August 2005 - openSUSE Security - openSUSE Mailing Lists

Root-over-NFS problem
by Prakash Velayutham 21 Aug '05

21 Aug '05

Hi, I have a root-over-NFS issue. How should my shutdown order be in case of a client who is mounting root-over-NFS? When should the network be shutdown and when should the NFS be shutdown? Thanks, Prakash

2 1

Re: [suse-security-announce] SUSE Security Announcement: apache, apache2 request smuggling problem (SUSE-SA:2005:046)
by Markus Gerke 17 Aug '05

17 Aug '05

Hi, I'm running apache 1.3.33 (SuSE 9.0) from the projects-folder on the suse-ftp server (ftp.suse.com:/pub/projects/apache/apache/9.0-i386). The official release for SuSE 9.0 is 1.3.28 (as fixed now), but from 1.3.28 to .33 a lot of bugs have been fixed, also. What should I do now? Downgrade to 1.3.28 with the new bug fixed? Or does SuSE intend to update the 1.3.33 in the project folder? Regards, Markus Marcus Meissner wrote: > ______________________________________________________________________________ > > SUSE Security Announcement > > Package: apache,apache2 > Announcement ID: SUSE-SA:2005:046 > Date: Tue, 16 Aug 2005 07:00:00 +0000 > Affected Products: 8.2, 9.0, 9.1, 9.2, 9.3 > SUSE Linux Enterprise Server 8, 9 > Vulnerability Type: authentication bypass > Severity (1-10): 6 > SUSE Default Package: no > Cross-References: CAN-2005-2088 > CAN-2005-1268 > > > Content of This Advisory: > 1) Security Vulnerability Resolved: > apache and apache2 request smuggling > Problem Description > 2) Solution or Work-Around > 3) Special Instructions and Notes > 4) Package Location and Checksums > 5) Pending Vulnerabilities, Solutions, and Work-Arounds: > See SUSE Security Summary Report. > 6) Authenticity Verification and Additional Information > > ______________________________________________________________________________ > > 1) Problem Description and Brief Discussion > > A security flaw was found in the Apache and Apache2 web servers which > allows remote attacker to "smuggle" requests past filters by providing > handcrafted header entries. > > Fixed Apache 2 server packages were released on July 26th, > fixed Apache 1 server packages were released on August 15th. > > This issue is tracked by the Mitre CVE ID CAN-2005-2088. > > The Apache2 packages additionally fix a single byte overflow in the SSL > CRL handling functionality, tracked by the Mitre CVE ID CAN-2005-1268. > > The Apache1 packages additionally fix a harmless local buffer overflow > in htpasswd. > > 2) Solution or Work-Around > > None, please install the updated packages. > > 3) Special Instructions and Notes > > Please restart the Apache web server after the update. > > 4) Package Location and Checksums > > The preferred method for installing security updates is to use the YaST > Online Update (YOU) tool. YOU detects which updates are required and > automatically performs the necessary steps to verify and install them. > Alternatively, download the update packages for your distribution > manually > and verify their integrity by the methods listed in Section 6 of this > announcement. Then install the packages using the command > > rpm -Fhv <file.rpm> > > to apply the update, replacing <file.rpm> with the filename of the > downloaded RPM package. > > Our maintenance customers are notified individually. The packages are > offered for installation from the maintenance web. > > > x86 Platform: > > SUSE Linux 9.3: > > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/apache2-2.0.53-9.2.i58… > f139e14297b5e62c297bdeeb91a72cfb > > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/apache2-prefork-2.0.53… > f3b91a27ce46603221423ce450f64b91 > > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/apache2-worker-2.0.53-… > 8085487fab1bd301013e4f4268cd5515 > > SUSE Linux 9.2: > > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/apache2-2.0.50-7.4.i58… > 3bcb58b4cfb08896be787bb62328197c > > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/apache2-prefork-2.0.50… > 1e520e3c81f6b7ec84bb4127f9c0ec52 > > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/apache2-worker-2.0.50-… > ff8b691c1d44e33ef43f46f0bd2e9016 > > SUSE Linux 9.1: > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/apache2-2.0.49-27.29.i… > 5bc20e44e197e7b9af2d26984c511950 > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/apache2-devel-2.0.49-2… > ec6a62ab160adebecbf5800fb0bde028 > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/apache2-doc-2.0.49-27.… > dfee5fdccd1fba307a0e580d08920114 > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/apache2-example-pages-… > 6ba6fde3121ce95efed896b55b3616b4 > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/apache2-prefork-2.0.49… > 825ff943742470dcf2deb459094dfc77 > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/apache2-worker-2.0.49-… > cab6bc047c236ca9c19445103bf2b08a > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/libapr0-2.0.49-27.29.i… > df114a68dc94134f1f78266c8a9b4162 > source rpm(s): > > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/apache2-2.0.49-27.29.sr… > 64a3415d384bae98734bfb029a0bfd74 > > SUSE Linux 9.0: > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache-1.3.28-79.i586.… > 3ea2571ee8b8f7533cfa19254ce76000 > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-2.0.48-152.i58… > e79c7b6cd99c86101dbae77d66a355b7 > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-devel-2.0.48-1… > 59f010b8e181975da80ea656104f7a1e > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-doc-2.0.48-152… > 65969fcd4b69912398b0ac133995dd6c > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-example-pages-… > 39efd1a9f7bf2693021642ef5d5f8fba > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-leader-2.0.48-… > 1fe7b5b73f73a747d1290bc495432a50 > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-metuxmpm-2.0.4… > da0a791f90e62f5ab3f49a52b7ad037b > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-prefork-2.0.48… > 0fdf9b7ab16b03354ee17b305b6e46a5 > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/apache2-worker-2.0.48-… > d1a4d5a06d9ca6b64ee6c7d0fe2ef434 > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/libapr0-2.0.48-152.i58… > 8d2f2b1d0e058fd51fa211adb997815c > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/mod_ssl-2.8.15-79.i586… > 241b06b75109f29623e48355a22e5cc5 > source rpm(s): > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/apache-1.3.28-79.src.rpm > 34ce607ad6ce1cd5ce400540ff0fc5c8 > > ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/apache2-2.0.48-152.src.… > 5b4e779401060cdef792aec5a83e298d > > SUSE Linux 8.2: > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/apache2-2.0.48-152.i58… > 3a3ce9aaf22ef266e4465dd845540103 > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/apache2-devel-2.0.48-1… > 891f721003c52433a230d88b6a674740 > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/apache2-doc-2.0.48-152… > 9c91e87e0c4305a006c041ab56c5bb4a > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/apache2-example-pages-… > a95d8a3e01285ab512e67ff99544e738 > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/apache2-leader-2.0.48-… > 830692c995bf913b308ef992b122d8d3 > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/apache2-prefork-2.0.48… > c9f022344948a3af810e0f706003b605 > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/apache2-worker-2.0.48-… > 6c23c596575d6dc4e4c5ed8484b96bc5 > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/libapr0-2.0.48-152.i58… > 0a9dcbdfcbf4b862b8b2da9970032ad3 > source rpm(s): > > ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/apache2-2.0.48-152.src.… > 8ed1800dc6ae23fdde92aeaab8467277 > > x86-64 Platform: > > SUSE Linux 9.3: > > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/apache2-2.0.53-9.2.x… > b0191eba7fbb1bc9f9c154b48f19f41e > > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/apache2-prefork-2.0.… > feec5b490afdbd30249923ccf791e5e1 > > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/apache2-worker-2.0.5… > 418f4b6310bb98177b477a8c2af0fd3e > source rpm(s): > > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/apache2-2.0.53-9.2.src.… > 51cd4351f98f32df47c5d15beeeb055c > > SUSE Linux 9.2: > > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/apache2-2.0.50-7.4.x… > 2a5421e418e43d552a4782d3bc9a2486 > > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/apache2-prefork-2.0.… > 1617072b6ebfe834251e8e6084acf71b > > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/apache2-worker-2.0.5… > a0ee7a530aefc0c902b45ffc5f140758 > source rpm(s): > > ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/apache2-2.0.50-7.4.src.… > 038265691d3d304c63301d1900d9c8f5 > > SUSE Linux 9.1: > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/apache2-2.0.49-27.… > 8d5268bb9772648aea84ab6c96f729e5 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/apache2-devel-2.0.… > cd24e073b85c1ad2ae0f4f9ac7f03833 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/apache2-doc-2.0.49… > aa96fe4043dadd434bfdbbcbda5b9e3c > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/apache2-example-pa… > fdef881a458ce47c4ab3852bc03b03c3 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/apache2-prefork-2.… > 4949d1b12846fc5ba998ba828f1d3aa2 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/apache2-worker-2.0… > db46554809bdcdb0d680f950a37d1a67 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/libapr0-2.0.49-27.… > cd742baacc51deb46e77abf44ee7852b > source rpm(s): > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/apache2-2.0.49-27.29.… > 2bf68594e45e71944ae666b9d05f042d > > SUSE Linux 9.0: > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache-1.3.28-79.x… > 383bb73f15037bdf193b43e8356c24e2 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-2.0.48-152… > 5a91de1118c01e36103bed561afaf461 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-devel-2.0.