July 2006 - openSUSE Security - openSUSE Mailing Lists

Command line version of You
by Bob Vickers 26 Jul '06

26 Jul '06

Since upgrading to 10.1 I have found applying security updates has become an extremely hit-and-miss process which takes much longer than it did under SuSE 9.3. I would be very grateful if someone could answer two questions: (1) What is the simplest way of applying security updates from the command-line? Something equivalent to online_update security (2) How do you configure it to use a local mirror instead of the far-off Austrian mirror that the Setup process likes to configure? I have looked at the rug man page and frankly don't understand it (the only bit I do understand turns out to be a lie: it says the only command you need is 'rug update'). I'm not interested in catalogues and services etc, I just want to install security updates. Regards, Bob Vickers ============================================================== Bob Vickers Dept of Computer Science, Royal Holloway, University of London

5 6

Re: Command line version of You
by Markus Gaugusch 25 Jul '06

25 Jul '06

On Jul 25, Bob Vickers <bobv(a)cs.rhul.ac.uk> wrote: > Since upgrading to 10.1 I have found applying security updates has become > an extremely hit-and-miss process which takes much longer than it did > under SuSE 9.3. I would be very grateful if someone could answer two > questions: Hi, You might want to try the beta version of fou4s available from http://fou4s.gaugusch.at/ You need to use the "--nopatch" option to disable patch RPMs until you have installed the "rpm" update package which enables them. The final version will hopefully do this automatically ;) > (1) What is the simplest way of applying security updates from the > command-line? Something equivalent to > online_update security fou4s -uis (fou4s --update --install --security) -- you only need to use --update once a day or so, it fetches the update descriptions. All other operations are local (except for downloading of course). Use the -v option to see update descriptions. > (2) How do you configure it to use a local mirror instead of the far-off > Austrian mirror that the Setup process likes to configure? fou4s --server -w Markus -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \

1 0

SuseFirewall2: Problem accessing from internal to external + port forward.
by Acute - Sebastien Flory 25 Jul '06

25 Jul '06

Hello, I have a problem maybe one of you could help me fix.. I have a webserver running on a internal ip, the router/fw forward the port 80 of the external ip to this internal webserver. Everything works fine in theses scenario: - access from internet to external ip (port is fwd, webserver answer) - access from intranet to internal ip of the webserver But it doesn't work when the internal network wants to access the external ip. I have browse this list archive and found that adding a custom rules would help. iptables -A INPUT -i eth0 -s 10.25.0.0/24 -d xxx.aaa.yyy.jjj -j ACCEPT Actually, it helps, but instead of using the port forward, the router/ fw answer by itself. I believe this is because of the order of something but I'm no expert in theses things so I would be reallly really happy if someone could help me resolve my issue.. Thanks a lot, Sebastien

1 0

AW: [suse-security] Command line version of You
by dag Danczul Georg 25 Jul '06

25 Jul '06

Hi, it takes also much longer then 10.0 and I will use 10.0 as production dist. My system uses ftp.chg.ru/pub/Linux/SuSE/suse/update/10.1/ It seems you has chanched a bad way... regards, georg danczul -----Ursprüngliche Nachricht----- Von: Bob Vickers [mailto:bobv@cs.rhul.ac.uk] Gesendet: Dienstag, 25. Juli 2006 10:55 An: SuSE-Security Betreff: [suse-security] Command line version of You Since upgrading to 10.1 I have found applying security updates has become an extremely hit-and-miss process which takes much longer than it did under SuSE 9.3. I would be very grateful if someone could answer two questions: (1) What is the simplest way of applying security updates from the command-line? Something equivalent to online_update security (2) How do you configure it to use a local mirror instead of the far-off Austrian mirror that the Setup process likes to configure? I have looked at the rug man page and frankly don't understand it (the only bit I do understand turns out to be a lie: it says the only command you need is 'rug update'). I'm not interested in catalogues and services etc, I just want to install security updates. Regards, Bob Vickers ============================================================== Bob Vickers Dept of Computer Science, Royal Holloway, University of London -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

