July 2005 - openSUSE Security - openSUSE Mailing Lists

Re: Re: Re: [suse-security] tsig verify failure on zone transfer
by Petteri Hakkarainen 25 Jul '05

25 Jul '05

The master says "tsig verify failure" and the slave says "tsig indicates error". That's just about it, no additional info given. Petteri -----Original Message----- From: Philippe Vogel <filiaap(a)freenet.de> To: suse-security(a)suse.com Date: Fri, 22 Jul 2005 11:19:46 +0200 Subject: Re: [suse-security] tsig verify failure on zone transfer -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Petteri Hakkarainen schrieb: > Well? > > -----Original Message----- From: "Petteri Hakkarainen" > <phakkarainen(a)myrealbox.com> To: suse-security(a)suse.com Date: Tue, > 19 Jul 2005 12:42:28 +0300 Subject: [suse-security] tsig verify > failure on zone transfer > I configured Bind to use signatures for zone tranfer. I added the > needed info on both the master and slave, even cut and pasted the > key to make sure I'm not misspelling it. No luck. > > Both servers use NTP and are configured for the same source. > > Any clues what more to check? > > Petteri And what do the logs say? Philippe -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

AW: [suse-security] Acrobat Reader upgrade to 7.0
by Rasp, Robert 25 Jul '05

25 Jul '05

...or you use squidGuard to block "remoteapproach.com" CU Robert -----Ursprüngliche Nachricht----- Von: Dr. Reiner Pietrzak [mailto:suse@crasswerk.de] Gesendet: Samstag, 23. Juli 2005 21:25 An: suse-security(a)suse.com Betreff: Re: [suse-security] Acrobat Reader upgrade to 7.0 Thank you very much for this hint! Am Samstag, den 23.07.2005, 17:51 +0100 schrieb suse(a)karsites.net: > Acrobat Reader likes to phone home apparently - LOL! > > Maybe these people are using AJAX technology also? > > full article at: http://lwn.net/Articles/129729/ > > Linux users may have been pleased to find that Adobe has finally made > available a new version of its Acrobat Reader, with accessibility > features, a much slicker interface than Acrobat 5.x and new and other > spiffy features. However, there are a few other features that Linux > users should be aware of. > > A company called Remote Approach is promising to alert PDF publishers > as to the "reach and use of their materials." We were curious to find > out how Remote Approach was going to make good on its promise, given > that PDF has largely been seen as a one-way medium. To find out, we > created a test account and uploaded a PDF to be "tagged" by Remote > Approach, and then downloaded the modified document to see whether > Remote Approach could log our use of the document. > > Remote Approach's reporting did not work when we viewed the document > with Kpdf, Xpdf and Adobe Reader 5.0.10. It also failed using Apple's > "Preview" application on Mac OS X. The document was still viewable > with no apparent glitch in other PDF readers, but the reporting > function did not work. > > However, when we opened the file using Adobe Acrobat Reader 7, Remote > Approach started logging views from our IP address. After doing a > little research, we found that Adobe's Reader was connecting to > http://www.remoteapproach.com/remoteapproach/logging.asp > each time we opened the document. The information is submitted over > port 80 using HTTP, so it is unlikely that a home or office firewall > would, in a normal configuration, block the activity, unless the > firewall administrator is attempting to block Web browsing. > > > Apparently, Remote Approach's "tag" to our document included the > addition of JavaScript code causing Acrobat to report back to their > server; the information reported includes the fact that the document > had been read, our IP address, and which viewer it had been read in. > (Interestingly, Remote Approach does not seem to recognize the Linux > version of Acrobat Reader, as it left the "User Agent" field blank in > its reports.) > What about simply disabling javascript? Regards - Reiner Pietrzak -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

