October 2005 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] SuSEfirewall2 & dhcp
by Wade Grant 25 Oct '05

25 Oct '05

I have found that if icmp is blocked the dhcp server will not issue a lease. Typically a dhcp server will send out a icmp ping out before issuing a lease. Have you allowed icmp from yast2 when enabling the firewall? wade G. Senior Network Specialist Helpdesk:601-359-2837 wgrant(a)mde.k12.ms.us grant(a)vicksburg.com Only in case of emergency or outage wade.education(a)my2way.com "Privilege becomes arrogance. Arrogance promotes injustice. The seed of ruin blossom." Frank Herbert. 1984. God Emperor of Dune. >>> clyde taylor <clydetay(a)yahoo.com> 10/25/05 10:22AM >>> Running 9.2 with all updates. I'm trying to get a dhcp server running along with SuSEfirewall2. The dhcp server will run and issue ip info to my test boxes. but when i turn on the firewall the dhcp server can't issue anymore leases. I've tried configuring the firewall with yast2 and editing /etc/sysconfig/SuSEfirewall script all to know avial. Any info would be thankful. Clyde __________________________________ Yahoo! FareChase: Search multiple travel sites in one click. http://farechase.yahoo.com -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] liby2util update on SuSE 9.1 breaks online_update?
by Polarizer 25 Oct '05

25 Oct '05

> Has anybody else seen this? Yes, this guy here[1] rpm -q --whatprovides liby2pm.so.2 says yast2-packagemanager-2.9.52-0.2 so try to rollback the package with one version from ./lib/YaST2/you/mnt/i386/update/9.1/rpm/xxx [1] http://www.mail-archive.com/linux-390@vm.marist.edu/msg31085.html Hope that helps a bit the polarizer http://www.codixx.de/polarizer.html

6 5

SuSEfirewall2 & dhcp
by clyde taylor 25 Oct '05

25 Oct '05

Running 9.2 with all updates. I'm trying to get a dhcp server running along with SuSEfirewall2. The dhcp server will run and issue ip info to my test boxes. but when i turn on the firewall the dhcp server can't issue anymore leases. I've tried configuring the firewall with yast2 and editing /etc/sysconfig/SuSEfirewall script all to know avial. Any info would be thankful. Clyde __________________________________ Yahoo! FareChase: Search multiple travel sites in one click. http://farechase.yahoo.com

1 0

volume flatrate supervision with SuSE-Firewall2
by Thomas Pförtner 25 Oct '05

25 Oct '05

Hi there, I am using SuSE 9.1 with the 'standard' Suse Firewall on home server acting as a internet router among other things.. I recently subscribed to dsl using a volume flatrate, which I would like to track since operator info is too much delayed. I have read a lot and found scripts doing these things with the netfilter/iptables firewall. However I am not a firewall expert and do not like to combine any script with the SuSEfirewall2 that is not designed for that. Did anybody do such volume control on top of the SuSEfirewall? Does anybody have some hints what to take care of? Thanks in adance Thomas

3 2

Apache update problem
by suse＠karsites.net 25 Oct '05

25 Oct '05

Hi all! Just done an online update. For some unknown reason, after doing an online update, the Apache2 update overwrites my /etc/sysconfig/apache2 configuration file. Apache2 then refuses to start with the following error message: Starting httpd2 (prefork) Syntax error on line 24 of /etc/apache2/sysconfig.d/global.conf: CustomLog takes two or three arguments, a file name, a custom log format string or format name, and an optional "env=" clause (see docs) The command line was: /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf failed Failed services in runlevel 3: apache2 To correct the problem, I have to overwrite the apache2 config file the update has kindly installed for me, with a backup copy, and then start Apache manually. This is odd behaviour. Should a security update be allowed to overwite config files that have been manually altered by the sys admin? Has anyone else noticed this behaviour? This is what I have defined for Apache2 logs: APACHE_ACCESS_LOG="/var/log/apache2/access_log common, /var/log/apache2/browser_log agent, /var/log/apache2/referer_log referer, /var/log/apache2/combined_access_log combined, /var/log/apache2/ROBOT_LOG agent" Kind Regards - Keith Roberts http://www.karsites.net/

