October 1999 - openSUSE Users - openSUSE Mailing Lists

[SLE] 128 Mg RAM
by SOLARIS＠cicei.ulpgc.es 01 Oct '99

01 Oct '99

Hi all. I wonder whether SUSE (6.1; 6.2) will recognize "automatically" 128 Mb of RAM ? If negative, how do I fix that and where ? Cheers from the Canary Islands (Central East Atlantic ocean), APS -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

9 9

[SLE] ipchains, firewalling, icq, and a cool net program
by chris.reeves＠iname.com 01 Oct '99

01 Oct '99

Hi everyone, This is going to be a long one, with LOTS of questions, but please bear with me and try and answer as many as possible (and there's a treat for some of you at the end :-)... ). It's also probably slightly OT and parts have been asked before in various forms, but firewalling is very specific. I'm sure this would answer a lot of questions that many people have. I have read HOWTOs, man pages, SuSE manual, etc. and still need some help. I recently moved from home (56k dialup) to uni (24/7 ethernet connection, pretty much direct). Since the university net isn't exactly secure, I need to set up firewalling and sort out services, etc. I'd also better mention: SuSE 6.1, kernel 2.2.5, Cyrix P150+, 96M RAM, 10GB HD, 10Mb Ethernet connection. 1) I have ipchains set to deny virtually everything except a few servers coming from specific remote ports and the first rule of all is to deny all incoming conections (-p tcp -y). I have the output chain set to accept everything (I don't see any harm in that, as forwarding is also set to deny all and isn't even turned on). Most of the services in /etc/services are left uncommented. So the first question is - those services running from inetd are safe as no connections can be established, aren't they (I know that they should be disabled anyway, but lets just say they're not)? What about if I put a rule in before that -y deny rule that would accept connections on port 80, to run a webserver, say. Would those other services still be safe? As far as I know, the httpd would answer connections on port 80 - is there any way for someone to connect on port 80 (where httpd is running) and use telnet to log on (sort of request the telnet daemon)? What if the open port were, say, 34712 and there was no daemon listening there - would the incomming connection then be able to choose a daemon? What would happen? 2) This one's kind of related to the previous one. I want to run a web server from my computer. I don't want to remove all the SuSE support db and search facilities. I would like to know if there would be any security holes if I just opened it up as it is - search facilities and everything. Would people be able to search the hard drive? I have a documentation server installed, but I think that's on a different port? I wouldn't be opening that up. But I have lots of support docs installed from the packages on the cdrom, and they are searchable with htdig. So can I just open the server up as it is? 3) I would like to use ftp from behind the firewall (recieving, not serving). How should I set this up with ipchains? I thought that I could just allow packets in from tcp port 21, but I wasn't sure if this was secure enough, but then I thought - since I don't allow incoming connections, *I* must have connected to *their* port 21, so that must make it safe(er). Is that true? Also, there is the problem of active (or is it passive?) ftp, which means the remote server tries to establish a connection to me (which at the moment is blocked by -y). How do I make allowances for this, other than specifying the server manually just before doing the transfer and opening up a range of ports, because the souce and destination ports can (as far as I know) be anything? So to sum up: how do I firewall ftp? 4) Here's a nice insecure protocol: icq. I know I have to open up udp port 4000 to icq.mirablis.com - that isn't a problem (other than the fact that the servers that I have IP addresses for keep on disappearing). What is a problem is that you need to open some other tcp ports (some outgoing, but others, presumably, for connection) as described in the ICQ firewall faq at http://www.mirabilis.com/faq/firewall.html . Has anyone had any experience of using ICQ over a firewall? What exactly are the security risks? Those ports you open for connection - does icq put a daemon on them?? I can get connected to an icq server by opening port 4000, but can't do much else. Please help if you can - some people I can only speak to over icq. 5) NFS. Does anyone know what ports have to be open on my side to be able to mount volumes via NFS? How secure is it? Does the RPC portmapper daemon need to be running on my end? Or any other daemon (eg mount)? man nfs mentioned the default port being udp 2049. Is this the only one I have to open? Do I have to expect incoming connections (I'm not going to be doing any sharing, just mounting)? What port should I expect a reply to? Again, could someone with experience using NFS through a firewall help me? 6) Surfing the web. I am trying to set up the firewall to access a caching proxy on the uni network. I don't need any help with that just now, and if it works it won't be a problem. At the moment, though, I am just directly accessing the websites. To do this I have (as you will see below) set ipchains to accept any packet from tcp port 80 from ANYWHERE. Since I don't accept incoming connections I think this is safe, yes? 7) ipchains. Although I have read quite a bit about them, I would maybe like to see one or two other people's scripts (sent off list to avoid wasting any more bandwidth) to compare with my own (which follow) and I am open to suggestions and comments on my current setup. There's no problem with the accept all output, is there, as I have got forwarding turned off? IPs have been altered to 'protect the innocent': Chain input (policy DENY): target prot opt source destination ports DENY tcp -y---- anywhere my-ip-address any -> any ACCEPT icmp ------ anywhere anywhere any -> any ACCEPT tcp ------ uni-ns1 anywhere domain -> any ACCEPT tcp ------ uni-ns2 anywhere domain -> any ACCEPT udp ------ uni-ns1 anywhere domain -> any ACCEPT udp ------ uni-ns2 anywhere domain -> any ACCEPT tcp ------ nearby-uni-server anywhere smtp -> any ACCEPT tcp ------ caching-proxy anywhere any -> any <--my attempt to get proxy cache server working, ignore ACCEPT tcp ------ anywhere anywhere www -> any ACCEPT tcp ------ home-isp-pop3-serv anywhere pop3 -> any ACCEPT tcp ------ nearby-uni-server anywhere telnet -> any ACCEPT tcp ------ nearby-uni-server anywhere pop3 -> any Chain forward (policy DENY): Chain output (policy ACCEPT): <end output> Right, that's just about it. I'd like to mention, though, that I got sound working a couple of days ago for the first time ever in linux (had various dists for over a year). I'd never actually tried before because it always sounded so complicated with everyone writing in with problems. After reading the docs it took me all of 5 mins to get it set up with OSS!! It only runs for three hours, but that's not a problem. I didn't even have to install anything extra (other than replacing the full license OSS off the CDs with the demo version off the CDs). BTW, I have a Yamaha DS-XG PCI and it sounds excellent. Here's the treat that you've all been waiting for. (Actually, you probably all knew about this already) I was looking through some stuff on the CDs and noticed a wee program called tleds, which does a very handy job. Ever had to crawl around the back of the computer to see if the network card's lights are flashing? No need now, use tleds and it'll use your numlock and scrolllock leds on your keyboard as TX and RX leds as on the back of the card. I've already found it very handy in checking for strange unneccesary network activity - and noticed a number of active connections to a particular server. If I remember right it is in series n (that would be sensible wouldn't it!). OK, now for a plea. Please reply, even if you can only answer one of these thousands of questions (but it would be excellent if you could answer them all :->>). I have to thank you now, even if you don't reply, for taking the time to read this epic. And thankyou in advance for anyone who does give me any answers. I've been building up to this for a number of weeks and it has all come flooding out like a dam bursting (as if you didn't notice!). Thanks again, and please, please answer. Thanks, Chris -- __ _ -o)/ / (_)__ __ ____ __ Chris Reeves /\\ /__/ / _ \/ // /\ \/ / ICQ# 22219005 _\_v __/_/_//_/\_,_/ /_/\_\ -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

