March 2005 - openSUSE Security - openSUSE Mailing Lists

installing newer software than that in the CDs
by John 01 Apr '05

01 Apr '05

Hello I tried to install the apache 2.0.53 from SUSE's rpm. I found them in SUSE's site. i installed these rpms (apache and other related with the 2.0.53 version packages like prefork, etc) I ran YOU and i surprising found that a patch was available for apache 2.0.53. Can this be true or not? Is there any patch for apache 2.0.53 ? One more issue. I tried to install php using Yast and the rpm from the CD. After having done the proper configuration for the php support, i tried to startapache 2.0.53 but it failed and gave me an error (in the error_log) Segmation Fault (pointed the line that php get loaded) What was wrong with that? Thanks in advance John

3 5

still have problems with "kernel: ip_conntrack: table full, dropping packet."
by Ralf Ronneburger 31 Mar '05

31 Mar '05

Hi everyone, I still get the error message "kernel: ip_conntrack: table full, dropping packet." on SuSE 9.0 with SuSEfirewall2 (all updates installed) about every 2-4 weeks (there was a discussion about this some month ago, but no solution...). The only thing that seems to help when this occurs is rebooting the machine (as far as I could figure). The machine does have some servers behind it and filters about 500MB of traffic average per day. Below are some informations about the error-messages and the configuration and the state of the server when the problem occurs: linux:~ # cat /var/log/messages | grep ip_ Feb 24 12:13:05 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:09 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:15 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:20 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:24 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:38 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:39 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:56 linux kernel: ip_conntrack: table full, dropping packet. linux:~ # cat /proc/net/ip_conntrack | wc -l 1913 linux:~ # cat /proc/sys/net/ipv4/ip_conntrack_max 32760 linux:~ # iptables-save | wc -l 922 Does anybody have the same problem and hopefully a solution? Any ideas how I can at least find out, which packets are dropped? Greetings, Ralf

9 16

Firefox invocation allows unintended root access
by Phil Betts 31 Mar '05

31 Mar '05

This is possibly not a SuSE specific problem, but since the two systems involved are both running 9.2 Pro, and it's their integrity that's at stake, and since I've no idea what the underlying mechanism is, I thought I'd start here ;) The situation: PC1 - SuSE 9.2 Pro AMD32 PC2 - SuSE 9.2 Pro AMD64 Run Firefox as root@PC2 for browsing local files (the files are only readable by root). Still on PC2, run ssh -X to get a shell as normal-user@PC1. Start Evolution on PC1, opening on PC2's display. Click on an http link in an email. A Firefox window opens with the link displayed. By chance, I noticed that the Adblock extension was missing and I happened to click on the About menu. I was surprised to see that it claimed to be the x86_64 version. Further investigation revealed that Evolution had connected to the root-invoked Firefox on PC2, rather than starting a fresh instance by normal-user@PC1 displaying on PC2. Had I not noticed this, it would have been easy for me to enable java/javascript and installed plugins etc., in the belief that the browser was running as normal-user@PC1. Note that Evolution is an innocent party here, just starting Firefox directly from the ssh session produces the same effect. The reason for mentioning it is that a link in an email can be a seductive way to trap the unwitting user. Also note that the situation does not appear to occur if the remote connection is not involved. I.e. when root@PC2 runs Firefox, then user@PC2 starts Firefox, this results in 2 instances of Firefox. IMHO, Firefox should only connect with an already running instance if that instance was started by the same user on the same host. It is questionable whether normal-user@PC1 should even be aware of the existence of the root@PC2 instance. Phil

3 3

RE: [suse-security] Firefox invocation allows unintended rootaccess
by Jose_Thomas＠Dell.com 31 Mar '05

