March 2004 - openSUSE Security - openSUSE Mailing Lists

Re: Here
by bjornts＠mi.uib.no 30 Mar '04

30 Mar '04

Here is the file. [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of yours.pif] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0

CryptoAPI & losetup under SuSE 8.2
by Thomas Gaertner 29 Mar '04

29 Mar '04

-----BEGIN PGP SIGNED MESSAGE----- Hello List, I want to setup encrypted loopback devices using CryptoAPI from kernel 2.4.25. So my problem is, that the tools from util-linux which is from 8.2 are not aware of the CryptoAPI drivers. Does anybody know, where to get the correct util-linux package, as well as the patches needed to make it using the CryptoAPI implementation from kernel 2.4.25? Thanks... - -- Thomas Gaertner ( host leela ) Brandenburg Technical University at Cottbus - --------------------------------------------------------------- Please send only plain ASCII-Mail. In case your Mail will be turned down, use <Dr.Zoidberg-Earth at gmx dot net>. But beware - I check this mailbox only once a day. - -- Stop Nemo! No seawater fish in hands of unexperienced children! - --- PGP-Public-Key http://www-stud.informatik.tu-cottbus.de/~tgaertne/public-pgp-2048.04232001… -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux) iQEVAwUBQGb/DVRxDogMOg+VAQGd1QgAxAJoXH/qLiqK/2Nu3p9OsO6YeNUh54FN HXdUJ8a9Iv6w1HXQzC8uamuarTrgdTP7ttsl0THRkr5e0df79dpeSB27pmOCWSrg 26oHaMaK6OrpjzzSgC8qG/Si4kfCrseGmi2GeZW+paRG9nWlOeBBkxJbhZLWsc8t 9fv3gzys6oboK4Mp+FkW8YU4muQaxzrMnfAamJj9j06Xd4Rx31IaS09ITtcXBcV5 hLznk8/Qj3qn91GbdeLDvt3VKNnjZyR4bh6X2c4Thisggw0DKZxI38JZeDAzocvp 7ppuK/KsbN26bclaL2WpzV/nb59ls1TBy3wpdgZ6NNBXSdeuOgS2Ug== =F/ZH -----END PGP SIGNATURE-----

2 1

Re: Approved
by d.huecking＠gmx.net 29 Mar '04

29 Mar '04

Here is the file. [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of all_document.pif] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0

Weah, hello! :-)
by marc＠SUSE.DE 28 Mar '04

28 Mar '04

I don't bite, weah! password -- 31271 [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of Info.zip] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0

AW: [suse-security] Per user config for SpamAssassin with amavisd-new and cyrus-imapd
by Rasp, Robert 28 Mar '04

28 Mar '04

Hello David, i use spamassassin with qmail and i dont use a per-user-config. The first few weeks it worked very good but then the spamlevel begun to increase. Now i enabled RBL-Check. By default RBL is disabled in local.cf. This works very good but you have to look for servers that are offline or very slow. I simple tested all the servers in "/usr/share/spamassassin/20_head_tests.cf" (grep "check_rbl" 20_head_tests.cf). You can use nslookup for that. I disabled every slow server with '#'..... CU Robert -----Ursprüngliche Nachricht----- Von: David Huecking [mailto:d.huecking@gmx.net] Gesendet: Samstag, 27. März 2004 13:59 An: suse-security(a)suse.com Betreff: [suse-security] Per user config for SpamAssassin with amavisd-new and cyrus-imapd Hi folks, maybe someone could give me a hint... I switched from: fetchmail->sendmail->sendmail.milter->Amavis->.forward->procmail->spamc(SpamAssasin)->INBOX which did global virus checking and per user spam checking with Bayes testing to fetchmail->postfix->amavisd-new->perl-spamassassin->cyrus-imapd which does global virus and global spam checking BUT NO PER USER spam checking, so without Bayes testing! :-( So the rate of unreconised spam did increase. I fiddled around with options in the /etc/mail/spamassassin/local.cf, but they were ignored because amavisd-new calls spamassin via perl interface and takes some SA parameters from the /etc/amavisd.conf (beginning with $sa_). I tried calling a SUIDed cyrus deliver (without SUID deliver hasn't got the right: deliver[3876]: connect(/var/lib/imap/socket/lmtp) failed: Permission denied) to user cyrus via .forward and a .procmailrc. The log said that lmtpd was called, but depending on the syntax of deliver in the .procmailrc the mail was delivered to the INBOX-file in /var/spool/mail or just vanished! One example for my .promailrc: :0 fw |/usr/bin/spamc -f |/usr/lib/cyrus/bin/deliver -e -a david -m user.david and the .forward: "|IFS=' ' && exec /usr/bin/procmail -f- || exit 75 #user" Could someone give me a hint using sieve or procmail for a per user SpamAssassin check? Thanks in advance. -- Eat, sleep and go running, David Huecking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216 -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Re: [suse-security] Fw: mail-server: error report
by Marc Samendinger 26 Mar '04

