June 2005 - openSUSE Security - openSUSE Mailing Lists

FYI: HyperThreading considered harmful
by Sven 'Darkman' Michels 16 Jun '05

16 Jun '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi list, FYI: http://www.daemonology.net/hyperthreading-considered-harmful/ any comments from SuSE about that? Regards, Sven -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQFCsAD+QoCguWUBzBwRAhy0AJ9QvCKnbDttxY4v6uYOotu0oQdgbACfRwLf bmrkznCjk71buD6/NKtt1SM= =v1IB -----END PGP SIGNATURE-----

4 3

<kein Betreff>
by Dieter Giersch 15 Jun '05

15 Jun '05

______________________________________________________________ Verschicken Sie romantische, coole und witzige Bilder per SMS! Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193

1 0

limiting connections to subnets
by David Bear 15 Jun '05

15 Jun '05

I don't see anywhere in yast where I can configure the suse firewall to limit connections to a port to a subnet as well. Is this possible in the gui? So, for example, I want to limit who can ssh to a machine to 3 subnets, can I do something like port 23 host allow 129.219.0.0/32 ? -- David Bear phone: 480-965-8257 fax: 480-965-9189 College of Public Programs/ASU Wilson Hall 232 Tempe, AZ 85287-0803 "Beware the IP portfolio, everyone will be suspect of trespassing"

3 2

mmap exploit
by Philippe Vogel 14 Jun '05

14 Jun '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! What about (CAN-2005-1265)? mmap exploit in kernel? http://www.ubuntulinux.org/support/documentation/usn/usn-137-1 Ubuntu did fix this already. Whern there will be a fix available? Reguards Philippe - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQq3YAUNg1DRVIGjBAQKvUwb/XHMHEGvJBF34GwJx+CdCbx4/kPl1iWlc 4O3a1T91Nvcy2K9hmWKNbB7rd1TfTRqBXXu0V1Ovx2r5AUBoComUfmck9WNO111w T3P1zHBl2d+k2oFEasYc5ZwD2kJdDnY63FcYaVd00goP3nSICYjCcG9kM8ALVrMh 0Yy4iYv+BrmclkcWC0LKyvK4lDTXo1UyJFNbwmVRnID+6jaTftWqC/U0jMRKYDt6 C+Sl4yTTb0jxDpvofPMQ9Y09aqJHpv3+79yvczFIjSDcFV4LiCdSrxdj8UqrMYhv is5mabOMpZk= =+b1z -----END PGP SIGNATURE-----

3 6

Antivir licence?
by Maxim A Belushkin 14 Jun '05

14 Jun '05

Hello everyone, I'm running SuSE 9.2, and recently, I've realized antivir won't update any longer, complaining about the licence: Jun 13 10:32:25 linux antivir[7171]: Warning: the file "antivir.vdf" is more than 14 days old Jun 13 10:32:27 linux antivir[7171]: Error: new updates will not work with current license I don't recall the licence being "expirable", but was it? Could someone please shed some light on this issue for me? Thanks!

4 3

Regression in Squid Security Patch
by David J N Begley 14 Jun '05

14 Jun '05

This is a heads-up in case anyone else stumbles across this problem and (like us) ends up spending a lot of time trying to figure out what has gone wrong. The matter has been seperately reported to the SuSE Security contact address (last Friday so they may not have had a chance to investigate it yet). In short, if you're using Squid on SuSE 9.2 (others may be affected but this is the only SuSE version we've checked) with the official Squid RPMs, the latest security updates will break cache digests thus render proxy peering one-way only (that is, your proxy can fetch/use digests but cannot share its own digest with other peers). The symptom is that a seemingly perfectly good Squid config (indeed, one that was previously working) will start reporting "404 Not Found" for every cache digest request, even if the proxy has been running for days (despite the error message, the digest has been built but Squid is refusing to store it locally). Looking through some source RPMs on the 'net, the problem appears to have been introduced around release 6.8 of the Squid RPM (ie., February) and is still present in release 6.10 (April): squid-2.5.STABLE6-6.10 The culprit appears to be an old version of this security patch: squid-2.5.STABLE7-response_splitting.patch The Squid team released an earlier version (used by SuSE in the security update) that broke cache digests, then later released an updated version to correct the problem (alas, this correct version of the patch has not yet found its way into the SuSE Squid updates available via YOU). The matter can be seen discussed in this thread (note specifically the first, penultimate and last messages in this thread): http://www.squid-cache.org/mail-archive/squid-users/200501/0798.html If you compare the version of this patch in the SuSE source RPM to the version available on the Squid Web site, the newer version of the patch adds an extra line to the store digest code in order to fix the broken cache digests thus get bi-directional peering working again. Hope this saves someone some time/effort... Cheers..