1 0

[SLE] Re: xfce-3.1.2 (on ftp.suse.com)
by mha＠suse.de 01 Oct '99

01 Oct '99

binary rpm: ftp://ftp.suse.com/pub/contrib/i386/madefor62/xfce-3.1.2-0.i386.rpm ource rpm: ftp://ftp.suse.com/pub/contrib/i386/madefor62/xfce-3.1.2-0.src.rpm It will take a while, probably at some time tonight, for the packages to be automatically migrated to ftp.suse.com. I just put 'em on the internal mirror server. -- Michael Hasenstein http://www.suse.de/~mha/ Private Pilot (ASEL) since 1998 -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

1 0

[SLE] (fwd) XFce 3.1.2 is out.
by tgdcuro1＠gd2.swissptt.ch 01 Oct '99

01 Oct '99

Date: Fri, 01 Oct 1999 10:38:32 +0200 From: Olivier Fourdan <fourdan(a)xfce.org> To: "xfce-list, xfce-list" <xfce-list(a)xfce.org> Subject: XFce 3.1.2 is out. Hi all, XFce 3.1.2 is now released, and ready for download from http://www.xfce.org Changelog extract : 01-OCT-1999 : XFce-3.1.2 ======================== - xfwm * Fix bug in title height computation - all * patch to display Multi-Byte charactors such as Japanese, Chinese or Korean properly in menus and titlebars and icons by Yamahata Kenichiro <mogutan(a)din.or.jp> * Japanese translation by Yamahata Kenichiro <mogutan(a)din.or.jp> - setup/startup scripts * Fixes to be compatible with ksh enjoy ! -- Olivier Fourdan (mailto:fourdan@csi.com) Looking for a different desktop ? Visit now http://www.xfce.org ! mailing list : send a mail to xfce-list-request(a)xfce.org ___________________________________________________________________________ XFce is the best X-GUI available on planet earth! You have received this email because you subscribed to the XFce list. To unsubscribe send a message to xfce-list-request(a)xfce.org with the word unsubscribe in the body of the message. The archives for this list are located at: http://www.xfce.org/Listarch/threads.html The home URL for XFce is: http://www.xfce.org. Have a nice day! -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

