April 2023 - openSUSE Users - openSUSE Mailing Lists

[opensuse] Project management software question for project managers
by Ted Byers 15 Apr '24

15 Apr '24

I am looking for project management software I can install on my Suse box. Alas, there are quite a number of prducts that claim to be suitable project management products, but I am hoping to obtain a little help separating the wheat from the chaffe. Basically, when I open the project management software, I want to be able to choose from among a number of projects that are under way, and then see the relation between a client's wish list and the functional requirements specs, and then how these specs relate to the UML diagrams that have been created, and from there, what tasks have been defined for each requirement and the identity of all persons involved, the developers and their managers, and the person who designed the code that supports the requirement. And with that, I want to be able to see the project's timeline, the related bugs, &c. I would even want to be able to open the source code files and examine the code that was actually written. Here is my wish list: 1) a web application that stores data in either PostgreSQL or MySQL. 2) easy integration with UML tool (or has it's own UML tool that supports round trip engineering) 3) resource management (e.g. computers, and development tools, that can be used, personelle assigned to each task) 4) documentation of relation between functional requirements specs to specific tasks and specific unit and integration tests. 5) time/effort tracking 6) bug tracking, including data relating the existance of the bug, and effort required to fix it, to the person who wrote the original code, the person who supervised him or her, and the person who designed the 'feature' in question, the time taken to complete the original task, and the technologies used (to imprrove accountability as well as to determine retraining and continuing education needs (people aren't disposable, so instead of taking a harsh aproach to problems identified, I prefer to use education as a corrective, but I can't design corrective instruction without knowing precisely what the need is). I also need to know if a developer has a higher than normal bug rate simply because he doesn't take enough time to ensure the job is done right, or because I haven't adequately trained him, or because of a poor choice of tools, or somethng else that may be my fault. 7) use of task effort tracking history to generate provisional effort/cost estimates from new project's functional requirements 8) easy integration with open source ERP products like OFBiz (which may make trakcing resources and manpower easier, as well as connect real production data to the enterprise's accounting systems) 9) easy integration with CMS products, like Wordpress (especally for production documentation, includng degin documentation and user guides and reference manuals) 10) easy integration with verion control systems such as subversion. If there is a decent product that supports all of this, great (and language used to implement it doesn't matter), but if I have to write code to add missing requirements, then I am limited to those implemented using Perl or Java (and running on Tomcat). I don't know PHP well enough, and I don't know Ruby at all; and I really don't want to think about implementing this sort of thing in C++ (though I could if absolutely necessary). If you have project management experience, and use tools that are available for Suse Linux, what software product(s) did you use, and with what result? While I await relies, I will continue to review web documentation for those products I have found so far, to see if any of them are a) suitable for use in production and b) to see to what extent they support the features I am after. I have seen a number of products so far in my search, that deserve to be nameless, because they provide no way to relate cost estimates to one's team's track record, or to the details of the design, and seem satisfied with production of a pretty gantt chart (which is why I have formed the view that there is a whole lots of chaffe in the set of applications that call themselves project menement software - I have yet to find anything that really has the potential of being labelled wheat). Thanks Ted -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

5 4

[SLE] RealPlayer G2 on SuSe 6.2
by yh＠ottawa.com 03 Apr '24

03 Apr '24

Yesterday, I finally got sound going on my Linux setup. I downloaded RealPlayer G2 and it worked beautifully. Today, RealPlayer run but no sound coming out. All other sound functions still work. I can still play my CD, have system sound BUT no sound when I run RealPlayer. /var/log/message said kernel: Sound: DMA (output) timed out - IRQ/DRQ config error? but KDE sound still work. I have re-installed RealPlayer 3 times now, still no sound when I run the RealPlayer. Any help is appreciated. Ying yh(a)ottawa.com -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

3 2

No Login, no Graphics after update to Tumbleweed 20230211-0
by Peter Maffter 30 Mar '24

