October 2017 - openSUSE Users - openSUSE Mailing Lists

[opensuse] IPv6 Rogue Router Security Issue
by Lew Wolfgang 30 Dec '17

30 Dec '17

Hi Folks, There seems to be a flurry of IPv6 talk going on, maybe this is time for me to bring up the rogue router problem again? I asked about this a couple of times over the years but could never find anyone to comment on it. First, here's the RFC that describes the problem: https://tools.ietf.org/html/rfc6104 Rogue routers have affected me personally at a customer's site. This is a large, professionally managed, dual-stacked network with a number of v4 class B addresses and thousands of hosts. Subnets seem to be /20 CIDR in size, so there are plenty of "neighbors" on any given subnet. I've encountered the situation where misconfigured Windows systems will advertise themselves as an IPv6 router. They then happily accept traffic and drop it all silently on the floor. This problem doesn't seem to bother other Windows boxes too much, but it absolutely kills SSH connections. SSH preferentially tries IPv6 port 22, which when sent to a dumb Windows box results in very long hangups and connection failures. My workaround for my cohort of Linux desktops and servers was to disable IPv6 for both ssh and sshd. This will work for as long as the host network supports dual stacks, but eventually? Then there's the issue of intentional MITM attacks using this vector. If a bad actor has physical access to a subnet, or has compromised a host on that subnet, your goose is cooked. This link mentions some mitigations, but they're quite technical and may require hardware support. https://community.infoblox.com/t5/IPv6-Center-of-Excellence/Holding-IPv6-Ne… So, what is the threat to a home IPv6 user who has WiFi and an Internet of Things with minimal/non-existent security? I personally feel safer behind a nice natted IPv4 firewall with ACL rules between my copper and WiFi subnets. I just feel that I have more control of the situation with a simpler network. Has SUSE addressed this issue? Tell me I don't have to worry about it! Regards, Lew -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

12 67

[opensuse] Big memory footprint: clamd
by Carlos E. R. 17 Dec '17

17 Dec '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, When I built my computer I put as much RAM as the board would allow, 8GiB. Today that is too little, but I can't add more. Telling 'mc' to sort by Resident memory, it shows: top - 22:44:32 up 28 days, 4:37, 4 users, load average: 0,26, 0,55, 1,02 Tasks: 521 total, 2 running, 517 sleeping, 0 stopped, 2 zombie %Cpu(s): 1,2 us, 0,6 sy, 0,0 ni, 97,3 id, 0,8 wa, 0,0 hi, 0,0 si, 0,0 st KiB Mem: 8174408 total, 7511580 used, 662828 free, 546440 buffers KiB Swap: 43744244 total, 1921984 used, 41822260 free. 3837656 cached Mem PID USER PR NI VIRT RES SHR SWAP S %CPU %MEM TIME+ COMMAND 20581 cer 20 0 3553104 1,266g 263636 0 R 4,088 16,24 3:52.94 firefox 3493 vscan 20 0 1376180 536972 10364 14548 S 0,000 6,569 11:27.15 clamd 19773 cer 20 0 1452508 309508 141740 0 S 0,000 3,786 0:05.72 soffice.bin 3874 root 20 0 1090892 226564 154380 217968 S 0,798 2,772 182:22.08 X 31344 cer 20 0 206044 87728 7404 1664 S 0,000 1,073 1:55.04 alpine 4176 cer 20 0 748016 56796 21004 17136 S 0,000 0,695 2:56.67 xfdesktop 20088 cer 20 0 829220 53820 4596 0 S 0,000 0,658 0:02.04 gnome-software 9835 cer 20 0 784100 40604 17784 36520 S 0,100 0,497 1:46.40 gnote 4207 cer 20 0 891040 38988 22504 18136 S 0,000 0,477 0:32.57 keepassxc ... The worst offender this moment is Firefox (Thunderbird is closed now). But the next is clamd (clamav, antivirus mail scanner daemon)! It is using more than LibreOffice! How can that be? It is iddle at the moment, doing nothing. What can be done to reduce its footprint? Instead of the daemon, I could call it from amavis, one process per mail. But this impacts scan speed. Could the daemon be started "on demand", and be killed a minute after the last email goes through? - -- Cheers Carlos E. R. (from 42.2 x86_64 "Malachite" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iEYEARECAAYFAlmGMxIACgkQtTMYHG2NR9UeCgCeNA+LGMhfhjS84U4h7EeEwlbT RhkAoIldf2vOQVms3CwHLc87ybN7vVDs =KoWk -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

4 30

[opensuse] Again, trying to find a suitable video editor.
by Carlos E. R. 02 Dec '17

