September 2020 - openSUSE Users - openSUSE Mailing Lists

Re: [opensuse] [SOLVED] Strongswan fails to configure / stopped working / how to configure on OpenSuse 15.1/15.2
by Glen 19 Sep '20

19 Sep '20

All - On Thu, Sep 17, 2020 at 2:34 AM Carlos E. R. <robin.listas(a)telefonica.net> wrote: > On 17/09/2020 03.16, Glen wrote: > > worked, I wanted to log this in here for our community. > Thankyou :-) Thank you! > > Does anyone here have guidance or an opinion on whether this > > information should be sent to a different list (e.g. opensuse-support) > IMO, here is fine. Good to know, thank you. > > Does anyone here have guidance or an opinion on whether this should be > > bug reported? > Yes, certainly, you should report in Bugzilla. And On Wed, Sep 16, 2020 at 9:10 PM Andrei Borzenkov <arvidjaar(a)gmail.com> wrote: > You should open bug report. Such changes are not acceptable in stable > releases. I just wanted to thank you both for your guidance here. As suggested, I have filed a detailed bug report on this issue here: https://bugzilla.opensuse.org/show_bug.cgi?id=1176735 We shall hope for the best. Thank you! Glen -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

1 0

[opensuse] e-books
by Dave Howorth 18 Sep '20

18 Sep '20

I'm discussing with a publisher and author of a book how to get an electronic copy of the book. It's published for Kindle, as an ePub (with Adobe DRM) and as a PDF. So I asked how to download the PDF but haven't got a straight answer yet (grr! :) In the meantime, is it easy/possible to read an e-book intended for a Kindle or a DRM-protected ePub? (And I'd rather not start with trying to install Adobe software inside wine unless there's some absolute guarantee of support, and even then I'd prefer not to). -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

13 76

[opensuse] Re: [opensuse-factory] Thunderbird 78 and encryption status
by Wolfgang Rosenauer 17 Sep '20

17 Sep '20

Hi, Am 14.09.20 um 20:53 schrieb Martin Wilck: > Q: "I need to use both GnuPG and Thunderbird in parallel, can I > synchronize my keys?" > A: "No." > > Q: "How is my personal key protected?" > A: "At the time you import your personal key into Thunderbird, we > unlock it, and protect it with a different password, that is > automatically (randomly) created. [..] You should use the Thunderbird > feature to set a Master Password. Without a master password, your > OpenPGP keys in your profile directory are unprotected." > > These two answers prove to me that this feature isn't production-ready. > Protecting one of the most important items for personal privacy (the > GPG secret key) with just the thunderbird master password sounds like a > joke. In general, not relying on gpg strikes me as a bad idea, as > that's what allows sharing the same set of keys between different > applications. And being unable to share or even synchronize keys with > the de-facto-standard PGP encryption software seems - dumb, sorry. > > It's not your fault. But perhaps let it sit in the mozilla repo for > some more time. what I understood it was not a light decision to implement it like this. There was basically not much choice from what I know. The Mozilla platform does not allow that deep integration with the system anymore (with the removal of legacy extensions to webextensions only). Integrating or linking to GPG components then again would have been a platform specific one and also apparently license wise not really an option. Just waiting most likely won't change the situation because of that. For certain usecases a bit of GPG support is still available: https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards Wolfgang -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

4 3

[opensuse] Filing bugs at https://bugzilla.opensuse.org/index.cgi
by Moby 17 Sep '20

17 Sep '20

I recently posted to the list about a problem with the latest update to icinga2 package on openSuSE Leap 15.2. With no luck so far, I decided to open a bug. I installed the source RPM to find the location to post bugs. in the SPEC file, it mentions "Please submit bugfixes or comments via https://bugs.opensuse.org/". I assume this means I can also go to this site to file bug reports. There is no clear indication of where to go to file bugs. Once I go to https://bugzilla.opensuse.org/index.cgi, I can find no hints as how to file a new bug. There are multiple "new" options on the site (new test case, new bug etc.) but no matter which "new" I go to, I can only get as far as choosing the product, after which I have no idea what to do. The system seems stuck on trying to search for "Test plans" etc. Am I at the wrong place to report a bug? Thank you in advance for your help, --Moby -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

4 10

[opensuse] [SOLVED] Strongswan fails to configure / stopped working / how to configure on OpenSuse 15.1/15.2
by Glen 17 Sep '20

