September 2004 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Mailing Trouble ?!
by remote 09 Sep '04

09 Sep '04

Thanks for the replies. I posted it to SuSE-security because it´s the only SuSE forum I subscribe to, also I believed that my problem might be the result of either an over-eager anti-spam software or my firewall. > Your mx records show > 0 router.leat.ruhr-uni-bochum.de > 20 mi.ruhr-uni-bochum.de > > router.leat.ruhr-uni-bochum.de points to two A records 134.147.162.39 and > 134.147.55.1, both of which accept connections on port 25, but just timeout, > no error message or anything. 134.147.162.39 is my external NIC, 134.147.55.1 my internal NIC. Communication from outside my domain to 134.147.55.1 is blocked by the firewall, this is intended. Where can I change that so that my servers gives back the appropiate message ? I looked at sendmail.cf but didn´t find anything I deemed useful in that matter. Also, my knowledge of sendmail is pretty limited. > mi.ruhr-uni-bochum.de points to two A records 127.147.64.30 and > 134.147.32.86, both of which accept connections on port 25 and give back a > 220 message. > > I am guessing that because router.leat.ruhr-uni-bochum.de is accepting > connections, but giving out a 220 message or any message for that matter, > they may well be correct in not going to the backup mx. > So, how come I sometimes have mail communications from and to that specific site, and sometimes don´t ? Also, this mail server has been running continuously for two years now, and I never missed any mail that I know of. > One other quick question, what does this problem have to do with Suse > Security??? See above :) Thanks for the help, Jörg > ----- Original Message ----- > From: "remote" <remote(a)leat.ruhr-uni-bochum.de> > To: "SuSE-Security-Liste" <suse-security(a)suse.com> > Sent: Tuesday, September 07, 2004 10:07 AM > Subject: [suse-security] Mailing Trouble ?! > > > Hi ! > > I run a mail server at a university institute. Recently I noticed that mails > from and to a certain site disappeared without notification. After mailing > to the sysadmin of that site he told me that his mail server software had > given up sending mail to my server after having received an error code 421 > whichhe says means that the server is temporarily unable to accept SMTP > connections. His system seems to be either unwilling or unable to switch to > the alternate mail server in my MX records. > My problem is, I don´t know if there is anything wrong with my system. As > far as I know, this is the only case where my domain had trouble receiving > or sending mail. We experience sluggish mail traffic at times here, but > according to my university´s computing center that is their problem because > their server are running near full capacity. > As far as I have been able to find out, my DNS service is configured > correctly (Name resolution and reverse resolution work, my MX records are > correct and can be accessed from outside) and my domain is not listed on a > blacklist. > My questions : > 1) Is the inability to establish mail communication to and from this > specific site my problem or theirs ? > 2) How can I check if my system yields this error-code 421 message ? If so, > what can I do to correct it ? > . > My server is a Linux box running SuSE 8.0, sendmail version is 8.12.2. > > Thanks for the help, > > Jörg >

2 1

Freeswan, suse 9.1 ipsec initialization problem
by Dimitris Stamatoulis 09 Sep '04

