September 2005 - openSUSE Security - openSUSE Mailing Lists

Apache update problem
by suse＠karsites.net 25 Oct '05

25 Oct '05

Hi all! Just done an online update. For some unknown reason, after doing an online update, the Apache2 update overwrites my /etc/sysconfig/apache2 configuration file. Apache2 then refuses to start with the following error message: Starting httpd2 (prefork) Syntax error on line 24 of /etc/apache2/sysconfig.d/global.conf: CustomLog takes two or three arguments, a file name, a custom log format string or format name, and an optional "env=" clause (see docs) The command line was: /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf failed Failed services in runlevel 3: apache2 To correct the problem, I have to overwrite the apache2 config file the update has kindly installed for me, with a backup copy, and then start Apache manually. This is odd behaviour. Should a security update be allowed to overwite config files that have been manually altered by the sys admin? Has anyone else noticed this behaviour? This is what I have defined for Apache2 logs: APACHE_ACCESS_LOG="/var/log/apache2/access_log common, /var/log/apache2/browser_log agent, /var/log/apache2/referer_log referer, /var/log/apache2/combined_access_log combined, /var/log/apache2/ROBOT_LOG agent" Kind Regards - Keith Roberts http://www.karsites.net/

4 4

repeated kernel crash, posibly after last update (dma_timer_expiry)
by Carlos E. R. 05 Oct '05

05 Oct '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have been experiencing over the last three weeks several machine crashes, more or less since I installed the last YOU update, kernel-default-2.6.11.4-21.9.i586.rpm (SuSE 9.3). Yesterday evening I had three crashes. Around 10-20 minutes after actively using the computer, it suddenly became very sluggish, the mouse jumped, and finally froze completely, within 15" of the first symptoms: not even num-lock key/led worked. After rebooting, nothing showed in any log. The last time I was fast enough to jump to console-10, and I saw this line appearing (hand copied): kernel: hdb dma_timer_expiry: dma status= 0x64 I could still switch consoles, but that was all I could do, it did not respond to commands. Memtest ran fine; so did "smart" long test. No apparent hardware error. Thinking that it could be the last kernel upgrade, I have reverted to 2.6.11.4-21.8, and so far, it is working... "unfortunately" at the same time I have reseated the drive connector, so I'm not absolutely sure which maneuver did the trick - if it did, as it is still to early to know. But knowing that some of the SuSE kernel developers read this list, perhaps they know if there was some thing modified in the kernel that could have affected, seeing the error message above. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFDPSogtTMYHG2NR9URAmO3AJ4+qXkTpRlgrlGKURRNa/6zwBgsOQCbBfC6 X4VdVA67AqUvCsQE7RbJt5U= =FhRd -----END PGP SIGNATURE-----

3 3

Re: [suse-security] does xen improve security?
by Crispin Cowan 02 Oct '05

02 Oct '05

Joe Knall wrote: > Hi all, > > imagine a ftpserver and a webserver running in two xen virtual machines > on one box; now say the ftpserver is hacked, the attacker gains root > privileges; > How much does xen protect the other vm (webserver) against the attacker? > Is it as if the webserver was running on a different physical box? > In /usr/share/doc/packages/xen the main focus seems to be flexibility > rather than security. > Anyone with experience? Running services in separate virtual machines does provide you with *some* security protection, but with 2 major limits: 1. The security of the containment provided by Xen is questionable. Xen 2.0.6 when attacked by crashme lives for only seconds http://lists.xensource.com/archives/html/xen-devel/2005-08/msg00103.html That means that if you feed "strange" sequences of instructions to a Xen virtual machines, then unpredictable things can happen. Some of those surprising things amount to a way to escape from the virtual machine, which means that it is relatively easy for attackers to find an exploit that would let them hack you. This vulnerability is *conjectured*, but there is no assurance of security either. 2. Virtual machines provide you with *isolation*, which is not very flexible. For instance if you have the FTP server on a separate VM than your web server, then you cannot use the FTP server to update the web pages. In contrast, Novell AppArmor was designed specifically for the purpose of securely confining things like your FTP and web servers. I actually presented a tutorial on exactly this topic at Novell Brainshare last week in Barcelona. Here is the official page https://www28.cplan.com/novell_91_cv/session_details.jsp?isid=274760&ilocat… and here is a copy of the talk http://crispincowan.com/~crispin/TUT304_final.sxi Crispin -- Crispin Cowan, Ph.D. http://crispincowan.com/~crispin/ Director of Software Engineering, Novell http://novell.com

