March 2004 - openSUSE Security - openSUSE Mailing Lists

read it immediately
by wiersig-ml＠dns.glamus.de 05 Mar '04

05 Mar '04

you are bad

1 0

useradd hangs
by Michael Ströder 05 Mar '04

05 Mar '04

HI! The useradd program hangs in an infinite loop on a Compaq server system with SuSE Linux 9.0 Professional. See strace log below. Relevant packages: k_smp4G-2.4.21-192 shadow-4.0.3-182 Anyone having a clue what that might be? Maybe it's related to the last kernel update? Ciao, Michael. -------------------------------- snip -------------------------------- [..repeating actions..] open("/etc/passwd", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=13757, ...}) = 0 mmap2(NULL, 13757, PROT_READ, MAP_SHARED, 4, 0) = 0x46171000 _llseek(4, 13757, [13757], SEEK_SET) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=13757, ...}) = 0 munmap(0x46171000, 13757) = 0 close(4) = 0 mremap(0x40377000, 98541568, 98541568, MREMAP_MAYMOVE) = 0x40377000 open("/etc/passwd", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=13757, ...}) = 0 mmap2(NULL, 13757, PROT_READ, MAP_SHARED, 4, 0) = 0x46171000 _llseek(4, 13757, [13757], SEEK_SET) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=13757, ...}) = 0 munmap(0x46171000, 13757) = 0 close(4) = 0 mremap(0x40377000, 98541568, 98541568, MREMAP_MAYMOVE) = 0x40377000 open("/etc/passwd", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=13757, ...}) = 0 mmap2(NULL, 13757, PROT_READ, MAP_SHARED, 4, 0) = 0x46171000 _llseek(4, 13757, [13757], SEEK_SET) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=13757, ...}) = 0 munmap(0x46171000, 13757) = 0 close(4) = 0 mremap(0x40377000, 98541568, 98545664, MREMAP_MAYMOVE) = 0x40377000 open("/etc/passwd", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=13757, ...}) = 0 mmap2(NULL, 13757, PROT_READ, MAP_SHARED, 4, 0) = 0x46172000 _llseek(4, 13757, [13757], SEEK_SET) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=13757, ...}) = 0 munmap(0x46172000, 13757) = 0 close(4) = 0 mremap(0x40377000, 98545664, 98545664, MREMAP_MAYMOVE) = 0x40377000 open("/etc/passwd", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=13757, ...}) = 0 mmap2(NULL, 13757, PROT_READ, MAP_SHARED, 4, 0) = 0x46172000 _llseek(4, 13757, [13757], SEEK_SET) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=13757, ...}) = 0 munmap(0x46172000, 13757) = 0 close(4) = 0 mremap(0x40377000, 98545664, 98545664, MREMAP_MAYMOVE) = 0x40377000 [..repeating actions..]

1 0

problems signing rpms
by Rainer Lay 05 Mar '04

05 Mar '04

Hi, whem I am signing rpms, the signed seems to be not OK: > faui6r [rpm-rainer/SRPMS] 46% rpm -K /tmp/rpm-rainer/RPMS/i586/iftop-0.16-0.pm.1.i586.rpm > /tmp/rpm-rainer/RPMS/i586/iftop-0.16-0.pm.1.i586.rpm: sha1 md5 OK > faui6r [rpm-rainer/SRPMS] 47% rpm --addsign /tmp/rpm-rainer/RPMS/i586/iftop-0.16-0.pm.1.i586.rpm > Enter pass phrase: > Das Passwort ist richtig. > /tmp/rpm-rainer/RPMS/i586/iftop-0.16-0.pm.1.i586.rpm: > faui6r [rpm-rainer/SRPMS] 48% rpm -K /tmp/rpm-rainer/RPMS/i586/iftop-0.16-0.pm.1.i586.rpm > /tmp/rpm-rainer/RPMS/i586/iftop-0.16-0.pm.1.i586.rpm: (SHA1) DSA sha1 md5 GPG NOT OK Whats wrong? My key ID is 0xCD3140CD This key is imported with rpm --import rainer.asc rpm is version rpm-4.1.1-71 Any hints? rgds, Rainer

2 2

MPPE/pppd
by Henrik Löwendahl-Nyrén 05 Mar '04

05 Mar '04

Hi! I'm running SuSE 9.0 with the k_deflt-2.4.21-192 kernel and pppd version 2.4.2 and the following mppe-support: # modinfo ppp_mppe filename: /lib/modules/2.4.21-192-default/kernel/drivers/net/ppp_mppe.o description: <none> author: <none> license: "Dual BSD/GPL" The problem is that pppd 2.4.2 and mppe 2.4.0 has compability issues - the mppe-options are different. This describes the problem: http://pptpclient.sourceforge.net/howto-diagnosis.phtml#mppe_rbkhns And here are the options for the different versions: http://pptpclient.sourceforge.net/howto-diagnosis.phtml#pppd_options One way to solve it is to use an older version of pppd, I guess, but that doesn't sound as the best solution. Is there a way to get mppe 2.4.2-support in the Suse kernel, without having to recompile it manually? If possible I'd like to keep my system as "rpm-clean" as possible, if you know what I mean... ;) But if the only way to get mppe 2.4.2-support is to recompile the kernel, I guess I'll just have to do that... Thanks in advance! /Henrik L-N -- ________________________________________________ Henrik Löwendahl-Nyrén, Systems Engineer, Student IT Karolinska Institutet, University Library Alfred Nobels allé 8:100, SE 141 83 Huddinge Mobile: +46 702 80 70 43 Telephone: +46 8 524 84 137 Fax: +46 8 524 84 310 Web: http://kib.ki.se - http://studentit.ki.se ________________________________________________

