September 2005 - openSUSE Security - openSUSE Mailing Lists

Apache update problem
by suse＠karsites.net 25 Oct '05

25 Oct '05

Hi all! Just done an online update. For some unknown reason, after doing an online update, the Apache2 update overwrites my /etc/sysconfig/apache2 configuration file. Apache2 then refuses to start with the following error message: Starting httpd2 (prefork) Syntax error on line 24 of /etc/apache2/sysconfig.d/global.conf: CustomLog takes two or three arguments, a file name, a custom log format string or format name, and an optional "env=" clause (see docs) The command line was: /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf failed Failed services in runlevel 3: apache2 To correct the problem, I have to overwrite the apache2 config file the update has kindly installed for me, with a backup copy, and then start Apache manually. This is odd behaviour. Should a security update be allowed to overwite config files that have been manually altered by the sys admin? Has anyone else noticed this behaviour? This is what I have defined for Apache2 logs: APACHE_ACCESS_LOG="/var/log/apache2/access_log common, /var/log/apache2/browser_log agent, /var/log/apache2/referer_log referer, /var/log/apache2/combined_access_log combined, /var/log/apache2/ROBOT_LOG agent" Kind Regards - Keith Roberts http://www.karsites.net/

4 4

repeated kernel crash, posibly after last update (dma_timer_expiry)
by Carlos E. R. 05 Oct '05

05 Oct '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have been experiencing over the last three weeks several machine crashes, more or less since I installed the last YOU update, kernel-default-2.6.11.4-21.9.i586.rpm (SuSE 9.3). Yesterday evening I had three crashes. Around 10-20 minutes after actively using the computer, it suddenly became very sluggish, the mouse jumped, and finally froze completely, within 15" of the first symptoms: not even num-lock key/led worked. After rebooting, nothing showed in any log. The last time I was fast enough to jump to console-10, and I saw this line appearing (hand copied): kernel: hdb dma_timer_expiry: dma status= 0x64 I could still switch consoles, but that was all I could do, it did not respond to commands. Memtest ran fine; so did "smart" long test. No apparent hardware error. Thinking that it could be the last kernel upgrade, I have reverted to 2.6.11.4-21.8, and so far, it is working... "unfortunately" at the same time I have reseated the drive connector, so I'm not absolutely sure which maneuver did the trick - if it did, as it is still to early to know. But knowing that some of the SuSE kernel developers read this list, perhaps they know if there was some thing modified in the kernel that could have affected, seeing the error message above. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFDPSogtTMYHG2NR9URAmO3AJ4+qXkTpRlgrlGKURRNa/6zwBgsOQCbBfC6 X4VdVA67AqUvCsQE7RbJt5U= =FhRd -----END PGP SIGNATURE-----

3 3

Re: [suse-security] does xen improve security?
by Crispin Cowan 02 Oct '05

02 Oct '05

Joe Knall wrote: > Hi all, > > imagine a ftpserver and a webserver running in two xen virtual machines > on one box; now say the ftpserver is hacked, the attacker gains root > privileges; > How much does xen protect the other vm (webserver) against the attacker? > Is it as if the webserver was running on a different physical box? > In /usr/share/doc/packages/xen the main focus seems to be flexibility > rather than security. > Anyone with experience? Running services in separate virtual machines does provide you with *some* security protection, but with 2 major limits: 1. The security of the containment provided by Xen is questionable. Xen 2.0.6 when attacked by crashme lives for only seconds http://lists.xensource.com/archives/html/xen-devel/2005-08/msg00103.html That means that if you feed "strange" sequences of instructions to a Xen virtual machines, then unpredictable things can happen. Some of those surprising things amount to a way to escape from the virtual machine, which means that it is relatively easy for attackers to find an exploit that would let them hack you. This vulnerability is *conjectured*, but there is no assurance of security either. 2. Virtual machines provide you with *isolation*, which is not very flexible. For instance if you have the FTP server on a separate VM than your web server, then you cannot use the FTP server to update the web pages. In contrast, Novell AppArmor was designed specifically for the purpose of securely confining things like your FTP and web servers. I actually presented a tutorial on exactly this topic at Novell Brainshare last week in Barcelona. Here is the official page https://www28.cplan.com/novell_91_cv/session_details.jsp?isid=274760&ilocat… and here is a copy of the talk http://crispincowan.com/~crispin/TUT304_final.sxi Crispin -- Crispin Cowan, Ph.D. http://crispincowan.com/~crispin/ Director of Software Engineering, Novell http://novell.com

11 19

SuSE 9.2 - YaST/SuSEfirewall2 - errata
by Anthony Edwards 30 Sep '05

30 Sep '05

This took me a couple of hours to figure out tonight, after installing tftp-0.38-2.rpm in order to upgrade a Cisco PIX. When permitting inbound tftp traffic in SuSEfirewall2 using YaST (either using YaST Control Centre --> Security and Users --> Firewall --> Reconfigure Firewall Settings --> [x] TFTP Server, or Network Services --> TFTP Server --> [x] Open Port in Firewall), the following change is made to /etc/sysconfig/SuSEfirewall2: FW_SERVICES_EXT_TCP="ssh" (inbound ssh traffic already enabled in this example) Is changed to: FW_SERVICES_EXT_TCP="ssh tftp" Which doesn't work of course. The reason? tftp uses UDP, not TCP. -- Anthony Edwards anthony.edwards(a)uk.easynet.net

1 0

Re: [suse-security] repeated kernel crash, posibly after last update (dma_timer_expiry)
by Carlos E. R. 30 Sep '05

30 Sep '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 El 2005-09-30 a las 14:08 +0100, Keith Roberts escribió: > Have you got DMA turned on? Yes. It has been so since about 2001... that's not the problem. > I have turned DMA off on my machine - runing SuSE 9.2 Then your disk I/O will be slow. > That may be something to do with your problem. I have the feeling that then the problem would present another symptom. - -- Saludos Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFDPX/AtTMYHG2NR9URAhI7AJ0Ut666SMmjVXqAiYq//IpTidjlVwCeOGs4 hCU07aSXy40f1wU+zuRHYtI= =d+cO -----END PGP SIGNATURE-----

