April 2005 - openSUSE Security - openSUSE Mailing Lists

ipsec with openswan (suse 9.2) daily restart necessary?
by Markus Feilner 25 Apr '05

25 Apr '05

Hi List, I have several systems running various VPN software, and some are suse 9.2 with ipsec of openswan. from time to time ipsec crashes, the only obvious error line in /var/log/messages is something like: "| called while no event expired" If i add a line to my crontab that restarts ipsec daily, everything works fine. Is that necessary or a misconfiguration? I can provide more details as needed. thanks! -- Mit freundlichen Grüßen Markus Feilner --------------------------- Bitte beachten Sie unsere neuen Adressdaten! Vielen Dank. --------------------------- Feilner IT Linux & GIS Linux Solutions, Training, Seminare und Workshops - auch Inhouse Beraiterweg 4 93047 Regensburg fon +49 941 9465243 fax +49 941 9465244 mobil + +49 170 3027092 mail mfeilner(a)feilner-it.net web http://www.feilner-it.net

1 0

Hard Drive Error
by Philip B Cook 23 Apr '05

23 Apr '05

Apologies guys, I know this is the wrong list, but am unsure which list to use. I only subscribe at present to SUSE Security. Please point me in the right area. I am generating the following errors .. hdb: dma_init: status=0x51 {DriveReady SeekComplete Error} hdb: dma_init: error=0x84 {DriveStatusError BadCRC} ide: failed opcode was : unknown I get about 7 or 8 of these when transfering sustained data from the linux machine to a Windows machine using SAMBA. After these errors the linux machine freezes completely forcing a hard RESET to clear it. I have two physical hard drives hda, hdb (both 120MB Western Digital drives) configured using LVM. The LVM contains my \home directories, which contain the files I am trying to transfer. The system has run for over a year without problems. I have run the DOS based WD diagnostics on the drive and it reports no errors. Any thing you can suggest. Philip

4 5

x86_64 Security Updates For OpenOffice.org?
by Bernie Hoefer 22 Apr '05

22 Apr '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm confused by the the recent absence of OpenOffice.org security updates for SuSE 9.1 on the x86_64 platform. For those who don't know, the x86_64 port of SuSE 9.1 has some packages that, apparently, are not 64-bit clean and thus could not be compiled for the x86_64. Thus, the install media, as well as SuSE's FTP site have this kind of directory structure: .../x86_64/update/9.1/rpm/i586 .../x86_64/update/9.1/rpm/noarch .../x86_64/update/9.1/rpm/src .../x86_64/update/9.1/rpm/x86_64 This recent OpenOffice.org security announcement[1] lists vulnerabilities that affect all architectures, but updates for SuSE 9.1 are only available in the .../i386/update/9.1/rpm/i586 ^^^^ directory. Is this just an oversight, or should us x86_64 users be looking in both .../x86_64/.../i586 and .../i386/.../i586 for updates? [1] <http://www.novell.com/linux/security/advisories/2005_25_openoffice_org.html> - -- Bernie Hoefer PGP e-mail is welcome! Get my 1024 bit signature key from: <http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x446A6F93>. "The more I know, the more I realize how much I do not understand." -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFCaD/mckGmqURqb5MRAk1WAKCXSiMIEXfAN5Lj9K3DTXBM9dKPOgCdFiiW 4Y0bUQl9bKPKCCfYpwMz9Mk= =Y3ld -----END PGP SIGNATURE-----

2 1

RE: [suse-security] 2-Factor Authentication
by Ness, Todd 21 Apr '05

21 Apr '05

You can use Secure Computing SafeWord Premier access as your server piece and use radius on the Linux client. -----Original Message----- From: Jack Sparrow [mailto:jack_sparrow81@yahoo.com] Sent: Thursday, April 21, 2005 6:31 AM To: suse-security(a)suse.com Subject: [suse-security] 2-Factor Authentication Hi Folks, I'm wondering whether there are any smartcards or USB toekens that can be used to perform 2-factor authentication on Linux. There are many such products out there, but they do not support Linux. I would appreciate if someone could help me to get pointers/information to/about such products. Thanks in advance. Regards, - Jack __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

2-Factor Authentication
by Jack Sparrow 21 Apr '05

21 Apr '05

Hi Folks, I'm wondering whether there are any smartcards or USB toekens that can be used to perform 2-factor authentication on Linux. There are many such products out there, but they do not support Linux. I would appreciate if someone could help me to get pointers/information to/about such products. Thanks in advance. Regards, - Jack __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

