September 2004 - openSUSE Security - openSUSE Mailing Lists

Kismet -- Orinoco Error
by Doug Foster 27 Sep '04

27 Sep '04

Whenever I run Kismet from Suse 9.1, I get the well-known "kernel: eth1: Error -5 writing packet to BAP " error showing up in the logs. Eventually the logs fill so fast that the computer becomes non-responsive. Interestingly, the problem does not occur whenever the computer associates with an AP before launching Kismet. The solution at http://www.kismetwireless.net/Forum/General/Messages/1058245225.517217 didn't work for me. Has anyone else had this Orinoco problem and if so, how did you fix it? -- Doug

1 0

Per user config for SpamAssassin with amavisd-new and cyrus-imapd
by David Huecking 26 Sep '04

26 Sep '04

Hi folks, maybe someone could give me a hint... I switched from: fetchmail->sendmail->sendmail.milter->Amavis->.forward->procmail->spamc(SpamAssasin)->INBOX which did global virus checking and per user spam checking with Bayes testing to fetchmail->postfix->amavisd-new->perl-spamassassin->cyrus-imapd which does global virus and global spam checking BUT NO PER USER spam checking, so without Bayes testing! :-( So the rate of unreconised spam did increase. I fiddled around with options in the /etc/mail/spamassassin/local.cf, but they were ignored because amavisd-new calls spamassin via perl interface and takes some SA parameters from the /etc/amavisd.conf (beginning with $sa_). I tried calling a SUIDed cyrus deliver (without SUID deliver hasn't got the right: deliver[3876]: connect(/var/lib/imap/socket/lmtp) failed: Permission denied) to user cyrus via .forward and a .procmailrc. The log said that lmtpd was called, but depending on the syntax of deliver in the .procmailrc the mail was delivered to the INBOX-file in /var/spool/mail or just vanished! One example for my .promailrc: :0 fw |/usr/bin/spamc -f |/usr/lib/cyrus/bin/deliver -e -a david -m user.david and the .forward: "|IFS=' ' && exec /usr/bin/procmail -f- || exit 75 #user" Could someone give me a hint using sieve or procmail for a per user SpamAssassin check? Thanks in advance. -- Eat, sleep and go running, David Huecking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216

2 2

Re: [suse-security] Making SuSE 9.1 a router?? HOW??
by John Andersen 25 Sep '04

25 Sep '04

On Saturday 25 September 2004 12:31 pm, melissad wrote: > So, how do I: > 1. force the eth0 (1.2.168.x.y) to be the external interface with > its default gateway and SuSE FW to see it as that > 2. set eth0 (192.168.x.y) as the default gateway for the internal > interface (or is this set in ip-tables)? > 3. If in ip-tables, what do I set for the default gateway for the > internal interface? It helps to think of it as Machines have default gateways, but interfaces don't. Machines connected to the internal interface need to point to that IP (172.16.16.1) as THEIR default gateway. But the SuSE box itself needs to point to its upstream (internet side) partner as ITS default gateway. So if the SuSE boxes eth0 (192.168.x.y) connects to the internet (presumably via a router) then your SuSE box's Default gateway is the IP of the router - usually 192.168.x.1. Boxes only have one default gateway, usually the IP of the next box upstream. -- _____________________________________ John Andersen

1 0

RE: [suse-security] Handling DoS Attacks from within
by GarUlbricht7＠netscape.net 25 Sep '04

25 Sep '04

Lucky Leavell wrote on Sat Sep 25 2004 - 05:08:42 CEST http://lists.suse.com/archive/suse-security/2004-Sep/0238.html > We are a small ISP using wireless (radio, not cellular) links and have > been experiencing increasing incidents of DoS (SYN Flood and smurf) > attacks. When first encountered, we built and deployed a bridging > firewall using SuSE 9.1 and Shorewall which does exactly what it is > designed to do: filter traffic entering > or leaving the subnet it protects. > >However, the statistics reveal that most of our attacks originate within >the subnet and not from the outside (internet). We have been using >ethereal to capture traffic and, using that to ID the source, cut them off >only to have the attack resume from another system on the subnet... (snip) > > Since most of our customers us M$ systems, > we are thinking we have several infested with some sort of worm > or trojan but it is a daunting task to identify the culprit > and remedy the situation. > ----<text trimmed>--- > >Questions: > > 1. What tools other than ethereal should we use? > 2. Is there any other protective measure we can take to fend > off the attacks from within our own networks given that > we do not have total control of the network as a corporate > user would? > 3. (snip) > > Any suggestions would be GREATLY appreciated > including other lists we might frequent. > > Thank you, > Lucky Leavell > Hi Lucky, Earlier today I read: http://www.securityfocus.com/columnists/267 It might have an idea or two you can use because it seems to me that your first problem is how to educate your customers to aid you in solving the problem. As one reviewer of the above article said: Sooner or later it comes down to the Human Firewall guarding the network Friendly greetings, -- __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

