February 2004 - openSUSE Users - openSUSE Mailing Lists

Control Center Weird Behavior
by C Hamel 02 Feb '04

02 Feb '04

Three things: (1)When attempting to logout of KDE & shutdown the box I am everlastingly sent to the login screen and have to select 'shutdown' AND enter root's password before the box will actually shutdown. This started happening after the online updates were installed w/YOU. (2)When SuSE9 Pro was first installed, pressing the power switch logged me out lf KDE & shutdown the box by default. No longer, and this, too, seems to have changed post-installation of online updates. (3)In the Control Center, under KDE Components, is something else called Session Manager ...and the settings therein will not hold! I select anything other than 'Login as different user' and 'Apply', and the next time I boot the box that change is gone --if it takes that long, which often is does not. As an aside, the AMD-optimized kernel was listed as one of the updates and I reluctantly updated though I have an Intel P4. I wondered why it was auto-checked in the listing, but since I'm new to SuSE... Any help greatly appreciated. Hope I don't have to start from scratch. ...CH

2 2

Libtiff.
by Erik Jakobsen 02 Feb '04

02 Feb '04

Hi. I want to know if the libtiff also has the libtiff-devel installed. I cannot find the devel in Yast in my SuSE 8.2. -- Med venlig hilsen - Best regards. Erik Jakobsen - eja(a)urbakken.dk. Licensed radioamateur with the callsign OZ4KK. SuSE Linux 8.2 Proff. Registered as user #319488 with the Linux Counter, http://counter.li.org.

1 0

Re: [SLE] chkroot claims top infected
by GarUlbricht7＠netscape.net 02 Feb '04

02 Feb '04

Anders Johansson <andjoh(a)rydsbo.net> wrote: > >On Sunday 01 February 2004 06.25, David Herman wrote: > >> Continuing my investigation I booted up my test machine w/ SuSE 9.0 >> ran checkrootkit and it showed all clean. >> Then I used synaptic and updated ps (ps_2003.11.17-18_i586.rpm) >> and nothing else >> then I ran chkroot again and the errors are there. > > chkrootkit is reacting to the string /prof in top. > That string isn't in the src.rpm, but it is in the binary. > That alone is very suspicious. > It does look like kraxel's binaries are infected. > > I wonder what other niceties are in the binaries in the apt repo David, compared to you and Anders, I am just a lost babe in the woods, but given what you have done and Togan's comment 3 emails back: http://lists.suse.com/archive/suse-linux-e/2004-Jan/4610.html I am surprized that you have not posted this on suse-security mailing list: http://www.suse.com/us/private/support/online_help/mailinglists/index.html Or maybe you have and I just missed it. Friendly greetings, Gar -- __________________________________________________________________ New! Unlimited Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Act now to get a personalized email address! Netscape. Just the Net You Need.

8 13

CVS with SSH from a private subnet (savana.gnu.org)
by Steven T. Hatton 02 Feb '04

02 Feb '04

I just discovered that I can access the emacs cvs repository anonymously from my firewall/router, but not from my workstation which is a member of a private subnet setup using IP masquerading. Has anybody encountered this kind of thing? Is there something I can do on my end to make it possible to access the CVS repository from my workstation? STH