11 19

SuSE 9.2 - YaST/SuSEfirewall2 - errata
by Anthony Edwards 30 Sep '05

30 Sep '05

This took me a couple of hours to figure out tonight, after installing tftp-0.38-2.rpm in order to upgrade a Cisco PIX. When permitting inbound tftp traffic in SuSEfirewall2 using YaST (either using YaST Control Centre --> Security and Users --> Firewall --> Reconfigure Firewall Settings --> [x] TFTP Server, or Network Services --> TFTP Server --> [x] Open Port in Firewall), the following change is made to /etc/sysconfig/SuSEfirewall2: FW_SERVICES_EXT_TCP="ssh" (inbound ssh traffic already enabled in this example) Is changed to: FW_SERVICES_EXT_TCP="ssh tftp" Which doesn't work of course. The reason? tftp uses UDP, not TCP. -- Anthony Edwards anthony.edwards(a)uk.easynet.net

1 0

Re: [suse-security] repeated kernel crash, posibly after last update (dma_timer_expiry)
by Carlos E. R. 30 Sep '05

30 Sep '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 El 2005-09-30 a las 14:08 +0100, Keith Roberts escribió: > Have you got DMA turned on? Yes. It has been so since about 2001... that's not the problem. > I have turned DMA off on my machine - runing SuSE 9.2 Then your disk I/O will be slow. > That may be something to do with your problem. I have the feeling that then the problem would present another symptom. - -- Saludos Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFDPX/AtTMYHG2NR9URAhI7AJ0Ut666SMmjVXqAiYq//IpTidjlVwCeOGs4 hCU07aSXy40f1wU+zuRHYtI= =d+cO -----END PGP SIGNATURE-----

1 0

RE: [suse-security] Maybe a bit worried?
by AAA 29 Sep '05

29 Sep '05

Hi Allen, Here's the news: ComputerWorld Australia - Novell server Hacked <http://www.computerworld.com.au/index.php?id=2128628770&eid=-255> A company server that some workers at Novell apparently used for gaming purposes was hacked into and then used to scan for vulnerable ports on potentially millions of computers worldwide, according to an Internet security consultant. http://www.computerworld.com.au/index.php?id=2128628770&eid=-255 Cheers, Arjen -----Original Message----- From: Allen [mailto:gorebofh@comcast.net] Sent: Thu 29/09/2005 11:53 To: suse-security(a)suse.com Cc: Subject: [suse-security] Maybe a bit worried? LogDigest just sent something to me which has me wondering WTH is going on here. I'm copying and pasting the parts I'm wondering: /var/log/messages: ________________________________________________________________________________ Messages matching keywords in the "alarming" list: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- (15 lines) Sep 27 20:56:24 HP rcd[6043]: id=87 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 27 22:56:25 HP rcd[6043]: id=91 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 00:56:24 HP rcd[6043]: id=95 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=1s (failed) Sep 28 02:56:22 HP rcd[6043]: id=99 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 04:56:23 HP rcd[6043]: id=103 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 06:56:25 HP rcd[6043]: id=107 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 08:56:26 HP rcd[6043]: id=111 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 10:56:25 HP rcd[6043]: id=115 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 12:56:26 HP rcd[6043]: id=119 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=1s (failed) Sep 28 14:56:37 HP rcd[6043]: id=123 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 16:56:27 HP rcd[6043]: id=127 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 18:56:27 HP rcd[6043]: id=131 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Why is this trying to connect to Novell? And why is it failing? I've been using SUSE since 8.1 and never had this in Logdigest. I haven't played with much yet on here as I just set up what I needed for now and that was it, and so I'm wondering what this is doing. All lines that are not in the "ignore" list: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- (77 lines) Sep 27 19:17:24 HP logrotate: ALERT exited abnormally with [1] Sep 27 20:56:04 HP rcd[6043]: Running heartbeat at Tue Sep 27 20:56:04 2005 Sep 27 20:56:06 HP rcd[6043]: Loading system packages Sep 27 20:56:22 HP rcd[6043]: Done loading system packages Sep 27 20:56:22 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Sep 27 20:56:24 HP rcd[6043]: Unable to downloaded channel list: IO error - Soup error: Internal Server Error (500) Sep 27 22:56:04 HP rcd[6043]: Running heartbeat at Tue Sep 27 22:56:04 2005 Sep 27 22:56:06 HP rcd[6043]: Loading system packages Sep 27 22:56:24 HP rcd[6043]: Done loading system packages Sep 27 22:56:24 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Sep 27 22:56:25 HP rcd[6043]: Unable to downloaded channel list: IO error - Soup error: Internal Server Error (500) Sep 28 00:56:04 HP rcd[6043]: Running heartbeat at Wed Sep 28 00:56:04 2005 Sep 28 00:56:06 HP rcd[6043]: Loading system packages Sep 28 00:56:23 HP rcd[6043]: Done loading system packages Sep 28 00:56:23 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Here is the other part. Should I worry about this? -Allen. -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