… > 0fe7ab322847c94c8346f259ab666973 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-doc-2.0.48… > e02b174d4b8312c9370d04e531c6cb6f > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-example-pa… > 5cbf2baf68a56df0e95149a209dcc5bb > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-leader-2.0… > 0512d0806364982cb77e300807f0c2ab > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-metuxmpm-2… > 66e024c176e86ae70f9cce5f68bbbb6e > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-prefork-2.… > 42046fedac25e435a87048895ba892a3 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/apache2-worker-2.0… > 2cf1c65663e16108cb25300e171a195b > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/libapr0-2.0.48-152… > 87b741b0402f03064de4619dff361086 > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/mod_ssl-2.8.15-79.… > 09458018034cfffbc419d816c5dd31ce > source rpm(s): > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/apache-1.3.28-79.src.… > ae182ca0cb6e47559f250feca8c67e2e > > ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/apache2-2.0.48-152.sr… > e87c50cda40a5c9097bab2e20c1098d6 > > > ______________________________________________________________________________ > > 5) Pending Vulnerabilities, Solutions, and Work-Arounds: > > See SUSE Security Summary Report. > ______________________________________________________________________________ > > 6) Authenticity Verification and Additional Information > > - Announcement authenticity verification: > > SUSE security announcements are published via mailing lists and on Web > sites. The authenticity and integrity of a SUSE security > announcement is > guaranteed by a cryptographic signature in each announcement. All SUSE > security announcements are published with a valid signature. > > To verify the signature of the announcement, save it as text into > a file > and run the command > > gpg --verify <file> > > replacing <file> with the name of the file where you saved the > announcement. The output for a valid signature looks like: > > gpg: Signature made <DATE> using RSA key ID 3D25D3D9 > gpg: Good signature from "SuSE Security Team <security(a)suse.de>" > > where <DATE> is replaced by the date the document was signed. > > If the security team's key is not contained in your key ring, you can > import it from the first installation CD. To import the key, use the > command > > gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc > > - Package authenticity verification: > > SUSE update packages are available on many mirror FTP servers all > over the > world. While this service is considered valuable and important to > the free > and open source software community, the authenticity and the > integrity of > a package needs to be verified to ensure that it has not been tampered > with. > > There are two verification methods that can be used independently from > each other to prove the authenticity of a downloaded file or RPM > package: > > 1) Using the internal gpg signatures of the rpm package > 2) MD5 checksums as provided in this announcement > > 1) The internal rpm package signatures provide an easy way to > verify the > authenticity of an RPM package. Use the command > > rpm -v --checksig <file.rpm> > > to verify the signature of the package, replacing <file.rpm> > with the > filename of the RPM package downloaded. The package is > unmodified if it > contains a valid signature from build(a)suse.de with the key ID > 9C800ACA. > > This key is automatically imported into the RPM database (on > RPMv4-based distributions) and the gpg key ring of 'root' during > installation. You can also find it on the first installation CD > and at > the end of this announcement. > > 2) If you need an alternative means of verification, use the md5sum > command to verify the authenticity of the packages. Execute the > command > > md5sum <filename.rpm> > > after you downloaded the file from a SUSE FTP server or its > mirrors. > Then compare the resulting md5sum with the one that is listed > in the > SUSE security announcement. Because the announcement containing the > checksums is cryptographically signed (by security(a)suse.de), the > checksums show proof of the authenticity of the package if the > signature of the announcement is valid. Note that the md5 sums > published in the SUSE Security Announcements are valid for the > respective packages only. Newer versions of these packages > cannot be > verified. > > - SUSE runs two security mailing lists to which any interested party may > subscribe: > > suse-security(a)suse.com > - General Linux and SUSE security discussion. > All SUSE security announcements are sent to this list. > To subscribe, send an e-mail to > <suse-security-subscribe(a)suse.com>. > > suse-security-announce(a)suse.com > - SUSE's announce-only mailing list. > Only SUSE's security announcements are sent to this list. > To subscribe, send an e-mail to > <suse-security-announce-subscribe(a)suse.com>. > > For general information or the frequently asked questions (FAQ), > send mail to <suse-security-info(a)suse.com> or > <suse-security-faq(a)suse.com>. > > ===================================================================== > SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. > The <security(a)suse.de> public key is listed below. > ===================================================================== > ______________________________________________________________________________ > > The information in this advisory may be distributed or reproduced, > provided that the advisory is not modified in any way. In > particular, the > clear text signature should show proof of the authenticity of the > text. > > SUSE Linux Products GmbH provides no warranties of any kind whatsoever > with respect to the information contained in this security advisory. > > Type Bits/KeyID Date User ID > pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> > pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> > > -----BEGIN PGP PUBLIC KEY BLOCK----- > Version: GnuPG v1.0.6 (GNU/Linux) > Comment: For info see http://www.gnupg.org > > mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff > 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d > M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO > QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK > XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE > D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd > G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM > CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE > myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr > YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD > wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d > NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe > QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe > LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t > XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU > D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 > 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot > 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW > cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E > ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f > AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E > Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ > HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h > t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT > tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM > 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q > 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 > QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw > JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ > 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH > ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 > wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY > EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol > 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK > CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co > SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo > omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt > A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J > /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE > GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf > ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT > ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 > RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ > 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb > B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X > 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA > 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj > qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p > WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL > hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG > BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ > AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi > RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 > zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM > /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 > whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl > D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz > dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI > RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI > DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= > =LRKC > -----END PGP PUBLIC KEY BLOCK----- >

