June 2006 - openSUSE Security - openSUSE Mailing Lists

Statefull packet inspection in SuSEfirewall2
by pronco＠conae.gov.ar 25 Jul '06

25 Jul '06

Hi, Is it there any way to configure stateful packet inspection rules in SuSEfirewall2 for masquerade networks? When I configure a rule in FW_MASQ_NETS in order to allow traffic from the outside to the DMZ, I also have to configure a rule for responses. Example: Incoming traffic to my web server in a DMZ with private addresses FW_FORWARD_MASQ="0/0,192.168.1.5,tcp,80 I also need to set up the following rules in order to let responses out FW_MASQ_NETS="192.168.1.5/32,0/0,tcp,1024:65535" This rule permits not only established sessions, but additionally it allows my web server to establish connections to the outside world. Dont know why the FW_FORWARD rules are stateful as I want, but FW_MASQ_NETS ones dont. Any suggestion? Is it possible to math the SYN, ACK and FIN TCP bits with SuSEfirewall2? Thanks in advance. Pablo Ronco

4 5

Re: [suse-security-announce] SUSE Security Announcement: freetype2 (SUSE-SA:2006:037)
by Mathias Homann 29 Jun '06

29 Jun '06

Am Dienstag, 27. Juni 2006 14:24 schrieb Thomas Biege: > SUSE Security Announcement > > Package: freetype2, freetype2-devel > SUSE LINUX 9.2 as soon as i recompile the source rpm for suse 9.2 with the ft-smooth-cvs patch from this site: http://www.cs.mcgill.ca/~dchest/xfthack/ freetype just stops working, truetype fonts just aren't displayed anymore... with the source rpm from the DVD it worked fine. that patch gives me much better font display quality than "regular" freetype2, even better than ClearType on windows XP, especially on TFT screens... Any ideas? bye, MH

1 1

Re: [suse-security-announce] SUSE Security Announcement: freetype2 (SUSE-SA:2006:037)
by Carlos E. R. 28 Jun '06

28 Jun '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Tuesday 2006-06-27 at 14:24 +0200, Thomas Biege wrote: ... > 3) Special Instructions and Notes > > Please log out from your window-manager session and log in again > to let all applications restart and load the new code. If you are using 'wdm' instead of the typical kdm, you need to switch to runlevel 3 and then back to 5, because wdm doesn't fully restart even after "ctrl-alt-backspace". Perhaps "rcxdm restart" would work as well. I noticed that using the method posted here by "Bob Vickers" last Jan 10 (# Subject: Re: [suse-security] Patch Noifications). - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFEopQ7tTMYHG2NR9URAl9YAJ48Rti1CUF0tlXbcj7xuGljEkmFEQCeNbNW sNYNj4dVBAX73vlLx+5BT2Y= =9wqn -----END PGP SIGNATURE-----

