September 2002 - openSUSE Users - openSUSE Mailing Lists

ok to remove nullOK?
by Susan Buczak 30 Sep '02

30 Sep '02

Probably it is ok to remove nullOK? Is it just the thing that allows users to register without a password? what is > use_authto > k in your file Kastus? a typo or error mine doesn't have that... actually on the redhat i used bastille which made these changes don't think I have that option here so was trying to do more or less the same thing manually... Susan > #%PAM-1.0 > auth requisite pam_unix.so nullok #set_secrpc > auth required pam_securetty.so > auth required pam_nologin.so > #auth required pam_homecheck.so > auth required pam_env.so > auth required pam_mail.so > account required pam_unix.so > password required pam_pwcheck.so nullok > password required pam_unix.so nullok use_first_pass > use_authto > k > session required pam_unix.so none # debug or trace > session required pam_limits.so > > That might explain why your changes are ignored. > > Regards, -Kastus

2 1

Re: [SLE] file modifications on 8.0
by Susan Buczak 30 Sep '02

30 Sep '02

Just out of curiousity, maybe you guys know, but on my redhat system the current /etc/pam.d/login looks like this: #%PAM-1.0 auth required /lib/security/pam_securetty.so auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_stack.so service=system-auth session optional /lib/security/pam_console.so account required /lib/security/pam_access.so So obviously I am missing access.conf here which should be easy enough to throw in, but any ideas about the differences between using mxauth and not using it, as suse appears to be doing, what's suse's equivalent of the auth file? and nullOk is that safe or does it just apply to mail and stuff? > If I understand it correctly, /etc/security/access.conf is used by > /lib/security/pam_access.so module which is not present in default > /etc/pam.d/login configuration in SuSE 8.0: > > #%PAM-1.0 > auth requisite pam_unix.so nullok #set_secrpc > auth required pam_securetty.so > auth required pam_nologin.so > #auth required pam_homecheck.so > auth required pam_env.so > auth required pam_mail.so > account required pam_unix.so > password required pam_pwcheck.so nullok > password required pam_unix.so nullok use_first_pass > use_authto > k > session required pam_unix.so none # debug or trace > session required pam_limits.so > > That might explain why your changes are ignored. > > Regards, -Kastus > On 2002.09.29 15:22 Carlos E. R. wrote: > > I have version 7.3. It seems that the access.conf file is part of "pam", > and that's a subject I don't fully understand yet. But if it desn't work, > it is not because of suse "peculiarities", but because of pam > "peculiarities" - this time at least. > > That file will be the configuration file for one of the pam modules, and > that module most be activated in /etc/pam.d/somewhere, I believe in > "access" module. The documentation en doc/packages/pam is incomplete, but > have a look at chapter 6.1, specially this: > > For /etc/pam.d style configurations where your modules live in > /lib/security, start by adding > the following line to /etc/pam.d/login, /etc/pam.d/rlogin, > /etc/pam.d/rsh and /etc/pam.d/ftp: > > account required /lib/security/pam_access.so > > Note that use of this module is not effective unless your > system ignores .rhosts files. See > the the pam_rhosts_auth documentation. > > A sample access.conf configuration file is included with the > distribution. > > > That line does not exist in suse 7.3, so any change in the access.conf > will be ignored - as you report. > > By the way, yast autoconfiguration can be completely disabled, if you > want. > > -- > Cheers, > Carlos Robinson >

2 1

Unable to Download Patches
by doc 30 Sep '02

30 Sep '02

Anyone aware of a problem across all of the SuSE sites? Every one of them responds with "Unable to download patches". Thanks! doc -- "And God said, let there be light ... " "I pledge allegiance to the Flag of the United States of America, and to the Republic, for which it stands; one nation, UNDER GOD indivisible, with liberty and justice for all. "