26 Mar '04

> -----Original Message----- > From: Philippe Vogel [mailto:filiaap@freenet.de] > Sent: Friday, March 26, 2004 2:07 PM > > > Is there a possibility to unsuscribe this account? > I always get this back after posting to the list - equal wich > content (and > this nerves me!). > > Here a sample of the content: *snip* > > > > Send mail to "owner-mail-server(a)rtfm.mit.edu" to contact a > real person > > (We have a limited amount of time to answer questions, so > please read > > the help file before sending questions.) Have you ever tried to contact the owner? Either the above mentioned e-mail or postmaster@ should get you in contact with someone that knows what to do. I would think the people at MIT are capable to resolve your "problem" (if its really the MIT mailserver sending those mails). marc

1 0

RE: [suse-security] Fw: mail-server: error report
by Barry Gill 26 Mar '04

26 Mar '04

Philippe Vogel <filiaap(a)freenet.de> wrote the Mar 26, 2004 3:06 PM: > Is there a possibility to unsuscribe this account? > I always get this back after posting to the list - equal wich content (and > this nerves me!). I have already set up a filter for that domain to send it straight to /dev/null

1 0

Fw: mail-server: error report
by Philippe Vogel 26 Mar '04

26 Mar '04

Is there a possibility to unsuscribe this account? I always get this back after posting to the list - equal wich content (and this nerves me!). Here a sample of the content: ----- Original Message ----- From: <mail-server(a)rtfm.mit.edu> To: "Philippe Vogel" <filiaap(a)freenet.de> Sent: Friday, March 26, 2004 11:23 AM Subject: mail-server: error report > -----cut here----- > Errors were encountered by the mail server while parsing your message to it. > An annotated copy of your message is below. The annotations of each command > line are as follows (lines not annotated were not treated as commands by the > server): > - Could not be processed (e.g., missing file, illegal vote). > X Is not valid. > R Skipped because it is a repeat of a previous request in > the same message. > + Successfully interpreted. > Note that the server ignores the remainder of a message if it encounters > 20 errors in it. > Furthermore, only the first 20 requests in a message are honored. > > Output of successful commands will be sent under separate cover. > > X > hi all.. > X > > X > i am preparing to run Squid-2.5 on my SuSE Linux 8.2 > X > Professional server, and i want to do run in > X > transparent mode using the 2.4 kernel WCCP module with > X > a Cisco router... > X > > X > as i get along, i've noticed a problem with Netfilter > X > -- a bug that causes the automatic redirection of HTTP > X > packets to Squid's 3128 port to hang... this bug has > X > been reported in kernel 2.4.20, and SuSE Linux 8.2 Pro > X > is running kernel 2.4.20-108 (latest update)... > > X My Box: > > X SuSE 8.2 > X uname -a > X Linux <Host> 2.4.20-64GB-SMP > > X No patch to iptables, redirect int -> 8080 dansguardian -> 3128 squid -> no > X problem. > X We uses cisco routers as well, but no WCCP in our network. > X Maybe it depends on your WCCP-Patch (http://www.sublime.com.au/squid-wccp/). > [error limit reached; remainder of message ignored] > > The most common error in requests to the mail server is specifying an > incorrect file name. Other common errors include: > * incorrect case in file names (case IS significant when requesting files); > * including a signature or other extra text without a "quit" command > before it. > > Commands should be sent to "mail-server(a)rtfm.mit.edu". > > For general information on using the mail server, send a message > to "mail-server(a)rtfm.mit.edu" with a body of: > > help > > For a listing of top-level files and directories available at this > site, send a message to "mail-server(a)rtfm.mit.edu" with a body of: > > index > > Send mail to "owner-mail-server(a)rtfm.mit.edu" to contact a real person > (We have a limited amount of time to answer questions, so please read > the help file before sending questions.) > -----cut here----- >