02 Dec '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I simply can't find a suitable video editor that works. My goal is to extract the interesting parts of a TV recording. Ie, mark the start of the movie, the end, the commercials inside, and dump all that into a single file, perhaps recoding. One limitation is that movies here have two sound tracks, one in Spanish, and the other one in the original language, typically English. I want to keep both, obviously. I don't need any transition or effect, just a simple editor that allows me to remove unwanted sections. I have tried: pitivi - crashes on start LiVES - works for an hour at 100% CPU and can't load the file. dvbcut - says my mpeg file is not a video (and it certainly is!) tragtor - can convert, but not edit. openshot - almost. My video has two sound tracks, and this tool ignores the second track. cinelerra-cv - I can't make head or tails of it. I tell it to load a video file, it does, but then I don't see how to do anything. It doesn't even display the video. I may have to read the manual, but I dislike having to read a manual for a GUI. Still... kdenlive - Well... crashes too often. I can mark the cuts, but it does not display what I'm cutting. And only one sound track. HandBrake - no edit. Avidemux - one sound track only. Kino - abandonware. Lightworks ?? Shotcut - Segmentation fault on start. cer@Telcontar:~/Videos/Fusion/trabajo> shotcut QSqlDatabase: QSQLITE driver not loaded QSqlDatabase: available drivers: QMYSQL QMYSQL3 QSqlQuery::exec: database not open QSqlQuery::exec: database not open Database::Database(QObject*) Failed to get version. QSqlQuery::exec: database not open bool Database::upgradeVersion1() Failed to create thumbnails table. Database version is 0 Segmentation fault cer@Telcontar:~/Videos/Fusion/trabajo> Flowblade ?? I don't understand the tool. May need some reading. At least it runs. I would like something that would produce a command line to ffmpeg in a GUI. Then I could modify further the options. This would be ideal. tragtor works this way, but has no editor. - -- Cheers Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iEYEARECAAYFAlbbJ80ACgkQtTMYHG2NR9UmagCeK8UbAAz5/lAjBvscdhzBuxtb WUQAn2jmzoy7810hldN4WwVWQktgVp2g =muqW -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

28 199

[opensuse] Apache Start Up Problem
by Paul Groves 17 Nov '17

17 Nov '17

Hi All, I had a weird problem today. I noticed that after a reboot of my server, my owncloud instance on my desktop was complaining about an invalid certificate. I tried to 'open owncloud in browser' and was presented with my apache default page. So first thing I tried is restart the apache service. This fixed the problem. However, every time I reboot apache is not loading my configuration correctly and the problem repeats. It appears to be loading the default configuration file fine at boot but ignoring the other files. (including owncloud). But when I manually stop and start the service they load fine. Huh?? Any idea how I can diagnose what is causing this problem? What is the difference between the apache service loading at boot compared to manually starting the service? Thanks -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

4 14

[opensuse] Boot failure after update from 42.2 to 42.3 "Grub-tpm-measure not found"
by stakanov 14 Nov '17

14 Nov '17

This is a very puzzling error as I did not install trusted grub and I do not have tpm on the system. The system is also not UEFI. The update was from 42.2 (working well) to 42.3 (screwed it up and I am now in rescue mode). Did anybody encounter this or does understand what the issue actually is? -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

7 31

[opensuse] Evolution default browser
by Christopher Myers 13 Nov '17

13 Nov '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi all, I've got Evolution installed on oS Tumbleweed using KDE, and for some reason, it doesn't respect the fact that Firefox is my default browser - -- every link I try to click on opens in Chromium. Is there any way to change things around? I didn't see any option in the configuration for browser choice. I've googled around on and off for a couple of days now and haven't found anything useful. Thanks! -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEE7GM/Dul8WSWn72odQ1nEo4DFCIUFAlm6k/QACgkQQ1nEo4DF CIWfBgf+K9LYvaYDDFUMJtRTMq+58e2lEP5GkXi7dKQhxhFkeKegwqnyo+fEfpvb RI1FT2aJAqBKsIZ5oZlxsGeJYcmp/+JO7AJ6Oa8XkWz02rmhgXjKPxqQgzQX87FM rNGqxOLXfcKu+CmcMERZswTQ/B/ZtA82eUls6Y5W7lIh2tAUbt2CnFP/6q5uM4wl pO2KNbcVJTTM2uEPSzEIBCQ/7jfZ9ogF+qIClPkn1UCmu3EqkLAhS+cdKzzJs+Cx pXyosNImtxW4FMl6W+m2NS08RCc69+U3Myr9aDe8q8/2fnM/HYApeezDsIpKkdnO t2Nr2WaxarbwUyqt15vTiNs0Q229jg== =joxc -----END PGP SIGNATURE-----