30 Mar '24

Hello, after the update the screen only shows a '-'. All the usual other tty screens that you get with e.g. STRG-ALT-F1 are also gone. I can connect to the PC via ssh from my Ubuntu Laptop and check what is going on. I am using an old GTX 570 on that PC. Previously when the G06 stuff was installed instead of updating the needed G04 stuff, I was able to install NVIDIA-Linux-x86_64-390.157.run manually and the login and XFCE worked. But now even that fails. :-( Any pointers? Is that the beginning of the things that are named in Subject "Nvidia 390x driver users - glibc 2.37 will bring bad news" ? I do have strange output about signature and verification: 2023-02-13T00:08:13.628957+01:00 machine4 kernel: [ 3.411047][ T527] nvidia: loading out-of-tree module taints kernel. 2023-02-13T00:08:13.628957+01:00 machine4 kernel: [ 3.411690][ T527] nvidia: module license 'NVIDIA' taints kernel. 2023-02-13T00:08:13.628958+01:00 machine4 kernel: [ 3.412304][ T527] Disabling lock debugging due to kernel taint 2023-02-13T00:08:13.628958+01:00 machine4 kernel: [ 3.418769][ T527] nvidia: module verification failed: signature and/or required key missing - tainting kernel 2023-02-13T00:08:13.628963+01:00 machine4 kernel: [ 3.426827][ T538] tg3 0000:0d:00.0 eth0: Tigon3 [partno(BCM57781) rev 57785100] (PCI Express) MAC address 00:25:22:e6:5d:d3 2023-02-13T00:08:13.628964+01:00 machine4 kernel: [ 3.427483][ T538] tg3 0000:0d:00.0 eth0: attached PHY is 57765 (10/100/1000Base-T Ethernet) (WireSpeed[1], EEE[1]) 2023-02-13T00:08:13.628964+01:00 machine4 kernel: [ 3.428122][ T538] tg3 0000:0d:00.0 eth0: RXcsums[1] LinkChgREG[0] MIirq[0] ASF[0] TSOcap[1] 2023-02-13T00:08:13.628965+01:00 machine4 kernel: [ 3.428740][ T538] tg3 0000:0d:00.0 eth0: dma_rwctrl[00000001] dma_mask[64-bit] 2023-02-13T00:08:13.628965+01:00 machine4 kernel: [ 3.482616][ T527] nvidia-nvlink: Nvlink Core is being initialized, major device number 241 2023-02-13T00:08:13.628966+01:00 machine4 kernel: [ 3.488784][ T527] nvidia 0000:01:00.0: vgaarb: changed VGA decodes: olddecodes=io+mem,decodes=none:owns=io+mem 2023-02-13T00:08:13.628971+01:00 machine4 kernel: [ 3.489637][ T527] NVRM: loading NVIDIA UNIX x86_64 Kernel Module 390.157 Wed Oct 12 09:19:07 UTC 2022 (using threaded interrupts) 2023-02-13T00:08:13.628972+01:00 machine4 kernel: [ 3.499362][ T527] nvidia-modeset: Loading NVIDIA Kernel Mode Setting Driver for UNIX platforms 390.157 Wed Oct 12 09:15:25 UTC 2022 2023-02-13T00:08:13.628972+01:00 machine4 kernel: [ 3.505733][ T527] [drm] [nvidia-drm] [GPU ID 0x00000100] Loading driver 2023-02-13T00:08:13.628973+01:00 machine4 kernel: [ 3.506428][ T527] [drm] Initialized nvidia-drm 0.0.0 20160202 for 0000:01:00.0 on minor 1 Update openSUSE Tumbleweed 20230211-0 -> 20230212-0 did not help either. Boot to the recover modes of 6.1.10-1 or 6.1.8-1 does not help . 6.1.8-1 recovery at least says that "Failed to start X Display Manager" and gives the F1,F2,...ttys. but when I install NVIDIA-Linux-x86_64-390.157.run the F1,F2, ttys are also gone. Please help. Thanks in advance BR Pete

12 68

[oS-en] iotop complains of missing feature in kernel
by Carlos E. R. 18 Feb '24

18 Feb '24

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 cer@Telcontar:~> sudo /usr/sbin/iotop -o -d 3.3333 Total DISK READ : 1169.77 K/s | Total DISK WRITE : 12.79 K/s Actual DISK READ: 1168.61 K/s | Actual DISK WRITE: 48.84 K/s TID PRIO USER DISK READ DISK WRITE SWAPIN IO> COMMAND 2041 be/4 news 490.70 K/s 0.00 B/s ?unavailable? texpire 9622 be/4 cer 0.00 B/s 6.98 K/s ?unavailable? firefox --sm-client-id 27~-9abbeba61260 [LS Thread] 8039 idle cer 679.07 K/s 0.00 B/s ?unavailable? tracker-miner-fs-3 12912 be/4 cer 0.00 B/s 5.81 K/s ?unavailable? firefox --sm-client-id 27~beba61260 [IndexedDB #45] * * ... CONFIG_TASK_DELAY_ACCT not enabled in kernel, cannot determine SWAPIN and IO % cer@Telcontar:~> uname -a Linux Telcontar 5.14.21-150400.24.33-default #1 SMP PREEMPT_DYNAMIC Fri Nov 4 13:55:06 UTC 2022 (76cfe60) x86_64 x86_64 x86_64 GNU/Linux cer@Telcontar:~> - -- Cheers Carlos E. R. (from 15.4 x86_64 at Telcontar) -----BEGIN PGP SIGNATURE----- iHoEARECADoWIQQZEb51mJKK1KpcU/W1MxgcbY1H1QUCY850Sxwccm9iaW4ubGlz dGFzQHRlbGVmb25pY2EubmV0AAoJELUzGBxtjUfVjxsAnREQY/RUTyYZuN8ZczMy KHE36e4GAJ9E6Pia/flb5Of5gQuYU1S9i0oirA== =W0vq -----END PGP SIGNATURE-----

