May 2007 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] LUKS and its master key
by Jochen+opensuse-security＠Hayek.name 13 Dec '07

13 Dec '07

I found LUKS recently through SUSE Linux 10.3, and the other night a read an article in c't 2006/11. I can't seriously appreciate the technical internals, as I'm not too compentent there. Anyway: Kudos to Clemens Fruhwirth! But I am not really sure, whether I can trust, what I read in that article regarding the master key, spefically that the master key can be read from the LUKS volume by the sys admin without any difficulties. Does that really mean, that as soon as somebody gains control over my computer with a mounted LUKS encrypted (external) disc and he also manages to gain root priviliges, that he can retrieve the necessary information, to mount that disc himself with LUKS-means again?!? I mean without me passing the keys to him. If that is seriously so, I think I will have to find myself another disc encryption toolset, as I cannot tolerate, that intruders can deal with my personal data without my explicit permission and support. Whether those intruders have governmental permissions, I don't f...ing care. I appreciate your serious comments. J. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

6 11

[opensuse-security] Need help with SuSE 9.3 and /var/log/auth.log
by Andreas 01 Jun '07

01 Jun '07

Hi, sorry for not using english in the other post. I've got an old SuSE 9.3 system that serves as a firewall/router/samba for a small office. I use ssh for maintenance. Recently I learned that on other systems there is a /var/log/auth.log that logs who is coming in. This files doesn't exist on my system and I couldn't find an entry in the 2 files in /etc/syslog-ng. Could someone give me a hint how to set this auth.log up? I have to admit that I'm not really hot with this setup stuff that goes beyond yast. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

7 7

[opensuse-security] Security features of current openSUSE versions?
by Németh Tamás 30 May '07

30 May '07

Dear openSUSE developers or Experts! In these days I am mostly engaged in the task of choosing a free and secure Linux ditribution for our university. I prefer openSUSE but it's security is unclean for me in some aspects. As far as i know, opesSUSE has compile time and runtime userland protection agains memory related exploits (gcc / Fortify Source), runtime SSP (gcc / -fstack-protector), and LSM based MAC framework (AppArmor). But I wonder if you could tell me if: -openSUSE 10.3 or older versions have all packages compiled as PIE or PIC to utilize the ASLR capabilities of the 2.6.20 and newer Linux kernels? (Does openSUSE 10.3 have an ASLR capability comparable to that of PaX?) -openSUSE has W^X capabilities (similar to the capabilities provided by PaX or ExecShield patches)? On which architectures and how extensively? -openSUSE packages are linked with BIND_NOW option to make the -z relro linking option even more effective? -openSUSE systems have some extra chroot restrictions, /dev/mem, /dev/kmem, /dev/port, /proc/<PID>/stat, /proc/<PID>maps, Linux privileged I/O related or other security enhancements beyond to the security of the vanilla Linux kernel? Thank you for the invaluable information! Best regards: Nemeth, Tamas IT administrator University of West-Hungary, Sopron, Hungary --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

6 7

Re: [opensuse-security] Frage zu sshd
by Andreas 30 May '07

30 May '07

Hi Stefan, ich fand deine Mail zwischen immerhin schon 7 autoreplies wo wer verkündet, er wäre nicht da. Das mit /bin/false ist nur eine halbe Lösung. Ich habe es schon mal versucht, als ich wem einen DB-Port geben wollte und da brach nach der Passworteingabe die Verbindung zusammen. Wärend ich das grad schrieb, fällt mir auf, dass das doch eine Lösung in meinem Fall sein könnte. Gruß Andreas Stefan Nowy schrieb: > Hallo! > > Andreas wrote: > >> kann ich in der config zum sshd lokalen Usern externen Zugriff verwehren? >> Ich möchte jetzt noch verhindern, dass durch nachlässige Passworte >> meiner lokalen user jemand fremdes sich den Zugriff erraten kann. >> > > Vorschlag: in der /etc/passwords bei den bösen usern /bin/bash durch > /bin/false ersetzen? > > Stefan > > --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