2 1

impossible log message
by Selcuk Ozturk 26 Mar '04

26 Mar '04

I see occasionally copies of the following line in my email server's log. I looked at the kernel source and found point where this message is output. But, that portion of the code is marked as an 'impossible' case by comment. Obviously, that's not true. My question is whether this message has any security or stability consequences. I never had any problems with that server but, it would be good to hear if somebody has a more definitive answer. -- Mar 25 20:05:12 mail1 kernel: neigh_timer_handler(): timer & !nud_in_timer -- Selcuk PS: My server is a dual Xeon system running Suse 8.1.

1 0

Netfilter Bug -- kernel 2.4.20
by Mark Tinka 26 Mar '04

26 Mar '04

hi all.. i am preparing to run Squid-2.5 on my SuSE Linux 8.2 Professional server, and i want to do run in transparent mode using the 2.4 kernel WCCP module with a Cisco router... as i get along, i've noticed a problem with Netfilter -- a bug that causes the automatic redirection of HTTP packets to Squid's 3128 port to hang... this bug has been reported in kernel 2.4.20, and SuSE Linux 8.2 Pro is running kernel 2.4.20-108 (latest update)... i wonder - has SuSE patched the kernel of this bug..?.. please see below for the bug report as well as the patch for it... ------------------------------- Hello, netfilter guys. We run transparent web caches using ipt_REDIRECT, and after upgrading to 2.4.20, found that conntrack table overflows after a week or so. Quick examination showed large number of entries in SYN_SENT state with super long timeouts exist. The offending change was in include/linux/list.h. list_del() now zeros prev and next pointer of list_head, which circumvents is_confirmed() test. This didn't cause troubles to most conntrack entries which disappear by timing out. But as our cache was bypassing some of the connections, the machine was seeing only one way stream of packets (!IPS_SEEN_REPLY). And when the originating host terminates a bypassed connection by sending out RST packets, the corresponding entry is repeatedly removed from hash with death_by_tiemout() and soon confirmed again adding jiffies to expire time every time. Applying the following patch solved the problem. As I'm not on the list, please CC to me any comments regarding this problem. Thank you a lot for great netfilter. --- linux-2.4.20-orig/include/linux/netfilter_ipv4/listhelp.h 2003-02-20 16:48:27.000000000 +0900 +++ linux-2.4.20-rmap-pm/include/linux/netfilter_ipv4/listhelp.h 2003-02-20 16:45:30.000000000 +0900 @@ -57,10 +57,13 @@ if (!list_inlist(head, oldentry)) \ printk("LIST_DELETE: %s:%u `%s'(%p) not in %s.\n", \ __FILE__, __LINE__, #oldentry, oldentry, #head); \ - else list_del((struct list_head *)oldentry); \ + else __list_del(((struct list_head *)oldentry)->prev, \ + ((struct list_head *)oldentry)->next); \ } while(0) #else -#define LIST_DELETE(head, oldentry) list_del((struct list_head *)oldentry) +#define LIST_DELETE(head, oldentry) \ + __list_del(((struct list_head *)oldentry)->prev, \ + ((struct list_head *)oldentry)->next) #endif /* Append. */ ------------------------------------ all help appreciated... __________________________________ Do you Yahoo!? Yahoo! Finance Tax Center - File online. File on time. http://taxes.yahoo.com/filing.html

3 5