August 2005 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] #@$% SUSE !!!
by Philippe Vogel 02 Sep '05

02 Sep '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Taras Prokopenko schrieb: > Thanks, i've bookmarked this page. > > P.S. Yes, it's my fault. I've upgraded from Red Hat 9, and it was > pretty interesting that plaintext passwords are not accepted in > suse's imap, and i have 70 mail users, which start to call me )... WTF? Is it that problem to solve and convert 70 user's passwords? There is always a way to do this by script (that's the way I normally do). > We have slow inet connection, only 256kbits for about 100 machines, > and downloading all .src.rpm with dependencies (not included in > DVD) then building this chain... ARGGHH. That's your problem, but if it last a little bit longer it's not the reason to call SuSE team names. > Not trolling, but ... Well now it's all done, no problems. Before you write this way better choose the way the nettiquette describes. Kind questions get kind answers (maybe some will give for simple questions bad answers as they don't know everybody starts from scratch ...). Bad questions and name-calling ends up in a flamewar or in worst case in an unsuscription from a list. It's always depends on what you make of it. Philippe - -- Diese Nachricht ist digital signiert und enth?lt weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verst??t gegen §1 UWG und 823 I BGB (Beschlu? des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der ?bermittelten pers?nlichen Daten sowie deren Weitergabe an Dritte ist ausdr?cklich untersagt! - -- Diese Nachricht ist digital signiert und enth?lt weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verst??t gegen §1 UWG und 823 I BGB (Beschlu? des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der ?bermittelten pers?nlichen Daten sowie deren Weitergabe an Dritte ist ausdr?cklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQxL/oENg1DRVIGjBAQJOPwb/eAJh4SbQJHmp4ADpwdA9acmnsANCnhW6 F+nEpMV7Yvs/9Ms6Rzs/EiU9zGTfOKuTgJK+Wb75vhWgC1/C7RjffE+vHkJQixDm +HxfWnGCBtY9QvcuY4JXMDSSQa2qh85et1eDpxb9h4e3n0bKDdpBqPWxM11h0oKm V9ne9RVBNU/G5SY46oRid+r4Je5df/nS36JZexvmiD8x08N5PmBcLbGo9S3bi2ng dFafEnhiJoCHgeBDnrKPDgpP2Td/CsAuEQ4EmtrtP7M7OjleSqsKqoPho7R5aCYl S9i3SbbRN2o= =MaB/ -----END PGP SIGNATURE-----

2 1

fuck SUSE !!!
by suse-list 01 Sep '05

01 Sep '05

WHY THE HELL imap-2004c-3.i586.rpm BUILT WITHOUT SSLTYPE=UNIX FOR PLAINTEX AUTH IN NON-SSL MODE!!! WHY THE HELL DVD NOT CONTAINS ALL FOR BUILD? WHY NO MESS IN REL.NOTES FUCK YOU ALL!

8 7

problems with pcre functions after php update
by Andy Spiers 31 Aug '05

31 Aug '05

Hi, We've just applied the updated packages from the security announcement SUSE-SA:2005:049 that came out about 2 hours ago and we're seeing errors in PCRE functions in a PHP application that was working fine before. Is anyone else having the same problems? Here's an example of the error generated: PHP Warning: preg_match: internal pcre_fullinfo() error -3 in /srv/www/htdocs/netcat/modules/stats/function.inc.php on line 28 Here's line 28 from the file mentioned - it looks perfectly fine to me: if (preg_match("/(netscape|mozilla|links|lynx|opera|msie|konqueror)/i",$HTTP_USER_AGENT)) { Looking on google gives me the impression that many people have seen this bug and unfortunately the PHP team's answer seems to be "use the internal/included PCRE library and not the system one". Do the guys from SuSE or anyone else have any comments on this or ideas on how to solve it? For the moment I've rolled back to the old versions of the RPMs. Best regards, Andy Spiers

4 6

lamers.just lamers.
by suse-list 31 Aug '05

31 Aug '05

break my php-apps. anyway!...

1 0

kernel 2.6.13 with kernel task optimization
by Philippe Vogel 30 Aug '05

30 Aug '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! Will there be updates to kernel 2.6.13 for recent and older (till 9.0) distributions? There are several new improvements in data throughput and for real-time processes within the newest kernel. Reguards Philippe - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQxMSikNg1DRVIGjBAQLWcQb/dIROYp9IT0YVDDq7OiMw8fEWmNr93ZXw OAkp3CW5uKtDSPIu9lGykyXYVgh52hmrQBJj2eV02kxeKF3ZXFwEtmiuv5TbHly5 4hEzzPGQV+YsAm+YcNeowYm/IFKjnGsnxkQk+2D53v2pnOplRy329PrQvJXa5JWo rPVkPQ350Ij/YvY//K/1Bp2bE1mbAKeJxw8Fact/h+NDd95e5ifQ6cUuIZtDHraa NMzqPLagJ/Kj4x8bKglU0yjBYHBDEPyamZUkL+hbnyT+kHHshVduus5l8mre9y7L 8O/xjLxCsXk= =cgji -----END PGP SIGNATURE-----

3 2

suse-firewall2 Question
by Ash 30 Aug '05

30 Aug '05

Hi, I have just upgraded form SuSE 9.2 -> 9.3 and the firewall GUI in YaST has changed. Is there a way I can use the OLD gui again? Well I guess if I can not then I will have to use a term shell again (Lazyness strikes back). Thanks all, Ash

1 0

Apache Update Failed
by suse＠karsites.net 29 Aug '05

29 Aug '05

Hi everyone. I'm running SuSE 9.2 pro. Just did an online update with fou4s. After re-booting my machine, Apache refused to start. Here is the error message. karsites:~ # /etc/init.d/apache2 start Starting httpd2 (prefork) Syntax error on line 24 of /etc/apache2/sysconfig.d/global.conf: CustomLog takes two or three arguments, a file name, a custom log format string or format name, and an optional "env=" clause (see docs) The command line was: /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf failed It appears the Apache is overwriting the /etc/sysconfig/apache2 config file. Fortunately, I had saved a copy, which I re-installed, and Apache started OK again. I thought that altered config files were not supposed to be touched by package updates? Kind Regards - Keith Roberts

1 0

Problems with ethernet channel bonding after last kernel update
by Markus Gaugusch 24 Aug '05

24 Aug '05

Hi, I have two SuSE 9.3 machines which started to produce the following errors after the latest kernel update: Aug 24 00:04:59 scotty kernel: e100: eth1: e100_watchdog: link down Aug 24 00:13:19 scotty kernel: e100: eth1: e100_watchdog: link down Aug 24 00:14:10 scotty kernel: bonding: bond0: link status definitely down for interface eth1, disabling it Aug 24 00:14:12 scotty kernel: e100: eth1: e100_watchdog: link up, 10Mbps, full-duplex Aug 24 00:14:12 scotty kernel: bonding: bond0: link status definitely up for interface eth1. Aug 24 00:19:46 scotty kernel: e100: eth1: e100_watchdog: link down Aug 24 00:27:33 scotty kernel: bonding: bond0: link status definitely down for interface eth1, disabling it Aug 24 00:27:35 scotty kernel: e100: eth1: e100_watchdog: link up, 100Mbps, full-duplex Aug 24 00:27:35 scotty kernel: bonding: bond0: link status definitely up for interface eth1. Aug 24 00:36:12 scotty kernel: e100: eth1: e100_watchdog: link down Aug 24 00:47:17 scotty kernel: e100: eth1: e100_watchdog: link down Aug 24 00:54:16 scotty kernel: bonding: bond0: link status definitely down for interface eth1, disabling it Aug 24 00:54:18 scotty kernel: e100: eth1: e100_watchdog: link up, 100Mbps, full-duplex (this goes all day long) The second machine was installed only a few days ago and has never used the original kernel in production, but the messages are the same. I'm sure that the switches are not guilty, because the configuration has worked for a long time before (we used SuSE 9.0 on the recently upgraded machine, also with the e100/bonding driver). The NICs are Intel Pro 1000 (eth0) and Intel e100 (eth1) in active backup mode (mode=1, miimon=100) in the shown machine and two Intel e100 in the second machine. The first machine has link failures only on eth1 and the second machine on both. So most probably, this is the e100 driver, but e100.c has not changed in the kernel source packages :-( Security Team: Any hints? Markus

1 0

Blocking an ip-address
by Chadley Wilson 22 Aug '05

22 Aug '05

Greetings, Is there away to block an ip-address completely with SuSEFirewall ? -- -- Chadley Wilson Production Line Superintendant Pinnacle Micro Manufacturers of Proline Computers ==================================== Exercise freedom, Use LINUX =====================================

3 2

disable boot.crypto
by miguel listas 21 Aug '05

21 Aug '05

Hi, i have some encrypted partitions in my system (suse 9.3, updated). My problem is that i must be at the keyboard when rebooting (or just booting up) the machine to enter the passphrase (or press the intro key to go on with the boot process) or just wait for the timeout. As the network is not available at this point (only lo interface is ready at that moment), i would like to disable the automatic mount during the boot process. I have tried to use 'noauto' option in the /etc/cryptotab file, to no success (doesnt make any difference): /dev/loop0 /dev/hdb11 /stuff reiserfs twofish256 acl,user_xattr,noauto /dev/loop1 /dev/hdc2 /waste2 reiserfs twofish256 acl,user_xattr,noauto /dev/loop2 /dev/hdc4 /waste4 ext3 twofish256 acl,user_xattr,noauto Is there an easy way to disable the boot.crypto script during the boot? Ive been unable to find the man page of cryptotab or any reference in the fstab man page. Thanks lots, -- Saludos, Miguel

3 2

Root-over-NFS problem
by Prakash Velayutham 21 Aug '05

21 Aug '05

Hi, I have a root-over-NFS issue. How should my shutdown order be in case of a client who is mounting root-over-NFS? When should the network be shutdown and when should the NFS be shutdown? Thanks, Prakash

2 1

Re: [suse-security-announce] SUSE Security Announcement: apache, apache2 request smuggling problem (SUSE-SA:2005:046)
by Markus Gerke 17 Aug '05