1 0

Handling DoS Attacks from within
by Lucky Leavell 25 Sep '04

25 Sep '04

We are a small ISP using wireless (radio, not cellular) links and have been experiencing increasing incidents of DoS (SYN Flood and smurf) attacks. When first encountered, we built and deployed a bridging firewall using SuSE 9.1 and Shorewall which does exactly what it is designed to do: filter traffic entering or leaving the subnet it protects. However, the statistics reveal that most of our attacks originate within the subnet and not from the outside (internet). We have been using ethereal to capture traffic and, using that to ID the source, cut them off only to have the attack resume from another system on the subnet. For example, Machine A will syn flood B but it also affects every other user on the subnet by consuming bandwidth. If we shut A off, then shortly, C will attack D, etc. Since most of our customers us M$ systems, we are thinking we have several infested with some sort of worm or trojan but it is a daunting task to identify the culprit and remedy the situation. What we have done: 1. Implement a bridging firewall to protect against attacks from the outside. 2. Inplement full email filtering using SuSE/Postfix/amavis-new/ clamAV/spamassassin. 3. Attempt to identify and deal with infested systems (Really the customers' responsibility but ...) Questions: 1. What tools other than ethereal should we use? 2. Is there any other protective measure we can take to fend off the attacks from within our own networks given that we do not have total control of the network as a corporate user would? 3. Are these particular worms or trojans which operate like this? Any suggestions would be GREATLY appreciated including other lists we might frequent. Thank you, Lucky Leavell

1 0

capability dazuko stops named xntpd
by Christoph Hanslik 24 Sep '04

24 Sep '04

Dear listmembers, dear maintainers, the problem I want to be helped in is about the capability. After installing the dazuko.ko module for running virus-scanning with avguard the services of xntpd and named give up to operate complaining: named: capset failed: Operation not permitted and: ntpd[3932]: cap_set_proc() failed to drop root privileges: Operation not permitted I am running SuSE 9.1 with the latest kernel 2.6.5-7.108-default and tried different dazuko-versions, latest was dazuko-2.0.4-pre2. Even with the latest kernel.org 2.6.8.1 it produced the same poor results. There is a module commoncap.ko but it is not included in the Makefile of /usr/src/linux-2.6.5-7.108-default/security but the commoncap.c is still there, for what purpose ist it omitted? I tried a lot with the capability=0 and selinux=0 in the /boot/grub/menu.lst entry, but the selinux is not in the mentioned kernel. Does anyone have an idea how can I run dazuko/avguard and named and xntpd on one machine? greetings and thanks in advance Christoph p.s.: the virus-scanning is working properly! -- >> -- hanslik(a)hanslux.de -- << >> -- http://www.hanslux.de -- <<

1 0

Pay attention after apache2 patch!
by Bjorn Tore Sund 24 Sep '04

24 Sep '04

On my SuSE 9.0 boxes running fou4s to update apache2 caused the service to stop running. A simple restart of the service was enough to fix it. On SuSE 9.1 it kept running, but only on one of the two 9.1 boxes I have with apache2 running was the automatic 'kill -HUP' from the update successfull. Again, a manual restart and no problem. Not worth debugging, but it's worth looking twice to make sure your apache2 server is still running after the upgrade, especially if you're running fully automated updates... Bjørn -- Bjørn Tore Sund Phone: (+47) 555-84894 Stupidity is like a System administrator Fax: (+47) 555-89672 fractal; universal and Math. Department Mobile: (+47) 918 68075 infinitely repetitive. University of Bergen VIP: 81724 Support: system(a)mi.uib.no Contact: teknisk(a)mi.uib.no Direct: bjornts(a)mi.uib.no

2 1

OpenVPN and x.509 certs - HOWTO ?
by Philipp Rusch 23 Sep '04

23 Sep '04

Hi all, Anybody who knows about doing OpenVPNs with x.509 certificates ? Any hint welcome, Philipp