1 0

e1000 Problem after Kernel Update
by Hans Ophüls (hop) 10 Jun '05

10 Jun '05

Hi, I have updated my 9.1 with a new Kernel. (2.6.5-7.111-default to 2.6.5-7.151-default). After reebot there was only one Network Interface avaliable. Setting up network interfaces: lo lo IP address: 127.0.0.1/8 doneWaiting for mandatory devices: eth-id-00:e0:81:62:29:19 eth-id-00:e0:81:62:29:1a 19 eth1 device: Intel Corp. 82801BD PRO/100 VE (LOM) Ethernet Controller (rev 82) eth1 configuration: eth-id-00:e0:81:62:29:1a eth1 IP address: 213.203.202.82/24 doneWaiting for mandatory devices: eth-id-00:e0:81:62:29:19 18 17 16 13 12 11 10 9 7 6 5 4 3 2 1 0 eth0 interface could not be set up failedSetting up service network . . . . . . . . . . . . . . . .failed In Yast both Interfaces are avaliable. But originaly eth0 was the RPO/100 Card and the Intel e1000 was eth1. So the routing table is false. Some Applications i.e. Confixx dosent also like that (because of eth0 <-> eth1 change). Can anybody help me. Can I go back to 2.6.5-7.111-default ? Please let me know if you need further Information. Thanks Hans

5 4

Daily Security Check
by Wade Grant 07 Jun '05

07 Jun '05

After installing 9.2 I noticed that it does not have the daily security check that my ver 8 systems have. I know that I cant really rely on the checks but I do like to have the email that it sends to just let me know it is still there. Was this not included in 9.2 or did I miss something during install? wade G.

2 1

Iptables help
by João Reis 07 Jun '05

07 Jun '05

Hi to all! I have the following problem. I have a gateway machine which acts as firewall (iptables) and router to the internal network. What i need is to access from outside with SSH to a internal machine, but i want some protection from the ssh dictionary attacks. I want to use the standard port 22 for ssh and perhaps use the 'recent' module for iptables in order to block this kind of attacks. I already have the block rules for iptables which i got from suse lists, as shown below: $IPTABLES -N SSH $IPTABLES -N SSH-evil $IPTABLES -A SSH-evil -m recent --name badSSH --set -j LOG --log-level DEBUG --log-prefix "evil SSH user: " $IPTABLES -A SSH-evil -j REJECT $IPTABLES -A SSH -p TCP ! --syn -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A SSH -p TCP --syn -m recent --name badSSH --rcheck --seconds 600 -j REJECT $IPTABLES -A SSH -p TCP --syn -m recent --name sshconn --rcheck --seconds 60 --hitcount 5 -j SSH-evil $IPTABLES -A SSH -p TCP --syn -m recent --name sshconn --set $IPTABLES -A SSH -p TCP --syn -j ACCEPT What i need now is to add a forward rule to an internal machine, if everything is ok. How can i do this ? Thanks to all in advance. P.S: Thanks to Rene Gallati for his iptables script. -- \|/ "Do or do not. There is no try" - Yoda \|/ |==============================================| | 2000Comp - Consultoria e Informática, Lda | | Tel: +351 22 941 99 32 | \|/ | Fax: +351 22 941 99 34 | \|/ O | www: http://www.2000comp.pt | O -|--| |--|- \| | Joao Reis | |/ / \ |==============================================| / \ ==========================================================

2 1

Encrypted Filesystem
by Ciro Iriarte 06 Jun '05

06 Jun '05

Hi: I'll probably get a Latitude D610, and because i'll work with sensible information and because of that i was considering the encrypted filesystem option on SuSE 9.2 in case the laptop is stolen or something like that, but i'm not sure about how it works, maybe it's not practical to encrypt +/- 20GB of data and pretend to work normally with that every day, any hints? Thanks in advanced CI.-

7 8