17 Aug '05

Hi, I'm running apache 1.3.33 (SuSE 9.0) from the projects-folder on the suse-ftp server (ftp.suse.com:/pub/projects/apache/apache/9.0-i386). The official release for SuSE 9.0 is 1.3.28 (as fixed now), but from 1.3.28 to .33 a lot of bugs have been fixed, also. What should I do now? Downgrade to 1.3.28 with the new bug fixed? Or does SuSE intend to update the 1.3.33 in the project folder? Regards, Markus Marcus Meissner wrote: > ______________________________________________________________________________ > > SUSE Security Announcement > > Package: apache,apache2 > Announcement ID: SUSE-SA:2005:046 > Date: Tue, 16 Aug 2005 07:00:00 +0000 > Affected Products: 8.2, 9.0, 9.1, 9.2, 9.3 > SUSE Linux Enterprise Server 8, 9 > Vulnerability Type: authentication bypass > Severity (1-10): 6 > SUSE Default Package: no > Cross-References: CAN-2005-2088 > CAN-2005-1268 > > > Content of This Advisory: > 1) Security Vulnerability Resolved: > apache and apache2 request smuggling > Problem Description > 2) Solution or Work-Around > 3) Special Instructions and Notes > 4) Package Location and Checksums > 5) Pending Vulnerabilities, Solutions, and Work-Arounds: > See SUSE Security Summary Report. > 6) Authenticity Verification and Additional Information > > ______________________________________________________________________________ > > 1) Problem Description and Brief Discussion > > A security flaw was found in the Apache and Apache2 web servers which > allows remote attacker to "smuggle" requests past filters by providing > handcrafted header entries. > > Fixed Apache 2 server packages were released on July 26th, > fixed Apache 1 server packages were released on August 15th. > > This issue is tracked by the Mitre CVE ID CAN-2005-2088. > > The Apache2 packages additionally fix a single byte overflow in the SSL > CRL handling functionality, tracked by the Mitre CVE ID CAN-2005-1268. > > The Apache1 packages additionally fix a harmless local buffer overflow > in htpasswd. > > 2) Solution or Work-Around > > None, please install the updated packages. > > 3) Special Instructions and Notes > > Please restart the Apache web server after the update. > > 4) Package Location and Checksums > > The preferred method for installing security updates is to use the YaST > Online Update (YOU) tool. YOU detects which updates are required and > automatically performs the necessary steps to verify and install them. > Alternatively, download the update packages for your distribution > manually > and verify their integrity by the methods listed in Section 6 of this > announcement. Then install the packages using the command > > rpm -Fhv <file.rpm> > > to apply the update, replacing <file.rpm> with the filename of the > downloaded RPM package. > > Our maintenance customers are notified individually. The packages are > offered for installation from the maintenance web. > > > x86 Platform: > > SUSE Linux 9.3: > > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/apache2-2.0.53-9.2.i58… > f139e14297b5e62c297bdeeb91a72cfb > > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/apache2-prefork-2.0.53… > f3b91a27ce46603221423ce450f64b91 > > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/apache2-worker-2.0.53-… > 8085487fab1bd301013e4f4268cd5515 > > SUSE Linux 9.2: > > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/apache2-2.0.50-7.4.i58… > 3bcb58b4cfb08896be787bb62328197c > > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/apache2-prefork-2.0.50… > 1e520e3c81f6b7ec84bb4127f9c0ec52 > > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/apache2-worker-2.0.50-… > ff8b691c1d44e33ef43f46f0bd2e9016 > > SUSE Linux 9.1: > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/apache2-2.0.49-27.29.i… > 5bc20e44e197e7b9af2d26984c511950 > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/apache2-devel-2.0.49-2… > ec6a62ab160adebecbf5800fb0bde028 > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/apache2-doc-2.0.49-27.… > dfee5fdccd1fba307a0e580d08920114 > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/apache2-example-pages-… > 6ba6fde3121ce95efed896b55b3616b4 > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/apache2-prefork-2.0.49… > 825ff943742470dcf2deb459094dfc77 > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/apache2-worker-2.0.49-… > cab6bc047c236ca9c19445103bf2b08a > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/libapr0-2.0.49-27.29.i… > df114a68dc94134f1f78266c8a9b4162 > source rpm(s): > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/apache2-2.0.49-27.29.sr… > 64a3415d384bae98734bfb029a0bfd74 > > SUSE Linux 9.0: > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache-1.3.28-79.i586.… > 3ea2571ee8b8f7533cfa19254ce76000 > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-2.0.48-152.i58… > e79c7b6cd99c86101dbae77d66a355b7 > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-devel-2.0.48-1… > 59f010b8e181975da80ea656104f7a1e > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-doc-2.0.48-152… > 65969fcd4b69912398b0ac133995dd6c > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-example-pages-… > 39efd1a9f7bf2693021642ef5d5f8fba > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-leader-2.0.48-… > 1fe7b5b73f73a747d1290bc495432a50 > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-metuxmpm-2.0.4… > da0a791f90e62f5ab3f49a52b7ad037b > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-prefork-2.0.48… > 0fdf9b7ab16b03354ee17b305b6e46a5 > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-worker-2.0.48-… > d1a4d5a06d9ca6b64ee6c7d0fe2ef434 > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/libapr0-2.0.48-152.i58… > 8d2f2b1d0e058fd51fa211adb997815c > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/mod_ssl-2.8.15-79.i586… > 241b06b75109f29623e48355a22e5cc5 > source rpm(s): > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/apache-1.3.28-79.src.rpm > 34ce607ad6ce1cd5ce400540ff0fc5c8 > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/apache2-2.0.48-152.src.… > 5b4e779401060cdef792aec5a83e298d > > SUSE Linux 8.2: > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/apache2-2.0.48-152.i58… > 3a3ce9aaf22ef266e4465dd845540103 > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/apache2-devel-2.0.48-1… > 891f721003c52433a230d88b6a674740 > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/apache2-doc-2.0.48-152… > 9c91e87e0c4305a006c041ab56c5bb4a > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/apache2-example-pages-… > a95d8a3e01285ab512e67ff99544e738 > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/apache2-leader-2.0.48-… > 830692c995bf913b308ef992b122d8d3 > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/apache2-prefork-2.0.48… > c9f022344948a3af810e0f706003b605 > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/apache2-worker-2.0.48-… > 6c23c596575d6dc4e4c5ed8484b96bc5 > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/libapr0-2.0.48-152.i58… > 0a9dcbdfcbf4b862b8b2da9970032ad3 > source rpm(s): > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/apache2-2.0.48-152.src.… > 8ed1800dc6ae23fdde92aeaab8467277 > > x86-64 Platform: > > SUSE Linux 9.3: > > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/apache2-2.0.53-9.2.x… > b0191eba7fbb1bc9f9c154b48f19f41e > > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/apache2-prefork-2.0.… > feec5b490afdbd30249923ccf791e5e1 > > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/apache2-worker-2.0.5… > 418f4b6310bb98177b477a8c2af0fd3e > source rpm(s): > > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/apache2-2.0.53-9.2.src.… > 51cd4351f98f32df47c5d15beeeb055c > > SUSE Linux 9.2: > > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/apache2-2.0.50-7.4.x… > 2a5421e418e43d552a4782d3bc9a2486 > > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/apache2-prefork-2.0.… > 1617072b6ebfe834251e8e6084acf71b > > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/apache2-worker-2.0.5… > a0ee7a530aefc0c902b45ffc5f140758 > source rpm(s): > > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/apache2-2.0.50-7.4.src.… > 038265691d3d304c63301d1900d9c8f5 > > SUSE Linux 9.1: > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/apache2-2.0.49-27.… > 8d5268bb9772648aea84ab6c96f729e5 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/apache2-devel-2.0.… > cd24e073b85c1ad2ae0f4f9ac7f03833 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/apache2-doc-2.0.49… > aa96fe4043dadd434bfdbbcbda5b9e3c > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/apache2-example-pa… > fdef881a458ce47c4ab3852bc03b03c3 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/apache2-prefork-2.… > 4949d1b12846fc5ba998ba828f1d3aa2 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/apache2-worker-2.0… > db46554809bdcdb0d680f950a37d1a67 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/libapr0-2.0.49-27.… > cd742baacc51deb46e77abf44ee7852b > source rpm(s): > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/apache2-2.0.49-27.29.… > 2bf68594e45e71944ae666b9d05f042d > > SUSE Linux 9.0: > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache-1.3.28-79.x… > 383bb73f15037bdf193b43e8356c24e2 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-2.0.48-152… > 5a91de1118c01e36103bed561afaf461 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-devel-2.0.… > 0fe7ab322847c94c8346f259ab666973 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-doc-2.0.48… > e02b174d4b8312c9370d04e531c6cb6f > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-example-pa… > 5cbf2baf68a56df0e95149a209dcc5bb > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-leader-2.0… > 0512d0806364982cb77e300807f0c2ab > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-metuxmpm-2… > 66e024c176e86ae70f9cce5f68bbbb6e > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-prefork-2.… > 42046fedac25e435a87048895ba892a3 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-worker-2.0… > 2cf1c65663e16108cb25300e171a195b > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/libapr0-2.0.48-152… > 87b741b0402f03064de4619dff361086 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/mod_ssl-2.8.15-79.… > 09458018034cfffbc419d816c5dd31ce > source rpm(s): > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/apache-1.3.28-79.src.… > ae182ca0cb6e47559f250feca8c67e2e > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/apache2-2.0.48-152.sr… > e87c50cda40a5c9097bab2e20c1098d6 > > > ______________________________________________________________________________ > > 5) Pending Vulnerabilities, Solutions, and Work-Arounds: > > See SUSE Security Summary Report. > ______________________________________________________________________________ > > 6) Authenticity Verification and Additional Information > > - Announcement authenticity verification: > > SUSE security announcements are published via mailing lists and on Web > sites. The authenticity and integrity of a SUSE security > announcement is > guaranteed by a cryptographic signature in each announcement. All SUSE > security announcements are published with a valid signature. > > To verify the signature of the announcement, save it as text into > a file > and run the command > > gpg --verify <file> > > replacing <file> with the name of the file where you saved the > announcement. The output for a valid signature looks like: > > gpg: Signature made <DATE> using RSA key ID 3D25D3D9 > gpg: Good signature from "SuSE Security Team <security(a)suse.de>" > > where <DATE> is replaced by the date the document was signed. > > If the security team's key is not contained in your key ring, you can > import it from the first installation CD. To import the key, use the > command > > gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc > > - Package authenticity verification: > > SUSE update packages are available on many mirror FTP servers all > over the > world. While this service is considered valuable and important to > the free > and open source software community, the authenticity and the > integrity of > a package needs to be verified to ensure that it has not been tampered > with. > > There are two verification methods that can be used independently from > each other to prove the authenticity of a downloaded file or RPM > package: > > 1) Using the internal gpg signatures of the rpm package > 2) MD5 checksums as provided in this announcement > > 1) The internal rpm package signatures provide an easy way to > verify the > authenticity of an RPM package. Use the command > > rpm -v --checksig <file.rpm> > > to verify the signature of the package, replacing <file.rpm> > with the > filename of the RPM package downloaded. The package is > unmodified if it > contains a valid signature from build(a)suse.de with the key ID > 9C800ACA. > > This key is automatically imported into the RPM database (on > RPMv4-based distributions) and the gpg key ring of 'root' during > installation. You can also find it on the first installation CD > and at > the end of this announcement. > > 2) If you need an alternative means of verification, use the md5sum > command to verify the authenticity of the packages. Execute the > command > > md5sum <filename.rpm> > > after you downloaded the file from a SUSE FTP server or its > mirrors. > Then compare the resulting md5sum with the one that is listed > in the > SUSE security announcement. Because the announcement containing the > checksums is cryptographically signed (by security(a)suse.de) the > checksums show proof of the authenticity of the package if the > signature of the announcement is valid. Note that the md5 sums > published in the SUSE Security Announcements are valid for the > respective packages only. Newer versions of these packages > cannot be > verified. > > - SUSE runs two security mailing lists to which any interested party may > subscribe: > > suse-security(a)suse.com > - General Linux and SUSE security discussion. > All SUSE security announcements are sent to this list. > To subscribe, send an e-mail to > <suse-security-subscribe(a)suse.com>. > > suse-security-announce(a)suse.com > - SUSE's announce-only mailing list. > Only SUSE's security announcements are sent to this list. > To subscribe, send an e-mail to > <suse-security-announce-subscribe(a)suse.com>. > > For general information or the frequently asked questions (FAQ), > send mail to <suse-security-info(a)suse.com> or > <suse-security-faq(a)suse.com>. > > ===================================================================== > SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. > The <security(a)suse.de> public key is listed below. > ===================================================================== > ______________________________________________________________________________ > > The information in this advisory may be distributed or reproduced, > provided that the advisory is not modified in any way. In > particular, the > clear text signature should show proof of the authenticity of the > text. > > SUSE Linux Products GmbH provides no warranties of any kind whatsoever > with respect to the information contained in this security advisory. > > Type Bits/KeyID Date User ID > pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> > pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> > > -----BEGIN PGP PUBLIC KEY BLOCK----- > Version: GnuPG v1.0.6 (GNU/Linux) > Comment: For info see http://www.gnupg.org > > mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff > 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d > M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO > QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK > XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE > D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd > G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM > CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE > myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr > YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD > wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d > NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe > QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe > LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t > XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU > D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 > 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot > 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW > cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E > ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f > AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E > Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ > HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h > t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT > tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM > 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q > 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 > QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw > JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ > 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH > ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 > wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY > EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol > 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK > CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co > SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo > omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt > A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J > /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE > GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf > ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT > ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 > RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ > 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb > B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X > 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA > 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj > qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p > WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL > hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG > BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ > AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi > RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 > zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM > /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 > whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl > D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz > dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI > RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI > DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= > =LRKC > -----END PGP PUBLIC KEY BLOCK----- >