susefirewall2 problem (SuSE 10.1)
by Carlos E. R. 25 Jul '06

25 Jul '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 When I start the computer or run SuSEfirewall2 I get some weird errors: nimrodel:~ # SuSEfirewall2 SuSEfirewall2: Warning: ip6tables does not support state matching. Extended IPv6 support disabled. SuSEfirewall2: Setting up rules from /etc/sysconfig/SuSEfirewall2 ... SuSEfirewall2: Firewall customary rules loaded from /etc/sysconfig/scripts/SuSEfirewall2-custom SuSEfirewall2: batch committing... iptables-batch v1.3.5: host/network `##' not found Try `iptables-batch -h' or 'iptables-batch --help' for more information. SuSEfirewall2: Error: iptables-batch failed, re-running using iptables iptables v1.3.5: host/network `##' not found Try `iptables -h' or 'iptables --help' for more information. iptables v1.3.5: host/network `##' not found Try `iptables -h' or 'iptables --help' for more information. iptables v1.3.5: host/network `Type:' not found Try `iptables -h' or 'iptables --help' for more information. iptables v1.3.5: host/network `Type:' not found Try `iptables -h' or 'iptables --help' for more information. iptables v1.3.5: host/network `string' not found Try `iptables -h' or 'iptables --help' for more information. iptables v1.3.5: host/network `string' not found Try `iptables -h' or 'iptables --help' for more information. iptables v1.3.5: host/network `##' not found Try `iptables -h' or 'iptables --help' for more information. iptables v1.3.5: host/network `##' not found Try `iptables -h' or 'iptables --help' for more information. iptables v1.3.5: host/network `Default:' not found Try `iptables -h' or 'iptables --help' for more information. iptables v1.3.5: host/network `Default:' not found Try `iptables -h' or 'iptables --help' for more information. SuSEfirewall2: Firewall rules successfully set nimrodel:~ # rcSuSEfirewall2 status Checking the status of SuSEfirewall2 running nimrodel:~ # I worry about the "not found" errors. How do I find out what is the exact problem? A bug of mine or of SuSE? It does not report the problematic file or line. The configuration is the same I had with 9.3, and it worked with no errors, AFAIK. I'm also getting some strange errors, maybe non related: Jul 23 13:13:16 nimrodel kernel: SFW2-OUT-ERROR IN= OUT=eth0 SRC=192.168.1.12 DST=134.76.11.100 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=61663 DF PROTO=TCP SPT=24438 DPT=80 WINDOW=2184 RES=0x00 ACK FIN URGP=0 OPT (0101080A0002D56B70A5E356) Jul 23 13:13:18 nimrodel kernel: SFW2-OUT-ERROR IN= OUT=eth0 SRC=192.168.1.12 DST=134.76.11.100 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=61664 DF PROTO=TCP SPT=24438 DPT=80 WINDOW=2184 RES=0x00 ACK FIN URGP=0 OPT (0101080A0002D6D370A5E356) Jul 23 13:13:21 nimrodel kernel: SFW2-OUT-ERROR IN= OUT=eth0 SRC=192.168.1.12 DST=134.76.11.100 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=61665 DF PROTO=TCP SPT=24438 DPT=80 WINDOW=2184 RES=0x00 ACK FIN URGP=0 OPT (0101080A0002D9A370A5E356) Jul 23 13:13:38 nimrodel kernel: SFW2-OUT-ERROR IN= OUT=eth0 SRC=192.168.1.12 DST=134.76.11.100 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=61667 DF PROTO=TCP SPT=24438 DPT=80 WINDOW=2184 RES=0x00 ACK FIN URGP=0 OPT (0101080A0002EA8370A5E356) The remote IP is ftp.gwdg.de. They occur when starting or closing YOU. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFEw1rMtTMYHG2NR9URAn9aAJ9aFh4mvEVf4RQHr3kqkEAYAb7IPwCfVTJj /qdeTyTRV3vOgjmnC93TcoQ= =ENV8 -----END PGP SIGNATURE-----

4 8

Statefull packet inspection in SuSEfirewall2
by pronco＠conae.gov.ar 25 Jul '06

25 Jul '06

Hi, Is it there any way to configure stateful packet inspection rules in SuSEfirewall2 for masquerade networks? When I configure a rule in FW_MASQ_NETS in order to allow traffic from the outside to the DMZ, I also have to configure a rule for responses. Example: Incoming traffic to my web server in a DMZ with private addresses FW_FORWARD_MASQ="0/0,192.168.1.5,tcp,80 I also need to set up the following rules in order to let responses out FW_MASQ_NETS="192.168.1.5/32,0/0,tcp,1024:65535" This rule permits not only established sessions, but additionally it allows my web server to establish connections to the outside world. Dont know why the FW_FORWARD rules are stateful as I want, but FW_MASQ_NETS ones dont. Any suggestion? Is it possible to math the SYN, ACK and FIN TCP bits with SuSEfirewall2? Thanks in advance. Pablo Ronco

