a)suse.com>) Recipient: lists(a)kar.eclipse.co.uk Quarantine Ref: /var/virusmails/virus-20040119-155802-28197-01-68 * Please note that many viruses may fake the sender address. __DATA__

1 0

enough freaking RE: HI's!
by Brock Hensley 19 Jan '04

19 Jan '04

enough allready. next subject. -- Brock Hensley Hi-Tech Companies http://www.Hi-TechCompanies.com/ Phone: 269.488.7788x112 1.800.968.1155x112 Fax: 269.488.7799 Mobile: 269.267.5406 This communication is intended solely for the use of the addressee and may contain information that is legally privileged, confidential or exempt from disclosure. If you are not the intended recipient, please note that any dissemination, distribution, or copying of this communication is strictly prohibited. Anyone who receives this message in error should notify the sender immediately and delete it from his or her computer. If you suspect e-mail abuse please contact abuse(a)hi-techcompanies.com Notice: Attachments are automatically scanned for viruses using the Kaspersky Engine.

1 0

virus from the list
by Kenneth Schneider 19 Jan '04

19 Jan '04

The following message had attachment(s) which contained the viruses: >From : suse-security-return-21086-suseseclist=rtsx.com(a)suse.com To : ken(a)rtsx.com Subject : Date : Mon, 19 Jan 2004 12:59:04 -0400 Message-ID: <kpjfmncoyejjuiljgkc(a)suse.de> Attachment Virus name Action taken ------------------------------------------------------------------------------ dgvxokpkxv.exe ??? Removed Thought this could be tracked by the Message-ID. -- Ken Schneider unix user since 1989 linux user since 1994 SuSE user since 1998 (5.2)

2 1

imap access changes /etc/sasldb
by Mathias Homann 19 Jan '04

19 Jan '04

help! since recently, an imap access changes /etc/sasldb! doent matter if the client is outlook express or kmail, after the imap access, /etc/sasldb has a new timestamp and a different md5sum, but the passwords themself are thill the same. started like one week ago, but tripwire doesnt notice anything strange. any ideas? system in question is a suse 8.0 with all patches installed. bye, MH -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! gpg key fingerprint: 5F64 4C92 9B77 DE37 D184 C5F9 B013 44E7 27BD 763C

2 1

Re: [suse-security] Hi
by james.bliss＠comcast.net 19 Jan '04

19 Jan '04

All but one, apparently ;) > elfed lewis wrote: > > >On Monday 19 January 2004 16:10, Kenneth Schneider wrote: > > > > > >>On Mon, 2004-01-19 at 11:59, poeml(a)suse.de wrote: > >> > >> > >>>******************************* WARNING ****************************** > >>>This message has been scanned by MDaemon AntiVirus and was found to > >>>contain infected attachment(s). Please review the list below. > >>> > >>> > >> bliemy, youd think a security list would be virus checked! > > > > While that might be nice, does it really matter? (bandwidth issues > aside) I mean, we're all running Linux, so what's an ms-windows .exe > really going to do even if I do [stupidly] click on it? And besides, > all of us here know better than to run executables sent to us that we > didn't ask for. ;-) > > Kevin > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

ip_conntrack table overflow
by Backhausen, Sven 19 Jan '04

19 Jan '04

hi list, i updated some of our SuSE-8.1 boxes to the newest kernel (k_smp-2.4.21-168) two weeks ago and now one of them stopped responding with following errors in /var/log/messages last night: kernel: ip_conntrack: table full, dropping packet. Here are the ip* modules that are loaded: ipt_REJECT 3288 3 (autoclean) iptable_mangle 2168 1 (autoclean) iptable_filter 1740 1 (autoclean) ip_nat_ftp 3376 0 (unused) iptable_nat 18072 1 [ip_nat_ftp] ip_conntrack_ftp 4336 1 [ip_nat_ftp] ip_conntrack 21832 3 [ipt_state ip_nat_ftp iptable_nat ip_conntrack_ftp] ip_tables 12248 10 [ipt_TCPMSS ipt_TOS ipt_state ipt_LOG ipt_REJECT iptable_mangle iptable_filter iptable_nat] Is there any known issue with the conntrack modules in the 2.4.21 series? How do I increase the table size or monitor the usage of these tables? Btw, why does SuSEfirewall2 load the nat modules even when routing and nat is disabled in /etc/sysconfig/SuSEfirewall2? tia Sven

3 2

Yast2 / auto-updating
by Brock Hensley 18 Jan '04

18 Jan '04

I have the following two entries in my crontab: /sbin/yast2 online_update .auto.get /sbin/yast2 online_update .auto.install and I get the following error for both of them when they run: Error opening terminal: unknown. All I want to do is have it auto-update everynight... can someone help me?.. Thank You, -Brock Hensley -- Brock Hensley Hi-Tech Companies http://www.Hi-TechCompanies.com/ Phone: 269.488.7788x112 1.800.968.1155x112 Fax: 269.488.7799 Mobile: 269.267.5406 This communication is intended solely for the use of the addressee and may contain information that is legally privileged, confidential or exempt from disclosure. If you are not the intended recipient, please note that any dissemination, distribution, or copying of this communication is strictly prohibited. Anyone who receives this message in error should notify the sender immediately and delete it from his or her computer. If you suspect e-mail abuse please contact abuse(a)hi-techcompanies.com Notice: Attachments are automatically scanned for viruses using the Kaspersky Engine.

4 3

Firewall-Problem with SynCE
by Andreas Mantke 18 Jan '04

18 Jan '04

Hello, yesterday I synced a PocketPC over synce to my SuSE 8.2 box. The interface is USB-Port ttyUSB1. The sync functined fine without the SuSEfirewall2 (stoped). If I started the Firewall again, there are the following messages in /var/log/messages: Jan 11 20:22:56 linux kernel: SuSE-FW-DROP-ANTI-SPOOF IN=ppp0 OUT= MAC= SRC=192.168.131.201 DST=192.168.131.102 LEN=64 TOS=0x00 PREC=0x00 TTL=128 ID=60971 DF PROTO=TCP SPT=1201 DPT=5679 WINDOW=32768 RES=0x00 SYN URGP=0 OPT (020405B4010303000101080A000000000000000001010402) The sync failed. The command route -n bring me the following output: Ziel Router Genmask Flags Metric Ref Use Iface 192.168.131.201 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0 192.168.22.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 My configuration of SuSEFW2: FW_DEV_EXT="ppp0" FW_DEV_INT="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/16" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="13 10001" FW_SERVICES_EXT_UDP="13" FW_SERVICES_INT_TCP="22 80 119 8080 10001 139 5678 5679 990" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" The other points of the FW-script are default. My questions: 1.) In FW_SERVICES_INT_TCP I added Port 5678, 5679 and 990 because the SynCE-Documation tells me, that the PocketPC need Access to the PC on Port 5678, 5679 and the PC on the PocketPC on Port 990. Is this the right way to configure this? 2.) I don't know the meaning of the message above. Is there a documentation to learn about? Regards, Andreas -- ## Content Developer OpenOffice.org: lang/DE ## Freie Office-Suite für Linux, Mac, Windows, Solaris ## http://de.openoffice.org ## Meine Seite http://www.amantke.de

2 2

online kernel updates
by Steve Sullivan 17 Jan '04

17 Jan '04

A recent Suse security announcment suggested installing kernel k_dflt 2.4.1-178. My system has 2.4.1-166 installed. Yet when I use Yast Online Update, the new kernel doesn't appear. Why not? Do I have to install it manually? Many thanks, Steve

2 1