5 6

Acrobat Reader upgrade to 7.0
by suse＠karsites.net 23 Jul '05

23 Jul '05

Acrobat Reader likes to phone home apparently - LOL! Maybe these people are using AJAX technology also? full article at: http://lwn.net/Articles/129729/ Linux users may have been pleased to find that Adobe has finally made available a new version of its Acrobat Reader, with accessibility features, a much slicker interface than Acrobat 5.x and new and other spiffy features. However, there are a few other features that Linux users should be aware of. A company called Remote Approach is promising to alert PDF publishers as to the "reach and use of their materials." We were curious to find out how Remote Approach was going to make good on its promise, given that PDF has largely been seen as a one-way medium. To find out, we created a test account and uploaded a PDF to be "tagged" by Remote Approach, and then downloaded the modified document to see whether Remote Approach could log our use of the document. Remote Approach's reporting did not work when we viewed the document with Kpdf, Xpdf and Adobe Reader 5.0.10. It also failed using Apple's "Preview" application on Mac OS X. The document was still viewable with no apparent glitch in other PDF readers, but the reporting function did not work. However, when we opened the file using Adobe Acrobat Reader 7, Remote Approach started logging views from our IP address. After doing a little research, we found that Adobe's Reader was connecting to http://www.remoteapproach.com/remoteapproach/logging.asp each time we opened the document. The information is submitted over port 80 using HTTP, so it is unlikely that a home or office firewall would, in a normal configuration, block the activity, unless the firewall administrator is attempting to block Web browsing. Apparently, Remote Approach's "tag" to our document included the addition of JavaScript code causing Acrobat to report back to their server; the information reported includes the fact that the document had been read, our IP address, and which viewer it had been read in. (Interestingly, Remote Approach does not seem to recognize the Linux version of Acrobat Reader, as it left the "User Agent" field blank in its reports.) Regards - Keith Roberts

2 1

susefirewall
by beer＠freakmail.de 22 Jul '05

22 Jul '05

Hi I run Suse 9.2 x86_64 and have to reconfigure my firewall, because I want to have an additional internal network for 'unknown' people to get internet access. I have - one external if dsl0 - one internal (eth1), which is trusted and needs services such as samba, dns, dhcp... from the server - one internal (eth2), which should _only_ have internet access and dhcp(these 2 things work) one could firewall against the internal network and open the needed ports, but then the untrusted internal net also gets samba and other services which it should not get access to. so whats the best way to configure the Susefirewall2? thanks for answers vb

3 2

error in squirrelmail after YOU (bug??)
by Leen de Braal 22 Jul '05

22 Jul '05

Fatal error: Call to undefined function: sq_defang() in /srv/www/htdocs/squirrelmail/functions/mime.php on line 1431 Happens when opening an html-mail. I do not know why it has changed (I am not that much of a programmer), is it ok if I change this small block of code into comments? -- L. de Braal BraHa Systems NL - Terneuzen T +31 115 649333 F +31 115 649444

2 2

Re: [suse-security] tsig verify failure on zone transfer
by Petteri Hakkarainen 22 Jul '05

22 Jul '05

Well? -----Original Message----- From: "Petteri Hakkarainen" <phakkarainen(a)myrealbox.com> To: suse-security(a)suse.com Date: Tue, 19 Jul 2005 12:42:28 +0300 Subject: [suse-security] tsig verify failure on zone transfer I configured Bind to use signatures for zone tranfer. I added the needed info on both the master and slave, even cut and pasted the key to make sure I'm not misspelling it. No luck. Both servers use NTP and are configured for the same source. Any clues what more to check? Petteri -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Alexander Usatin/NY/DOMESTIC/BNY is out of the office.
by ausatin＠bankofny.com 22 Jul '05

22 Jul '05

I will be out of the office starting 07/15/2005 and will not return until 08/01/2005. I will be out of the office starting 7/15/2005 and will not return until 8/1/2005. For immediate assistance, please contact NW group. ________________________________________________________________________ The information in this e-mail, and any attachment therein, is confidential and for use by the addressee only. If you are not the intended recipient, please return the e-mail to the sender and delete it from your computer. Although The Bank of New York attempts to sweep e-mail and attachments for viruses, it does not guarantee that either are virus-free and accepts no liability for any damage sustained as a result of viruses.