2 1

Re: [suse-security] chkroot claims top infected (fwd)
by Lenz Grimmer 02 Feb '04

02 Feb '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, JFYI, for those of you who are not on suse-security... Seems like it was (fortunately) a false alarm. But still, I too would appreciate if the packages in the "people" directory were signed at least with the developer's key. Bye, LenZ - -- - ------------------------------------------------------------------ Lenz Grimmer <lenz(a)grimmer.com> -o) [ICQ: 160767607 | Jabber: LenZGr(a)jabber.org] /\\ http://www.lenzg.org/ V_V - ---------- Forwarded message ---------- Date: Mon, 2 Feb 2004 12:42:36 +0100 (CET) From: Sebastian Krahmer <krahmer(a)suse.de> To: dh <mesamoo(a)comcast.net> Cc: suse-security(a)suse.com Subject: Re: [suse-security] chkroot claims top infected On Sun, 1 Feb 2004, dh wrote: Hi, I think this is a false positive from chkrootkit. I downloaded the ps package from ftp://ftp.gwdg.de/pub/linux/suse/apt/SuSE/9.0-i386 and indeed there is "/prof" string in ps and top. But this is ok. The string is inside .text and is executable code. This is: ... 0x8055205: call 0x8049700 strtoul() 0x805520a: mov 0xc(%ebp),%edx 0x805520d: mov %eax,0x1b8(%edx) 0x8055213: mov %eax,(%edx) 0x8055215: movl $0x6f72702f,(%esi) ; /prof 0x805521b: movw $0x2f63,0x4(%esi) 0x8055221: mov 0x226fc(%ebx),%eax 0x8055227: add $0xb,%eax 0x805522a: mov %eax,0x4(%esp,1) 0x805522e: lea 0x6(%esi),%eax 0x8055231: mov %eax,(%esp,1) 0x8055234: call 0x8049780 strcpy() ... The code in C is: pid = strtoul(ent->d_name, NULL, 10); memcpy(path, "/proc/", 6); strcpy(path+6, ent->d_name); and comes from the original ps source. The compiler optimized the memcpy() into a movl+movw since /pro is 32 bit and the left 2 byte are copied via movw. This just yields "/prof" string in .text. regards, Sebastian > I brought up this issue on the SuSE English List (SLE) and it was > suggested that I should pass my information along to this list. > > What follows is a cut and past of the thread from SLE... > > I just ran chkroot (chkrootkit-0.43, Sat Dec 27 2003) and it gave the > results > Checking `top'... INFECTED > and > Checking `lkm'... You have 5 process hidden for ps command > > I found these commands were in an rpm updated w/ synaptic recently, > ps_2003.11.17-18_i586.rpm. The file can be found at > ftp://ftp.gwdg.de/pub/linux/suse/apt/SuSE/9.0-i386/RPMS.suse-people > > top's size is 81.5kb and has a modified date of 2004-01-20 > #top -h > top: procps version 3.1.14 > > As further investigation I installed the previous rpm > (ps-2003.9.20-6.i586.rpm) from SuSE and then ran checkroot again, this > time no errors were reported. Then reinstalled the rpm from the apt > repository and the errors appear again. > > I know this doesn't mean that I haven't been rooted but it really points > a finger at the ps_2003.11.17-18_i586.rpm from > ftp://ftp.gwdg.de/pub/linux/suse/apt/SuSE/9.0-i386/RPMS.suse-people > (the apt archive) > If so anyone using apt for their upgrades should be concerned about > this. > > Continuing my investigation I booted up my test machine w/ SuSE 9.0 > ran checkrootkit and it showed all clean. Then I used synaptic and > updated ps (ps_2003.11.17-18_i586.rpm) and nothing else > then I ran chkroot again and the errors are there. > > Anders Johansson wrote (from 3 separate messages): > > chkrootkit is reacting to the string /prof in top. That string isn't in > the src.rpm, but it is in the binary. That alone is very suspicious. It > does look like kraxel's binaries are infected. I wonder what other > niceties are in the binaries in the apt repo > > The suspicious ps package is identical on suse.com and on gwdg.de, so it > seems that if something has been compromised it's on suse.com. > The problem is in the "top" in the ps package from /pub/people/kraxel > The top binary in that contains the string "/prof", which chkrootkit > detects > as a sign of an infected binary > > That string isn't in the src.rpm from kraxel's directory, and if you > rebuild the rpm from that src.rpm you also won't see that string. > > And finally a long quote from Ivan Sergio Borgonovo : > > I've done all these things > Installed ps through apt > Installed ps from DVD > Compiled and installed ps from ftp.suse.com > Installed chkrootkit from source > Installed chkrootkit from apt > > and the result ranged from no infected packages, no modules loaded to, > top or/and ps infected and hidden modules etc... > > I doubt that just substituting 2 binaries I can "unload" trojan > modules. > > I gave a look at the sources of chkrootkit and discovered which binary > was checking for "hidden" modules. > I discovered it has an option -v and got this output > > stige:~ # chkproc -v > PID 3: not in ps output > PID 4: not in ps output > PID 5: not in ps output > PID 6: not in ps output > You have 4 process hidden for ps command > > then I did... > > // edited to fit in email > stige:~ # ps aux > USER PID VSZ RSS TTY STAT START TIME COMMAND > root 1 620 256 ? S 22:00 0:04 init [3] > root 2 0 0 ? SW 22:00 0:00 [keventd] > root 0 0 0 ? SWN 22:00 0:00 [ksoftirqd_CPU0] > root 0 0 0 ? SW 22:00 0:00 [kswapd] > root 0 0 0 ? SW 22:00 0:00 [bdflush] > root 0 0 0 ? SW 22:00 0:00 [kupdated] > root 8 0 0 ? SW 22:00 0:00 [khubd] > root 9 0 0 ? SW< 22:00 0:00 [mdrecoveryd] > > Curiously enough > /proc/3 is actually ksoftirqd_CPU0 > /proc/4 is kswapd > ... bdflush, kupdated > > out of panic mode: reasonable??? > > So there you have it. I would love to post back to the SLE and apt4SuSE > lists that this is a non-issue but if there really is a problem then I > am sure that the great minds on this list will be able to help. > > Thanks for your time and I do apologize if I've broken any etiquette, I > just don't have time to read the whole FAQ, or search the archives > right now . > > > > -- > dh > > - -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~ - -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) Comment: For info see http://quantumlab.net/pine_privacy_guard/ iD8DBQFAHlZ5SVDhKrJykfIRAoGoAJ9kLWJ/8pHN4S4k2iZPxQFeI3QXIwCeLBW2 S+AysSlIRdwbrpyG1V+ymoQ= =88yp -----END PGP SIGNATURE-----

