January 2005 - openSUSE Security - openSUSE Mailing Lists

selinux
by Cristian Del Carlo 17 Jan '05

17 Jan '05

Hi List, i wanna test selinux in my suse professional 9.1/9.2. Do you know some documentation that explain how to use selinux in suse? Best regards, Cristian Del Carlo

1 0

squid and active directory again ... squid doesn't get UserNames
by Markus Feilner 17 Jan '05

17 Jan '05

Hello List, I am somewhat stuck here... I have successfully intregrated my linux box into the active directory domain and I can access the proxy squid on it perfectly. Now I want to combine the two services, like I did several times before, with no problem. [A perl skript is called which checks whether the user is in an active directory group which is allowed to acess the internet.] But this is the first time with suse 9.2, and now i run into problems: I get FATAL errors in my squid cache.log file. ------------------------ FATAL: authenticateNTLMHandleReply: called with no result string Squid Cache (Version 2.5.STABLE6): Terminated abnormally. ------------------------------ Normally, the browser should hand over the User name to squid, but it doesn't - see my access.log: --------------------- 1105959574.911 4 192.194.146.14 TCP_DENIED/407 1716 GET http://www.google.de/ - NONE/- text/html 1105959618.610 4 192.194.146.14 TCP_DENIED/407 1716 GET http://www.google.de/ - NONE/- text/html 1105960427.520 5 192.194.146.14 TCP_DENIED/407 1716 GET http://www.google.de/ - NONE/- text/html --------------------- here the log from a working system: -------------------- 1105961962.811 162 192.16.110.16 TCP_MISS/304 217 GET http://www.n-tv.de/images/200501/5475522__.jpg domain\username DIRECT/217.27.2.150 - -------------------- Can u help me? Has anybody experienced something similar? Does the SuSE Squid support NTLM ? I hope... ;-) -- Mit freundlichen Grüßen Markus Feilner --------------------------- Bitte beachten Sie unsere neuen Adressdaten! Vielen Dank. --------------------------- Feilner IT Linux & GIS Linux Solutions, Training, Seminare und Workshops - auch Inhouse Beraiterweg 4 93047 Regensburg fon +49 941 9465243 fax +49 941 9465244 mobil + +49 170 3027092 mail mfeilner(a)feilner-it.net web http://www.feilner-it.net

1 1

cyrus-imap and sieve with MD5?
by Markus Feilner 16 Jan '05

16 Jan '05

Hello List, I have trouble getting sieve to work with cramm-md5 or digest-md5 encryption. Whereas imap works, timsieve says "authorisation error" or similar errors - depending on the client. sieveshell simply doesn't take any password (same for all users) kioslave gives an "authorization error" smartsieve says it can' connect to the imap server. right now i have cyrus/sieve working with tls, which will do for the moment, but: Is it possible to enable MD5 encryption for sieve? Where can I put options for sieve, like debugging-style verbosity? /etc/imapd.conf ? The manpage knows only few options... Where can i find out commands for the telnet interface ? Thank you ! -- Mit freundlichen Grüßen Markus Feilner --------------------------- Bitte beachten Sie unsere neuen Adressdaten! Vielen Dank. --------------------------- Feilner IT Linux & GIS Linux Solutions, Training, Seminare und Workshops - auch Inhouse Beraiterweg 4 93047 Regensburg fon +49 941 9465243 fax +49 941 9465244 mobil + +49 170 3027092 mail mfeilner(a)feilner-it.net web http://www.feilner-it.net

