September 2004 - openSUSE Security - openSUSE Mailing Lists

kernel: ip_conntrack: table full, dropping packet.
by peter.kanters＠nl.abnamro.com 12 Sep '04

12 Sep '04

Dear suse-security list, I had this problem : kernel: ip_conntrack: table full, dropping packet. I found this solution : sysctl -w net.ipv4.ip_conntrack_max="32768" After i restart susefirewall2 the value off ip_conntrack_max is back to default 16k . How can i solve this ?? Best regards, Peter. --------------------------------------------------------------------------- This message (including any attachments) is confidential and may be privileged. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorised use or dissemination of this message in whole or in part is strictly prohibited. Please note that e-mails are susceptible to change. ABN AMRO Bank N.V. (including its group companies) shall not be liable for the improper or incomplete transmission of the information contained in this communication nor for any delay in its receipt or damage to your system. ABN AMRO Bank N.V. (or its group companies) does not guarantee that the integrity of this communication has been maintained nor that this communication is free of viruses, interceptions or interference. ---------------------------------------------------------------------------

5 5

Using 9.1 as Bridgin Firewall
by Lucky Leavell 11 Sep '04

11 Sep '04

OS: SuSE 9.1 with latest patches I found the thread on using SuSE as a bridging firewall earlier this year but seem to be stuck. Topology: Internet Side: xxx.xxx.xxx.1 (Default Gateway) (Cisco router) Bridge: Defined bridge xxx.xxx.xxx.10 adding eth0 (connected to .1) and eth1 (LAN side). Default route defined as xxx.xxx.xxx.1 LAN Side: Test system xxx.xxx.xxx.29 I can ping .1, .10 and .29 from the bridge system and even surf the internet, etc. I can ping the bridge (.10) from the LAN side (.29) but cannot ping the gateway (.1). At this point there are no iptables rules in effect (iptables -L shows nothing) and SuSEfirewall2 is disabled. I have downloaded shorewall 2.0.8 and bridge-utils (from SuSE 9.1 CDs) but seem to be missing some thing here. Goal: Use the bridging firewall between a Cisco router and the rest of our networks to detect/defeat syn flood and smurf attacks. Cisco wants $US 2K/router for the enterprise version of their software to do this (times 4 routers!) which is a major outlay for a small ISP, hence urgency of getting this to work. (I have a bottom of the line MultiTech RF550VPN on one of the LAN side systems and even it has no problem stopping these attacks on the one system - we just need to duplicate this protection on several subnets.) Thank you, Lucky Leavell

3 3

Survey on Open Source
by Mike Chan 11 Sep '04

11 Sep '04

Dear all, I am conducting a survey on open source software, focusing on the OSS development and IT/IS costs in two separate questionnaires. This is for my coursework at the Curtin Uuniversity of Technology. Below are the links: Brief introduction page: http://web.singnet.com.sg/~mikecck/opensource/Introduction1.htm Questionnaire 1(Open Source Development): http://web.singnet.com.sg/~mikecck/opensource/WebFormA1.htm Questionnaire 2(Open Source and IT/IS Cost): http://web.singnet.com.sg/~mikecck/opensource/WebFormB1.htm It will be great to have your participation in this survey. Thanks. Mike Chan

1 0

Re: [suse-security] Apache User Authentication
by Armin Schoech 10 Sep '04

10 Sep '04

Hi Eric, > I am trying to setup user authentication on my SUSE 9.0 box and I keep=20 > running into 500 errors, or the username and password will not work in=20 > the pop up window. The errors I get in the logs are: >=20 > [Thu Sep 09 12:00:24 2004] [error] [client 192.168.1.103] (2)No such=20 > file or directory: Could not open password file: /etc/apache/.htaccess > [Thu Sep 09 12:00:24 2004] [error] [client 192.168.1.103] user admin not= =20 > found: / > --> Just a thought: have you check the ownership and access rights of /etc/apache/.htaccess ? On my SuSE 9.0 system, the process "httpd" runs as user "wwwrun". So=20 /etc/apache/.htaccess should be readable by user "wwwrun" and probably=20 not by anyone else (to protect from local users). HTH, Armin --=20 Am Hasenberg 26 office: Institut f=FCr Atmosph=E4renphysik D-18209 Bad Doberan Schloss-Stra=DFe 6 Tel. ++49-(0)38203/42137 D-18225 K=FChlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50