2 1

Root over NFS hangs during shutdow
by Prakash Velayutham 15 Aug '05

15 Aug '05

Hi All, I have a client system boot from a server using "Root over NFS" and PXEBOOT. The entire booting process seems just fine. But if I do a shutdown (or reboot) on the client, for some reason, the root file system gets unmounted during the terminating of the network services and everything else from then on is just frozen. Eventually I get a "INIT: no more process left in this runlevel" error and a lot of error messages before that. Is there someway I can avoid this? How can I see to that the root file system is not unmounted during the system reboot until the very end. Is there a better way of doing this? Any suggestions greatly appreciated. PS: I have tried both with and without the root file system mount line in the client's /etc/fstab file (without any difference in the output). Thanks, Prakash

1 0

L2TP
by Rasp, Robert 15 Aug '05

15 Aug '05

Hello, In the moment I use Strongswan and l2tpd to connect my Windows-Client via VPN. I want to make WLAN secure by using Strongswan and l2tpd for WLAN. The Router / Firewall (Suse 9.0) is connected to the Internet with one NIC (eth2), connected to internal LAN (eth0) and connected to several WLAN-AP with eth1. I want different configurations for the WLAN-VPN and the INET-VPN. Different IP-Subnets and different MTU. If I start l2tpd with "l2tpd -c /etc/l2tpd/wlan.conf" then the first l2tpd stops accepting incoming calls. Is it possible to run two l2tpd on different devices ? ( listen-addr does not help or I use it wrong ) Is it possible to run one l2tpd and have different configurations for different NIC's / IP's ??? Thanks for your Help Robert

1 0

OpenSuSE and security updates?
by Guido Tschakert 09 Aug '05

09 Aug '05

Hello does anybody of the SuSE guys already knows how long there will be security updates for the new distris of opensuse? 2 years as usual, just 1 year :-( or maybe 3 years :-) ( I would prefer only one new dristri every year and a lifetime of 3 years instead of 2 distris/a and just 2 years lifetime. but that' s just my two cents). And another question: who will produce and distribute the security updates (and make the quality assurance)? -- Mit freundlichen Grüßen, Guido Tschakert

3 3

BIOS hangs after update to newest kernel :(
by Philippe Vogel 09 Aug '05

09 Aug '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! I experienced similar problems with the update as I forgot to update one machine. Reboot didn't worked and a cold reboot made the BIOS crash and I had to reset BIOS/depower everything and then reboot the machine again. This is no stable update and wasn't fully tested (kind'a' novel influence on the quality of updates?). If this doesn't change I will switch back to debian (as there is the question to update several servers and I got my scripts for debian as well). Reguards Philippe - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQvjHgkNg1DRVIGjBAQJ92wb/R6gqSD2KgmOmVGVR383yTerJPDUp2e01 7YWFYpX/uxb6eoaPeU1JhmpmxmfV3pa4Kfozc8IssyBGt0a5MccPybwPlrkPU5Rm /bavH/dVtkPdX6nGzEf4tA2vgySwVhmerjW/cqZjZ2eIEeOa0v+5Kmp0YhLX6hY9 U2E8R8+W1XbLoN/TBz+EpwwjTK+wE4elwikA9xW7LWXHPh1pq3gJ/O8PZnPhLEKd vIFqhhW5QCvOwTWseTDKOUjFasCXHtvnU5UhHr3YIX29PITOgCmWH5lmfHFdTRY3 igjyZwa8ckI= =QiDK -----END PGP SIGNATURE-----