3 2

[opensuse-security] Frage zu sshd
by Andreas 30 May '07

30 May '07

Hi, kann ich in der config zum sshd lokalen Usern externen Zugriff verwehren? Meine internen LAN User wollen nicht via ssh zugreifen. Den ssh-port nutze nur ich. Ich möchte jetzt noch verhindern, dass durch nachlässige Passworte meiner lokalen user jemand fremdes sich den Zugriff erraten kann. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] Hilfe meine SuSE 9.3 hat keine /var/log/auth.log
by Andreas 30 May '07

30 May '07

Hi, meine altbewährte SuSE 9.3 hat keine /var/log/auth.log hab ich grad etwas irritiert festgestellt. Bis jetzt fiel mir das nie auf, weil ich nicht wusste, dass es die gibt. =8-} In /etc/syslog-ng sehe ich in den beiden config-Dateien auch keien Eintrag. Könnt mich bitte wer erleuchten, was zu tun ist, damit hier auch so ein auth.log geführt wird? --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] DoS Attacks
by "J. Schröder" 29 May '07

29 May '07

Hi there, someone does DoS attacks from my server to servers in the internet. How could I configure iptables to make DoS attacks impossible from my server and how do I have to configure iptables to log all errors and warnings to a external syslog server? I hope this is the right mailinglist for such questions. I already searched the net, but I couldn't find the needed answers. Thank you! Regards, Johnny --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

7 6

Re: [opensuse-security] Security features of current openSUSE versions?
by Németh Tamás 25 May '07

25 May '07

I spent this day by reading some documentations and examining openSUSE 10.2, and there is something, I don't understand: Why are there PIE compileg packages in openSUSE, if the kernel doesn't do ASLR on the program codes? Or does it do? (Am I correct if I say that PIE programs are the ones recognized as "ET_DYN" by scanelf?) Sorry but I forgot to send a copy of my previous mail to the list (I thought it should happen automatically.) 2007. május 24. 17.22 dátummal ezt írta: > On Thu, May 24, 2007 at 05:18:36PM +0200, Németh Tamás wrote: > > Thank you for the quick answer! > > > > 2007. május 24. 16.39 dátummal ezt írta: > > > > -openSUSE 10.3 or older versions have all packages compiled as PIE or > > > > PIC to utilize the ASLR capabilities of the 2.6.20 and newer Linux > > > > kernels? (Does openSUSE 10.3 have an ASLR capability comparable to > > > > that of PaX?) > > > > > > We have a selected set of packages (but not all) compiled as PIE since > > > 10.1. > > > > Can I benefit from this by replacing your kernel by some PaX patched one? > > If PAX allows it, yes. > > > > The kernel has various parts of ASLR: > > > > > > - MMAP and Stack location: is in the kernel since 10.1 > > > > > > - PIE binaries location: is not in the mainline kernel yet, so we do > > > not have it. > > > > > > We are however working on bringing binary location randomization into > > > the mainline kernel. > > > > Oh. Wikipedia > > (http://en.wikipedia.org/wiki/Address_space_layout_randomization) states > > that: "ASLR is enabled by default in the linux kernel since 2.6.20". > > ASLR has multiple parts ... since there are multiple parts of the address > space. Binary, Heap, MMAP area, Stack, VDSO ... > Only some of them are randomized (Stack, Heap with 2.6.13?16? and VDSO with > 2.6.20). > > > But in the file > > http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20 one can read > > that: > > > > "commit 90cb28e8f76e57751ffe14abd09c2d53a6aea7c8 > > Author: Linus Torvalds <torvalds(a)woody.osdl.org> > > Date: Sat Jan 6 13:28:21 2007 -0800 > > > > Revert "[PATCH] binfmt_elf: randomize PIE binaries (2nd try)" > > > > This reverts commit 59287c0913cc9a6c75712a775f6c1c1ef418ef3b." > > > > (Your patch was refused? Was it a patch for binaries location?) > > This was a very simple patch I tried to get in for the Binary > randomization. Unfortunately it cannot be done that easily. > > > A czech developer is currently trying to get in a better one, and it > already lives in the -mm tree. > > > > All AMD64 systems, all x86 systems with the "bigsmp" kernel if the > > > hardware supports it, not sure about the other architectures (PPC, > > > S390, IA64...). > > > > Do Intel EM64T processors running 64 bit openSUSE fall into this > > category? > > Yes. > > > > http://en.opensuse.org/Security_Features has a summary. > > > > I've read that but I was hoping for some fundamental security > > enhancements in openSUSE 10.3 which are undocumented yet. > > So far not, but until release there is still some time. We have however > nothing planned. > > Ciao, Marcus --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 1