4 5

Please cancel my e-mails
by sharpjoe＠charter.net 25 Jul '06

25 Jul '06

15 18

SPAM: Please unsubscribe
by Ash Thakrar 24 Jul '06

24 Jul '06

Ash Thakrar ash(a)largedesign.com

4 3

[SLE] postfix and apparmour
by Carlos E. R. 24 Jul '06

24 Jul '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I post this here so that the maintainer of apparmour sees it and corrects what I think are bugs. When I installed 10.1 I had to add some rules to apparmour or postfix mail delivery with amavis would fail. These are my modifications I did then: /etc/apparmor.d/usr.lib.postfix.qmgr: /{var/spool/postfix/,}private/smtp-amavis w, /{var/spool/postfix/,}public/flush w, /etc/apparmor.d/usr.lib.postfix.smtpd: /{var/spool/postfix,}/pid/inet.localhost rw, /{var/spool/postfix,}/pid/inet.localhost:10025 rw, /etc/apparmor.d/usr.lib.postfix.master: /usr/lib/postfix/lmtp px, These modifications petain to these log entries: Jul 5 13:03:05 nimrodel postfix/smtpd[5615]: fatal: open lock file pid/inet.localhost:10025: cannot open file: Operation not permit Jul 5 13:03:06 nimrodel postfix/master[22973]: warning: process /usr/lib/postfix/smtpd pid 5615 exit status 1 Jul 5 13:10:35 nimrodel postfix/master[5908]: warning: /usr/lib/postfix/lmtp: bad command startup -- throttling Jul 5 13:11:35 nimrodel master[5985]: fatal: master_spawn: exec /usr/lib/postfix/lmtp: Operation not permitted I don't know if the correct procedure is to modify those files directly, but that's what I did and it works. Now, I have another problem. Today I had some hundred emails being downloaded, and the command mailq took a long time before failing to complete. I saw this log entry: Jul 21 20:00:46 nimrodel postfix/showq[18412]: fatal: open incoming 564677F01D: Operation not permitted Jul 21 20:00:47 nimrodel postfix/master[4587]: warning: process /usr/lib/postfix/showq pid 18412 exit status 1 Jul 21 20:00:47 nimrodel postfix/master[4587]: warning: /usr/lib/postfix/showq: bad command startup -- throttling Then I looked at /var/log/audit/audit.log, and sure, there was a problem: type=APPARMOR msg=audit(1153504846.751:1344): REJECTING r access to /var/spool/postfix/incoming/564677F01D (showq(18412) profile /usr/lib/postfix/showq active /usr/lib/postfix/showq) So I go to /etc/apparmor.d/usr.lib.postfix.showq, and see this: /{var/spool/postfix/,}incoming r, /{var/spool/postfix/,}incoming/[0-9A-F] r, /{var/spool/postfix/,}incoming/[0-9A-F]/[0-9A-F] r, /{var/spool/postfix/,}incoming/[0-9A-F]/[0-9A-F]/* r, /{var/spool/postfix/,}incoming/[0-9A-F]/[0-9A-F]* r, /{var/spool/postfix/,}incoming/[0-0A-F]* r, Now, the question: Should the last line be: /{var/spool/postfix/,}incoming/[0-9A-F]* r, instead? Notice that it is very dificult for me to test this: not till I get another mail with certain ID will it work or fail. Is this a bug? Should all those modifications be included by SuSE in a patch? - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFEwhhXtTMYHG2NR9URAoGvAJ9ioB5ah2O2hrEYzfXQyFj3jnpSeQCeMbQP 6UYW04xk07bjBY2vOtCs0Oc= =6nKD -----END PGP SIGNATURE-----

3 5

SLES10 Security Certification
by shashi 24 Jul '06

24 Jul '06

Hi As AppArmor will implement a type of MAC in SLES10, is Novell has submitted (or) going to achieve EAL4+ LSPP ? As SLES9 already certified for EAL4+ CAPP, i didn't heared SLES10 about this. Thanks & Regards, Shashi Kanth

3 4