2 3

Creating a new user for a deamon
by Rowan Reid 15 Jan '24

15 Jan '24

I'm setting up a cron job for a analysis tool, I'm trying to use the SuSE tools where possible but YAST doent' allow you to create new user without a home I tried /dev/null is there a proper way to do this ? Rowan Reid Job Captain, Systems Administrator STUDIO 3 ARCHITECTS 909 982 1717

3 2

[oS-EN] Question on full disk encription
by Carlos E. R. 02 Sep '23

02 Sep '23

Hi, new laptop here, and I decided to install Leap 15.4 with full disk encryption, no LVM (a feature I wanted to have for years, so I'm happy). It asks for the password twice (contrary to my customs, I'm using plymouth). It asks once before grub loads. Well, ok, there is no separate /boot, so it has to read "/" which is encrypted. Nice. But after selecting the boot entry in grub, it asks again. Once, despite being 3 partitions ("/", "/boot" and swap). Ok. Is there some way to make it ask only once? I guess not, but perhaps I'm wrong. -- Cheers / Saludos, Carlos E. R. (from Elesar, using openSUSE Leap 15.4)

10 60

KDE keyboard layout not starting on login
by Stratos Zolotas 15 May '23

15 May '23

Hello, I have a strange issue that appears in two systems. One Tumbleweed and one 15.4. I use en and gr keyboard layouts configured from the KDE settings. Although the setting is valid and as soon as I apply it the keyboard layout indicator appears in the system tray, after reboot it disappears and I have to go and re-apply the settings (it is not deleted just not "executed") to make it visible and working again. I usually use keep last session on KDE but I also tried to start with a clean session or with a manual saved session. Nothing seems to affect the keyboard layout indicator, it is always disappearing after reboot. Both systems were working as expected before. The only difference is that the issue on 15.4 appeared just after dist-upgrading from 15.3. Any ideas on how to debug it? Regards Stratos

3 6

Bonding?
by Lew Wolfgang 10 May '23

10 May '23

Hi Folks, We've been collecting data through four 1-GbE Ethernet interfaces configured as independent connections on different subnets. This has been working well enough for years. But now someone has suggested bonding those four interfaces into one virtual interface. I've never had any experience with this sort of thing, it looks like there's "bonding" and a newer thing called "teaming". We're already getting 950-Mb/channel so we'd be looking more for load-leveling and fall-over reliability. I wonder if any of you might have some suggestions or experience you might share? Regards, Lew