2 1

Root over NFS hangs during shutdow
by Prakash Velayutham 15 Aug '05

15 Aug '05

Hi All, I have a client system boot from a server using "Root over NFS" and PXEBOOT. The entire booting process seems just fine. But if I do a shutdown (or reboot) on the client, for some reason, the root file system gets unmounted during the terminating of the network services and everything else from then on is just frozen. Eventually I get a "INIT: no more process left in this runlevel" error and a lot of error messages before that. Is there someway I can avoid this? How can I see to that the root file system is not unmounted during the system reboot until the very end. Is there a better way of doing this? Any suggestions greatly appreciated. PS: I have tried both with and without the root file system mount line in the client's /etc/fstab file (without any difference in the output). Thanks, Prakash

1 0

L2TP
by Rasp, Robert 15 Aug '05

15 Aug '05

Hello, In the moment I use Strongswan and l2tpd to connect my Windows-Client via VPN. I want to make WLAN secure by using Strongswan and l2tpd for WLAN. The Router / Firewall (Suse 9.0) is connected to the Internet with one NIC (eth2), connected to internal LAN (eth0) and connected to several WLAN-AP with eth1. I want different configurations for the WLAN-VPN and the INET-VPN. Different IP-Subnets and different MTU. If I start l2tpd with "l2tpd -c /etc/l2tpd/wlan.conf" then the first l2tpd stops accepting incoming calls. Is it possible to run two l2tpd on different devices ? ( listen-addr does not help or I use it wrong ) Is it possible to run one l2tpd and have different configurations for different NIC's / IP's ??? Thanks for your Help Robert

1 0

OpenSuSE and security updates?
by Guido Tschakert 09 Aug '05

09 Aug '05

Hello does anybody of the SuSE guys already knows how long there will be security updates for the new distris of opensuse? 2 years as usual, just 1 year :-( or maybe 3 years :-) ( I would prefer only one new dristri every year and a lifetime of 3 years instead of 2 distris/a and just 2 years lifetime. but that' s just my two cents). And another question: who will produce and distribute the security updates (and make the quality assurance)? -- Mit freundlichen Grüßen, Guido Tschakert

3 3

BIOS hangs after update to newest kernel :(
by Philippe Vogel 09 Aug '05

09 Aug '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! I experienced similar problems with the update as I forgot to update one machine. Reboot didn't worked and a cold reboot made the BIOS crash and I had to reset BIOS/depower everything and then reboot the machine again. This is no stable update and wasn't fully tested (kind'a' novel influence on the quality of updates?). If this doesn't change I will switch back to debian (as there is the question to update several servers and I got my scripts for debian as well). Reguards Philippe - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQvjHgkNg1DRVIGjBAQJ92wb/R6gqSD2KgmOmVGVR383yTerJPDUp2e01 7YWFYpX/uxb6eoaPeU1JhmpmxmfV3pa4Kfozc8IssyBGt0a5MccPybwPlrkPU5Rm /bavH/dVtkPdX6nGzEf4tA2vgySwVhmerjW/cqZjZ2eIEeOa0v+5Kmp0YhLX6hY9 U2E8R8+W1XbLoN/TBz+EpwwjTK+wE4elwikA9xW7LWXHPh1pq3gJ/O8PZnPhLEKd vIFqhhW5QCvOwTWseTDKOUjFasCXHtvnU5UhHr3YIX29PITOgCmWH5lmfHFdTRY3 igjyZwa8ckI= =QiDK -----END PGP SIGNATURE-----