1 0

Re: [suse-security] SSH password attacks
by Peer Stefan 23 Sep '04

23 Sep '04

Hi, > From: Carl A. Schreiber [mailto:gooly@gmx.at] > Sent: Donnerstag, 23. September 2004 10:55 > To: suse-security(a)suse.com > Subject: Re: [suse-security] SSH password attacks > > Hello, > > a question about a (SuSE)Firewall-Login: > > Is there a possibility (most probably) to restrict the ssh-access (user > and root) to the firewall to certain (local) networks like 10.10.10.*? Yes, you can filter ssh (port 22) by ipchains (SuSE-Firewall: FW_SERVICES_INT="ssh" and remove it from FW_SERVICES_EXT). > Am I on the right way that I must change > /etc/ssh/sshd_config > > Here I should change > #ListenAddress 0.0.0.0 > to > ListenAddress 10.10.10.0 > (with this only from the 10.10.10.0 net a user can login, > root login is denied anyway) The ListenAddress is the binding address of the daemon. It binds to the adapter with the given address and port - so if you use your internal address like 10.10.10.254 or whatever it only listens to ssh requests for this address. To allow requests only from certain subnets have a look at hosts.allow and hosts.deny. But it should suffice to use a firewall and bind sshd to local addresses only. > But _only_ this? > For me there is no need to protect from 'inside' as it is only me. > > Thanks in advance, > Carl You're welcome, Stefan

1 0

Anti-Spam news letter
by suse＠karsites.net 23 Sep '04

23 Sep '04

Hi all. If anyone is interested I can email you off list the latest copy of Bigfoots anti-spam newsletter. Has alot of interesting info in the fight against spammers. Regards - Keith

2 1

Re: [suse-security] harden_suse
by tfulton9909＠comcast.net 23 Sep '04

23 Sep '04

I was told that this was a resource for security questions to be answered. Could someone please help me. thanks Tom Fulton Novell San Jose, CA > On Mon, 09 Aug 2004 22:44:42 +0000, tfulton9909(a)comcast.net > wrote: > > Hello, > > What is that status of harden_suse in SLES 9 in light of Bastille being > released? > > thanks > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

3 2

Re:[suse-security] SSH password attacks
by Dustin Knuttgen 23 Sep '04

23 Sep '04

Hi all, I am, of course, seeing the same thing. I wonder if it might be because of SuSE now being owned by novell. Admin is a typical Novell server user account. Maybe someone is trying the attacks against the SuSE servers that they were using for Novell servers. Just a thought. Dustin Hi, by me the same: ... Sep 13 14:53:25 tempi sshd[7383]: Failed password for invalid user test from 220.73.215.151 port 52864 ssh2 Sep 13 14:53:28 tempi sshd[7385]: Failed password for invalid user guest from 220.73.215.151 port 52992 ssh2 Sep 13 14:53:30 tempi sshd[7387]: Failed password for admin from 220.73.215.151 port 53128 ssh2 Sep 13 14:53:33 tempi sshd[7393]: Failed password for admin from 220.73.215.151 port 53260 ssh2 Sep 13 14:53:36 tempi sshd[7396]: Failed password for invalid user user from 220.73.215.151 port 53392 ssh2 Sep 13 14:53:39 tempi sshd[7398]: Failed password for root from 220.73.215.151 port 53539 ssh2 Sep 13 14:53:41 tempi sshd[7400]: Failed password for root from 220.73.215.151 port 53678 ssh2 Sep 13 14:53:44 tempi sshd[7406]: Failed password for root from 220.73.215.151 port 53814 ssh2 Sep 13 14:53:47 tempi sshd[7408]: Failed password for invalid user test from 220.73.215.151 port 53948 ssh2 ... what I can do, is to block the addresses and read less logs :) On Mon, 20 Sep 2004 11:40:23 -0400, suse wrote > This may not be strictly SuSE related, but what the heck: Lately, > I've been getting tons of attempts to login via ssh for "guest", > "test", "user", and "admin". Plenty others for root, and even one > that seemed to have been a list of some script kiddie's /etc/passwd. > The root ones are pretty obvious and always blocked, but I've found > the others rather curious. > > Does anyone running a unix server really use "guest", "test", "user", > or "admin" as real accounts? Judging by the volume of attempts I'm > getting, there has to be something causing this. Was a borked > version of ssh server released for windows, or something? Or is > this trying to connect to zombie machines? From what I understand, > ssh server isn't common on windows, and those accounts certainly > aren't common to unix... Anyone know what's going on here? > > (I'm not worried about my machines, root is blocked by sshd and I > don't have the other accounts, I'm just curious.) > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here -- Yes of course I'm sure it's the red cable. I guarante[^%!/+)F#0c|'NO CARRIER -- STTS -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 2

