August 2015 - openSUSE Users - openSUSE Mailing Lists

[opensuse] Right directroy with trustancor (dnssec) for tumbleweed?
by stakanov＠freenet.de 24 Aug '15

24 Aug '15

I installed tentatively tumbleweed on a PC. My settings for dnssec validation do fail because dnsmasq fails to start. It cannot find the directory with the trust anchor (where I followed the indications in http://www.heise.de/netze/artikel/Auskunft-mit-Siegel-dnsmasq-als-DNSSEC-va… which work flawlessly with 13.2 stable). Have there been any changes to the anchor? Where can I find the content of /usr/share/dnsmasq/ in tumbleweed. I checked and it seems this directory is simply missing in tumbleweed. Thank you. --- Alle Postfächer an einem Ort. Jetzt wechseln und E-Mail-Adresse mitnehmen! http://email.freenet.de/basic/Informationen -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

2 1

[opensuse] Windows 10 Upgrade and UEFI dual-boot
by Bjoern Voigt 24 Aug '15

24 Aug '15

Some of my PCs and notebooks have openSUSE 13.2 and Windows 8.1 installed. I used the classic way to install them: 1) Windows 8.1 installation 2) Partitioning with resizing the big Windows partition 3) openSUSE 13.2 installation Are there any experiences with Windows 10 upgrade? HOWTOs? My questions: 1. Is it possible to upgrade Window 8.1 to 10 without loosing openSUSE (partitions, UEFI boot entries)? (There were reports about failed Windows 10 updates on dual-boot systems.) 2. Is it possible to install Window 10 from scratch without loosing openSUSE? 3. Which tools should I use from openSUSE to backup and restore the Windows 8.1 installation (only UEFI capable solutions please). 4. What is the best way to restore the openSUSE UEFI boot entries? (Rescue stick and efibootmgr?) Greetings, Björn -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

3 2

[opensuse] Can't enable SuSEFirewall2 SystemD service
by Bjoern Voigt 24 Aug '15

24 Aug '15

If I finish the YaST firewall setup I get: Attempt to `enable` service 'SuSEfirewall2' failed. ERROR: I am also unable to enable the SuSEfirewall2 service manually: systemctl enable SuSEfirewall2.service Failed to execute operation: Invalid argument Manual start works: # systemctl start SuSEfirewall2.service # systemctl status SuSEfirewall2.service SuSEfirewall2.service - SuSEfirewall2 phase 2 Loaded: loaded (/usr/lib/systemd/system/SuSEfirewall2.service; enabled) Active: active (exited) since Wed 2015-08-19 00:21:21 CEST; 5s ago Process: 23344 ExecStop=/usr/sbin/SuSEfirewall2 systemd_stop (code=exited, status=0/SUCCESS) Process: 23371 ExecStart=/usr/sbin/SuSEfirewall2 boot_setup (code=exited, status=0/SUCCESS) Main PID: 23371 (code=exited, status=0/SUCCESS) How can I get more details? "journalctl -n" shows nothing about the failed commands. Greetings, Björn -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

5 15

[opensuse] hplip for officejet pro 6830 not working
by Josep M Sole 24 Aug '15

24 Aug '15

Hi everyone, I have just bought an officejet pro 6830 which is supposed to run under openSuSE 13.2. (http://hplipopensource.com/hplip-web/models/officejet/officejet_pro_6830.ht… ). Trying to install I've noticed that the required version of hplip is above 3.14.10. So I've decided to install the last one (3.15.7), the .run file. I've followed this steps (http://hplipopensource.com/hplip-web/install/install/index.html ) but when it asks me for the root password remains "thinking". How can I install hplip for my printer? Thank you in advance. -- --- Josep Solé -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

5 10

[opensuse] openSUSE Distribution Security?
by Lew Wolfgang 24 Aug '15

24 Aug '15

Hi Folks, This is kind of a rhetorical question. Has there ever been a documented instance of malware being injected into either a base openSUSE release, or that was delivered by subsequent patch/application loads from repositories? How about the semi-official repositories? I remember the forums were compromised once upon a time. And are there any controls in place to prevent manipulation of repository mirrors? I know that the repositories have signatures, but what about the individual rpm files? Is there a master SHA-256 hash database that downloaded files could be checked against before being installed? I know, these may be dumb questions, but security seems to be on everyone's mind these daze. Regards, Lew -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

