February 2005 - openSUSE Security - openSUSE Mailing Lists

still have problems with "kernel: ip_conntrack: table full, dropping packet."
by Ralf Ronneburger 31 Mar '05

31 Mar '05

Hi everyone, I still get the error message "kernel: ip_conntrack: table full, dropping packet." on SuSE 9.0 with SuSEfirewall2 (all updates installed) about every 2-4 weeks (there was a discussion about this some month ago, but no solution...). The only thing that seems to help when this occurs is rebooting the machine (as far as I could figure). The machine does have some servers behind it and filters about 500MB of traffic average per day. Below are some informations about the error-messages and the configuration and the state of the server when the problem occurs: linux:~ # cat /var/log/messages | grep ip_ Feb 24 12:13:05 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:09 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:15 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:20 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:24 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:38 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:39 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:56 linux kernel: ip_conntrack: table full, dropping packet. linux:~ # cat /proc/net/ip_conntrack | wc -l 1913 linux:~ # cat /proc/sys/net/ipv4/ip_conntrack_max 32760 linux:~ # iptables-save | wc -l 922 Does anybody have the same problem and hopefully a solution? Any ideas how I can at least find out, which packets are dropped? Greetings, Ralf

9 16

ClamAV 0.82 -> 0.83 !
by Franz Alt 03 Mar '05

03 Mar '05

Hello, in the latest SUSE Security Summary Report from Feb, 18th there is mentioned that Suse patches to ClamAV 0.82. I would not suggest to install this particular update! We had installed ClamAV 0.82 last week under BSD Plattform and there were "false positives". This means ClamAV declared some E-Mails with Powerpoint attachments as Virus. There is already a newer version 0.83 at http://www.clamav.net/stable.php#pagestart where this malfunction seems to be corrected. Greetings Franz

16 25

[Fwd: EMAIL INACTIVO]
by Philippe Vogel 02 Mar '05

02 Mar '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Can somebody fix that deactivated account on the list? Philippe - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQh6OoENg1DRVIGjBAQLvYwb9FC8uudB98/3xB5heNQFliGTWHujLiOkR RZMNoksytECnVNaRdj6mi31C536AmXr8eTJNETpqc8UTvXfbZaDtTqVarqp+uYTC ZzqsykL4Lk+VqcrHCVZnIInmEX/VvpgxwqWFGfkfU7YNEKuiH5Qwz67lD2iGZZOR /kGqWmSxuydJJhe6fmXcFM67/BCUk1gzO3Fj0DZdqmcXdHnnoR66vMp4QA0QiVEi cGdD9jihmdyEfa/SC7hq5Pxf+qcqa/MYgsKi5uqXQiFtudp97NgkrudHdH1OiUuh 35JMYFHoW34= =k2s3 -----END PGP SIGNATURE-----

5 9

why does this list...
by Mathias Homann 01 Mar '05

01 Mar '05

... attract all those fools who are to dumb to fucking read four fucking lines of instructions? i mean, i'm on quite a lot of lists, not only suse lists, but others with similarly high traffic... and suse-security is the only list that keeps getting the fools. maybe someone at suse should rewrite the subscribe- and unsubscribe instructions, preferrably in short sentences. sentences of not more than three words, each of which should not have more than one syllable... -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! gpg key fingerprint: 5F64 4C92 9B77 DE37 D184 C5F9 B013 44E7 27BD 763C

7 8

info@nrsdesign.de
by Nico Scaiano 28 Feb '05

28 Feb '05

suse-security(a)suse.com

2 1

Encrypted devices unsalted
by 2005 28 Feb '05

28 Feb '05

SuSE 9.2 creates encrypted volumes without salting the password/key. While this is not a problem for long binary keys, it simplifies a dictionary attack against a shorter ascii keys. man losetup says: -S pseed Sets encryption password seed pseed which is appended to user supplied password before hashing. Using different seeds for different partitions makes dictionary attacks slower but does not prevent them if user supplied password is guessable. &:-)

2 1

Re: awstats remote command execution vulerability
by Dimitar Slavov 28 Feb '05

28 Feb '05

Hello: Is there any patch released for the awstats remote command execution vulerability from Jan 17th? More info here: http://lists.netsys.com/pipermail/full-disclosure/2005-January/031002.html Best Regards, Dimitar Slavov

