May 2005 - openSUSE Security - openSUSE Mailing Lists

Self DOS with xosview?
by David Huecking 07 May '05

07 May '05

Hello! I run xosview on some machines to be informed about their status. Now with SuSE Linux 9.2 x86 I've go the prob that from time to time xosview does eat all memory available on the machine running the X-server to display the xosview-windows (my workstation). At the same time it may happen that from remote-machine A the xosview works correct, from remote-machine B it does not and from local machine it also does not work. Some time later when I switched my workstation off and on again all xosviews are running smoothly... Though it happens only from time to time it seems like some kind of race condition?! I did a strace of a error xosview session: [...] mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x4001b000 read(4, "Personalities : [raid1] \nmd1 : a"..., 8192) = 195 read(4, "", 7168) = 0 close(4) = 0 munmap(0x4001b000, 4096) = 0 mmap2(NULL, 943079424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40357000 mmap2(NULL, 943079424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x786bb000 The last mmap2-call seems to be the bad one. As I understand the mmap2-call it does allocate 943079424 bytes of memory (would be around 900MB). On a correctly running xosview session the program goes into the loop to grab the informations from /proc after the munmap(): [...] mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x4001b000 read(4, " CPU0 \n 0: 234"..., 8192) = 490 read(4, "", 7168) = 0 close(4) = 0 munmap(0x4001b000, 4096) = 0 open("/proc/mdstat", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x4001b000 read(4, "Personalities : [raid1] \nmd1 : a"..., 8192) = 196 read(4, "", 7168) = 0 close(4) = 0 munmap(0x4001b000, 4096) = 0 write(3, "\20\1\t\0\33\0`\5XDCCC_LINEAR_RGB_CORRECT"..., 36) = 36 read(3, 0xbfffea70, 32) = -1 EAGAIN (Resource temporarily unavailable) [...] I do remember this behaviour from a SuSE 9.0 based system where I switched to a self-compiled Kernel 2.6 (9.0 was with 2.4...). But there was a patch for xosview available because the structure of /proc changed from 2.4 to 2.6. To customize xosview I added the following to my .Xresources ! =========================================================================== ! XOsview ! =========================================================================== xosview*netBandwidth: 10000000 ! for 100Mbit/s Ethernet (could be 12500000) !xosview*netBandwidth: 5000000 xosview*netGraph: True xosview*cpuGraph: False !True xosview*loadGraph: True xosview*disk: True xosview*diskBandwidth: 20000000 xosview*RAID: True But even if I comment out the last line (RAID /proc/mdstat) or even every line, so that the resource are standard it does not work... Anyone an idea what I could do/ test further? TIA. -- Eat, sleep and go running, David Huecking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216

1 1

Mail Control
by ARiF UYSAL 06 May '05

06 May '05

Hello, I have a question, and I do not know if this is the right mailling list. I have a LAN of 10 Win98 PC, 1 Suse Squid, Samba, Masquare (iptables) and Gateway server.. The server's eth0 points to LAN, eth1 points to ADSL Modem .. They have no access directly to internet.. all the connection passes through the Suse server. One of the PC is sending mail, and I want to count how many e-mail that PC sending out at what time, and to whom, and if possible I want to check/see the content of the e-mails. Since there is no local mail server, I can not copy/re-direct any incoming and outgoing mails. Anyways, is there a way to solve my problems. I can check the packets but I want to see what the pc is sending out.. Cheers ARiF

8 8

SuSEfirewall2 + Router + Einzelrechner
by robertspohn＠web.de 06 May '05

06 May '05

Hallo, ich habe einen Einzelrechner (d. h. kein lokales Netzwerk) der über eth0 mit meinem Router verbunden ist und darüber Anschluss ans Internet hat. Frage: 1.) Reicht die im Router integrierte Firewall aus oder ist es sinnvoll auch noch die SuSEFirewall2 zusätzlich einzusetzen ? 2.) Falls SuSEfirewall2 zusätzlich eingesetzt werden kann/sollte, muß ich dann über Yast die interne oder externe Schnittstelle -unter Konfiguration der firewall- auswählen (d. h. ist eth0 dann eine interne oder externe Schnittstelle da mit dem router verbunden) ? Und ist "dsl0" oder "eth-id-00:50:ba:ba:e8:30" oder "ppp0" bei der richtigen Schnittstelle (interne oder externe ?) auszuwählen. Danke schon im voraus ! rob