5 5

Re: [SLE] YOU -- Can't get patches from server.
by Ben Rosenberg 30 Sep '02

30 Sep '02

* Michael D. Schleif (mds(a)helices.org) [020929 18:28]: ::Ben => :: ::Thank you, for your participation. No, my associate has very little ::idea what he is doing. :: ::# find / | grep lib | grep -i openssl ::/usr/share/doc/packages/openssl-doc/ssl/SSL_library_init.pod ::/var/lib/YaST/patches/i386/update/7.2/patches/openssl-5395.20020929.installed ::/var/lib/YaST/patches/i386/update/7.2/sec1/openssl-0.9.6a-69.i386.rpm ::/var/lib/YaST/patches/i386/update/7.2/d2/openssl-devel-0.9.6a-69.i386.rpm ::/var/lib/YaST/patches/i386/update/7.2/doc3/openssl-doc-0.9.6a-69.i386.rpm :: :: ::# sshd -v ::sshd: illegal option -- v ::sshd version OpenSSH_2.9.9p2 :: :: ::Please, straighten me out . . . If he's updated to the latest pkgs from SuSE's FTP site then you should be good. As I was saying earlier. SuSE patches existing versions of the software as not to break deps by other software on the system. The updated version of SSH for the SLES would be 2.9.9p2 but a patched version..since SLES is based on SuSE 7.0 and that's the same version of OpenSSH. I know it's confusing and I'm not sure I like it, but it's how SuSE does it. It's been a major topic on the SuSE Security list for the -ast few months. ::think we know. The more I know, the more I know I don't know . . . As you can see by the date below. These packages were posted on Aug. 13th which is a month after the major OpenSSL bug that people are still talking about. No matter how many versions of Slapper or what new tools come to exploit the SSL problem. SuSE's patched it...or at least they've patched to the current known bug set. So trust it as much as you trust anything else created by humans to be perfect. :) ftp://ftp.gwdg.de:0/pub/linux/suse/ftp.suse.com/suse/i386/update/7.2/sec1/ ---- wrw-r--r-- 1 emoenke ftp 1729599 Aug 13 04:12 openssh-2.9.9p2-126.i386.rpm -rw-r--r-- 1 emoenke ftp 965831 Aug 13 03:59 openssl-0.9.6a-69.i386.rpm ---- If your associate isn't UNIX/LINUX savvy then I would suggest restricting his access until he learns more if this is a production machine that houses important data. If you can't do that. Then I'm not sure what to say. But as long as he keeps the current patches installed at least by date then you should be better off then not. I would suggest having him subscribe to the security list and if he is even the slightest bit worried that he doesn't know what he's doing. He should post. They are really good people on that list and as long as the question is security related. They'll help him. As far as information on YaST2..on that version of SuSE I never went near it. It was to new for my tastes and often didn't work as well as I would have liked. I stuck with yast1 in this case. You should have information on that version in the system. YaST2 will effect you more if you go to SLES 8.0 which is a huge improvement over 7.0 :) Cheers! -- Ben Rosenberg ---===---===---===--- mailto:ben@whack.org Tell me what you believe.. I tell you what you should see.

1 0

tomcat 4 strangeness....?
by kathee 30 Sep '02

30 Sep '02

Hi, I have two servers -- one running tomcat 4.1.10 with SuSE 8 and the other running tomcat 4.0.3 on RH 7.3. I am seeing a strange thing with my java apps being served up on SuSE and I really want to make SuSE the production platform, so I am hoping I can get some help. Does anyone know of issues in 4.1 of tomcat vs 4.0? Is there an issue with SuSE? Is anything fixed in 8.1 of SuSE? The problem is fairly simple -- on a secure link of tomcat, certain web pages get served up with part of previous pages. In other words, as you cycle through (and this is all java, no apache, just tomcat serving java and xml) pages, some of the pages bring up old pieces of previous pages. If I restart tomcat, it fixes itself for a while. The strange part is, on the lower version of RH and Tomcat, it does not occur. I just don't want to start down grading haphazardly until I get a better handle on it. And no, there is nothing in any of the jakarta logs to indicate an error. thanks Kat

2 1

Disk Shifted To New IDE Controller
by James.Rocks＠equant.com 30 Sep '02

30 Sep '02

Hi, I have just plugged my Linux boot disk into a different controller (on board raid) but it doesn't boot ... I figure this is just a matter of editing some files ... but which ones? James James C. Rocks Equant Archway House Canary Wharf London E14 9SZ Phone: 0207-5226856 Fax: 0207-5126087 Mobile Phone: 07771-767405 http://www.equant.com