4 4

Samba security update broken
by Polarizer 25 Feb '05

25 Feb '05

Hi Suse people, I did updates on a box running a samba server. Suse Prof 9.1 with Samba 3.0.2a-51.i586 updated to samba-3.0.4-1.27. All works "fine". Then i did an update to samba-3.0.9-2.6.i586 and the problem occurs. Every directory on a share is marked as write-protected in the property dialog of windows. Nevertheless you are able to put files into. You can't change the flag, set it to "not protected" has no effect. Calling property dialog again shows it still as protected. The property dialog for files is still working fine. The impact is that some applications e.g. ACAD are checking this attribut before writing into a directory and fail cause they get a "write protected" info. I rolled back to samba-3.0.4-1.27 and this behaviour disappears. A directory is not longer marked as "write protected" per default. Any comments on this are appriciated. These attributes were mapped to extended attributes of filesystem objects via store dos attributes = yes map archive = no map system = no map hidden = no The share on this filesystem /dev/XXX on /YYY type ext3 rw,data=journal,acl,user_xattr,grpquota,quota,usrquota and is shared this way [share] comment = Files of ... path = /XXX read only = No create mask = 0770 directory mask = 0770 directory security mask = 0700 veto files = /.recycle/ The attributes for the directory "AA" are (not write protected): getfattr -d AA # file: AA user.DOSATTRIB="0x10" and write protected: getfattr -d AA # file: AA user.DOSATTRIB="0x11" but the actual rpm let samba show "write protected" even when user.DOSATTRIB is "0x10". The "hidden" and "system" flags are not affected. BTW: I rolled back to original 9.1 samba version 3.0.2a-51 and with this very version i wasn't enable to SET a directory write protected with the windows dialog. Any comments on this are appriciated The polarizer polarizers at its best http://www.glass-polarizers.com

1 0

[SUSE 9.2] SuSEfirewall2 Problem
by Stefan Schmidt 25 Feb '05

25 Feb '05

Hello List. This is my first posting, so please bear with me. I'm playing with SuSEfirewall2 on SUSE 9.2 trying to build a screened subnet FW. Here's my test setup: +----------+ |"Internet"| +----------+ | wlan0 | (192.168.1.1) | +----------------+ +----------------+ +--------+ |exterior router |-----+---- |interiror router| --- |intranet| +----------------+ | +----------------+ +--------+ eth0 (10.0.0.1) | | | eth0 (10.0.0.2) +----------+ |DMZ server| +----------+ Right now I'm trying to configure the exterior router. To enable HTTP and SSH on the DMZ server I configured the SuSEfirewall2 script as follows: FW_DEV_EXT="wlan-bus-pcmcia" FW_DEV_DMZ="eth-id-00:50:04:d2:71:9e" FW_ROUTE="yes" FW_FORWARD="0/0,10.0.0.2,tcp,80 0/0,10.0.0.2,tcp,22" the rest is more or less standard settings (attached at the end of this email) Now, when I try to connect to the webserver from the internet I can see the packets with tcpdump at the DMZ server, however, the return packets get blocked by SuSEfirewall2 with the log entry: Feb 24 13:19:10 linux kernel: SFW2-FWDdmz-DROP-DEFLT IN=eth0 OUT=wlan0 SRC=10.0.0.2 DST=192.168.1.2 LEN=60 TOS=0x08 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=80 DPT=33012 WINDOW=5792 RES=0x00 ACK SYN URGP=0 OPT (020405B40402080A0456274F008ADDF901030302 and these packets should be bloked because the relevant iptables-rules generated by SuSEfirewall2 are: -A forward_dmz -d 10.0.0.2 -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 80 -j ACCEPT -A forward_dmz -j LOG --log-prefix "SFW2-FWDdmz-DROP-DEFLT " --log-tcp-options --log-ip-options -A forward_dmz -j DROP If I understand the first rule correctly, only packets with the destination IP 10.0.0.2 will match. All the rest gets blocked with the Log message. All the tutorials and FAQs I read so far never said anything about configuring the reverse path also. I mean I could simply include 10.0.0.2,0/0 in FW_FORWARD, but if someone hacked my DMZ server he automatically has access to everywhere. So is this me just being stupid or is SuSEfirewall2 not doing what it should be doing? Is there a better way to enable just the response traffic from the DMZ server than including the reverse path? Greetings Stefan ---- full SuSEfirewall2 configuration --- $ cat /etc/sysconfig/SuSEfirewall2 | grep -e "FW_" | grep -v "#" FW_QUICKMODE="no" FW_DEV_EXT="wlan-bus-pcmcia" FW_DEV_INT="" FW_DEV_DMZ="eth-id-00:50:04:d2:71:9e" FW_ROUTE="yes" FW_MASQUERADE="no" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_*_TCP="" FW_SERVICES_*_UDP="" FW_SERVICES_DROP_EXT="" FW_SERVICES_REJECT_EXT="0/0,tcp,113" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="" FW_ALLOW_INCOMING_HIGHPORTS_UDP="" FW_FORWARD="0/0,10.0.0.2,tcp,80 0/0,10.0.0.2,tcp,22" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG_LIMIT="no" FW_LOG="" FW_KERNEL_SECURITY="yes" FW_ANTISPOOF="no" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="int" FW_IGNORE_FW_BROADCAST="no" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV="" FW_IPv6="" FW_IPv6_REJECT_OUTGOING="yes" FW_IPSEC_TRUST="no"

8 11

Two vice-1.14 bugs...
by pelibali 25 Feb '05

25 Feb '05

Hi, While checking the vice-1.14 source rpm coming with SUSE 9.2 I could confirm, that two recent (?) patches I looked for are in fact included in it. Cited from the changelog: * Fri Aug 13 2004 - there seems to be no version update, so fix security bug (bug #41976) * Thu Jul 01 2004 - fix crash on 64-bit platforms (bug #39808) Is there a fix scheduled for 9.1 against them or are these two again not serious enough ? Thanks, Pelibali

2 1