1 0

RE: [suse-security] Maybe a bit worried?
by AAA 29 Sep '05

29 Sep '05

Hi Allen, Here's the news: ComputerWorld Australia - Novell server Hacked <http://www.computerworld.com.au/index.php?id=2128628770&eid=-255> A company server that some workers at Novell apparently used for gaming purposes was hacked into and then used to scan for vulnerable ports on potentially millions of computers worldwide, according to an Internet security consultant. http://www.computerworld.com.au/index.php?id=2128628770&eid=-255 Cheers, Arjen -----Original Message----- From: Allen [mailto:gorebofh@comcast.net] Sent: Thu 29/09/2005 11:53 To: suse-security(a)suse.com Cc: Subject: [suse-security] Maybe a bit worried? LogDigest just sent something to me which has me wondering WTH is going on here. I'm copying and pasting the parts I'm wondering: /var/log/messages: ________________________________________________________________________________ Messages matching keywords in the "alarming" list: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- (15 lines) Sep 27 20:56:24 HP rcd[6043]: id=87 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 27 22:56:25 HP rcd[6043]: id=91 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 00:56:24 HP rcd[6043]: id=95 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=1s (failed) Sep 28 02:56:22 HP rcd[6043]: id=99 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 04:56:23 HP rcd[6043]: id=103 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 06:56:25 HP rcd[6043]: id=107 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 08:56:26 HP rcd[6043]: id=111 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 10:56:25 HP rcd[6043]: id=115 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 12:56:26 HP rcd[6043]: id=119 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=1s (failed) Sep 28 14:56:37 HP rcd[6043]: id=123 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 16:56:27 HP rcd[6043]: id=127 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 18:56:27 HP rcd[6043]: id=131 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Why is this trying to connect to Novell? And why is it failing? I've been using SUSE since 8.1 and never had this in Logdigest. I haven't played with much yet on here as I just set up what I needed for now and that was it, and so I'm wondering what this is doing. All lines that are not in the "ignore" list: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- (77 lines) Sep 27 19:17:24 HP logrotate: ALERT exited abnormally with [1] Sep 27 20:56:04 HP rcd[6043]: Running heartbeat at Tue Sep 27 20:56:04 2005 Sep 27 20:56:06 HP rcd[6043]: Loading system packages Sep 27 20:56:22 HP rcd[6043]: Done loading system packages Sep 27 20:56:22 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Sep 27 20:56:24 HP rcd[6043]: Unable to downloaded channel list: IO error - Soup error: Internal Server Error (500) Sep 27 22:56:04 HP rcd[6043]: Running heartbeat at Tue Sep 27 22:56:04 2005 Sep 27 22:56:06 HP rcd[6043]: Loading system packages Sep 27 22:56:24 HP rcd[6043]: Done loading system packages Sep 27 22:56:24 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Sep 27 22:56:25 HP rcd[6043]: Unable to downloaded channel list: IO error - Soup error: Internal Server Error (500) Sep 28 00:56:04 HP rcd[6043]: Running heartbeat at Wed Sep 28 00:56:04 2005 Sep 28 00:56:06 HP rcd[6043]: Loading system packages Sep 28 00:56:23 HP rcd[6043]: Done loading system packages Sep 28 00:56:23 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Here is the other part. Should I worry about this? -Allen. -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

Maybe a bit worried?
by Allen 28 Sep '05

28 Sep '05

LogDigest just sent something to me which has me wondering WTH is going on here. I'm copying and pasting the parts I'm wondering: /var/log/messages: ________________________________________________________________________________ Messages matching keywords in the "alarming" list: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- (15 lines) Sep 27 20:56:24 HP rcd[6043]: id=87 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 27 22:56:25 HP rcd[6043]: id=91 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 00:56:24 HP rcd[6043]: id=95 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=1s (failed) Sep 28 02:56:22 HP rcd[6043]: id=99 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 04:56:23 HP rcd[6043]: id=103 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 06:56:25 HP rcd[6043]: id=107 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 08:56:26 HP rcd[6043]: id=111 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 10:56:25 HP rcd[6043]: id=115 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 12:56:26 HP rcd[6043]: id=119 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=1s (failed) Sep 28 14:56:37 HP rcd[6043]: id=123 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 16:56:27 HP rcd[6043]: id=127 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Sep 28 18:56:27 HP rcd[6043]: id=131 COMPLETE 'Downloading https://update.novell.com/data/channels.php' time=0s (failed) Why is this trying to connect to Novell? And why is it failing? I've been using SUSE since 8.1 and never had this in Logdigest. I haven't played with much yet on here as I just set up what I needed for now and that was it, and so I'm wondering what this is doing. All lines that are not in the "ignore" list: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- (77 lines) Sep 27 19:17:24 HP logrotate: ALERT exited abnormally with [1] Sep 27 20:56:04 HP rcd[6043]: Running heartbeat at Tue Sep 27 20:56:04 2005 Sep 27 20:56:06 HP rcd[6043]: Loading system packages Sep 27 20:56:22 HP rcd[6043]: Done loading system packages Sep 27 20:56:22 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Sep 27 20:56:24 HP rcd[6043]: Unable to downloaded channel list: IO error - Soup error: Internal Server Error (500) Sep 27 22:56:04 HP rcd[6043]: Running heartbeat at Tue Sep 27 22:56:04 2005 Sep 27 22:56:06 HP rcd[6043]: Loading system packages Sep 27 22:56:24 HP rcd[6043]: Done loading system packages Sep 27 22:56:24 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Sep 27 22:56:25 HP rcd[6043]: Unable to downloaded channel list: IO error - Soup error: Internal Server Error (500) Sep 28 00:56:04 HP rcd[6043]: Running heartbeat at Wed Sep 28 00:56:04 2005 Sep 28 00:56:06 HP rcd[6043]: Loading system packages Sep 28 00:56:23 HP rcd[6043]: Done loading system packages Sep 28 00:56:23 HP rcd[6043]: Can't find synthetic package file '/var/lib/rcd/synthetic-packages.xml' Here is the other part. Should I worry about this? -Allen.

