February 2004 - openSUSE Security - openSUSE Mailing Lists

Iptables PREROUTING
by Vincent Lee 05 Feb '04

05 Feb '04

Dear all, I am new to SuSE. I would like to setup the MS netmeeting for a computer which behind SuSE firewall. When I made change on the nat, I cannot get it through. It seems that the IP forwarding is disabled by SuSE. Can anyone tell me how can I enable it? Best Regards, Vincent

3 3

RE: Re: [suse-security] Iptables PREROUTING
by Barry Gill 05 Feb '04

05 Feb '04

Geoffrey <esoteric(a)3times25.net> wrote the Feb 4, 2004 12:46 AM: > Yast -> Network devices -> network card -> change -> > edit -> routing -> enable ip forwarding Be smarter to set up FW_ROUTE=YES in SuSEfirewall2

1 0

Custom rules for the Susefirewall2
by suse-security 04 Feb '04

04 Feb '04

Hi list, I'm very new to the subject of administrating a linux server, so please forgive my dumb questions. Currently my server is receiving a lot of spam mail from a certain address. I want to block this rubbish before it hits the smtp-server, hence I'd like to add some rules to the firewall that sorts the stuff out. Is the custom script for the SuseFirewall2 (/etc/sysconfig/scripts/Susefirewall2-custom) the right place for this temporary solution? And which section to I have to use inside this script? I know that I have to setup some proper antispam-software, but in the meantime I just want to drop the mails. Any hints are really welcome Sebastian

3 2

test
by suse-security＠ott-service.de 04 Feb '04

04 Feb '04

��Nv�!�,Kb&B;�_��.��OH��7p��#籈��#cV?a�ǧ��~�y�к|0y��b�[�}��-vvs��]�ځ�.W��(�&�!��pX]Lg3l��g�mS��c��P��K_��ͱH�� G*�p�Vq[yŭʑ|.�t�g��3�#H�\Y�~{�!��UCX'iڝ3\� {ʞC�^�� 1��˧Q�c��7��j�蚹3Db Q7º��"��vS,q��l��8Vgŝ�g��,S|ZB��_�F�UH><�&y��|��MNp�&scJ�v� .�l��鈐S<��ͭ ��f�CGtI;�(*0��/2��)��/� �Q�K�Z��z�]ci\-�B��?�ג�J��F"�?��ȟ��s�#��9hL9��;��H9Oz�B�i.5��a��o�R��{�0J��i4) ׶c��rNu��liUpO�G��֩2��W�a�ǧRJ�氎�r~��)��f��,��Y��g��N(\�ӂ�' ��!!� ��wV�E��l.cOy��0��p�b��ʴPS�{q��!�B�ʒ��?�u��}EC7��Y� �z�v�z�ܬTG2Й�3�kӴm�7 �n�}:u<� �K&�A��fKw�W��u��a�r��M��Co�� Luw�31��M�_/�Y\#-�� 7y�Y<W�j�N-1��Vݴ[i}��NU��:{��\��H

2 1

RE: [suse-security] [Announcement] New fou4s release - 0.11.2
by GarUlbricht7＠netscape.net 04 Feb '04

04 Feb '04

Markus Gaugusch <markus(a)gaugusch.at> wrote: > >Fou4s (Fast OnlineUpdate for SuSE) is an alternative implementation of YOU >(YaST Online Update) and is aimed at admin users that want updates as >painless and automated as possible. But it can also be useful for desktop >users. I've used it to update mozilla, gnome, kde and rpms from >packman.links2linux.org as well. > > See: http://fou4s.gaugusch.at/ > > for more information. > -----<Snip>--- Hi Markus, I just downloaded the new patch using: [boxen1 root]# fou4s --auto --checkfou4s --inversecolor --interactive No problem. Afterwards I checked If I am missing an other security updates. I wasn't. I then went to your site to get the latest and greatest: http://fou4s.gaugusch.at/download.shtml And when I clicked on: fou4s-0.11.2-2.noarch.rpm it returned: **** Not Found **** . The requested URL /download/fou4s-0.11.2-2.noarch.rpm .. was not found on this server. .. Apache/1.3.26 Server at fou4s.gaugusch.at Port 80 I don't know if I got the message because your server is overloaded with people getting the update, or because you took it down, and haven't put it back up At any rate, I am good to go for today, and I will try back later. Friendly greetings, Gar -- __________________________________________________________________ New! Unlimited Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Act now to get a personalized email address! Netscape. Just the Net You Need.