Postfix Backscatter
by Uwe Debacher 22 Sep '04

22 Sep '04

Hi, my postfix-Mailserver on a SuSE9.1 system ist flooded by backscatter mails which are undeliverable (random addresses). At the moment it is nearly impossible to sent a mail to this system. Yesterday it handled (rejected) about 12.000 of such mails. This seems to be too slow. So i changed my configuration setting: smtpd_error_sleep_time = 0, stopped all RBL usage and increased the number of smtp processes from 2 to 80. Now my system seems to handle about 40.000/day but this is not enough, there is still only a small chance to send a normal mail. Is there any chance to optimize postfix so that it can handle much more mails/connections each day? Or any other idea to solve such backscatter problems? Best Uwe

5 8

Re: [suse-security] Postfix Backscatter
by Marc Samendinger 22 Sep '04

22 Sep '04

I'm sorry for the private mail that i accidentally sent to you Uwe. > -----Original Message----- > From: Uwe Debacher [mailto:suse@hsan.hh.schule.de] > Sent: Wednesday, September 22, 2004 2:29 PM general tuning tips can be found on www.postfix.org/TUNING_README.html www.stahl.bau.tu-bs.de/~hildeb/postfix/postfix_bottleneck.shtml > Am Mi, den 22.09.2004 schrieb Sven 'Darkman' Michels um 12:50: > > What Hardware and Setup do you use? Virtual Users? Database > it is a standard SuSE9.1 system only with real (Linux) users. > > the hardware memory/processor should be good enough. PC Hardware > (500MByte/5000bogomips) and the WAN connectivity is about 5MBit. > > > maybe bad hardware. If possible a post of postconf -n would > i attached the output, but i cut the domain/host information unknown_local_recipient_reject_code = 450 you definitely should change this to 550 I can't see anything that shold slow down your system that much. 40.000 Mails a day should be a joke to postfix. can you please show your uncommented master.cf entries > Best > Uwe marc

3 2

Re: [suse-security] IPSEC - SuSE 9.1 - Shorewall 2.x
by t.henneberger＠hcs-computer.de 22 Sep '04

22 Sep '04

Hello again ;) Subject: Re: [suse-security] IPSEC - SuSE 9.1 - Shorewall 2.x (22-Sep-2004 10:46) From: philipp.rusch(a)rusch-edv.de To: suse-security(a)suse.com > I got one step nearer to my goals: > > ISAKMP SA is established, so key-exchange seems to work and > encryption is not the reason. > But pluto complains, that he cannot find a connection for that SA, > although everything else is *exactly* like on 9.0 before. Hm, you may want to check the archive of the Openswan Mailinglist (http://lists.openswan.org/mailman/listinfo/), maybe someone else encountered that problem. > I did define my roadwarriors like that: > > # /etc/ipsec.conf - FreeS/WAN IPsec configuration file > version 2.0 # conforms to second version of ipsec.conf specification > > # basic configuration > config setup > interfaces=%defaultroute > klipsdebug=all > plutodebug=all > nat_traversal=yes > > Any hint appreciated, > Philipp I don't think it is related to your problem, but you can delele the interfaces line, as Native-IPsec doesn't use them anymore, and I think the debugging levels are a bit high. Best regards Thomas

1 0

Re: [suse-security] IPSEC - SuSE 9.1 - Shorewall 2.x
by t.henneberger＠hcs-computer.de 22 Sep '04

22 Sep '04

Hey Philipp > From: philipp.rusch(a)rusch-edv.de > To: suse-security(a)suse.com > Hi all, > > I use the same setup in production with Suse 8.1 / 8.2 and 9.0, > IPSEC-VPN with Freeswan and Shorewall as firewall. > ipsec.conf is modified for this new setup, main difference is > the kernel 2.6.x > > what happens: > - I don't see an interface "ipsec0" or similar anymore when I startup IPSEC Native IPsec doesn't have a virtual interface anymore, you only get this with KLIPS. > - I get errors in firewall logs about connection attempts from my road- > warriors on port 4500 (???) what's this ? UDP port 4500 is the ESP-Protocoll, I guess thats why your Roadwarriors are acting strange, too. Best Regards Thomas

