October 2005 - openSUSE Security - openSUSE Mailing Lists

repeated kernel crash, posibly after last update (dma_timer_expiry)
by Carlos E. R. 05 Oct '05

05 Oct '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have been experiencing over the last three weeks several machine crashes, more or less since I installed the last YOU update, kernel-default-2.6.11.4-21.9.i586.rpm (SuSE 9.3). Yesterday evening I had three crashes. Around 10-20 minutes after actively using the computer, it suddenly became very sluggish, the mouse jumped, and finally froze completely, within 15" of the first symptoms: not even num-lock key/led worked. After rebooting, nothing showed in any log. The last time I was fast enough to jump to console-10, and I saw this line appearing (hand copied): kernel: hdb dma_timer_expiry: dma status= 0x64 I could still switch consoles, but that was all I could do, it did not respond to commands. Memtest ran fine; so did "smart" long test. No apparent hardware error. Thinking that it could be the last kernel upgrade, I have reverted to 2.6.11.4-21.8, and so far, it is working... "unfortunately" at the same time I have reseated the drive connector, so I'm not absolutely sure which maneuver did the trick - if it did, as it is still to early to know. But knowing that some of the SuSE kernel developers read this list, perhaps they know if there was some thing modified in the kernel that could have affected, seeing the error message above. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFDPSogtTMYHG2NR9URAmO3AJ4+qXkTpRlgrlGKURRNa/6zwBgsOQCbBfC6 X4VdVA67AqUvCsQE7RbJt5U= =FhRd -----END PGP SIGNATURE-----

3 3

RE: [suse-security] account lockout after x incorrect attempts???
by Baenen Eric P Contr AFRL/HEC 05 Oct '05

05 Oct '05

One other thing - as far as we could tell pam_tally only locked a user out of a single machine (/var/log/faillog would appear to be kept on each individual machine) - it does not appear to be able to lock a network account - get locked out of one machine and the user could move on to the next machine. Does anyone know of any LDAP-based(PAM/LDAP combo?)/enterprise solutions for this? Thanks much, Eric -----Original Message----- From: Baenen Eric P Contr AFRL/HEC Sent: Wednesday, October 05, 2005 9:20 AM To: 'suse-security(a)suse.com' Subject: RE: [suse-security] account lockout after x incorrect attempts??? Thank you, We had looked at pam_tally just a bit - but our searches didn't find much in the way of positive experience with it. Has anyone actually implemented this with positive results? Thanks, Eric -----Original Message----- From: Marcus Meissner [mailto:meissner@suse.de] Sent: Wednesday, October 05, 2005 9:08 AM To: Baenen Eric P Contr AFRL/HEC Cc: 'suse-security(a)suse.com' Subject: Re: [suse-security] account lockout after x incorrect attempts??? On Wed, Oct 05, 2005 at 08:34:06AM -0400, Baenen Eric P Contr AFRL/HEC wrote: > Hello, > > We have a number of SUSE 9.x workstations - and recently we've been > mandated to have them adhere to a corporate IT security policy that > requires account lockout after a certain number of incorrect login attempts. > > Has anyone ever worked with a solution for this for SUSE 9.x? a pam > module perhaps? an LDAP based solution? At this point we're looking > for any solution - commercial or open source. You want pam_tally: /usr/share/doc/packages/pam/modules/README.pam_tally Ciao, Marcus

2 1

RE: [suse-security] account lockout after x incorrect attempts???
by Baenen Eric P Contr AFRL/HEC 05 Oct '05

05 Oct '05

Thank you, We had looked at pam_tally just a bit - but our searches didn't find much in the way of positive experience with it. Has anyone actually implemented this with positive results? Thanks, Eric -----Original Message----- From: Marcus Meissner [mailto:meissner@suse.de] Sent: Wednesday, October 05, 2005 9:08 AM To: Baenen Eric P Contr AFRL/HEC Cc: 'suse-security(a)suse.com' Subject: Re: [suse-security] account lockout after x incorrect attempts??? On Wed, Oct 05, 2005 at 08:34:06AM -0400, Baenen Eric P Contr AFRL/HEC wrote: > Hello, > > We have a number of SUSE 9.x workstations - and recently we've been > mandated to have them adhere to a corporate IT security policy that > requires account lockout after a certain number of incorrect login attempts. > > Has anyone ever worked with a solution for this for SUSE 9.x? a pam > module perhaps? an LDAP based solution? At this point we're looking > for any solution - commercial or open source. You want pam_tally: /usr/share/doc/packages/pam/modules/README.pam_tally Ciao, Marcus

2 1

Re: [suse-security] account lockout after x incorrect attempts???
by Polarizer 05 Oct '05

05 Oct '05

> Has anyone ever worked with a solution for this for SUSE 9.x? a pam module > perhaps? an LDAP based solution? At this point we're looking for any > solution - commercial or open source. Here[1] is an extensive lists of pam_modules. Look at chapter "Really using PAM". What you are looking for seems to be pam_tally[2]. [1] http://www.securityfocus.com/infocus/1389 [2] http://www.baverstock.org.uk/tim/pam/ Hope that helps. the polarizer http://www.codixx.de/polarizer.html