09 Sep '04

Dear all, I have successfully set-up an ipsec tunnel between a suse 9.0 linux with freeswan 2.04_1_4_8 and a Cisco PIX 515. I decided to install suse 9.1to a new PC because the previous suse kernel was not working normally after freeswan was doing rekeying( ...incoming packet policy failed..blah, blah.). If anyone knows something about this please tell me. Anyway, I set-up a suse 9.1 with kernel 2.6. I installed freeswan 2.04_1_5_3 (included in the distribution) during the installation. I copied the ipsec.conf and ipsec.secrets files as well as the private, public and CA certificates from my previous successfull set-up with suse 9.0(kernel 2.4.21) to my new installation. I have a big problem now because I cannot even set-up the tunnel. PIX configuration has not been changed and my old setup is working. Here is the debug: Sep 9 16:31:37 linux pluto[21125]: added connection description "myconn" Sep 9 16:31:37 linux pluto[21125]: listening for IKE messages Sep 9 16:31:37 linux pluto[21125]: adding interface eth0/eth0 192.168.11.46 Sep 9 16:31:37 linux pluto[21125]: adding interface lo/lo 127.0.0.1 Sep 9 16:31:37 linux pluto[21125]: adding interface lo/lo ::1 Sep 9 16:31:37 linux pluto[21125]: loading secrets from "/etc/ipsec.secrets" Sep 9 16:31:37 linux pluto[21125]: loaded private key file '/etc/ipsec.d/newsuse91.pem' (887 bytes) Sep 9 16:31:37 linux pluto[21125]: "myconn" #1: initiating Main Mode Sep 9 16:31:37 linux ipsec__plutorun: 104 "myconn" #1: STATE_MAIN_I1: initiate Sep 9 16:31:37 linux ipsec__plutorun: ...could not start conn "myconn" Sep 9 16:31:37 linux pluto[21125]: "myconn" #1: ignoring Vendor ID payload [XAUTH] Sep 9 16:31:37 linux pluto[21125]: "myconn" #1: received Vendor ID payload [Dead Peer Detection] Sep 9 16:31:37 linux pluto[21125]: "myconn" #1: ignoring Vendor ID payload [Cisco-Unity] Sep 9 16:31:37 linux pluto[21125]: "myconn" #1: ignoring Vendor ID payload [3341804bef4cc911...] Sep 9 16:31:38 linux pluto[21125]: "myconn" #1: Peer ID is ID_FQDN: '@pixfw2.x.com' Sep 9 16:31:38 linux pluto[21125]: "myconn" #1: issuer crl not found Sep 9 16:31:38 linux pluto[21125]: "myconn" #1: ISAKMP SA established Sep 9 16:31:38 linux pluto[21125]: "myconn" #2: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+UP {using isakmp#1} Sep 9 16:31:38 linux pluto[21125]: "myconn" #1: ignoring informational payload, type NO_PROPOSAL_CHOSEN Sep 9 16:31:38 linux pluto[21125]: "myconn" #1: ignoring informational payload, type IPSEC_INITIAL_CONTACT Sep 9 16:31:48 linux pluto[21125]: packet from x.x.x.x:500: not enough room in input packet for ISAKMP Message (remain=0, sd->size=28) Sep 9 16:31:48 linux pluto[21125]: packet from x.x.x.x:500: sending notification PAYLOAD_MALFORMED to x.x.x.x:500 And here is my ipsec.conf: version 2.0 # conforms to second version of ipsec.conf specification # basic configuration config setup forwardcontrol=yes # default settings for connections conn %default ikelifetime=120 keylife=120 rekeymargin=30 #rekeyfuzz=0% keyexchange=ike esp=3des-md5-96 # Add connections here. conn myconn authby=rsasig left=%defaultroute leftcert=/etc/ipsec.d/newsuse91.crt right=1.1.1.1 rightid=(a)pixfw2.x.com rightsubnet=x.x.0.0/16 rightrsasigkey=%cert rightca=%same pfs=no auto=start # authorizes but doesn't start this # connection at startup # Switch off Opportunistic Encryption -- BEGIN conn block auto=ignore conn private auto=ignore conn private-or-clear auto=ignore conn clear-or-private auto=ignore conn clear auto=ignore conn packetdefault auto=ignore # Needed? conn OEself auto=ignore # Switch off Opportunistic Encryption -- END I receive this NO_PROPOSAL_CHOSEN which I don't receive using suse 9.0. I don't know what's going wrong. Please, give me some advise. Any thoughts would be appreciated too. Dimitris Stamatoulis

1 0

Re: [suse-security] Bad quality of updates from SuSE ftp server
by Savvas Ladopoulos 09 Sep '04