RE: [opensuse-security] Security features of current openSUSE versions?
by Maitreya Maziarz 25 May '07

25 May '07

Heresy!!! Actually, I've never tried Red Hat myself. No doubt it's nice. I guess I'm a kinda old-fashioned "one distro man" ;) I'll be a SuSE man 'til the day I die (or the day *they* die). Of course, we appreciated the irony when, a day after we celebrated shutting down our last Novell file server, the Novell SuSE acquisition was announced! Ha! Cheers, --Maitreya -----Original Message----- From: Keith Roberts [mailto:keith@karsites.net] Sent: Thursday, May 24, 2007 10:57 AM To: opensuse-security(a)opensuse.org Subject: Re: [opensuse-security] Security features of current openSUSE versions? You may like to try Fedora Core, sponsored by Red Hat: http://fedoraproject.org/wiki/Overview It has an option called SELinux which you might like. http://fedoraproject.org/wiki/SELinux Regards Keith --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

Re: [opensuse-security] EAL 3 and 4 rated versions.
by Crispin Cowan 22 May '07

22 May '07

SLES9 ships with a script that puts the system into the certified configuration. I don't know whether we have such a script for SLES10SP1, but it is currently in evaluation, so such a script could not be final right now anyway. Crispin Raekism wrote: > This there a whitepaper on locking down a "certified" Suse configuration? > > Thanks, > Rae > > > On 5/21/07, *Crispin Cowan* <crispin(a)novell.com > <mailto:crispin@novell.com>> wrote: > > Emily Ratliff wrote: > > Crispin Cowan wrote: > > > To be considered certified, it would have to be in the certified > > configuration. > > > Installing a new application with an open network port > violates that > > certification. > > > > This is only true if it opens a port < 1024 or runs as root. If > it is > > started as a non-root user, then a port can be opened. That's why > > running a webserver on port 8080 does not violate the certified > > configuration. > > > > I'm not arguing against your main point, but it is not quite as > bad as > > you state here. > Thanks for clarifying. Its good to know that the certified > configuration's restrictions make it less useless than I thought :-) > > Crispin > > -- > Crispin Cowan, Ph.D. > http://crispincowan.com/~crispin/ > <http://crispincowan.com/%7Ecrispin/> > Director of Software Engineering http://novell.com > > --------------------------------------------------------------------- > To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org > <mailto:opensuse-security+unsubscribe@opensuse.org> > For additional commands, e-mail: > opensuse-security+help(a)opensuse.org > <mailto:opensuse-security+help@opensuse.org> > > > > > -- > Be who you are and say what you feel, because those who mind don't > matter and those who matter don't mind. > - Dr. Seuss -- Crispin Cowan, Ph.D. http://crispincowan.com/~crispin/ Director of Software Engineering http://novell.com --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] EAL 3 and 4 rated versions.
by Mark Armstrong 22 May '07