17 Sep '20

All - I have been struggling with StrongSwan for a number of days, and finally have a solution to my problem, so I'm posting it here. Apologies if this is common knowledge now, but my problem is reproducible on fresh installs of 15.1 and 15.2, Google failed to help, Bugzilla shows nothing relevant, and https://lists.opensuse.org/cgi-bin/search.cgi?query=strongswan&list=opensuse is currently returning a 500 server error. Therefore, I'm posting the solution I found here, for the archives, and I do have two procedural questions at the end. SYMPTOMS: I had been using Strongswan on several OpenSuse servers in different locations to provide VPN service to my users. I had two types of users - Android clients, and Windows 10 clients. A number of months ago, most likely after a zypper update, Strongswan just... stopped working. No clients of either type could connect to *any* of my servers. My clients could connect to other providers, but it seemed all of my servers just stopped working. The servers had initially been configured with the relevant yast2 snapin, which had created simple /etc/ipsec.conf and /etc/ipsec.secrets files, and which had worked for over a year. Everything was easy, fine, and reliable... until it wasn't. No matter what configurations I tried, either using yast2 or manually editing the ipsec.* files, I could not get any clients to connect. Upon checking the log files, I was noticing things like: no authorities found, 0 unloaded no pools found, 0 unloaded no connections found, 0 unloaded No matter what I tried in ipsec.conf, nothing was being recognized. CAUSES IDENTIFIED: At some point in an update, the behavior of strongswan changed without warning. Strongswan started *ignoring* the /etc/ipsec.conf file completely. Digging into the documentation, I discovered that /etc/ipsec.conf was being deprecated by the Strongswan team in favor of /etc/swanctl/swanctl.conf. HOWEVER, that change was *not* picked up on by yast2. Yast2 continues to pretend to configure VPNs, and appears to function properly; however, it writes an /etc/ipsec.conf file each time, which is ignored by Strongswan. TESTS RUN: I tried removing /etc/swanctl/swanctl.conf (a basically blank file with just comments in it anyway) to see if Strongswan would fall back to /etc/ipsec.conf. It did not. I confirmed that the deprecated "stroke" plugin was present, it is, and it's supposed to load /etc/ipsec.conf, but it does not. I did a fresh, clean install of OpenSuSE 15.1, and confirmed the same behavior there. I also did a clean install of 15.2, and that behavior persists: Strongswan completely ignores /etc/ipsec.conf, Yast2 ignores everything else, and only works with /etc/ipsec.conf. SOLUTION: The only solution I was able to find was to abandon Yast2 and /etc/ipsec.conf, and create an actual /etc/swanctl structure, set it up and run it. The internet has a number of configuration examples attempting to explain this.... and none of them work. There are many people out there also who ask questions, and come back and say, "Oh, I fixed it," but they never post their fixes, and leave the world hanging. I am therefore providing herethe configuration steps and control file I used to make Strongswan work on OpenSuse 15.1 and 15.2 for both Android (IKEV1) clients and Windows 10 (IKEV2) clients, simultaneously. This setup assumes your server has a fully-qualified name, resolves on the internet, and has an SSL certificate to match that name. It is for a server, on the internet, serving roaming "road warrior" clients. First, setup the directories, and copy in your keys: mkdir /etc/swanctl/private /etc/swanctl/x509 /etc/swanctl/x509ca cp your.private.key /etc/swanctl/private cp your.public.crt /etc/swanctl/x509/ cp your.cert.chain /etc/swanctl/x509ca/ Then, create your /etc/swanctl/swanctl.conf file: -----begin-below-this-line----- connections { ikev1-psk-xauth { version = 1 proposals = aes256-sha256-modp1024,aes256-sha1-modp1024,aes192gcm16-aes128gcm16-prfsha256-ecp256-ecp521,aes192-sha256-modp3072,default rekey_time = 0s pools = primary-pool-ipv4 fragmentation = yes dpd_delay = 30s dpd_timeout = 90s local-1 { auth = psk } remote-1 { auth = psk } remote-2 { auth = xauth } children { ikev1-psk-xauth { local_ts = 0.0.0.0/0 rekey_time = 0s dpd_action = clear esp_proposals = aes192gcm16-aes128gcm16-prfsha256-ecp256-modp3072,aes192-sha256-ecp256-modp3072,default } } } ikev2-pubkey { version = 2 proposals = aes192gcm16-aes128gcm16-prfsha256-ecp256-ecp521,aes192-sha256-modp3072,aes256-sha256-modp2048,aes256-sha1-modp1024,default pools = primary-pool-ipv4 local { auth = pubkey certs = your.public.crt id = your.server.fqdn } remote { auth = eap-mschapv2 eap_id = %any } children { ikev2-pubkey-child { local_ts = 0.0.0.0/0 esp_proposals = aes192gcm16-aes128gcm16-prfsha256-ecp256-modp3072,aes256-sha256-modp2048,aes256-sha1-modp1024,default } } } } pools { primary-pool-ipv4 { addrs = 192.168.100.0/24 dns = 1.1.1.1, 8.8.8.8 } } secrets { ike-one { secret = "yourprivatepresharedkey" } eap-youruserid { id = youruserid secret = "yourpersonalvpnpassword" } } -----end-above-this-line----- For clarity, he first section supports Android clients using the native OS VPN setup. The second section supports Windows 10 clients using the native OS VPN setup in "IKEV2" mode. Anything that you might have to change in the above file starts with "your". If you run a firewall, you must of course open the relevant ports; iptables rules look like: iptables -A INPUT -p 50 -j ACCEPT iptables -A INPUT -p udp --dport 500 -j ACCEPT iptables -A INPUT -p udp --dport 4500 -j ACCEPT iptables -A FORWARD -s 192.168.100.0/24 -j ACCEPT iptables -A FORWARD -d 192.168.100.0/24 -j ACCEPT iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -j MASQUERADE After installing the above, and restarting Strongswan, my /var/log/messages shows: swanctl[18023]: loaded pool 'primary-pool-ipv4' successfully loaded 1 pools, 0 unloaded loaded connection 'ikev1-psk-xauth' loaded connection 'ikev2-pubkey' successfully loaded 2 connections, 0 unloaded ... and everything just works. I have not tested on IOS or Apple yet, but I expect they will work, and can follow up if additional changes were needed. Again, I'm sorry if this is common knowledge now, or if I'm missing something obvious, but since Yast2 still fails, and no examples worked, I wanted to log this in here for our community. QUESTIONS Does anyone here have guidance or an opinion on whether this information should be sent to a different list (e.g. opensuse-support) ? Does anyone here have guidance or an opinion on whether this should be bug reported? Thank you again for your patience. Glen -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

