November 2022 - openSUSE Users - openSUSE Mailing Lists

firewalld routing problem
by Marc Chamberlin 17 Nov '22

17 Nov '22

Hello gurus! I am running an OpenSuSE 15.3 system and using it as a gateway between the internet and my internal network of computers. This is a SOHO system which I administer myself. Internal security is not something I have to worry about since my wife and I are the only users. I have set up this gateway computer, which I call Quasar, with one internet facing NIC card, and one internal network facing NIC (192.168.10.100). On the internet facing NIC I used Yast2 to configure it with one "main" public IP address and 4 additional public IP addresses. Each of these external IP addresses I want to route to/from different systems on my internal network. So for example the following table shows what I want (with actual public IP addresses obscured) - IP address 200.xxx.xxx.10 <--------- routed to/from --------> 192.168.10.100 (this is for quasar, the gateway computer itself with the interface name simply eth0) IP address 200.xxx.xxx.11 <--------- routed to/from --------> 192.168.10.51 (this is for bigbang and the interface name is eth0:bigbangExt) IP address 200.xxx.xxx.12 <--------- routed to/from --------> 192.168.10.21 (this is for nova and the interface name is eth0:novaExt) IP address 200.xxx.xxx.13 <--------- routed to/from --------> 192.168.10.31 (this is for darkstar and the interface name is eth0:darkstarEx) etc. I have been trying to set these routes up with firewalld, but so far no joy getting it to work. Examples to the 2 main approaches I have tried are shown below. First, I configured a sejparate zone for each of the external IP address, so for example for the computer I call bigbang, I configured a zone called bigbangExt and assigned the interface eth0:bigbangExt to it. I then configured the IP Port Forwarding data such that there is an entry for each port I wanted to configure and forward to bigbang. The xml file for this configuration is shown here - quasar:/etc/firewalld/zones # cat bigbangExt.xml <?xml version="1.0" encoding="utf-8"?> <zone> <service name="apache2"/> <service name="apache2-ssl"/> <service name="http"/> <service name="https"/> <service name="smtp"/> <service name="smtps"/> <service name="smtp-submission"/> <service name="imap"/> <service name="imaps"/> <service name="pop3"/> <service name="pop3s"/> <protocol value="icmp"/> <protocol value="tcp"/> <protocol value="udp"/> <masquerade/> <forward-port port="9000-9001" protocol="tcp" to-port="9000-9001" to-addr="192.168.10.51"/> <forward-port port="465" protocol="tcp" to-port="465" to-addr="192.168.10.51"/> <forward-port port="587" protocol="tcp" to-port="587" to-addr="192.168.10.51"/> <forward-port port="25" protocol="tcp" to-port="25" to-addr="192.168.10.51"/> <forward-port port="110" protocol="tcp" to-port="110" to-addr="192.168.10.51"/> <forward-port port="995" protocol="tcp" to-port="995" to-addr="192.168.10.51"/> <forward-port port="993" protocol="tcp" to-port="993" to-addr="192.168.10.51"/> <forward-port port="10000" protocol="tcp" to-port="10000" to-addr="192.168.10.51"/> <forward-port port="80" protocol="tcp" to-port="80" to-addr="192.168.10.51"/> <forward-port port="143" protocol="tcp" to-port="143" to-addr="192.168.10.51"/> <interface name="eth0:bigbangExt"/> </zone> SURPRISINGLY to me at least, this did not work. For example, if I bring up a web browser and connect directly to the internal IP address 192.168.10.51 I will get the appropriate web page displayed. But if I connect to the external public IP address 200.xxx.xxx.11 it's no joy! So, for my second attempt, I tried using Direct Configuration in firewalld. Since I cannot do a copy/paste from firewalld, I will just show the configuration file - direct.xml, when set up just to do routing for bigbang - quasar:/etc/firewalld # cat direct.xml <?xml version="1.0" encoding="utf-8"?> <direct> <rule ipv="ipv4" table="nat" chain="PREROUTING" priority="0">-d 200.xxx.xxx.11 -i eth0:bigbangExt -j DNAT --to-destination 192.168.10.51</rule> <rule ipv="ipv4" table="nat" chain="POSTROUTING" priority="0">-s 192.168.10.51 -j SNAT --to-source 200.xxx.xxx.11</rule> <rule ipv="ipv4" table="filter" chain="FORWARD" priority="0">-s 192.168.10.51/32 -j ACCEPT</rule> <rule ipv="ipv4" table="filter" chain="FORWARD" priority="0">-d 192.168.10.51/32 -j ACCEPT</rule> </direct> However, again no joy! I am not getting routing from the external interface/IP addresses as I want/expect. I looked through the log files and iptables listings and I could not see anything obviously wrong, but then again my ability to grok iptables lists is somewhat limited. (I am by no means an expert on iptables!) I have reached the end of my ability to debug and figure out what I am doing wrong, so need some help from firewalld and iptables gurus to help me get over this hump. As always, many thanks in advance for any and all forms of assistance! MarcC -- *"The Truth is out there" - Spooky* -- *_ _ . . . . . . _ _ . _ _ _ _ . . . . _ . . . . _ _ . _ _ _ . . . . _ _ . _ . . _ . _ _ _ _ . _ . _ . _ . _ . * Computers: the final frontier. These are the voyages of the user Marc. His mission: to explore strange new hardware. To seek out new software and new applications. To boldly go where no Marc has gone before! (/This email is digitally signed. My public key for sending encrypted email to me can be found at - https://keys.openpgp.org/search?q=marc@domesweetdome.us.com or just ask me for it and I will send it to you as an attachment. If you don't understand, no worries, just ignore it and/or ask me to explain it further./)