4 4

AW: [suse-security] Iptables PREROUTING
by Stefan.Junge＠ssi-schaefer.de 04 Feb '04

04 Feb '04

Hi Vincent, Try yast2 -> System -> Sysconfig Editor -> Network -> Base -> IP here you will find a select box IP_FORWARD. Set it to 'yes'. With best regards, Stefan > -----Ursprüngliche Nachricht----- > Von: Vincent Lee [mailto:vincent.lee@vs-pro.com] > Gesendet: Mittwoch, 4. Februar 2004 03:50 > An: suse-security(a)suse.com > Betreff: [suse-security] Iptables PREROUTING > > Dear all, > > I am new to SuSE. I would like to setup the MS netmeeting for > a computer which behind SuSE firewall. When I made change on > the nat, I cannot get it through. It seems that the IP > forwarding is disabled by SuSE. Can anyone tell me how can I > enable it? > > Best Regards, > > Vincent

1 0

Re: [suse-security] [Announcement] New fou4s release - 0.11.2
by GarUlbricht7＠netscape.net 04 Feb '04

04 Feb '04

Juan Erbes <jerbes(a)arnet.com.ar> wrote: >When i execute fou4s, i got the error: >cat: /etc/suseservers: No such file or directory > >¿From who obtain the /etc/suseservers file? > >GarUlbricht7(a)netscape.net wrote: > >>Markus Gaugusch <markus(a)gaugusch.at> wrote: >> >>> Fou4s (Fast OnlineUpdate for SuSE) is an alternative implementation >>> of YOU >>>(YaST Online Update) and is aimed at admin users that want updates as >>> painless and automated as possible. >>> But it can also be useful for desktop users. >>> I've used it to update mozilla, gnome, kde and rpms from >>> packman.links2linux.org as well. >>> >>>See: http://fou4s.gaugusch.at/ >>> >>>for more information. >>> >>-----<Snip>--- ----<and snip again>----- > Hi Juan, Sorry I cause some confussion. I should have just sent my mail to Markus and not post it on the security list, because what I was saying was it appeared to me that his download site was working. Be that as it may, Several things I didn't say: 1. I had my "ftp" coonection to the net up and running. 2. Prior to executing the command, I started a shell. 3. And I logged in as root, usisng "sux -" I had also previously downloaded and installed the "fou4s.rpm: from: http://fou4s.gaugusch.at/download.shtml So what I was doing was installing a patch. See: http://fou4s.gaugusch.at/ For more info. Sorry again for any confusion I caused:( fou4s Is great and I hope you get it installed. Hope this helps, Gar -- Then I was __________________________________________________________________ New! Unlimited Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Act now to get a personalized email address! Netscape. Just the Net You Need.

1 0

[Announcement] New fou4s release - 0.11.2
by Markus Gaugusch 03 Feb '04

03 Feb '04

Fou4s (Fast OnlineUpdate for SuSE) is an alternative implementation of YOU (YaST Online Update) and is aimed at admin users that want updates as painless and automated as possible. But it can also be useful for desktop users. I've used it to update mozilla, gnome, kde and rpms from packman.links2linux.org as well. See http://fou4s.gaugusch.at/ for more information. Now the bad part :-) Lars Ellenberg has found a potential security problem that is fixed in this release: RPM pre/postinstall scripts were executed with a group writable umask and GID fou4s. Although no unprivileged user should be member of group fou4s (it is thought for administrators who want to run fou4s with a non-root rights, and not for normal users), I recommend to check your machines and fix broken permissions. Please note, that group fou4s has NO members with the default settings! The commands below are an example for checking. I exclude /var because according to my tests it is not affected by the bug. You can also only exclude /var/cache/fou4s and /var/log/fou4s.log, if you want to be sure. # check files find / -group fou4s | grep -v '^/var/' | xargs ls -la # fix rights, if you are satisfied with above results find / -group fou4s | grep -v '^/var/' | xargs chmod g-w # fix owner - don't fix before fixing rights or no match is found there!! find / -group fou4s | grep -v '^/var/' | xargs chgrp root Martin Köhling has also found a potential problem. Versions of fou4s before 0.11.0 didn't recognise the latest kdebase3-SuSE update because of a slightly different formatting of the update description file. Fou4s 0.11.0 and newer automatically find the missed update, so you are encouraged to get the latest version. (Try fou4s --auto --checkfou4s). Apart from the above, this release contains mostly bugfixes for the --export and --host options. German and French information texts (--language=german) are now shown correctly (Unicode decoding, thanks to Matthias Andree for this!). Some non-SuSE packages that caused update problems because of different arch (e.g. i386 instead of i586) also work now. kind regards, Markus Gaugusch -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \

1 0

Identical http request in log file
by Andreas Jägermann 03 Feb '04

03 Feb '04

Hi list, I've experienced strange entries in the transfer.log of my apache 1.3.23. This apache is protected via .htaccess files and is the only service I provide to selected users. The entries look like this: aaa.bbb.ccc.ddd - - [31/Jan/2004:00:01:29 +0100] "GET / HTTP/1.1" 401 494 65.166.64.132 - - [31/Jan/2004:00:01:30 +0100] "GET / HTTP/1.1" 401 494 aaa.bbb.ccc.ddd - - [31/Jan/2004:00:09:00 +0100] "GET / HTTP/1.1" 401 494 217.169.46.98 - - [31/Jan/2004:00:09:01 +0100] "GET / HTTP/1.1" 401 494 aaa.bbb.ccc.ddd - - [31/Jan/2004:00:17:41 +0100] "GET / HTTP/1.1" 401 494 65.245.128.68 - - [31/Jan/2004:00:17:42 +0100] "GET / HTTP/1.1" 401 494 aaa.bbb.ccc.ddd is the ip of one of my users who is just accessing the htaccess-dialog. Every request that is made, is doubled from a different ip. If the user logs in with a valid account then the "doubled" request gets a 401. Is this a security problem at my site? How can I prevent this without limiting access to certain ip addresses? I'm using SuSE 8.0 with all patches applied. Any hint is appreciated. Thanks in advance. Regards, Andreas

4 7

RE: [suse-security] RAID5 on SuSE 9.0
by David Soltero-Lugo 03 Feb '04

03 Feb '04

Already 4 hours testing with out errors!!! It has to be the raid!! Any other thoughts? David -----Original Message----- From: Michael Wirth [mailto:micha@linux-install.de] Sent: Tuesday, February 03, 2004 8:39 AM To: David Soltero-Lugo Subject: Re: [suse-security] RAID5 on SuSE 9.0 David, > Jan 15 22:27:39 linux kernel: raid5: resync finished. > Jan 15 22:47:40 linux kernel: Unable to handle kernel paging request at > virtual address 000011e6 > Jan 15 22:47:40 linux kernel: printing eip: > Jan 15 22:47:40 linux kernel: c7c13ddc > Jan 15 22:47:40 linux kernel: *pde = 00000000 > Jan 15 22:47:40 linux kernel: Oops: 0002 2.4.21-166-athlon #1 Thu Dec 18 > 18:24:05 UTC 2003 > Jan 15 22:47:40 linux kernel: CPU: 0 > Jan 15 22:47:40 linux kernel: EIP: > 0010:[ipv6:mipv6_functions_R874e5304+51758556/804608079] Tainted: P > Jan 15 22:47:40 linux kernel: EIP: 0010:[<c7c13ddc>] Tainted: P > Jan 15 22:47:40 linux kernel: EFLAGS: 00010296 > Jan 15 22:47:40 linux kernel: eax: 00000000 ebx: 08073fc0 ecx: 00000000 > edx: 08073fd0 > Jan 15 22:47:40 linux kernel: esi: 00000030 edi: c7c13eba ebp: c7c13fa4 > esp: c7c13dc4 > Jan 15 22:47:40 linux kernel: ds: 0018 es: 0018 ss: 0018 > Jan 15 22:47:40 linux kernel: Process man (pid: 3459, stackpage=c7c13000) ^^^^^^^^^^^ This is almost certainly not a kernel bug, but a dirty RAM component. Try running memtest86 overnight. Then get a printout and contact your dealer for new RAMs. Process man should never cause a kernel Oops... Greetings and good luck............Michael --- --- Michael Wirth linux-install Mühlehof 20 Phone: +49-7073-802 72119 Ammerbuch Fax: +49-7073-500282 wirth(a)linux-install.de Web: http://www.linux-install.de/