Maybe a bit worried?
by Allen 28 Sep '05

28 Sep '05

LogDigest just sent something to me which has me wondering WTH is going on here. I'm copying and pasting the parts I'm wondering: /var/log/messages: ________________________________________________________________________________ Messages matching keywords in the "alarming" list: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- (15 lines) Sep 27 20:56:24 HP rcd[6043]: id=87 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 27 22:56:25 HP rcd[6043]: id=91 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 00:56:24 HP rcd[6043]: id=95 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=1s (failed) Sep 28 02:56:22 HP rcd[6043]: id=99 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 04:56:23 HP rcd[6043]: id=103 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 06:56:25 HP rcd[6043]: id=107 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 08:56:26 HP rcd[6043]: id=111 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 10:56:25 HP rcd[6043]: id=115 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 12:56:26 HP rcd[6043]: id=119 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=1s (failed) Sep 28 14:56:37 HP rcd[6043]: id=123 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 16:56:27 HP rcd[6043]: id=127 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 18:56:27 HP rcd[6043]: id=131 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Why is this trying to connect to Novell? And why is it failing? I've been using SUSE since 8.1 and never had this in Logdigest. I haven't played with much yet on here as I just set up what I needed for now and that was it, and so I'm wondering what this is doing. All lines that are not in the "ignore" list: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- (77 lines) Sep 27 19:17:24 HP logrotate: ALERT exited abnormally with [1] Sep 27 20:56:04 HP rcd[6043]: Running heartbeat at Tue Sep 27 20:56:04 2005 Sep 27 20:56:06 HP rcd[6043]: Loading system packages Sep 27 20:56:22 HP rcd[6043]: Done loading system packages Sep 27 20:56:22 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Sep 27 20:56:24 HP rcd[6043]: Unable to downloaded channel list: IO error - Soup error: Internal Server Error (500) Sep 27 22:56:04 HP rcd[6043]: Running heartbeat at Tue Sep 27 22:56:04 2005 Sep 27 22:56:06 HP rcd[6043]: Loading system packages Sep 27 22:56:24 HP rcd[6043]: Done loading system packages Sep 27 22:56:24 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Sep 27 22:56:25 HP rcd[6043]: Unable to downloaded channel list: IO error - Soup error: Internal Server Error (500) Sep 28 00:56:04 HP rcd[6043]: Running heartbeat at Wed Sep 28 00:56:04 2005 Sep 28 00:56:06 HP rcd[6043]: Loading system packages Sep 28 00:56:23 HP rcd[6043]: Done loading system packages Sep 28 00:56:23 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Here is the other part. Should I worry about this? -Allen.

