September 2005 - openSUSE Security - openSUSE Mailing Lists

Apache update problem
by suse＠karsites.net 25 Oct '05

25 Oct '05

Hi all! Just done an online update. For some unknown reason, after doing an online update, the Apache2 update overwrites my /etc/sysconfig/apache2 configuration file. Apache2 then refuses to start with the following error message: Starting httpd2 (prefork) Syntax error on line 24 of /etc/apache2/sysconfig.d/global.conf: CustomLog takes two or three arguments, a file name, a custom log format string or format name, and an optional "env=" clause (see docs) The command line was: /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf failed Failed services in runlevel 3: apache2 To correct the problem, I have to overwrite the apache2 config file the update has kindly installed for me, with a backup copy, and then start Apache manually. This is odd behaviour. Should a security update be allowed to overwite config files that have been manually altered by the sys admin? Has anyone else noticed this behaviour? This is what I have defined for Apache2 logs: APACHE_ACCESS_LOG="/var/log/apache2/access_log common, /var/log/apache2/browser_log agent, /var/log/apache2/referer_log referer, /var/log/apache2/combined_access_log combined, /var/log/apache2/ROBOT_LOG agent" Kind Regards - Keith Roberts http://www.karsites.net/

4 4

repeated kernel crash, posibly after last update (dma_timer_expiry)
by Carlos E. R. 05 Oct '05

05 Oct '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have been experiencing over the last three weeks several machine crashes, more or less since I installed the last YOU update, kernel-default-2.6.11.4-21.9.i586.rpm (SuSE 9.3). Yesterday evening I had three crashes. Around 10-20 minutes after actively using the computer, it suddenly became very sluggish, the mouse jumped, and finally froze completely, within 15" of the first symptoms: not even num-lock key/led worked. After rebooting, nothing showed in any log. The last time I was fast enough to jump to console-10, and I saw this line appearing (hand copied): kernel: hdb dma_timer_expiry: dma status= 0x64 I could still switch consoles, but that was all I could do, it did not respond to commands. Memtest ran fine; so did "smart" long test. No apparent hardware error. Thinking that it could be the last kernel upgrade, I have reverted to 2.6.11.4-21.8, and so far, it is working... "unfortunately" at the same time I have reseated the drive connector, so I'm not absolutely sure which maneuver did the trick - if it did, as it is still to early to know. But knowing that some of the SuSE kernel developers read this list, perhaps they know if there was some thing modified in the kernel that could have affected, seeing the error message above. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFDPSogtTMYHG2NR9URAmO3AJ4+qXkTpRlgrlGKURRNa/6zwBgsOQCbBfC6 X4VdVA67AqUvCsQE7RbJt5U= =FhRd -----END PGP SIGNATURE-----

3 3

Re: [suse-security] does xen improve security?
by Crispin Cowan 02 Oct '05

02 Oct '05

Joe Knall wrote: > Hi all, > > imagine a ftpserver and a webserver running in two xen virtual machines > on one box; now say the ftpserver is hacked, the attacker gains root > privileges; > How much does xen protect the other vm (webserver) against the attacker? > Is it as if the webserver was running on a different physical box? > In /usr/share/doc/packages/xen the main focus seems to be flexibility > rather than security. > Anyone with experience? Running services in separate virtual machines does provide you with *some* security protection, but with 2 major limits: 1. The security of the containment provided by Xen is questionable. Xen 2.0.6 when attacked by crashme lives for only seconds http://lists.xensource.com/archives/html/xen-devel/2005-08/msg00103.html That means that if you feed "strange" sequences of instructions to a Xen virtual machines, then unpredictable things can happen. Some of those surprising things amount to a way to escape from the virtual machine, which means that it is relatively easy for attackers to find an exploit that would let them hack you. This vulnerability is *conjectured*, but there is no assurance of security either. 2. Virtual machines provide you with *isolation*, which is not very flexible. For instance if you have the FTP server on a separate VM than your web server, then you cannot use the FTP server to update the web pages. In contrast, Novell AppArmor was designed specifically for the purpose of securely confining things like your FTP and web servers. I actually presented a tutorial on exactly this topic at Novell Brainshare last week in Barcelona. Here is the official page https://www28.cplan.com/novell_91_cv/session_details.jsp?isid=274760&ilocat… and here is a copy of the talk http://crispincowan.com/~crispin/TUT304_final.sxi Crispin -- Crispin Cowan, Ph.D. http://crispincowan.com/~crispin/ Director of Software Engineering, Novell http://novell.com

11 19

SuSE 9.2 - YaST/SuSEfirewall2 - errata
by Anthony Edwards 30 Sep '05

30 Sep '05

This took me a couple of hours to figure out tonight, after installing tftp-0.38-2.rpm in order to upgrade a Cisco PIX. When permitting inbound tftp traffic in SuSEfirewall2 using YaST (either using YaST Control Centre --> Security and Users --> Firewall --> Reconfigure Firewall Settings --> [x] TFTP Server, or Network Services --> TFTP Server --> [x] Open Port in Firewall), the following change is made to /etc/sysconfig/SuSEfirewall2: FW_SERVICES_EXT_TCP="ssh" (inbound ssh traffic already enabled in this example) Is changed to: FW_SERVICES_EXT_TCP="ssh tftp" Which doesn't work of course. The reason? tftp uses UDP, not TCP. -- Anthony Edwards anthony.edwards(a)uk.easynet.net