1 0

E-mail account disabling warning.
by staff＠suse.com 04 Mar '04

04 Mar '04

Hello user of Suse.com e-mail server, Your e-mail account will be disabled because of improper using in next three days, if you are still wishing to use it, please, resign your account information. Further details can be obtained from attached file. Have a good day, The Suse.com team http://www.suse.com

4 3

E-mail account disabling warning.
by staff＠suse.com 04 Mar '04

04 Mar '04

Dear user, the management of Suse.com mailing system wants to let you know that, We warn you about some attacks on your e-mail account. Your computer may contain viruses, in order to keep your computer and e-mail account safe, please, follow the instructions. For details see the attach. In order to read the attach you have to use the following password: 26753. Sincerely, The Suse.com team http://www.suse.com

8 8

Re: [suse-security-announce] SUSE Security Announcement: Linux Kernel (SuSE-SA:2004:005)
by Vincent Propice 04 Mar '04

04 Mar '04

> >ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/k_smp-2.4.21-189.i586.… Hello, i have a problem with this kernel on a HP/Compaq Proliant DL360 G3 with one 2.4GHz Xeon CPU (Hyperthreading actived) : Hyperthreading not supported, the message in boot.msg is : <4>WARNING: No sibling found for CPU 0 and cat /proc/cpuinfo : processor : 0 vendor_id : GenuineIntel cpu family : 15 model : 2 model name : Intel(R) Xeon(TM) CPU 2.40GHz stepping : 7 cpu MHz : 2399.393 cache size : 512 KB physical id : 3 siblings : 1 fdiv_bug : no hlt_bug : no f00f_bug : no coma_bug : no fpu : yes fpu_exception : yes cpuid level : 2 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm bogomips : 4784.12 I have installed the same kernel on a HP/Compaq Proliant ML 330 G3 with one 2.4 GHz Xeon and it works fine : cat /proc/cpuinfo : processor : 0 vendor_id : GenuineIntel cpu family : 15 model : 2 model name : Intel(R) Xeon(TM) CPU 2.40GHz stepping : 7 cpu MHz : 2399.433 cache size : 512 KB physical id : 0 siblings : 2 fdiv_bug : no hlt_bug : no f00f_bug : no coma_bug : no fpu : yes fpu_exception : yes cpuid level : 2 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm bogomips : 4784.12 processor : 1 vendor_id : GenuineIntel cpu family : 15 model : 2 model name : Intel(R) Xeon(TM) CPU 2.40GHz stepping : 7 cpu MHz : 2399.433 cache size : 512 KB physical id : 0 siblings : 2 fdiv_bug : no hlt_bug : no f00f_bug : no coma_bug : no fpu : yes fpu_exception : yes cpuid level : 2 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm bogomips : 4797.23 i don't understand what happen so please help me Thanks Vincent

4 5

Traffic redirection using SuSEFirewall2
by Manuel Balderrábano 04 Mar '04

04 Mar '04

Hi to all. I am using SuSEfirewall2 under SuSE 9.0. The firewall has three interfaces, for the EXT, INT and DMZ zones. Every address I use for the DMZ and INT zones are private (192.168.x.y). All traffic from the INT to the EXT and from the EXT to the DMZ interfaces is masqueraded. All traffic betwen the EXT and INT interfaces is OK, but I have a problem with the DMZ. I have an apache web server connected to the DMZ interfaz, using a crossover RJ-45. My problem is that all trafic is logged as coming from the firewall IP. It works perfectly, but I dont like the idea of not beeing able to log conections. Also I don't know if cookies will be handled correctly for each connection. I know this is because I masquerade all traffic going towards the DMZ, but I wonder if there is any way to do a port redirection using SuSEFirewall2. By port redirection I mean that all traffic coming to a specific port of the firewall will be redirected to a specific server on the DMZ zone, I think this is called circuit-level forwarding. Thanks in advance.