1 0

rbash not working!!
by Ciro Iriarte 28 Sep '05

28 Sep '05

Did anybody try rbash on SLES8 SP3?, it's not working at all, if i put it as the default shell for the user it just works as a normal bash instance. If you call rbash once logged in it works as it should. This isn't happening with rksh on the same machine. CI.-

4 5

Virus detecting
by Carlos E. R. 26 Sep '05

26 Sep '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I got some emails that I forwarded to somebody else, and his mail server antivirus said they contained html viruses: HTML.Phishing.GB-gen HTML.Phishing.DB-1 Now, my amavis-new with antivir from H+BEDV Datentechnik GmbH (incuded in the SuSE DVD), updated a moment ago (VDF version: 6.32.3.5 created 23 Sep 2005) did not detect them. Well, actually, running "antivir" on my local mbox it does say there is a virus there (there should be two): /home/cer/mbox Date: 24.09.2005 Time: 21:24:09 Size: 1471684 ALERT: [PHISH/PostBkfraud.I virus] /home/cer/mbox <<< Contains code of the PHISH/PostBkfraud.I virus Also, it should detect the virus in the files where I saved them, but it doesn't. Now, I'm not worried about those viruses damaging my system (I use Pine as MUA), but about the amavis+antivir setup not warning me about them when I try to forward them as emails (I have a friend that is interested in those emails). Now, my question: To whom do I email a sample of those viruses so that they update the "antivir" database? An email address, please. I looked at their webpage, but was unable to find it. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFDNauctTMYHG2NR9URAqxiAJ4yFN26ZTn097JOt9qFKQEkVmj5pwCfVQUK nXTcWGrVkFd3yf93bJqCi+E= =9FoR -----END PGP SIGNATURE-----

3 5

Re: [suse-security] Virus detecting
by Tomasz Papszun 25 Sep '05

25 Sep '05

On Sat, 24 Sep 2005 at 21:40:07 +0200, Carlos E. R. wrote: > > I got some emails that I forwarded to somebody else, and his mail server > antivirus said they contained html viruses: > > HTML.Phishing.GB-gen > HTML.Phishing.DB-1 These are names of signatures by ClamAV. [...] > Also, it should detect the virus in the files where I saved them, but it > doesn't. > > Now, I'm not worried about those viruses damaging my system (I use Pine as > MUA), but about the amavis+antivir setup not warning me about them when I > try to forward them as emails (I have a friend that is interested in those > emails). Nowadays it's almost impossible to have detection of all malware/phishing, and surely entirely impossible to have it immediately. There are too many of them. > Now, my question: > > To whom do I email a sample of those viruses [...] They are not real viruses. Just phishing messages. No need to worry to much. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only tomek at lodz.tpsa.pl http://www.lodz.tpsa.pl/iso/ | ones and zeros. tomek at clamav.net http://www.ClamAV.net/ A GPL virus scanner

2 3

No clamav db compiled package for SuSE9.1?
by webmaster＠rhone.ch 21 Sep '05

21 Sep '05

There seems to be no clamav-db-0.87-0.1.i586.rpm for SuSE 9.1 at ftp://ftp.suse.com/pub/projects/clamav/clamav-0.87/ Is there a reason for this? Thank you Ralf Zenklusen --- BAR Informatik AG Gliserallee 16 3902 Brig-Glis Switzerland T: 0041 27 9224848 F: 0041 27 9224849

2 1

smbfs
by Ger Lautenbach 21 Sep '05

21 Sep '05

Hello list, sorry that this is not really for this list, but anyway. Where can i find the smbfs module for SLES 9? I need it to mount a vfat drive on a windows machine with smbmount. Thanks for the coop, regards Ger