3 3

RE: [suse-security] RAID5 on SuSE 9.0
by David Soltero-Lugo 03 Feb '04

03 Feb '04

Yes, module aic7xxx (2) 29160 AND 19160! On kernel 2.4.21-166-athlon -----Original Message----- From: Guido Tschakert [mailto:guido.tschakert@src-gmbh.de] Sent: Tuesday, February 03, 2004 9:28 AM To: David Soltero-Lugo Subject: Re: [suse-security] RAID5 on SuSE 9.0 David Soltero-Lugo wrote: > > I am trying to setup a 9.0Pro machine using 4 scsi discs on a RAID5 > (software based) but I am having troubles with it. If I boot on runlevel 1 > the system does not crash, but if I boot over another runlevel, the system > will freeze after a while with a Oops message, related to ipv6 driver, > raid5.o, ssh, or other. Here are some of the Oops, This is a brand new > installation with almost everything default!!! > > Thanks for any help you can give! > > David > > ############################################################################ > # > > Jan 15 22:27:39 linux kernel: md: md0: sync done. > Jan 15 22:27:39 linux kernel: raid5: resync finished. > Jan 15 22:47:40 linux kernel: Unable to handle kernel paging request at > virtual address 000011e6 > Jan 15 22:47:40 linux kernel: printing eip: > Jan 15 22:47:40 linux kernel: c7c13ddc > Jan 15 22:47:40 linux kernel: *pde = 00000000 > Jan 15 22:47:40 linux kernel: Oops: 0002 2.4.21-166-athlon #1 Thu Dec 18 > 18:24:05 UTC 2003 > Jan 15 22:47:40 linux kernel: CPU: 0 > Jan 15 22:47:40 linux kernel: EIP: > 0010:[ipv6:mipv6_functions_R874e5304+51758556/804608079] Tainted: P > Jan 15 22:47:40 linux kernel: EIP: 0010:[<c7c13ddc>] Tainted: P > Jan 15 22:47:40 linux kernel: EFLAGS: 00010296 > Jan 15 22:47:40 linux kernel: eax: 00000000 ebx: 08073fc0 ecx: 00000000 > edx: 08073fd0 > Jan 15 22:47:40 linux kernel: esi: 00000030 edi: c7c13eba ebp: c7c13fa4 > esp: c7c13dc4 > Jan 15 22:47:40 linux kernel: ds: 0018 es: 0018 ss: 0018 > Jan 15 22:47:40 linux kernel: Process man (pid: 3459, stackpage=c7c13000) > Jan 15 22:47:40 linux kernel: Stack: 08073fc8 c7c13ddc 00000008 08073fd4 > 00033f8d 00000000 11e68900 00000000 > Jan 15 22:47:40 linux kernel: 00000028 00000000 c8765848 c7c13f24 > 00000016 c875cb26 c7c13eba c875c3f0 > Jan 15 22:47:40 linux kernel: c328e470 c7c13fa4 c7c13ea4 00000016 > 11e68900 00000000 0002c39a 00000000 > Jan 15 22:47:40 linux kernel: Call Trace: > [keybdev:__insmod_keybdev_O/lib/modules/2.4.21-166-athlon/kernel/dri+4265276 > 528/96] (216) [cached_lookup+24/112] (120) [vfs_readdir+169/176] (12) > Jan 15 22:47:40 linux kernel: Call Trace: [<c328e470>] (216) > [<c0154798>] (120) [<c0159369>] (12) > Jan 15 22:47:40 linux kernel: [filldir64+0/288] (20) > [sys_getdents64+91/181] (08) [filldir64+0/288] (32) [sys_fcntl64+93/192] > (36) > Jan 15 22:47:40 linux kernel: [<c01599f0>] (20) [<c0159b6b>] (08) > [<c01599f0>] (32) [<c0158acd>] (36) > Jan 15 22:47:40 linux kernel: [system_call+51/56] (60) > ############################################################################ > > Which kind of scsi-controller do you use? The Modul for adaptec (aic7xxx) is a little bit buggy (a lot of backporting from Kernel 2.6, which leads to a lot of error messages) A friend of mine had tried it and went back to SuSE 8.1. -- mit freundlichen Grüßen, Guido Tschakert ___________________________________________________________________ SRC Security Research & Consulting GmbH Graurheindorfer Str. 149a Tel: +49-228-2806-138 53117 Bonn Mobil:+49-160-3671422 http://www.src-gmbh.de Fax: +49-228-2806-199