3 2

Kgpg
by Mark Tinka 10 Sep '04

10 Sep '04

hi all.. any idea when Kgpg will be include in the KDE base packages that arrive with SuSE..?.. i tried to look for it on my 9.1 Pro CD's but couldn't find it... www.kde.org mentioned it's now part of the KDE base, but this isn't the case with SuSE.. i had to install the older, standalone version, that doesn't require integration into KDE on install.. it may not be functioning at 100%, but works for the most part.. any ideas..?.. Mark. __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - 100MB free storage! http://promotions.yahoo.com/new_mail

2 1

RE: [suse-security] SUSE 9.0 Pro Production Quality?
by GarUlbricht7＠netscape.net 10 Sep '04

10 Sep '04

Eric Kahklen wrote on Thu Sep 09 2004 - 16:53:23 CEST: : > I had a discussion with my local LUG > and a member had some interesting threads to share. > Basically it showed that SUSE 9.0 is not really a production level version. > For production level use, > it is recommended to go with the Enterprise version of SUSE. > ---<text snipped>---- Hi Eric, You didn't say wheteher you were going to use SUSE 9.0 for a Production server or as Work stations, and whether you have Microsoft boxes on your local net and further how, if at all, you were going to connect to the net. The answers to those questions all affect "our" answer. You did mention "apt-get". There is an "apt-get" feature for SuSE I don't use it, but others do: (you can google for it, but be sure to read the "cautions") I use "fou4s" to get my security patches from SuSE (rather than YOU). I run fou4s in the "interactive mode, so my last step is: fou4s -i --inversecolor --interactive see: http://fou4s.gaugusch.at/ I run the stock SuSE kernel and download that separetly much like Sandu Mihai suggested on 9/8/2004 http://lists.suse.com/archive/suse-security/2004-Sep/0050.html That's why I run fou4s in the interactive mode, if I see a kernel update I skip it and handle it separetly. On some rpms I won't use the "patch rpm" but prefer the "complete" rpm which I get from my local mirror, or: http://www.suse.co.uk/uk/private/download/updates/90_i386.html I have run SuSE 8.0, 8.1, 8.2 and 9.0 as a "workstation, and found it to be "rock solid". I use both KDE and Mozilla, and only problems I run into is when I try leading edge stuff. Givn that, and that this is a security list, if you (or your System Admin) doesn't have extensive UNIX or Linux experience I would strongly suggest that you pay someone who does to help set up your separate firewall box. I believe that would be money well spent whether you used SuSE, Redhat, or Debian on your firewall box. Hope this helps, Gar -- Mark Twain: "Sorry I wrote such a long email; I didn't have time to write a short one." -- __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

5 5

Re: [suse-security] SUSE 9.0 Pro Production Quality?
by Philippe Vogel 10 Sep '04

10 Sep '04

>>> I had a discussion with my local LUG and a member had some interesting >>> threads to share. Basically it showed that SUSE 9.0 is not really a production level version. For production level use, it is recommended >>> to go with the Enterprise version of SUSE. Has other people got this impression? My concern is that my company can't afford to purchase >>> any more software at this time so would I be better off looking at >>> something like Debian? I know this is kind of off topic, but >>> basically I am curious if 9.0 Pro is secure and stable enough for my >>> organization needs. Debian is always a good choice if you use stable tree of the distribution. Fresh ISO's can be downloaded for free. Before Debian is released it is well tested. If the security-team thinks some stuff is not stable it get's off the stable tree. This means you got to get this software from somewhere different and then the system is not anymore a stable distribution. Stable means tested stable (= secure). Testing means beta-packages. Gentoo is a good choice if you want to have a fast and stable system, but it means much more work to do and is intended for peolpe with more linux-knowledge. All packages are compiled by hand and this is a reason why the distribution last longer for installing (you can choose how much you want to compile or if you use pre-compiled packages). All packages you compile gain a performanceboost, because they are compiled for your hardware. Because you get sourcepackages you always get the latest software. Gentoo is free for download. If you are not experienced enough you use SLES and gain the benefits of the mentenance included in the price. So it's your choice if you want a stable, fast or easy to configure distribution. The security depends always on the person behind the monitor (not on the distribution). I would choose debian with a 2.4.x kernel (it installs only needed packages - no commend to that :)). >> Sometimes I have the impression that the SuSE Professional releases are >> beta (and light) versions of the next SLES version.... Maybe I am wrong >> but this is a huge IMHO. > > > The focus of SUSE Professional are experienced (home and development) users. > > If you need business strength software for production use, SUSE Linux Enterprise > Server is more suited for you. > > Ciao, Marcus That's not an impression. SLES is always based on the latest stable release of a SuSE distribution (for SLES 8 if may be 8.1). The stable distributions are always not ending with a "0" after the point. This were 7.3 and 8.1 afaik and were used by SLES 7 and 8. So maybe 9.1 will not be used for SLES 9, because it's the first distro with 2.6.x kernel. Based on my experience only the first stable release of a SuSE distribution is used for SLES. One advantage of SLES is the mentenance and supportweb, the other is a more configureable yast-version with much more options, than in the Pro version (which makes a difference in the price). Another difference is the certification of hardware which runs with the distributions. This is sometimes altered by the bad quality of the latest updates. I didn't right now test SLES 8.0 - a reseller I know got it, but I didn't test it right now. I tested and installed SuSE Office Server for him and was disappointed because of missing packages (for a small office as firewall and samba/printserver it is o.k., but not for more). If I buy such software (which is more expensive, than Pro) I want to have the same functionality than the pro-version plus the benefits of mentenance. If I get less I spent to much money for things I by myself can do by hand on the pro-version with even more packages on the list. Philippe