1 0

Oopses after SL 9.2 kernel security update
by Jan Ritzerfeld 09 Aug '05

09 Aug '05

Hello, yesterday I have installed the kernel update for SL 9.2 (2.6.8-24.17.i586 SL92_BRANCH-200507190856330000) via YOU. Today (the first reboot) I tried to compile some source and gcc segfaulted. Opera did not start either. Then I noticed the oopses (see end of this mail). rpm segfaulted when I tried to downgrade. Using the rescue system and the recent version of reiserfsck showed no corruption. After downgrading to 2.6.8-24.16 there are no more oopses. Aug 6 13:30:50 linux su: (to nobody) root on none Aug 6 13:30:50 linux su: pam_unix2: session started for user nobody, service su Aug 6 13:30:50 linux su: pam_unix2: session finished for user nobody, service su Aug 6 13:30:50 linux su: (to nobody) root on none Aug 6 13:30:50 linux su: pam_unix2: session started for user nobody, service su Aug 6 13:31:02 linux su: pam_unix2: session finished for user nobody, service su Aug 6 13:31:02 linux su: (to nobody) root on none Aug 6 13:31:02 linux su: pam_unix2: session started for user nobody, service su Aug 6 13:31:02 linux su: pam_unix2: session finished for user nobody, service su Aug 6 13:31:02 linux su: (to nobody) root on none Aug 6 13:31:02 linux su: pam_unix2: session started for user nobody, service su Aug 6 13:32:30 linux kernel: Unable to handle kernel paging request at virtual address 00400000 Aug 6 13:32:30 linux kernel: printing eip: Aug 6 13:32:30 linux kernel: c0165ed6 Aug 6 13:32:30 linux kernel: *pde = 00000000 Aug 6 13:32:30 linux kernel: Oops: 0000 [#1] Aug 6 13:32:30 linux kernel: Modules linked in: nvidia usbserial parport_pc lp parport nvram speedstep_lib freq_table thermal processor fan button battery ac snd_pcm_oss snd_mixer_oss snd_intel8x0 snd_ac97_codec snd_pcm snd_timer snd soundcore snd_page_alloc it87 i2c_sensor i2c_isa i2c_core edd ipt_tos ipt_MARK ipt_length cls_fw sch_htb ipt_TOS ip6t_LOG ip6t_limit ipt_LOG ipt_limit ipt_pkttype af_packet joydev sg st sd_mod sr_mod scsi_mod ip6t_state ip6_conntrack ipt_state ip6t_REJECT ipt_REJECT iptable_mangle iptable_filter ip6table_mangle ip_nat_ftp iptable_nat ip_conntrack_ftp ip_conntrack ip_tables ip6table_filter ip6_tables ipv6 ohci_hcd nvidia_agp agpgart ide_cd cdrom evdev subfs dm_mod 8139too mii usbcore reiserfs Aug 6 13:32:30 linux kernel: CPU: 0 Aug 6 13:32:30 linux kernel: EIP: 0060:[<c0165ed6>] Tainted: P U VLI Aug 6 13:32:30 linux kernel: EFLAGS: 00010206 (2.6.8-24.17-default SL92_BRANCH-200507190856330000) Aug 6 13:32:30 linux kernel: EIP is at __d_lookup+0x76/0xf0 Aug 6 13:32:30 linux kernel: eax: 00400000 ebx: 00400000 ecx: 00000011 edx: c1410200 Aug 6 13:32:30 linux kernel: esi: 839f51ea edi: cc45bec8 ebp: c154611c esp: cc45be6c Aug 6 13:32:30 linux kernel: ds: 007b es: 007b ss: 0068 Aug 6 13:32:31 linux kernel: Process find (pid: 6855, threadinfo=cc45a000 task=de561000) Aug 6 13:32:31 linux kernel: Stack: 839f51ea c3e8632c 00000001 cc45bf1c 00000000 c1457818 d43f3000 00000008 Aug 6 13:32:31 linux kernel: cc45bed0 cc45bed0 cc45bf1c cc45bec8 cc45bed0 c015c6a8 cdec0080 cc45bed0 Aug 6 13:32:31 linux kernel: 839f51ea c3e8ed18 d43f3008 c015cdc9 cc45bf00 00000000 cc45bf1c cc45a000 Aug 6 13:32:31 linux kernel: Call Trace: Aug 6 13:32:31 linux kernel: [<c015c6a8>] do_lookup+0x18/0x70 Aug 6 13:32:31 linux kernel: [<c015cdc9>] link_path_walk+0x6c9/0xca0 Aug 6 13:32:31 linux kernel: [<c015d5b3>] path_lookup+0x73/0x150 Aug 6 13:32:31 linux kernel: [<c015d7e1>] __user_walk+0x21/0x60 Aug 6 13:32:31 linux kernel: [<c0158df1>] vfs_lstat+0x11/0x40 Aug 6 13:32:31 linux kernel: [<c015948f>] sys_lstat64+0xf/0x30 Aug 6 13:32:31 linux kernel: [<c01441ed>] do_no_page+0x9d/0x270 Aug 6 13:32:31 linux kernel: [<c0150753>] filp_close+0x43/0x70 Aug 6 13:32:31 linux kernel: [<c0105c69>] sysenter_past_esp+0x52/0x79 Aug 6 13:32:31 linux kernel: Code: c0 21 d0 8b 15 6c ab 43 c0 c7 44 24 10 00 00 00 00 8d 04 82 89 44 24 14 8b 18 85 db 75 0d eb 69 90 8d 74 26 00 8b 1b 85 db 74 5e <8b> 03 0f 18 00 90 8d 6b a4 8b 34 24 39 75 14 75 e9 8b 7c 24 04 Aug 6 13:32:30 linux su: pam_unix2: session finished for user nobody, service su Aug 6 13:39:30 linux kernel: <1>Unable to handle kernel paging request at virtual address 00400000 Aug 6 13:39:30 linux kernel: printing eip: Aug 6 13:39:30 linux kernel: c0165ed6 Aug 6 13:39:30 linux kernel: *pde = 00000000 Aug 6 13:39:30 linux kernel: Oops: 0000 [#2] Aug 6 13:39:30 linux kernel: Modules linked in: nvidia usbserial parport_pc lp parport