31 Mar '05

Looks this problem is directly inherited from the way how X works. SELinux will be the right way to solve this problem. Thanks Jose -----Original Message----- From: Phil Betts [mailto:phil_betts@ntlworld.com] Sent: Thursday, March 31, 2005 1:52 AM To: suse-security(a)suse.com Subject: Re: [suse-security] Firefox invocation allows unintended rootaccess On Wed, 2005-03-30 at 11:27 +0200, Marcus Meissner wrote: > Your remote side can do even more things, like snooping or inserting > keyboard input into the main X session. > > If you are on the same X Server you have basically full user access. > Of course, but that's not what one expects of a browser whose reputation is built, at least partly, on security. If you invite your trustworthy neighbour in for a drink, you'd be pretty upset if he took control of the TV remote, emptied your fridge and rearranged the furniture! > > I do not see this is as a problem, but workin as intended. > Hmm, "as intended" != "correctly" (except perhaps in Redmond). If by "intended", you mean that there should only ever be one instance of firefox per X display, then firefox is broken, because two different users on the _same_ box start independent firefox instances, each with their own set of bookmarks, cookies, extensions etc. Why should this policy be different when running a firefox from a session on a second box? The fact remains that I clicked on a link in an email message as an unprivileged user on my web-facing machine, but found that I had connected to the web as root on a machine that normally only connects to the web for system updates. I would NEVER have connected to the web for any other purpose using my root account (on either box) by choice. If the link I had clicked was actually to a page containing some malicious exploit, I would have been completely stuffed. I can't believe that this is "as intended". Also, regardless of the security implications, if I start a session on a remote box and start firefox, I do this because I want THAT user's set of bookmarks etc., not those of some arbitrary user on a different machine. As it stands, the only way to achieve this is to shut down all prior instances of firefox first, which is neither intuitive, nor desirable. As I mentioned in my original post, I don't know the details of the underlying mechanism, as it involves the interaction of X, ssh and firefox. If you have more knowledge on this, I'll be happy to raise it with the most appropriate party. My guess would be the firefox developers, but for all I know, they may just be using some connect_to_existing_instance() routine in an independently written shared library, which could mean that many apps may be subject to the same problem. Phil -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Kernel updates+ATI drivers
by Maxim A Belushkin 30 Mar '05

30 Mar '05

Are there any plans to include the ATI drivers for X.org into the YaST graphics card selection? Alternatively, is there any way to force YaST to run a specific command after each kernel update? Every kernel update breaks the ATI drivers (expected), loosing 3D support and requiring a manual re-installation of the ATI rpm which builds the driver for the current kernel... Thanks in advance!

3 2

Securing data on disk - when disk taken out of computer ?
by Robert Rozman 30 Mar '05

30 Mar '05

Hi, I'm seeking for solution, that would let me ecrypt partition of file on disk, but be somehow automatically mounted on reboot (without prompting for password) , but still secured if someone takes disk out and tries to mount on another system... I'm newbie, so please be gentle - it could be impossible to achieve... How to do this? Can I somehow sign disk to be used/mounted only in certain HW and not on another HW ? If proof solution is not possible, could I at least automate mounting of encrypted file and give at least some problems to enyone that stoles disk and tries to mount it outside PC ? Thanks in advance, regards, Rob.

2 1

CAN-2004-1073 fixed by suse ?
by BoneMachine 30 Mar '05

30 Mar '05

Hi, I've noticed a message on the Full-Disclosure mailinglist. The message states that there is no fix supplied in the vanilla kernel and that there is probably no fix in vendor supplied kernels for the CAN-2004-1074 vulnerability. The message to FD can be found at the following link: http://archives.neohapsis.com/archives/fulldisclosure/2005-03/0820.html Can any of you guys confirm that SuSE is still vulnerable? TIA Bone Machine --- "I can hardly wait Betty" - The Pixies

3 2

Susefirewall2 detailed howto
by Valentin Holban 28 Mar '05

28 Mar '05

Hello. I have: Suse 9.1 kernel 2.6.5 Susefirewall2 I would like to know how to use FW_CUSTOMRULES in order to perform more detailed filtering. If there are any docs available, or online references, please point them to me. Thx, Vali.