1 0

[SLE] A plea...
by grimmer＠suse.de 01 Oct '99

01 Oct '99

Hello Guys, I just would like to ask you a little favor. Even though I try help out on this list as my time permits, this does not mean that I can give free personal installation support to anybody. I know it is tempting to write to me personally and I usually try to answer. However, I get a little too much of this messages lately and I hate being unable to answer them all. Especially right now, where it takes me ages to type an e-mail over this slow modem link :) So please, if you are having a problem and are looking for help: post your question to this list. If you explain, what went wrong and give us enough details, I know there are a lot of people out there that are willing and able to help you. This is what this list is all about :) And I must really say: you all out there are doing a wonderful job. One more thing: make sure, that your answer to one of my posts is really getting back to the list only! ItŽs usually not necessary to Cc: me on your answer. If you send it to the list, I will pretty sure read it. I hope, I did not sound too rude and I donŽt like doing this. But I just want to let you know that it is not that I am ignoring you on purpose, but I simply cannot guarantee an answer to personal request at the moment. Thanks for your understanding. Bye, LenZ -- ------------------------------------------------------------------ Lenz Grimmer SuSE GmbH mailto:grimmer@suse.de Schanzaeckerstr. 10 http://www.suse.de/~grimmer 90443 Nuernberg, Germany -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

5 6

RE: [SLE] 128 Mg RAM
by tlambley＠cspops.co.uk 01 Oct '99

01 Oct '99

The kernal in 6.2 picks up my 256M. However, I did have problems with an earlier kernal, which was overcome with an entry like: mem=256M in the lilo.conf T. ---------- From: <solaris(a)cicei.ulpgc.es > Sent: 01 October 1999 09:58 To: suse-linux-e(a)suse.com Subject: [SLE] 128 Mg RAM <<File: RFC822.TXT>> Hi all. I wonder whether SUSE (6.1; 6.2) will recognize "automatically" 128 Mb of RAM ? If negative, how do I fix that and where ? -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

1 0

Re: [SLE] Bud...Oink! (was SuSE 7.0)
by koen_dejonghe＠hotmail.com 01 Oct '99

01 Oct '99

You're right Lenz, it looks a lot nicer now. Keep it as it is. I'm beginning to like it. Lenz wrote: as you can see on our new web server design, the logo has already received a minor face lift ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

1 0

[SLE] How to enable access to the port?
by alex＠daniloff.com 01 Oct '99

01 Oct '99

Hello SuSE folks! I've installed Roxen web server and imho IMAP mail module which came with the 6.2 distro. When I tried to access IMHO default http://localhost:143 I got an error: Sorry, access to the port given has been disabled for security reasons. How I can enable this port to access my mailbox over IMHO? Thanks for any suggestions. Alex -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

2 1

[SLE] XFree 3.3.5 and "password"-prompt
by grimmer＠suse.de 01 Oct '99

01 Oct '99

Hi, this bug has been fixed and an update should be available on ftp.suse.com soon. We will also write an SDB article about this. This bug was fixed with disabling PAM Support of the Xwrapper program. A Workaround would be to create a PAM permission file: /etc/pam.d/xserver: ------------------- #%PAM-1.0 auth sufficient /lib/security/pam_rootok.so # never change this line auth required /lib/security/pam_permit.so account required /lib/security/pam_permit.so Bye, LenZ -- ------------------------------------------------------------------ Lenz Grimmer SuSE GmbH mailto:grimmer@suse.de Schanzaeckerstr. 10 http://www.suse.de/~grimmer 90443 Nuernberg, Germany -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

2 1

RE: [SLE] Don't ship internationaly (Was: Re: [SLE] Getting SuSE 6.2)
by kuhlmav＠elec.canterbury.ac.nz 01 Oct '99

01 Oct '99

> www.cheapbytes.com has $5.00 base shipping price for U.S. and Canada, for Be careful with buying anything from the States if you are interested in any of the crypto software. In New Zealand, SuSE 6.2 international has all the nice things on it (part of the reason I went away from Red Hat), they must have imported from Europe. The price incidentally was the equivalent of what SusE sells it for in Germany. Anything from the States almost certainly is not going to have the crypto things included. The problem might be that there is no good/useful/cheap/all-of-the-above international mail order place in Europe, though I don't know. Also, check whether any Canadian resellers have imported from the USA - bad luck for your crypto things in that case too. On the odd chance that buying from New Zealand is actually cheaper for you, I got it from http://www.drfloppy.co.nz/ for NZ$104.95. They are one of the two resellers listed on SuSE's web page. Volker -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

5 4