1 0

Oopses after SL 9.2 kernel security update
by Jan Ritzerfeld 09 Aug '05

09 Aug '05

Hello, yesterday I have installed the kernel update for SL 9.2 (2.6.8-24.17.i586 SL92_BRANCH-200507190856330000) via YOU. Today (the first reboot) I tried to compile some source and gcc segfaulted. Opera did not start either. Then I noticed the oopses (see end of this mail). rpm segfaulted when I tried to downgrade. Using the rescue system and the recent version of reiserfsck showed no corruption. After downgrading to 2.6.8-24.16 there are no more oopses. Aug 6 13:30:50 linux su: (to nobody) root on none Aug 6 13:30:50 linux su: pam_unix2: session started for user nobody, service su Aug 6 13:30:50 linux su: pam_unix2: session finished for user nobody, service su Aug 6 13:30:50 linux su: (to nobody) root on none Aug 6 13:30:50 linux su: pam_unix2: session started for user nobody, service su Aug 6 13:31:02 linux su: pam_unix2: session finished for user nobody, service su Aug 6 13:31:02 linux su: (to nobody) root on none Aug 6 13:31:02 linux su: pam_unix2: session started for user nobody, service su Aug 6 13:31:02 linux su: pam_unix2: session finished for user nobody, service su Aug 6 13:31:02 linux su: (to nobody) root on none Aug 6 13:31:02 linux su: pam_unix2: session started for user nobody, service su Aug 6 13:32:30 linux kernel: Unable to handle kernel paging request at virtual address 00400000 Aug 6 13:32:30 linux kernel: printing eip: Aug 6 13:32:30 linux kernel: c0165ed6 Aug 6 13:32:30 linux kernel: *pde = 00000000 Aug 6 13:32:30 linux kernel: Oops: 0000 [#1] Aug 6 13:32:30 linux kernel: Modules linked in: nvidia usbserial parport_pc lp parport nvram speedstep_lib freq_table thermal processor fan button battery ac snd_pcm_oss snd_mixer_oss snd_intel8x0 snd_ac97_codec snd_pcm snd_timer snd soundcore snd_page_alloc it87 i2c_sensor i2c_isa i2c_core edd ipt_tos ipt_MARK ipt_length cls_fw sch_htb ipt_TOS ip6t_LOG ip6t_limit ipt_LOG ipt_limit ipt_pkttype af_packet joydev sg st sd_mod sr_mod scsi_mod ip6t_state ip6_conntrack ipt_state ip6t_REJECT ipt_REJECT iptable_mangle iptable_filter ip6table_mangle ip_nat_ftp iptable_nat ip_conntrack_ftp ip_conntrack ip_tables ip6table_filter ip6_tables ipv6 ohci_hcd nvidia_agp agpgart ide_cd cdrom evdev subfs dm_mod 8139too mii usbcore reiserfs Aug 6 13:32:30 linux kernel: CPU: 0 Aug 6 13:32:30 linux kernel: EIP: 0060:[<c0165ed6>] Tainted: P U VLI Aug 6 13:32:30 linux kernel: EFLAGS: 00010206 (2.6.8-24.17-default SL92_BRANCH-200507190856330000) Aug 6 13:32:30 linux kernel: EIP is at __d_lookup+0x76/0xf0 Aug 6 13:32:30 linux kernel: eax: 00400000 ebx: 00400000 ecx: 00000011 edx: c1410200 Aug 6 13:32:30 linux kernel: esi: 839f51ea edi: cc45bec8 ebp: c154611c esp: cc45be6c Aug 6 13:32:30 linux kernel: ds: 007b es: 007b ss: 0068 Aug 6 13:32:31 linux kernel: Process find (pid: 6855, threadinfo=cc45a000 task=de561000) Aug 6 13:32:31 linux kernel: Stack: 839f51ea c3e8632c 00000001 cc45bf1c 00000000 c1457818 d43f3000 00000008 Aug 6 13:32:31 linux kernel: cc45bed0 cc45bed0 cc45bf1c cc45bec8 cc45bed0 c015c6a8 cdec0080 cc45bed0 Aug 6 13:32:31 linux kernel: 839f51ea c3e8ed18 d43f3008 c015cdc9 cc45bf00 00000000 cc45bf1c cc45a000 Aug 6 13:32:31 linux kernel: Call Trace: Aug 6 13:32:31 linux kernel: [<c015c6a8>] do_lookup+0x18/0x70 Aug 6 13:32:31 linux kernel: [<c015cdc9>] link_path_walk+0x6c9/0xca0 Aug 6 13:32:31 linux kernel: [<c015d5b3>] path_lookup+0x73/0x150 Aug 6 13:32:31 linux kernel: [<c015d7e1>] __user_walk+0x21/0x60 Aug 6 13:32:31 linux kernel: [<c0158df1>] vfs_lstat+0x11/0x40 Aug 6 13:32:31 linux kernel: [<c015948f>] sys_lstat64+0xf/0x30 Aug 6 13:32:31 linux kernel: [<c01441ed>] do_no_page+0x9d/0x270 Aug 6 13:32:31 linux kernel: [<c0150753>] filp_close+0x43/0x70 Aug 6 13:32:31 linux kernel: [<c0105c69>] sysenter_past_esp+0x52/0x79 Aug 6 13:32:31 linux kernel: Code: c0 21 d0 8b 15 6c ab 43 c0 c7 44 24 10 00 00 00 00 8d 04 82 89 44 24 14 8b 18 85 db 75 0d eb 69 90 8d 74 26 00 8b 1b 85 db 74 5e <8b> 03 0f 18 00 90 8d 6b a4 8b 34 24 39 75 14 75 e9 8b 7c 24 04 Aug 6 13:32:30 linux su: pam_unix2: session finished for user nobody, service su Aug 6 13:39:30 linux kernel: <1>Unable to handle kernel paging request at virtual address 00400000 Aug 6 13:39:30 linux kernel: printing eip: Aug 6 13:39:30 linux kernel: c0165ed6 Aug 6 13:39:30 linux kernel: *pde = 00000000 Aug 6 13:39:30 linux kernel: Oops: 0000 [#2] Aug 6 13:39:30 linux kernel: Modules linked in: nvidia usbserial parport_pc lp parport nvram speedstep_lib freq_table thermal processor fan button battery ac snd_pcm_oss snd_mixer_oss snd_intel8x0 snd_ac97_codec snd_pcm snd_timer snd soundcore snd_page_alloc it87 i2c_sensor i2c_isa i2c_core edd ipt_tos ipt_MARK ipt_length cls_fw sch_htb ipt_TOS ip6t_LOG ip6t_limit ipt_LOG ipt_limit ipt_pkttype af_packet joydev sg st sd_mod sr_mod scsi_mod ip6t_state ip6_conntrack ipt_state ip6t_REJECT ipt_REJECT iptable_mangle iptable_filter ip6table_mangle ip_nat_ftp iptable_nat ip_conntrack_ftp ip_conntrack ip_tables ip6table_filter ip6_tables ipv6 ohci_hcd nvidia_agp agpgart ide_cd cdrom evdev subfs dm_mod 8139too mii usbcore reiserfs Aug 6 13:39:30 linux kernel: CPU: 0 Aug 6 13:39:30 linux kernel: EIP: 0060:[<c0165ed6>] Tainted: P U VLI Aug 6 13:39:30 linux kernel: EFLAGS: 00210206 (2.6.8-24.17-default SL92_BRANCH-200507190856330000) Aug 6 13:39:30 linux kernel: EIP is at __d_lookup+0x76/0xf0 Aug 6 13:39:30 linux kernel: eax: 00400000 ebx: 00400000 ecx: 00000011 edx: c1410200 Aug 6 13:39:30 linux kernel: esi: d21c440d edi: d5e3def8 ebp: c154611c esp: d5e3de9c Aug 6 13:39:30 linux kernel: ds: 007b es: 007b ss: 0068 Aug 6 13:39:31 linux kernel: Process cc1plus (pid: 27981, threadinfo=d5e3c000 task=d8a66aa0) Aug 6 13:39:31 linux kernel: Stack: d21c440d d24cdd70 fffffff4 c283b8e0 00000000 c1457818 d792300d 0000000e Aug 6 13:39:31 linux kernel: d5e3df00 d5e3df00 d5e3df68 d5e3def8 d5e3df00 c015c6a8 cdec0080 d5e3df00 Aug 6 13:39:31 linux kernel: d21c440d d2bb8290 d792301b c015cdc9 dd8e9a50 00000101 d5e3df68 cdec0080 Aug 6 13:39:31 linux kernel: Call Trace: Aug 6 13:39:31 linux kernel: [<c015c6a8>] do_lookup+0x18/0x70 Aug 6 13:39:31 linux kernel: [<c015cdc9>] link_path_walk+0x6c9/0xca0 Aug 6 13:39:31 linux kernel: [<c015d5b3>] path_lookup+0x73/0x150 Aug 6 13:39:31 linux kernel: [<c015dd15>] open_namei+0x85/0x5e0 Aug 6 13:39:31 linux kernel: [<c0145c20>] __do_mmap_pgoff+0x410/0x700 Aug 6 13:39:31 linux kernel: [<c01503a4>] filp_open+0x24/0x50 Aug 6 13:39:31 linux kernel: [<c01506a1>] sys_open+0x31/0x80 Aug 6 13:39:31 linux kernel: [<c0105c69>] sysenter_past_esp+0x52/0x79 Aug 6 13:39:31 linux kernel: Code: c0 21 d0 8b 15 6c ab 43 c0 c7 44 24 10 00 00 00 00 8d 04 82 89 44 24 14 8b 18 85 db 75 0d eb 69 90 8d 74 26 00 8b 1b 85 db 74 5e <8b> 03 0f 18 00 90 8d 6b a4 8b 34 24 39 75 14 75 e9 8b 7c 24 04 Aug 6 13:46:09 linux kernel: <1>Unable to handle kernel paging request at virtual address 00400000 Aug 6 13:46:09 linux kernel: printing eip: Aug 6 13:46:09 linux kernel: c0165ed6 Aug 6 13:46:09 linux kernel: *pde = 00000000 Aug 6 13:46:09 linux kernel: Oops: 0000 [#3] Aug 6 13:46:09 linux kernel: Modules linked in: nvidia usbserial parport_pc lp parport nvram speedstep_lib freq_table thermal processor fan button battery ac snd_pcm_oss snd_mixer_oss snd_intel8x0 snd_ac97_codec snd_pcm snd_timer snd soundcore snd_page_alloc it87 i2c_sensor i2c_isa i2c_core edd ipt_tos ipt_MARK ipt_length cls_fw sch_htb ipt_TOS ip6t_LOG ip6t_limit ipt_LOG ipt_limit ipt_pkttype af_packet joydev sg st sd_mod sr_mod scsi_mod ip6t_state ip6_conntrack ipt_state ip6t_REJECT ipt_REJECT iptable_mangle iptable_filter ip6table_mangle ip_nat_ftp iptable_nat ip_conntrack_ftp ip_conntrack ip_tables ip6table_filter ip6_tables ipv6 ohci_hcd nvidia_agp agpgart ide_cd cdrom evdev subfs dm_mod 8139too mii usbcore reiserfs Aug 6 13:46:09 linux kernel: CPU: 0 Aug 6 13:46:09 linux kernel: EIP: 0060:[<c0165ed6>] Tainted: P U VLI Aug 6 13:46:09 linux kernel: EFLAGS: 00210206 (2.6.8-24.17-default SL92_BRANCH-200507190856330000) Aug 6 13:46:09 linux kernel: EIP is at __d_lookup+0x76/0xf0 Aug 6 13:46:09 linux kernel: eax: 00400000 ebx: 00400000 ecx: 00000011 edx: c1410200 Aug 6 13:46:09 linux kernel: esi: d21c440d edi: d85abef8 ebp: c154611c esp: d85abe9c Aug 6 13:46:09 linux kernel: ds: 007b es: 007b ss: 0068 Aug 6 13:46:09 linux kernel: Process cc1plus (pid: 28087, threadinfo=d85aa000 task=d335baa0) Aug 6 13:46:10 linux kernel: Stack: d21c440d d24cdd70 00000000 c7344bc0 00000000 c1457818 d92d700d 0000000e Aug 6 13:46:10 linux kernel: d85abf00 d85abf00 d85abf68 d85abef8 d85abf00 c015c6a8 cdec0080 d85abf00 Aug 6 13:46:10 linux kernel: d21c440d d2bb8290 d92d701b c015cdc9 c1fa6f3c 00000101 d85abf68 cdec0080 Aug 6 13:46:10 linux kernel: Call Trace: Aug 6 13:46:10 linux kernel: [<c015c6a8>] do_lookup+0x18/0x70 Aug 6 13:46:10 linux kernel: [<c015cdc9>] link_path_walk+0x6c9/0xca0 Aug 6 13:46:10 linux kernel: [<c015d5b3>] path_lookup+0x73/0x150 Aug 6 13:46:10 linux kernel: [<c015dd15>] open_namei+0x85/0x5e0 Aug 6 13:46:10 linux kernel: [<c01503a4>] filp_open+0x24/0x50 Aug 6 13:46:10 linux kernel: [<c01506a1>] sys_open+0x31/0x80 Aug 6 13:46:10 linux kernel: [<c0105c69>] sysenter_past_esp+0x52/0x79 Aug 6 13:46:10 linux kernel: Code: c0 21 d0 8b 15 6c ab 43 c0 c7 44 24 10 00 00 00 00 8d 04 82 89 44 24 14 8b 18 85 db 75 0d eb 69 90 8d 74 26 00 8b 1b 85 db 74 5e <8b> 03 0f 18 00 90 8d 6b a4 8b 34 24 39 75 14 75 e9 8b 7c 24 04 Aug 6 13:50:59 linux kernel: <1>Unable to handle kernel paging request at virtual address 00400000 Aug 6 13:50:59 linux kernel: printing eip: Aug 6 13:50:59 linux kernel: c0165ed6 Aug 6 13:50:59 linux kernel: *pde = 00000000 Aug 6 13:50:59 linux kernel: Oops: 0000 [#4] Aug 6 13:50:59 linux kernel: Modules linked in: nvidia usbserial parport_pc lp parport nvram speedstep_lib freq_table thermal processor fan button battery ac snd_pcm_oss snd_mixer_oss snd_intel8x0 snd_ac97_codec snd_pcm snd_timer snd soundcore snd_page_alloc it87 i2c_sensor i2c_isa i2c_core edd ipt_tos ipt_MARK ipt_length cls_fw sch_htb ipt_TOS ip6t_LOG ip6t_limit ipt_LOG ipt_limit ipt_pkttype af_packet joydev sg st sd_mod sr_mod scsi_mod ip6t_state ip6_conntrack ipt_state ip6t_REJECT ipt_REJECT iptable_mangle iptable_filter ip6table_mangle ip_nat_ftp iptable_nat ip_conntrack_ftp ip_conntrack ip_tables ip6table_filter ip6_tables ipv6 ohci_hcd nvidia_agp agpgart ide_cd cdrom evdev subfs dm_mod 8139too mii usbcore reiserfs Aug 6 13:50:59 linux kernel: CPU: 0 Aug 6 13:50:59 linux kernel: EIP: 0060:[<c0165ed6>] Tainted: P U VLI Aug 6 13:50:59 linux kernel: EFLAGS: 00210206 (2.6.8-24.17-default SL92_BRANCH-200507190856330000) Aug 6 13:50:59 linux kernel: EIP is at __d_lookup+0x76/0xf0 Aug 6 13:50:59 linux kernel: eax: 00400000 ebx: 00400000 ecx: 00000011 edx: c1410200 Aug 6 13:50:59 linux kernel: esi: d21c440d edi: d3343ef8 ebp: c154611c esp: d3343e9c Aug 6 13:50:59 linux kernel: ds: 007b es: 007b ss: 0068 Aug 6 13:50:59 linux kernel: Process cc1plus (pid: 31360, threadinfo=d3342000 task=d4ae1000) Aug 6 13:50:59 linux kernel: Stack: d21c440d d24cdd70 00000000 c7344bc0 00000000 c1457818 c172700d 0000000e Aug 6 13:50:59 linux kernel: d3343f00 d3343f00 d3343f68 d3343ef8 d3343f00 c015c6a8 cdec0080 d3343f00 Aug 6 13:50:59 linux kernel: d21c440d d2bb8290 c172701b c015cdc9 d2e678ac 00000101 d3343f68 cdec0080 Aug 6 13:50:59 linux kernel: Call Trace: Aug 6 13:50:59 linux kernel: [<c015c6a8>] do_lookup+0x18/0x70 Aug 6 13:50:59 linux kernel: [<c015cdc9>] link_path_walk+0x6c9/0xca0 Aug 6 13:50:59 linux kernel: [<c015d5b3>] path_lookup+0x73/0x150 Aug 6 13:50:59 linux kernel: [<c015dd15>] open_namei+0x85/0x5e0 Aug 6 13:50:59 linux kernel: [<c0145c20>] __do_mmap_pgoff+0x410/0x700 Aug 6 13:50:59 linux kernel: [<c01503a4>] filp_open+0x24/0x50 Aug 6 13:50:59 linux kernel: [<c01506a1>] sys_open+0x31/0x80 Aug 6 13:50:59 linux kernel: [<c0105c69>] sysenter_past_esp+0x52/0x79 Aug 6 13:50:59 linux kernel: Code: c0 21 d0 8b 15 6c ab 43 c0 c7 44 24 10 00 00 00 00 8d 04 82 89 44 24 14 8b 18 85 db 75 0d eb 69 90 8d 74 26 00 8b 1b 85 db 74 5e <8b> 03 0f 18 00 90 8d 6b a4 8b 34 24 39 75 14 75 e9 8b 7c 24 04 Aug 6 13:59:01 linux /usr/sbin/cron[31373]: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly) Aug 6 14:23:15 linux kernel: Unable to handle kernel paging request at virtual address 00400000 Aug 6 14:23:15 linux kernel: printing eip: Aug 6 14:23:15 linux kernel: c0165ed6 Aug 6 14:23:15 linux kernel: *pde = 00000000 Aug 6 14:23:15 linux kernel: Oops: 0000 [#5] Aug 6 14:23:15 linux kernel: Modules linked in: nvidia usbserial parport_pc lp parport nvram speedstep_lib freq_table thermal processor fan button battery ac snd_pcm_oss snd_mixer_oss snd_intel8x0 snd_ac97_codec snd_pcm snd_timer snd soundcore snd_page_alloc it87 i2c_sensor i2c_isa i2c_core edd ipt_tos ipt_MARK ipt_length cls_fw sch_htb ipt_TOS ip6t_LOG ip6t_limit ipt_LOG ipt_limit ipt_pkttype af_packet joydev sg st sd_mod sr_mod scsi_mod ip6t_state ip6_conntrack ipt_state ip6t_REJECT ipt_REJECT iptable_mangle iptable_filter ip6table_mangle ip_nat_ftp iptable_nat ip_conntrack_ftp ip_conntrack ip_tables ip6table_filter ip6_tables ipv6 ohci_hcd nvidia_agp agpgart ide_cd cdrom evdev subfs dm_mod 8139too mii usbcore reiserfs Aug 6 14:23:15 linux kernel: CPU: 0 Aug 6 14:23:15 linux kernel: EIP: 0060:[<c0165ed6>] Tainted: P U VLI Aug 6 14:23:15 linux kernel: EFLAGS: 00210206 (2.6.8-24.17-default SL92_BRANCH-200507190856330000) Aug 6 14:23:15 linux kernel: EIP is at __d_lookup+0x76/0xf0 Aug 6 14:23:15 linux kernel: eax: 00400000 ebx: 00400000 ecx: 00000011 edx: c1410200 Aug 6 14:23:15 linux kernel: esi: a682767b edi: c6e7def8 ebp: c154611c esp: c6e7de9c Aug 6 14:23:15 linux kernel: ds: 007b es: 007b ss: 0068 Aug 6 14:23:15 linux kernel: Process opera (pid: 1990, threadinfo=c6e7c000 task=dbb2d000) Aug 6 14:23:15 linux kernel: Stack: a682767b c87247f8 00000001 c6e7df68 00000000 c1457818 de223018 0000000c Aug 6 14:23:15 linux kernel: c6e7df00 c6e7df00 c6e7df68 c6e7def8 c6e7df00 c015c6a8 cdec0080 c6e7df00 Aug 6 14:23:15 linux kernel: a682767b cb6bfb40 de223024 c015cdc9 c0142be1 00000101 c6e7df68 cdec0080 Aug 6 14:23:15 linux kernel: Call Trace: Aug 6 14:23:15 linux kernel: [<c015c6a8>] do_lookup+0x18/0x70 Aug 6 14:23:15 linux kernel: [<c015cdc9>] link_path_walk+0x6c9/0xca0 Aug 6 14:23:15 linux kernel: [<c0142be1>] zap_pmd_range+0x41/0x60 Aug 6 14:23:15 linux kernel: [<c015d5b3>] path_lookup+0x73/0x150 Aug 6 14:23:15 linux kernel: [<c015dd15>] open_namei+0x85/0x5e0 Aug 6 14:23:15 linux kernel: [<c01503a4>] filp_open+0x24/0x50 Aug 6 14:23:15 linux kernel: [<c0146622>] unmap_region+0x82/0xd0 Aug 6 14:23:15 linux kernel: [<c01506a1>] sys_open+0x31/0x80 Aug 6 14:23:15 linux kernel: [<c0105c69>] sysenter_past_esp+0x52/0x79 Aug 6 14:23:15 linux kernel: Code: c0 21 d0 8b 15 6c ab 43 c0 c7 44 24 10 00 00 00 00 8d 04 82 89 44 24 14 8b 18 85 db 75 0d eb 69 90 8d 74 26 00 8b 1b 85 db 74 5e <8b> 03 0f 18 00 90 8d 6b a4 8b 34 24 39 75 14 75 e9 8b 7c 24 04 Aug 6 14:25:04 linux su: (to root) jan on /dev/pts/2 Aug 6 14:25:04 linux su: pam_unix2: session started for user root, service su Aug 6 14:36:40 linux kernel: Unable to handle kernel paging request at virtual address 00400000 Aug 6 14:36:40 linux kernel: printing eip: Aug 6 14:36:40 linux kernel: c0165ed6 Aug 6 14:36:40 linux kernel: *pde = 00000000 Aug 6 14:36:40 linux kernel: Oops: 0000 [#6] Aug 6 14:36:40 linux kernel: Modules linked in: nvidia usbserial parport_pc lp parport nvram speedstep_lib freq_table thermal processor fan button battery ac snd_pcm_oss snd_mixer_oss snd_intel8x0 snd_ac97_codec snd_pcm snd_timer snd soundcore snd_page_alloc it87 i2c_sensor i2c_isa i2c_core edd ipt_tos ipt_MARK ipt_length cls_fw sch_htb ipt_TOS ip6t_LOG ip6t_limit ipt_LOG ipt_limit ipt_pkttype af_packet joydev sg st sd_mod sr_mod scsi_mod ip6t_state ip6_conntrack ipt_state ip6t_REJECT ipt_REJECT iptable_mangle iptable_filter ip6table_mangle ip_nat_ftp iptable_nat ip_conntrack_ftp ip_conntrack ip_tables ip6table_filter ip6_tables ipv6 ohci_hcd nvidia_agp agpgart ide_cd cdrom evdev subfs dm_mod 8139too mii usbcore reiserfs Aug 6 14:36:40 linux kernel: CPU: 0 Aug 6 14:36:40 linux kernel: EIP: 0060:[<c0165ed6>] Tainted: P U VLI Aug 6 14:36:40 linux kernel: EFLAGS: 00210206 (2.6.8-24.17-default SL92_BRANCH-200507190856330000) Aug 6 14:36:40 linux kernel: EIP is at __d_lookup+0x76/0xf0 Aug 6 14:36:40 linux kernel: eax: 00400000 ebx: 00400000 ecx: 00000011 edx: c1410200 Aug 6 14:36:40 linux kernel: esi: 839f51ea edi: cb8b5ec8 ebp: c154611c esp: cb8b5e6c Aug 6 14:36:40 linux kernel: ds: 007b es: 007b ss: 0068 Aug 6 14:36:40 linux kernel: Process rpm (pid: 2432, threadinfo=cb8b4000 task=debbc000) Aug 6 14:36:40 linux kernel: Stack: 839f51ea c3e8632c fffffff4 e0d42fc0 00000000 c1457818 ddc7901e 00000008 Aug 6 14:36:40 linux kernel: cb8b5ed0 cb8b5ed0 cb8b5f1c cb8b5ec8 cb8b5ed0 c015c6a8 cdec0080 cb8b5ed0 Aug 6 14:36:40 linux kernel: 839f51ea c3e8ed18 ddc79026 c015cdc9 c1e862e0 00000001 cb8b5f1c cdec0080 Aug 6 14:36:40 linux kernel: Call Trace: Aug 6 14:36:40 linux kernel: [<e0d42fc0>] xattr_lookup_poison+0x0/0x90 [reiserfs] Aug 6 14:36:40 linux kernel: [<c015c6a8>] do_lookup+0x18/0x70 Aug 6 14:36:40 linux kernel: [<c015cdc9>] link_path_walk+0x6c9/0xca0 Aug 6 14:36:40 linux kernel: [<c015d5b3>] path_lookup+0x73/0x150 Aug 6 14:36:40 linux kernel: [<c015d7e1>] __user_walk+0x21/0x60 Aug 6 14:36:40 linux kernel: [<c0158da4>] vfs_stat+0x14/0x50 Aug 6 14:36:40 linux kernel: [<c015945f>] sys_stat64+0xf/0x30 Aug 6 14:36:40 linux kernel: [<c0117810>] do_page_fault+0x0/0x5bf Aug 6 14:36:40 linux kernel: [<c0106d9d>] error_code+0x2d/0x40 Aug 6 14:36:40 linux kernel: [<c0105c69>] sysenter_past_esp+0x52/0x79 Aug 6 14:36:40 linux kernel: Code: c0 21 d0 8b 15 6c ab 43 c0 c7 44 24 10 00 00 00 00 8d 04 82 89 44 24 14 8b 18 85 db 75 0d eb 69 90 8d 74 26 00 8b 1b 85 db 74 5e <8b> 03 0f 18 00 90 8d 6b a4 8b 34 24 39 75 14 75 e9 8b 7c 24 04 Gruß, Jan -- Hindsight is an exact science.