1 0

Asterisk update?
by Hubertus A. Haniel 28 Jun '06

28 Jun '06

Hi, Is there a reason that there is a new asterisk rpm in the SuSE 9.2 update tree that has been build on the 26th of June with the same version of the rpm build on the 26th of April? On update tree: Name : asterisk Relocations: (not relocatable) Version : 1.0.0.20040814 Vendor: SUSE LINUX AG, Nuernberg, Germany Release : 0.1 Build Date: Mon 26 Jun 2006 19:06:41 BST Install date: (not installed) Build Host: ensslin.suse.de Group : Productivity/Telephony/Servers Source RPM: asterisk-1.0.0.20040814-0.1.src.rpm Size : 11838743 License: GPL, BSD Signature : DSA/SHA1, Mon 26 Jun 2006 19:09:20 BST, Key ID a84edae89c800aca Packager : http://www.suse.de/feedback URL : http://www.asterisk.org Summary : The Asterisk Open Source PBX Description : Asterisk is a complete PBX in software. It provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware. Asterisk provides Voicemail services with Directory, Call Conferencing, Interactive Voice Response, and Call Queuing. It has support for three-way calling, caller ID services, ADSI, SIP and H.323 (as both client and gateway). Documentation is available on the Asterisk homepage (http://www.asterisk.org) and on the Asterisk wiki (http://www.voip-info.org/wiki-Asterisk) Currently installed on my system: Name : asterisk Relocations: (not relocatable) Version : 1.0.0.20040814 Vendor: SUSE LINUX AG, Nuernberg, Germany Release : 0.1 Build Date: Wed 26 Apr 2006 11:05:28 BST Install date: Sun 07 May 2006 11:03:38 BST Build Host: couperin.suse.de Group : Productivity/Telephony/Servers Source RPM: asterisk-1.0.0.20040814-0.1.src.rpm Size : 11838743 License: GPL, BSD Signature : DSA/SHA1, Thu 27 Apr 2006 00:31:03 BST, Key ID a84edae89c800aca Packager : http://www.suse.de/feedback URL : http://www.asterisk.org Summary : The Asterisk Open Source PBX Description : Asterisk is a complete PBX in software. It provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware. Asterisk provides Voicemail services with Directory, Call Conferencing, Interactive Voice Response, and Call Queuing. It has support for three-way calling, caller ID services, ADSI, SIP and H.323 (as both client and gateway). Documentation is available on the Asterisk homepage (http://www.asterisk.org) and on the Asterisk wiki (http://www.voip-info.org/wiki-Asterisk) Regards Hubba