1 0

k3b issues
by Chris Herrnberger 02 Feb '04

02 Feb '04

Greets: On upgrading to KDE 3.2 RC1 from SuSE on 8.2 K3b giving me very strange results. SuSE version:k3b-0.10-2 The error message is as follows: ---------------------------------------------------------------------------- System ----------------------- K3b Version: 0.10 KDE Version: 3.2.0 RC1 QT Version: 3.3.0-snapshot-20040113 cdrecord ----------------------- /usr/bin/cdrecord: Warning: not running as root user, fs= option ignored. scsidev: '1,0,0' scsibus: 1 target: 0 lun: 0 Linux sg driver version: 3.1.24 cdrecord comand: ----------------------- /usr/bin/cdrecord -v gracetime=2 dev=1,0,0 speed=1 -eject -data -tsize=17504s - mkisofs ----------------------- 17504 /usr/bin/mkisofs: Resource temporarily unavailable. cannot fwrite 32768*1 mkisofs comand: ----------------------- /usr/bin/mkisofs -gui -graft-points -V K3b data project -volset -A K3B THE CD KREATOR VERSION 0.10 (C) 2003 SEBASTIAN TRUEG AND THE K3B TEAM -P -p K3b - Version 0.10 -sysid LINUX -volset-size 1 -volset-seqno 1 -sort /tmp/kde-chris123/k3buaBjtb.tmp -r -hide-list /tmp/kde-chris123/k3bRkTSua.tmp -l -iso-level 2 -path-list /tmp/kde-chris123/k3bKT4XBa.tmp ---------------------------------------------eof---------------------- What interesting here is that K3b claims that mkisofs> resource is temporarily unavailable and cannot write. The default K3b setting would point this to /tmp/kde-username which is set 777, usersname: users just to open it up. However the location and permission settings do not seem to affect the error output. mkisofs is currently also set as 777 and root:users to ensure that k3b has access No idea whats going on here..anyone have any light they can shed. Doing the process manually of course works just fine..:) and all CDROM drives are detected and properly configured. Best and tia.. /ch

7 13

Re: [SLE] bad sectors on hard drive (suse 9.0)
by Ales Jagodnik 02 Feb '04

02 Feb '04

Thank you very much. Could you perhaps tell me the xt3 format command? I will just run CD1 suse rescue , reformat existing partions to ext3 and swap (your command) , as they will all be the same size. Then I will run the e2fsck commands. Ales

6 7

2.4.22 kernel
by Dave Howorth 02 Feb '04

02 Feb '04

Is there a 2.4.22 kernel for SUSE? I have SUSE 9.0 on an Intel D875PBZ with a mix of PATA and SATA drives and experience intermittent lockups when running in BIOS 'Enhanced' mode (i.e. with the SATA drives appearing in native mode). The D875P uses an ICH5 and BandiPat quoted an article that said the Intel ICH5 needs a 2.4.22 kernel, so I want to give that a try. Thanks, Dave

