July 2004 - openSUSE Security - openSUSE Mailing Lists

Site Firewall/Proxy
by Terry E. Milnes Jr. 28 Jul '04

28 Jul '04

I would like to setup my system as a transparent proxy and firewall for the rest of my PC's. Is this possible as I already have a router that all of the systems use to connect to the internet(which is also my cable modem, so I can't take it out of the loop)? If so, how would I go about doing it? Thanks! NeoFax

6 8

RE: [suse-security] fs corrupted - permissions altered
by José Luis Ledesma 28 Jul '04

28 Jul '04

First of all... you shouldn't give root permissions to programmers! I'm not a guru, but: How are you trying to mount the filesystem? is a hardware raid or a software one? ide or scsi drives? I supose you have solved the hardware problems, right? as much info you give, more help you will receive. José Luis Ledesma _______________ Competitiveness Telephone: +34 93 582 02 90 Email: jledesma(a)competitiveness.com Website: http://www.competitiveness.com -----Original Message----- From: Miguel Albuquerque [mailto:mfoacs@e-workshop.ch] Sent: miércoles, 28 de julio de 2004 10:49 To: suse-security(a)suse.com Subject: [suse-security] fs corrupted - permissions altered Hi, My nightmare : one of our programmers accidently has "chown (as root) * -R". Hardware problems shuted down the box during the night and this morning the machine won't boot. I had tried several things : 1. normal reboot does an normal fs repair, then it hangs on "unable to mount /proc - only root can do that". The next reboot will eventually pass this phase but will stop on "init : runlevel 6 respawn too fast disabling for 5 minztes" and again and again. 2. boot in rescue mode - can't mount file system, anywhere (i figured now that HD devices are in RAID mode). What should i do. I am not that experienced with RAID and although i can handle an rescue environement this situation is above my skill i fear. Help will be much appreciated. Thanks. Miguel -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

Re: [suse-security] Problem with sis900.o on 2.4.21-99-default
by Kyek, Andreas, VF-DE 27 Jul '04

27 Jul '04

Paolo Santancini wrote: > I've SuSe 9.0 professional installed in a Terminator Asus > Pentium IV 2Ghz. > Seem to be all right but my eth0 doesn't work even if the > module "sis900.o" is setup succesfully. I tried to find > out an update about "sis900.o" but nothing for my kernel: > "2.4.21-99-default" .... > Anyone may help me? a) 2.4.21-99 is rather old. There were a lot of Kernel updates for that one. I would try a new one (even for security reasons) b) what means "doesn't work" what does lspci say? do you see the card? messages in /var/log/messages? does the module load properly? do you see ethx? can you activate it? some more details would make it easier for the rest here Andreas

2 1

OT?: IP-Tables problem with WebSite access ala eBay, etc.
by bleonhardt＠analytek.de 27 Jul '04

27 Jul '04

Hi, this is a possible off-topic problem with IP-Tables and some Internet Sites ... I use a quite simple IP-Tables Ruleset to ensure, outgoing traffic is only possible to ports 1-1024 from internal network. Now, I have a problem to access some Internet sites, for example "ebay.de, ebay.com, atrada.de, etc." .. I have some other, additional rules but haven't them available, actually. If anybody is interested to help me, and this post IS OFF TOPIC, could you please reply to my topic at http://www.lis-24.de ? This is the Link to the threat : http://www.lis-24.de/viewtopic.php?p=198#198 Thank's to everybody !!! -Alex

1 0

Problem with sis900.o on 2.4.21-99-default
by Paolo Santancini 27 Jul '04

27 Jul '04

Hi all! I've SuSe 9.0 professional installed in a Terminator Asus Pentium IV 2Ghz. Seem to be all right but my eth0 doesn't work even if the module "sis900.o" is setup succesfully. I tried to find out an update about "sis900.o" but nothing for my kernel : "2.4.21-99-default" .... Anyone may help me? Thank Paolo

1 0

Problem with mod_ssl-2.8.7-120.i386.patch.rpm
by Armin Schoech 27 Jul '04

27 Jul '04

Hi ! I have a problem with the newest mod_ssl Patches on my SuSE 8.0 boxes. The error messsage ist: error: failed dependencies: apache = 1.3.23-152 is needed by mod_ssl-2.8.7-120 But there is no apache-1.3.23-152.i386.rpm on the SuSE FTP server. The latest patch for apache is apache-1.3.23-150.i386.rpm. There is only a apache-1.3.23-152.src.rpm but no pre-compiled rpm. Is anyone having the same problem ? Can I just force the update with "--nodeps" option ? Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50

