October 2017 - openSUSE Users - openSUSE Mailing Lists

[opensuse] Using Volume Groups and the Boot Partition
by Richmond 21 Oct '17

21 Oct '17

In the documentation I see this: Warning: File System for Booting The file system used for booting (the root file system or |/boot|) must not be stored on an LVM logical volume. Instead, store it on a normal physical partition. https://doc.opensuse.org/documentation/leap/reference/html/book.opensuse.re… However, I have installed Leap 42.3 and I accepted a recommended partition layout (although I did change it and go back and forth a few times) and it put the /boot partition on the system-root logical volume. I have a grub2 rescue disc and I found I was still able to use it provided I 'insmod lvm' first. So is this documentation out of date? -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

2 1

[opensuse] where is the user's PATH variable set
by eddie 21 Oct '17

21 Oct '17

Some how my path is missing /home/user/bin. I know this is the default so one of my files must be messed up. Can someone tell me where the user's path variable is set please. I've checked /etc/profile .profile and .bashrc and they all seem standard and are untouched. I have some scripts in my bin folder that I would like to run and I can only do so by accessing them directly. How can I reset my path variable. It currently is: /usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games but the default should be /home/me/bin:/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games Thanks -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

1 1

[opensuse] Empty dialog boxes in some applications
by Mark Hounschell 20 Oct '17

20 Oct '17

I am running the eclipse IDE recently downloaded and when I hover my mouse over an icon, instead of getting text in a box describing what the icon is for, I get an empty box. I reported this over on the eclipse user forum and they wanted a recording of what I was doing so they could see. Si I installed xvidcap from packman to get a recording and I noticed that the xvidcap program did the same thing. Emtpy dialog boxes when I hover over an icon. So I now suspect this may be a SuSE problem. I've only done this on leap 42.3. Anyone else ever see this and know a possible solution? Thanks Mark -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

7 24

Re: [opensuse] Fwd: Basically every WiFi device just hacked?
by Wols Lists 18 Oct '17

18 Oct '17

On 18/10/17 17:48, Tony Su wrote: > Greg, > I agree with most of what you wrote about possible attack scenarios, > but YMMV regarding broadcasting enough noise to disrupt a session > causing a client to reconnect generally possible only if you have a > powerful enough transmitter and if that's the case then why bother > with these attacks? Just impersonate, capture passwords and be done > with it. > > And, it does matter about when Users connect and relative to the > amount of traffic, so for instance when Users first connect it's true > that they're Tx and Rx those magic packets, but the next most likely > thing to happen is that those machines will be updating and checking > email... So although it's more likely that those packets will be > within a smaller time frame, the total traffic volume will also be > enormous. > The scenario posited on LWN was very simple, and does not need much by way of powerful kit. Most sessions nowadays are spread-spectrum. I'm not sure how it works, but if you disrupt the connection open sequence, ie get the client transmitting on one frequency, and the router receiving on another, you can MITM the conversation. You then simply don't forward packet #3, forcing the client or router (can't remember which) to retry. This then causes the connection to reset with a nonce of 0, and a key of 0. Bingo - connection encryption now cracked, and the supposedly secure connection is wide open. That's the way these things always go - someone cocks up and the resulting crack is pretty simple. Changing topic slightly - you're aware somebody's found a bug in an RSA implementation such that any 4096-bit keys from this generator can be brute-forced? Not sure how long it takes but it's well within the ability of a determined attacker! As always, an implementation cockup gives a back-door into the encryption. Cheers, Wol > I just posted an opinion on the openSUSE Forums, as I described only > an opinion which of course can be subject to ridicule and disagreement > > https://forums.opensuse.org/showthread.php/527675-WPA2-situation?p=2842095#… > > As for DMARC, it's actually not more than SPF and TKIP which have been > around for ages plus applying policy. So, nothing revolutionary. And, > only addresses forging email domains. It won't do anything for you > regarding the overall possible phishing attacks and other ways of > implanting malware. If you're not already doing SPF and TKIP, then > it's a step forward but isn't a replacement for other methods like > blocklists, whitelisting and anti-spam. > > IMO, > Tony > > On Wed, Oct 18, 2017 at 6:38 AM, Wols Lists <antlists(a)youngman.org.uk> wrote: >> On 16/10/17 17:35, Tony Su wrote: >>> From the general description (I haven't been able to inspect a >>> detailed demo), it looks like a cousin to the Diffie Hellman flaw >>> described last year. >>> >>> If so, >>> - All encrypted traffic including SSL/TLS, SSH, VPNs, etc should be >>> protected despite the researchers' suggestion that <might> also be >>> vulnerable. And, all User activity that involves exchanging passwords >>> on websites, Financial/Banking, email and other activity are covered >>> here. >>> >>> - The other stuff about capturing, replaying and injecting content or >>> even false network settings is a different consideration, but if this >>> is not much different than what has always been possible using >>> aircrack-ng against WEP or WPA1, then there are practical >>> considerations which can make this kind of attack difficult although >>> possible... like... >>> >>> The attacker might have to capture gigabytes of data to obtain the few >>> packets which contain a WPA handshake. Low activity APs might be more >>> vulnerable than heavily used. >>> >>> Once captured, the attacker has to crack the keys. Depending on >>> strength and available machine resources plus method of crack (are >>> rainbow tables available and used?), this might take awhile >> >> LIKE A COUPLE OF NANOSECONDS? >> >> Sorry for shouting, but the nature of the crack tricks wpa_supplicant >> into using a key of 0x00. >>> >>> Once cracked, the keys are usable for only as long as the original >>> User has not yet closed his wireless session. Once the User has >>> disconnected, then a new session and handshake has to be cracked. >>> >>> So, >>> Unless you're supporting a high security wireless network, I don't >>> think that anyone should be pressing any emergency buttons, and if you >>> were supporting a high security network then I'd be questioning why >>> you even have Wifi or not deploying WiFi that automatically rotates >>> new keys every few minutes. >>> >> Yes you should be pressing security buttons. The key is absolutely no >> protection at all! >> >> Cheers, >> Wol >> >> >> -- >> To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org >> To contact the owner, e-mail: opensuse+owner(a)opensuse.org >> > -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