2 2

Puzzled with gawk
by Pablo 28 Jun '06

28 Jun '06

Hello there, I've just found a rather weird problem on my opensuse10.1 box. I've produced a simple awk script and a sample input file which makes gawk crash on my 10.1, while it works as expected on my gentoo. I got also what I would expect on non-gnu awk running under Mac OS X. I would really appreciate if someone ran my script under 10.1 and tried to reproduce the error. It's a one minute task: I've arranged everything below so you can run it on your ~/tmp with a single copy/paste, if you feel like giving it a try. Maybe I'm not seeing the obvious, I would expect a broken awk build to cause lots of trouble on my system, but this sample script is quite tricky. So I would appreciate if someone confirms the odd behaviour or has any clue before I go on with further testing. $ uname -a Linux 2.6.16.13-4-smp #1 SMP Wed May 3 04:53:23 UTC 2006 i686 i686 i386 GNU/Linux $ rpm -qa | grep awk gawk-3.1.5-18 $ gawk --version | head -n 1 GNU Awk 3.1.5 Thank you for getting so far, and thank you very much if you choose to go on ;) Kind regards. Pablo -8<-------------cut here--------------------- #skip this if your CWD is a better place for two temp files ;) cd ~/tmp # the script; PLEASE take care if you copy on your own file # to remove the BACKSLASH just before the DOLLAR; It's # there to prevent the shell from evaluating $i when copy/pasting. cat > problem.awk <<-EOF { print "RECORD " NR; for ( i = 0; length( \$i ) > 0; i++ ) print " FIELD " i " of " NF; } EOF # It doesn't seem to really matter what kind of input you # give to the script. Also it doesn't matter if it's given # on a file via gawk command line invocation or if it's fed # via stdin through a pipe. cat > awk_example <<EOF drwxr-xr-x 2 pablo users 112 2006-06-20 19:29 . drwxr-xr-x 3 pablo users 248 2006-06-20 19:26 .. -rw-r--r-- 1 pablo users 0 2006-06-20 19:43 awk_example -rw-r--r-- 1 pablo users 91 2006-06-20 19:37 problem.awk drwxr-xr-x 2 pablo users 112 2006-06-20 19:29 . drwxr-xr-x 3 pablo users 248 2006-06-20 19:26 .. -rw-r--r-- 1 pablo users 0 2006-06-20 19:43 awk_example -rw-r--r-- 1 pablo users 91 2006-06-20 19:37 problem.awk EOF # Unleash hell! gawk -f problem.awk awk_example -8<-------------cut here--------------------- This is the expected output (what I get on my Gentoo's gawk and on my Mac OS X's awk): $ gawk -f problem.awk awk_example RECORD 1 FIELD 0 of 8 FIELD 1 of 8 FIELD 2 of 8 FIELD 3 of 8 FIELD 4 of 8 FIELD 5 of 8 FIELD 6 of 8 FIELD 7 of 8 FIELD 8 of 8 [... records 2 to 7 ...] RECORD 8 FIELD 0 of 8 FIELD 1 of 8 FIELD 2 of 8 FIELD 3 of 8 FIELD 4 of 8 FIELD 5 of 8 FIELD 6 of 8 FIELD 7 of 8 FIELD 8 of 8 This is what I get on my opensuse10.1: $ gawk -f problem.awk awk_example RECORD 1 FIELD 0 of 8 FIELD 1 of 8 FIELD 2 of 8 FIELD 3 of 8 FIELD 4 of 8 FIELD 5 of 8 FIELD 6 of 8 FIELD 7 of 8 FIELD 8 of 8 RECORD 2 FIELD 0 of 8 FIELD 1 of 8 FIELD 2 of 8 *** glibc detected *** gawk: double free or corruption (fasttop): 0x08089be0 *** ======= Backtrace: ========= /lib/libc.so.6[0xb7e80911] /lib/libc.so.6(__libc_free+0x84)[0xb7e81f84] gawk(str2wstr+0x37)[0x806f2dd] gawk(do_length+0x1f3)[0x8056c73] gawk(r_tree_eval+0x3a2)[0x80742f2] gawk(r_tree_eval+0x75)[0x8073fc5] gawk[0x8075d12] gawk(interpret+0x2c6)[0x80727e6] gawk(interpret+0x221)[0x8072741] gawk(interpret+0x1b1)[0x80726d1] gawk(do_input+0x33)[0x806a743] gawk(main+0x79b)[0x806e33b] /lib/libc.so.6(__libc_start_main+0xdc)[0xb7e3287c] gawk[0x804c9b1] ======= Memory map: ======== 08048000-08082000 r-xp 00000000 03:01 431340 /bin/gawk 08082000-08083000 rw-p 0003a000 03:01 431340 /bin/gawk 08083000-080a9000 rw-p 08083000 00:00 0 [heap] b7b00000-b7b21000 rw-p b7b00000 00:00 0 b7b21000-b7c00000 ---p b7b21000 00:00 0 b7d12000-b7de9000 r--p 00000000 03:01 441088 /usr/lib/locale/ en_US.utf8/LC_COLLATE b7de9000-b7e1c000 r--p 00000000 03:01 441087 /usr/lib/locale/ en_US.utf8/LC_CTYPE b7e1c000-b7e1d000 rw-p b7e1c000 00:00 0 b7e1d000-b7f36000 r-xp 00000000 03:01 473445 /lib/libc-2.4.so b7f36000-b7f38000 r--p 00118000 03:01 473445 /lib/libc-2.4.so b7f38000-b7f3a000 rw-p 0011a000 03:01 473445 /lib/libc-2.4.so b7f3a000-b7f3d000 rw-p b7f3a000 00:00 0 b7f3d000-b7f60000 r-xp 00000000 03:01 473453 /lib/libm-2.4.so b7f60000-b7f62000 rw-p 00022000 03:01 473453 /lib/libm-2.4.so b7f62000-b7f64000 r-xp 00000000 03:01 473451 /lib/libdl-2.4.so b7f64000-b7f66000 rw-p 00001000 03:01 473451 /lib/libdl-2.4.so b7f6b000-b7f75000 r-xp 00000000 03:01 473492 /lib/libgcc_s.so.1 b7f75000-b7f76000 rw-p 00009000 03:01 473492 /lib/libgcc_s.so.1 b7f76000-b7f77000 rw-p b7f76000 00:00 0 b7f77000-b7f78000 r--p 00000000 03:01 441084 /usr/lib/locale/ en_US.utf8/LC_NUMERIC b7f78000-b7f79000 r--p 00000000 03:01 429431 /usr/lib/locale/ en_US.utf8/LC_TIME b7f79000-b7f7a000 r--p 00000000 03:01 431263 /usr/lib/locale/ en_US.utf8/LC_MESSAGES/SYS_LC_MESSAGES b7f7a000-b7f81000 r--s 00000000 03:01 428430 /usr/lib/gconv/ gconv-modules.cache b7f81000-b7f82000 rw-p b7f81000 00:00 0 b7f82000-b7f9c000 r-xp 00000000 03:01 479433 /lib/ld-2.4.so b7f9c000-b7f9e000 rw-p 00019000 03:01 479433 /lib/ld-2.4.so bf868000-bf87d000 rw-p bf868000 00:00 0 [stack] ffffe000-fffff000 ---p 00000000 00:00 0 [vdso] Aborted