nvram speedstep_lib freq_table thermal processor fan button battery ac snd_pcm_oss snd_mixer_oss snd_intel8x0 snd_ac97_codec snd_pcm snd_timer snd soundcore snd_page_alloc it87 i2c_sensor i2c_isa i2c_core edd ipt_tos ipt_MARK ipt_length cls_fw sch_htb ipt_TOS ip6t_LOG ip6t_limit ipt_LOG ipt_limit ipt_pkttype af_packet joydev sg st sd_mod sr_mod scsi_mod ip6t_state ip6_conntrack ipt_state ip6t_REJECT ipt_REJECT iptable_mangle iptable_filter ip6table_mangle ip_nat_ftp iptable_nat ip_conntrack_ftp ip_conntrack ip_tables ip6table_filter ip6_tables ipv6 ohci_hcd nvidia_agp agpgart ide_cd cdrom evdev subfs dm_mod 8139too mii usbcore reiserfs Aug 6 13:39:30 linux kernel: CPU: 0 Aug 6 13:39:30 linux kernel: EIP: 0060:[<c0165ed6>] Tainted: P U VLI Aug 6 13:39:30 linux kernel: EFLAGS: 00210206 (2.6.8-24.17-default SL92_BRANCH-200507190856330000) Aug 6 13:39:30 linux kernel: EIP is at __d_lookup+0x76/0xf0 Aug 6 13:39:30 linux kernel: eax: 00400000 ebx: 00400000 ecx: 00000011 edx: c1410200 Aug 6 13:39:30 linux kernel: esi: d21c440d edi: d5e3def8 ebp: c154611c esp: d5e3de9c Aug 6 13:39:30 linux kernel: ds: 007b es: 007b ss: 0068 Aug 6 13:39:31 linux kernel: Process cc1plus (pid: 27981, threadinfo=d5e3c000 task=d8a66aa0) Aug 6 13:39:31 linux kernel: Stack: d21c440d d24cdd70 fffffff4 c283b8e0 00000000 c1457818 d792300d 0000000e Aug 6 13:39:31 linux kernel: d5e3df00 d5e3df00 d5e3df68 d5e3def8 d5e3df00 c015c6a8 cdec0080 d5e3df00 Aug 6 13:39:31 linux kernel: d21c440d d2bb8290 d792301b c015cdc9 dd8e9a50 00000101 d5e3df68 cdec0080 Aug 6 13:39:31 linux kernel: Call Trace: Aug 6 13:39:31 linux kernel: [<c015c6a8>] do_lookup+0x18/0x70 Aug 6 13:39:31 linux kernel: [<c015cdc9>] link_path_walk+0x6c9/0xca0 Aug 6 13:39:31 linux kernel: [<c015d5b3>] path_lookup+0x73/0x150 Aug 6 13:39:31 linux kernel: [<c015dd15>] open_namei+0x85/0x5e0 Aug 6 13:39:31 linux kernel: [<c0145c20>] __do_mmap_pgoff+0x410/0x700 Aug 6 13:39:31 linux kernel: [<c01503a4>] filp_open+0x24/0x50 Aug 6 13:39:31 linux kernel: [<c01506a1>] sys_open+0x31/0x80 Aug 6 13:39:31 linux kernel: [<c0105c69>] sysenter_past_esp+0x52/0x79 Aug 6 13:39:31 linux kernel: Code: c0 21 d0 8b 15 6c ab 43 c0 c7 44 24 10 00 00 00 00 8d 04 82 89 44 24 14 8b 18 85 db 75 0d eb 69 90 8d 74 26 00 8b 1b 85 db 74 5e <8b> 03 0f 18 00 90 8d 6b a4 8b 34 24 39 75 14 75 e9 8b 7c 24 04 Aug 6 13:46:09 linux kernel: <1>Unable to handle kernel paging request at virtual address 00400000 Aug 6 13:46:09 linux kernel: printing eip: Aug 6 13:46:09 linux kernel: c0165ed6 Aug 6 13:46:09 linux kernel: *pde = 00000000 Aug 6 13:46:09 linux kernel: Oops: 0000 [#3] Aug 6 13:46:09 linux kernel: Modules linked in: nvidia usbserial parport_pc lp parport nvram speedstep_lib freq_table thermal processor fan button battery ac snd_pcm_oss snd_mixer_oss snd_intel8x0 snd_ac97_codec snd_pcm snd_timer snd soundcore snd_page_alloc it87 i2c_sensor i2c_isa i2c_core edd ipt_tos ipt_MARK ipt_length cls_fw sch_htb ipt_TOS ip6t_LOG ip6t_limit ipt_LOG ipt_limit ipt_pkttype af_packet joydev sg st sd_mod sr_mod scsi_mod ip6t_state ip6_conntrack ipt_state ip6t_REJECT ipt_REJECT iptable_mangle iptable_filter ip6table_mangle ip_nat_ftp iptable_nat ip_conntrack_ftp ip_conntrack ip_tables ip6table_filter ip6_tables ipv6 ohci_hcd nvidia_agp agpgart ide_cd cdrom evdev subfs dm_mod 8139too mii usbcore reiserfs Aug 6 13:46:09 linux kernel: CPU: 0 Aug 6 13:46:09 linux kernel: EIP: 0060:[<c0165ed6>] Tainted: P U VLI Aug 6 13:46:09 linux kernel: EFLAGS: 00210206 (2.6.8-24.17-default SL92_BRANCH-200507190856330000) Aug 6 13:46:09 linux kernel: EIP is at __d_lookup+0x76/0xf0 Aug 6 13:46:09 linux kernel: eax: 00400000 ebx: 00400000 ecx: 00000011 edx: c1410200 Aug 6 13:46:09 linux kernel: esi: d21c440d edi: d85abef8 ebp: c154611c esp: d85abe9c Aug 6 13:46:09 linux kernel: ds: 007b es: 007b ss: 0068 Aug 6 13:46:09 linux kernel: Process cc1plus (pid: 28087, threadinfo=d85aa000 task=d335baa0) Aug 6 13:46:10 linux kernel: Stack: d21c440d d24cdd70 00000000 c7344bc0 00000000 c1457818 d92d700d 0000000e Aug 6 13:46:10 linux kernel: d85abf00 d85abf00 d85abf68 d85abef8 d85abf00 c015c6a8 cdec0080 d85abf00 Aug 6 13:46:10 linux kernel: d21c440d d2bb8290 d92d701b c015cdc9 c1fa6f3c 00000101 d85abf68 cdec0080 Aug 6 13:46:10 linux kernel: Call Trace: Aug 6 13:46:10 linux kernel: [<c015c6a8>] do_lookup+0x18/0x70 Aug 6 13:46:10 linux kernel: [<c015cdc9>] link_path_walk+0x6c9/0xca0 Aug 6 13:46:10 linux kernel: [<c015d5b3>] path_lookup+0x73/0x150 Aug 6 13:46:10 linux kernel: [<c015dd15>] open_namei+0x85/0x5e0 Aug 6 13:46:10 linux kernel: [<c01503a4>] filp_open+0x24/0x50 Aug 6 13:46:10 linux kernel: [<c01506a1>] sys_open+0x31/0x80 Aug 6 13:46:10 linux kernel: [<c0105c69>] sysenter_past_esp+0x52/0x79 Aug 6 13:46:10 linux kernel: Code: c0 21 d0 8b 15 6c ab 43 c0 c7 44 24 10 00 00 00 00 8d 04 82 89 44 24 14 8b 18 85 db 75 0d eb 69 90 8d 74 26 00 8b 1b 85 db 74 5e <8b> 03 0f 18 00 90 8d 6b a4 8b 34 24 39 75 14 75 e9 8b 7c 24 04 Aug 6 13:50:59 linux kernel: <1>Unable to handle kernel paging request at virtual address 00400000 Aug 6 13:50:59 linux kernel: printing eip: Aug 6 13:50:59 linux kernel: c0165ed6 Aug 6 13:50:59 linux kernel: *pde = 00000000 Aug 6 13:50:59 linux kernel: Oops: 0000 [#4] Aug 6 13:50:59 linux kernel: Modules linked in: nvidia usbserial parport_pc lp parport nvram speedstep_lib freq_table thermal processor fan button battery ac snd_pcm_oss snd_mixer_oss snd_intel8x0 snd_ac97_codec snd_pcm snd_timer snd soundcore snd_page_alloc it87 i2c_sensor i2c_isa i2c_core edd ipt_tos ipt_MARK ipt_length cls_fw sch_htb ipt_TOS ip6t_LOG ip6t_limit ipt_LOG ipt_limit ipt_pkttype af_packet joydev sg st sd_mod sr_mod scsi_mod ip6t_state ip6_conntrack ipt_state ip6t_REJECT ipt_REJECT iptable_mangle iptable_filter ip6table_mangle ip_nat_ftp iptable_nat ip_conntrack_ftp ip_conntrack ip_tables ip6table_filter ip6_tables ipv6 ohci_hcd nvidia_agp agpgart ide_cd cdrom evdev subfs dm_mod 8139too mii usbcore reiserfs Aug 6 13:50:59 linux kernel: CPU: 0 Aug 6 13:50:59 linux kernel: EIP: 0060:[<c0165ed6>] Tainted: P U VLI Aug 6 13:50:59 linux kernel: EFLAGS: 00210206 (2.6.8-24.17-default SL92_BRANCH-200507190856330000) Aug 6 13:50:59 linux kernel: EIP is at __d_lookup+0x76/0xf0 Aug 6 13:50:59 linux kernel: eax: 00400000 ebx: 00400000 ecx: 00000011 edx: c1410200 Aug 6 13:50:59 linux kernel: esi: d21c440d edi: d3343ef8 ebp: c154611c esp: d3343e9c Aug 6 13:50:59 linux kernel: ds: 007b es: 007b ss: 0068 Aug 6 13:50:59 linux kernel: Process cc1plus (pid: 31360, threadinfo=d3342000 task=d4ae1000) Aug 6 13:50:59 linux kernel: Stack: d21c440d d24cdd70 00000000 c7344bc0 00000000 c1457818 c172700d 0000000e Aug 6 13:50:59 linux kernel: d3343f00 d3343f00 d3343f68 d3343ef8 d3343f00 c015c6a8 cdec0080 d3343f00 Aug 6 13:50:59 linux kernel: d21c440d d2bb8290 c172701b c015cdc9 d2e678ac 00000101 d3343f68 cdec0080 Aug 6 13:50:59 linux kernel: Call Trace: Aug 6 13:50:59 linux kernel: [<c015c6a8>] do_lookup+0x18/0x70 Aug 6 13:50:59 linux kernel: [<c015cdc9>] link_path_walk+0x6c9/0xca0 Aug 6 13:50:59 linux kernel: [<c015d5b3>] path_lookup+0x73/0x150 Aug 6 13:50:59 linux kernel: [<c015dd15>] open_namei+0x85/0x5e0 Aug 6 13:50:59 linux kernel: [<c0145c20>] __do_mmap_pgoff+0x410/0x700 Aug 6 13:50:59 linux kernel: [<c01503a4>] filp_open+0x24/0x50 Aug 6 13:50:59 linux kernel: [<c01506a1>] sys_open+0x31/0x80 Aug 6 13:50:59 linux kernel: [<c0105c69>] sysenter_past_esp+0x52/0x79 Aug 6 13:50:59 linux kernel: Code: c0 21 d0 8b 15 6c ab 43 c0 c7 44 24 10 00 00 00 00 8d 04 82 89 44 24 14 8b 18 85 db 75 0d eb 69 90 8d 74 26 00 8b 1b 85 db 74 5e <8b> 03 0f 18 00 90 8d 6b a4 8b 34 24 39 75 14 75 e9 8b 7c 24 04 Aug 6 13:59:01 linux /usr/sbin/cron[31373]: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly) Aug 6 14:23:15 linux kernel: Unable to handle kernel paging request at virtual address 00400000 Aug 6 14:23:15 linux kernel: printing eip: Aug 6 14:23:15 linux kernel: c0165ed6 Aug 6 14:23:15 linux kernel: *pde = 00000000 Aug 6 14:23:15 linux kernel: Oops: 0000 [#5] Aug 6 14:23:15 linux kernel: Modules linked in: nvidia usbserial parport_pc lp parport nvram speedstep_lib freq_table thermal processor fan button battery ac snd_pcm_oss snd_mixer_oss snd_intel8x0 snd_ac97_codec snd_pcm snd_timer snd soundcore snd_page_alloc it87 i2c_sensor i2c_isa i2c_core edd ipt_tos ipt_MARK ipt_length cls_fw sch_htb ipt_TOS ip6t_LOG ip6t_limit ipt_LOG ipt_limit ipt_pkttype af_packet joydev sg st sd_mod sr_mod scsi_mod ip6t_state ip6_conntrack ipt_state ip6t_REJECT ipt_REJECT iptable_mangle iptable_filter ip6table_mangle ip_nat_ftp iptable_nat ip_conntrack_ftp ip_conntrack ip_tables ip6table_filter ip6_tables ipv6 ohci_hcd nvidia_agp agpgart ide_cd cdrom evdev subfs dm_mod 8139too mii usbcore reiserfs Aug 6 14:23:15 linux kernel: CPU: 0 Aug 6 14:23:15 linux kernel: EIP: 0060:[<c0165ed6>] Tainted: P U VLI Aug 6 14:23:15 linux kernel: EFLAGS: 00210206 (2.6.8-24.17-default SL92_BRANCH-200507190856330000) Aug 6 14:23:15 linux kernel: EIP is at __d_lookup+0x76/0xf0 Aug 6 14:23:15 linux kernel: eax: 00400000 ebx: 00400000 ecx: 00000011 edx: c1410200 Aug 6 14:23:15 linux kernel: esi: a682767b edi: c6e7def8 ebp: c154611c esp: c6e7de9c Aug 6 14:23:15 linux kernel: ds: 007b es: 007b ss: 0068 Aug 6 14:23:15 linux kernel: Process opera (pid: 1990, threadinfo=c6e7c000 task=dbb2d000) Aug 6 14:23:15 linux kernel: Stack: a682767b c87247f8 00000001 c6e7df68 00000000 c1457818 de223018 0000000c Aug 6 14:23:15 linux kernel: c6e7df00 c6e7df00 c6e7df68 c6e7def8 c6e7df00 c015c6a8 cdec0080 c6e7df00 Aug 6 14:23:15 linux kernel: a682767b cb6bfb40 de223024 c015cdc9 c0142be1 00000101 c6e7df68 cdec0080 Aug 6 14:23:15 linux kernel: Call Trace: Aug 6 14:23:15 linux kernel: [<c015c6a8>] do_lookup+0x18/0x70 Aug 6 14:23:15 linux kernel: [<c015cdc9>] link_path_walk+0x6c9/0xca0 Aug 6 14:23:15 linux kernel: [<c0142be1>] zap_pmd_range+0x41/0x60 Aug 6 14:23:15 linux kernel: [<c015d5b3>] path_lookup+0x73/0x150 Aug 6 14:23:15 linux kernel: [<c015dd15>] open_namei+0x85/0x5e0 Aug 6 14:23:15 linux kernel: [<c01503a4>] filp_open+0x24/0x50 Aug 6 14:23:15 linux kernel: [<c0146622>] unmap_region+0x82/0xd0 Aug 6 14:23:15 linux kernel: [<c01506a1>] sys_open+0x31/0x80 Aug 6 14:23:15 linux kernel: [<c0105c69>] sysenter_past_esp+0x52/0x79 Aug 6 14:23:15 linux kernel: Code: c0 21 d0 8b 15 6c ab 43 c0 c7 44 24 10 00 00 00 00 8d 04 82 89 44 24 14 8b 18 85 db 75 0d eb 69 90 8d 74 26 00 8b 1b 85 db 74 5e <8b> 03 0f 18 00 90 8d 6b a4 8b 34 24 39 75 14 75 e9 8b 7c 24 04 Aug 6 14:25:04 linux su: (to root) jan on /dev/pts/2 Aug 6 14:25:04 linux su: pam_unix2: session started for user root, service su Aug 6 14:36:40 linux kernel: Unable to handle kernel paging request at virtual address 00400000 Aug 6 14:36:40 linux kernel: printing eip: Aug 6 14:36:40 linux kernel: c0165ed6 Aug 6 14:36:40 linux kernel: *pde = 00000000 Aug 6 14:36:40 linux kernel: Oops: 0000 [#6] Aug 6 14:36:40 linux kernel: Modules linked in: nvidia usbserial parport_pc lp parport nvram speedstep_lib freq_table thermal processor fan button battery ac snd_pcm_oss snd_mixer_oss snd_intel8x0 snd_ac97_codec snd_pcm snd_timer snd soundcore snd_page_alloc it87 i2c_sensor i2c_isa i2c_core edd ipt_tos ipt_MARK ipt_length cls_fw sch_htb ipt_TOS ip6t_LOG ip6t_limit ipt_LOG ipt_limit ipt_pkttype af_packet joydev sg st sd_mod sr_mod scsi_mod ip6t_state ip6_conntrack ipt_state ip6t_REJECT ipt_REJECT iptable_mangle iptable_filter ip6table_mangle ip_nat_ftp iptable_nat ip_conntrack_ftp ip_conntrack ip_tables ip6table_filter ip6_tables ipv6 ohci_hcd nvidia_agp agpgart ide_cd cdrom evdev subfs dm_mod 8139too mii usbcore reiserfs Aug 6 14:36:40 linux kernel: CPU: 0 Aug 6 14:36:40 linux kernel: EIP: 0060:[<c0165ed6>] Tainted: P U VLI Aug 6 14:36:40 linux kernel: EFLAGS: 00210206 (2.6.8-24.17-default SL92_BRANCH-200507190856330000) Aug 6 14:36:40 linux kernel: EIP is at __d_lookup+0x76/0xf0 Aug 6 14:36:40 linux kernel: eax: 00400000 ebx: 00400000 ecx: 00000011 edx: c1410200 Aug 6 14:36:40 linux kernel: esi: 839f51ea edi: cb8b5ec8 ebp: c154611c esp: cb8b5e6c Aug 6 14:36:40 linux kernel: ds: 007b es: 007b ss: 0068 Aug 6 14:36:40 linux kernel: Process rpm (pid: 2432, threadinfo=cb8b4000 task=debbc000) Aug 6 14:36:40 linux kernel: Stack: 839f51ea c3e8632c fffffff4 e0d42fc0 00000000 c1457818 ddc7901e 00000008 Aug 6 14:36:40 linux kernel: cb8b5ed0 cb8b5ed0 cb8b5f1c cb8b5ec8 cb8b5ed0 c015c6a8 cdec0080 cb8b5ed0 Aug 6 14:36:40 linux kernel: 839f51ea c3e8ed18 ddc79026 c015cdc9 c1e862e0 00000001 cb8b5f1c cdec0080 Aug 6 14:36:40 linux kernel: Call Trace: Aug 6 14:36:40 linux kernel: [<e0d42fc0>] xattr_lookup_poison+0x0/0x90 [reiserfs] Aug 6 14:36:40 linux kernel: [<c015c6a8>] do_lookup+0x18/0x70 Aug 6 14:36:40 linux kernel: [<c015cdc9>] link_path_walk+0x6c9/0xca0 Aug 6 14:36:40 linux kernel: [<c015d5b3>] path_lookup+0x73/0x150 Aug 6 14:36:40 linux kernel: [<c015d7e1>] __user_walk+0x21/0x60 Aug 6 14:36:40 linux kernel: [<c0158da4>] vfs_stat+0x14/0x50 Aug 6 14:36:40 linux kernel: [<c015945f>] sys_stat64+0xf/0x30 Aug 6 14:36:40 linux kernel: [<c0117810>] do_page_fault+0x0/0x5bf Aug 6 14:36:40 linux kernel: [<c0106d9d>] error_code+0x2d/0x40 Aug 6 14:36:40 linux kernel: [<c0105c69>] sysenter_past_esp+0x52/0x79 Aug 6 14:36:40 linux kernel: Code: c0 21 d0 8b 15 6c ab 43 c0 c7 44 24 10 00 00 00 00 8d 04 82 89 44 24 14 8b 18 85 db 75 0d eb 69 90 8d 74 26 00 8b 1b 85 db 74 5e <8b> 03 0f 18 00 90 8d 6b a4 8b 34 24 39 75 14 75 e9 8b 7c 24 04 Gruß, Jan -- Hindsight is an exact science.