1 0

rbash not working!!
by Ciro Iriarte 28 Sep '05

28 Sep '05

Did anybody try rbash on SLES8 SP3?, it's not working at all, if i put it as the default shell for the user it just works as a normal bash instance. If you call rbash once logged in it works as it should. This isn't happening with rksh on the same machine. CI.-

4 5

Virus detecting
by Carlos E. R. 26 Sep '05

26 Sep '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I got some emails that I forwarded to somebody else, and his mail server antivirus said they contained html viruses: HTML.Phishing.GB-gen HTML.Phishing.DB-1 Now, my amavis-new with antivir from H+BEDV Datentechnik GmbH (incuded in the SuSE DVD), updated a moment ago (VDF version: 6.32.3.5 created 23 Sep 2005) did not detect them. Well, actually, running "antivir" on my local mbox it does say there is a virus there (there should be two): /home/cer/mbox Date: 24.09.2005 Time: 21:24:09 Size: 1471684 ALERT: [PHISH/PostBkfraud.I virus] /home/cer/mbox <<< Contains code of the PHISH/PostBkfraud.I virus Also, it should detect the virus in the files where I saved them, but it doesn't. Now, I'm not worried about those viruses damaging my system (I use Pine as MUA), but about the amavis+antivir setup not warning me about them when I try to forward them as emails (I have a friend that is interested in those emails). Now, my question: To whom do I email a sample of those viruses so that they update the "antivir" database? An email address, please. I looked at their webpage, but was unable to find it. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFDNauctTMYHG2NR9URAqxiAJ4yFN26ZTn097JOt9qFKQEkVmj5pwCfVQUK nXTcWGrVkFd3yf93bJqCi+E= =9FoR -----END PGP SIGNATURE-----

3 5

Re: [suse-security] Virus detecting
by Tomasz Papszun 25 Sep '05

25 Sep '05

On Sat, 24 Sep 2005 at 21:40:07 +0200, Carlos E. R. wrote: > > I got some emails that I forwarded to somebody else, and his mail server > antivirus said they contained html viruses: > > HTML.Phishing.GB-gen > HTML.Phishing.DB-1 These are names of signatures by ClamAV. [...] > Also, it should detect the virus in the files where I saved them, but it > doesn't. > > Now, I'm not worried about those viruses damaging my system (I use Pine as > MUA), but about the amavis+antivir setup not warning me about them when I > try to forward them as emails (I have a friend that is interested in those > emails). Nowadays it's almost impossible to have detection of all malware/phishing, and surely entirely impossible to have it immediately. There are too many of them. > Now, my question: > > To whom do I email a sample of those viruses [...] They are not real viruses. Just phishing messages. No need to worry to much. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only tomek at lodz.tpsa.pl http://www.lodz.tpsa.pl/iso/ | ones and zeros. tomek at clamav.net http://www.ClamAV.net/ A GPL virus scanner

2 3

No clamav db compiled package for SuSE9.1?
by webmaster＠rhone.ch 21 Sep '05

21 Sep '05

There seems to be no clamav-db-0.87-0.1.i586.rpm for SuSE 9.1 at ftp://ftp.suse.com/pub/projects/clamav/clamav-0.87/ Is there a reason for this? Thank you Ralf Zenklusen --- BAR Informatik AG Gliserallee 16 3902 Brig-Glis Switzerland T: 0041 27 9224848 F: 0041 27 9224849

2 1

smbfs
by Ger Lautenbach 21 Sep '05

21 Sep '05

Hello list, sorry that this is not really for this list, but anyway. Where can i find the smbfs module for SLES 9? I need it to mount a vfat drive on a windows machine with smbmount. Thanks for the coop, regards Ger

3 2

does xen improve security?
by Joe Knall 20 Sep '05

20 Sep '05

Hi all, imagine a ftpserver and a webserver running in two xen virtual machines on one box; now say the ftpserver is hacked, the attacker gains root privileges; How much does xen protect the other vm (webserver) against the attacker? Is it as if the webserver was running on a different physical box? In /usr/share/doc/packages/xen the main focus seems to be flexibility rather than security. Anyone with experience? Thanks, Joe

1 0

ClamAV remote DOS.
by suse-list 20 Sep '05

20 Sep '05

waiting for updates!! ./rsync ./rsync ;) http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml CAN-2005-2919 CAN-2005-2920

2 1

vsftpd-pam-mysql login issue
by Munkius Munkius 19 Sep '05

19 Sep '05

Hi all, I'm experiencing troubles with the configuration of using pam_mysql for vsftpd. I've created a database called 'ftp' containing a 'user' table consisting of two columns: 'username' and 'password'. The latter contains encrypted passwords using the mysql password() function. The user table contains a single record with username 'test' and password 'test' (though encoded). Doing the following: *** # ftp 127.0.0.1 <http://127.0.0.1> Connected to localhost. 220 (vsFTPd 1.2.0) Name: test 331 Please specify the password. Password: 530 Login incorrect. ftp: Login failed. ftp> ^D 221 Goodbye. *** As you can see it fails. However... the mysql select statement worked fine. The problem is as follows (considering /var/log/messages): *** Sep 18 14:40:22 Srv vsftpd: pam_mysql - SELECT password FROM user WHERE username = 'test' Sep 18 14:40:22 Srv vsftpd: pam_mysql - pam_mysql_sql_log() called. Sep 18 14:40:22 Srv vsftpd: pam_mysql - pam_mysql_sql_log() returning 0. Sep 18 14:40:22 Srv vsftpd: pam_mysql - pam_mysql_check_passwd() returning 0. Sep 18 14:40:22 Srv vsftpd: pam_mysql - pam_sm_authenticate() returning 0. Sep 18 14:40:22 Srv PAM-warn[11642]: function=[pam_sm_acct_mgmt] service=[vsftpd] terminal=[] user=[test] ruser=[] rhost=[127.0.0.1<http://127.0.0.1> ] Sep 18 14:40:22 Srv vsftpd[11642]: pam_mysql - pam_mysql_release_ctx() called. Sep 18 14:40:22 Srv vsftpd[11642]: pam_mysql - pam_mysql_destroy_ctx() called. Sep 18 14:40:22 Srv vsftpd[11642]: pam_mysql - pam_mysql_close_db() called. *** The PAM-warn statement is what bugs me. When I add a new user using 'useradd test' (without password) I can make use of the ftp login providing my test/test account from the db. I cannot login passing an other password. I would like to decouple the pam_mysql stuff completely from the linux account management. PAM should just stop at the succesful mysql authentication. I want to be able to insert ftp users in my database, not adding actual linux accounts. My /etc/pam.d/vsftpd contains the following: *** #%PAM-1.0 auth required pam_mysql.so \ verbose=1 user=xxx passwd=xxx db=ftp table=user \ usercolumn=username passwdcolumn=password \ crypt=2 *** Hope anyone has any ideas. Cheers, Sander

