August 2005 - openSUSE Security - openSUSE Mailing Lists

Mozilla update availability -- SuSE 9.3
by Darryl Gregorash 08 Aug '05

08 Aug '05

I notice that Mozilla 1.7.11 is available on the ftp site, in /pub/projects/mozilla... Given that as many as 16 vulnerabilities still exist that were not fixed until Mozilla 1.7.9/1.7.10 (notably the frame-injection spoof that was recently re-introduced), is it advised to download and install 1.7.11, or will the pending security update for 1.7.5 be available soon?

2 1

RE: [suse-security] nobody
by Jose_Thomas＠Dell.com 08 Aug '05

08 Aug '05

Preetham, These system accounts (daemon, nobody, lp, bin, uucp etc.) are using to execute system functions that require special privilages. For eg. to access certain files or directories, but that does not require root privilages. These special users are associated with particular system functions rather than indvidual users. Different flavours have slightly different kind of implementation. To understand why these special accounts are in use, we can consider the example of uucp (Unix to Unix CoPy) program. Except for legacy networks, uucp is not a widely use mail transmission mechanism now. UUCP is use for transfering files and mails between unix systems connected by telephone lines. When one computer dials another it must first log in instead of logging in as root, the remote compter log in as uucp. The mails (or files) that is awaiting transmission to the remote machine is stored in directories that are readable only by uucp user. nobody - nfs anonymous access user; nobody4 - nfs4 anonymous access user; uucp - uucp admin; daemon - use for network utilities; bin, sys - for system files; lp - for line printer (or laser printer :-)) etc. However I think some are maintain as it is due to historical reasons to keep the legacy systems interact well with more recent Linux systems. HTH Jose -----Original Message----- From: Preetam Ramakrishna [mailto:rpreetam@novell.com] Sent: Friday, August 05, 2005 9:47 AM To: suse-security(a)suse.com Subject: [suse-security] nobody Hi, The system accounts like nobody, daemon, lp, etc on SUSE have a shell in the /etc/password file. Why is this required. These system accounts do not have a shell on other unix / linux systems. Thanks, Preetam -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

ECN?
by David J N Begley 08 Aug '05

08 Aug '05

Dumb question time. Does anyone know the rationale behind SuSEfirewall2's disabling of ECN (Explicit Congestion Notification, IETF RFC 3168)? This is done at line 1200 (in the set_proc_stuff function) as shown below: id@host:~> uname -srm ; cat /etc/SuSE-release ; rpm -q SuSEfirewall2 Linux 2.6.8-24.16-default i686 SuSE Linux 9.2 (i586) VERSION = 9.2 SuSEfirewall2-3.2-14.4 id@host:~> fgrep -n tcp_ecn /sbin/SuSEfirewall2 1200: setproc 0 /proc/sys/net/ipv4/tcp_ecn Thanks..

2 1

Re: [suse-security] RE : [suse-security] Virtual IP
by Arjen de Korte 07 Aug '05

07 Aug '05

> Sorry, I missed part of your configuration at first. > The problem is that you cannot add static alias to a DHCP assigned > primary address. Yes you can. I do this all the time for DHCP clients that use a xDSL modem in bridge configuration to be able to reach the modem configuration pages. This can be done very neatly by switching from the default 'dhcpcd' to 'dhclient'. I find the latter much more versatile in cases where you want to override or append some DHCP configuration options. If memory serves, even the /etc/dhclient.conf as shipped by SuSE also lists this possibility. See the 'alias' command for 'dhclient.conf'. Arjen

1 0

MLDonkey in compartment => no name-resolution for BitTorrent
by David Huecking 06 Aug '05

06 Aug '05

Hi! I'm running MLDonkey with compartment (http://www.suse.de/~marc/SuSE.html) and I'd like to use BitTorrent... The problem is that mlnet can't look up the IP of the Tracker for the torrent-file. e.g. when I try to get Knoppix with KNOPPIX_V3.9-2005-05-27-DE.torrent I get error-messages Error: torrent.unix-ag.uni-kl.de: address not found in the log. mlnet itself is a static binary, so it won't use libs for name-resolution I think. I start mlnet with a start-script which executes: /usr/sbin/compartment --chroot $CHROOT_PATH --user $MLDONKEY_USER --group $MLDONKEY_GROUP --fork "$MLDONKEY" 2>&1 >> $CHROOT_PATH/$MLDONKEY_LOG Anyone an idea what I could do to solve this? -- Eat, sleep and go running, David Hücking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216