4 4

RE: [suse-security] wildcard for reverse proxy via apache ?
by Dörfler Andreas 25 Oct '05

25 Oct '05

hello alex, think my synaps offline. i dont understand what docroot have todo with reverse proxy ? because a reverse proxy access a complete other machine, there is no docroot to configure inside the vhost from the proxy greetings andy --free your mind, use open source http://www.mono-project.com ASCII ribbon campaign ( ) - against HTML email X & vCards / \ -----Original Message----- From: Alexander.Kessinger(a)HelvetiaPatria.ch [mailto:Alexander.Kessinger@..ch Sent: Tuesday, October 25, 2005 9:24 AM To: suse-security(a)suse.com Cc: Dörfler Andreas Subject: Re: [suse-security] wildcard for reverse proxy via apache ? Hi Andy, have you tried to define the DocumentRoot explicit "/srv/www/"? Within the DocumentRoot you can also work with * as wildcard (/srv/www/*/something/) GrEEtz Alex Dörfler Andreas <Andreas.Doerfler@...de> 25.10.2005 08:34 To<suse-security(a)suse.com> cc Subject[suse-security] wildcard for reverse proxy via apache ? hello list, i try to setup reverse proxy for all our websites with apache 2.x. right now my vhosts look like this: <VirtualHost *:80> ServerName test.dummy.tld ProxyPass / http://111.111.111.111/ ProxyPassReverse / http://111.111.111.111/ </VirtualHost> that way it works fine for root-dir of the webserver but not for the subdirectorys ( test.dummy.tld/subdir/ ) is it possible to configure a wildcard for all subdirs or it is needed to configure ProxyPass ProxyPassReverse for every single subdir ? greetings andy --free your mind, use open source http://www.mono-project.com ASCII ribbon campaign ( ) - against HTML email X & vCards / \ -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here *** Disclaimer *** The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. E-mail transmission cannot be ensured to be secure or without error. Information could be intercepted, corrupted, lost, destroyed, incomplete or may contain viruses. Neither Helvetia Patria Group nor the sender can accept any liability for any kind of damage as the result of viruses or transmission errors.

2 1

wildcard for reverse proxy via apache ?
by Dörfler Andreas 25 Oct '05

25 Oct '05

hello list, i try to setup reverse proxy for all our websites with apache 2.x. right now my vhosts look like this: <VirtualHost *:80> ServerName test.dummy.tld ProxyPass / http://111.111.111.111/ ProxyPassReverse / http://111.111.111.111/ </VirtualHost> that way it works fine for root-dir of the webserver but not for the subdirectorys ( test.dummy.tld/subdir/ ) is it possible to configure a wildcard for all subdirs or it is needed to configure ProxyPass ProxyPassReverse for every single subdir ? greetings andy --free your mind, use open source http://www.mono-project.com ASCII ribbon campaign ( ) - against HTML email X & vCards / \

2 1

How to create old good rc.local script?
by suse-list 22 Oct '05

22 Oct '05

Do suse have rc.local?

2 1

My solution of rc.local.
by suse-list 22 Oct '05

22 Oct '05

If there is a beter way to go - please help. I've read /etc/init.d/README and manpages referenced And by the way - i've disabled boot.quota, and placed quotaon -a in my rc.local, and now this server starts much faster ;) Quite a qute idea with using kernel mem ;). Oah, we can use UUIDz from /proc ;). 8<--------------------------------- #! /bin/sh # /etc/init.d/rc_local ### BEGIN INIT INFO # Provides: local_startup # Required-Start: $syslog $remote_fs $ALL # Should-Start: # Required-Stop: $syslog $remote_fs # Should-Stop: # Default-Start: 3 5 # Default-Stop: 0 1 2 6 # Short-Description: local startup script # Description: Good old rc.local. ### END INIT INFO . /etc/rc.status rc_reset case "$1" in start) muf=`cat /proc/sys/dev/rtc/max-user-freq` if [ $muf != "64" ]; then exit fi echo -n "Starting RC_LOCAL" hdparm -c3 /dev/hda quotaon -a #arpwatch -i eth0 -f arp.dat-inet #arpwatch -i eth1 -f arp.dat-local echo 128 > /proc/sys/dev/rtc/max-user-freq # echo -n "[DEBUG] done rc_local" rc_status -v ;; stop) echo -n "Shutting down RC_LOCAL " rc_status -v ;; restart) $0 stop $0 start rc_status ;; *) echo "Usage: $0 {start|stop|restart}" exit 1 ;; esac rc_exit

