July 2004 - openSUSE Security - openSUSE Mailing Lists

Per user config for SpamAssassin with amavisd-new and cyrus-imapd
by David Huecking 26 Sep '04

26 Sep '04

Hi folks, maybe someone could give me a hint... I switched from: fetchmail->sendmail->sendmail.milter->Amavis->.forward->procmail->spamc(SpamAssasin)->INBOX which did global virus checking and per user spam checking with Bayes testing to fetchmail->postfix->amavisd-new->perl-spamassassin->cyrus-imapd which does global virus and global spam checking BUT NO PER USER spam checking, so without Bayes testing! :-( So the rate of unreconised spam did increase. I fiddled around with options in the /etc/mail/spamassassin/local.cf, but they were ignored because amavisd-new calls spamassin via perl interface and takes some SA parameters from the /etc/amavisd.conf (beginning with $sa_). I tried calling a SUIDed cyrus deliver (without SUID deliver hasn't got the right: deliver[3876]: connect(/var/lib/imap/socket/lmtp) failed: Permission denied) to user cyrus via .forward and a .procmailrc. The log said that lmtpd was called, but depending on the syntax of deliver in the .procmailrc the mail was delivered to the INBOX-file in /var/spool/mail or just vanished! One example for my .promailrc: :0 fw |/usr/bin/spamc -f |/usr/lib/cyrus/bin/deliver -e -a david -m user.david and the .forward: "|IFS=' ' && exec /usr/bin/procmail -f- || exit 75 #user" Could someone give me a hint using sieve or procmail for a per user SpamAssassin check? Thanks in advance. -- Eat, sleep and go running, David Huecking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216

2 2

network performance problems with SuSEfirewall2 and multiple interfaces
by Ralf Ronneburger 03 Aug '04

03 Aug '04

Hi everyone, I've a machine with 3 real and 15 virtual interfaces under SuSE 9.0 with SuSEfirewall2. Resulting from this I've also a lot of iptable-rules (iptables-save | wc -l gives me 1068 lines). After some weeks the machine slows down network-traffic, although everything else seems to run quite well (low CPU-load, low memory-usage), so I have to reboot it (restarting SuSEfirewall2 does not help). I wounder if anybody else has experienced something similar, if anything of that kind is known and if anybody has an idea, where the problem may lay. Greetings, Ralf

3 3

Unsubscribtion
by Vibeke & John Petersen 02 Aug '04

02 Aug '04

Please, unsubscribe me NOW! Thanks.

3 2

password recovery
by Lyle Giese 02 Aug '04

02 Aug '04

I have been using suse for a bit now, having used RH previously. One feature that I seem not to see or maybe it's just not there. In RH, there was a way to recover the root password. As I am an independant consultant, I can just imagine getting to a client's site and they don't remember/know the root password. Is there a way/method to recover/reset the root password in suse? Thanks, Lyle

17 30

Re: [suse-security] OT: VM killing sec relevant daemons
by Wolfgang Leithner 30 Jul '04

30 Jul '04

Dear Maarten, thanks for your reply. I definitely will put in more memory if the customer pays ;) > > Instead of memtest, just running 'top' or 'free' would have told you what's > wrong... if top or free had told me this I wouldn't have asked > Spamd and amavisd will quite easily kill your machine seen as it has only > 256 MB. Just one mass-mailing (inbound of outbound) will take care of > that. Been there, done that, got the T-shirt... It can't be easy as that, because the machine is up for almost half a year and only recently started to behave like this. On top of that, for three weeks in a row the customer sent tons of mails from this server (some promo or other) and nothing happened. Usually this server takes about 1000 mails inbound and about 500 to 1500 mails outbound in stride without so much as a whimp. All the time this happened for the last few days the load never reached 4.00 which I would've expected. And all the time more than 30% memwere unused... That's why I asked. Regards Wolfgang