2 7

Updates mess with thunderbird translations (yes/no buttons)
by Karl Sinn 10 Nov '22

10 Nov '22

Hi, in thunderbird, when one uses the keyboard shortcut "n" to navigate to the next unread message and the next unread message is in another folder a window opens asking for confirmation to actually go to the next folder. Now my system is entirely configured for the German language settings and should therefor label the buttons with Ja/Nein. Now I realized a few times that when I run updates, they mess with these buttons, they then appear in English language as Yes/No while the rest of thunderbird (as far as I can tell) still uses German language. Depending on the update I have different language on these buttons... Two questions: - How can I set that back? - Is there a way to prevent this? thanks, Karl

2 3

TW firewall and zeroconf / smb3 on TrueNAS
by Stakanov 09 Nov '22

09 Nov '22

I have two machines running, a TW (most recent always) and a trueNAS (FreeBSD based). I have in the TrueNAS running a jail with miniDLNA to stream movies via the network (to a smart TV but also to a PC). I also have put the pools with samba on a share with appropriate permissions. I did allow in firewall of TW (via yast): upnp, zeroconf, samba client. Now guess what, if I am running the dolphin to search the network for services, he does not see on TW neither upnp services nor zeroconf not even samba. When I do instead stop the firewall and search, all appears and works. This is true also after reboot - just in case anybody suggested it. Are the yast allowances to the FW still working or has all to be edited via some config file / table? Thank you.

5 9

Mess of locales in TW
by Stakanov 06 Nov '22

06 Nov '22

while trying to find out how to fix sudo in the "newly intended way" (communication is as usually woefully flawed by hubris in thinking that problems will go away by posting a "notice" on some exotic email list, very funny, just that as a toxic side note, SCNR), I have now an issue in TW that I do not even marginally understand. My system is set up locale IT. So all should be in Italian.......should it? a) while writing the update requests, the system does inform as expected in Italian. Then it switches to .... German???? And finally it gives the warning for dup in English. Provided I am a user of many languages on this system, for personal means. But the users are all set up in Italian. No user is setup in German (but the geographical "time zone" is set to Berlin because I am in Germany currently, does the German thing comes from that? > Alcuni programmi in esecuzione utilizzano ancora file e librerie rilevati e > aggiornati da upgrade recenti. Riavviarli per trarre vantaggio dagli ultimi > aggiornamenti. Eseguire 'zypper ps -s' per visualizzare l'elenco di questi > programmi. > > entropy@silversurfer:~> sudo zypper dup > [sudo] password di entropy: > »entropy« ist nicht in der sudoers-Datei. > > Dieser Vorfall wurde an den Administrator gemeldet. > entropy@silversurfer:~> su - > Password: > silversurfer:~ # zypper dup > Loading repository data... > Reading installed packages... > Warning: You are about to do a distribution upgrade with all enabled > repositories. Make sure these repositories are compatible before you > continue. See 'man zypper' for more information about this command. > Computing distribution upgrade... > Nothing to do. > silversurfer:~ # exit > logout > entropy@silversurfer:~> sudo zypper dup > [sudo] password di entropy: > Riprovare. > [sudo] password di entropy: > »entropy« ist nicht in der sudoers-Datei. > > Dieser Vorfall wurde an den Administrator gemeldet. > entropy@silversurfer:~> Try to make me understand why my system is so much about "inclusion". Thank you very much, grazie tante (e quelli con l'idea del avviso per sudo senza spiegazioni specialmente un "Grazia, Graziella, e grazie al..."), Danke vielmals.