1 0

RE: [suse-security] RAID5 on SuSE 9.0
by David Soltero-Lugo 03 Feb '04

03 Feb '04

I did think that, but with SuSE 8.2 didn't have that problem, neither with 8.1, 8.0, 7.3, on the same machine!!!. IF I load runlevel 1 and then change to runlevel5 there is NO problem the problems start when Jan 15 22:27:39 linux kernel: raid5: resync finished. This happens!! But anyway I will be trying the memtest. Thanks! David -----Original Message----- From: Michael Wirth [mailto:micha@linux-install.de] Sent: Tuesday, February 03, 2004 8:39 AM To: David Soltero-Lugo Subject: Re: [suse-security] RAID5 on SuSE 9.0 David, > Jan 15 22:27:39 linux kernel: raid5: resync finished. > Jan 15 22:47:40 linux kernel: Unable to handle kernel paging request at > virtual address 000011e6 > Jan 15 22:47:40 linux kernel: printing eip: > Jan 15 22:47:40 linux kernel: c7c13ddc > Jan 15 22:47:40 linux kernel: *pde = 00000000 > Jan 15 22:47:40 linux kernel: Oops: 0002 2.4.21-166-athlon #1 Thu Dec 18 > 18:24:05 UTC 2003 > Jan 15 22:47:40 linux kernel: CPU: 0 > Jan 15 22:47:40 linux kernel: EIP: > 0010:[ipv6:mipv6_functions_R874e5304+51758556/804608079] Tainted: P > Jan 15 22:47:40 linux kernel: EIP: 0010:[<c7c13ddc>] Tainted: P > Jan 15 22:47:40 linux kernel: EFLAGS: 00010296 > Jan 15 22:47:40 linux kernel: eax: 00000000 ebx: 08073fc0 ecx: 00000000 > edx: 08073fd0 > Jan 15 22:47:40 linux kernel: esi: 00000030 edi: c7c13eba ebp: c7c13fa4 > esp: c7c13dc4 > Jan 15 22:47:40 linux kernel: ds: 0018 es: 0018 ss: 0018 > Jan 15 22:47:40 linux kernel: Process man (pid: 3459, stackpage=c7c13000) ^^^^^^^^^^^ This is almost certainly not a kernel bug, but a dirty RAM component. Try running memtest86 overnight. Then get a printout and contact your dealer for new RAMs. Process man should never cause a kernel Oops... Greetings and good luck............Michael --- --- Michael Wirth linux-install Mühlehof 20 Phone: +49-7073-802 72119 Ammerbuch Fax: +49-7073-500282 wirth(a)linux-install.de Web: http://www.linux-install.de/

1 0

RE: [suse-security] RAID5 on SuSE 9.0
by David Soltero-Lugo 03 Feb '04

03 Feb '04

NO, es una maquina con un motherboard Tyan! Pero el problema no es con el ethernet, pues si la subo runlevel 1 y luego la cambio a runlevel 5 el raid5 en software NO trata de hacer el sync de los 4 disco y por lo tanto NO se jangea! Pero entonces NO tengo el raid funcionando!!! David -----Original Message----- From: Manuel Balderrábano [mailto:garibolo@wanadoo.es] Sent: Tuesday, February 03, 2004 8:31 AM To: David Soltero-Lugo Subject: Re: [suse-security] RAID5 on SuSE 9.0 Hola, David. (Asumo que hablas español.) ¿Se trata de un servidor IBM, por casualidad? Tuve un priblema idéntico al tuyo, y al final era la forma en que la BIOS manejaba el driver de la ethernet integrada en placa. Lo solucioné instalando una ethernet PCI, y ahora todo va como la seda! Un saludo. ----- Original Message ----- From: "David Soltero-Lugo" <david(a)hpcf.upr.edu> To: <suse-security(a)suse.com> Sent: Tuesday, February 03, 2004 10:14 AM Subject: [suse-security] RAID5 on SuSE 9.0 > > > I am trying to setup a 9.0Pro machine using 4 scsi discs on a RAID5 > (software based) but I am having troubles with it. If I boot on runlevel 1 > the system does not crash, but if I boot over another runlevel, the system > will freeze after a while with a Oops message, related to ipv6 driver, > raid5.o, ssh, or other. Here are some of the Oops, This is a brand new > installation with almost everything default!!! > > Thanks for any help you can give! > > David > > ############################################################################ > # > > Jan 15 22:27:39 linux kernel: md: md0: sync done. > Jan 15 22:27:39 linux kernel: raid5: resync finished. > Jan 15 22:47:40 linux kernel: Unable to handle kernel paging request at > virtual address 000011e6 > Jan 15 22:47:40 linux kernel: printing eip: > Jan 15 22:47:40 linux kernel: c7c13ddc > Jan 15 22:47:40 linux kernel: *pde = 00000000 > Jan 15 22:47:40 linux kernel: Oops: 0002 2.4.21-166-athlon #1 Thu Dec 18 > 18:24:05 UTC 2003 > Jan 15 22:47:40 linux kernel: CPU: 0 > Jan 15 22:47:40 linux kernel: EIP: > 0010:[ipv6:mipv6_functions_R874e5304+51758556/804608079] Tainted: P > Jan 15 22:47:40 linux kernel: EIP: 0010:[<c7c13ddc>] Tainted: P > Jan 15 22:47:40 linux kernel: EFLAGS: 00010296 > Jan 15 22:47:40 linux kernel: eax: 00000000 ebx: 08073fc0 ecx: 00000000 > edx: 08073fd0 > Jan 15 22:47:40 linux kernel: esi: 00000030 edi: c7c13eba ebp: c7c13fa4 > esp: c7c13dc4 > Jan 15 22:47:40 linux kernel: ds: 0018 es: 0018 ss: 0018 > Jan 15 22:47:40 linux kernel: Process man (pid: 3459, stackpage=c7c13000) > Jan 15 22:47:40 linux kernel: Stack: 08073fc8 c7c13ddc 00000008 08073fd4 > 00033f8d 00000000 11e68900 00000000 > Jan 15 22:47:40 linux kernel: 00000028 00000000 c8765848 c7c13f24 > 00000016 c875cb26 c7c13eba c875c3f0 > Jan 15 22:47:40 linux kernel: c328e470 c7c13fa4 c7c13ea4 00000016 > 11e68900 00000000 0002c39a 00000000 > Jan 15 22:47:40 linux kernel: Call Trace: > [keybdev:__insmod_keybdev_O/lib/modules/2.4.21-166-athlon/kernel/dri+4265276 > 528/96] (216) [cached_lookup+24/112] (120) [vfs_readdir+169/176] (12) > Jan 15 22:47:40 linux kernel: Call Trace: [<c328e470>] (216) > [<c0154798>] (120) [<c0159369>] (12) > Jan 15 22:47:40 linux kernel: [filldir64+0/288] (20) > [sys_getdents64+91/181] (08) [filldir64+0/288] (32) [sys_fcntl64+93/192] > (36) > Jan 15 22:47:40 linux kernel: [<c01599f0>] (20) [<c0159b6b>] (08) > [<c01599f0>] (32) [<c0158acd>] (36) > Jan 15 22:47:40 linux kernel: [system_call+51/56] (60) > ############################################################################ > > > -- > Check the headers for your unsubscription address > For additional commands send e-mail to suse-linux-e-help(a)suse.com > Also check the archives at http://lists.suse.com > Please read the FAQs: suse-linux-e-faq(a)suse.com > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