2 1

IPSec question (freeswan + cisco)
by Aleksandar Ivanovski 06 May '05

06 May '05

Hi List, I have installed freeswan on suse9.0 pro, 2.4.21-99-default . freeswan-1.99_0.9.34-27 freeswan.ca says that 2.4.2x+ works OK with freeswan1.99 The remote site uses cisco IPSec. Since I am very new to IPSec issues, sorry for the stupid questions below sad.gif The other site gave me these infos: PHASE1 (ISAKMP): encryption algorithm: 3DES hash algorithm: Secure Hash Standard authentication method: Pre-Shared Key Diffie-Hellman group: #2 (1024 bit) lifetime: 86400 seconds, no volume limit PHASE2 (IPSEC): encryption algorithm: 3DES hash algorithm: Secure Hash Standard Security association lifetime 4608000 kilobytes/3600 seconds No PFS and that all we need to do is exchange the pre-shared keys and IP addresses. First question is wheather it is possible at all to establish such a connection? I have been reading a pdf Implementing site-to-site ipsec between cisco router and freeswan and have done all the steps Iam attaching here the conf files and the logs: config setup # THIS SETTING MUST BE CORRECT or almost nothing will work; # %defaultroute is okay for most simple cases. interfaces="ipsec0=eth0" # Debug-logging controls: "none" for (almost) none, "all" for lots. klipsdebug=none plutodebug=none # Use auto= parameters in conn descriptions to control startup actions. plutoload=%search plutostart=%search # Close down old connection when new one using same ID shows up. uniqueids=yes ...... conn freeswan-cisco # Left security gateway, subnet behind it, next hop toward right. left=hidden IP address leftsubnet=10.1.10.0/24 (my LAN) leftnexthop= gateway that takes me to internet static IP) # Right security gateway, subnet behind it, next hop toward left. right= IP provided by the operator rightsubnet= rightnexthop= # To authorize this connection, but not actually start it, at startup, # uncomment this. auto=add authby=secret and add row at the end of ipsec.secrets: theirIP myIP : PSK "shared-key that were sent to me by the operator" /var/log/messages: Apr 29 14:57:14 linux pluto[4663]: "freeswan-cisco" #1: initiating Main Mode Apr 29 14:57:17 linux pluto[4663]: "freeswan-cisco" #1: Can't authenticate: no preshared key found for `10.1.10.176' and `195.26.157.18'. Attribute OAKLEY_A UTHENTICATION_METHOD Apr 29 14:57:17 linux pluto[4663]: "freeswan-cisco" #1: no acceptable Oakley Transform Apr 29 14:57:17 linux pluto[4663]: "freeswan-cisco" #1: sending notification NO_PROPOSAL_CHOSEN to 195.26.157.18:500 Apr 29 14:57:26 linux pluto[4663]: "freeswan-cisco" #1: Can't authenticate: no preshared key found for `10.1.10.176' and `195.26.157.18'. Attribute OAKLEY_A UTHENTICATION_METHOD Since I do not have where to read and where to search for these error messages please drop few lines anything, links, pdf's, whats the solution for errors ..... 10x to you all __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 2

clone critical servers
by Cristian Del Carlo 05 May '05

05 May '05

Hi list, I have some critical servers and i would want to clone it to have a secure image. I would want to use this images to have a secure image of my files and to use it to recover the server if the disck fail. I have found this bootable iso cd http://www.sysresccd.org/ that have partimage. Is this for you a good solution or there is other better way ? Thanks, Cristian Del Carlo

5 4

Strange links, /usr/bin/[ ?
by pelibali 04 May '05

04 May '05

Hi, On my SUSE 9.1 I found two quite strange links as /dev/shm/Desktop/~Desktop -> /dev/shm/Desktop/ /var/lib/ntp/var/lib/~ntp -> ../.. I have no idea, what is the meaning to have the above stuff. Anyone could explain it please?! By the way I have an interesting '/usr/bin/[' file as well; is this strange name just an accident or it supposed to be like this? And why then this uncommon name? (The file belongs to the coreutils package and is present also in SUSE 9.2: http://www.novell.com/products/linuxpackages/professional/coreutils.html Thanks, Pelibali

9 23

Illegal user?
by NSK 03 May '05

03 May '05

from /var/log/messages I see msgs like sshd[31200]: Illegal user agata sshd[31202]: Illegal user alejandro sshd[31204]: Illegal user alice sshd[31206]: Illegal user alka All from the same IP address in South Korea. What should I do? -- NSK http://portal.wikinerds.org

6 5

Any tips on IPTABLES-logging?
by Odd Arne Beck 02 May '05

02 May '05

Hi there! (My first posting to this group) I have iptables set up with the "default" logging scheme, /var/log/messages. Here's an "iptables -L"-snippet: LOG all -- anywhere anywhere LOG level warning prefix `Drop: ' DROP all -- anywhere anywhere My logfiles look like this Drop: IN=eth1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=60.191.1.173 DST=aa.bb.cc.dd ../*edited*/ PROTO=UDP SPT=1087 DPT=1434 ... Which isn't very "nice", or (imho) not very readable. I am wondering if someone in here does these loggings in an other way, and how they then do it. What ways can I make iptables log it's traffic? If anyone have suggestions, good links, tips or explanatory docs on the following "methods", I would really appreciate it: - Log to a database (whatever DB) - Log to a file - Log to a syslog-server It would be nice to not receive mails with "rtfm iptables", please. Best regards Odd Arne Beck SuSE 9.2-user

2 1