8 17

[opensuse] Chromium toolbar question
by Thomas Taylor 23 Aug '15

23 Aug '15

I've been using Firefox for many years now (oS 10.x) and am considering changing to Chromium. I've been able to get most of the settings the way I want but one thing I haven't been able to do is use custom toolbar buttons. In FF I open the file "custom-button-eccf45dc7.xpi" from codefisher.org and add buttons to the toolbar. So far, although I can open the file in Chromium, I haven't been able to figure out how to open the dialog box for adding the buttons to the toolbar. In FF this is done by right clicking on the toolbar but that isn't working in Chromium. 1: Are Chromium and Chrome the same thing? i.e.: is Chromium just the open source version of Chrome? 2: Is it even possible to easily modify the toolbar in Chrome and if so how? Thanks, Tom -- When you get all full of yourself try giving orders to a cat. - Anonymous ^^ --... ...-- / -.- --. --... -.-. ..-. -.-. ^^^^ Tom Taylor KG7CFC openSUSE 13.1 (64-bit), Kernel 3.11.6-4-default, KDE 4.11.2, AMD A8-7600, GeForce GTX 740 T/PCIe/ 16GB RAM -- 3x1.5TB sata2 -- 128GB-SSD FF 37.0, claws-mail 3.10.1 registered Linux user 263467 -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