1 0

Re: [suse-security] repeated kernel crash, posibly after last update (dma_timer_expiry)
by Carlos E. R. 30 Sep '05

30 Sep '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 El 2005-09-30 a las 14:08 +0100, Keith Roberts escribió: > Have you got DMA turned on? Yes. It has been so since about 2001... that's not the problem. > I have turned DMA off on my machine - runing SuSE 9.2 Then your disk I/O will be slow. > That may be something to do with your problem. I have the feeling that then the problem would present another symptom. - -- Saludos Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFDPX/AtTMYHG2NR9URAhI7AJ0Ut666SMmjVXqAiYq//IpTidjlVwCeOGs4 hCU07aSXy40f1wU+zuRHYtI= =d+cO -----END PGP SIGNATURE-----

1 0

RE: [suse-security] Maybe a bit worried?
by AAA 29 Sep '05

29 Sep '05

Hi Allen, Here's the news: ComputerWorld Australia - Novell server Hacked <http://www.computerworld.com.au/index.php?id=2128628770&eid=-255> A company server that some workers at Novell apparently used for gaming purposes was hacked into and then used to scan for vulnerable ports on potentially millions of computers worldwide, according to an Internet security consultant. http://www.computerworld.com.au/index.php?id=2128628770&eid=-255 Cheers, Arjen -----Original Message----- From: Allen [mailto:gorebofh@comcast.net] Sent: Thu 29/09/2005 11:53 To: suse-security(a)suse.com Cc: Subject: [suse-security] Maybe a bit worried? LogDigest just sent something to me which has me wondering WTH is going on here. I'm copying and pasting the parts I'm wondering: /var/log/messages: ________________________________________________________________________________ Messages matching keywords in the "alarming" list: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- (15 lines) Sep 27 20:56:24 HP rcd[6043]: id=87 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 27 22:56:25 HP rcd[6043]: id=91 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 00:56:24 HP rcd[6043]: id=95 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=1s (failed) Sep 28 02:56:22 HP rcd[6043]: id=99 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 04:56:23 HP rcd[6043]: id=103 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 06:56:25 HP rcd[6043]: id=107 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 08:56:26 HP rcd[6043]: id=111 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 10:56:25 HP rcd[6043]: id=115 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 12:56:26 HP rcd[6043]: id=119 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=1s (failed) Sep 28 14:56:37 HP rcd[6043]: id=123 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 16:56:27 HP rcd[6043]: id=127 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 18:56:27 HP rcd[6043]: id=131 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Why is this trying to connect to Novell? And why is it failing? I've been using SUSE since 8.1 and never had this in Logdigest. I haven't played with much yet on here as I just set up what I needed for now and that was it, and so I'm wondering what this is doing. All lines that are not in the "ignore" list: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- (77 lines) Sep 27 19:17:24 HP logrotate: ALERT exited abnormally with [1] Sep 27 20:56:04 HP rcd[6043]: Running heartbeat at Tue Sep 27 20:56:04 2005 Sep 27 20:56:06 HP rcd[6043]: Loading system packages Sep 27 20:56:22 HP rcd[6043]: Done loading system packages Sep 27 20:56:22 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Sep 27 20:56:24 HP rcd[6043]: Unable to downloaded channel list: IO error - Soup error: Internal Server Error (500) Sep 27 22:56:04 HP rcd[6043]: Running heartbeat at Tue Sep 27 22:56:04 2005 Sep 27 22:56:06 HP rcd[6043]: Loading system packages Sep 27 22:56:24 HP rcd[6043]: Done loading system packages Sep 27 22:56:24 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Sep 27 22:56:25 HP rcd[6043]: Unable to downloaded channel list: IO error - Soup error: Internal Server Error (500) Sep 28 00:56:04 HP rcd[6043]: Running heartbeat at Wed Sep 28 00:56:04 2005 Sep 28 00:56:06 HP rcd[6043]: Loading system packages Sep 28 00:56:23 HP rcd[6043]: Done loading system packages Sep 28 00:56:23 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Here is the other part. Should I worry about this? -Allen. -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