2 1

trusted crontab
by discip＠pjm.com 23 Jun '06

23 Jun '06

Does anyone know what the preferred way is to eliminate the restriction that crontab only be available to users in the trusted group? I would like all local users to be able to use cron. I changed the ownership of the crontab command from root:trusted to root:users, but it appears there must be something else I should change because certain command complain (the rpmbuild command even reset the permissions back to root:trusted). Any help would be greatly appreciated. This is SLES 9 SP3 Thanks, Paul

3 2

nntp and irc
by wpc 22 Jun '06

22 Jun '06

on my linux server i can use irc and nntp but on my workstations i can't. have opened ports for nntp and irc on internal and external. what could be wrong ? "Who the heck is General Failure, and why is he reading my harddisk?" __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

traceroute to SuSEfirewall
by Frank Stuehmer 20 Jun '06

20 Jun '06

Hi, in earlier versions of SuSEfirewall there was a parameter FW_ALLOW_FW_TRACEROUTE. In version 3.3 isn't. I could use FW_ALLOW_INCOMING_HIGHPORTS_UDP but it's deprecated. How may I allow to traceroute the firewall? Frank

2 1

Open Source call graph paper announcement
by Sebastian Krahmer 19 Jun '06

19 Jun '06

Hi, For those who are interested in: http://www.suse.de/~krahmer/instrumental/instrumental.pdf and http://www.suse.de/~krahmer/bbpaint/bbpaint.pdf The first one describes how to use certain GCC features to generate call graphs from a running program. The second one describes how ptrace() might be used to build a Control Flow Integrity system. Code for playing is included for both, but for the later its not yet uploaded (mainly because the Branch Trapping has just been implemented). l8er, Sebastian -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~

1 0

Re: [suse-security] userdd userdel very slow/delayed..???
by Andy 16 Jun '06

16 Jun '06

Hm... you're right. What does that do exactly and how do I disable it? ----- Original Message ----- From: "Richard Ems" <Richard.Ems(a)mtg-marinetechnik.de> To: "Andy" <frum(a)ar-sd.net> Cc: <suse-security(a)suse.com> Sent: Friday, June 16, 2006 1:24 PM Subject: Re: [suse-security] userdd userdel very slow/delayed..??? > Did you tried "rcnscd stop" ? > > Richard > > -- > Richard Ems > Tel: +49 40 65803 312 > Fax: +49 40 65803 392 > Richard.Ems(a)mtg-marinetechnik.de > > MTG Marinetechnik GmbH - Wandsbeker Koenigstr. 62 - D 22041 Hamburg > > GF Dipl.-Ing. Ullrich Keil > Handelsregister: Abt. B Nr. 11 500 - Amtsgericht Hamburg Abt. 66 > USt.-IdNr.: DE 1186 70571 > > >

2 1