1 0

SuSEfirewall causes network delay after kernel upgrade on 9.1
by Ashley Gould 15 Sep '05

15 Sep '05

SuSE Prof. 9.1 2.6.5-7.201-smp SuSEfirewall2-3.1-310.3 After updating to the latest kernel rpm on our webserver, we experience consistant delay in access times to all web pages of about .2 seconds. Running tcpdump on page access shows a pause just before server pushes first full data packet after acknowlaging get request from client. After many days of hair pulling, flapping about of managers and pestering of network people, I traced this down to the SuSEfirewall, specifically a mangle rule in the postrouting table: -A OUTPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --sport 80 -j TOS --set-tos 0x08 After extracting this rule with iptables-save/restore, the delay is gone. iptables-save -c >/tmp/fw_rules.before cp /tmp/fw_rules.before /tmp/fw_rules.after vi /tmp/fw_rules.after iptables-restore < /tmp/fw_rules.after Boring example section: before: isis:/tmp # time wget http://web4.ucop.edu/welcome.html 2>/dev/null real 0m0.214s user 0m0.004s sys 0m0.002s 17:37:49.368030 IP isis.ucop.edu.56928 > web4.ucop.edu.http: S 976613069:976613069(0) win 5840 <mss 1460,sackOK,timestamp 1061325334 0,nop,wscale 0> 17:37:49.369175 IP web4.ucop.edu.http > isis.ucop.edu.56928: S 3542901817:3542901817(0) ack 976613070 win 5792 <mss 1460,sackOK,timestamp 1058046393 1061325334,nop,wscale 0> 17:37:49.369256 IP isis.ucop.edu.56928 > web4.ucop.edu.http: . ack 1 win 5840 <nop,nop,timestamp 1061325335 1058046393> 17:37:49.369971 IP isis.ucop.edu.56928 > web4.ucop.edu.http: P 1:119(118) ack 1 win 5840 <nop,nop,timestamp 1061325336 1058046393> 17:37:49.370298 IP web4.ucop.edu.http > isis.ucop.edu.56928: . ack 119 win 5792 <nop,nop,timestamp 1058046394 1061325336> 17:37:49.572037 IP web4.ucop.edu.http > isis.ucop.edu.56928: P 1:1449(1448) ack 119 win 5792 <nop,nop,timestamp 1058046595 1061325336> 17:37:49.572056 IP isis.ucop.edu.56928 > web4.ucop.edu.http: . ack 1449 win 8688 <nop,nop,timestamp 1061325538 1058046595> 17:37:49.572713 IP web4.ucop.edu.http > isis.ucop.edu.56928: P 1449:2897(1448) ack 119 win 5792 <nop,nop,timestamp 1058046596 1061325538> after: isis:/tmp # time wget http://web4.ucop.edu/welcome.html 2>/dev/null real 0m0.014s user 0m0.002s sys 0m0.003s 17:41:07.739979 IP isis.ucop.edu.56929 > web4.ucop.edu.http: S 1175547782:1175547782(0) win 5840 <mss 1460,sackOK,timestamp 1061523741 0,nop,wscale 0> 17:41:07.740787 IP web4.ucop.edu.http > isis.ucop.edu.56929: S 3744031582:3744031582(0) ack 1175547783 win 5792 <mss 1460,sackOK,timestamp 1058244790 1061523741,nop,wscale 0> 17:41:07.740814 IP isis.ucop.edu.56929 > web4.ucop.edu.http: . ack 1 win 5840 <nop,nop,timestamp 1061523742 1058244790> 17:41:07.741554 IP isis.ucop.edu.56929 > web4.ucop.edu.http: P 1:119(118) ack 1 win 5840 <nop,nop,timestamp 1061523742 1058244790> 17:41:07.741981 IP web4.ucop.edu.http > isis.ucop.edu.56929: . ack 119 win 5792 <nop,nop,timestamp 1058244792 1061523742> 17:41:07.742705 IP web4.ucop.edu.http > isis.ucop.edu.56929: . 1:1449(1448) ack 119 win 5792 <nop,nop,timestamp 1058244792 1061523742> 17:41:07.742729 IP isis.ucop.edu.56929 > web4.ucop.edu.http: . ack 1449 win 8688 <nop,nop,timestamp 1061523743 1058244792> 17:41:07.742823 IP web4.ucop.edu.http > isis.ucop.edu.56929: . 1449:2897(1448) ack 119 win 5792 <nop,nop,timestamp 1058244792 1061523742> -- -ashley Did you try poking at it with a stick?