7 9

Re: [suse-security] ECN?
by David J N Begley 08 Aug '05

08 Aug '05

On Sun, 7 Aug 2005 John Andersen wrote: > On Sunday 07 August 2005 06:38 am, David J N Begley wrote: > > Dumb question time. Does anyone know the rationale behind SuSEfirewall2's > > disabling of ECN (Explicit Congestion Notification, IETF RFC 3168)? > ECN's implementation is spotty at best. > http://urchin.earth.li/ecn/ > And the hall of shame of non-confirming sites: > http://urchin.earth.li/cgi-bin/ecn.pl Yes, this is an issue of compatibility - that's why the DISABLE_ECN variable exists in /etc/sysconfig/sysctl (and defaults to "yes"); however, SuSEfirewall2 disables ECN regardless of the DISABLE_ECN variable - hence my question (my limited testing so far on our internal network hasn't had any problems with ECN crossing Linux, Solaris, various Cisco equipment and two vendors' firewall equipment). I am aware of some potential weaknesses, documented in a number of places including here: "ECN is fine - but will it be used?" http://republika.pl/maom_onet/papers/ecn/378-444.pdf As the author writes, "while one should realize possible threats, they are not a reason to reject ECN and all the advantages it gives". There are also attempts to strengthen ECN including IETF RFC 3540, "Robust Explicit Congestion Notification (ECN) Signaling [sic] with Nonces". So to expand on my original question, is there some specific security concern surrounding ECN that has led to SuSEfirewall2 turning the feature off in all instances rather than honouring the DISABLE_ECN variable? Thanks..

1 0

RE : [suse-security] Virtual IP
by "Dubé, Michel" 08 Aug '05

08 Aug '05

Thank's, it's working now. Michel. -----Message d'origine----- De : Vaclav Brunnhofer [mailto:vbru@entu.cas.cz] Envoyé : 8 août 2005 07:27 À : "Dubé, Michel" Objet : Re: [suse-security] Virtual IP Dubé, Michel napsal(a): > > eth0:0 Link encap:Ethernet HWaddr 00:09:6B:BA:28:A0 > inet addr:192.168.1.100 Bcast:192.168.1.255 Mask:255.255.255.0 > UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 > Metric:1 > > Here is the file: > BOOTPROTO='dhcp' This is the clue! You have to change this to BOOTPROTO='static' > MTU='' > REMOTE_IPADDR='' > STARTMODE='onboot' > UNIQUE='oxTw.JIMl2CweY+3' > > IPADDR_0='192.168.1.100' > NETMASK_0='255.255.255.0' > BROADCAST_0='192.168.1.255' > NETWORK_0='192.168.1.0' > > > >>ifconfig show: > > > eth0 Link encap:Ethernet HWaddr 00:09:6B:BA:28:A0 > inet addr:XXX.XX.XX.135 Bcast:XXX.XX.XX.255 Mask:255.255.255.0 > inet6 addr: fe80::209:6bff:feba:28a0/64 Scope:Link > UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1 > RX packets:37863 errors:0 dropped:0 overruns:0 frame:0 > TX packets:3318 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:1000 > RX bytes:2821465 (2.6 Mb) TX bytes:343335 (335.2 Kb) > > lo Link encap:Local Loopback > inet addr:127.0.0.1 Mask:255.0.0.0 > inet6 addr: ::1/128 Scope:Host > UP LOOPBACK RUNNING MTU:16436 Metric:1 > RX packets:42 errors:0 dropped:0 overruns:0 frame:0 > TX packets:42 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:0 > RX bytes:2896 (2.8 Kb) TX bytes:2896 (2.8 Kb) > > If I do the command manually ( >ifconfig eth0:0 192.168.1.100 netmask > 255.255.255.0 broadcast 192.168.1.255), it's working fine until I > reboot. I try to find the way to have it at boot time via the file > ifcfg-eth-id-00:09:6b:ba:28:a0. It's suppose to work according to the > documentation, so what's missing. > > Thank's, > > Michel. > -- Vaclav Brunnhofer ENTU AV CR Branisovska 31 37005 Ceske Budejovice Czech Republic tel.: +420387775251 mob.: +420606632822 fax : +420355310354

1 0

RE: [suse-security] nobody
by Jose_Thomas＠Dell.com 08 Aug '05

08 Aug '05

Preetam, Yes, to offer system accounts open outside is a security risk. Normally sysadmins solve this by setting the login shells to /dev/null. Jose -----Original Message----- From: Preetam Ramakrishna [mailto:rpreetam@novell.com] Sent: Monday, August 08, 2005 12:35 PM To: Thomas, Jose - Authorized Dell Representative; suse-security(a)suse.com Subject: RE: [suse-security] nobody Jose, Thanks for the information. I understand the need for system accounts. But, I thought giving a shell to such accounts could be a security risk. Thanks, Preetam >>> <Jose_Thomas(a)Dell.com> 8/8/2005 10:09:18 AM >>> Preetham, These system accounts (daemon, nobody, lp, bin, uucp etc.) are using to execute system functions that require special privilages. For eg. to access certain files or directories, but that does not require root privilages. These special users are associated with particular system functions rather than indvidual users. Different flavours have slightly different kind of implementation. To understand why these special accounts are in use, we can consider the example of uucp (Unix to Unix CoPy) program. Except for legacy networks, uucp is not a widely use mail transmission mechanism now. UUCP is use for transfering files and mails between unix systems connected by telephone lines. When one computer dials another it must first log in instead of logging in as root, the remote compter log in as uucp. The mails (or files) that is awaiting transmission to the remote machine is stored in directories that are readable only by uucp user. nobody - nfs anonymous access user; nobody4 - nfs4 anonymous access user; uucp - uucp admin; daemon - use for network utilities; bin, sys - for system files; lp - for line printer (or laser printer :-)) etc. However I think some are maintain as it is due to historical reasons to keep the legacy systems interact well with more recent Linux systems. HTH Jose -----Original Message----- From: Preetam Ramakrishna [mailto:rpreetam@novell.com] Sent: Friday, August 05, 2005 9:47 AM To: suse-security(a)suse.com Subject: [suse-security] nobody Hi, The system accounts like nobody, daemon, lp, etc on SUSE have a shell in the /etc/password file. Why is this required. These system accounts do not have a shell on other unix / linux systems. Thanks, Preetam -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

4 4

Mozilla update availability -- SuSE 9.3
by Darryl Gregorash 08 Aug '05

08 Aug '05

I notice that Mozilla 1.7.11 is available on the ftp site, in /pub/projects/mozilla... Given that as many as 16 vulnerabilities still exist that were not fixed until Mozilla 1.7.9/1.7.10 (notably the frame-injection spoof that was recently re-introduced), is it advised to download and install 1.7.11, or will the pending security update for 1.7.5 be available soon?