1 0

Re: [suse-security-announce] SUSE Security Announcement: several kernel security problems (SUSE-SA:2005:018)
by Carlos E. R. 28 Mar '05

28 Mar '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Thursday 2005-03-24 at 17:29 +0100, Marcus Meissner wrote: > SUSE Security Announcement > > Package: kernel > Announcement-ID: SUSE-SA:2005:018 > Date: Thu, 24 Mar 2005 15:00:00 +0000 > Affected products: 8.2, 9.0, 9.1, 9.2 > SUSE Linux Desktop 1.0 > SUSE Linux Enterprise Server 8, 9 > Novell Linux Desktop 9 Just for the record, YOU update for SuSE 9.1 of this patch forgets to run mkinitrd. The most visible problem is the missing splash in tty1. It is not the fisrt time this happens. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFCR+IstTMYHG2NR9URAsMBAJsHj4SKDNeuaTUzsr2KB9koElYMowCgiLPl 5quBxpMZpmYVHuQZucMyZzs= =EY0s -----END PGP SIGNATURE-----

4 4

mysql and kernelupdates
by Philippe Vogel 25 Mar '05

25 Mar '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! There are several exploits in the described packages, but why aren't there any packages for YOU or am I too fast with my conclusion? The normal way was to write an announcement and then provide the patch-rpm's via YOU or is there a slightly change after novell is in the business? Reguards Philippe - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQkMbk0Ng1DRVIGjBAQLn5gb9HQfh2+GLGUZk2UIzvsgwIAtSJL76hyVe Sf4PgbkDh3xnT3jfahoQnM4jtna5xemfFil1hl3VUu16MF8+Dd0Z7LFJ/LMREmJq S2QQjnT02XsiGcA2+QrZQfKkE5DlDG6jk+FH9jsZ3lPk6dnt+WGfs+PzNUMDhISz qiYJRmD3KaE35nAsDIoxe2XddsmGP6eXN/WM9ylHYQtaZj9Xw1xoYFq1ZrEA/Jqh hcXCh7Rvxxa2MPK9UGNgJcyeVNBxjxm6dmjB4gUsNC46wNypDjayNIPP4JkcllmX Ele8wfMRqxQ= =94g2 -----END PGP SIGNATURE-----

3 3

(SUSE-SA:2005:018)
by tshilson＠mmm.com 25 Mar '05

25 Mar '05

I looked at this announcement and did not find how to get the update files for my SuSE SLES 8 on zSeries. Do I need to look elsewhere for the updates? Thanks, tom - - - - - - - - - - - - Toto, I have a feeling we're not in the mainframe world any more. _/) Tom Shilson ~~~~~ Unix Team / IT Server Services Aloha Tel: 651-733-7591 tshilson at mmm dot com Fax: 651-736-7689

2 1

update process
by suse 25 Mar '05

25 Mar '05

Please, point me to manual about suse update process. We have a set of machines running suse 9.1 and want to have exact copy of ftp.suse.com/pub/suse/i386/update/9.1/ in local dir (local mirror), we are using wget, but it does not remove files absent in mentioned location. Sorry for pretty dumb question, we have no time to google/etc, just help if you can.

3 2

Re: [suse-security] mysql and kernelupdates
by Philippe Vogel 24 Mar '05

24 Mar '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 O.K. Then I was too fast and have to wait a little more time. Funny is I use Göttingen and got different types of machines which got different updates (2x smp (p3/p4), 2x single cpu (p3/p4)). On one I didn't get mysql and kernel, but on the others I got all updates. This looks a littlebit strange for me. That's the reason why I asked. Philippe Arjen de Korte schrieb: > Philippe Vogel schreef: > >> There are several exploits in the described packages, but why >> aren't there any packages for YOU or am I too fast with my >> conclusion? > > > Way too fast. Not all the mirrors are updated and that's probably > why YOU is not seeing the updates. But if you look at the (really > slow at the moment) SuSE ftp servers, the packages are there. The > GWD Göttingen servers are usually pretty fast in picking them up > and generally give better throughput (just finished downloading > them from there). > > Regards, Arjen > - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQkMgx0Ng1DRVIGjBAQIJZwb/aN/rAj6eH3YLjCMTckfJPSDKCKQGvD0y btGoAgxe7jGjA/46kNzrcvpxYjMmE8D3tQM7OkRCTNFnOtu3fk2li0gfLV87rlvg hBnwAJauPF8DjhBJd9rBZKSOn4k5Z4YDGztnewGUr0PkvjBw/F2FHMbhhMdMV/ec S3+BG6I537IU9UwyqzKPJBxMz+hwIl2f76u0herCw8OD/Jc3qvflisJJ/SvC8aTz QUeC8bEFoaj3RpsMkpmK2GMFEaoQ5IotecfF06DJB4DzBfjuHk3kae/OAwQyF5jK N5WqPNC1pqo= =tfY9 -----END PGP SIGNATURE-----