4 3

Re: [opensuse] Libreofficewriter problems printing embedded inage.
by Anton Aylward 18 Oct '17

18 Oct '17

On 18/10/17 06:36 AM, Mikhail Ramendik wrote: > On 17 October 2017 at 23:12, Anton Aylward <opensuse(a)antonaylward.com> wrote: > >> I believe the printer and driver can print images for a number of reasons. >> I can print a page from a PDF document that has images on it. > > So it can print other images, but this image fails to print from both > LO and exported PDF right? Cycling this way, this example. yes. > I would test the following things: > > - Will this image print on its own, for example, if you open it with a browser? Well, instead I went back to google maps and printed that, using BRScript (brothers PS) settings all the way down the line. That came out a a faint greyscale. This is not a colour printer. That result is disjointing. I would not use it as a graphic in a proposal. It is disappointing because this is a quality printer and back in the 12. and 13.x days I did produce proposals and reports with illustrations (I use a lot of mindmaps as regular readers might recall) > - Find a different image that prints from a browser, if you can. Then > paste it into an LO document and try to print that. Yes. Same result. > If the image does not print out in a browser, the matter is definitely > with the image. Then I'd try doing something with it in the Gimp (like > double the resolution) and try printing it again. Yes, I tied GIMP. Things got weird. At first it didn't help. Then I created a layer that was just text, markers to items on the map that googlemaps didn't state. I then embedded it in the document a printed. The text layer came out OK, the image layer didn't. As I say, weird. This is why I think there is something hinky in the PDF aspect of the print subsystem. I wish I could better see what the processing stream was, what transformations get done. When I get time I'm going to try converting the output to a PS file and doing a raw print. Oh, right, what's the CLI for raw printing again? -- A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting frowned upon? -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

2 1

[opensuse] Fwd: Basically every WiFi device just hacked?
by Greg Freemyer 18 Oct '17

18 Oct '17

All, Most WiFi routers have WEP, WPA, and WPA2. WPA2 was the most secure and the recommendation. No longer: https://www.theregister.co.uk/AMP/2017/10/16/wpa2_krack_attack_security_wif… But WPA2 comes in a couple variants. Does anyone know if any of them are unaffected? Thanks Greg -- -- Greg Freemyer Advances are made by answering questions. Discoveries are made by questioning answers. — Bernard Haisch -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

11 31

[opensuse] can i dual-boot plus run Win in a VM?
by David T-G 18 Oct '17

18 Oct '17

Hi, all -- I will, soon, once again finally have my own laptop, and it's been so long that I'm basically starting over :-)/2 I will dual boot because there are still times when I just have to be in Windows, but I'd also like to fire up that same copy in a VM when I just want to pop over for a moment. Is that an option? If so, is it perhaps even possible to wake and hibernate back and forth across metal and VM? Oh, and recommendations for good laptops that have trackpoint sticks in the keyboard are also welcome :-) TIA & HAND :-D -- David T-G See http://justpickone.org/davidtg/email/ See http://justpickone.org/davidtg/tofu.txt -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

3 8

[opensuse] /tmp mounting question
by Roger Oberholtzer 18 Oct '17

18 Oct '17

I need to replace the btrfs /tmp volume mounted on my Leap 42.3 system with a separate partition. The thing is, the new one will not be a btrfs volume. Surely it makes no difference if I comment out the existing btrfs line: UUID=dec8ab38-419f-46e3-bb03-c72b2688a142 /tmp btrfs subvol=@/tmp 0 0 and add something like this: /dev/sda3 /tmp ext4 defaults 0 0 And then reboot. Right? /dev/sda3 is formatted (obviously) but otherwise empty. I am always suspicious of what btrfs volumes are up to... -- Roger Oberholtzer -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