1 0

Re: [opensuse] Possible SSH attacker?
by Marco Calistri 23 Aug '15

23 Aug '15

Il 21/08/2015 19:41, Greg Freemyer ha scritto: > > > On Fri, Aug 21, 2015 at 3:52 PM, Marco Calistri > <marco.calistri(a)yahoo.com.br <mailto:marco.calistri@yahoo.com.br>> wrote: > > Il 21/08/2015 12:44, Greg Freemyer ha scritto: > > On Fri, Aug 21, 2015 at 11:23 AM, Lew Wolfgang > <wolfgang(a)sweet-haven.com <mailto:wolfgang@sweet-haven.com>> wrote: > > On 08/21/2015 07:32 AM, Marco Calistri wrote: > > > Hello, > > I'm monitoring the /var/log/messages and I noticed this > kind of warning > (there are many similar): > > 2015-08-21T11:16:05.451779-03:00 linux-turion64 kernel: > [ 9894.977105 <tel:%5B%209894.977105>] > audit: type=2404 audit(1440166565.450:788): pid=4260 > uid=0 auid=4294967295 > ses=4294967295 msg='op=destroy kind=server > fp=ec:a9:63:90:61:bf:ea:53:d3:1b:fa:c3:38:da:ff:cc [MD5] > direction=? > spid=4260 suid=0 exe="/usr/sbin/sshd" hostname=? > addr=125.121.146.24 <tel:125.121.146.24> > terminal=? res=success' > > Have I to be worried? > > > I'm not familiar with that particular message, but the fact that > 125.121.146.24 <tel:125.121.146.24> is in China would make > me very nervous! It's > also blackholed by spamhaus. Do the other warnings > reference the same IP? > > Are you running sshd? Are you seeing any "sshd" entries > in /var/log/messages? > > Regards, > Lew > > > > I'm not aware of that specific message either, but failed ssh > connections from malicious IPs is so common it isn't worth > mentioning. > > I use fail2ban to scan my logs and look for failed SSH login > attempts. > On first detection it blocks that IP for some hours. Then after 3 > temporary blocks it does a permanent block. > > Currently I have 114 IPs in my permanent ban list. (I inadvertently > wiped it out a few months back.) > > I think most of the failed attempt try to login as root. I also > have > all root ssh access disabled. > > Greg > > > Greg, > > Interesting! > > This app., fail2ban is it difficult to setup? > > Thanks also to point out the important detail about ssh root access, > I will give a check to my ssh configuration. > > It is most probable my laptop is being attacked from a lot of days > or even months and I had not yet noticed it! > > Regards, > > -- > Marco Calistri > opensuse 13.2 (Harlequin) 64 bit - Kernel 4.1.5-2-desktop Gnome 3.16.2 > Intel® Core™ i5-2410M CPU @ 2.30GHz × 4 - Intel® Sandybridge Mobile > -- > To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org > <mailto:opensuse%2Bunsubscribe@opensuse.org> > To contact the owner, e-mail: opensuse+owner(a)opensuse.org > <mailto:opensuse%2Bowner@opensuse.org> > > > You should start a new thread, but it is not hard to use. Unfortunately > I don't think it can be setup via YaST. > > I have a newer fail2ban release installed from OBS (fail2ban-0.9.2). It > is easier to setup I think. The below may only apply to that version: > > It uses an override file /etc/fail2ban/jail.local. Here's mine: > > ========================> jail.local <================ > > # Fail2Ban jail base specification file > # > > # Comments: use '#' for comment lines and ';' (following a space) for > inline comments > > # The DEFAULT allows a global definition of the options. They can be > overridden > # in each jail afterwards. > > > [DEFAULT] > > > # "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban > will not > # ban a host which matches an address in this list. Several addresses can be > # defined using space separator. > ignoreip = 127.0.0.1/8 <http://127.0.0.1/8> > > # > # ACTIONS > # > > # Some options used for actions > > # Destination email address used solely for the interpolations in > # jail.{conf,local,d/*} configuration files. > > destemail = "put your email address here" > > [sshd] > enabled = true > action = %(action_)s > > [sshd-ddos] > enabled = true > action = %(action_mw)s > > # Added by GAF (Greg Freemyer) from a v8.x recipe > [ssh-repeater] > enabled = true > filter = sshd > action = %(action_mw)s > logpath = %(sshd_log)s > maxretry = 21 > findtime = 31536000 > bantime = 31536000 > > =============================================================== > > I deleted my email address. Also I deleted my IPs from the "ignoreip" > line above. You should add any static IPs you use so your don't disable > your own access inadvertently. > > Note [ssh-repeater] is not part of the base install, so I also have to > have:an extra action file: > > ======== /etc/fail2ban/action.d/iptables-repeater.conf > # Fail2ban configuration file > # > # Author: Phil Hagen <phil(a)identityvector.com > <mailto:phil@identityvector.com>> > # > # This file is NOT part of openSUSE default. It was added by GAF (Greg > Freemyer) > # > > [Definition] > > # Option: actionstart > # Notes.: command executed once at the start of Fail2Ban. > # Values: CMD > # > actionstart = iptables -N fail2ban-REPEAT-ssh > iptables -A fail2ban-REPEAT-ssh -j RETURN > iptables -I INPUT -j fail2ban-REPEAT-ssh > # set up from the static file > cat /etc/fail2ban/ip.blocklist.ssh |grep -v ^\s*#|awk > '{print $1}' | while read IP; do iptables -I fail2ban-REPEAT-ssh 1 -s > $IP -j DROP; done > > # Option: actionstop > # Notes.: command executed once at the end of Fail2Ban > # Values: CMD > # > actionstop = iptables -D INPUT -j fail2ban-REPEAT-ssh > iptables -F fail2ban-REPEAT-ssh > iptables -X fail2ban-REPEAT-ssh > > # Option: actioncheck > # Notes.: command executed once before each actionban command > # Values: CMD > # > actioncheck = iptables -n -L INPUT | grep -q fail2ban-REPEAT-ssh > > # Option: actionban > # Notes.: command executed when banning an IP. Take care that the > # command is executed with Fail2Ban user rights. > # Tags: <ip> IP address > # <failures> number of failures > # <time> unix timestamp of the ban time > # Values: CMD > # > actionban = iptables -I fail2ban-REPEAT-ssh 1 -s <ip> -j DROP > # also put into the static file to re-populate after a restart > ! grep -Fq <ip> /etc/fail2ban/ip.blocklist.ssh && echo "<ip> > # fail2ban/$( date '+%%Y-%%m-%%d %%T' ): auto-add for repeat offender" >>> /etc/fail2ban/ip.blocklist.ssh > > # Option: actionunban > # Notes.: command executed when unbanning an IP. Take care that the > # command is executed with Fail2Ban user rights. > # Tags: <ip> IP address > # <failures> number of failures > # <time> unix timestamp of the ban time > # Values: CMD > # > actionunban = /bin/true > > [Init] > > # Defaut name of the chain > # > name = REPEAT > ============================================================================================ > > It seems to be working fine. > > Greg > > > > > Thanks for the details Greg, I will think about it despite I have not a 24/24 online system. Regards, -- Marco Calistri opensuse 13.2 (Harlequin) 64 bit - Kernel 4.1.5-2-desktop Gnome 3.16.2 Intel® Core™ i5-2410M CPU @ 2.30GHz × 4 - Intel® Sandybridge Mobile -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