2 1

suse 9 + amavisd + spamassasin
by mag1994＠tiscali.it 02 Feb '04

02 Feb '04

Hi all, i hope that anyone can help me setting up sendmail + amavis + spamassasin the problem is this if start amavisd-new and after sendmail and i issue a mail -v mik (user on localhost running all) the connection with the localhost hangs and waits the setup is the following Suse 9.0 with sendmail-8.12.10-7 amavisd-new-20030616p5-23 spamassassin-2.55-75 perl-spamassassin-2.55-75 nai antivirus the /var/log/mail Feb 2 13:22:59 charlize amavis[3650]: Found primary av scanner NAI McAfee AntiVirus (uvscan) at /usr/local/bin/uvscan Feb 2 13:22:59 charlize amavis[3650]: SpamControl: initializing Mail::SpamAssassin Feb 2 13:23:00 charlize amavis[3650]: SpamControl: done Feb 2 13:23:04 charlize sendmail[3663]: starting daemon (8.12.10): SMTP+queueing@00:30:00 Feb 2 13:23:04 charlize sendmail-client[3667]: starting daemon (8.12.10): persistent-queueing@00:30:00 Feb 2 13:23:04 charlize sendmail[3669]: i12CN4VN003669: from=<root(a)charlize.home.mydom.it>, size=480, class=0, nrcpts=1, msgid=<401E40A6.mail2RO11JAAV@c harlize.home.mydom.it>, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1] Feb 2 13:23:04 charlize amavis[3652]: (XXWSECeq) AM.CL /var/spool/amavis/amavis-milter-XXWSECeq: <root(a)charlize.home.mydom.it> -> <mik(a)charlize.home.mydom.it> Feb 2 13:23:04 charlize amavis[3652]: (XXWSECeq) Checking: <root(a)charlize.home.mydom.it> -> <mik(a)charlize.home.mydom.it> Feb 2 13:23:04 charlize amavis[3652]: (XXWSECeq) spam_scan: hits=0 tests=USER_AGENT Feb 2 13:23:04 charlize amavis[3652]: (XXWSECeq) FWD via SMTP: [127.0.0.1:10025] <root(a)charlize.home.mydom.it> -> <mik(a)charlize.home.mydom.it> Feb 2 13:23:04 charlize amavis[3651]: (03651-01) ESMTP::10025 /var/spool/amavis/amavis-20040202T132304-03651: <root(a)charlize.home.mydom.it> -> <mik(a)charlize.home.mydom.it> Received: from localhost ([127.0.0.1]) by localhost (charlize [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id 03651-01 for < mik(a)charlize.home.mydom.it>; Mon, 2 Feb 2004 13:23:04 +0100 (CET) Feb 2 13:23:04 charlize amavis[3651]: (03651-01) Checking: <root(a)charlize.home.mydom.it> -> <mik(a)charlize.home.mydom.it> Feb 2 13:23:05 charlize amavis[3651]: (03651-01) spam_scan: hits=0 tests=USER_AGENT Feb 2 13:23:05 charlize amavis[3651]: (03651-01) FWD via SMTP: [127.0.0.1:10025] <root(a)charlize.home.mydom.it> -> <mik(a)charlize.home.mydom.it> Feb 2 13:23:15 charlize sendmail[3676]: i12CNF33003676: from=root, size=257, class=0, nrcpts=1, msgid=<401E4133.mail2U311LBQR(a)charlize.home.mydom.it>, r elay=root@localhost Feb 2 13:23:15 charlize sendmail[3677]: i12CNFVN003677: from=<root(a)charlize.home.mydom.it>, size=480, class=0, nrcpts=1, msgid=<401E4133.mail2U311LBQR(a)charlize.home.mydom.it>, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1] i've some doubt about di mc file that is divert(-1) # # Copyright (c) 1999,2000 SuSE GmbH Nuernberg, Germany. # Author: Werner Fink <werner(a)suse.de> # include(`/usr/share/sendmail/m4/cf.m4') divert(0) VERSIONID(`@(#) suse-linux.m4 8.12.3-0.6 (SuSE Linux) 2003/04/15 mik1') define(`confCF_VERSION', `SuSE Linux 0.7 mik1')dnl #mik OSTYPE(`suse-linux')dnl dnl dnl Flags dnl define(`confDEF_USER_ID', `daemon:daemon')dnl define(`confCOPY_ERRORS_TO', `Postmaster')dnl define(`confPRIVACY_FLAGS', `authwarnings,needmailhelo,novrfy,noexpn,noverb')dnl