4 8

[opensuse] pdftk exists in suse?
by ken 08 Nov '17

08 Nov '17

Is there an app called pdftk for suse? I know there are many apps to handle PDFs, but this one is unique in its capabilities... I haven't found another which can do all the same things. -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

13 28

[opensuse] Yast segmentation fault on several installs of 42.3
by andreil1 08 Nov '17

08 Nov '17

Hi, I have several installs of Leap 42.3, and almost all of them have the same problem with yast2 - launching it results in: /sbin/ast2: line 447: 30273 segmentation fault (core dumped) $y2ccbin $Y2UI_ARGS “$@“ However, yast2 —gtk works just fine. No updates from repositories really helps. Anyone know how to fix this issue ? Thanks in advance. -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

9 13

[opensuse] Unstable wifi on 42.2
by Mikhail Ramendik 08 Nov '17

08 Nov '17

Hello, I have Leap 42.2. After some update relatively recently (or possibly after a change of VDSL provider and therefore of access point/router) wifi became unstable. It is an old-ish 2.4 GHz card that uses the rt2800pci driver. It is working, but after some time, pings to the access point/router become very slow (up to 3 seconds!) and packet loss appears. Network connectivity is noticeably flaky (slow loads, extrtemely laggy games, etc). The output of the dmesg command contains the following kind of messages periodically: [ 8488.700135] cfg80211: World regulatory domain updated: [ 8488.700139] cfg80211: DFS Master region: unset [ 8488.700140] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time) [ 8488.700141] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 8488.700142] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz, 92000 KHz AUTO), (N/A, 2000 mBm), (N/A) [ 8488.700143] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A) [ 8488.700144] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (N/A) [ 8488.700145] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s) [ 8488.700146] cfg80211: (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s) [ 8488.700147] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 8488.700147] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A) [ 8489.835461] wlan0: authenticate with 70:50:af:cc:3b:02 [ 8489.851029] wlan0: send auth to 70:50:af:cc:3b:02 (try 1/3) [ 8489.853331] wlan0: authenticated [ 8489.854916] wlan0: associate with 70:50:af:cc:3b:02 (try 1/3) [ 8489.858363] wlan0: RX AssocResp from 70:50:af:cc:3b:02 (capab=0x1411 status=0 aid=2) [ 8489.858433] wlan0: associated [ 8490.006569] SFW2-INext-DROP-DEFLT IN=wlan0 OUT= MAC=00:0e:2e:e5:df:23:70:50:af:cc:3b:01:08:00 SRC=192.168.1.254 DST=192.168.1.10 LEN=308 TOS=0x00 PREC=0x0 0 TTL=64 ID=0 PROTO=UDP SPT=67 DPT=68 LEN=288 What can I do to fix or diagnose this? -- Yours, Mikhail Ramendik Unless explicitly stated, all opinions in my mail are my own and do not reflect the views of any organization -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

7 10

[opensuse] openSUSE merits a better home page
by Roger Price 06 Nov '17

06 Nov '17

openSUSE merits a better home page than the current one [https://www.opensuse.org/] A recent article in Linux.com [4] explains << Initially openSUSE’s mission statement was to “encourage use of Linux & Open Source everywhere.” But, that’s no longer the heart and soul of openSUSE. OpenSUSE has evolved beyond just a Linux distribution project. They now cater to a totally different audience -- developers and sysadmins. So, openSUSE board members drafted a new mission statement: “Openly engineered tools to change your world.” ... >> << “... What we do essentially is engineering - we help in building packages, we help in testing and we help in delivering them. We care about the process.” said Brown. “At the same time everything that we do is a tool, OpenQA is a testing tool, OBS is a packaging tool, YaST is system management tool, even our distributions Leap and Tumbleweed are tools.” >> Now that openSUSE recognizes that it's main audience is a world of developers and sysadmins, the home page should show this with a style suitable for developers and sysadmins. The home page should be precise and unashamedly technical with just sufficient graphics; no twirling logos, no large pastel coloured rectangles. The home page should also be a tool, providing a crisp statement from the Chairman of the Board on why openSUSE+Yast is the best distribution of them all, and clear links to all the other tools from the top of the page. See Debian [1], DNS24 [2] and openBSD [3] for succinct examples of what can be done. Roger [1] http://www.debian.org [2] http://www.dns24.ch [3] https://www.openbsd.org/ [4] https://www.linux.com/blog/event/open-source-summit-na/2017/6/opensuse-leap…

30 155