February 2005 - openSUSE Security - openSUSE Mailing Lists

apache 2 mod_rewrite nothing happens
by dadirtyluk 24 Feb '05

24 Feb '05

hey guys, i have a serious problem with my mod_rewrite: (guess what) it won't rewrite what i want it to! :P i hope thats not to ot by the way!!! for one vhost i had to rewrite http->https and it did work after some time of testing regexp's! now i'm trying to rewrite a subdomain name from http://www.testing.dom to http://demo.testing.dom but i can't get it to work! here are the rules: RewriteCond %{HTTP_HOST} ^foo\.testing\.dom$ RewriteRule ^(.*)$ https://foo.testing.dom RewriteCond %{HTTP_HOST} ^www\.testing\.dom$ RewriteRule ^(.*)$ http://demo.testing.dom does anybody have an idea what is going wrong here? i'd be veeeery thankful for any kind of help with this! greetingz luk

2 1

file permissions beneath /sys
by Ulrich Brochhagen 24 Feb '05

24 Feb '05

Hello, i use SystemImager to clone a SuSE 9.2 installation to the other nodes of a small web server farm. The image-retrieval from the golden-client to the imageserver by the SystemImager - Script getimage (in fact using rsync) fails sometimes because of strict file permissions beneath /sys (see list below). As a workaround i make these files readable to root. My question: Is this a severe security breach and should i script something to restore the original settings on every node ? Greetings Uli B. -- _____________________________________________________ Senatsverwaltung für Stadtentwicklung Berlin Informationssystem Stadt und Umwelt Ulrich Brochhagen e-mail: ulrich.brochhagen(a)senstadt.verwalt-berlin.de http://www.stadtentwicklung.berlin.de/ This mail is written in 100% recycled electrons. _____________________________________________________ --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/AEC62xx_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/ALI15x3_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/AMD_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/ATIIXP_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/CMD64x_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/Cypress_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/HPT34x_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/HPT366_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/NS87415_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/Opti621_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/PCI_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/PIIX_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/Promise_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/Promise_Old_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/RZ1000_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/SC1200_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/SIS_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/SLC90e66_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/Serverworks_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/SiI_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/TRIFLEX_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/TRM290_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/VIA_IDE/new_id --w------- 1 root root 4096 Feb 21 16:03 /sys/bus/pci/drivers/agpgart-serverworks/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/aic7xxx/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/imsttfb/new_id --w------- 1 root root 4096 Feb 21 16:03 /sys/bus/pci/drivers/megaide/new_id --w------- 1 root root 4096 Feb 21 16:03 /sys/bus/pci/drivers/ohci_hcd/new_id --w------- 1 root root 4096 Feb 21 16:03 /sys/bus/pci/drivers/parport_pc/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/serial/new_id --w------- 1 root root 4096 Feb 21 16:03 /sys/bus/pci/drivers/tg3/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/class/scsi_host/host0/scan --w------- 1 root root 4096 Feb 21 16:02 /sys/class/scsi_host/host1/scan --w------- 1 root root 4096 Feb 21 16:02 /sys/devices/platform/host0/0:0:0:0/delete --w------- 1 root root 4096 Feb 21 16:02 /sys/devices/platform/host0/0:0:0:0/rescan --w------- 1 root root 4096 Feb 21 16:02 /sys/devices/platform/host0/0:0:8:0/delete --w------- 1 root root 4096 Feb 21 16:02 /sys/devices/platform/host0/0:0:8:0/rescan

3 3

remote ssh dump ziemlich langsam
by dadirtyluk 24 Feb '05

24 Feb '05

hey, wenn ich eine platte uebers netz dumpen will klappt das eigentlich alles, aber einfach ziemlich langsam. dump schafft ca 1MB/s ~10Mbit/s scp schafft ca. 6/7MB/s ~50Mbit/s ich habe gelesen, dass man dass mit einem anderen cipher schneller machen kann und das arcfour wohl gut waere, aber das hat bei scp keinen unterschied gemacht, obwohl ich auch nicht weiss, wie ich mir ansehen kann, womit sich ssh denn gerade verschluesselt... fällt dazu irgendwem was ein? bin ein bisschen ratlos. gruz luk