5 9

[oS-en] I'm finally getting things done with LibreOffice Base
by Carlos E. R. 04 Nov '22

04 Nov '22

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 After several years, I'm finally progressing with LibreOffice Base. I have a catalogue of my books in MySQL, done with the application Rekall (KDE3). The app is not maintained, so I have been trying for years to migrate to something else, the obvious one LibreOffice Base. It is more difficult that Microsoft Base, which I learned to use without documentation in a month back in 1998. It appears that the trick is that to write to my table I have to use a form, not a table. See what I have (created by the wizard, then modified): <https://susepaste.org/56891822> Top is the table as is, and in the subform below are the controls. See the first row, with a "0_test" book selected. The same book is displayed below. The data Autor, SegundoAutor and TercerAutor display the numbers 1, 2, 3, corresponding to an auxiliary table of authors. The entries below in white background show the text, the names of the first author, second and third, selectable from the list. This has been the hurdle for years (true, I have not dedicated intense study to it). (In Rekall, or in Office, I get the name of the authors directly in the main table. It knows how to handle the relationship automatically, r/w. It was trivial). The simple detail that remains now is to join the label "Autor 1" to the control below, so that when I click there in design view both move as a single object. I have not seen this in the tutorial: Getting Started Guide 7.3 Chapter 8, Getting Started with Base Relational databases in LibreOffice <https://wiki.documentfoundation.org/images/9/99/GS7308-GettingStartedWithBa…> This has been done automatically somehow by the wizard in all the controls it has created. But I do not know how to replicate, and it should be trivial. Somebody knows? - -- Cheers Carlos E. R. (from 15.3 x86_64 at Telcontar) -----BEGIN PGP SIGNATURE----- iHoEARECADoWIQQZEb51mJKK1KpcU/W1MxgcbY1H1QUCY1Wh+Rwccm9iaW4ubGlz dGFzQHRlbGVmb25pY2EubmV0AAoJELUzGBxtjUfV4wkAmwf+UHoVx8oCqJVs5mPa VOrEXyzwAJ9KelawLONAPhjSYzf3qOEV0P4Eiw== =C+Op -----END PGP SIGNATURE-----

7 22

Server-side mail folders problem with Thunderbird
by Philippe Andersson 03 Nov '22

03 Nov '22

Hello list, Last week, I switched to using OAuth2 (aka "Modern Authentication") from Thunderbird to access my company's Office365 mailbox over IMAP. Everything went swell for 2 days. Over the week-end, I applied the (Leap 15.3) online update for Thunderbird (to v102.4.0), and this morning all my server-side folders were gone. The Inbox itself could still be accessed, and the local folders have no issue. I then reverted to the earlier version of TB (v102.2.2), and after some fiddling, I could get some of the server-side folders to reappear and to resynch, but: - even though the messages are listed in those folders, the message contents won't display if I select one of them (status says "loading") forever - sent messages aren't copied to the "sent items" folder -- there as well, it waits forever Has anyone else here been confronted with a similar behaviour? TIA Ph. A. -- *Philippe Andersson* Unix System Administrator IBA Particle Therapy | Tel: +32-10-475.983 Fax: +32-10-487.707 eMail: pan(a)iba-group.com <http://www.iba-worldwide.com> Disclaimer | Use of IBA e-communication<https://iba-worldwide.com/disclaimer> The contents of this e-mail message and any attachments are intended solely for the recipient (s) named above. This communication is intended to be and to remain confidential and may be protected by intellectual property rights. Any use of the information contained herein (including but not limited to, total or partial reproduction, communication or distribution of any form) by persons other than the designated recipient(s) is prohibited. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free. Ion Beam Applications does not accept liability for any such errors. Thank you for your cooperation.

3 4

Network Names (ESSID) discovery faoled
by Boyd Lynn Gerber 02 Nov '22

02 Nov '22

Hello, I do not know when this started. I rebooted my machine and couldn't connect to the internet. Execution of command "[["/usr/sbin/ip", "link", "set", "wlan0", "up"]]" failed. Exit code: 2 Error output: RTNETLINK answers: Input/output error I am not sure how to deal with it The device is a RT-AC3100 router. It has been working flawlessly for over 2 years. My other devices using wireless do not have any proplems connecting/ OopenSUSE Leap 15.4 Regards, -- Boyd Gerber <gerberb(a)zenez.com> 801 849-0213 ZENEZ 1042 East Fort Union #135, Midvale Utah 84047