2 4

[opensuse] I need more ram, but I can't.
by Carlos E. R. 17 Oct '17

17 Oct '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I need more ram than my 8GiB, but my board doesn't allow it. I use swap, but Leap is very slow when swapping; I have the feeling that it is slower than other releases. So I wonder if there is some type of small hard disk that can be used for fast swap. SSD? Would it wear out? SSD is typically slow at writing. A RAM based "disk"? No need for battery backup, unless to keep the format. Does it exist? - -- Cheers Carlos E. R. (from 42.2 x86_64 "Malachite" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iEYEARECAAYFAlm/yMsACgkQtTMYHG2NR9WoeQCgkKbSLo1AZhJa29JhdYjE3myF HdsAn3dHyHmeqVDqNz08xUPhj712RDVz =S0mM -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

24 141

[opensuse] No encryption on imap on some servers [WAS: Basically every WiFi device just hacked?]
by Carlos E. R. 17 Oct '17

17 Oct '17

On 2017-10-16 22:37, James Knott wrote: > On 10/16/2017 04:02 PM, Carlos E. R. wrote: >> On 2017-10-16 20:11, James Knott wrote: >>> On 10/16/2017 01:51 PM, Carlos E. R. wrote: >>>> Besides, any communication protocol that uses encryption is safe, even >>>> if they get entry to our WiFi: ssh, https... but not, I think, smb, nfs, >>>> most email... >>> Many email providers are moving to SSL/TLS for POP, IMAP and SMTP. >> Not mine. >> > > Geez... Spain is really behind the times. Can you not even configure > it with your email apps? Also, email web interfaces now use https. > Also, Google tries to favour https web sites, to encourage encryption on > the web. It is the ISP, email is secondary for them. It is no longer offered to new clients, so they don't care that much. So currently the IMAP connection has no security at all, whereas the smtp connection does. I tried to enable starttls or ssl/tls and the connection failed. I also looked at my fetchmail log of one connection, it is this: - - 6.3.26 querying imap.telefonica.net (protocol IMAP) at 2017-10-16T13:07:35 CEST: poll started - - Trying to connect to 86.109.99.71/143...connected. - - IMAP< * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=CRAM-MD5] e.movistar.es. - - IMAP> A0001 CAPABILITY - - IMAP< * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=CRAM-MD5 - - IMAP< A0001 OK Pre-login capabilities listed, post-login capabilities have more. - - IMAP> A0002 AUTHENTICATE CRAM-MD5 - - IMAP< + ***********== - - IMAP> ************== - - IMAP< * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MUMULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS SPECIAL-USE BINARY MOVE QUOTA - - IMAP< A0002 OK Logged in - - IMAP> A0003 SELECT "Inbox" - - IMAP< * FLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk Junk) - - IMAP< * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk Junk \*)] Flags permitted. - - IMAP< * 3 EXISTS - - IMAP< * 0 RECENT - - IMAP< * OK [UNSEEN 1] First unseen. - - IMAP< * OK [UIDVALIDITY 1496821626] UIDs valid - - IMAP< * OK [UIDNEXT 33] Predicted next UID - - IMAP< A0003 OK [READ-WRITE] Select completed (0.002 secs). - - IMAP> A0004 EXPUNGE - - IMAP< A0004 OK Expunge completed. - - 3 messages for SOMEBODY at imap.telefonica.net (folder Inbox). - - IMAP> A0005 FETCH 1:3 RFC822.SIZE - - IMAP< * 1 FETCH (RFC822.SIZE 31383) - - IMAP< * 2 FETCH (RFC822.SIZE 15673) - - IMAP< * 3 FETCH (RFC822.SIZE 16227) - - IMAP< A0005 OK Fetch completed. - - IMAP> A0006 FETCH 1 RFC822.HEADER - - IMAP< * 1 FETCH (RFC822.HEADER {2994} - - reading message SOMEBODY@imap.telefonica.net:1 of 3 (2994 header octets)Trying to connect to 127.0.0.1/25...connected. - - SMTP< 220 Telcontar.valinor ESMTP - - SMTP> EHLO Telcontar.valinor - - SMTP< 250-Telcontar.valinor - - SMTP< 250-PIPELINING ... Looking at the exchange and that it used cramd5, I changed Thunderbird to also use encryption for the password and apparently it works - this is new. But I see no nothing about using TLS or SSL in the body fetch. On another provider (pop3), I see: - - POP3> CAPA - - POP3< +OK - - POP3< CAPA - - POP3< TOP - - POP3< UIDL - - POP3< RESP-CODES - - POP3< PIPELINING - - POP3< AUTH-RESP-CODE - - POP3< USER - - POP3< SASL PLAIN - - POP3< . - - pop.dominioabsoluto.net: upgrade to TLS succeeded. <========== so fetchmail tries and succeeds on another provider, but not on telefonica aka movistar. -- Cheers / Saludos, Carlos E. R. (from 42.2 x86_64 "Malachite" at Telcontar)

3 4