2 2

RE: [suse-security] remote ssh dump ziemlich langsam
by Black, Alain 23 Feb '05

23 Feb '05

Try making a memory based file system on two machines, and then transferring files between the memory based files systems over the gigabit copper. Most likely the I/O on one end or both of the transfer is what's causing the reduced throughput. Using the above test I was able to get expected speeds across copper gigabit. -Alain. -----Original Message----- From: Robbert Eggermont [mailto:R.Eggermont@EWI.TUDelft.nl] Sent: Wednesday, February 23, 2005 4:46 AM To: suse-security(a)suse.com Subject: Re: [suse-security] remote ssh dump ziemlich langsam Pablo wrote: > I've been told gigabit over copper won't deliver more than 33%, to > improve performance you have to switch to fiber. Please note that's what > I heard, I've not tested or seen this myself, but I trust the source ;) I get up to around 0.66 Gbit/s over NFS, including tcp/ip & NFS overhead, so network throughput is certainly not a bottleneck. ;-) Robbert -- Robbert Eggermont Information & Communication Theory R.Eggermont(a)EWI.TUDelft.nl Electr.Eng., Mathematics & Comp.Science +31 (15) 2783234 Delft University of Technology -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] remote ssh dump ziemlich langsam
by Robbert Eggermont 23 Feb '05

23 Feb '05

Pablo wrote: > I've been told gigabit over copper won't deliver more than 33%, to > improve performance you have to switch to fiber. Please note that's what > I heard, I've not tested or seen this myself, but I trust the source ;) I get up to around 0.66 Gbit/s over NFS, including tcp/ip & NFS overhead, so network throughput is certainly not a bottleneck. ;-) Robbert -- Robbert Eggermont Information & Communication Theory R.Eggermont(a)EWI.TUDelft.nl Electr.Eng., Mathematics & Comp.Science +31 (15) 2783234 Delft University of Technology

1 0

info@nrsdesign.de
by Nico Scaiano 23 Feb '05

23 Feb '05

1 0

SHA-1 broken - impact on SuSE linux versions
by Polarizer 22 Feb '05

22 Feb '05

Hi list, i would like to discuss this with you: This [1] arcticle shows that SHA-1 is broken and details will be "fully disclosured" [2] soon. What impact does is have for our SuSE linux installations. Where is it used by default in standard packages and where by default in packages to install additionally via Yast. I found it exempli gratia in SSH for integrity checks (seems not critical) or in gpg for fingerprints. The polarizer polarizers at its best http://www.glass-polarizers.com [1]http://www.schneier.com/blog/archives/2005/02/sha1_broken.html [2]http://archives.neohapsis.com/archives/fulldisclosure/2005-02/0303.html

10 17

SuSEfirewall, iptables and SNAT
by Markus Feilner 21 Feb '05

21 Feb '05

Hello List, I want to SNAT a host in my local net - i have been trying so by adding the following line to my susefirewall custom script iptables -t nat -A POSTROUTING -s SOURCE_IP -d TARGET_IP -j SNAT --to-source NATTED_SOURCE_IP I have configured DNAT the same, and that works fine, but outgoing packets are not natted. (My Firewall is also rejecting everything but allowed traffic) what's wrong? what am i missing? thanks a lot! -- Mit freundlichen Grüßen Markus Feilner --------------------------- Bitte beachten Sie unsere neuen Adressdaten! Vielen Dank. --------------------------- Feilner IT Linux & GIS Linux Solutions, Training, Seminare und Workshops - auch Inhouse Beraiterweg 4 93047 Regensburg fon +49 941 9465243 fax +49 941 9465244 mobil + +49 170 3027092 mail mfeilner(a)feilner-it.net web http://www.feilner-it.net

1 0

latest Perl upgrade broke parts of Perl
by Kai Schaetzl 21 Feb '05

21 Feb '05

The recent Perl security upgrades for 9.0 broke parts of Perl it seems. f.i. I can't install (make test) Spamassassin 3.0.2 because it cannot find module Storable and can't start spamd. When trying to install modules via CPAN I get this for each package I try: Subroutine CLONE redefined at /usr/lib/perl5/5.8.1/i586-linux-thread-multi/Storable.pm line 50. Subroutine retrieve_fd redefined at /usr/lib/perl5/5.8.1/i586-linux-thread-multi/Storable.pm line 56. In general it seems Perl cannot determine anymore that some modules are installed. F.i. when trying to upgrade the CPAN module it first says Digest::MD5 disabled because not installed and at the end it will say Digest::MD5 is up-to-date and when I try to upgrade it it will say the same. And at the end I get error "Undefined subroutine &Digest::base::new called at /usr/lib/perl5/5.8.1/CPAN.pm line 4344." I tried to make test Spamassassin 3.0.1 on the same system which had installed successfully back then: same problem. Then I tried to install Spamassassin 3.02 on an almost identical system which doesn't have the Perl upgrades yet: works. So, it very much seems that upgrade broke important parts of Perl. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com IE-Center: http://ie5.de & http://msie.winware.org

4 9

Signedness bugs in kernel
by Frank Steiner 17 Feb '05

17 Feb '05

Hi, are the SuSE kernels affected by the bugs Guninski detected? cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. *

2 2