1 0

SuSEFirewall FW_MASQ_NETS help
by Dirk Enrique Seiffert 15 Jan '05

15 Jan '05

I am trying to restrict ports below 1024 on my internal network interface. In /etc/sysconfig SuSEfirewall my configuration says: FW_MASQ_NETS="192.168.100.0/24,0.0,tcp,1024:65535" When I restart SuSEfirewall the logs show: rcSuSEfirewall2 restart Starting Firewall Initialization (phase 2 of 3) iptables v1.2.9: invalid TCP port/service `65535' specified Try `iptables -h' or 'iptables --help' for more information. iptables v1.2.9: invalid TCP port/service `65535' specified Try `iptables -h' or 'iptables --help' for more information. iptables v1.2.9: invalid TCP port/service `65535' specified This happens with any port or portrange I choose. I tried also FW_MASQ_NETS="192.168.100.0/24,tcp,1024:65535" as described in the SuSE examples. In this SuSEfirewall complains: The protocol with FW_MASQ_NETS must be tcp, udp or empty-> 192.168.100.0/24,tcp,1024:65535 Thanks for any advice! Best wishes Enrique -- Dirk Enrique Seiffert CaribeNet S.A. - Cartagena - Colombia www.caribenet.com

2 2

Wine and ISDN
by Nihad Mujkanovic 15 Jan '05

15 Jan '05

NOW I AM REALLY PISSED OFF! At first I wanted to title this "DOS attack performed by SuSE" or "Sabotage performed by SuSE", but I managed it to cool down a bit, so I hopefully don't hit the wrong guy(s), but someone's got to be blamed and flamed, since this is a neverending story. I don't know if it's the team working on WINE or SuSE team compiling the packages for the distro, I assume it's both of them at the end. What they allow themselves is a pure sabotage and because it repeats in several distributions (I can remember at least the last 4-5) I can't believe that is an act of ignorance or a minor failure: I have never in my life had anything to do with ISDN and I don't have any hardware for this shit and I am even less interested in getting it, but SuSE is FORCING me to install ISDN packages, nevertheless. I ALWAYS deselect this crap and set it to "tabu", but the first time the system s allowed to automatically install a packet I happen to need (e.g. bttv in my case), it IGNORES any settings from installation time and installs all things I do not need: capi4linux, a bunch of isdn packages, formerly even "gnokii". Have you ever noticed that even if you deselect capi4linux, there are still packages required by it? Story background: I use wine sometimes and want it in my computer. Now, some brainless idiot(s) have set the package requirements so that you can't dodge, you'll get shot down anyway. Do they have something against smoothly running systems? Mine was OK, then I let the system automatically install packages needed for my TV card, and what happens? My computer hangs while trying to unload ISDN modules on reboot, and can't reboot any more!!! The only thing that helped was he reset button. After reboot, I saw there was a new entry in runlevel editor - you guess - "ISDN" and it was ON!!! I'm lucky this happened in my test machine and not in one of the servers I have running SuSE, but I am still VERY pissed off. What now? I don't believe that SuSE people are a bunch of idiots, because they have done many good things and hopefully will keep on doing them further. I don't believe it HAS to be this way, because other distributions don't do this to me/us. I don't believe they haven't noticed this, because this repeats for years, so what remains? Nothing I can think of but pure ignorance. This is not the only one thing that made me jump over to gentoo, but this is the only one that made me write this letter already three times ago, but every time till now I cooled down and trashed the mails. Now I won't. I have payed 90 EUR for the shit and I WANT IT WORKING PROPERLY! Don't you, wouldn't you, too? regards Dr. Nihad Mujkanovic Vienna, Austria

6 8

syslog, syslog-ng und logserver
by Markus Feilner 14 Jan '05

14 Jan '05

Hello List, can you give me a hint: I have a Linux Backup Server (NAS) running Samba and I want to transfer my logfiles to another Linux host. It's Easy, but not satisfying with old syslog: I get all the messages in the syslog file of the Linux Loghost. I read that syslog-ng might be the best way for me: I want to build a log Server with one directory per host and separate files in these corresponding the services. like: /var/log/NAS/messages /var/log/NAS/warn /var/log/NAS/mail /var/log/NAS/samba/log.smbd /var/log/NAS/samba/log.nmbd and for our proxy: /var/log/PROXY/messages ... /var/log/squid/access.log ... 4 Questions: Is this setup possible? Do I need to setup syslog-ng on all Clients? Does it make sense? Does anybody have better recommendations? Thanks a lot -- Mit freundlichen Grüßen Markus Feilner --------------------------- Bitte beachten Sie unsere neuen Adressdaten! Vielen Dank. --------------------------- Feilner IT Linux & GIS Linux Solutions, Training, Seminare und Workshops - auch Inhouse Beraiterweg 4 93047 Regensburg fon +49 941 9465243 fax +49 941 9465244 mobil + +49 170 3027092 mail mfeilner(a)feilner-it.net web http://www.feilner-it.net