2 1

RE: [suse-security] nobody
by Jose_Thomas＠Dell.com 08 Aug '05

08 Aug '05

Preetham, These system accounts (daemon, nobody, lp, bin, uucp etc.) are using to execute system functions that require special privilages. For eg. to access certain files or directories, but that does not require root privilages. These special users are associated with particular system functions rather than indvidual users. Different flavours have slightly different kind of implementation. To understand why these special accounts are in use, we can consider the example of uucp (Unix to Unix CoPy) program. Except for legacy networks, uucp is not a widely use mail transmission mechanism now. UUCP is use for transfering files and mails between unix systems connected by telephone lines. When one computer dials another it must first log in instead of logging in as root, the remote compter log in as uucp. The mails (or files) that is awaiting transmission to the remote machine is stored in directories that are readable only by uucp user. nobody - nfs anonymous access user; nobody4 - nfs4 anonymous access user; uucp - uucp admin; daemon - use for network utilities; bin, sys - for system files; lp - for line printer (or laser printer :-)) etc. However I think some are maintain as it is due to historical reasons to keep the legacy systems interact well with more recent Linux systems. HTH Jose -----Original Message----- From: Preetam Ramakrishna [mailto:rpreetam@novell.com] Sent: Friday, August 05, 2005 9:47 AM To: suse-security(a)suse.com Subject: [suse-security] nobody Hi, The system accounts like nobody, daemon, lp, etc on SUSE have a shell in the /etc/password file. Why is this required. These system accounts do not have a shell on other unix / linux systems. Thanks, Preetam -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

ECN?
by David J N Begley 08 Aug '05

08 Aug '05

Dumb question time. Does anyone know the rationale behind SuSEfirewall2's disabling of ECN (Explicit Congestion Notification, IETF RFC 3168)? This is done at line 1200 (in the set_proc_stuff function) as shown below: id@host:~> uname -srm ; cat /etc/SuSE-release ; rpm -q SuSEfirewall2 Linux 2.6.8-24.16-default i686 SuSE Linux 9.2 (i586) VERSION = 9.2 SuSEfirewall2-3.2-14.4 id@host:~> fgrep -n tcp_ecn /sbin/SuSEfirewall2 1200: setproc 0 /proc/sys/net/ipv4/tcp_ecn Thanks..

2 1

Re: [suse-security] RE : [suse-security] Virtual IP
by Arjen de Korte 07 Aug '05

07 Aug '05

> Sorry, I missed part of your configuration at first. > The problem is that you cannot add static alias to a DHCP assigned > primary address. Yes you can. I do this all the time for DHCP clients that use a xDSL modem in bridge configuration to be able to reach the modem configuration pages. This can be done very neatly by switching from the default 'dhcpcd' to 'dhclient'. I find the latter much more versatile in cases where you want to override or append some DHCP configuration options. If memory serves, even the /etc/dhclient.conf as shipped by SuSE also lists this possibility. See the 'alias' command for 'dhclient.conf'. Arjen

1 0

MLDonkey in compartment => no name-resolution for BitTorrent
by David Huecking 06 Aug '05

06 Aug '05

Hi! I'm running MLDonkey with compartment (http://www.suse.de/~marc/SuSE.html) and I'd like to use BitTorrent... The problem is that mlnet can't look up the IP of the Tracker for the torrent-file. e.g. when I try to get Knoppix with KNOPPIX_V3.9-2005-05-27-DE.torrent I get error-messages Error: torrent.unix-ag.uni-kl.de: address not found in the log. mlnet itself is a static binary, so it won't use libs for name-resolution I think. I start mlnet with a start-script which executes: /usr/sbin/compartment --chroot $CHROOT_PATH --user $MLDONKEY_USER --group $MLDONKEY_GROUP --fork "$MLDONKEY" 2>&1 >> $CHROOT_PATH/$MLDONKEY_LOG Anyone an idea what I could do to solve this? -- Eat, sleep and go running, David Hücking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216

2 3

RE : [suse-security] Virtual IP
by "Dubé, Michel" 06 Aug '05

06 Aug '05

I add the line "LABEL_0='eth0:0'" and It's still the same. «ifconfig» and «ip addr show» doesn't show eth0:0 The ping of 192.168.1.100 doesn't answer. Do you have more suggestion ? Michel. -----Message d'origine----- De : Kastus [mailto:NOSPAM@tprfct.net] Envoyé : 5 août 2005 19:12 À : suse-security(a)suse.com Objet : Re: [suse-security] Virtual IP On Fri, Aug 05, 2005 at 02:38:12PM -0400, "Dubé, Michel" wrote: > I'm a bit off topic, but I'm sure someone know the answer. Yes, it's off-topic for security list. > > I am using SuSE 9.1, I modify manually the file > /etc/sysconfig/network/ifcfg-eth-id-00:09:6b:ba:28:a0 to add this > config: > > eth0:0 Link encap:Ethernet HWaddr 00:09:6B:BA:28:A0 > inet addr:192.168.1.100 Bcast:192.168.1.255 Mask:255.255.255.0 > UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 > Metric:1 > > Here is the file: > BOOTPROTO='dhcp' > MTU='' > REMOTE_IPADDR='' > STARTMODE='onboot' > UNIQUE='oxTw.JIMl2CweY+3' > > IPADDR_0='192.168.1.100' > NETMASK_0='255.255.255.0' > BROADCAST_0='192.168.1.255' > NETWORK_0='192.168.1.0' You need to add line "LABEL_0='eth0:0'" if you want to see your interface in ifconfig command. > > > >ifconfig show: > > eth0 Link encap:Ethernet HWaddr 00:09:6B:BA:28:A0 > inet addr:XXX.XX.XX.135 Bcast:XXX.XX.XX.255 Mask:255.255.255.0 > inet6 addr: fe80::209:6bff:feba:28a0/64 Scope:Link > UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1 > RX packets:37863 errors:0 dropped:0 overruns:0 frame:0 > TX packets:3318 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:1000 > RX bytes:2821465 (2.6 Mb) TX bytes:343335 (335.2 Kb) > > lo Link encap:Local Loopback > inet addr:127.0.0.1 Mask:255.0.0.0 > inet6 addr: ::1/128 Scope:Host > UP LOOPBACK RUNNING MTU:16436 Metric:1 > RX packets:42 errors:0 dropped:0 overruns:0 frame:0 > TX packets:42 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:0 > RX bytes:2896 (2.8 Kb) TX bytes:2896 (2.8 Kb) Absolutely correct. To see your alias use "ip addr show" command > > If I do the command manually ( >ifconfig eth0:0 192.168.1.100 netmask > 255.255.255.0 broadcast 192.168.1.255), it's working fine until I > reboot. I try to find the way to have it at boot time via the file > ifcfg-eth-id-00:09:6b:ba:28:a0. It's suppose to work according to the > documentation, so what's missing. ifcfg(5): LABEL[suffix] Each address may be tagged with a label string. For details see manpage of ip SUSE uses ip command to configure interfaces, not ifconfig. > > Thank's, You are welcome. > > Michel. -Kastus -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Virtual IP
by "Dubé, Michel" 05 Aug '05

05 Aug '05

I'm a bit off topic, but I'm sure someone know the answer. I am using SuSE 9.1, I modify manually the file /etc/sysconfig/network/ifcfg-eth-id-00:09:6b:ba:28:a0 to add this config: eth0:0 Link encap:Ethernet HWaddr 00:09:6B:BA:28:A0 inet addr:192.168.1.100 Bcast:192.168.1.255 Mask:255.255.255.0 UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1 Here is the file: BOOTPROTO='dhcp' MTU='' REMOTE_IPADDR='' STARTMODE='onboot' UNIQUE='oxTw.JIMl2CweY+3' IPADDR_0='192.168.1.100' NETMASK_0='255.255.255.0' BROADCAST_0='192.168.1.255' NETWORK_0='192.168.1.0' >ifconfig show: eth0 Link encap:Ethernet HWaddr 00:09:6B:BA:28:A0 inet addr:XXX.XX.XX.135 Bcast:XXX.XX.XX.255 Mask:255.255.255.0 inet6 addr: fe80::209:6bff:feba:28a0/64 Scope:Link UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1 RX packets:37863 errors:0 dropped:0 overruns:0 frame:0 TX packets:3318 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2821465 (2.6 Mb) TX bytes:343335 (335.2 Kb) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:42 errors:0 dropped:0 overruns:0 frame:0 TX packets:42 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:2896 (2.8 Kb) TX bytes:2896 (2.8 Kb) If I do the command manually ( >ifconfig eth0:0 192.168.1.100 netmask 255.255.255.0 broadcast 192.168.1.255), it's working fine until I reboot. I try to find the way to have it at boot time via the file ifcfg-eth-id-00:09:6b:ba:28:a0. It's suppose to work according to the documentation, so what's missing. Thank's, Michel.