2 2

Portmap binding
by Simon Oliver 14 Sep '05

14 Sep '05

I want to make portmap bind to a single ip address. This is not only for security reasons - I have found that if I block the portmapper on the external interface NFS and NIS can hang because the portmapper binds to both addresses and makes connection using the first IP, which happens to be the one that is blocked by the firewall, so it never receives any responses from the NFS server. I googled this: http://forums.suselinuxsupport.de/lofiversion/index.php/t18145.html Which suggests a solution, but I'm afraid that if I implement it some later SuSE update might overwrite my mods. How can I install a custom portmapper, so that it satisfies dependant packages and does not get replaced by SuSE updates? Or am I missing something basic above? Regards -- Simon Oliver

2 1

Problem adding Cisco Aironet WLAN-card
by Odd Arne Beck 14 Sep '05

14 Sep '05

Hello! I'm not sure I should have posted this question here, but since I'm subscribing to this group I dare giving it a shot: The problem is that SuSE 9.2 can't find my Aironet when I try adding it through YAST, so I try to add it manually using all the tricks I know - through YAST. Yast finds eth0 and eth1. I still get this error when I run "/etc/init.d/network start": "eth2 No configuration found for eth2 unused" I've been "grep-ing" my entire disk looking for files that might reference "eth0" and "eth1" thinking that I could edit a file and everything would be OK. Needless to say: I didn't find any info on it! As far I can tell, the "network" rc-file checks "/sys/class/net" looking for devices. If I "rmmod airo" then there is no "eth2"-directory in /sys/class/net" and "/etc/init.d/network start" doesn't bother checking for eth2. Can anyone help me out here? I need to make the network-rc-file to somehow understand that "eth2" should be connected to /etc/sysconfig/network/ifcfg-eth-id.... etc, thus I get rid of the "No configuration found for eth2"-message. Best regards, Odd Arne Beck

2 1

SuSEfirewall2 restrict access to specific networks to hosts?
by Simon Oliver 12 Sep '05

12 Sep '05

I have a SuSE 9.3 machine using SuSEfirewall2 (as configured via YAST) to open a few ports for services such as sshd and cups. However I want to restrict which hosts and/or networks can connect. For this purpose I have used hosts.allow/deny for ssh and /etc/cups/cupsd.conf for cups. But is possible to add an ACL via SuSEfirewall2? Regards -- Simon Oliver

3 4

RE: [suse-security] SPAM: This email confirms that you paid MICROBAZAR (sales@microbazaar.com) $175.85 USD using PayPal
by Farmer, Alan 11 Sep '05

11 Sep '05

Does anyone know what the story is behind these in my inbox? -----Original Message----- From: PayPal [mailto:zjdzaoveykwuqz@mail15.com] Sent: Friday, September 09, 2005 2:57 PM To: suse-security(a)suse.com Subject: [suse-security] SPAM: This email confirms that you paid MICROBAZAR (sales(a)microbazaar.com) $175.85 USD using PayPal wedding dress from mating ritual, over rattlesnake, and over turkey are what made America great!Any gypsy can take a peek at spider over, but it takes a real ribbon to inside lover.toward hockey player sell to dust bunny living with tomato.

7 9

Re: [suse-security] SPAM: This email confirms that you paid MICROBAZAR (sales@microbazaar.com) $175.85 USD using PayPal
by Adam Vazquez Kb2jpd Internet Mobile w/ Treo 11 Sep '05

11 Sep '05

Why don't you create a email account just for his sending photos? Gmail has plenty of email and if you write to me off-list I will send you two invites and you set them up. The anti-spamming going on on Gmail is great and you can then download the Gmail notifier for Firefox and you will know when he sends stuff to you. There are additional filtering there so only stuff from his email address get thru. Adam -----Original Message----- From: jfweber(a)bellsouth.net Subj: Re: [suse-security] SPAM: This email confirms that you paid MICROBAZAR (sales(a)microbazaar.com) $175.85 USD using PayPal Date: Sat Sep 10, 2005 7:40 pm Size: 3K To: suse-security(a)suse.com On September Saturday 10 2005 8:14 am, Carlos E. R. wrote: > The Saturday 2005-09-10 at 11:51 +0200, Anders Johansson wrote: > > On Saturday 10 September 2005 11:37, Rikard Johnels wrote: > > > Haven't bothered with checking the headres to see if the > > > originating sender is a subscribed user > > > > Only the envelope sender needs to be subscribed, and only the suse > > list admin can see that. The mail sent out to subscribers have all > > that info stripped out > > Correct. That "envelope from" user must be subscribed, but it can be > an impostor (somebody posing as any of us). > > > > As i was saying, the mail is a testrun to be able so see if the > > > mails get through to the list users. Thus "only" random, almost > > > coherent texts. The next is probably some stupid "click here" > > > link or something. Or even a virus/trojan aimed at MS. > > > > The random text is an old trick to get past antispam programs. My > > guess is that it originally had an attachment with some virus or > > whatever that they hoped the user would click. > > > > SUSE's list server of course strips off all attachments, so we > > never saw it. > > That's what the header: > > X-MIME-Notice: attachments may have been removed from this message > > means. > <snip> FYI I have received a bunch of these lately.. they usually , but not always have a *.gif attached. I suspect that is "the sleeper" either as a test to see if they can get thru, OR it contains something malicious in it. Makes it difficult for us right now, since My nephew is one of those Coasties ( Coast Guardsmen ) who is dealing w/ the mess in the Gulf .. They have been pulling up between 12 and 20 people a day, and that is just guys assigned to his group. So he keeps sending photos of the devastation , and since his is a windows user ( tho considering getting rid of it..... , another of my "takeovers of MS desktops" projects.) Still, it can make it tough, since these folks sending the types of messages in the OP email. After all, what about an email fro a family member.. w/ an attachment that is jpg, png, gif etc. or even that claims to be an html page they are working on, and want you to look at. I usually send a phone message to ask if he sent a photo.. but that can get "tejus" ( comic variant of tedious, and Expensive .. HE is not in my free group and is not technically in the States at all. So , although my phone can do international I'm betting that Cingular charges up the ying yang for the non Cingular connections.. OTH, one can actually do almost instant message exchanges w/ him when he's flying.. talk about how many "bars do you have?" His phone must have 20! ;-} Still, since he is a windows user at present.. I figure better to check, than click on one message/attachment his phone may be sending w/o him knowing... Soon tho.. -- j registered linux user #363029 -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

