September 2004 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Kernel update
by Wolf Josef 14 Sep '04

14 Sep '04

Marcus Meissner [mailto:meissner@suse.de] wrote: > On Mon, Sep 13, 2004 at 12:38:12PM -0400, Selcuk Ozturk wrote: > > At the time of last 2.6 kernel update, updates for the various 2.4 > > kernels was promised. It has been about 2 weeks since then > > and I still don't see any new 2.4 kernels. What is the status on > > these? > > Were they maybe not affected by the latest bugs? > > They are still in our update queue. While at it: The web pages that used to list available updates (for example http://www.suse.de/de/private/download/updates/91_i386.html ) don't list them anymore. Were they moved to a different place?

2 1

Fou4s 0.12.1 released
by Markus Gaugusch 13 Sep '04

13 Sep '04

Many thanks to all contributors and people who sent me mails about bugs in the last version! I just released fou4s 0.12.1 with the following changes: - The --checkdeleted option was broken (Please not that it doesn' work at all on SuSE 9.0/9.1 because I just can't find any deleted files after an update there - if you do, please tell me) - The kernel update reboot reminder did not work on SMP machines - Servers with user:pass URLs were not parsed correctly - The nagios check script was updated (thanks to Christoph Wegener) The latest version is available via "fou4s -ui --checkf" or from my homepage: http://fou4s.gaugusch.at/ kind regards Markus Gaugusch -- ____________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \

1 0

FTP server dirctory layout
by Muhammad Reza 13 Sep '04

13 Sep '04

Dear Lists What its exactly directory layout for FTP Installation server suse-9.1 ? -- regards, reza "Name one thing UNIX can't do that Win can, and I'll name 100 things it can't do that UNIX can"

1 0

Kernel update
by Selcuk Ozturk 13 Sep '04

13 Sep '04

At the time of last 2.6 kernel update, updates for the various 2.4 kernels was promised. It has been about 2 weeks since then and I still don't see any new 2.4 kernels. What is the status on these? Were they maybe not affected by the latest bugs? Selcuk

2 1

Tripwire vs rootkit Hunter
by John 13 Sep '04

13 Sep '04

Which is best? Has anyone tried both these tools?

2 2

tripwire twpol.txt for suse 9.0
by David Evans 13 Sep '04

13 Sep '04

Hello, Back in March 2004 some people where looking for a tripwire twpol.txt that was "tuned" to Suse 9.0. I found the conversation via google becuase i was looking for the same thing. Has anyone found or created such a file, and is so would you be willing to share it? Thanks Dave Evans The Berndtgroup www.berndtgroup.net

2 1

two issues: sshd error messages and adaptec scsi card lack of stability
by Mike Rose 13 Sep '04

13 Sep '04

Hi, Suse 9.1 installed on workstations. Central authentication using NIS from sun server. Error messages in /var/log/messages : Sep 1 14:15:52 PC sshd[7347]: error: Could not get shadow information for USER Sep 1 14:15:52 PC sshd[7347]: Accepted password for USER from ::IPv^address port 1022 ssh2 Not a major problem, but two minor questions: 1) why am I being told that the user is not in the shadow password file, when authentication is then being provided by NIS? 2) why is the client IP address being reported in IPv6 format? both are annoyances, but I would like to turn off the first and change the second to IPv4. ================ This is slightly OT, but given the recent spate of posts about production quality of Suse 9.1 Pro I thought I would post. I've already reported this as a problem to both Adaptec and Suse, but Adaptec SCSI RAID cards are fairly common (?). Hardware: Intel Xeon single CPU 4u high rack mount computer. 5 SCSI HDD, 2 IDE HDD. One Adaptec 2120S SCSI RAID controller. Configure Adaptec RAID controller for RAID 5 with all SCSI HDDs (array builds...). fdisk mkfs -t ext3 /dev/sda1 mkdir /data1 mount -t ext3 /dev/sda1 /data1 all fine. Do a simple write performance test onto new partition: time dd if=/dev/zero of=/data1/8gb bs=1024k count=8192 This usually works and gives performance of about 38MB/second (not great, but better than with the 2.4 kernel which was down at about 15 MB/second which was awful). Now create some files on /data1 by copying kernel source to it: cp -r /usr/src/linux /data1 frozen xterm. Can login to computer, but any process that touches the RAID array will hang and is completely unkillable. Errors in log are like this: Sep 9 09:52:39 tcmis kernel: aacraid: Host adapter reset request. SCSI hang ? Sep 9 09:52:39 tcmis kernel: aacraid: Host adapter appears dead Sep 9 09:52:39 tcmis kernel: scsi: Device offlined - not ready after error recovery: host 0 channel 0 id 0 lun 0 Sep 9 09:52:39 tcmis last message repeated 99 times Sep 9 09:52:39 tcmis kernel: SCSI error : return code = 0x6000000 Sep 9 09:52:39 tcmis kernel: end_request: I/O error, dev sda, sector 476263772 Sep 9 09:52:39 tcmis kernel: Buffer I/O error on device sda3, logical block 935884 Sep 9 09:52:39 tcmis kernel: lost page write due to I/O error on sda3 Sep 9 09:52:39 tcmis kernel: Buffer I/O error on device sda3, logical block 935892 Sep 9 09:52:40 tcmis kernel: lost page write due to I/O error on sda3 (LOTS) Now this could be a hardware problem, but the Adaptec card thinks it is happy, and it used to work with Redhat 9 (the 2.4 kernel that I mentioned earlier)...... This card is not supported with Suse 9.1 by Adaptec on their website: http://www.adaptec.com/worldwide/support/drivers_by_product.jsp?sess=no&lan… , but it has been out for a while now... on this same webpage you can get the source of the latest source for the aacraid module (1.1.5) which is different to the source used to the build the 2.6.5-7.108-default kernel.... it refused to compile against the running kernel. I would like to know if other people have this problem, of if you have a working RAID array with an Adaptec hardware controller. regards, Mike Rose