2 3

RE : [suse-security] Virtual IP
by "Dubé, Michel" 06 Aug '05

06 Aug '05

I add the line "LABEL_0='eth0:0'" and It's still the same. «ifconfig» and «ip addr show» doesn't show eth0:0 The ping of 192.168.1.100 doesn't answer. Do you have more suggestion ? Michel. -----Message d'origine----- De : Kastus [mailto:NOSPAM@tprfct.net] Envoyé : 5 août 2005 19:12 À : suse-security(a)suse.com Objet : Re: [suse-security] Virtual IP On Fri, Aug 05, 2005 at 02:38:12PM -0400, "Dubé, Michel" wrote: > I'm a bit off topic, but I'm sure someone know the answer. Yes, it's off-topic for security list. > > I am using SuSE 9.1, I modify manually the file > /etc/sysconfig/network/ifcfg-eth-id-00:09:6b:ba:28:a0 to add this > config: > > eth0:0 Link encap:Ethernet HWaddr 00:09:6B:BA:28:A0 > inet addr:192.168.1.100 Bcast:192.168.1.255 Mask:255.255.255.0 > UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 > Metric:1 > > Here is the file: > BOOTPROTO='dhcp' > MTU='' > REMOTE_IPADDR='' > STARTMODE='onboot' > UNIQUE='oxTw.JIMl2CweY+3' > > IPADDR_0='192.168.1.100' > NETMASK_0='255.255.255.0' > BROADCAST_0='192.168.1.255' > NETWORK_0='192.168.1.0' You need to add line "LABEL_0='eth0:0'" if you want to see your interface in ifconfig command. > > > >ifconfig show: > > eth0 Link encap:Ethernet HWaddr 00:09:6B:BA:28:A0 > inet addr:XXX.XX.XX.135 Bcast:XXX.XX.XX.255 Mask:255.255.255.0 > inet6 addr: fe80::209:6bff:feba:28a0/64 Scope:Link > UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1 > RX packets:37863 errors:0 dropped:0 overruns:0 frame:0 > TX packets:3318 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:1000 > RX bytes:2821465 (2.6 Mb) TX bytes:343335 (335.2 Kb) > > lo Link encap:Local Loopback > inet addr:127.0.0.1 Mask:255.0.0.0 > inet6 addr: ::1/128 Scope:Host > UP LOOPBACK RUNNING MTU:16436 Metric:1 > RX packets:42 errors:0 dropped:0 overruns:0 frame:0 > TX packets:42 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:0 > RX bytes:2896 (2.8 Kb) TX bytes:2896 (2.8 Kb) Absolutely correct. To see your alias use "ip addr show" command > > If I do the command manually ( >ifconfig eth0:0 192.168.1.100 netmask > 255.255.255.0 broadcast 192.168.1.255), it's working fine until I > reboot. I try to find the way to have it at boot time via the file > ifcfg-eth-id-00:09:6b:ba:28:a0. It's suppose to work according to the > documentation, so what's missing. ifcfg(5): LABEL[suffix] Each address may be tagged with a label string. For details see manpage of ip SUSE uses ip command to configure interfaces, not ifconfig. > > Thank's, You are welcome. > > Michel. -Kastus -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Virtual IP
by "Dubé, Michel" 05 Aug '05

05 Aug '05

I'm a bit off topic, but I'm sure someone know the answer. I am using SuSE 9.1, I modify manually the file /etc/sysconfig/network/ifcfg-eth-id-00:09:6b:ba:28:a0 to add this config: eth0:0 Link encap:Ethernet HWaddr 00:09:6B:BA:28:A0 inet addr:192.168.1.100 Bcast:192.168.1.255 Mask:255.255.255.0 UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1 Here is the file: BOOTPROTO='dhcp' MTU='' REMOTE_IPADDR='' STARTMODE='onboot' UNIQUE='oxTw.JIMl2CweY+3' IPADDR_0='192.168.1.100' NETMASK_0='255.255.255.0' BROADCAST_0='192.168.1.255' NETWORK_0='192.168.1.0' >ifconfig show: eth0 Link encap:Ethernet HWaddr 00:09:6B:BA:28:A0 inet addr:XXX.XX.XX.135 Bcast:XXX.XX.XX.255 Mask:255.255.255.0 inet6 addr: fe80::209:6bff:feba:28a0/64 Scope:Link UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1 RX packets:37863 errors:0 dropped:0 overruns:0 frame:0 TX packets:3318 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2821465 (2.6 Mb) TX bytes:343335 (335.2 Kb) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:42 errors:0 dropped:0 overruns:0 frame:0 TX packets:42 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:2896 (2.8 Kb) TX bytes:2896 (2.8 Kb) If I do the command manually ( >ifconfig eth0:0 192.168.1.100 netmask 255.255.255.0 broadcast 192.168.1.255), it's working fine until I reboot. I try to find the way to have it at boot time via the file ifcfg-eth-id-00:09:6b:ba:28:a0. It's suppose to work according to the documentation, so what's missing. Thank's, Michel.

2 1

nobody
by Preetam Ramakrishna 05 Aug '05

05 Aug '05

Hi, The system accounts like nobody, daemon, lp, etc on SUSE have a shell in the /etc/password file. Why is this required. These system accounts do not have a shell on other unix / linux systems. Thanks, Preetam

4 4

MLDonkey in compartment => no name-resolution for BitTorrent
by David Huecking 04 Aug '05

04 Aug '05

Hi! I'm running MLDonkey with compartment (http://www.suse.de/~marc/SuSE.html) and I'd like to use BitTorrent... The problem is that mlnet can't look up the IP of the Tracker for the torrent-file. e.g. when I try to get Knoppix with KNOPPIX_V3.9-2005-05-27-DE.torrent I get error-messages Error: torrent.unix-ag.uni-kl.de: address not found in the log. mlnet itself is a static binary, so it won't use libs for name-resolution I think. I start mlnet with a start-script which executes: /usr/sbin/compartment --chroot $CHROOT_PATH --user $MLDONKEY_USER --group $MLDONKEY_GROUP --fork "$MLDONKEY" 2>&1 >> $CHROOT_PATH/$MLDONKEY_LOG Anyone an idea what I could do to solve this? -- Eat, sleep and go running, David Hücking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216

1 0

Sorry for my technical glitch
by Charles philip Chan 03 Aug '05

03 Aug '05

Sorry for sending my last two post to the wrong list. It was a technical glitch- I put in the wrong address in the gnus_public field in bbdb, thus the parent posts were filtered to the wrong group. :-( Charles -- "I'd crawl over an acre of 'Visual This++' and 'Integrated Development That' to get to gcc, Emacs, and gdb. Thank you." (By Vance Petree, Virginia Power)

1 0