22 May '07

I recently discovered that there are security hardened version of SUSE that are certified/accredited to EAL 3 and even EAL 4. Does anyone have any experienced feedback on how restrictive these setups are? We are looking to implement a data retreival system that access disks over NFS and tape drives over SCSI, but does little else. Would like to know if I could still do these simple things. Regards, Mark Armstrong --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

5 12

[opensuse-security] SSH tunnels without a real shell ?
by Andreas 19 May '07

19 May '07

Hi, is there a way to get expernal people to establish a SSH tunnel to one firewalled internal port without them getting a real shell to snoop around? I'd like to let some externals use our database server that sits behind a port filter. There is only the ssh port to come in. Up until now there was only me and I trust me enough to grant me a shell. ;-) Are there reasonably simple alternatives to do this without SSH? I've got SUSE 9.3 on our server and the clients would be all kinds of Windows. Our Internet connection has no fixed IP but this would be manageable with a dynamic dns service, I suppose. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

7 8

Re: [opensuse-security] LUKS and its master key
by Jochen+opensuse-security＠Hayek.name 19 May '07

19 May '07

>>>>> Paco Cruz writes: >> I found LUKS recently through SUSE Linux 10.3, >> and the other night a read an article in c't 2006/11. PC> Could you post a link to the article you are referring to? Well, the article is in a german printed magazine, so that doesn't really help a lot. [...] >> But I am not really sure, whether I can trust, what I read in that article regarding the master key, >> specifically that the master key can be read from the LUKS volume by the sys admin without any difficulties. PC> This is the part that I don't understand well. PC> Do you have the master key in a file? That's not the point, and that's not my concern, so, no, the master key is not on any (accessible) file. The article says, that the master key can be extracted from a "luksOpen"-ed volume, i.e. from the admin header of the LUKS volume. That's my concern. Kind regards, J. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

RE: [opensuse-security] LUKS and its master key
by J.Witvliet＠MINDEF.NL 18 May '07

18 May '07

Hi all, -----Original Message----- From: Martin Konold [mailto:martin.konold@erfrakon.de] Sent: Friday, May 18, 2007 12:04 AM To: opensuse-security(a)opensuse.org Subject: Re: [opensuse-security] LUKS and its master key Am Donnerstag 17 Mai 2007 schrieb Jochen+opensuse-security(a)hayek.name: Hi Jochen, > manages to gain root priviliges, > that he can retrieve the necessary information, There is no easy way to prevent this for any Linux encryption solution. As soon as a 3rd party has either root or physical access to your linux machine this party will be able to gain access to all volumes which are currently in use. E.g. it is trivial as user root to obtain all access permissions of any user on the system. <snip> Some small side-way remarks... A) If an intruder has physical access to your machine (a co-worker, or something else is very wrong!!), he doesn't directly has access to your private data. First step would probably be to gain root access. Assuming the root user didn't leave any console open (...) it would at least mean a reboot. Stopping of the system should trigger (snmp) maintenance/security actions. Default boot-medium (with keys) can be removed. Non-default booting through grub can be protected by a password. Booting from other media can be protected by bios-password. Altering bios-setup (default pwd) can be protected by locks on your 19" cubboard Enough delaying, for maintenance/security people to have a look why the related system got offline. Even when he removes the disks and put them in another system, it's possible to encrypt root, swap, etc etc. B) Intruder has root access to your machine (through social enginering or so). It shouldn't imply that he has access to your data. For every account ther should be at least one or more private vault, that can only be opened by the user, and no-one else, not even the root user. Your data is only vulnarable (for rogue-root) if you open your vault, and mount it. So if somebody gets root-privileges, all other users should be alerted. (E.G.: Don't trust root! All his entrences and actions should be guarded) C) refering to Hobson, security has it price. If you introduce two-factor or tree-factor security; it means that a trusted person with key/dongle needs to be present when the system must be restarted. Hans --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] too many open files problem
by Cevahir Pilpil 17 May '07