2 2

Martian addresses attempts
by Andy Bennett 13 Sep '04

13 Sep '04

I have a network pf Windows PC's which has all of a sudden started to run incredibly slowly, the PC's sometimes simply can't log on at all. When I run the 'iptraf' programme it appears that traffic is trying to get to ip addresses that simply aren't on the local network. The local network is 192.168.2. and all addresses should be in this range. Here is an example of a few log entries. 48 bytes; from 192.168.2.27:2190 to 192.168.91.211:445; first packet (SYN) 48 bytes; from 192.168.2.27:2191 to 192.168.172.38:445; first packet (SYN) 48 bytes; from 192.168.2.27:2192 to 192.168.168.5:445; first packet (SYN) 48 bytes; from 192.168.2.27:2193 to 192.168.51.177:445; first packet (SYN) 48 bytes; from 192.168.2.27:2194 to 192.168.250.226:445; first packet (SYN) 48 bytes; from 192.168.2.27:2195 to 192.168.23.69:445; first packet (SYN) Anyone got any idea what could be causing this. Regards Andy

5 4

Chkrootkit Scan
by Richard Ibbotson 13 Sep '04

13 Sep '04

Hi After updating my SuSE 9.1 workstation the other day and downloading chkrootkit-0.40 and compiling it I ran a scan with this useful utility program and found... Searching for Romanian rootkit ... nothing found Searching for anomalies in shell history files... nothing found Checking `asp'... not infected Checking `bindshell'... not infected Checking `lkm'... You have 12 process hidden for readdir command You have 12 process hidden for ps command >>> Warning: Possible LKM Trojan installed <<< Checking `rexedcs'... not found Checking `sniffer'... eth0 is not promisc Checking `wted'... nothing deleted Checking `scalper'... not infected Checking `slapper'... not infected Anything I can do to investigate this further ? My workstation is plugged into my domestic network which in turn connects to the net through an ISDN router/BSD firewall. The SuSEFireall is running on my workstation as an added precaution although it's probably not doing much for me in the way of protection. I'm supposing that this has arrived with some e-mail. Although, Amavis is installed and running. Regards Richard www.sheflug.co.uk

3 3

Portscans and SuSEFirewall2
by remote 13 Sep '04

13 Sep '04

Hi ! Today, my personal firewall notified my that my PC has been portscanned over the weekend over some higher ports(> 1024). My domain router/gateway is a SuSE 8.0 box with SuSEfirewall2. It is configured so that TCP communications can only pass through several specific ports (like 22, 25, 110, etc). All ports > 1024 are supposed to be blocked. Now I wonder : if my firewall is working as it should, how can I be portscanned ? My logs show no traffic with the IP number that scanned me which is not surprising since I only log denied traffic. Can anybody explain this to me ? Thanks, Jörg

1 0