1 0

Re: [suse-security] heimdal (kerberos) with openssh
by paul kaiser 24 Mar '05

24 Mar '05

i created a principals in the database using kadmin -l. i copied the information regarding the local host to /etc/krb5.keytab and /etc/srvtab on each local host using ktutil get. from reading the literature i am assuming /etc/krb5.keytab contains only the principals for that particular host, and not the principals for every host. --- Roland Kuhn <rkuhn(a)e18.physik.tu-muenchen.de> wrote: > Hi Paul! > > On Mar 23, 2005, at 5:36 PM, paul kaiser wrote: > > > i am using suse professional 9.1. > > > > i have installed heimdal (kerberos) from the distribution cdroms on a > > realm > > server. i have installed openssh from the distribution cdroms on all > > hosts. > > all the hosts are kerberos clients > > > > authentication and ticket granting appear to be working fine on all > > hosts. > > if i am reading the suse manual correctly, i should be able to slogin > > between > > hosts without being asked for a password. > > > > this is actually working from any host to the kerberos server! > > however, slogin from the server to any other host > > and slogin between any two (non-server) hosts prompts for a password. > > > > i have recompiled openssh > > --with-pam --with-kerberos5=/usr/lib/heimdal > > but to no avail. the same prompting for password occurs. > > > > any suggestions would be appreciated! > > Have you created host principals and stored the relevant keystashes on > the respective hosts? > > Ciao, > Roland > > -- > TU Muenchen, Physik-Department E18, James-Franck-Str. 85747 Garching > Telefon 089/289-12592; Telefax 089/289-12570 > -- > A mouse is a device used to point at > the xterm you want to type in. > Kim Alm on a.s.r. > __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/

2 1

Re: [suse-security] heimdal (kerberos) with openssh
by paul kaiser 24 Mar '05

24 Mar '05

usePAM is set to YES i should also mention i am running 2.6 kernel. i know that causes problems for openAFS clients. thanks for your assistance. --- Mike Rose <mr349(a)cam.ac.uk> wrote: > > Not sure this is what you need, but have you set: > > usePAM YES > > in /etc/ssh/sshd_config > > undocumented config parameter - well done openssh! > > > > Mike Rose > TCM & BSS Computer Officer > University of Cambridge > http://www.bio.phy.cam.ac.uk/ > http://www.tcm.phy.cam.ac.uk/ > http://www.phy.cam.ac.uk/research/bss/ > > On Wed, 23 Mar 2005, paul kaiser wrote: > > > i am using suse professional 9.1. > > > > i have installed heimdal (kerberos) from the distribution cdroms on a realm > > server. i have installed openssh from the distribution cdroms on all hosts. > > all the hosts are kerberos clients > > > > authentication and ticket granting appear to be working fine on all hosts. > > if i am reading the suse manual correctly, i should be able to slogin > between > > hosts without being asked for a password. > > > > this is actually working from any host to the kerberos server! > > however, slogin from the server to any other host > > and slogin between any two (non-server) hosts prompts for a password. > > > > i have recompiled openssh > > --with-pam --with-kerberos5=/usr/lib/heimdal > > but to no avail. the same prompting for password occurs. > > > > any suggestions would be appreciated! > > > > > > > > > > > > __________________________________ > > Do you Yahoo!? > > Yahoo! Sports - Sign up for Fantasy Baseball. > > http://baseball.fantasysports.yahoo.com/ > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > > __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/