09 Sep '04

I tried what you say with no success. Tried to rpm -e k_athlon rpm -i k_athlon and know its worse got: invalid compressed format --system halted. but thank you for your help -savvas Στις 09/Σεπ/2004, ημέρα Πέμπτη και ώρα 16:06, ο/η Sandu Mihai έγραψε: > The mkinitrd command must be run from inside a CHROOTED shell onto the > sysimage directory. > After the mounts, do: > chroot sysimage bash > > then run /sbin/mkinitrd > > Savvas Ladopoulos wrote: > > >Sorry for the delay, had to do some reading. > > > >I was able to mount the system and did : > > > >Boot rescue > >mkdir sysimage > >mount /dev/sda2 sysimage > >mount /dev/sda1 sysimage/boot > >mount /dev/system/Home_VOlume sysimage/home > >mount /dev/system/Var_VOlume sysimage/var > >mount /dev/system/Usr_VOlume sysimage/usr > >mount /dev/system/Opt_VOlume sysimage/opt > >mount /dev/system/Srv_VOlume sysimage/srv > >mount /dev/system/Tmp_VOlume sysimage/tmp > > > >/sbin/mkinitrd > >exit > >umount sysimage/tmp > >umount sysimage/srv > >umount sysimage/opt > >umount sysimage/usr > >umount sysimage/var > >umount sysimage/home > >umount sysimage/boot > > > >sync > >reboot > > > >however i do get the same kernel panic! > >The good thing is that i was able to mount the Reiserfs. > >Mkinitrd did not load the fasttrack driver as seem from boot output. > >even if it was seen when run mkinitrd. > > > >-savvas > > > > > > > > > >Στις 08/Σεπ/2004, ημέρα Τετάρτη και ώρα 08:13, ο/η Sandu Mihai έγραψε: > > > > > >>On a second tought: > >> > >>Boot rescue > >>Mount system under a directory > >>chroot directory bash > >>/sbin/mkinitrd > >>exit > >>reboot > >> > >>Eg. for a system that has: > >>/dev/sda1 - boot > >>/dev/sda2 - root > >>/dev/sda3 - var > >>/dev/sda4 - swap > >> > >>Boot rescue > >>mkdir sysimage > >>mount /dev/sda2 sysimage > >>mount /dev/sda1 sysimage/boot > >>mount /dev/sda3 sysimage/var > >> > >> > > > > > > > >>/sbin/mkinitrd > >>exit > >>umount sysimage/var > >>umount sysimage/boot > >>umount sysimage > >>sync > >>sync > >>sync > >>ctrl-alt-del > >> > >>It seems that the kernel update probably did not run mkinitrd to refresh > >>the initrd (are you using SCSI or Ext3/Reiserfs probably). > >> > >>Sandu Mihai > >>GTS Telecom Network Engineer > >>RHCE #807202946505274 > >> > >>S andu Mihai wrote: > >> > >> > >> > >>>First of all, > >>> > >>>it is bad practice (tm) to directly update an important production > >>>server. Even with a trusted method of updates. > >>>One of the good practices include : > >>>- mirroring internally an external available source > >>>- testing updates on a set of servers / a server that mirror the > >>>behavior of the real target of updates > >>>- never let an external program directly update the kernel, rather do > >>>it by hand using rpm -i and not rpm -F, and then add the new kernel in > >>>Grub/Lilo if rpm -i dose not do it automatically (Redhat seemed to do > >>>that) > >>>You can undo that by : > >>>Booting in rescue mode, mounting the partitions of the system under a > >>>created directory in the RAM disk, copy the k_athlon...rpm from the > >>>first install CD in that directory, chroot <directory> bash, rpm -i > >>>k_athlon....rpm, vi /etc/lilo.conf or vi > >>>/boot/grub/menu.lst,/sbin/lilo (only if using lilo), exit > >>>Then, umount the partitions mounted under the directory, reboot. > >>>These are basic rescue methods one should be aware of , in case ugly > >>>things happen to kernel, or to some interesting files of the system > >>>(/etc/fstab is my favorite) > >>>Sorry for the not quite detailed description of the rescue steps, if > >>>these steps are really requested by the list I will then send a > >>>near-to-reality-step-by-step scenario. > >>> > >>>Best regards, > >>> > >>>Sandu Mihai > >>>GTS Telecom Network Engineer > >>>RHCE #807202946505274 > >>> > >>>Savvas Ladopoulos wrote: > >>> > >>> > >>> > >>>>Just read "Bad quality of updates from SuSE ftp server" and now I > >>>>understand what went wrong to my suse 9.0 update via YOU. Thank you all. > >>>> > >>>>However, I need some quidance on what to do next. I am left with "kernel > >>>>panic: VFS can not mount root fs on 08:02". > >>>>I managed with rescue to mount boot but I am not sure if I can undo the > >>>>2.4.21-243-athlon image to the previous version of 2.4.21-99-athlon? > >>>> > >>>>please any advise is much appreciated. > >>>> > >>>>-Savvas > >>>> > >>>> > >>>> > >>>> > >>>> > >>>> > >>>> > >>>> > >>> > >>> > > > > > > > >

1 0

updated snort rpm
by Eric Kahklen 09 Sep '04

09 Sep '04

Does anyone know where I can get an updated rpm for snort 2.2? I am running SUSE 9.0 pro Thanks, Eric -- ______________________________________________________________________

1 0

Bad quality of updates from SuSE ftp server
by Savvas Ladopoulos 08 Sep '04

08 Sep '04

Just read "Bad quality of updates from SuSE ftp server" and now I understand what went wrong to my suse 9.0 update via YOU. Thank you all. However, I need some quidance on what to do next. I am left with "kernel panic: VFS can not mount root fs on 08:02". I managed with rescue to mount boot but I am not sure if I can undo the 2.4.21-243-athlon image to the previous version of 2.4.21-99-athlon? please any advise is much appreciated. -Savvas

2 3

Help SuSEfirewall2 / ifup / kernel 2.6
by Dirk Enrique Seiffert - CaribeNet 08 Sep '04

08 Sep '04

This morning one of our firewall machines got reboot after a power failure. After startup we were not able to remotely login: For some reason eth0 (internal) and eth1 (external) got mixed up. Until SuSE 9.0 yast created for each interface a file named ifcfg-eth0, ifcfg-eth1 etc. SuSE 9.1 uses something like ifcfg-eth-id-00:0d:87:74:21:f3, ifcfg-eth-id-00:0d:87:74:21:f4 - ifconfig shows eth0 and eth1 though. My silly question is: How does ifup know on bootup which of these interfaces should be eth0 or eth1? Do I have to add a line like ETHERDEVICE=eth0 in ifcfg-eth-id-00:0d:87:74:21:f3 ? Thanks a lot Enrique -- CaribeNet S.A. - Cartagena - Colombia www.caribenet.com -- Este mensaje ha sido analizado por MailScanner en busca de virus y otros contenidos peligrosos, y se considera que está limpio.