3 2

[opensuse] Nuisance with Evince
by Carlos E. R. 16 Sep '20

16 Sep '20

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm on XFCE (Leap 15.1), and I have a nuisance problem with Evince. When I open a PDF document (invoices from several providers) the window is always a bit bigger than the usable area of the display, it goes under the panel area at the bottom of the screen, so that I always have to resize it. But first, as the bottom edge is not visible, I have to resize dragging the top edge down a fair bit, then move the top edge of the window to the top of the screen, and then resize the bottom edge of the window down to the actual edge of the display, not what it thinks the display size is. Use fixed size font to see the drawings: ************************************** * +------------+ * * | | * * | | * * | | * * | | * * | | * * | | * * | | * * | | * * | | * * | | * ************************************** resize down from top edge: ************************************** * * * ^+------------+ * * | | * * | | * * | | * * | | * * | | * * | | * * | | * * | | * * | | * ************************************** move up ************************************** * +---^--------+ * * | | * * | | * * | | * * | | * * | | * * | | * * | | * * | | * * +------------+ * * * ************************************** resize up from bottom edge ************************************** * +------------+ * * | | * * | | * * | | * * | | * * | | * * | | * * | | * * | | * * | | * * +------------+^ * ************************************** What is this, bug, feature, configuration issue? Maybe it is a Gnome application and their devs don't care at all about behaving correctly in XFCE? - -- Cheers Carlos E. R. (from 15.1 x86_64 at Telcontar) -----BEGIN PGP SIGNATURE----- iHoEARECADoWIQQZEb51mJKK1KpcU/W1MxgcbY1H1QUCX2HXsxwccm9iaW4ubGlz dGFzQHRlbGVmb25pY2EubmV0AAoJELUzGBxtjUfV8gsAni3UAcK8R7/lt/U5I4lq c+EFUz0nAJ4mTXyCSuwc5nfFB19MeXJOrSUjBA== =KzhG -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

3 6

[opensuse] opensuse 15.2 lost password
by Carl Spitzer {L Juno} 16 Sep '20

16 Sep '20

I have gone and dome something dumb and lost the paper with the root password. In the old days a Knoppix disk could be used to boot a system and remove the password indicator. Thus clearing the root password and allowing a new one to be set. Is this still true? /etc/passwd root:x:0:0:root:/root:/bin/bash [--] - [--] [--] [-----] [--------] [--------] | | | | | | | | | | | | | +-> 7. Login shell | | | | | +----------> 6. Home directory | | | | +--------------------> 5. GECOS | | | +--------------------------> 4. GID | | +-------------------------------> 3. UID | +-----------------------------------> 2. Password +----------------------------------------> 1. Username Password. In older Linux systems, the user’s encrypted password was stored in the /etc/passwd file. On most modern systems, this field is set to x, and the user password is stored in the /etc/shadow file. From https://linuxize.com/post/etc-passwd-file/ ____________________________________________________________ Sponsored by https://www.newser.com/?utm_source=part&utm_medium=uol&utm_campaign=rss_tag… Breonna Taylor Settlement Is a Record-Breaker http://thirdpartyoffers.juno.com/TGL3131/5f616ba13cbb46ba06f51st02duc1 Hurricane Sally Moving Slowly, and That's Bad http://thirdpartyoffers.juno.com/TGL3131/5f616ba15ce826ba06f51st02duc2 175-Year-Old Magazine Endorses Candidate for First Time http://thirdpartyoffers.juno.com/TGL3131/5f616ba17bb896ba06f51st02duc3 -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