4 3

Re: [suse-kde] VMware Crashing with Suse8
by Brian Marr 30 Sep '02

30 Sep '02

Suse 8.0 Vmware 3.1 is working ok here Brian Marr On Monday 30 September 2002 10:23, Carl wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Install and config of VMware 3.2 is proving to be a nightmare. > > I found this on Google: > >VMware has a problem with Suse 8.0. > > > >Suse decided to include a memory management patch from the 2.5.x > >kernel tree in their 2.4.x kernels. Applications that are not > >specifically modified for this patch can be severely broken by it. > > > >VMware was not written to take this patch into account because VMware > >only supports 2.2.x and 2.4.x kernels on the host and this patch is > >*NOT* part of the 2.2.x or 2.4.x kernels. > > > >Suse should not be claiming that the kernel shipped with Suse 8.0 is a > >2.4.18 kernel. It is not. It is a heavily modified kernel that was > >originally based on 2.4.18. VMware is compatible with 2.4.18 > >kernels. It is not 100% compatible with the custom kernel installed > >by default in Suse 8.0 (please note that Suse 8.0 is not a supported > >host OS) > > > >Replacing your patched Suse kernel with a stock 2.4.18 kernel will > >resolve the problem completely. > > > >>a fast an simple solution is to limit RAM to 850 MB at bootime, works > >>but if you need the RAM.... > > > >Whether you need the RAM or not, the better solution is to remove that > >patch. Apparently even the author of the patch has said that the only > >people who should see any benefit from it right now are people with > >more than 1GB of RAM, but less than 2GB of RAM who are also running > >Oracle on the machine. So removing it should not hurt anything. > > So is the only fix to use kernel.org kernels? > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.6 (GNU/Linux) > Comment: For info see http://www.gnupg.org > > iEYEARECAAYFAj2XoIIACgkQnQ18+PFcZJtREQCfXcbD8Bfueuky9/0dAe6vH8NX > 55cAniZA0uVO5sDKf0La3twX02wKv+Q+ > =aqb7 > -----END PGP SIGNATURE-----

1 0

Having another Linux installation on another disk
by David List 30 Sep '02

30 Sep '02

I have just installed another disk, sdc, on my SuSE Linux 7.3 system. I have installed Red Hat 7.3 on it, since I need to test some software I am writing. I need to be *absolutely* sure it works with the libs that come with RH7.3. After the RH7.3 installation, I restored my lilo, so that the system booted as before, and the RH7.3 installation was just lying there on sdc. So, how do I make lilo understand the new situation? The new disk has been partitioned as follows: sdc1 /boot sdc2 swap sdc3 / I intend not to let the two installations "see" each other, but I temporarily mounted /dev/sdc1 on /newdisk and ran /sbin/lilo with the /etc/lilo.conf below. This didn't work. I can boot to SuSE 7.3, but when I try booting to RH7.3, I just see: Booting Red Hat 7.3......... and nothing more happens. Something must be wrong with my /etc/lilo.conf entry for the new installation, but what? Is it that just temporarily mounting the /dev/sdc1 and running /sbin/lilo won't work? My /etc/lilo.conf looks like this, now: ///////////////////////////////////////////////////////////////// append="hdc=ide-scsi noapic" boot=/dev/hda disk = /dev/hda bios = 0x80 disk = /dev/sr0 bios = 0x81 disk = /dev/sdc bios = 0x82 disk = /dev/sda bios = 0x83 disk = /dev/sdb bios = 0x84 vga = normal read-only menu-scheme = Wg:kw:Wg:Wg lba32 prompt timeout = 50 message = /boot/message image = /boot/vmlinuz label = SuSE7.3 root = /dev/sda3 initrd = /boot/initrd optional image = /newdisk/vmlinuz label = RedHat7.3 root = /dev/sdc3 initrd = /newdisk/initrd-2.4.18-3.img optional other = /dev/hda1 label = Win2k image = /boot/memtest.bin label = memtest86 /////////////////////////////////////////////////////// Best regards, David List

3 3

After update Glibc rpm problem...
by berto van Oorspronk 30 Sep '02

30 Sep '02

Hello, I have updated the glibc (glibc version 2.2.4-75) library's on my SUSE 7.3 system in single user mode. After the update I even run the command /sbin/ldconfig ls -l glibc* -rw-r--r-- 1 root root 7626435 Aug 11 12:14 glibc-2.2.4-75.i386.rpm -rw-r--r-- 1 root root 10943302 Aug 11 12:14 glibc-devel-2.2.4-75.i386.rpm -rw-r--r-- 1 root root 9245569 Aug 11 12:15 glibc-profile-2.2.4-75.i386.rpm At the moment everything works file, but only the rpm program won't work anymore. It gives the following message: bash-2.05# rpm rpm: loadlocale.c:221: _nl_load_locale: Assertion `idx % __alignof__ (u_int32_t) == 0' failed. Aborted bash-2.05# Can anyone tell me what is (and what did I am) wrong? Berto bash-2.05# uname -a Linux pa3hfn 2.4.19 #1 Thu Sep 26 14:15:00 CEST 2002 i586 unknown

2 1

GRIP and CD Ripping
by robert73 30 Sep '02

30 Sep '02

Good Morning all I trying to make MP3s from CDROMs. IM not sure what program to use (which is the most popular)... IVe found GRIP online and included on the install cds. My problem is GRIP reports "no disk detected" There wasnt much in the grip docs except "the user needs access to the device" Ive changed perms in the propertices but still dosnt see the CDROM. ANy ideas ? What is the most popular program and any other feedback people may have Thanks rob -- Sex is the mathematics urge sublimated. -- M. C. Reed.

4 7