1 0

RE: [suse-security] firewall help..
by egilmore 04 Mar '04

04 Mar '04

OK, Thanks for all your help Maarten. Here's what I have so far, that is FINALLY doing something close to what I need. I haven't blocked everything yet, but I an developing rules to keep out alot of the nasties. Tell me what you think. -e /////////////////////////////////////////////////////////////// #!/bin/sh ##################################################################### # /etc/init.d/firewall {start|stop} # # a simple iptables firewall # # based on various scripts found online # to support virtual hosts, NAT rules and masquerading # # Last Rev.3/3/2004 ##################################################################### PATH="$PATH:/usr/bin/:/usr/sbin" DEPMOD=/sbin/depmod INSMOD=/sbin/insmod EXTIF=eth0 INTIF1=eth1 INTIF2=eth2 case "$1" in 'start') #======================================================= # Set policy for tables #======================================================= echo "Clearing any existing rules and setting default policy.." iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT #======================================================= # Flush rules in tables #======================================================= iptables -F iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD #======================================================= # Delete empty tables #======================================================= iptables -X #======================================================= # Flush the nat table and set it's policies #======================================================= iptables -t nat -F iptables -t nat --policy PREROUTING ACCEPT iptables -t nat --policy OUTPUT ACCEPT iptables -t nat --policy POSTROUTING ACCEPT #======================================================= # Allow unlimited loopback #======================================================= echo "Setting up loopback access..." iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT #======================================================= # Masquerade everything out eth0 #======================================================= echo "Setting up masquerading..." iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE #======================================================= # Allow all outbound connections from LAN(eth1 & eth2) # to Internet(eth0) # Allow only return traffic from those connections #======================================================= echo "Allow forwarding for 192.168.48.0 subnet..." echo "Allow forwarding for 192.168.5.0 subnet..." iptables -A FORWARD -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT #======================================================= # Allow all connections from LAN1(eth1) to LAN2(eth2) #======================================================= echo "Allow forwarding between internal networks..." iptables -A FORWARD -i $INTIF1 -o $INTIF2 -j ACCEPT iptables -A FORWARD -i $INTIF2 -o $INTIF1 -j ACCEPT #======================================================= # Allow unlimited outbound connections and return # traffic from firewall #======================================================= iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i $INTIF1 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i $INTIF2 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -o $EXTIF -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -o $INTIF1 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -o $INTIF2 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT #======================================================= # Allow ssh at the firewall machine (JANUS) #======================================================= iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p udp --dport 22 -j ACCEPT #======================================================= # Routing packets from the external LAN to EMDX #======================================================= echo "Associating internal address 192.168.48.211 with external address 193.54.48.211" iptables -t nat -A PREROUTING -p tcp --dst 193.54.48.211 -j DNAT --to-destination 192.168.48.211 iptables -t nat -A PREROUTING -p udp --dst 193.54.48.211 -j DNAT --to-destination 192.168.48.211 iptables -t nat -A PREROUTING -p icmp --dst 193.54.48.211 -j DNAT --to-destination 192.168.48.211 #======================================================= # Routing packets from an internal LAN to EMDX #======================================================= iptables -t nat -A POSTROUTING -p tcp --dst 193.54.48.211 -j SNAT --to-source 192.168.48.211 iptables -t nat -A POSTROUTING -p udp --dst 193.54.48.211 -j SNAT --to-source 192.168.48.211 iptables -t nat -A POSTROUTING -p icmp --dst 193.54.48.211 -j SNAT --to-source 192.168.48.211 #======================================================= # Routing packets from the external LAN to EMDSNAP #======================================================= echo "Associating internal address 192.168.5.217 with external address 193.54.48.217" iptables -t nat -A PREROUTING -p tcp --dst 193.54.48.217 -j DNAT --to-destination 192.168.5.217 iptables -t nat -A PREROUTING -p udp --dst 193.54.48.217 -j DNAT --to-destination 192.168.5.217 iptables -t nat -A PREROUTING -p icmp --dst 193.54.48.217 -j DNAT --to-destination 192.168.5.217 #======================================================= # Routing packets from an internal LAN to EMDSNAP #======================================================= iptables -t nat -A POSTROUTING -p tcp --dst 193.54.48.217 -j SNAT --to-source 192.168.5.217 iptables -t nat -A POSTROUTING -p udp --dst 193.54.48.217 -j SNAT --to-source 192.168.5.217 iptables -t nat -A POSTROUTING -p icmp --dst 193.54.48.217 -j SNAT --to-source 192.168.5.217 #======================================================= # Drop everything else (not implemented yet) #======================================================= #iptables -A block -j DROP #iptables -A INPUT -j block #iptables -A FORWARD -j block #iptables -L -n #iptables -t nat -L -n #======================================================= # Setup logging #======================================================= echo "Logging started..." iptables -A INPUT -j LOG #iptables -A FORWARD -j LOG #iptables -t nat -A PREROUTING -j LOG #iptables -t nat -A POSTROUTING -j LOG #iptables -A OUTPUT -j LOG #iptables -A block -j LOG ;; 'stop') echo "Flushing iptables firewall..." iptables -P INPUT ACCEPT iptables -F INPUT iptables -P OUTPUT ACCEPT iptables -F OUTPUT iptables -P FORWARD DROP iptables -F FORWARD #iptables -F block iptables -t nat -F ;; 'restart') $0 stop $0 start ;; *) echo "$0 {start|stop}" exit 1 ;; esac exit 0 ////////////////////////////////////////////////////////////////////////////// ///////////////

2 2

Amavis and NAI
by Bill Bishop 04 Mar '04

04 Mar '04

Just getting ready to trial Amavis with NAI- anybody done this? How well does it work? How much did they charge you for it? -B^2 ;)

2 1