RAID5 on SuSE 9.0
by David Soltero-Lugo 03 Feb '04

03 Feb '04

I am trying to setup a 9.0Pro machine using 4 scsi discs on a RAID5 (software based) but I am having troubles with it. If I boot on runlevel 1 the system does not crash, but if I boot over another runlevel, the system will freeze after a while with a Oops message, related to ipv6 driver, raid5.o, ssh, or other. Here are some of the Oops, This is a brand new installation with almost everything default!!! Thanks for any help you can give! David ############################################################################ # Jan 15 22:27:39 linux kernel: md: md0: sync done. Jan 15 22:27:39 linux kernel: raid5: resync finished. Jan 15 22:47:40 linux kernel: Unable to handle kernel paging request at virtual address 000011e6 Jan 15 22:47:40 linux kernel: printing eip: Jan 15 22:47:40 linux kernel: c7c13ddc Jan 15 22:47:40 linux kernel: *pde = 00000000 Jan 15 22:47:40 linux kernel: Oops: 0002 2.4.21-166-athlon #1 Thu Dec 18 18:24:05 UTC 2003 Jan 15 22:47:40 linux kernel: CPU: 0 Jan 15 22:47:40 linux kernel: EIP: 0010:[ipv6:mipv6_functions_R874e5304+51758556/804608079] Tainted: P Jan 15 22:47:40 linux kernel: EIP: 0010:[<c7c13ddc>] Tainted: P Jan 15 22:47:40 linux kernel: EFLAGS: 00010296 Jan 15 22:47:40 linux kernel: eax: 00000000 ebx: 08073fc0 ecx: 00000000 edx: 08073fd0 Jan 15 22:47:40 linux kernel: esi: 00000030 edi: c7c13eba ebp: c7c13fa4 esp: c7c13dc4 Jan 15 22:47:40 linux kernel: ds: 0018 es: 0018 ss: 0018 Jan 15 22:47:40 linux kernel: Process man (pid: 3459, stackpage=c7c13000) Jan 15 22:47:40 linux kernel: Stack: 08073fc8 c7c13ddc 00000008 08073fd4 00033f8d 00000000 11e68900 00000000 Jan 15 22:47:40 linux kernel: 00000028 00000000 c8765848 c7c13f24 00000016 c875cb26 c7c13eba c875c3f0 Jan 15 22:47:40 linux kernel: c328e470 c7c13fa4 c7c13ea4 00000016 11e68900 00000000 0002c39a 00000000 Jan 15 22:47:40 linux kernel: Call Trace: [keybdev:__insmod_keybdev_O/lib/modules/2.4.21-166-athlon/kernel/dri+4265276 528/96] (216) [cached_lookup+24/112] (120) [vfs_readdir+169/176] (12) Jan 15 22:47:40 linux kernel: Call Trace: [<c328e470>] (216) [<c0154798>] (120) [<c0159369>] (12) Jan 15 22:47:40 linux kernel: [filldir64+0/288] (20) [sys_getdents64+91/181] (08) [filldir64+0/288] (32) [sys_fcntl64+93/192] (36) Jan 15 22:47:40 linux kernel: [<c01599f0>] (20) [<c0159b6b>] (08) [<c01599f0>] (32) [<c0158acd>] (36) Jan 15 22:47:40 linux kernel: [system_call+51/56] (60) ############################################################################ -- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq(a)suse.com