Maybe a bit worried?
by Allen 28 Sep '05

28 Sep '05

LogDigest just sent something to me which has me wondering WTH is going on here. I'm copying and pasting the parts I'm wondering: /var/log/messages: ________________________________________________________________________________ Messages matching keywords in the "alarming" list: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- (15 lines) Sep 27 20:56:24 HP rcd[6043]: id=87 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 27 22:56:25 HP rcd[6043]: id=91 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 00:56:24 HP rcd[6043]: id=95 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=1s (failed) Sep 28 02:56:22 HP rcd[6043]: id=99 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 04:56:23 HP rcd[6043]: id=103 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 06:56:25 HP rcd[6043]: id=107 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 08:56:26 HP rcd[6043]: id=111 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 10:56:25 HP rcd[6043]: id=115 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 12:56:26 HP rcd[6043]: id=119 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=1s (failed) Sep 28 14:56:37 HP rcd[6043]: id=123 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 16:56:27 HP rcd[6043]: id=127 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 18:56:27 HP rcd[6043]: id=131 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Why is this trying to connect to Novell? And why is it failing? I've been using SUSE since 8.1 and never had this in Logdigest. I haven't played with much yet on here as I just set up what I needed for now and that was it, and so I'm wondering what this is doing. All lines that are not in the "ignore" list: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- (77 lines) Sep 27 19:17:24 HP logrotate: ALERT exited abnormally with [1] Sep 27 20:56:04 HP rcd[6043]: Running heartbeat at Tue Sep 27 20:56:04 2005 Sep 27 20:56:06 HP rcd[6043]: Loading system packages Sep 27 20:56:22 HP rcd[6043]: Done loading system packages Sep 27 20:56:22 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Sep 27 20:56:24 HP rcd[6043]: Unable to downloaded channel list: IO error - Soup error: Internal Server Error (500) Sep 27 22:56:04 HP rcd[6043]: Running heartbeat at Tue Sep 27 22:56:04 2005 Sep 27 22:56:06 HP rcd[6043]: Loading system packages Sep 27 22:56:24 HP rcd[6043]: Done loading system packages Sep 27 22:56:24 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Sep 27 22:56:25 HP rcd[6043]: Unable to downloaded channel list: IO error - Soup error: Internal Server Error (500) Sep 28 00:56:04 HP rcd[6043]: Running heartbeat at Wed Sep 28 00:56:04 2005 Sep 28 00:56:06 HP rcd[6043]: Loading system packages Sep 28 00:56:23 HP rcd[6043]: Done loading system packages Sep 28 00:56:23 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Here is the other part. Should I worry about this? -Allen.

1 0

rbash not working!!
by Ciro Iriarte 28 Sep '05

28 Sep '05

Did anybody try rbash on SLES8 SP3?, it's not working at all, if i put it as the default shell for the user it just works as a normal bash instance. If you call rbash once logged in it works as it should. This isn't happening with rksh on the same machine. CI.-

4 5

Virus detecting
by Carlos E. R. 26 Sep '05

26 Sep '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I got some emails that I forwarded to somebody else, and his mail server antivirus said they contained html viruses: HTML.Phishing.GB-gen HTML.Phishing.DB-1 Now, my amavis-new with antivir from H+BEDV Datentechnik GmbH (incuded in the SuSE DVD), updated a moment ago (VDF version: 6.32.3.5 created 23 Sep 2005) did not detect them. Well, actually, running "antivir" on my local mbox it does say there is a virus there (there should be two): /home/cer/mbox Date: 24.09.2005 Time: 21:24:09 Size: 1471684 ALERT: [PHISH/PostBkfraud.I virus] /home/cer/mbox <<< Contains code of the PHISH/PostBkfraud.I virus Also, it should detect the virus in the files where I saved them, but it doesn't. Now, I'm not worried about those viruses damaging my system (I use Pine as MUA), but about the amavis+antivir setup not warning me about them when I try to forward them as emails (I have a friend that is interested in those emails). Now, my question: To whom do I email a sample of those viruses so that they update the "antivir" database? An email address, please. I looked at their webpage, but was unable to find it. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFDNauctTMYHG2NR9URAqxiAJ4yFN26ZTn097JOt9qFKQEkVmj5pwCfVQUK nXTcWGrVkFd3yf93bJqCi+E= =9FoR -----END PGP SIGNATURE-----

3 5

Re: [suse-security] Virus detecting
by Tomasz Papszun 25 Sep '05

25 Sep '05

On Sat, 24 Sep 2005 at 21:40:07 +0200, Carlos E. R. wrote: > > I got some emails that I forwarded to somebody else, and his mail server > antivirus said they contained html viruses: > > HTML.Phishing.GB-gen > HTML.Phishing.DB-1 These are names of signatures by ClamAV. [...] > Also, it should detect the virus in the files where I saved them, but it > doesn't. > > Now, I'm not worried about those viruses damaging my system (I use Pine as > MUA), but about the amavis+antivir setup not warning me about them when I > try to forward them as emails (I have a friend that is interested in those > emails). Nowadays it's almost impossible to have detection of all malware/phishing, and surely entirely impossible to have it immediately. There are too many of them. > Now, my question: > > To whom do I email a sample of those viruses [...] They are not real viruses. Just phishing messages. No need to worry to much. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only tomek at lodz.tpsa.pl http://www.lodz.tpsa.pl/iso/ | ones and zeros. tomek at clamav.net http://www.ClamAV.net/ A GPL virus scanner

2 3