1 0

Re: [suse-security] Susefirewall2 rdp access nightmare
by Polarizer 05 Oct '05

05 Oct '05

For outgoing requests try FW_MASQ_NETS="x.x.x.x/24,y.y.y.y/32,tcp,3389" where you have to replace x.x.x.x with your private ip block and y.y.y.y with the ip of the external rdp server. for incoming requests try FW_FORWARD_MASQ="0.0.0.0/0,x.x.x.x,tcp,3389" where x.x.x.x is to replace with the ip of your internal rdp server. CAUTION: This opens up a big security hole!!! It's a good idea to restrict the incoming ip range to dedicated addresses. Another good idea is to put the rdp server into a DMZ. To access the internal server i would suggest to use a ssh tunnel or a vpn via ipsec instead of "FW_FORWARD_MASQ" Check /var/log/firewall if it still fails. the polarizer http://www.codixx.de/polarizer.html

1 0

RE: [suse-security] Susefirewall2 weblogger
by Bruno Cochofel 05 Oct '05

05 Oct '05

> > >Must have to do with the conversion function for month short names from >locale at the beginning of the script, I am not good enough at Perl to be >able to change anything there ... >I think it will continue working since the function fills an array with all >12 month names. I hope you did not hard-code a month into the script. >I think you should look at the entries at Nov 1st and you will know what >happens > Well I did the following: #year is not in syslog date format... try to guess it from the local time # ***TODO*** what happen when the year change ? my($year); my($month); $month = shift(@entry_split); (undef,undef,undef,undef,$month,$year,undef,undef,undef) = localtime(time); $month += 1; $year += 1900; # $entry{'date'}="$year-".$m{shift(@entry_split)}."-".shift(@entry_split)." ".shift(@entry_split); $entry{'date'}="$year-".$month."-".shift(@entry_split)." ".shift(@entry_split); Thans for everything, Bruno

1 0

Re: [suse-security] repeated kernel crash, posibly after last update (dma_timer_expiry)
by Polarizer 05 Oct '05

05 Oct '05

Same probs here. I did the kernel update and machine is crashing from time to time. lspci 0000:00:00.0 Host bridge: VIA Technologies, Inc. VT8377 [KT400 AGP] 0000:00:01.0 PCI bridge: VIA Technologies, Inc. VT8235 PCI Bridge 0000:00:11.1 IDE interface: VIA Technologies, Inc. VT82C586A/B/VT82C686/A/B/VT8233/A/C/VT8235 PIPC Bus Master IDE (rev 06) So i took a plain vanilla 2.6.13.1 from kernel.org and all is fine for now. I hate it when such stuff occurs caused by a "simple" security kernel update. the polarizer http://www.codixx.de/polarizer.html

1 0

Re: [suse-security] repeated kernel crash, posibly after last update (dma_timer_expiry) (fwd)
by suse＠karsites.net 05 Oct '05

05 Oct '05

Could this possibly be a problem in the IDE driver code? The same here: SUSE kernel 2.6.13-9-default, disk IBM IC35, controller VIA vt8233a Jürgen Keith Roberts

1 0

Susefirewall2 weblogger
by Bruno Cochofel 05 Oct '05

05 Oct '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I found a weblogger that comes with support for susefirewall but I can't seem to get this right... Can someone help me on this? Iptables logs can be found at: http://www.gege.org/iptables/ Thanks, Bruno Cochofel -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Using GnuPG with Netscape - http://enigmail.mozdev.org iD8DBQFDQPY9vug0e/DKR7kRAj0VAJ9CleqlkTkyP94xC63wMUcPWn81tACfUJvW d9THEsXpXtu8vQXe/w+mG5U= =WF/n -----END PGP SIGNATURE-----

2 13

Re: [suse-security] Re: portmap only for local interfaces
by Polarizer 04 Oct '05

04 Oct '05

> How can I make sure tcpwrapper is in use? Check whether or not libwrap is in use. ldd /sbin/portmap > Can I edit host.allow so only localhost can access? Will it give any > trouble? You have to look on all services that uses tcpwrapper (e.g. sshd) > I don't use nfs, I've disabled it, so don't know why does portmap gets > on... It's a good idea to deny access to any tcpwrapper enabled service via /etc/hosts.deny # deny all ALL : ALL and then allow access to services for dedicated hosts via (example) /etc/hosts.allow # allow access to/for portmap : 127.0.0.1/255.0.0.0 mountd : 127.0.0.1/255.0.0.0 lockd : 127.0.0.1/255.0.0.0 statd : 127.0.0.1/255.0.0.0 rquotad : 127.0.0.1/255.0.0.0 If you dont use nfs/rpc disable it via yast's runlevel editor. The polarizer http://www.codixx.de/polarizer.html

2 1