1 0

severe useradd problem
by iS-Fun Internet Services GmbH, Holger Diehm 21 Jul '05

21 Jul '05

Hi out there, need help - urgent :-) I have a curious problem addin a new user to my Suse 9.0 system which should absolutely NOT happen!!! Perhaps other Systems may have the same Problems... good luck its the first in my farm showing it up. Heres a description: Doing it via useradd the system CPU and RAM bloats up. cancelling with ctrl-c does not work. killing via killal doesnt work too. I checked the consistency with rpm -V shadow...seems ok. I reinstalled the shadow-rpm from the dvd just to be sure its not manipulated. I straced it, but it only shows me a readonly-access to /etc/passwd which looks like a loop: open("/etc/passwd", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=25473, ...}) = 0 mmap2(NULL, 25473, PROT_READ, MAP_SHARED, 4, 0) = 0x40602000 _llseek(4, 25473, [25473], SEEK_SET) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=25473, ...}) = 0 munmap(0x40602000, 25473) = 0 close(4) = 0 mremap(0x4037f000, 2633728, 2637824, MREMAP_MAYMOVE) = 0x4037f000 ... ... the top values are as follows: 24680 root 15 0 66888 65m 1028 R 99.0 26.2 1:03.69 /usr/sbin/useradd holge3 after a less then a minute later 24680 root 17 0 102m 102m 1016 R 98.7 41.2 1:40.85 /usr/sbin/useradd holge3 Has anyone made the same Experience sometime? I have to admit the /etc/passwd and /etc/shadow are very bloated. But i backuped and emptied them just to see if the files are corrupt in some way --- no effect. Has anyone a clue ? Need more info...tell me, i dont know what more to offer here at first. Greets, Holger

3 4

Re: [suse-security] severe useradd problem
by Marcos Rojas 21 Jul '05

21 Jul '05

Hi In /etc/default/useradd delete this line: GROUPS=dialout,uucp,video,audio cu Sebastian Armin Schoech wrote: > Hello Holger, > > > > On Thu, 21 Jul 2005, iS-Fun Internet Services GmbH, Holger Diehm wrote: > > > >> Date: Thu, 21 Jul 2005 13:30:06 +0200 >> From: "iS-Fun Internet Services GmbH, Holger Diehm" <h.diehm(a)is-fun.de> >> To: suse-security(a)suse.com >> Subject: [suse-security] severe useradd problem >> >> Hi out there, >> >> need help - urgent :-) >> >> I have a curious problem addin a new user to my Suse 9.0 system which should absolutely NOT happen!!! >> >> Doing it via useradd the system CPU and RAM bloats up. cancelling with ctrl-c does not work. killing via killal doesnt work too. >> >> > > --> Just a thought: have you tried adding a user with YaST ? > > Cheers, > Armin > > > __________________________________________________ Correo Yahoo! Espacio para todos tus mensajes, antivirus y antispam ¡gratis! ¡Abrí tu cuenta ya! - http://correo.yahoo.com.ar

2 1

RE: [suse-security] severe useradd problem
by Wilde, Martin 21 Jul '05

21 Jul '05

Hi Armin, since I never had such or similar problem I can also only guess. Though I don"t know if there is a restriction for the amount of users in one group or /etc/group as whole I think it would be a value that you under normal conditions will never reach. However if you think it is a problem with the default group - simply create a new user using something stupid as default group. You will know if this is your problem. Also you might want to post the result of "ls -l /etc/paswd /etc/shadow /etc/group" and also the result of a "wc -l" on each of those files. But what you describes looks as if the process created with your call to useradd has a problem. So you might e. g. try to strace(1) your useradd. Though very unlikely it could be that one of the mentioned files are corrupt. So pipe each of the above files through something like "| sed -n 'l'" and see if there is anything that looks unusual. Is your system a newly created system or did everything work for few weeks e. g.? Again, only some thoughts... Martin > -----Original Message----- > From: iS-Fun Internet Services GmbH, Holger Diehm > [mailto:h.diehm@is-fun.de] > Sent: Thursday, July 21, 2005 5:31 PM > To: suse-security(a)suse.com > Subject: Re: [suse-security] severe useradd problem > > > Hello Armin, > > > --> Just a thought: have you tried adding a user with YaST ? > > > > is not really a way to go for me so i didnt try that yet.I am > adding users via scripting. > I just came back from the doctor and will try tomorrow. > > I found out, that when I delete the last user I created with > userdel and then add the user again...it works. > But only for that one time. > Deleting unneeded users doesnt help me either. > Could there be a limitation for an amount of users being > added to certain groups? > I think it could be some prob with the /etc/group file...but > thats simply a guess yet. > > I hope i get closer to my Prob tomorrow... > > Further suggestions are welcome :-) > > Holger > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0