2 1

Issues with pptpd
by Joebstl Thomas 10 Sep '04

10 Sep '04

Hi, I'm experiencing some weird issues with pptpd: The pptp server has an external interface with a routeable IP and an internal interface with 10.x.x.x IP where clients should connect to from our wlan and get assigned routeable IP's as well. pptpd is configured to listen on the internal 10.x.x.x address and accepts incoming calls fine, but some clients can never successfully establish a connection. I cant isolate the problem to a specific group of clients though - after a reboot (rcpptpd restart doesn't change anything) win98/ME/XP clients can connect, after the next restart only 98/XP, then only ME and so forth. I'm really getting annoyed with that stuff - latest version which works for me now is the one in Debian 3.0 which is ancient. I've had a tcpdump running and it showed some really weird traffic from pppd. Everytime a client couldnt establish a connection pppd used the external routeable IP as source IP for its packets - although ps awx and debug/dump show that it gets the proper local (10.x.x.x) IP address specified on the command line. The system is running 9.1 Pro with the latest updates as of 2 hours ago. I think I had it working before on a system running either 9.0 or 9.1 without any updates, but I cant remember exactly and thanks to maxtors QA department I cant check it anymore since the hdd is dead.... Would be nice to get some clues how to get it working reliable again. Regards, Thomas

1 0

Re: [suse-security] Bad quality of updates from SuSE ftp server
by Savvas Ladopoulos 10 Sep '04