1 0

heimdal (kerberos) with openssh
by paul kaiser 24 Mar '05

24 Mar '05

i am using suse professional 9.1. i have installed heimdal (kerberos) from the distribution cdroms on a realm server. i have installed openssh from the distribution cdroms on all hosts. all the hosts are kerberos clients authentication and ticket granting appear to be working fine on all hosts. if i am reading the suse manual correctly, i should be able to slogin between hosts without being asked for a password. this is actually working from any host to the kerberos server! however, slogin from the server to any other host and slogin between any two (non-server) hosts prompts for a password. i have recompiled openssh --with-pam --with-kerberos5=/usr/lib/heimdal but to no avail. the same prompting for password occurs. any suggestions would be appreciated! __________________________________ Do you Yahoo!? Yahoo! Sports - Sign up for Fantasy Baseball. http://baseball.fantasysports.yahoo.com/

3 2

Enabling bittorrent in Suse 9.2 Firewall via Yast
by Thomas Frayne 24 Mar '05

24 Mar '05

I have a home laptop computer with Suse 9.2 installed, and with the default firewall configuration and no services enabled. I want to download the Knoppix iso using bittorent. To do this, I need to install bittorrent and enable the firewall to use it in Suse 9.2. I would prefer to use Yast to change the firewall configuration, but I don't know how. The bittorrent documatation indicates that I should insert the iptables rule iptables -t nat -I PREROUTING -p tcp --dport 6881:6889 -j DNAT --to- destination <host> I think that this is to open the firewall to allow other machines participating in the bittorrent download to send me parts of the iso file and get parts from me that I have already received. Is that right? I looked at Yast Firewall Configuration: Services/Edit additional services, and found that I could open ports 6881:6889 for tcp, but I don't see how to limit the uses of these ports to bittorrent. Does this have to be done? Is there a way to do it via Yast? If not, what is the best way to do a temporary iptables change to enable bittorrent without letting anything else into my computer? Should I use a script file to enable/disable bittorrent? Where should I look for information that will answer these questions?

2 1

RE: [suse-security] OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 23 Mar '05

23 Mar '05

> -----Original Message----- > From: edwin [mailto:edwin@nsi.co.id] > Sent: Wednesday, March 23, 2005 3:31 PM > > I implement same thing with no problem. > What is firewall you use? > Before go to squid.conf I think better to check the firewall. > firewall is ok > ifconfig eth0:1 your_external_IP_but_different_from_proxy_IP > > after that you should forward all the request to > your_external_IP_but_different_from_proxy_IP port https port forward > it to your internal_OWA_IP port 80 or 443, set this on your firewall > configuration u meen nat right ? think thats my last problem now. i can enter username and password but after that i get redirected too the private ip, funny, private ip on the net. but nat isnt the way i want to go, if i handle it that way no squid needed and its a direct access to the internal lan. isnt there any other way ? or im complete wrong ?

2 1

OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 23 Mar '05

23 Mar '05

hi there, after reading multible sites over a long time i hope im getting help via this list, im running crazy here sheme: client (www) -> squid (www - public ip) -> firewall -> owa (lan - private ip) squid.conf: visible_hostname host.domain.tld https_port 443 cert=/etc/squid/server.crt key=/etc/squid/server.key hosts_file /etc/squid/hosts http_port 127.0.0.1:8080 httpd_accel_host srv066 httpd_accel_port 80 httpd_accel_uses_host_header off httpd_accel_single_host on httpd_accel_with_proxy off acl acl_testmail dstdomain srv066 http_access allow acl_testmail acl to_index urlpath_regex /$ acl to_favicon urlpath_regex /favicon.ico$ acl to_exchange urlpath_regex /exchange http_access allow to_index http_access allow to_favicon http_access allow to_exchange acl all src 0.0.0.0/0.0.0.0 header_access Accept-Encoding deny all never_direct allow all http_access deny all when i try the connect via https://host.domain.tld, the following error ocoured: While trying to retrieve the URL: http://srv066 The following error was encountered: * Unable to forward this request at this time. This request could not be forwarded to the origin server or to any parent caches. The most likely cause for this error is that: * The cache administrator does not allow this cache to make direct connections to origin servers, and * All configured parent caches are currently unreachable. its an urgent problem, so i hope getting help here greetings andy --free your mind, use open source http://www.mono-project.com ASCII ribbon campaign ( ) - against HTML email X & vCards / \