1 0

[OT] Bind9 not resolving the first time round ...
by Ray Leach 03 Feb '04

03 Feb '04

Hi All I use SuSE 9.0 on my firewall. I am having issues with Bind9 not resolving host the first time round. If the same wuery is issued within a few seconds, then it resolves correctly. I did a bit of research at google.com and came across a few list postings (of various lists) which suggest that bind9 is to blame. Are there currently any such known issues with bind 9.2.2 on SuSE 9.0? Their suggestions were to go back to bind8. Regards Ray -- -- Raymond Leach <raymondl(a)knowledgefactory.co.za> Network Support Specialist http://www.knowledgefactory.co.za "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 --

1 0

Re: [suse-security] Securing Remote Shell Access via PHP Module
by mailings - kunstwerke.designs 03 Feb '04

03 Feb '04

On Feb 3, mailings - kunstwerke.designs <mailings(a)kunstwerkedesigns.de> wrote: >> Hi People, >> >> need some advice in securing two suSe Linux 8.2 Server which should >> communicate through a remote Shell running on wwwrun ( PHP driven ). >> Servers are both secured with portsentry. > > >>I don't really understand what you mean by "php driven remote shell". Can >>you tell us the software that you are using? I am using a PHP Script i wrote to connect via ssh from a website on my Webserver to the remote one. Its only a process opened via proc_open() in PHP with which i join the shell remotely from my webserver using ssh2. >> Any hints / advices what else i should do to keep the risk down to a >> minimum? > > >>I would at least install a custom kernel with grsecurity patch, forbid >>users to see processes of other users and enable as many of the >>other security options as possible (some break e.g. java, so watch out). >>Of course, always watch your logfiles (logcheck) and apply security >>updates when they come out (fou4s). >>Markus Got to read something more about grsec patch, nice idea. Thanks ben

1 0

Securing Remote Shell Access via PHP Module
by mailings - kunstwerke.designs 03 Feb '04

03 Feb '04

Hi People, need some advice in securing two suSe Linux 8.2 Server which should communicate through a remote Shell running on wwwrun ( PHP driven ). Servers are both secured with portsentry. Any hints / advices what else i should do to keep the risk down to a minimum? Best Regards ben

2 1

low ports and a regular user
by seve7 03 Feb '04

03 Feb '04

just because this would make my life simpler, is there a way to allow some user (or group, etc) to execute a program that listens on a low port? a specific low port? thanks --r dorothy@oz: ~> ls lion scarecrow tinman dorothy@oz: ~> find . -name home There's no place like home.

1 0

RE: [suse-security] Is it iptables enough?
by Sturgis, Grant 03 Feb '04

03 Feb '04

SuSEFirewall is just an administration wrapper for iptables. > -----Original Message----- > From: John [mailto:isofroni@cc.uoi.gr] > Sent: Friday, January 30, 2004 12:49 PM > To: suse-security(a)suse.com > Subject: [suse-security] Is it iptables enough? > > > Is it iptables enough with the built-in firewall to secure a > SL 9.0 box? > This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

8 9

samba 3.0, winbind is not updating userlist - only on restart
by Markus Feilner 02 Feb '04

02 Feb '04

Hello List, I have successfuly brought samba 3.0 on SuSE (8.1,8.2,9.0) to work together with an Active Directory Server. I have (also successfully) enabled squid to use winbind for authentication for internet access. (I need winbind, because only members of a certain AD Group are allowed to access the internet.) Kerberos is running fine. My Problem is: After I add a new user to the AD: With wbinfo -a user%password i can successfully authenticate the new user. ("challenge/response password authentication succeeded") But the list i recieve from wbinfo -u does not show this user until winbind is started over. Why? Note that I have not defined a winbind cache time parameter in my smb.conf, and winbind is running with the -B option for dual server mode. I have searched samba + mailling list archives, but I have not found anything, same at google and new zealand wikis.. Please help! Thank you! -- Mit freundlichen Grüßen Markus Feilner -- Linux Solutions, Training, Seminare und Workshops - auch Inhouse Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