10 Sep '04

It is very strange but here is, what formed the solution!!! After mounting the partitions, chroot sysimage bash started Yast. Uninstalled k_athlon... installed k_athlon...old exit yast mkinitrd lilo umount all reboot. It looks that the ft3xx driver now is loaded and working properly, not sure how...since I only installed the driver in the rescue option. As a result on startup before bios, fasttrack initializes and lilo starts up the system. Everything is working fine. Thank you for your help & advice Sandu. I will be a lot more carefull from now on. -savvas Στις 09/Σεπ/2004, ημέρα Πέμπτη και ώρα 16:06, ο/η Sandu Mihai έγραψε: > The mkinitrd command must be run from inside a CHROOTED shell onto the > sysimage directory. > After the mounts, do: > chroot sysimage bash > > then run /sbin/mkinitrd > > Savvas Ladopoulos wrote: > > >Sorry for the delay, had to do some reading. > > > >I was able to mount the system and did : > > > >Boot rescue > >mkdir sysimage > >mount /dev/sda2 sysimage > >mount /dev/sda1 sysimage/boot > >mount /dev/system/Home_VOlume sysimage/home > >mount /dev/system/Var_VOlume sysimage/var > >mount /dev/system/Usr_VOlume sysimage/usr > >mount /dev/system/Opt_VOlume sysimage/opt > >mount /dev/system/Srv_VOlume sysimage/srv > >mount /dev/system/Tmp_VOlume sysimage/tmp > > > >/sbin/mkinitrd > >exit > >umount sysimage/tmp > >umount sysimage/srv > >umount sysimage/opt > >umount sysimage/usr > >umount sysimage/var > >umount sysimage/home > >umount sysimage/boot > > > >sync > >reboot > > > >however i do get the same kernel panic! > >The good thing is that i was able to mount the Reiserfs. > >Mkinitrd did not load the fasttrack driver as seem from boot output. > >even if it was seen when run mkinitrd. > > > >-savvas > > > > > > > > > >Στις 08/Σεπ/2004, ημέρα Τετάρτη και ώρα 08:13, ο/η Sandu Mihai έγραψε: > > > > > >>On a second tought: > >> > >>Boot rescue > >>Mount system under a directory > >>chroot directory bash > >>/sbin/mkinitrd > >>exit > >>reboot > >> > >>Eg. for a system that has: > >>/dev/sda1 - boot > >>/dev/sda2 - root > >>/dev/sda3 - var > >>/dev/sda4 - swap > >> > >>Boot rescue > >>mkdir sysimage > >>mount /dev/sda2 sysimage > >>mount /dev/sda1 sysimage/boot > >>mount /dev/sda3 sysimage/var > >> > >> > > > > > > > >>/sbin/mkinitrd > >>exit > >>umount sysimage/var > >>umount sysimage/boot > >>umount sysimage > >>sync > >>sync > >>sync > >>ctrl-alt-del > >> > >>It seems that the kernel update probably did not run mkinitrd to refresh > >>the initrd (are you using SCSI or Ext3/Reiserfs probably). > >> > >>Sandu Mihai > >>GTS Telecom Network Engineer > >>RHCE #807202946505274 > >> > >>S andu Mihai wrote: > >> > >> > >> > >>>First of all, > >>> > >>>it is bad practice (tm) to directly update an important production > >>>server. Even with a trusted method of updates. > >>>One of the good practices include : > >>>- mirroring internally an external available source > >>>- testing updates on a set of servers / a server that mirror the > >>>behavior of the real target of updates > >>>- never let an external program directly update the kernel, rather do > >>>it by hand using rpm -i and not rpm -F, and then add the new kernel in > >>>Grub/Lilo if rpm -i dose not do it automatically (Redhat seemed to do > >>>that) > >>>You can undo that by : > >>>Booting in rescue mode, mounting the partitions of the system under a > >>>created directory in the RAM disk, copy the k_athlon...rpm from the > >>>first install CD in that directory, chroot <directory> bash, rpm -i > >>>k_athlon....rpm, vi /etc/lilo.conf or vi > >>>/boot/grub/menu.lst,/sbin/lilo (only if using lilo), exit > >>>Then, umount the partitions mounted under the directory, reboot. > >>>These are basic rescue methods one should be aware of , in case ugly > >>>things happen to kernel, or to some interesting files of the system > >>>(/etc/fstab is my favorite) > >>>Sorry for the not quite detailed description of the rescue steps, if > >>>these steps are really requested by the list I will then send a > >>>near-to-reality-step-by-step scenario. > >>> > >>>Best regards, > >>> > >>>Sandu Mihai > >>>GTS Telecom Network Engineer > >>>RHCE #807202946505274 > >>> > >>>Savvas Ladopoulos wrote: > >>> > >>> > >>> > >>>>Just read "Bad quality of updates from SuSE ftp server" and now I > >>>>understand what went wrong to my suse 9.0 update via YOU. Thank you all. > >>>> > >>>>However, I need some quidance on what to do next. I am left with "kernel > >>>>panic: VFS can not mount root fs on 08:02". > >>>>I managed with rescue to mount boot but I am not sure if I can undo the > >>>>2.4.21-243-athlon image to the previous version of 2.4.21-99-athlon? > >>>> > >>>>please any advise is much appreciated. > >>>> > >>>>-Savvas > >>>> > >>>> > >>>> > >>>> > >>>> > >>>> > >>>> > >>>> > >>> > >>> > > > > > > > >

1 0

Apache User Authentication
by Eric Kahklen 10 Sep '04

10 Sep '04

I am trying to setup user authentication on my SUSE 9.0 box and I keep running into 500 errors, or the username and password will not work in the pop up window. The errors I get in the logs are: [Thu Sep 09 12:00:24 2004] [error] [client 192.168.1.103] (2)No such file or directory: Could not open password file: /etc/apache/.htaccess [Thu Sep 09 12:00:24 2004] [error] [client 192.168.1.103] user admin not found: / I've set this up in the http.conf: <Directory "/srv/www/htdoc/"> AuthType Basic AuthName "Test Auth" AuthUserFile /etc/apache/.htaccess require valid-user </Directory> I used this to create the file: htpasswd -cmps /etc/apache/.htaccess admin I tried changing the AuthType to digest and creating the .htaccess file with plaintext or crypt options. I've done this on FreeBSD before, but wasn't sure if there was some other place or procedure for using this in SUSE. Thanks, Eric

1 0