3 2

RE: [suse-security] OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 23 Mar '05

23 Mar '05

> -----Original Message----- > From: Philippe Vogel [mailto:filiaap@freenet.de] > Sent: Wednesday, March 23, 2005 1:05 PM > What about port-acls? > > #Recommended minimum configuration: > #acl all src 0.0.0.0/0.0.0.0 > #acl manager proto cache_object > #acl localhost src 127.0.0.1/255.255.255.255 > #acl SSL_ports port 443 563 > #acl Safe_ports port 80 # http > #acl Safe_ports port 21 # ftp > #acl Safe_ports port 443 563 # https, snews > #acl Safe_ports port 70 # gopher > #acl Safe_ports port 210 # wais > #acl Safe_ports port 1025-65535 # unregistered ports > #acl Safe_ports port 280 # http-mgmt > #acl Safe_ports port 488 # gss-http > #acl Safe_ports port 591 # filemaker > #acl Safe_ports port 777 # multiling http > #acl CONNECT method CONNECT sure my fool, added now to conf > Point #1: Before getting access to any port it is useful to get > correct acls for all used ports. > > Point #2: Is there a listen-port configured to let your squid run on > https-port? sure: https_port 443 cert=/etc/squid/server.crt key=/etc/squid/server.key > Point #3: Is there a reason in caching https-content as this is > insecure as https should not be cached!? now my english have an break ... > Point #4: I would do this with safe ports: > > http_access deny !Safe_ports > http_access deny CONNECT !SSL_ports right ... added to squid.conf: extension_methods SEARCH PROPFIND PROPATCH MKCOL MOVE BMOVE DELETE BDELETE BPROPFIND BPROPATCH REPORT the connect now works but i dont recieve the formular login on 443 from outlook web access. clients moves to https://host.domain.tld/exchange request tp accept certificate (from squid), long load following and after a while it breaks with: While trying to retrieve the URL: http://srv066:443/exchange The following error was encountered: * Connection Failed The system returned: (111) Connection refused The remote host or network may be down. Please try the request again. problem i see there: its http and not https, and https is needed anyone knows if there if there changes on the owa to do ? actual config looks like this: visible_hostname host.domain.tld https_port 443 cert=/etc/squid/server.crt key=/etc/squid/server.key hosts_file /etc/squid/hosts http_port 127.0.0.1:8080 httpd_accel_host srv066 httpd_accel_port 443 httpd_accel_uses_host_header off httpd_accel_single_host on httpd_accel_with_proxy off acl acl_testmail dstdomain srv066 http_access allow acl_testmail acl to_index urlpath_regex /$ acl to_favicon urlpath_regex /favicon.ico$ acl to_exchange urlpath_regex /exchange http_access allow to_index http_access allow to_favicon http_access allow to_exchange acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl SSL_ports port 443 563 acl Safe_ports port 80 8080 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 563 # https, snews acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl Safe_ports port 3401 # snmp acl CONNECT method CONNECT http_access allow all http_access allow SSL_ports http_access deny !Safe_ports extension_methods SEARCH PROPFIND PROPATCH MKCOL MOVE BMOVE DELETE BDELETE BPROPFIND BPROPATCH REPORT

1 0

RE: [suse-security] OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 23 Mar '05