3 3

tcpdump and esp packets
by bleonhardt＠analytek.de 30 Jul '04

30 Jul '04

Hi all, I guess it's OT, again.. but I need it quite quickly... ... I need to capture and decrypt esp packets to see, what's in ... anybody an idea ? I already have downloaded and installed the latest libcrypt ( openssl ), the latestet tcpdump ( I had to change the "configure" file to get "des_cbc_encrypt" implemented ) and the latest libpcap ... Now, I tried following : tcpdump -i eth0 -w dump.cap -n -vv -E des-cbc:shared-secret ip proto 50 or ip proto 51 or udp port 500 or udp port 4500 I see all the ESP packets but I can't see, if it's just a ping, or anything else... I also tried : tcpdump -i eth0 -w dump-cap -n -vv -E des-cbc:shared-secret esp host IPADDRESSOFTHEREMOTE-SECURED-HOST but didn't work at all... any ideas ? Many thanks, Alex

2 2

OT: VM killing sec relevant daemons
by Wolfgang Leithner 30 Jul '04

30 Jul '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear list, I know I am (slightly) off topc with this question, but for me it is definitely security related. Since a few days the server of one of my customers keeps telling me (in /var/log/messages): prime kernel: __alloc_pages: 0-order allocation failed (gfp=0x1d2/0) prime kernel: VM: killing process sendmail prime kernel: __alloc_pages: 0-order allocation failed (gfp=0x1d2/0) prime kernel: VM: killing process spamassassin several times in a row. After that it starts killing services and daemons, starting (always) with spamd and amavisd, followed by nfsserver and sendmail, with cups only a short time behind. Also the netfilter tables get flushed at some point, but without so much as a hint to when. Does anybody have a clue what this could possibly be? BTW memtest showed absolutely nothing so far... About the machine: P4 2GHz with 256 MB Memory, 2 HDD RAID1 as /, 2 HDD RAID1 as data storage Linux 9.0 Pro with only samba, nfsserver, sendmail, spamd, amavisd and sshd running. TIA Wolfgang - -- - ----------------------------------------------------- Wolfgang Leithner Pinguin-Systeme.at Bereich Systeme und Security EMail: wolfgang.leithner(a)pinguin-systeme.at http://www.pinguin-systeme.at - ----------------------------------------------------- GPG Key Fingerprint: 21FE FB64 BD83 8385 364A E927 BB2F F331 84FD 12A9 - ----------------------------------------------------- Diese Nachricht wurde elektronisch erstellt und traegt daher weder Unterschrift noch Siegel This message was electronically created and therefore bears neither signature nor seal - ----------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQFBCkc6uy/zMYT9EqkRApXkAJwK7bf3Y8cf3Slrh5SLcjHXIutYNACgimne dKo6THcJBu199nMqORPXaTk= =YNF1 -----END PGP SIGNATURE-----

2 2

Re: Re: [suse-security] Re: Problem with Windows Network Neighborhood and Linux
by Kris Hoelzer 30 Jul '04

30 Jul '04

Hey Joerg, > [...] Though I still wonder why any > clients seems to be able to initiate an election. Does this make sense technical answer: IMO Win-specific "workaround" (started about 16 years ago with netbeui) to realise also server/master browser -LESS topologies ("Workgroups"/"Arbeitgruppe") [there every box acts as a local caching server for himself] "political" answer: Ask Redmond, why -- better: use more unix-flavour Boxes ;o) Kris

2 1

Per domain/host options for sshd?
by Frank Steiner 29 Jul '04

29 Jul '04

Hi, is there any way to specify certain options for sshd only for some domains or hosts just like you can do it for the openssh client (Host section)? E.g., I would like to restrict the usage of authorized_keys files to certain "trusted" domains and disallow it from other domains. Does anyone know a way to do this? Thanks! cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: -4054

4 6

fs corrupted - permissions altered
by Miguel Albuquerque 28 Jul '04

28 Jul '04

Hi, My nightmare : one of our programmers accidently has "chown (as root) * -R". Hardware problems shuted down the box during the night and this morning the machine won't boot. I had tried several things : 1. normal reboot does an normal fs repair, then it hangs on "unable to mount /proc - only root can do that". The next reboot will eventually pass this phase but will stop on "init : runlevel 6 respawn too fast disabling for 5 minztes" and again and again. 2. boot in rescue mode - can't mount file system, anywhere (i figured now that HD devices are in RAID mode). What should i do. I am not that experienced with RAID and although i can handle an rescue environement this situation is above my skill i fear. Help will be much appreciated. Thanks. Miguel

4 4