2 2

strange: Open Ports, not owned by processes, SuSe 9.1
by Markus Gerke 22 Sep '04

22 Sep '04

Dear list! I encountered a strange behaviour of my 9.1-Installation. The system is listening to TCP-ports (for example 1024, 996) but I don't know which processes are assigned to it and I did not start a service. Here is the netstat -atp output right after boot (runlevel 3): Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 *:967 *:* LISTEN 4602/ypbind tcp 0 0 ipi230.ipi.:netbios-ssn *:* LISTEN 5260/smbd tcp 0 0 *:sunrpc *:* LISTEN 4403/portmap tcp 0 0 ipi230.ipi:microsoft-ds *:* LISTEN 5260/smbd tcp 0 0 *:ssh *:* LISTEN 4576/sshd That is OK, but after approx. 10 min. an additional port is open: Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 *:1024 *:* LISTEN - tcp 0 0 *:967 *:* LISTEN 4602/ypbind tcp 0 0 ipi230.ipi.:netbios-ssn *:* LISTEN 5260/smbd tcp 0 0 *:sunrpc *:* LISTEN 4403/portmap tcp 0 0 ipi230.ipi:microsoft-ds *:* LISTEN 5260/smbd tcp 0 0 *:ssh *:* LISTEN 4576/sshd There is no process assigned to 1024. I checked the system with chkrootkit and rkhunter, both negative. Do you know this behaviour? Is this a backdoor? Before I encountered this problem the system was permanently running in runlevel 5, also runninng CUPS. Perhaps this has something to do with the vulnerability solved with the patch from Sept. 15? Regards, Markus

3 3

Suse 9.0->apache2->mod_auth_ldap->bug ? When the fix will be available ?
by Dmitry Novosjolov 22 Sep '04

22 Sep '04

Hello All, I have a strange behavior of the module mod_auth_ldap in apache2 in suse 9.0: when configuring basic authentication like that: <VirtualHost *:80> ServerName default.domain.com DocumentRoot /www/default/htdocs <Directory /www/default/htdocs> order allow,deny AllowOverride All allow from 123.123.123.123 AuthLDAPUrl ldap://ldap.domain.com:389/dc=domain,dc=com?uid?sub? (objectclass=person) AuthLDAPBindDN cn=server,ou=services,dc=domain,dc=com AuthLDAPBindPassword password AuthType Basic AuthName "LDAP-Protected resource" require valid-user Satisfy any </Directory> </VirtualHost> when accessing not from trusted IP 123.123.123.123 the following thing happens: 1. a password dialog opens, to enable user to provide a correct password - good thing 2. intentionaly type INCORRECT user/password combination, submit. Get access denied with another dialog opening - good thing 3. Now type CORRECT user/password combination, still get access denied - not a good thing, probably bug ???!!!??? Note1: if you type in the first attempt correct user/password combination - no bad thing happen. Note2: could not find anything related explainig to that behavior in bug reports of apache, however that problem is fixed in the most recent release (see below) Note3: Nothing bad is seen in apache's log files after a failure. I use default version of apache2 package shipped with Suse 9.0: apache2-2.0.47-63 with prefork package. Update to the latest apache2 package available by the moment at ftp.suse.com (apache2-2.0.48-139) - does not help. Tests were made on two separate installations of Suse 9.0 system. The problem is fixed when building apache2-2.0.51 from sources, but the question is WHEN the fixed version will be available in updated at ftp.suse.com ? I really need it :) -- Best Regards, Novosjolov Dmitry

1 0

postfix
by Paul Ikanza 22 Sep '04

22 Sep '04

My Postfix keeps dying, some one give me some ideas on what could be wrong with it please.

3 2

ldconfig binding order correct ?
by Christian Volkmann 21 Sep '04

21 Sep '04

Hi SuSE security community, ldconfig / ld.so seems to include /usr/local/lib first and before /usr/lib. Is this the right order to load libraries ? Due some installation (self compiled version + suse-package) of nessus I found this "strange behavoir". /usr/sbin/nessusd started with the "self compiled" /usr/local/lib/* files. I expected this order only with a set LD_LIBRARY_PATH. May be it's define to take the pathes of /etc/ld.so.conf first. Does somebody an official definition of the "ld.so.conf" order ? Best regards, Christian PS: It's not a security problem until somebody is able to write a modified library to /usr/local/lib which is taken earlier than the /usr/lib/...