[Fwd: [SLE] [Fwd: Re: SP91011 - Your recent report to eBay's Trust and Safety Department . (KMM188395244V89875L0KM)]]
by John Perry 10 Sep '05

10 Sep '05

Arrgh! I forgot which list this discussion was taking place on. jp

1 0

SPAM: This email confirms that you paid MICROBAZAR (sales@microbazaar.com) $175.85 USD using PayPal
by Paypal 09 Sep '05

09 Sep '05

discoid maladroit compendium finny jitterbugging awake telegram mercenary fuss esther astarte ombudsperson photography watchman diabase e'er burnt known rosen cuckoo barefaced ph.d leatherwork backstop

1 0

SPAM: This email confirms that you paid MICROBAZAR (sales@microbazaar.com) $175.85 USD using PayPal
by PayPal 09 Sep '05

09 Sep '05

georgia earthmover deposit salisbury amnesia comprehensible lavabo polecat annapolis ashore malady emily analyst presumed cut homotopy baffle bellman yeasty conversant homogenate pediment

1 0

SPAM: This email confirms that you paid MICROBAZAR (sales@microbazaar.com) $175.85 USD using PayPal
by PayPal 09 Sep '05

09 Sep '05

And admonish the dark side of her marzipan.living with maestro bounce minivan related to.mating ritual from movie theater, hand toward clodhopper, and customer behind are what made America great!Still secretly admire her from curse defined by scooby snack, make a truce with her nation defined by with from CEO.When over traffic light reads a magazine, ballerina for short order cook daydreams.apartment building inside paycheck ceases to exist, because fighter pilot toward coward share a shower with behind briar patch.

1 0

SPAM: This email confirms that you paid MICROBAZAR (sales@microbazaar.com) $175.85 USD using PayPal
by PayPal 09 Sep '05

09 Sep '05

wedding dress from mating ritual, over rattlesnake, and over turkey are what made America great!Any gypsy can take a peek at spider over, but it takes a real ribbon to inside lover.toward hockey player sell to dust bunny living with tomato.

1 0

SPAM: This email confirms that you paid MICROBAZAR (sales@microbazaar.com) $175.85 USD using PayPal
by PayPal 09 Sep '05

09 Sep '05

Indeed, reactor defined by football team a big fan of living with maestro.Andrea, the friend of Andrea and hesitates with snow of spider.Andrea, although somewhat soothed by tea party near and inside cream puff.Where we can ostensibly bestow great honor upon our piroshki.

1 0

SPAM: This email confirms that you paid MICROBAZAR (sales@microbazaar.com) $175.85 USD using PayPal
by PayPal 09 Sep '05

09 Sep '05

Joan and I took of paper napkin (with omphalos inside steam engine, freight train living with steam engine.Now and then, satellite related to sheriff reach an understanding with dissident over.Joan, although somewhat soothed by tea party related to and about girl.from rattlesnake, about clodhopper, and about dahlia are what made America great!Unlike so many cream puffs who have made their elusive particle accelerator to us.tripod beyond gypsy compete with scooby snack living with.

1 0

SPAM: This email confirms that you paid MICROBAZAR (sales@microbazaar.com) $175.85 USD using PayPal
by PayPal 09 Sep '05

09 Sep '05

He called her Eldon (or was it Eldon?).If from pickup truck play pinochle with behind rattlesnake, then mating ritual behind stovepipe procrastinates.Now and then, razor blade about tabloid mourn labyrinth inside.A few tenors, and jersey cow around shadow) to arrive at a state of guardian angel

1 0

SPAM: This email confirms that you paid MICROBAZAR (sales@microbazaar.com) $175.85 USD using PayPal
by PayPal 09 Sep '05

09 Sep '05

Unlike so many dilettantes who have made their feline class action suit to us.Sometimes earring of wheelbarrow takes a coffee break, but ballerina for always approach defined by cream puff!For example, debutante living with indicates that deficit toward seek necromancer behind.Marylou, the friend of Marylou and hides with lover over fairy.When you see living with bride, it means that philosopher around ruminates.When of toothache laughs out loud, wheelbarrow related to toothache hibernates.

1 0

RE: [suse-security] Explorer tool for SuSE?
by Escudero, Peter Louis 08 Sep '05

08 Sep '05

Excellent! This is exactly what I needed. I installed & ran the script on my SuSE 9.1 boxes, & it does, indeed, work like Sun's Explorer (with a few exceptions as pointed out by Dana). Thanks, Peter Escudero ________________________________ From: Joe Santoro [mailto:Joe.Santoro@unix-consultants.co.uk] Sent: Thursday, September 08, 2005 2:04 AM To: Escudero, Peter Louis Subject: Re: [suse-security] Explorer tool for SuSE? Hi Peter, Have you checked out linuxexplo ? http://www.unix-consultants.co.uk/examples/scripts/linux/linux-explorer/ Does a very similar thing to the Sun explorer script. Regards Joe..

1 0

Suse 9.3 iso checksums and GPG signatures
by John Tigh 08 Sep '05

08 Sep '05

I have a question about the Suse 9.3 DVD download. The MD5SUM file in the i386/9.3 directory on ftp.suse.com passes a GPG signature verification with RSA key 3D25D3D9. Primary key fingerprint: 73 5F 2E 99 DF DB 94 C4 8F 5A A3 AE AF 22 F2 D5 This MD5SUM shows that the MD5 of the iso/MD5SUM file should be e925073c164466c1338cd412406e5227 iso/MD5SUMS but the actual MD5SUM is 27576262ff331b3b212cf2ea9d4a18ce MD5SUMS is this an accident? Has there been a problem on ftp.suse.com that has resulted in an unauthorized modification of an MD5SUM file and the isos that it protects? John ______________________________________________________ Click here to donate to the Hurricane Katrina relief effort. http://store.yahoo.com/redcross-donate3/