1 0

Problems getting GPG key recognised by RPM
by Eric Seynaeve 27 Jul '04

27 Jul '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hey all, I'm trying to import a GPG key into RPM for package signature checking. However, the ascii armored key doesn't seem to be recognised by RPM, although the pseudo-package is created. The key has ID CD3140CD. Exporting an ascii armored public key gives a file as follows: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.2.4 (GNU/Linux) mQGiBD1Giz8RBACwOaLG5S5MhYRA6pg0s/h/MAda/KWR9SIIaA7OGqEITcuQbvG2 lmldBOlC2UZLxM7XZNz3p4xPotgbGJ/a7ZYTOE8aEvYo/oTkyHfqy956f4ujmike moZ5rn1Zu5ij6ze2Cz0GH1uVV3KvKRp9h+hNvjzm7T4sBFJ9PSwzuC19xwCg/+dF <snip> /3QnvaR72kd3dIh47GWnIbS4P8jxHrQhxEELe2pbiEYEGBECAAYFAj1Gi0QACgkQ t7/qz80xQM3FCwCfVhZ0eIlgJLlTowhkKs4/bWAZJSEAoPqcQpzxF9TX/0hq6DCL HuBYoivd =gkzc - -----END PGP PUBLIC KEY BLOCK----- This file was imported in to RPM with "rpm --import rainer.asc". No errors were reported during import. A list of current public keys known by rpm: # rpm -qa gpg-pubkey* gpg-pubkey-807235a8-3e26a1bc gpg-pubkey-9c800aca-39eef481 # rpm -qi gpg-pubkey-807235a8-3e26a1bc Name : gpg-pubkey Relocations: (not relocatable) Version : 807235a8 Vendor: (none) Release : 3e26a1bc Build Date: Wed Jul 21 14:35:30 2004 Install date: Wed Jul 21 14:35:30 2004 Build Host: localhost Group : Public Keys Source RPM: (none) Size : 0 License: pubkey Signature : (none) Summary : gpg(Rainer Lay <rainer.lay(a)informatik.uni-erlangen.de>) Description : - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: rpm-4.1.1 (beecrypt-2.2.0) mQGiBD1Giz8RBACwOaLG5S5MhYRA6pg0s/h/MAda/KWR9SIIaA7OGqEITcuQbvG2lmldBOlC 2UZLxM7XZNz3p4xPotgbGJ/a7ZYTOE8aEvYo/oTkyHfqy956f4ujmikemoZ5rn1Zu5ij6ze2 Cz0GH1uVV3KvKRp9h+hNvjzm7T4sBFJ9PSwzuC19xwCg/+dFQvXdGtgwcpI10Bx+JQ6z0t0E <snip> sLtMLzwY/3QnvaR72kd3dIh47GWnIbS4P8jxHrQhxEELe2pbiEYEGBECAAYFAj1Gi0QACgkQ t7/qz80xQM3FCwCfVhZ0eIlgJLlTowhkKs4/bWAZJSEAoPqcQpzxF9TX/0hq6DCLHuBYoivd =gkzc - -----END PGP PUBLIC KEY BLOCK----- As can be seen, the information seems to be different. Also, shouldn't the name of pseudo package give an indication as to the key id? Not surprisingly, a sigcheck of a package fails: # rpm -K k3b-0.11.12-0.pm.1.i586.rpm k3b-0.11.12-0.pm.1.i586.rpm: (SHA1) DSA sha1 md5 (GPG) NOT OK (MISSING KEYS: GPG#cd3140cd) However, checking the rpm agains the .asc file listed on the site, indicates the package seems to be OK. What am I doing wrong? I found http://lists.suse.com/archive/suse-security/2004-Mar/0073.html indicating that the problem might be in the signature of the key. Can anybody shed some light on this? How do I limit the export of the signature (the exported file is larger than other found signature files). I have tried to export the key from gpg with --openpgp or --pgp2 but that doesn't seem to influence the export. Thanks, Eric - -- eric.seynaeve(a)advalvas.be long GPG key id: B0BDB695395DDBFC key fingerprint: B207 1531 4D18 7142 7ED2 B835 B0BD B695 395D DBFC -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFA/mYwsL22lTld2/wRAqF5AJ9Cjtq3o1wEWEoN+tnJvRawpxwT3QCffMSf NRT4bQleGYfl8b0gEsjGBG8= =0np0 -----END PGP SIGNATURE-----