1 0

IPSEC - SuSE 9.1 - Shorewall 2.x
by Philipp Rusch 21 Sep '04

21 Sep '04

Hi all, I use the same setup in production with Suse 8.1 / 8.2 and 9.0, IPSEC-VPN with Freeswan and Shorewall as firewall. ipsec.conf is modified for this new setup, main difference is the kernel 2.6.x what happens: - I don't see an interface "ipsec0" or similar anymore when I startup IPSEC - I get errors in firewall logs about connection attempts from my road- warriors on port 4500 (???) what's this ? - My gateway "sees" the attempts to exchange SA info on port 500, but never gets farther as to complain about incomplete packets. Clients are W2K and WXP, both work ok with other freeswan connections and the same way to produce x.509 certs. Any hints ? Regards, Mit freundlichen Grüßen, Philipp Rusch ----------------------------------------------------------------- | EDV Beratung Rusch EDP Consulting Rusch | | Philipp Rusch IBM Certified AS/400 Specialist | | Am Errlich 9 WWW : http://www.rusch-edv.de/ | | D-61191 Rosbach, Mailto: Philipp.Rusch(a)rusch-edv.de | | Germany Ust.-ID: DE 157 548 731 | | Phone: (+49) 6003 3972 Mobile : (+49) 172 89 86 230 | | Fax : (+49) 6003 3795 | | | ----------------------------------------------------------------- Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte den Absender und vernichten Sie diese E-Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser E-Mail ist nicht gestattet. This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

1 0

ssl errors from imaps
by Aubrey King 21 Sep '04

21 Sep '04

I have been trying to set up this server for days and to no avail. I tried the docs here: http://portal.suse.com/sdb/en/2003/05/imap_ssl.html but they do not work, as I get the following errors in my /var/log/mail.err: Sep 21 14:32:35 ross1 imapd[11431]: Unable to load certificate from /etc/ssl/certs/imapd-192.168.0.199.pem, host=[192.168.0.6] Sep 21 14:32:35 ross1 imapd[11431]: SSL error status: error:0906D06C:PEM routines:PEM_read_bio:no start line Sep 21 14:32:35 ross1 imapd[11431]: SSL error status: error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib Where is the signing of the certs in the instructions? What is this error? Aubrey King Global Crossing, Ltd. IP Systems Engineering Systems Administrator

1 0

startup and shutdown
by Sébastien V 21 Sep '04

21 Sep '04

hi, I made a small shell script(firewall) and i want to launch this script when suse linux boot and shut down this script when i close suse linux. how can i do that? best regards sebastien _________________________________________________________________ MSN Search, le moteur de recherche qui pense comme vous ! http://search.msn.fr/worldwide.asp

5 4

Re: [suse-security] SELinux
by Marc Samendinger 21 Sep '04

21 Sep '04

On Tue, Sep 21, 2004 at 02:40:11PM +0200, suse(a)bortal.de wrote: > > I have not started the forensics on this box. Pulled it offline and > > left it running until I can get to it. > > You left it "running" ? If you leave your system running you can examine the content that is loaded in memory. > > > > I suspect, but cannot confirm, that it was via SSHv1 that I > > inadvertantly left enabled in webmin. > > > > SuSE want the HD image? > > I doubt it...it's not SuSE`s fault anyway :) No doubt about that, but maybe they want to play around with it? I'd ask your local honeynet project, I bet they'll be interessted in it. marc

2 1

SELinux
by Jophn Deo 21 Sep '04

21 Sep '04

Hello, I would like to know if SuSE has plans to integrate SELinux in YAST.For example with the other security setting ,easy local . ....paranoid local. Would be revolutionair if SuSE had a GUI interface in YAST to SELinux. Dreams are deceptive. My question is: Are there specific SuSE SELinux howto's or other documents regarding SELinux on SuSE 9.1 ? 1)Do i have to recompile the kernel 2)Is SELinux policy implementing ready on SuSE 9.1 ? 3)Are there SuSE 9.1 policy examples? kind regards, Jophn Deo

4 4