4 9

Rosegarden segfault (Leap, AGAIN!)
by bent fender 02 Nov '22

02 Nov '22

If I try to start Rosegarden 21.06.bp154.1.51-x86_64 first all by itself and then after having purged everythiong *rosegarden* and started qjackctl I get the folowing errors: ---------------------------- # rosegarden [main] *** This is the first time running this Rosegarden version Cannot connect to server socket err = No such file or directory Cannot connect to server request channel jackdmp 1.9.12 Copyright 2001-2005 Paul Davis and others. Copyright 2004-2016 Grame. Copyright 2016-2017 Filipe Coelho. jackdmp comes with ABSOLUTELY NO WARRANTY This is free software, and you are welcome to redistribute it under certain conditions; see the file COPYING for details Cannot create RT messagebuffer thread: Operation not permitted (1) Retrying messagebuffer thread without RT scheduling Messagebuffer not realtime; consider enabling RT scheduling for user no message buffer overruns Cannot create RT messagebuffer thread: Operation not permitted (1) Retrying messagebuffer thread without RT scheduling Messagebuffer not realtime; consider enabling RT scheduling for user no message buffer overruns Cannot create RT messagebuffer thread: Operation not permitted (1) Retrying messagebuffer thread without RT scheduling Messagebuffer not realtime; consider enabling RT scheduling for user no message buffer overruns JACK server starting in realtime mode with priority 10 self-connect-mode is "Don't restrict self connect requests" Cannot lock down 86611866 byte memory area (Cannot allocate memory) audio_reservation_init Acquire audio card Audio0 creating alsa driver ... hw:II,0|hw:II|1024|2|48000|0|0|nomon|swmeter|-|32bit configuring for 48000Hz, period = 1024 frames (21.3 ms), buffer = 2 periods ALSA: final selected sample format for capture: 32bit integer little-endian ALSA: use 2 periods for capture ALSA: final selected sample format for playback: 32bit integer little-endian ALSA: use 2 periods for playback Cannot use real-time scheduling (RR/10)(1: Operation not permitted) AcquireSelfRealTime error Segmentation fault (core dumped) # rosegarden [main] *** This is the first time running this Rosegarden version Cannot lock down 86611866 byte memory area (Cannot allocate memory) Cannot use real-time scheduling (RR/5)(1: Operation not permitted) JackClient::AcquireSelfRealTime error [AlsaDriver] setCurrentTimer(): WARNING: using system timer with only 250 Hz resolution! JackEngine::XRun: client = rosegarden was not finished, state = Triggered JackAudioDriver::ProcessGraphAsyncMaster: Process error Segmentation fault (core dumped) openSUSE Leap 15.4, Kernel=5.14.21-150400.22-default on x86_64, DM=sddm, DE=sle-Classic:GNOME, ST=x11,grub2, GPT, BIOS-boot

2 2

Re: Network Names (ESSID) discovery failed
by Boyd Lynn Gerber 01 Nov '22

01 Nov '22

On Tuesday 2022-11-01 16:29, Andrei Borzenkov wrote: > On Tue, Nov 1, 2022 at 4:10 PM Boyd Lynn Gerber <gerberb(a)zenez.com> wrote: >> >>> On Mon, 31 Oct 2022 17:23:08 -0600, Boyd Lynn Gerber <gerberb(a)zenez.com> >>> wrote: >>> >>>> I do not know when this started. I rebooted my machine and couldn't >>>> connect to the internet. >>>> >>>> Execution of command "[["/usr/sbin/ip", "link", "set", "wlan0", "up"]]" >>>> failed. >>>> Exit code: 2 >>>> Error output: RTNETLINK answers: Input/output error >>>> >>>> I am not sure how to deal with it >>>> >>>> The device is a RT-AC3100 router. It has been working flawlessly for >>>> over 2 years. My other devices using wireless do not have any proplems >>>> connecting/ >>> >>> I don't know anything about the error message, but you could try power >>> cycling, or rebooting, the router. >> >> Done that before posting. Driving me crazy. Google search doesn't >> help. >> > > You could start with explaining where you see this message, what you > do before this message appears. Are you using wicked or NetworkManager > or something else. yast2->Network Setting->Edit wlan0 (Wireless) Choose Network. scanning for Network Window pops up Error Execution of command "[["/usr/sbin/ip", "link", "set", "wlan0", "up"]]" failed. Exit code: 2 Error output: RTNETLINK answers: Input/output error > Educated guess is that to bring the wireless interface up it has to be > associated with the access point which means this message is probably > the consequence of a failed association. Also the subject of your post > says "discovery failed" but there is absolutely nothing about > "discovery" of any kind in your message. yes the discovery failed. I have 8 other devices that do nothave any trouble accessibng it with the sames Network Name (ESSID) and mode/password. Thanks, -- Boyd Gerber <gerberb(a)zenez.com> 801 849-0213 ZENEZ 1042 East Fort Union #135, Midvale Utah 84047

1 0

Vietnamese virtual keyboard
by Jon Cosby 01 Nov '22

01 Nov '22

I'm traveling to Vietnam next month and I'm looking for a Vietnamese virtual keyboard for my laptop. I can only find it online, I want a local VK. I don't want to configure the physical keyboard. I just want something for passwords and URLs. Anybody have a suggestion? I have Leap 15.4 and GNOME 41.2. Jon Cosby

3 3