3 3

Installin Nesssus on SuSE 9.0
by Gian Fabio Palmerini 26 Jul '04

26 Jul '04

Hi folks, i am trying toinstall Nessus 2.1.1 on suse 9.0 as suggested in nessus' faq i have the following packages installed bison flex gtk-devel gtk2-devel glib-devel glib2-devel sharutils libpcap openssl libnet but when i try to compile nessus-core i have the following error: include -Wl,--export-dynamic -L/opt/gnome/lib -lgtk-x11-2.0 -lgdk-x11-2.0 -latk-1.0 -lgdk_pixbuf-2.0 -lm -lpangoxft-1.0 -lpangox-1.0 -lpango-1.0 -lgobject-2.0 -lgmodule-2.0 -ldl -lglib-2.0 -L/opt/gnome/lib -lglib gdchart0.94b/gd1.3/libgd.a -lm /usr/lib/gcc-lib/i586-suse-linux/3.3.1/../../../../i586-suse-linux/bin/ld: cannot find -lgtk-x11-2.0 collect2: ld returned 1 exit status make[1]: *** [nessus] Error 1 make[1]: Leaving directory `/home/mailer/DOWNLOAD/NESSUS21/nessus-core/nessus' make: *** [client] Error 2 what's wrong? where can i find that lib?? Regards Gian Fabio -- --- Gian Fabio Palmerini --- Spike Reply S.r.L g.palmerini(a)reply.it http://www.reply.it

4 4

RE: [suse-security] Cracking passwd "linux" with John (JTR) took 1hr
by Matt Bohall 26 Jul '04

26 Jul '04

>From what I've seen, the john -incremental test cracks passwords much faster then the default john options. I could crack numbers, uppercase, lowercase and one special char in less then 4 hours on a p4 3.0. Simple text passwords like linux done in 30 seconds, but you gotta realize that john guesses semi-randomly and not in a true brute force fasion. This is why its great for those single accounts that other crackers like rainbow couldn't get with letters and numbers. If you keep pressing enter the next time you run john, you should see its "progress" and actually see what pw's its using. Matt -----Original Message----- From: Al Bogner [mailto:suse-security@ml04c.pinguin.uni.cc] Sent: Saturday, July 24, 2004 10:20 AM To: suse-security(a)suse.com Subject: [suse-security] Cracking passwd "linux" with John (JTR) took 1hr I try to find out how secure my passwords are and tried the following: I created a file passwd.1 with the following content: test: $2a$05$CL3uN2mrTaP6zoDNubQsEuFhxIB0K4bIylcm5yuP5LTY8nZ3HJ4MO:1002:100:te st:/home/test:/bin/bash Then I used john from SuSE 9.1-DVD: john -users:test -session:testcrack passwd.1 Loaded 1 password hash (OpenBSD Blowfish [32/32]) linux (test) guesses: 1 time: 0:01:11:27 (3) c/s: 333 trying: linux Why does it take so long to crack a simple passwd like "linux", while the password test1 was found immediately? I used a XP 2700+ with the following bechmarks: john -test Benchmarking: Traditional DES [24/32 4K]... DONE Many salts: 223578 c/s real, 232391 c/s virtual Only one salt: 214406 c/s real, 218773 c/s virtual Benchmarking: BSDI DES (x725) [24/32 4K]... DONE Many salts: 8009 c/s real, 8139 c/s virtual Only one salt: 7924 c/s real, 8053 c/s virtual Benchmarking: FreeBSD MD5 [32/32]... DONE Raw: 5999 c/s real, 6262 c/s virtual Benchmarking: OpenBSD Blowfish (x32) [32/32]... DONE Raw: 362 c/s real, 370 c/s virtual Benchmarking: Kerberos AFS DES [24/32 4K]... DONE Short: 213350 c/s real, 215941 c/s virtual Long: 593561 c/s real, 595945 c/s virtual Benchmarking: NT LM DES [32/32 BS]... DONE Raw: 3056787 c/s real, 3062913 c/s virtual Al -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] Re: Problem with Windows Network Neighborhood and Linux
by remote 26 Jul '04

26 Jul '04

Hi ! The problem has been solved, icapturied network traffic showed that Samba for some unknown reason insisted on a re-election of the Master Browser every 2 seconds or so. Of course, name resolution broke down completely. After switching off Samba, the situation became normal again, even after re-activating Samba. Thanks for all the help, I learned a lot ! Though I still wonder why any clients seems to be able to initiate an election. Does this make sense ? Thanks, Jörg

1 0