2 2

Re: [suse-security] telnet doesnt work
by Romeo Theriault 13 Jan '05

13 Jan '05

To: Allen <gorebofh(a)comcast.net> You may be great at using computers but with an attitude like yours I don't blame anyone for not hiring you. Romeo Theriault On Thu, Jan 13, 2005 at 10:48:48AM +0100, David De Maeyer wrote: > To be honest, I really dislike the way people used to communicate with > Riaz. Don't call people idiot nor stupid because they do mistakes. Teach > them what they should do OR like in this case not do. If you are toobusy > to respond or just don't care, don't pollute the mailing-list with > childish and arrogant posts. Give the man a chance instead. I told him exactly how to fix his problem after I called him an Idiot. This isn't some run of the mill newbie who needed help, this person worked for HP, one fo the largest computer companies in the World.... I would understand if he was a newbie who was new to computing, but an HP employee? Hell no. I can't even get a job flippin' burgers but that guy can work at HP and be a threat to national security at the same time.... Wait, let me re-word that, WAS a threat to national security. Last I heard the Pentagon was notified of him and he was mud. I'm not saying you can't make mistakes, but DAMN, when the whole list is telling you telnet is crap, and that you should REALLY not use it, and everyone trying to help him, hello, he works at HP trying to get into a DoD computer and we should treat him nicer? Maybe if he would have asked how to EDIT the firewall config, then, maybe, even though he was still workign at HP and should already know this crap, but OK, but no, he asked how to shut it down completely. > All of us have been dummy newbies one day, never forget that. AndRiaz... > don't worry too much, according to this mailing-list idioticscale, I am > probably as "idiot" as you. You are not alone! Yes, but most of us "dummies" weren't working at HP with an actual job being an idiot while people who are in need are sitting around waiting for a job because nothing is in need of employees. The IP should be down now. > Regards, > David > Allen wrote: > >On Wed, Jan 12, 2005 at 01:48:04PM +0000, martin mcleod wrote: > >> > >>On Wed, 12 Jan 2005 03:38:11 -0500, Allen <gorebofh(a)comcast.net> wrote: > >> >> > >>>On Tue, Jan 11, 2005 at 10:55:14PM -0900, John Andersen wrote: > >>> >>> > >>>>On Tuesday 11 January 2005 01:24 am, Maarten wrote: > >>>> >>>> > >>>>>On Tuesday 11 January 2005 10:59, Riaz Ur Rahaman wrote: > >>>>> >>>>> > >>>>>>>On Wed, 05 Jan 2005 17:20:33 +0530, Riaz Ur Rahaman > >>>>>>><riazrahaman(a)hp.com> > >>>>>>> >>>>>>> > >>>>>wrote: > >>>>> >>>>> > >>>>>>>>Hi, > >>>>>>>> I am not able to telnet to my system...I didnt have this problem > >>>>>>>>when I was running 9.1.... > >>>>>>>> > >>>>>>>> >>>>>>>> > >>>>>>>>>telnet 215.176.125.70 > >>>>>>>>> >>>>>>>>> > >>>>>>>>Trying 215.176.125.70... > >>>>>>>>telnet: connect to address 215.176.125.70: Connection refused > >>>>>>>> > >>>>>>>>What configuration changes are required to be done in this case? > If > >>>>>>>>the firewall is on, can i disable it completely or is there any > way > >>>>>>>>of allowing my telnet session to happen? > >>>>>>>> >>>>>>>> > >>>>>Ehm...Let me get this straight. You're posting from a @hp.com > >>>>>address, to > >>>>>a security list, you mention two highly frowned upon items; > "completely > >>>>>disabling firewall" and "enabling telnet" in you post *AND* you even > >>>>>put in > >>>>>the IP number of the target host...?!?! > >>>>> > >>>>>You are either too stupid to work there, or you have some other > agenda. > >>>>> > >>>>>Maarten > >>>>> >>>>> > >>>>Yes, trying to fiddle with a US DOD target at that. > >>>>Good call Maarten. > >>>> >>>> > >>>OH MY GOD! Anyone ever read rinkworks computer stupidities? This > should>>>be > >>>there..... Shit like this makes me want to think about a Dell. > >>> > >>>No offense @HP, but I worked flipping burgers in fast food because I'm > >>>"underqualified" because I can't afford to take the test and get my > stuff > >>>from it, but THIS dude can work for HP?? OK, I'm pissed. I wouldn't > be so > >>>pissed if I wasn't in need of a job so bad, but when you see things > like > >>>this you just cringe. > >>> > >>>You idiot, make sure you have the Telent server installed, and then > edit > >>>the firewall with YAST2 and tell it to allow telnet.... Telnet is > clear > >>>text, but after seeing this crap, I don't think you'll be able to > >>>comprehend why SSH is better anyway. > >>> > >>> > >>> >>> > > > > > > > > > > > > > > > >> > >>http://www.antionline.com/showthread.php?s=&threadid=265249 > >> >> > > > >Heh, I doubt this guy will be back asking this question, or playing with > >THAT server again.> > > > > > > > > > >> > --Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > -- Romeo Theriault