23 Mar '05

> -----Original Message----- > From: Barry Gill [mailto:barrulus@outies.co.za] > Sent: Wednesday, March 23, 2005 12:45 PM > > http_port 443 > # Port of Squid proxy > httpd_accel_host 192.168.55.20 > # IP address of web server > httpd_accel_port 443 > # Port of web server > httpd_accel_single_host on > # Forward uncached requests to single host > httpd_accel_with_proxy on > httpd_accel_uses_host_header off > > Try this... https_port is configured to 443, httpd_port is only a dummy done the rest, same error like befor

1 0

RE: [suse-security] OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 23 Mar '05

23 Mar '05

> -----Original Message----- > From: Barry Gill [mailto:barrulus@outies.co.za] > Sent: Wednesday, March 23, 2005 12:31 PM > > > > httpd_accel_host srv066 > > > While trying to retrieve the URL: http://srv066 > > Can you ping srv066 from your squid box? > > If not, you need to make httpd_accel_host a resolveable name. > Just a thought. > ping is blocked but connect on 80 and 443 are possible from this host name to ip works fine srv066 - 192.168.55.20 found in cache.log: 005/03/23 12:33:26| Failed to select source for 'http://192.168.55.20/' 2005/03/23 12:33:26| always_direct = 0 2005/03/23 12:33:26| never_direct = 1 2005/03/23 12:33:26| timedout = 0

1 0

Re: [suse-security] Linux and forkbomb - with link
by Bernhard Held 22 Mar '05

22 Mar '05

> Because we have unlimited ulimits by default. > > To fix that: > Install the "ulimit" package. > Adapt /etc/sysconfig/ulimit to your needs. Installing ulimit.rpm broke capi4hylafax, which appends the line fr:35:respawn:/usr/bin/c2faxrecv -q "/var/spool/fax" in /etc/inittab. This runs fine without ulimit.rpm, but together with initscript c2faxrecv chokes on the double quotes. I couldn't find out who's responsible for removing the quotes, therefore I simply removed them in inittab. It seems to be a long standing bug, maybe someone at suse could have a look. Bernhard

2 1

pam_ldap patch not applied correctly in 9.1 and 9.2
by Prakash Velayutham 21 Mar '05

21 Mar '05

Hi All, I have several SuSE Pro 9.0, 9.1 and 9.2 systems. One of these systems is running openldap2 server and the other systems are clients of this LDAP server and authenticate against it. I use pam_ldap and nss_ldap on the clients. Recently I realized that my users are able to change their LDAP passwords using "passwd" utility only from the 9.0 clients and not from the 9.1 and 9.2 clients. The error is something like: user@hostname:~> passwd Changing password for user. Enter login(LDAP) password: New password: Re-enter new password: LDAP password information update failed: Can't contact LDAP server use bind to verify old password Password changed. In the clients warn logs I see something like "pam_ldap: ldap_extended_operation_s Server is unwilling to perform". After googling and searcing around for almost 2 days, I discovered that SuSE did not apply a patch to pam_ldap.c file from the pam_ldap distribution on the recent systems (at least on the 9.1 source RPM I did not see the change suggested by PADL). Here it is if anyone wants it. ber_printf (ber, "{"); ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID, session->info->userdn); - ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_OLD, old_password); +/* ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_OLD, old_password);*/ ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_NEW, new_password); ber_printf (ber, "N}"); In 9.1 sources, I saw this instead. ber_printf (ber, "{"); ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_ID, session->info->userdn); /* this doesn't appear to be necessary anymore */ ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_OLD, old_password); ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_NEW, new_password); ber_printf (ber, "N}"); Once I commented out the necessary line, and rebuilt the RPM I could use "passwd" to change the user password in LDAP. Regards, Prakash

1 0

Linux and forkbomb - with link
by Jim Flanagan 21 Mar '05

21 Mar '05

Sorry, my earlier post did not include the link to the story at securityfocus.com Are any of the currently supported Suse versions suseptable to this forkbomb attack? I'm not very sure what it is, but I'm sure many of you are. I'm running suse 8.2 pro and 9.1 pro. http://www.securityfocus.com/columnists/308?ref=rssdebia -- Jim Flanagan linuxjim(a)jjfiii.com

9 11