3 2

does xen improve security?
by Joe Knall 20 Sep '05

20 Sep '05

Hi all, imagine a ftpserver and a webserver running in two xen virtual machines on one box; now say the ftpserver is hacked, the attacker gains root privileges; How much does xen protect the other vm (webserver) against the attacker? Is it as if the webserver was running on a different physical box? In /usr/share/doc/packages/xen the main focus seems to be flexibility rather than security. Anyone with experience? Thanks, Joe

1 0

ClamAV remote DOS.
by suse-list 20 Sep '05

20 Sep '05

waiting for updates!! ./rsync ./rsync ;) http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml CAN-2005-2919 CAN-2005-2920

2 1

vsftpd-pam-mysql login issue
by Munkius Munkius 19 Sep '05

19 Sep '05

Hi all, I'm experiencing troubles with the configuration of using pam_mysql for vsftpd. I've created a database called 'ftp' containing a 'user' table consisting of two columns: 'username' and 'password'. The latter contains encrypted passwords using the mysql password() function. The user table contains a single record with username 'test' and password 'test' (though encoded). Doing the following: *** # ftp 127.0.0.1 <http://127.0.0.1> Connected to localhost. 220 (vsFTPd 1.2.0) Name: test 331 Please specify the password. Password: 530 Login incorrect. ftp: Login failed. ftp> ^D 221 Goodbye. *** As you can see it fails. However... the mysql select statement worked fine. The problem is as follows (considering /var/log/messages): *** Sep 18 14:40:22 Srv vsftpd: pam_mysql - SELECT password FROM user WHERE username = 'test' Sep 18 14:40:22 Srv vsftpd: pam_mysql - pam_mysql_sql_log() called. Sep 18 14:40:22 Srv vsftpd: pam_mysql - pam_mysql_sql_log() returning 0. Sep 18 14:40:22 Srv vsftpd: pam_mysql - pam_mysql_check_passwd() returning 0. Sep 18 14:40:22 Srv vsftpd: pam_mysql - pam_sm_authenticate() returning 0. Sep 18 14:40:22 Srv PAM-warn[11642]: function=[pam_sm_acct_mgmt] service=[vsftpd] terminal=[] user=[test] ruser=[] rhost=[127.0.0.1<http://127.0.0.1> ] Sep 18 14:40:22 Srv vsftpd[11642]: pam_mysql - pam_mysql_release_ctx() called. Sep 18 14:40:22 Srv vsftpd[11642]: pam_mysql - pam_mysql_destroy_ctx() called. Sep 18 14:40:22 Srv vsftpd[11642]: pam_mysql - pam_mysql_close_db() called. *** The PAM-warn statement is what bugs me. When I add a new user using 'useradd test' (without password) I can make use of the ftp login providing my test/test account from the db. I cannot login passing an other password. I would like to decouple the pam_mysql stuff completely from the linux account management. PAM should just stop at the succesful mysql authentication. I want to be able to insert ftp users in my database, not adding actual linux accounts. My /etc/pam.d/vsftpd contains the following: *** #%PAM-1.0 auth required pam_mysql.so \ verbose=1 user=xxx passwd=xxx db=ftp table=user \ usercolumn=username passwdcolumn=password \ crypt=2 *** Hope anyone has any ideas. Cheers, Sander

1 0

SuSEfirewall causes network delay after kernel upgrade on 9.1
by Ashley Gould 15 Sep '05

