July 2005 - openSUSE Security - openSUSE Mailing Lists

I'm stumped what exactly is kpgp/gnupgp looking for in a "valid" passphrase?
by jfweber＠bellsouth.net 08 Jul '05

08 Jul '05

I have tried just about everything I can think of and no matter what it is I get the same result "invalid passphrase please try again, until after a while it just says, invalid passphrase and revocation certificate ( or anything else that wants a passphrase ) is not created.. I tried reading the manual but got no help there... oh, it's Suse 9.3 a clean install , And I am attempting to put back the gnupg and kpgp items from 9.2, I can import them from a keyserver, but although a click on the kpgp icon shows the files , if I attempt to use one for a signature in kmail, it tells me there is no information there. Decrypts do the same it claims there is no information in the file... I can't even make a new one that shows up.. I have tried that as well. Most omoshiroii -- j kpgp fingerprint:2974 C0EF 1FDB E4FF 94C6 EF99 BD5E CC94 823B 8B73

3 3

MySQL 4.1 on SLES9?
by Tom Knight 08 Jul '05

08 Jul '05

Hi, I'm installing a set of SLES 9 servers, and trying to keep on the rpm only route, 'cos that's (IMO) a Good Thing. I've noticed that MySQl is installed as version mysql-4.0.18-32.13, and I'd rather have version 4.1.xxx installed. I know that SuSE update software for security reasons - could 4.1 be justified because of the change of password hash? Not having 4.1 isn't a killer, just it'd be nice ;-) Ta, Tom. -- Tom Knight System Administration Officer Arts & Humanities Data Service Web: http://www.ahds.ac.uk Email: tom.knight(a)ahds.ac.uk

2 2

RE : [suse-security] Kernel update
by "Dubé, Michel" 07 Jul '05

07 Jul '05

I install this list of software from source, I don't use the rpm from SuSE. Michel. -----Message d'origine----- De : Ingo Boernig [mailto:ingo@boernig.de] Envoyé : 7 juillet 2005 11:37 À : suse-security(a)suse.com Objet : Re: [suse-security] Kernel update Am Donnerstag, 7. Juli 2005 17:07 schrieb Dubé, Michel: > Hi all, for security reason I want to update my kernel from > 2.6.5-7.111 to 2.6.5-7.155.29. > > Do I need to recompile my application: apache, php, mysql, heartbeat > and drbd with the new kernel ? No. > > I am pretty sure about drbd because it's a module. The updated module is incorporated in the kernel-rpm. > Michel. wkr, Ingo -- Ingo Börnig <ingo at boernig.de> /*\ \ / ASCII Ribbon Campaign ask for phone or snail mail X against HTML email / \ GPG-Fingerprint: 2F8B DDFB F2A8 155A 206D 2969 F8FB 3C63 2033 BF32

2 1

Kernel update
by "Dubé, Michel" 07 Jul '05

07 Jul '05

Hi all, for security reason I want to update my kernel from 2.6.5-7.111 to 2.6.5-7.155.29. Do I need to recompile my application: apache, php, mysql, heartbeat and drbd with the new kernel ? I am pretty sure about drbd because it's a module. Michel.

2 1

FW_REDIRECT in SuSE Firewall
by Wolfgang Kluge 07 Jul '05

07 Jul '05

Good morning. I am quite new to configuring a firewall and I will appreciate any help I can get. I am running SuSE 9.3, default Kernel on my firewall machine and want to redirect client FTP requests to Frox proxy, port 2121 on the firewall machine. In /etc/sysconfig/SuSEfirewall2, section 15 I set FW_REDIRECT="192.168.0.0/24,0/0,tcp,21,2121" But nothing gets redirected. What did I overlook? Regards Wolfgang Kluge -- This message was scanned for spam and viruses by BitDefender. For more information please visit http://linux.bitdefender.com/

4 6

Cryptoloop AES multi key setup
by Christian Erpelding 06 Jul '05

06 Jul '05

Hello list! Under SuSE Linux 9.2 Pro, I've encrypted several partitions using crytoloop / aes-128. Now, I updated my system to SuSE 9.3. The update process went fine, but now I'm unable to mount the AES Multi Key (V2=64 keys / V3=65 keys) encrypted partitions. AES Single Key Encryption still works flawlessly. I've done some testing and found out, that SuSE 9.3 seems to be unable to use AES multi key setups at all. I've tested this on 2 different computers. To reproduce, try the following steps: # Check kernel version linux:/crypto # uname -a Linux linux 2.6.11.4-21.7-default #1 Thu Jun 2 14:23:14 UTC 2005 i686 athlon i386 GNU/Linux # Create test image linux:/crypto # dd if=/dev/urandom of=test.img bs=1k count=1k 1024+0 records in 1024+0 records out 1048576 bytes (1.0 MB) copied, 0.397559 seconds, 2.6 MB/s # Create test key V1 (1 key) linux:/crypto # head -c3000 /dev/urandom |uuencode -m - | head -n66 | tail -n1 > testkey1 linux:/crypto # wc testkey1 1 1 61 testkey1 # Create test key V2 (64 keys) linux:/crypto # head -c3000 /dev/urandom |uuencode -m - | head -n66 | tail -n64 > testkey64 linux:/crypto # wc testkey64 64 64 3904 testkey64 # Create test key V3 (65 keys) linux:/crypto # head -c3000 /dev/urandom |uuencode -m - | head -n66 | tail -n65 > testkey65 linux:/crypto # wc testkey65 65 65 3965 testkey65 # Load modules linux:/crypto # modprobe cryptoloop linux:/crypto # modprobe aes # Check crypto capabilities linux:/crypto # cat /proc/crypto [...] name : aes module : aes_i586 type : cipher blocksize : 16 min keysize : 16 max keysize : 32 # Try single key setup (WORKS) linux:/crypto # losetup -e aes-128 -p0 /dev/loop0 test.img < testkey1 linux:/crypto # losetup -d /dev/loop0 # Try multi key setup V2 (DOES NOT WORK) linux:/crypto # losetup -e aes-128 -p0 /dev/loop0 test.img < testkey64 ioctl: LOOP_MULTI_KEY_SETUP: Invalid argument # Try multi key setup V3 (DOES NOT WORK) linux:/crypto # losetup -e aes-128 -p0 /dev/loop0 test.img < testkey65 ioctl: LOOP_MULTI_KEY_SETUP_V3: Invalid argument Any ideas? Thanks in advance Christian Erpelding