4 4

[opensuse] cryptsetup open won't map LVM volumes
by Xen 23 Aug '15

23 Aug '15

Hey, I was just wanting to inform that in openSUSE, whenever you run "cryptsetup open /dev/... cryptname" the cryptdevice gets mapped (entry appears in /dev/mapper) but any LVM volumes are not loaded automatically. I also did not know how to do it by myself. LVM shows everything is allright in terms of "lvdisplay" displaying all the logical volumes, and the like. The "lvm" command itself didn't seem to have any option of getting the volumes to be loaded/mapped. The dmsetup command also did not have any way to actually load the LVM. Now that I have internet I might find out, but I did not have any, as I needed to use the openSUSE rescue mode to access my drive and reinstall grub. I could not. Fact was that I was in a bit of a pinch as I have no other computing resources available, my Windows installation suddenly wouldn't enable my wifi anymore (as a form of not doing "rfkill unblock all", supposedly) and if it were not for the Kubuntu Live disc I had burned just moments before, I would not be having any computer for the coming months unless I installed openSUSE again from scratch, possibly having to wipe the LUKS block device. Maybe that's all irrelevant, but I was completely stuck. Maybe the answer was to do vgchange -ay <volgroupname> I couldn't find it. This stuff is really well hidden. Maybe a thought? I don't know. I think these volumes would need to get mapped automatically. Regards, Bart. -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

4 4

[opensuse] systemd[1]: Reexecuting ? Drives (re)mounted on running system?
by MarkusGMX 23 Aug '15

23 Aug '15

I have seen ...systemd[1]: Reexecuting several times now in /var/log/messages. But only today I also realized that afterwards sometimes there is (thunderbird reformats output): ...systemd[1]: Activated swap /dev/disk/by-id/ata-M4-CT128M4SSD2_000000001137031962ED-part4. ... ...systemd[1]: Mounted /var ...systemd[1]: Mounted /boot. ...systemd[1]: Mounted /. ...systemd[1]: Found device M4-CT128M4SSD2. (that's where /boot is on) ...systemd[1]: Started File System Check on /dev/disk/by-id/ata-M4-CT128M4SSD2_000000001137031962ED-part3. ...systemd[1]: Found device M4-CT128M4SSD2. ...systemd[1]: Started File System Check on /dev/disk/by-id/ata-M4-CT128M4SSD2_000000001137031962ED-part2. ...systemd[1]: Found device M4-CT256M4SSD2. (2nd SSD =Windows boot) ...systemd[1]: Found device /dev/disk/by-id/md-uuid-49818217:13c92065:79a2503c:31fc331d-part1. ...systemd[1]: Found device M4-CT128M4SSD2. ...systemd[1]: message repeated 26 times: [ Found device M4-CT128M4SSD2.] ...systemd[1]: Found device M4-CT256M4SSD2. ...systemd[1]: message repeated 7 times: [ Found device M4-CT256M4SSD2.] ...systemd[1]: Found device /sys/devices/virtual/block/md126/md126p1. ...systemd[1]: Found device /dev/md126p1. (RAID1 !) I am using ext4 on a 13.1 SuSE. Are these fake messages or are the drives really remounted on a running system? Why? The message "repeated 26 times" also does worry me. Is the system going into some "bad state"? Problems with the controller? Thanks in advance ME -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

1 1

[opensuse] What reads a pdf that contains forms?
by David C. Rankin 23 Aug '15

23 Aug '15

All, There are new forms the courts require that I am having trouble reading. The following is a Civil Docketing Statement for the 4th Court of Appeals in Texas. The site recommends Adobe Reader, which I don't have. I've tried my old trusty kpdf (nope), the readers in FF39 (nope). What else will read it? http://www.txcourts.gov/media/515780/cv_ds.pdf -- David C. Rankin, J.D.,P.E. -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

15 66