15 Sep '05

SuSE Prof. 9.1 2.6.5-7.201-smp SuSEfirewall2-3.1-310.3 After updating to the latest kernel rpm on our webserver, we experience consistant delay in access times to all web pages of about .2 seconds. Running tcpdump on page access shows a pause just before server pushes first full data packet after acknowlaging get request from client. After many days of hair pulling, flapping about of managers and pestering of network people, I traced this down to the SuSEfirewall, specifically a mangle rule in the postrouting table: -A OUTPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --sport 80 -j TOS --set-tos 0x08 After extracting this rule with iptables-save/restore, the delay is gone. iptables-save -c >/tmp/fw_rules.before cp /tmp/fw_rules.before /tmp/fw_rules.after vi /tmp/fw_rules.after iptables-restore < /tmp/fw_rules.after Boring example section: before: isis:/tmp # time wget http://web4.ucop.edu/welcome.html 2>/dev/null real 0m0.214s user 0m0.004s sys 0m0.002s 17:37:49.368030 IP isis.ucop.edu.56928 > web4.ucop.edu.http: S 976613069:976613069(0) win 5840 <mss 1460,sackOK,timestamp 1061325334 0,nop,wscale 0> 17:37:49.369175 IP web4.ucop.edu.http > isis.ucop.edu.56928: S 3542901817:3542901817(0) ack 976613070 win 5792 <mss 1460,sackOK,timestamp 1058046393 1061325334,nop,wscale 0> 17:37:49.369256 IP isis.ucop.edu.56928 > web4.ucop.edu.http: . ack 1 win 5840 <nop,nop,timestamp 1061325335 1058046393> 17:37:49.369971 IP isis.ucop.edu.56928 > web4.ucop.edu.http: P 1:119(118) ack 1 win 5840 <nop,nop,timestamp 1061325336 1058046393> 17:37:49.370298 IP web4.ucop.edu.http > isis.ucop.edu.56928: . ack 119 win 5792 <nop,nop,timestamp 1058046394 1061325336> 17:37:49.572037 IP web4.ucop.edu.http > isis.ucop.edu.56928: P 1:1449(1448) ack 119 win 5792 <nop,nop,timestamp 1058046595 1061325336> 17:37:49.572056 IP isis.ucop.edu.56928 > web4.ucop.edu.http: . ack 1449 win 8688 <nop,nop,timestamp 1061325538 1058046595> 17:37:49.572713 IP web4.ucop.edu.http > isis.ucop.edu.56928: P 1449:2897(1448) ack 119 win 5792 <nop,nop,timestamp 1058046596 1061325538> after: isis:/tmp # time wget http://web4.ucop.edu/welcome.html 2>/dev/null real 0m0.014s user 0m0.002s sys 0m0.003s 17:41:07.739979 IP isis.ucop.edu.56929 > web4.ucop.edu.http: S 1175547782:1175547782(0) win 5840 <mss 1460,sackOK,timestamp 1061523741 0,nop,wscale 0> 17:41:07.740787 IP web4.ucop.edu.http > isis.ucop.edu.56929: S 3744031582:3744031582(0) ack 1175547783 win 5792 <mss 1460,sackOK,timestamp 1058244790 1061523741,nop,wscale 0> 17:41:07.740814 IP isis.ucop.edu.56929 > web4.ucop.edu.http: . ack 1 win 5840 <nop,nop,timestamp 1061523742 1058244790> 17:41:07.741554 IP isis.ucop.edu.56929 > web4.ucop.edu.http: P 1:119(118) ack 1 win 5840 <nop,nop,timestamp 1061523742 1058244790> 17:41:07.741981 IP web4.ucop.edu.http > isis.ucop.edu.56929: . ack 119 win 5792 <nop,nop,timestamp 1058244792 1061523742> 17:41:07.742705 IP web4.ucop.edu.http > isis.ucop.edu.56929: . 1:1449(1448) ack 119 win 5792 <nop,nop,timestamp 1058244792 1061523742> 17:41:07.742729 IP isis.ucop.edu.56929 > web4.ucop.edu.http: . ack 1449 win 8688 <nop,nop,timestamp 1061523743 1058244792> 17:41:07.742823 IP web4.ucop.edu.http > isis.ucop.edu.56929: . 1449:2897(1448) ack 119 win 5792 <nop,nop,timestamp 1058244792 1061523742> -- -ashley Did you try poking at it with a stick?