17 May '07

Hi everybody, I am using OpenSuSE 10.0 with default installation and kernel 2.6. When an application tries to run with root user, it returns an error "Can not open files - too many open files". I checked kernel limits (file-max, file-nr) and bash limits (limits.conf) then have changed values as follows. ulimit open files (-n) 10240 sysctl fs.file-max = 10240 fs.file-nr = 600 0 10240 After I restart, I am still having same error message. I am listing and counting open files with lsof command. It seems, it can not open files more than 1024. Does anyone have any idea what is wrong about that? Thanks, Regards, Cevahir Pilpil --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 1

[opensuse-security] Certificate acceptance
by kl 17 May '07

17 May '07

Good morning. Many thanks for the help. Regards Wolfgang Kluge --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] Certificate acceptance
by kl 17 May '07

17 May '07

Good afternoon. I would be grateful if someone could point me to the right site or give me some clue in this matter. Whenever I log in into my remote Linux box ( 10.2 ) the first time via SSH I will be asked to accept the certificate of that server. Is it possible to configure the server to accept only connections from selected clients based on the client's certificate? Regards Wolfgang Kluge --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

3 2

[opensuse-security] CN=Miguel ALBUQUERQUE/O=JGSACERT is out of the office.
by Miguel ALBUQUERQUE 04 May '07

04 May '07

I will be out of the office starting 27.04.2007 and will not return until 07.05.2007. for urgent matters please call +41 22 827 3030 --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] Updates for 9.3
by Sven.Hartrumpf＠FernUni-Hagen.de 03 May '07

03 May '07

Hi all. Novell announced that 9.3 updates end on 2007-04-15 and that a last kernel update will be available at the end of 2007-04. Any news on this? (Today's "SUSE Security Summary Report" did not mention this issue.) Greetings Sven

5 10

[opensuse-security] problemas con fibertel
by Gaston DeSouza 03 May '07

03 May '07

hola gente, les cuento cual es el problema que tengo. el vierner me puse fibertel, la gente vino lo instalo y probo en una maquina con winXP y funciono a la perfeccion, yo que en mi casa tengo un sles9 como server con dos placas una LAN(192.168.1.7) y otra PUBLIC (es por dhcp la de fibertel) no me esta dejando navegar, probe con ping a una ip publica del mundo y nada... alguien ya tuvo este problema asi me puede ayudar a solucionarlo??? desde ya muchas gracias. s2 --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 1

[opensuse-security] Weird encrypted filesystem problem.
by Carlos E. R. 02 May '07