6 6

[opensuse] Re: [opensuse-kernel] Re: Jump: merge Leap and SLE kernel configs
by Hans-Peter Jansen 16 Sep '20

16 Sep '20

Am Mittwoch, 16. September 2020, 15:15:55 CEST schrieb Jan Kara: > On Thu 10-09-20 07:59:13, Takashi Iwai wrote: > > > Do you know of a test case that fails using PREEMPT > > > > > > VOLUNTARY vs. NONE or where it's seen that one performs significantly > > > better under some workload? How typical is the workload? > > > > > > Note: PREEMPT NONE is for kernels used for scientific computation > > > > > > that needs the raw processing power of the kernel, regardless of > > > scheduling > > > latencies. I'm not doing such work straight computing, but instead > > > use the server, mostly, for serving incoming network requests. > > > Depending on packet and request size, One(1) 10Gb connection can > > > saturate > > > a single cpu. > > > > > > Supposedly RedHat disabled various C-States if you use 9K network > > > packets, as long latencies imposed by deeper power saving states > > > can theoretically cause some packet loss. If the cpu is not > > > preemptable, > > > wouldn't the same situation exist? Conversely I see some disable Jumbo > > > packets, which, when compared to standard, causes network throughput > > > drop from 400-600MB/s down to 110MB/s. That's unacceptable for > > > servers serving internal network requests. > > > > > > How much does 'Preempt none' benefit what workload over voluntary? > > > > This can be answered best by the performance team, who has been > > carrying the tests and evaluations. > > I believe Mel did some comparisons for this in the past. Mel? As noted in the other leg of this thread, apart from PREEMPT_NONE, the NO_HZ_FULL vs. NO_HZ_IDLE should be included into this discussion. Pete -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

1 0

[opensuse] Problem with latest monitoring-plugins-ping
by Moby 15 Sep '20

15 Sep '20

I have icinga2 installed from the OBS repo. The latest update (yesterday) seems to have broken check_ping where it includes -4 option to ping twice. I cannot find anything in the rpm itself on where to report this, can anyone either point me to the proper forum if this is not the correct one? Thank you in advance for your help, Moby -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

2 1

[opensuse] chrony and ipv6
by Carlos E. R. 15 Sep '20

15 Sep '20

Hi, Look at this output on a newly installed Leap 15.2 system: arlos@Rescate:~> grep chrony /var/log/messages 2020-09-04T01:55:00.304034+02:00 install chronyd[1465]: chronyd version 3.2 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP -SCFILTER +SECHASH -SIGND +ASYNCDNS +IPV6 -DEBUG) 2020-09-04T01:55:12.502311+02:00 install chronyd[1465]: Selected source 185.132.136.116 2020-09-04T01:56:16.829596+02:00 install chronyd[1465]: Selected source 178.255.228.77 2020-09-04T01:59:30.696451+02:00 install chronyd[1465]: Selected source 185.132.136.116 2020-09-04T02:25:17.504984+02:00 install chronyd[1465]: Source 2606:4700:f1::123 replaced with 2001:720:424:1::1:15 2020-09-04T02:55:08.658645+02:00 install chronyd[1465]: Source 2606:4700:f1::1 replaced with 2001:720:1014:a202::2 2020-09-04T03:25:01.548423+02:00 install chronyd[1465]: Source 2001:720:424:1::1:15 replaced with 178.32.88.247 2020-09-04T03:54:53.688796+02:00 install chronyd[1465]: Source 2001:720:1014:a201::2 replaced with 2606:4700:f1::1 2020-09-04T04:24:45.734513+02:00 install chronyd[1465]: Source 2001:720:1014:a202::2 replaced with 2001:720:424:1::1:15 carlos@Rescate:~> Notice how chronyd is trying to use IPv6 addresses, when my home doesn't have IPv6. The network is autoconfigured with DHCP (network manager) from the ISP provided and configured router. carlos@Rescate:~> ifconfig eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.1.134 netmask 255.255.255.0 broadcast 192.168.1.255 inet6 fe80::b24b:5404:16c2:b3f6 prefixlen 64 scopeid 0x20<link> ether f8:75:a4:e2:4b:48 txqueuelen 1000 (Ethernet) RX packets 91343 bytes 111136210 (105.9 MiB) RX errors 0 dropped 1 overruns 0 frame 0 TX packets 32678 bytes 2686720 (2.5 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 What should I look at? The system is with default configurations, installed hours ago. -- Cheers Carlos E. R. (from 15.1 x86_64 at Telcontar) -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

7 59