7 9

Re: [suse-security] ECN?
by David J N Begley 08 Aug '05

08 Aug '05

On Sun, 7 Aug 2005 John Andersen wrote: > On Sunday 07 August 2005 06:38 am, David J N Begley wrote: > > Dumb question time. Does anyone know the rationale behind SuSEfirewall2's > > disabling of ECN (Explicit Congestion Notification, IETF RFC 3168)? > ECN's implementation is spotty at best. > http://urchin.earth.li/ecn/ > And the hall of shame of non-confirming sites: > http://urchin.earth.li/cgi-bin/ecn.pl Yes, this is an issue of compatibility - that's why the DISABLE_ECN variable exists in /etc/sysconfig/sysctl (and defaults to "yes"); however, SuSEfirewall2 disables ECN regardless of the DISABLE_ECN variable - hence my question (my limited testing so far on our internal network hasn't had any problems with ECN crossing Linux, Solaris, various Cisco equipment and two vendors' firewall equipment). I am aware of some potential weaknesses, documented in a number of places including here: "ECN is fine - but will it be used?" http://republika.pl/maom_onet/papers/ecn/378-444.pdf As the author writes, "while one should realize possible threats, they are not a reason to reject ECN and all the advantages it gives". There are also attempts to strengthen ECN including IETF RFC 3540, "Robust Explicit Congestion Notification (ECN) Signaling [sic] with Nonces". So to expand on my original question, is there some specific security concern surrounding ECN that has led to SuSEfirewall2 turning the feature off in all instances rather than honouring the DISABLE_ECN variable? Thanks..

1 0

RE : [suse-security] Virtual IP
by "Dubé, Michel" 08 Aug '05

08 Aug '05

Thank's, it's working now. Michel. -----Message d'origine----- De : Vaclav Brunnhofer [mailto:vbru@entu.cas.cz] Envoyé : 8 août 2005 07:27 À : "Dubé, Michel" Objet : Re: [suse-security] Virtual IP Dubé, Michel napsal(a): > > eth0:0 Link encap:Ethernet HWaddr 00:09:6B:BA:28:A0 > inet addr:192.168.1.100 Bcast:192.168.1.255 Mask:255.255.255.0 > UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 > Metric:1 > > Here is the file: > BOOTPROTO='dhcp' This is the clue! You have to change this to BOOTPROTO='static' > MTU='' > REMOTE_IPADDR='' > STARTMODE='onboot' > UNIQUE='oxTw.JIMl2CweY+3' > > IPADDR_0='192.168.1.100' > NETMASK_0='255.255.255.0' > BROADCAST_0='192.168.1.255' > NETWORK_0='192.168.1.0' > > > >>ifconfig show: > > > eth0 Link encap:Ethernet HWaddr 00:09:6B:BA:28:A0 > inet addr:XXX.XX.XX.135 Bcast:XXX.XX.XX.255 Mask:255.255.255.0 > inet6 addr: fe80::209:6bff:feba:28a0/64 Scope:Link > UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1 > RX packets:37863 errors:0 dropped:0 overruns:0 frame:0 > TX packets:3318 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:1000 > RX bytes:2821465 (2.6 Mb) TX bytes:343335 (335.2 Kb) > > lo Link encap:Local Loopback > inet addr:127.0.0.1 Mask:255.0.0.0 > inet6 addr: ::1/128 Scope:Host > UP LOOPBACK RUNNING MTU:16436 Metric:1 > RX packets:42 errors:0 dropped:0 overruns:0 frame:0 > TX packets:42 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:0 > RX bytes:2896 (2.8 Kb) TX bytes:2896 (2.8 Kb) > > If I do the command manually ( >ifconfig eth0:0 192.168.1.100 netmask > 255.255.255.0 broadcast 192.168.1.255), it's working fine until I > reboot. I try to find the way to have it at boot time via the file > ifcfg-eth-id-00:09:6b:ba:28:a0. It's suppose to work according to the > documentation, so what's missing. > > Thank's, > > Michel. > -- Vaclav Brunnhofer ENTU AV CR Branisovska 31 37005 Ceske Budejovice Czech Republic tel.: +420387775251 mob.: +420606632822 fax : +420355310354

1 0

RE: [suse-security] nobody
by Jose_Thomas＠Dell.com 08 Aug '05

08 Aug '05

Preetam, Yes, to offer system accounts open outside is a security risk. Normally sysadmins solve this by setting the login shells to /dev/null. Jose -----Original Message----- From: Preetam Ramakrishna [mailto:rpreetam@novell.com] Sent: Monday, August 08, 2005 12:35 PM To: Thomas, Jose - Authorized Dell Representative; suse-security(a)suse.com Subject: RE: [suse-security] nobody Jose, Thanks for the information. I understand the need for system accounts. But, I thought giving a shell to such accounts could be a security risk. Thanks, Preetam >>> <Jose_Thomas(a)Dell.com> 8/8/2005 10:09:18 AM >>> Preetham, These system accounts (daemon, nobody, lp, bin, uucp etc.) are using to execute system functions that require special privilages. For eg. to access certain files or directories, but that does not require root privilages. These special users are associated with particular system functions rather than indvidual users. Different flavours have slightly different kind of implementation. To understand why these special accounts are in use, we can consider the example of uucp (Unix to Unix CoPy) program. Except for legacy networks, uucp is not a widely use mail transmission mechanism now. UUCP is use for transfering files and mails between unix systems connected by telephone lines. When one computer dials another it must first log in instead of logging in as root, the remote compter log in as uucp. The mails (or files) that is awaiting transmission to the remote machine is stored in directories that are readable only by uucp user. nobody - nfs anonymous access user; nobody4 - nfs4 anonymous access user; uucp - uucp admin; daemon - use for network utilities; bin, sys - for system files; lp - for line printer (or laser printer :-)) etc. However I think some are maintain as it is due to historical reasons to keep the legacy systems interact well with more recent Linux systems. HTH Jose -----Original Message----- From: Preetam Ramakrishna [mailto:rpreetam@novell.com] Sent: Friday, August 05, 2005 9:47 AM To: suse-security(a)suse.com Subject: [suse-security] nobody Hi, The system accounts like nobody, daemon, lp, etc on SUSE have a shell in the /etc/password file. Why is this required. These system accounts do not have a shell on other unix / linux systems. Thanks, Preetam -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

4 4