02 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have bumped into a weird problem with encrypted filesystems. It appears there are two incompatible types that use the same options in the cryptotab file. It's difficult to explain. I have replaced an old disk wit a bigger one. The old one had an encrypted partition predating SuSE 9.2. Over the time, I have created other partitions and copied files to encrypted filesystems in DVD, and never had problems. However, I discovered, after switching to the new disk, that although I could load the new encrypted partition, I was unable to load any of the old ones. In order to mount any of those encrypted filesystems, first I have to mount the obsolete (pre 9.2) one, then the rest - except that in that case, I'm unable to mount the new one. For example. I boot, and the "/etc/init.d/boot.crypto" script mounts the main encrypted partition fine. I then manually try to mount one of the auxiliaries: nimrodel:~/cripta.problem # losetup -a /dev/loop0: [000d]:2484 (/dev/disk/by-id/ata-ST3320620A_5QF2M56F-part15) encryption=CryptoAPI/twofish-cbc nimrodel:~/cripta.problem # mount /mnt/crypta.x/ Password: mount: /dev/loop1: can't read superblock However, if edit the /etc/cryptotab to mount the obsolete one (I had to copy it over from the old disk for this purpose): /dev/loop1 /Grande/oldcriptadevicefile /A60/cripta xfs twofishSL92 noatime and now, I mount it: nimrodel:~/cripta.problem # /etc/init.d/boot.crypto start Activating crypto devices using /etc/cryptotab ... Please enter passphrase for /Grande/oldcriptadevicefile: Switching to SuSE 9.2 loop_fish2 compatibility mode. Please enter passphrase for /Grande/oldcriptadevicefile: fsck 1.38 (30-Jun-2005) /sbin/fsck.xfs: XFS file system. See the notice about 9.2 compatibility mode? Once this mode is activated, I can mount any of the partitions or backups I created during last year: (fstab) /biggy/crypta.bck_f.x0 /mnt/crypta.x xfs noauto,loop,encryption=twofish256 0 0 nimrodel:~/cripta.problem # mount /mnt/crypta.x/ Password: nimrodel:~/cripta.problem # mount /mnt/dvd.crypta.x/ Password: nimrodel:~/cripta.problem # mount | grep encryption /dev/hda15 on /cripta type xfs (rw,noatime,loop=/dev/loop0,encryption=twofish256) /Grande/oldcriptadevicefile on /A60/cripta type xfs (rw,noatime,loop=/dev/loop1,encryption=twofishSL92) /biggy/crypta.bck_f.x0 on /mnt/crypta.x type xfs (rw,loop=/dev/loop2,encryption=twofish256) /dev/hdc on /mnt/dvd.crypta.x type xfs (ro,noexec,nosuid,nodev,loop=/dev/loop3,encryption=twofish256) nimrodel:~/cripta.problem # losetup -a /dev/loop0: [000d]:2484 (/dev/disk/by-id/ata-ST3320620A_5QF2M56F-part15) encryption=CryptoAPI/twofish-cbc /dev/loop1: [0314]:177 (/Grande/oldcriptadevicefile) encryption=twofish256 /dev/loop2: [1650]:135 (/biggy/crypta.bck_f.x0) encryption=twofish256 /dev/loop3: [000d]:5490 (/dev/dvd) encryption=twofish256 See? everything is mounted, old, medium, new (remember that "loop1" is in 9.2 compatibility mode, explicitly). The thing is, I first have to mount the new partition, using "encryption=twofish256". Second thing, I have to mount the old one, using "encryption=twofishSL92", which switches something in the system to "SuSE 9.2 loop_fish2 compatibility mode". Finally, I can mount the new partitions using "encryption=twofish256" as well, but which were created while there was already a mounted partition in 9.2 mode (during last year). That is, it seems that if twofishSL92 is active, new partitions in twofish256 need the old mode to be active to be able to mount! If not, they give errors: Filesystem "loop1": Disabling barriers, not supported by the underlying device XFS mounting filesystem loop1 XFS: Log inconsistent (didn't find previous header) XFS: failed to find log head XFS: log mount/recovery failed: error 5 XFS: log mount failed Feb 11 01:04:58 nimrodel kernel: XFS: Log inconsistent (didn't find previous header) Feb 11 01:04:58 nimrodel kernel: XFS: failed to find log head Feb 11 01:04:58 nimrodel kernel: XFS: log mount/recovery failed: error 5 Feb 11 01:04:58 nimrodel kernel: XFS: log mount failed My problem is now that I have to keep using the old compatibility mode! I have to keep this in the cryptotab file, and in that precise order: /dev/loop0 /dev/disk/by-id/ata-ST3320620A_5QF2M56F-part15 /cripta xfs twofish256 noatime /dev/loop1 /Grande/oldcriptadevicefile /A60/cripta xfs twofishSL92 noatime And I will have to keep for ever that twofishSL92 file I do not want, simply in order to activate the old compatibility mode so that I can mount my backup dvds which do not use twofishSL92 but twofish256, but still need twofishSL92! Or, can I change some definition in the cryptotab file so that I can mount "twofish256" filesystems that require "twofishSL92" to be previously activated? - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFzmwLtTMYHG2NR9URAk9uAJ0f15fnbFkuPOoUAtUWlhMwiVJrywCfbOId jeUDB7zXgVOWM3pkJGUo2UQ= =ZKI4 -----END PGP SIGNATURE----- --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 22