2 1

Firewall performance
by Ariel Sabiguero 13 Jan '05

13 Jan '05

Hello all. I think I am experiencing some kind of performance problem in a firewall.... and we can't work out why. We still work with 2.4 kernel (yes, SuSE 9.2 & 9.1 are out there, but replacing a 24x7 box with a detailed configuration is not easy). The box (1,8 GHz Celeron, 512MB RAM) balances load over two 512/192Kbps ADSL lines (fixed IPs, no PPPoE stuff) and connects to a internal network. The number of iptables rules is not so high (only 430). The number of conntrack connections handled is around 5000-6000 normally and the rt_cache has 2322 entries. The uptime is ok, and the CPU load seems ok. # uptime 1:07pm up 35 days 18:39, 1 user, load average: 0.28, 0.25, 0.22 The CPU usage is due to upnpd (yes, we need it of msn voice & video features) and some scripts for gathering statistics (mrtg and others). MRTG says that -on average- we are using 30% less of the lines, that means, we are wasting bandwidth somewhere. I am aware that this is "slightly" off-topic.. any way, it is firewall -> security -> performance problem :-) Thanks. Ariel PS: you don't need to mention that upnp != security ;-)

1 0

NTFS to FAT32
by Paul Ikanza 13 Jan '05

13 Jan '05

Anyone knows how I can possibly change my file system to fat32 from ntfs? Paul. Paul Ikanza Systems Administrator The New Vision Printing and Publishing Company <mailto:pikanza@newvision.co.ug> pikanza(a)newvision.co.ug

5 4

PPTP Client and SuSE Firewall
by Al Bogner 13 Jan '05

13 Jan '05

http://pptpclient.sourceforge.net/howto-suse-92.phtml "Note: on our test system, we had to type SuSEfirewall2 off to get the tunnel to connect. But this is not good, because it opens your computer to potential attack. We welcome a paragraph here as to how to configure the SuSE firewall for outbound tunnel connections. We know [1] [2]. It is intentional. We're letting you use generic RPMs that are not SUSE specific. That's why we say above to install the RPMs using the --nodeps option. Please log a bug with SUSE to get them to package the most recent version ..." Any comments? Al

2 1