define(`confTRUSTED_USERS', `mdom vscan wwwrun root uucp daemon mail')dnl define(`confNO_RCPT_ACTION', `add-to-undisclosed')dnl dnl dnl Mailer dnl define(`PROCMAIL_MAILER_PATH', `/usr/bin/procmail')dnl define(`PROCMAIL_MAILER_ARGS', `procmail -m $h $f $u')dnl FEATURE(`local_procmail')dnl define(`LOCAL_SHELL_FLAGS', `eu09')dnl define(`LOCAL_MAILER_ARGS', `procmail -a $h -d $u')dnl define(`LOCAL_MAILER_FLAGS', `SPfhn09')dnl define(`MILTER')dnl divert(-1) INPUT_MAIL_FILTER(`milter-amavis', `S=local:/var/run/amavis/amavis-milter.sock, T=S:10m;R:10m;E:10m') divert(0)dnl dnl dnl The default data base type is hash dnl define(`DATABASE_MAP_TYPE', `hash')dnl dnl dnl Main paths dnl define(`SMLIBDIR', `/usr/lib/sendmail.d')dnl define(`MAIL_SETTINGS_DIR', `/etc/mail/')dnl define(`confDEAD_LETTER_DROP', `/var/log/dead.letter')dnl define(`STATUS_FILE', `/var/run/sendmail/statistics')dnl define(`QUEUE_DIR', `/var/spool/mqueue')dnl define(`confHOST_STATUS_DIRECTORY', `.hoststat')dnl define(`HELP_FILE', SMLIBDIR`/helpfile')dnl define(`ALIAS_FILE', `/etc/aliases')dnl define(`confHOSTS_FILE', `/etc/hosts')dnl FEATURE(`use_ct_file')dnl define(`confCW_FILE', `-o /etc/mail/local-host-names %[^\#]')dnl define(`confCR_FILE', `-o /etc/mail/relay-domains %[^\#]')dnl define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl define(`confSERVICE_SWITCH_FILE', `/etc/mail/service.switch')dnl define(`confEBINDIR', SMLIBDIR`/bin')dnl define(`confDONT_BLAME_SENDMAIL', `AssumeSafeChown,TrustStickyBit,GroupReadableSASLDBFile')dnl define(`confCONTROL_SOCKET_NAME', `/var/run/sendmail/control')dnl define(`CERT_DIR', MAIL_SETTINGS_DIR`certs')dnl define(`confCACERT_PATH', CERT_DIR)dnl define(`AUTH_DIR', MAIL_SETTINGS_DIR`auth')dnl dnl dnl Daemon (disable new Message Submission Agent) dnl FEATURE(`no_default_msa')dnl dnl dnl Common features dnl FEATURE(`mailertable', `hash -o /etc/mail/mailertable.db')dnl FEATURE(`genericstable', `hash -o /etc/mail/genericstable.db')dnl FEATURE(`virtusertable', `hash -o /etc/mail/virtusertable.db')dnl FEATURE(`access_db', `hash -T<TMPF> -o /etc/mail/access.db')dnl dnl LOCAL_CONFIG #mik MAILER(procmail) MAILER(smtp) in the sendmail.cf there's # Input mail filters O InputMailFilters=milter-amavis # Milter options #O Milter.LogLevel O Milter.macros.connect=j, _, {daemon_name}, {if_name}, {if_addr} O Milter.macros.helo={tls_version}, {cipher}, {cipher_bits}, {cert_subject}, {cert_issuer} O Milter.macros.envfrom=i, {auth_type}, {auth_authen}, {auth_ssf}, {auth_author}, {mail_mailer}, {mail_host}, {mail_addr} O Milter.macros.envrcpt={rcpt_mailer}, {rcpt_host}, {rcpt_addr} and Xmilter-amavis, S=local:/var/run/amavis/amavis-milter.sock, T=S:10m;R:10m;E:10m thank you very much Mik __________________________________________________________________ Tiscali ADSL SENZA CANONE: Attivazione GRATIS, contributo adesione GRATIS, modem GRATIS, 50 ore di navigazione GRATIS. ABBONARTI TI COSTA SOLO UN CLICK! http://point.tiscali.it/adsl/index.shtml

1 0

camstream ftp file permissions
by steve-ss 02 Feb '04

02 Feb '04

Is there anyway that I can get camstream to upload snapshots with different permissions? I need this so that browsers can access the .jpg's on the 'net. The default is user-rw only. Or is there a way I can strem the output instead of taking snapshots? SuSE-9.0 Thanks, Steve.

1 0