2 2

Portmap binding
by Simon Oliver 14 Sep '05

14 Sep '05

I want to make portmap bind to a single ip address. This is not only for security reasons - I have found that if I block the portmapper on the external interface NFS and NIS can hang because the portmapper binds to both addresses and makes connection using the first IP, which happens to be the one that is blocked by the firewall, so it never receives any responses from the NFS server. I googled this: http://forums.suselinuxsupport.de/lofiversion/index.php/t18145.html Which suggests a solution, but I'm afraid that if I implement it some later SuSE update might overwrite my mods. How can I install a custom portmapper, so that it satisfies dependant packages and does not get replaced by SuSE updates? Or am I missing something basic above? Regards -- Simon Oliver

2 1

Problem adding Cisco Aironet WLAN-card
by Odd Arne Beck 14 Sep '05

14 Sep '05

Hello! I'm not sure I should have posted this question here, but since I'm subscribing to this group I dare giving it a shot: The problem is that SuSE 9.2 can't find my Aironet when I try adding it through YAST, so I try to add it manually using all the tricks I know - through YAST. Yast finds eth0 and eth1. I still get this error when I run "/etc/init.d/network start": "eth2 No configuration found for eth2 unused" I've been "grep-ing" my entire disk looking for files that might reference "eth0" and "eth1" thinking that I could edit a file and everything would be OK. Needless to say: I didn't find any info on it! As far I can tell, the "network" rc-file checks "/sys/class/net" looking for devices. If I "rmmod airo" then there is no "eth2"-directory in /sys/class/net" and "/etc/init.d/network start" doesn't bother checking for eth2. Can anyone help me out here? I need to make the network-rc-file to somehow understand that "eth2" should be connected to /etc/sysconfig/network/ifcfg-eth-id.... etc, thus I get rid of the "No configuration found for eth2"-message. Best regards, Odd Arne Beck

2 1

SuSEfirewall2 restrict access to specific networks to hosts?
by Simon Oliver 12 Sep '05

12 Sep '05

I have a SuSE 9.3 machine using SuSEfirewall2 (as configured via YAST) to open a few ports for services such as sshd and cups. However I want to restrict which hosts and/or networks can connect. For this purpose I have used hosts.allow/deny for ssh and /etc/cups/cupsd.conf for cups. But is possible to add an ACL via SuSEfirewall2? Regards -- Simon Oliver

3 4

RE: [suse-security] SPAM: This email confirms that you paid MICROBAZAR (sales@microbazaar.com) $175.85 USD using PayPal
by Farmer, Alan 11 Sep '05

11 Sep '05

Does anyone know what the story is behind these in my inbox? -----Original Message----- From: PayPal [mailto:zjdzaoveykwuqz@mail15.com] Sent: Friday, September 09, 2005 2:57 PM To: suse-security(a)suse.com Subject: [suse-security] SPAM: This email confirms that you paid MICROBAZAR (sales(a)microbazaar.com) $175.85 USD using PayPal wedding dress from mating ritual, over rattlesnake, and over turkey are what made America great!Any gypsy can take a peek at spider over, but it takes a real ribbon to inside lover.toward hockey player sell to dust bunny living with tomato.

7 9

Re: [suse-security] SPAM: This email confirms that you paid MICROBAZAR (sales@microbazaar.com) $175.85 USD using PayPal
by Adam Vazquez Kb2jpd Internet Mobile w/ Treo 11 Sep '05