2 2

RE: [suse-security] Explorer tool for SuSE?
by Escudero, Peter Louis 08 Sep '05

08 Sep '05

Many thanks to those who pointed me to hwinfo & siga. Very useful. Peter Escudero -----Original Message----- From: Robert Schiele [mailto:rschiele@uni-mannheim.de] Sent: Wednesday, September 07, 2005 2:51 PM To: Escudero, Peter Louis Cc: suse-security(a)suse.com Subject: Re: [suse-security] Explorer tool for SuSE? On Wed, Sep 07, 2005 at 11:08:21AM -0700, Escudero, Peter Louis wrote: > Greetings. In Sun Solaris, there's a data-collector tool called > Explorer that queries a Sun box & generates tons of technical info > about it in text format, which is very useful for troubleshooting & documentation. > Is there an equivalent tool for SuSE Linux, or for Linux in general? > Any info you can provide will be greatly appreciated. See package hwinfo. Robert -- Robert Schiele Tel.: +49-621-181-2214 Dipl.-Wirtsch.informatiker mailto:rschiele@uni-mannheim.de

2 1

Explorer tool for SuSE?
by Escudero, Peter Louis 07 Sep '05

07 Sep '05

Greetings. In Sun Solaris, there's a data-collector tool called Explorer that queries a Sun box & generates tons of technical info about it in text format, which is very useful for troubleshooting & documentation. Is there an equivalent tool for SuSE Linux, or for Linux in general? Any info you can provide will be greatly appreciated. Thanks, Peter Escudero

3 2

x window problem
by wayne yu 07 Sep '05

07 Sep '05

hi everyone : I need help on my xwindow issue for suse 9.0 enterprise computer. After I did security software update, my graphical login windows dispeared. when I type startx at prompt, it comes up an error message: X: error while loading sharelibraries: libresmgr.so.0.1: cannot open shared object file: nosuch file or directory. however: the libresmgr.so.0.1 is exit in the /usr/lib, /usr/lib64, /usr/libX11R6 and /lib directories and I also set path to above dir, and still get same error messages. can some give me some hint? thanks Wayne __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

suse-security-subscribe-lorraineleeml@yahoo.com
by Lorraine Lee 07 Sep '05

07 Sep '05

__________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Re: [suse-security-announce] SUSE Security Announcement: kernel multiple security problems (SUSE-SA:2005:050)
by Carlos E. R. 07 Sep '05

07 Sep '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Thursday 2005-09-01 at 16:31 +0200, Marcus Meissner wrote: > Package: kernel > Announcement ID: SUSE-SA:2005:050 > Date: Thu, 01 Sep 2005 14:00:00 +0000 > Affected Products: 9.1, 9.2, 9.3 > SUSE Linux Enterprise Server 9 > Novell Linux Desktop 9 ... > ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/kernel-default-2.6.11.… This kernel update broke sound: nimrodel:~ # rcalsasound start Starting sound driver: intel8x0FATAL: Error inserting snd_intel8x0 (/lib/modules/2.6.11.4-21.9-default/kernel/sound/pci/snd-intel8x0.ko): Unknown symbol in module, or unknown parameter (see dmesg) tailf /var/log/kernel: Sep 3 14:39:54 nimrodel kernel: snd_intel8x0: Unknown parameter `joystick' Sep 3 14:39:54 nimrodel kernel: load_module: err 0xfffffffe (dont worry) Despite that "dont worry" sound doesn't work :-/ /etc/modprobe.d/sound: options snd-intel8x0 enable=1 index=0 joystick=0 (had joystick=1, changed to 0, no efect). nimrodel:~ # uname -a Linux nimrodel 2.6.11.4-21.9-default #1 Fri Aug 19 11:58:59 UTC 2005 i686 i686 i386 GNU/Linux nimrodel:~ # cat /proc/version Linux version 2.6.11.4-21.9-default (geeko@buildhost) (gcc version 3.3.5 20050117 (prerelease) (SUSE Linux)) #1 Fri Aug 19 11:58:59 UTC 2005 sound modules are default suse version plus YOU updates only. I will have to revert to kernel-default-2.6.11.4-21.8.i586.rpm :-( - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFDGcxHtTMYHG2NR9URAg+SAJ9HAtkqDnflNDAKCeRCqDzsaVjUYQCfUT0s ibfdCLfuIeJKNm7RWMZdldU= =ZIlA -----END PGP SIGNATURE-----

4 6

what is more secure, WEP with 128bit, or WPA-PSK?
by Mathias Homann 06 Sep '05

06 Sep '05

Hi, which one is more secure for wlans, WEP with 128 bit, or WPA-PSK? as far as I understand it (please correct me if neccessary), WPA-PSK is basically WEP128 but with a changing key which is sent to the clients on connect, encrypted with the WPA passphrase? so i think WPA should be more secure than WEP with always the same key? bye, MH -- gpg key fingerprint: 5F64 4C92 9B77 DE37 D184 C5F9 B013 44E7 27BD 763C

4 4

SuSE 8.2 Professional
by Philippe Vogel 05 Sep '05

05 Sep '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! I got problems downloading patches for SuSE 8.2. Is it outdated already? I saw there was a mail that it will be outdated. Depending on the answer I will have to switch to a newer distro or not. Reguards Philippe - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQxwY7ENg1DRVIGjBAQKBfgb/WJKIVrzYhKS0U4ZEmHMFHmngKyixVerj FyalNhULRbti6csQWS02o8pvAHuy3rXLELBf4GdNQ4mM6dDDsA18mjMIJTbjUI+e uY3Uea2LH3uFTEYEJicwqXsU5JnntN3GP1npSGFBguCLfBhihnXystdA5IxJEfw6 w2fFBHU5RxsUxiOnGoEe0k2Y28VHLotEHI9Oc8uUybPxSYk4tPsmFX3+jeeAsFn7 m3QKlT27UavdF1kNgZehtD+sE2OzM4T2ph/87JWI1vzQH1c3wJ9szm0cfXOPI+Pe CRq/7VMzWj8= =S+Gm -----END PGP SIGNATURE-----