2 1

Mailing Trouble ?!
by remote 07 Sep '04

07 Sep '04

Hi ! I run a mail server at a university institute. Recently I noticed that mails from and to a certain site disappeared without notification. After mailing to the sysadmin of that site he told me that his mail server software had given up sending mail to my server after having received an error code 421 whichhe says means that the server is temporarily unable to accept SMTP connections. His system seems to be either unwilling or unable to switch to the alternate mail server in my MX records. My problem is, I don´t know if there is anything wrong with my system. As far as I know, this is the only case where my domain had trouble receiving or sending mail. We experience sluggish mail traffic at times here, but according to my university´s computing center that is their problem because their server are running near full capacity. As far as I have been able to find out, my DNS service is configured correctly (Name resolution and reverse resolution work, my MX records are correct and can be accessed from outside) and my domain is not listed on a blacklist. My questions : 1) Is the inability to establish mail communication to and from this specific site my problem or theirs ? 2) How can I check if my system yields this error-code 421 message ? If so, what can I do to correct it ? . My server is a Linux box running SuSE 8.0, sendmail version is 8.12.2. Thanks for the help, Jörg

2 1

Disable login for x minutes after x failed logins?
by Kai Schaetzl 07 Sep '04

07 Sep '04

I want to either disable a remote login (ssh, ftp, pop etc.) after x failures completely, to the trying remote client (IP no.) or for x minutes. I searched the web up and down, but can't come up with a simple and concise explanation, how to do this. It seems pam_tally could somehow be used to achieve part of that, but not completely. F.i. it seems once the account is locked it is locked as long as someone unlocks it. Is pam_tally the way to go or are there better ways on a normal Suse 8/9 system? Is there a better explanation/howto than what can be found in the PAM docs, man or http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam.html (PAM system administrator's guide)? At least for me this documentation is quite scarce and I'm missing some real-word and "how-to" examples for a good start. I also wonder if any of the login.defs definitions is used if PAM gets used? I read somewhere that most of it is handled by PAM now, but some options were still valid, f.i. "fail_delay" (delay for next attempt after a failure), but I can't repro that, so it seems none of it is in use when using PAM? Thanks, Kai

3 5

Machine freezing - 9.1 updated yesterday
by Keith Hopper 06 Sep '04

06 Sep '04

Hi, I am sending the following to this list as there was considerable comment here about hard disc freezing shortly after 9.1 was released and this may afford some further insight into the problem - and solution? I have SuSE installed on an Acer Travelmate 530 and had no problems with mouse or keyboard with 8.2. However, upgrading to 9.1 caused apparently arbitrary freezes which appeared originally to be due to using mouse or keyboard. After some help from SuSE this was tracked down to the acpi module - probably having relation to the Synaptic mouse and battery control being on the motherboard (?). Disabling this in the earlier 9.1 releases cured the problem. Associated with this freezing went a rather odd error in respect of NFS mounts (I permit one specified IP address free access through the Firewall). When attempting to write to the remotely mounted point, writing would time out for no apparent reason if the linux hard disc concerned was not actually rotating - ie no start-up occurred due to the NFS write. Having disabled acpi and enabled apm when booting, the freezes - and the NFS disc writing problem - disappeared completely. I can now confirm that the problem still exists with the 2.6.5-7.108 kernel to which I updated yesterday. I have again disabled acpi and all is again well. Keith Hopper -- City Desk Waikato University [PGP key available if desired]

1 0

Spam with bad Message-Id blocked fetchmail
by Manfred Rebentisch 06 Sep '04

06 Sep '04

On one server sometimes comes spam with a Message-Id like this: <850293591151.90733@Z[5-]@hush.ai> Fetchmail ( fetchmail release 6.2.3+POP2+RPA+NTLM+SDPS+SSL+OPIE+NLS ) breaks with errors, send many error mails to the admin and stops fetching mails. Is this known as a problem? Does anybody know, how to configure fetchmail to resolve this? Thank you in advance Manfred Rebentisch

1 0