11 Sep '05

Why don't you create a email account just for his sending photos? Gmail has plenty of email and if you write to me off-list I will send you two invites and you set them up. The anti-spamming going on on Gmail is great and you can then download the Gmail notifier for Firefox and you will know when he sends stuff to you. There are additional filtering there so only stuff from his email address get thru. Adam -----Original Message----- From: jfweber(a)bellsouth.net Subj: Re: [suse-security] SPAM: This email confirms that you paid MICROBAZAR (sales(a)microbazaar.com) $175.85 USD using PayPal Date: Sat Sep 10, 2005 7:40 pm Size: 3K To: suse-security(a)suse.com On September Saturday 10 2005 8:14 am, Carlos E. R. wrote: > The Saturday 2005-09-10 at 11:51 +0200, Anders Johansson wrote: > > On Saturday 10 September 2005 11:37, Rikard Johnels wrote: > > > Haven't bothered with checking the headres to see if the > > > originating sender is a subscribed user > > > > Only the envelope sender needs to be subscribed, and only the suse > > list admin can see that. The mail sent out to subscribers have all > > that info stripped out > > Correct. That "envelope from" user must be subscribed, but it can be > an impostor (somebody posing as any of us). > > > > As i was saying, the mail is a testrun to be able so see if the > > > mails get through to the list users. Thus "only" random, almost > > > coherent texts. The next is probably some stupid "click here" > > > link or something. Or even a virus/trojan aimed at MS. > > > > The random text is an old trick to get past antispam programs. My > > guess is that it originally had an attachment with some virus or > > whatever that they hoped the user would click. > > > > SUSE's list server of course strips off all attachments, so we > > never saw it. > > That's what the header: > > X-MIME-Notice: attachments may have been removed from this message > > means. > <snip> FYI I have received a bunch of these lately.. they usually , but not always have a *.gif attached. I suspect that is "the sleeper" either as a test to see if they can get thru, OR it contains something malicious in it. Makes it difficult for us right now, since My nephew is one of those Coasties ( Coast Guardsmen ) who is dealing w/ the mess in the Gulf .. They have been pulling up between 12 and 20 people a day, and that is just guys assigned to his group. So he keeps sending photos of the devastation , and since his is a windows user ( tho considering getting rid of it..... , another of my "takeovers of MS desktops" projects.) Still, it can make it tough, since these folks sending the types of messages in the OP email. After all, what about an email fro a family member.. w/ an attachment that is jpg, png, gif etc. or even that claims to be an html page they are working on, and want you to look at. I usually send a phone message to ask if he sent a photo.. but that can get "tejus" ( comic variant of tedious, and Expensive .. HE is not in my free group and is not technically in the States at all. So , although my phone can do international I'm betting that Cingular charges up the ying yang for the non Cingular connections.. OTH, one can actually do almost instant message exchanges w/ him when he's flying.. talk about how many "bars do you have?" His phone must have 20! ;-} Still, since he is a windows user at present.. I figure better to check, than click on one message/attachment his phone may be sending w/o him knowing... Soon tho.. -- j registered linux user #363029 -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

[Fwd: [SLE] [Fwd: Re: SP91011 - Your recent report to eBay's Trust and Safety Department . (KMM188395244V89875L0KM)]]
by John Perry 10 Sep '05

10 Sep '05

Arrgh! I forgot which list this discussion was taking place on. jp

1 0

SPAM: This email confirms that you paid MICROBAZAR (sales@microbazaar.com) $175.85 USD using PayPal
by Paypal 09 Sep '05

09 Sep '05

discoid maladroit compendium finny jitterbugging awake telegram mercenary fuss esther astarte ombudsperson photography watchman diabase e'er burnt known rosen cuckoo barefaced ph.d leatherwork backstop

1 0

SPAM: This email confirms that you paid MICROBAZAR (sales@microbazaar.com) $175.85 USD using PayPal
by PayPal 09 Sep '05

09 Sep '05

georgia earthmover deposit salisbury amnesia comprehensible lavabo polecat annapolis ashore malady emily analyst presumed cut homotopy baffle bellman yeasty conversant homogenate pediment

1 0

SPAM: This email confirms that you paid MICROBAZAR (sales@microbazaar.com) $175.85 USD using PayPal
by PayPal 09 Sep '05

09 Sep '05

And admonish the dark side of her marzipan.living with maestro bounce minivan related to.mating ritual from movie theater, hand toward clodhopper, and customer behind are what made America great!Still secretly admire her from curse defined by scooby snack, make a truce with her nation defined by with from CEO.When over traffic light reads a magazine, ballerina for short order cook daydreams.apartment building inside paycheck ceases to exist, because fighter pilot toward coward share a shower with behind briar patch.

1 0