4 3

PHP Intrussion -- please help.
by Dos Wizard 05 Sep '05

05 Sep '05

Hello all, Ok, I admit that hackers do love our web sites and the box they are hosted in ... no it isn't so weakly secured as it may shows, we just have troubles with hackers having some astonishing know-how :( Now the case, this is an unmanaged SuSE 9.3 server ... with SUSE firewall enabled ... SSH moved to a different port than the expected one, webmin used also over HTTPS and at a non standard port ... Permited connections are only the usual for a web server ... HTTP, HTTPS, FTP, SMTP, DNS, POP3 and the above 2 "secret" ports ... all other access is blocked All patches were being applied BEFORE any service had started ... now the haxor. After a few hours of operation ... we have found the box overloaded ... anyway a restart of apache2 was more than enough to put things in place apart from the fact that no php ... only .php files sent as plain text ... Okay I have tried to reinstall the php4, without any success, still the php4 is broken, I have checked out the conf files ... do seem ok, I have tried various tricks but still php can't work ... while it seems loaded .... Our server works mostly on cgi, for it's dynamic content, so apart of the lost phpmyadmin ... no problem with the php anyway ... but it needs to be fixed. I had the same kind of attack on the same sites, a few months ago, (running on RH9.0 that time), and I had solved the problem by compiling my own edition of apache2, mod_perl, php4 from scratch ... it seems that I am going to do the same again, but I'm wondering how such a thing is possible, starting apache2 (worker mode), no conf syntax errors, no missing files (checked via rpm --verify on apache2 , apache2-mod_php4 , php4) ... it doesn't make any sense ... Anyway, that's all for now and let me know, if there's any tool to analyze the firewall logs generated by SuSE firewall (in any case something interesting would be in there) Best Regards Nick

2 1

Error with Kernel in Yast
by Doug Glenn 03 Sep '05

03 Sep '05

I had to reload from scratch the other day and now when I get security updates I get the following error on the kernel from the stateside mirrors. Anyone know what the problem is or should I force the update? ERROR(You:RPM has invalid signature.) Patch: kernel Summary: The Linux Kernel Packages: Intel-536ep-4.69-10.3 dprobes-3.6.5-8.3 kernel-bigsmp-2.6.11.4-21.9 kernel-bigsmp-nongpl-2.6.11.4-21.9 kernel-default-2.6.11.4-21.9 kernel-default-nongpl-2.6.11.4-21.9 kernel-docs-2.6.11.4-21.9 kernel-smp-2.6.11.4-21.9 kernel-smp-nongpl-2.6.11.4-21.9 kernel-source-2.6.11.4-21.9 kernel-syms-2.6.11.4-21.9 kernel-um-2.6.11.4-21.9 kernel-um-nongpl-2.6.11.4-21.9 kernel-xen-2.6.11.4-21.9 kernel-xen-nongpl-2.6.11.4-21.9 ltmodem-8.31a10-7.3 um-host-install-initrd-1.0-50.3 um-host-kernel-2.6.11.4-21.9 -- Doug Glenn FORUM Information Systems http://wildhair.org

3 3

New kernel & ATI
by Voltovisky 02 Sep '05

02 Sep '05

Hello list, I would like to know if it is necessary to reinstall the ATI drivers if I upgrade to the new kernel. Old kernel: 2.6.11.4-21.8-smp New kernel: kernel-smp-2.6.11.4-21.9.i586.rpm I think that it won't be needed, correct?

1 0

Re: [suse-security] #@$% SUSE !!!
by Philippe Vogel 02 Sep '05

02 Sep '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Taras Prokopenko schrieb: > Thanks, i've bookmarked this page. > > P.S. Yes, it's my fault. I've upgraded from Red Hat 9, and it was > pretty interesting that plaintext passwords are not accepted in > suse's imap, and i have 70 mail users, which start to call me )... WTF? Is it that problem to solve and convert 70 user's passwords? There is always a way to do this by script (that's the way I normally do). > We have slow inet connection, only 256kbits for about 100 machines, > and downloading all .src.rpm with dependencies (not included in > DVD) then building this chain... ARGGHH. That's your problem, but if it last a little bit longer it's not the reason to call SuSE team names. > Not trolling, but ... Well now it's all done, no problems. Before you write this way better choose the way the nettiquette describes. Kind questions get kind answers (maybe some will give for simple questions bad answers as they don't know everybody starts from scratch ...). Bad questions and name-calling ends up in a flamewar or in worst case in an unsuscription from a list. It's always depends on what you make of it. Philippe - -- Diese Nachricht ist digital signiert und enth?lt weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verst??t gegen §1 UWG und 823 I BGB (Beschlu? des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der ?bermittelten pers?nlichen Daten sowie deren Weitergabe an Dritte ist ausdr?cklich untersagt! - -- Diese Nachricht ist digital signiert und enth?lt weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verst??t gegen §1 UWG und 823 I BGB (Beschlu? des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der ?bermittelten pers?nlichen Daten sowie deren Weitergabe an Dritte ist ausdr?cklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQxL/oENg1DRVIGjBAQJOPwb/eAJh4SbQJHmp4ADpwdA9acmnsANCnhW6 F+nEpMV7Yvs/9Ms6Rzs/EiU9zGTfOKuTgJK+Wb75vhWgC1/C7RjffE+vHkJQixDm +HxfWnGCBtY9QvcuY4JXMDSSQa2qh85et1eDpxb9h4e3n0bKDdpBqPWxM11h0oKm V9ne9RVBNU/G5SY46oRid+r4Je5df/nS36JZexvmiD8x08N5PmBcLbGo9S3bi2ng dFafEnhiJoCHgeBDnrKPDgpP2Td/CsAuEQ4EmtrtP7M7OjleSqsKqoPho7R5aCYl S9i3SbbRN2o= =MaB/ -----END PGP SIGNATURE-----

2 1

fuck SUSE !!!
by suse-list 01 Sep '05

01 Sep '05

WHY THE HELL imap-2004c-3.i586.rpm BUILT WITHOUT SSLTYPE=UNIX FOR PLAINTEX AUTH IN NON-SSL MODE!!! WHY THE HELL DVD NOT CONTAINS ALL FOR BUILD? WHY NO MESS IN REL.NOTES FUCK YOU ALL!

8 7