1 0

Suse 9.2 Pro User Logging Problem
by Bill Arcieri 06 Jul '05

06 Jul '05

I'm running SUSE 9.2 and need to automatically log user logins, including bad logins (password errors, etc.). I have sent the logging parameters in Yast and expect to see the bad logins in either /var/log/btmp (which I have defined) or in /var/log/faillog using either the lastb or faillog utilities. Bad login attempts are not being accumulated in either of these files and, in fact, the file size of these files is 0. I have the feeling that there is some flag in the system configuration that is not being set that is needed to automatically log bad login attempts (and perhaps some other logging features). My system is default SUSE 9.2 operating on an AMD Opteron 244 system. I'd like to know if anyone has experience with user logging with SUSE 9.2. In particular, were any changes made to the system configuration to get user logging to work properly? If so, what are the changes? Are there user logging issues with SUSE 9.2? I've checked the SUSE website and have found little about user logging. Is some alternative software package being used like SNARE. Note that I have thought about using SNARE, but it has not been integrated into the SUSE 9.2 package (kernel). Thank you in advance for any help. Bill Arcieri

1 0

Is Java 1.5 safe?
by Bob Vickers 06 Jul '05

06 Jul '05

There was recently a security alert from Sun about J2SE 5.0 and 1.4.2 (see http://sunsolve.sun.com/search/document.do?assetkey=1-26-101749-1 ). SuSE supplied updates for the various 1.4.2 packages, but not for the 1.5.0 packages supplied on the 9.3 DVD, e.g. java-1_5_0-sun-plugin-1.5.0_01-5 java-1_5_0-sun-1.5.0_01-5 Now Java version numbers are a bit mysterious, but it looks to me like these packages might be vulnerable. Would anyone like to comment? Thanks, Bob

2 2

The future of Linux
by Janvier Anonical 05 Jul '05

05 Jul '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I have read that Microsoft has bought Sybari and discontinued its anti-virus support for UNIX and Linux. It seems Microsoft views Linux as a real threat. Since Sybari is out, what would be an alternative for Linux users with regards to anti viruses? - -- To mess up a Linux box, you need to work at it; to mess up your Windows box, you just need to work on it. - Scott Granneman, Security Focus -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.1 (Build 2185) iQEVAwUBQsUV0GlGIXYBuowEAQqv5wgAvZ+M2T7Bf3aAKdX0M/XUW5s6u80NbxA1 cMTEKRXYVW8Zc637ey5UlDkhhoQ1hRqfPm/AAyi0Ki55f5h4YsGPh2h40MLS80en aSNnM5hjtXp6eii1zLwHvims1LkSr9s5gSXjhWWtUGp8wKSC2ugCahoLUAKYRRVn eai4FFykAQPukkLTWEqoX34Bp5wNf4hyl356IoqycQE6hFigkm2G/5rMy9rJHU1u jfpeYTX748JmnTBD57mQRvsgog89X5aB7EcFFQiA23MOu0QeN31Lcm9/ESGgu6RG xM7fXDWBJRjL+k93sHSlArkpe6gEDhtZE+TsZ8eNlObeDESrmnC9Fg== =UYEM -----END PGP SIGNATURE-----

9 8

logrotate - rotate to a information leak?
by Sven 'Darkman' Michels 05 Jul '05

05 Jul '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi there, i noticed a "small" problem with logrotate (at least on SLES9): we've very restrictive rights for all our logfiles cause many of them contain sensitive informations. So we use 'create 0600 user group' to protect our logs. Now the problem: a rotated logfile (gzipped) has 644 and root.root permissions instead of the 'secure' ones. So we've a small security problem here. One way to fix this would be a postrotate script to fix the permissions, but is this really the way? I think if i use special permissions for my logs, they should applyed to the archives, too. Did i miss something in the manpage(s) or is this the normal behavior? (didn't yet take a look into the source due to lack of time...) Regards and thanks, Sven -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQFCyWHHQoCguWUBzBwRAgOxAKCZxi344+yIdZLLfWAGq+fNj2OrnwCffgRU dBB49esW+Mg7CrScD6brCYA= =05Ow -----END PGP SIGNATURE-----

3 3