2 1

nobody
by Preetam Ramakrishna 05 Aug '05

05 Aug '05

Hi, The system accounts like nobody, daemon, lp, etc on SUSE have a shell in the /etc/password file. Why is this required. These system accounts do not have a shell on other unix / linux systems. Thanks, Preetam

4 4

MLDonkey in compartment => no name-resolution for BitTorrent
by David Huecking 04 Aug '05

04 Aug '05

Hi! I'm running MLDonkey with compartment (http://www.suse.de/~marc/SuSE.html) and I'd like to use BitTorrent... The problem is that mlnet can't look up the IP of the Tracker for the torrent-file. e.g. when I try to get Knoppix with KNOPPIX_V3.9-2005-05-27-DE.torrent I get error-messages Error: torrent.unix-ag.uni-kl.de: address not found in the log. mlnet itself is a static binary, so it won't use libs for name-resolution I think. I start mlnet with a start-script which executes: /usr/sbin/compartment --chroot $CHROOT_PATH --user $MLDONKEY_USER --group $MLDONKEY_GROUP --fork "$MLDONKEY" 2>&1 >> $CHROOT_PATH/$MLDONKEY_LOG Anyone an idea what I could do to solve this? -- Eat, sleep and go running, David Hücking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216

1 0

Sorry for my technical glitch
by Charles philip Chan 03 Aug '05

03 Aug '05

Sorry for sending my last two post to the wrong list. It was a technical glitch- I put in the wrong address in the gnus_public field in bbdb, thus the parent posts were filtered to the wrong group. :-( Charles -- "I'd crawl over an acre of 'Visual This++' and 'Integrated Development That' to get to gcc, Emacs, and gdb. Thank you." (By Vance Petree, Virginia Power)

1 0

Re: [OT] SUSE Linux will be Opened
by Charles philip Chan 03 Aug '05

03 Aug '05

On 3 Aug 2005, joe(a)tmsusa.com wrote: > Yes, the shrink wrapped boxed set will continue to be sold, for those who > like nice CD/DVD sets, thick manuals, and support - but they will also offer > the free (speech, beer) download for those who prefer to go that route. Yes, this is certainly the best of both worlds. Charles -- Linux: Because a PC is a terrible thing to waste. (By komarimf(a)craft.camp.clarkson.edu, Mark Komarinski)

1 0

Re: [OT] SUSE Linux will be Opened
by Charles philip Chan 03 Aug '05

03 Aug '05

On 3 Aug 2005, red.kryptonite(a)gmail.com wrote: On 8/2/05, Charles philip Chan <cpchan(a)sympatico.ca> wrote: > > Sounds great. Now I hope someone writes an applet which lets a user > switch networks on the fly from config files they've setup.. something > similar to what OS X lets the user do. Yes, this is a *must* for mobile users. Charles -- "Whip me. Beat me. Make me maintain AIX." (By Stephan Zielinski)

1 0

Xvnc configuration for SuSE 9.2
by R Hannes Beinert 02 Aug '05

02 Aug '05

Hello! I was having trouble getting a vnc connection to my SuSE v9.2 box, and ultimately resolved the problem by modifying the xinetd configuration file in /etc/xinetd.d/vnc to specify that the xvnc server execute as user=root instead of the original distro specification of user=nobody. It seems to me that regardless of which window manager is forked from xvnc, it would need root privilege -- I can't see how the originally shipped configuration file would work. Given that I would like to use VNC, is this a reasonable configuration from a security perspective? Is there a preferred configuration? Thanks! Hannes. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 2

RE: [suse-security] Martian problems
by THORNTON Simon 02 Aug '05

02 Aug '05

Hi, (minor update) See /usr/src/linux/Documentation/networking/ip-sysctl.txt for an explanation of parameters that can be set for networking, specifically "log_martians". The current settings can be found by typing (as root): sysctl -a | grep martian (if there multiple interfaces their will be an entry for each one net.ipv4.conf.XXXXX.log_martians plus the "default" and "all"). Two way to implement this: 1. From the command line (needs to be re-done each time you reboot): echo 0 >/proc/sys/net/ipv4/conf/all/log_martians echo 0 >/proc/sys/net/ipv4/conf/default/log_martians echo 0 >/proc/sys/net/ipv4/conf/eth1/log_martians 2. Automatically at startup, by editing /etc/sysctl.conf and adding: net.ipv4.conf.default.log_martians = 0 net.ipv4.conf.all.log_martians = 0 To activate the changes without rebooting type: /etc/rc.d/boot.sysctl start echo 0 >/proc/sys/net/ipv4/conf/eth1/log_martians The latter echo is necessary without a reboot as the default setting will only apply when an inteface is brought up. Rgds, Simon -----Original Message----- From: Tarjei Huse [mailto:tarjei+a_lists.suse@nu.no] Sent: Tuesday, August 02, 2005 12:57 To: suse-security(a)suse.com Subject: [suse-security] Martian problems Hi, I'm having problems with a SuSE 9.2 box. The box is set up with two interfaces on the same subnet. The interfaces has been set up as normal with static ip's 10.9.1.3, 10.9.1.2 , netmask 255.255.255.0 and broadcast 10.9.1.255. I'm getting errormessages saying Aug 2 12:33:41 mail2 kernel: martian source 10.9.1.255 from 10.9.1.3, on dev eth1 Aug 2 12:33:41 mail2 kernel: ll header: ff:ff:ff:ff:ff:ff:00:c0:9f:2c:2d:f7:08:00 Is this related to the usage of two nics on the same subnet? If so, is there a way to solve this? It seems the martians are stopping cups from doing broadcasts. Kind regards, Tarjei

1 0

RE: [suse-security] Martian problems
by THORNTON Simon 02 Aug '05

02 Aug '05

Hi, See /usr/src/linux/Documentation/networking/ip-sysctl.txt for an explanation of parameters that can be set for networking, specifically "log_martians". The current settings can be found by typing (as root): sysctl -a | grep martian (if there multiple interfaces their will be an entry for each one net.ipv4.conf.XXXXX.log_martians plus the "default" and "all" Two way to implement this: 1. From the command line (needs to be re-done each time you reboot): echo 0 >/proc/sys/net/ipv4/conf/all/log_martians echo 0 >/proc/sys/net/ipv4/conf/default/log_martians 2. Automatically at startup, by editing /etc/sysctl.conf and adding: net.ipv4.conf.default.log_martians = 0 net.ipv4.conf.all.log_martians = 0 To activate the changes without rebooting type: /etc/rc.d/boot.sysctl start Rgds, Simon -----Original Message----- From: Tarjei Huse [mailto:tarjei+a_lists.suse@nu.no] Sent: Tuesday, August 02, 2005 12:57 To: suse-security(a)suse.com Subject: [suse-security] Martian problems Hi, I'm having problems with a SuSE 9.2 box. The box is set up with two interfaces on the same subnet. The interfaces has been set up as normal with static ip's 10.9.1.3, 10.9.1.2 , netmask 255.255.255.0 and broadcast 10.9.1.255. I'm getting errormessages saying Aug 2 12:33:41 mail2 kernel: martian source 10.9.1.255 from 10.9.1.3, on dev eth1 Aug 2 12:33:41 mail2 kernel: ll header: ff:ff:ff:ff:ff:ff:00:c0:9f:2c:2d:f7:08:00 Is this related to the usage of two nics on the same subnet? If so, is there a way to solve this? It seems the martians are stopping cups from doing broadcasts. Kind regards, Tarjei

1 0

Martian problems
by Tarjei Huse 02 Aug '05

02 Aug '05

Hi, I'm having problems with a SuSE 9.2 box. The box is set up with two interfaces on the same subnet. The interfaces has been set up as normal with static ip's 10.9.1.3, 10.9.1.2 , netmask 255.255.255.0 and broadcast 10.9.1.255. I'm getting errormessages saying Aug 2 12:33:41 mail2 kernel: martian source 10.9.1.255 from 10.9.1.3, on dev eth1 Aug 2 12:33:41 mail2 kernel: ll header: ff:ff:ff:ff:ff:ff:00:c0:9f:2c:2d:f7:08:00 Is this related to the usage of two nics on the same subnet? If so, is there a way to solve this? It seems the martians are stopping cups from doing broadcasts. Kind regards, Tarjei -- Tarjei Huse <tarjei(a)nu.no> --

2 2

Re: [OT] iPod compatibility
by Charles philip Chan 01 Aug '05

01 Aug '05

On 29 Jul 2005, pierre(a)cruzio.com wrote: > Yikes! My wife's birthday is next week and she finally has told me that > she wants an iPod. I know nothing about these things and the house > computers run SuSE. Do I have to build a Windows box to support this toy? Amarok supports the ipod. Charles -- "I'd crawl over an acre of 'Visual This++' and 'Integrated Development That' to get to gcc, Emacs, and gdb. Thank you." (By Vance Petree, Virginia Power)

1 0

Re: [suse-security] Multiple NIC scenario
by Torsten E. 01 Aug '05

01 Aug '05

Hi, Wolfgang Leithner scribbled on 01.08.2005 21:01: > Hello Thorsten, > On Monday 09 May 2005 12:53, Torsten E. wrote: [...] Thanks everybody! We decided to walk a different way: a collegue of mine 'found' an hw-router, offering 2 dsl connections and some other stuff. Now he's responsible for it (its not online yet), and I don't have to deal with that prob anymore ... ;) Have a nice day Torsten

1 0

Heimdal kerberos on suse 8.2
by Postmaster＠queenelizabeths.derbyshire.sch.uk 01 Aug '05

01 Aug '05

Firstly I apologise if this is the wrong list to ask this question, I have some linux knowledge but have run out of my depth on this, hopefully there is a simple answer that someone will share with me. We have just "upgraded" our main school domain controllers to windows 2003 sp1 (from NT4), I have then upgraded the suse 9.1 boxes to Samba 3.0.14a and Kerberos 0.6, this following the guidance in the samba how-to enables me to use the machines as member servers, allowing single sign on for mail etc. However, our intranet, which is based around apache 1.3 and Mod_auth runs on a suse 8.2 box, although samba 3.0.14a has been rpmed for this Kerberos 0.6 has not, 0.6 is the minimum version for joining a windows 2003 domain. The question is, what can I do now, even if I download the source and compile it, is it likely to work? Ideally I could do with a RPM but 0.4 is the latest available for suse 8.2 that I could find. Could anyone help me out. -- Rob Keeling Network Manager Queen Elizabeth's Grammar School Ashbourne

2 1