1 0

chkroot claims top infected
by dh 02 Feb '04

02 Feb '04

I brought up this issue on the SuSE English List (SLE) and it was suggested that I should pass my information along to this list. What follows is a cut and past of the thread from SLE... I just ran chkroot (chkrootkit-0.43, Sat Dec 27 2003) and it gave the results Checking `top'... INFECTED and Checking `lkm'... You have 5 process hidden for ps command I found these commands were in an rpm updated w/ synaptic recently, ps_2003.11.17-18_i586.rpm. The file can be found at ftp://ftp.gwdg.de/pub/linux/suse/apt/SuSE/9.0-i386/RPMS.suse-people top's size is 81.5kb and has a modified date of 2004-01-20 #top -h top: procps version 3.1.14 As further investigation I installed the previous rpm (ps-2003.9.20-6.i586.rpm) from SuSE and then ran checkroot again, this time no errors were reported. Then reinstalled the rpm from the apt repository and the errors appear again. I know this doesn't mean that I haven't been rooted but it really points a finger at the ps_2003.11.17-18_i586.rpm from ftp://ftp.gwdg.de/pub/linux/suse/apt/SuSE/9.0-i386/RPMS.suse-people (the apt archive) If so anyone using apt for their upgrades should be concerned about this. Continuing my investigation I booted up my test machine w/ SuSE 9.0 ran checkrootkit and it showed all clean. Then I used synaptic and updated ps (ps_2003.11.17-18_i586.rpm) and nothing else then I ran chkroot again and the errors are there. Anders Johansson wrote (from 3 separate messages): chkrootkit is reacting to the string /prof in top. That string isn't in the src.rpm, but it is in the binary. That alone is very suspicious. It does look like kraxel's binaries are infected. I wonder what other niceties are in the binaries in the apt repo The suspicious ps package is identical on suse.com and on gwdg.de, so it seems that if something has been compromised it's on suse.com. The problem is in the "top" in the ps package from /pub/people/kraxel The top binary in that contains the string "/prof", which chkrootkit detects as a sign of an infected binary That string isn't in the src.rpm from kraxel's directory, and if you rebuild the rpm from that src.rpm you also won't see that string. And finally a long quote from Ivan Sergio Borgonovo : I've done all these things Installed ps through apt Installed ps from DVD Compiled and installed ps from ftp.suse.com Installed chkrootkit from source Installed chkrootkit from apt and the result ranged from no infected packages, no modules loaded to, top or/and ps infected and hidden modules etc... I doubt that just substituting 2 binaries I can "unload" trojan modules. I gave a look at the sources of chkrootkit and discovered which binary was checking for "hidden" modules. I discovered it has an option -v and got this output stige:~ # chkproc -v PID 3: not in ps output PID 4: not in ps output PID 5: not in ps output PID 6: not in ps output You have 4 process hidden for ps command then I did... // edited to fit in email stige:~ # ps aux USER PID VSZ RSS TTY STAT START TIME COMMAND root 1 620 256 ? S 22:00 0:04 init [3] root 2 0 0 ? SW 22:00 0:00 [keventd] root 0 0 0 ? SWN 22:00 0:00 [ksoftirqd_CPU0] root 0 0 0 ? SW 22:00 0:00 [kswapd] root 0 0 0 ? SW 22:00 0:00 [bdflush] root 0 0 0 ? SW 22:00 0:00 [kupdated] root 8 0 0 ? SW 22:00 0:00 [khubd] root 9 0 0 ? SW< 22:00 0:00 [mdrecoveryd] Curiously enough /proc/3 is actually ksoftirqd_CPU0 /proc/4 is kswapd ... bdflush, kupdated out of panic mode: reasonable??? So there you have it. I would love to post back to the SLE and apt4SuSE lists that this is a non-issue but if there really is a problem then I am sure that the great minds on this list will be able to help. Thanks for your time and I do apologize if I've broken any etiquette, I just don't have time to read the whole FAQ, or search the archives right now . -- dh

2 2

automatic acquiring kerberos tickets
by Markus Feilner 02 Feb '04

02 Feb '04

Hello List, I have samba 3.0 on SuSE 8.1/8.2/9.0, (and debian) integrated in an Active directory. Works fine, Squid as Proxy uses winbind - ADS-Authentication. This of course only works as long as a valid kerberos ticket exists. How can I automatically recieve a ticket? kinit + cronjob won't work, (thank god - i don't need to save a passphrase on the system), because the password is required. I heard about keytabs and a key exchange system, but was not able to get information about that. Can anybody help me with that? Thank you! -- Mit freundlichen Grüßen Markus Feilner -- Linux Solutions, Training, Seminare und Workshops - auch Inhouse Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

1 0