RE: [suse-security] Paranoid File Permissions
by Ian Douglas 21 Apr '05

21 Apr '05

I haven't worked out why the login error occurs, but it is annoying. However, you can easily fix the su problem by editing the /etc/permissions.paranoid file and changing the value of /bin/su from 0755 to 4755 as shown below (this may have security implications for others!!): # suid system programs that need the suid bit to work: # /bin/su root:root 4755 Run "SuSEconfig" to update the file or change permissions manally. This at least will allow users to su to root. This was critical on a couple of boxes I had that were headless and keyboard-less, and root logins had been disabled! Bear in mind, any updates may change the value back. Cheers Ian -----Original Message----- From: White, Joseph [mailto:jwhite@sandia.gov] Sent: Thursday, April 21, 2005 8:28 AM To: suse-security(a)suse.com Subject: [suse-security] Paranoid File Permissions Hi All, Using Suse 9.2 /KDE w/GDM Has anyone noticed if you go into Yast and select security, then custom, and change file permissions from "Easy" to "Paranoid", once you do that you will not be able to unlock your screen saver or su to root. Also, if your logged in as a regular user and you launch Yast it will ask for you root password, probably just anther su function, but that won't work any longer as well. You have to log out and log back in as root to run Yast to undo the setting. It is probably messing with 'pam' in some strange way, but don't know exactly. Thanks, Joe -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

OpenOffice_org 1.1.3 update (for SUSE 9.3)
by pelibali 21 Apr '05

21 Apr '05

Hi, Is there an update scheduled for the "obsolete" OpenOffice_org 1.1.3 package included on SUSE 9.3? For the 1.9.79 series there are updates provided, but in fact nothing for the 1.1.3 variant. Just have to wait a little, or no chance? Thanks, Pelibali

2 1

Paranoid File Permissions
by White, Joseph 20 Apr '05

20 Apr '05

Hi All, Using Suse 9.2 /KDE w/GDM Has anyone noticed if you go into Yast and select security, then custom, and change file permissions from "Easy" to "Paranoid", once you do that you will not be able to unlock your screen saver or su to root. Also, if your logged in as a regular user and you launch Yast it will ask for you root password, probably just anther su function, but that won't work any longer as well. You have to log out and log back in as root to run Yast to undo the setting. It is probably messing with 'pam' in some strange way, but don't know exactly. Thanks, Joe

1 0

YOU installs RPM with bad MD5 checksum
by Klaus Layer 20 Apr '05

20 Apr '05

Hi all, I just installed the security updates for wget and openoffice. During checking the RPM checksum YOU reported a wrong checksum but instead of canceling it installed the RPM: ---------------------------------------------------------------------- OpenOffice_org: "Ein freies Office-Paket (der sprachunabhängige Teil)" wird abgerufen ... Ok wget: "Programm zum Spiegeln von HTTP- und FTP-Servern" wird abgerufen ... ERROR(You:Die MD5-Prüfsumme passt nicht überein.)[Die Datei './i386/update/9.2/deltas/wget-1.9.1-50.4_50.6.i586.delta.rpm' besitzt eine falsche MD5-Prüfsumme: '58239d09af0b5aea88973fea3503ed11' != '384843093d16aa8489b550c5e957c426'] Ok Delta wird angewendet ... Ok Delta wird angewendet ... Ok OpenOffice_org: "Ein freies Office-Paket (der sprachunabhängige Teil)" wird installiert Ok wget: "Programm zum Spiegeln von HTTP- und FTP-Servern" wird installiert Ok Installation abgeschlossen. 2 Patches wurden installiert. ----------------------------------------------------------------------- I cant believe it. If YOU ignores bad checksums this would be a major security hole. Can anyone from SUSE please comment on this. Thanks, -- Klaus Layer .~. Walldorf /V\ Germany // \\ EMail: klaus.layer(a)gmx.de /( )\ ICQ: 230933667 ^`~'^ GnuPG Fingerprint: 466D 12F8 28A3 D137 A77E FC3B 271C 2D79 6F5E 94C9

1 1

Samba Problem?
by Philippe Vogel 20 Apr '05

20 Apr '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! Yesterday I backuped my dayly data to my home samba share while listening to some music from the same share. After copy was finished the server crashed. Is there a filehandler problem in SuSE 9.1 with current samba and current smp-kernel? For me it looks like this as I got this behaviour the second time. Reguards Philippe - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQmaZLUNg1DRVIGjBAQIdywcAi53mJ/oRXG0A62eRRnFQqWvD/UzBZfev 7L4n9D5opKTNyKZANYsANon3JSWgcBit3nDSqyfToeaQFo73xxeXuwnR0Py6Ph9H vHyZQmNK5AxSJhlQooEgRgBPIXj/YpSyremOvB99ClraB0cmpbG95u7uSMyNqg8N 2llFXLV/OHaAZy6Ifnl6vR6kLwDLGEiuMMxprdTlNe15bQWJh+vJXjG0fScidgB9 KslI59BP1XLv7R2YW4MMsVuORKV18vRFXGpDEYBV0q9MS5nreZ5JEyQs9IP9ctzC VbybbH2bBck= =nzrM -----END PGP SIGNATURE-----

1 0