1 0

Re: Fw: [lenzberger@gmail.com: [suse-security] SuSE 9.1 + quota = deadlock]
by Christopher Lenzberger 22 Oct '05

22 Oct '05

Hi, sorry, i know that the information given by me was very poor. i am running reiserfs and the device is listed in fstab this way: /dev/hda2 / reiserfs acl,user_xattr,usrquota 1 1 i found some posts about this kind of problem when having acl activated (even when not in use). but the strange thing is, that we never had this problem on this machine before. i know, that users reached their quota limit without problems. i think that it will have to do with one of the last kernel upgrades on suse 9.1 (or maybe some other packages?) some information i found (maybe the same thing): http://marc.theaimsgroup.com/?l=reiserfs&m=112170574830590&w=2 the first time we saw this bug on 2005-09-20 on our system. it does not happen very often that our users reach their quota limit but now we see that problem once or twice a week. so it could be a problem since that update: -rw-r--r-- 1 root root 9144 Sep 3 16:05 kernel-52369 any help would be fine - thank you. christopher 2005/10/21, Jan Kara <jack(a)suse.cz>: > Hello, > > is there some bugzilla entry for this problem? If not, then please > create one... Also some questions: do you use acls or extended > attributes? Which filesystem do you use? Have you tried to reproduce the > problem with some newer kernel? By what do you judge that the bug is > 'known' - if you point me to some place where this was discussed I have > better chance of remembering how I fixed that in newer kernels ;). > > Bye > Honza > > > ----- Forwarded message from Christopher Lenzberger <lenzberger(a)gmail.com> ----- > > > > DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; > > s=beta; d=gmail.com; > > h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; > > b=RHBgj00jhQWf9SxKFvNEGZeqHKx9J9B55If52T/sGsxNqUj58WsyMFyhF7lgYy50mG8npwPkwPQiXPBiGBcSTTIbdUciYM881uNHtbKduh35xd+0sk9rEJPEYqjiDkerxkyA/OfqG+bF8v0aWwz0+QYdsM7JL61dx0sNL5wyo64= > > Date: Tue, 18 Oct 2005 13:59:04 +0200 > > From: Christopher Lenzberger <lenzberger(a)gmail.com> > > To: suse-security(a)suse.com > > Subject: [suse-security] SuSE 9.1 + quota = deadlock > > > > we are running suse 9.1 using userquota but something strange happens > > when a user reaches his limit (for example with vsftpd). > > > > the task accessing the file hangs in state "D" - no access to the > > directory is possible. kill or killall won't help - only rebooting the > > machine helps until a user reaches his limit again... > > > > seems to be an old known bug - but this one should be already fixed?!? > > > > currently we are running: > > Linux version 2.6.5-7.201-default (geeko@buildhost) (gcc version 3.3.3 > > (SuSE Linux)) #1 Thu Aug 25 06:20:45 UTC 2005 > > > > please help - thank u! > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > ----- End forwarded message ----- > > > > -- > > Bye, > > Thomas > > -- > > Thomas Biege <thomas(a)suse.de>, SUSE LINUX, Security Support & Auditing > > -- > > Always code as if the guy who ends up maintaining your code > > will be violent psychopath who knows where you live. > > --- John F. Woods > > > -- > Jan Kara <jack(a)suse.cz> > SuSE CR Labs >

1 0