5 14

[oS-en] Testing the new configuration of firewalld
by Carlos E. R. 02 May '23

02 May '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Content-ID: <5bf6502a-a6a1-9cf4-dce1-355b4d5b564b(a)Telcontar.valinor> Hi, (This is a thinking aloud post, so of course there is conflict in what I say) So I converted my miniserver to use firewalld instead of SuSEfirewalld, using "susefirewall2-to-firewalld" script. I added the rule to block incoming packets from the router. The resulting config is: Isengard:/etc/firewalld/zones # firewall-cmd --list-all external (active) target: default icmp-block-inversion: no interfaces: eth0 wlan0 sources: services: dns http https mountd nfs nfs3 ntp rpc-bind ssh ports: 12854/tcp 50000/tcp 12858/udp 47981/udp 38059/tcp 56517/udp 40399/tcp protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: address-unreachable bad-header beyond-scope communication-prohibited destination-unreachable echo-reply failed-policy fragmentation-needed host-precedence-violation host-prohibited host-redirect host-unknown host-unreachable ip-header-bad network-prohibited network-redirect network-unknown network-unreachable no-route packet-too-big parameter-problem port-unreachable precedence-cutoff protocol-unreachable reject-route required-option-missing source-route-failed time-exceeded timestamp-reply timestamp-request tos-host-redirect tos-host-unreachable tos-network-redirect tos-network-unreachable ttl-zero-during-reassembly ttl-zero-during-transit unknown-header-type unknown-option rich rules: rule family="ipv4" source address="192.168.1.55/32" port port="5556" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="2908" protocol="udp" accept rule family="ipv4" source address="192.168.1.129/32" port port="53" protocol="udp" accept rule family="ipv4" source address="192.168.1.57/32" accept rule family="ipv4" source address="192.168.1.14/32" port port="2049" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="80" protocol="tcp" accept rule family="ipv4" source address="192.168.1.0/24" port port="80" protocol="tcp" accept rule family="ipv4" source address="192.168.1.5/32" protocol value="icmp" accept rule family="ipv4" source address="192.168.1.14/32" port port="514" protocol="udp" accept rule family="ipv4" source address="192.168.1.14/32" port port="4080" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="4080" protocol="tcp" accept rule family="ipv4" source address="192.168.1.7/32" port port="137" protocol="tcp" accept rule family="ipv4" source address="172.26.0.0/16" protocol value="udp" accept rule family="ipv4" source address="192.168.1.126/32" port port="2049" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="4243" protocol="tcp" accept rule family="ipv4" source address="192.168.1.54/32" port port="4243" protocol="tcp" accept rule family="ipv4" source address="192.168.1.129/32" port port="53" protocol="tcp" accept rule family="ipv4" source address="192.168.1.7/32" protocol value="udp" accept rule family="ipv4" source address="192.168.1.7/32" port port="139" protocol="tcp" accept rule family="ipv4" source address="192.168.1.127/32" port port="873" protocol="tcp" accept rule family="ipv4" source address="192.168.1.1/32" port port="162" protocol="udp" accept rule family="ipv4" source address="192.168.1.55/32" accept rule family="ipv4" source address="192.168.1.0/24" port port="111" protocol="tcp" accept rule family="ipv4" source address="192.168.1.129/32" port port="5000" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="8080" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="4001" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="25" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="4000" protocol="tcp" accept rule family="ipv4" source address="192.168.1.1/32" port port="50000" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="445" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="5353" protocol="tcp" accept rule family="ipv4" source address="192.168.1.56/32" port port="5556" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="4120" protocol="udp" accept rule family="ipv4" source address="192.168.1.126/32" port port="873" protocol="tcp" accept rule family="ipv4" source address="192.168.1.0/24" port port="2049" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="4242" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="4243" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="1252" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="4243" protocol="udp" accept rule family="ipv4" source address="192.168.1.14/32" port port="8081" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="9090" protocol="tcp" accept rule family="ipv4" source address="192.168.1.129/32" port port="2049" protocol="tcp" accept rule family="ipv6" source address="fc00::/64" port port="5353" protocol="udp" accept rule family="ipv4" source address="192.168.1.1/32" port port="514" protocol="udp" accept rule family="ipv4" source address="192.168.1.128/32" port port="1625" protocol="tcp" accept rule family="ipv4" source address="192.168.1.127/32" port port="2049" protocol="tcp" accept rule family="ipv4" source address="192.168.1.129/32" port port="4080" protocol="tcp" accept rule family="ipv4" source address="192.168.1.54/32" accept rule family="ipv4" source address="192.168.1.128/32" port port="137" protocol="udp" accept rule family="ipv4" source address="192.168.1.0/24" port port="2049" protocol="udp" accept rule family="ipv4" source address="192.168.1.7/32" port port="53" protocol="udp" accept rule family="ipv4" source address="192.168.1.129/32" port port="9090" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="162" protocol="udp" accept rule family="ipv4" source address="192.168.1.129/32" port port="4000" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="8000" protocol="tcp" accept rule family="ipv4" source address="192.168.1.50/32" port port="53" protocol="tcp" accept rule family="ipv4" source address="192.168.1.0/24" port port="111" protocol="udp" accept rule family="ipv4" source address="192.168.1.7/32" port port="514" protocol="udp" accept rule family="ipv4" source address="192.168.1.5/32" port port="162" protocol="udp" accept rule family="ipv4" source address="192.168.1.14/32" port port="514" protocol="tcp" accept rule family="ipv4" source address="192.168.1.7/32" port port="5353" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="873" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" protocol value="icmp" accept rule family="ipv4" source address="192.168.1.128/32" port port="4754" protocol="udp" accept rule family="ipv4" source address="192.168.1.128/32" port port="53" protocol="tcp" accept rule family="ipv4" source address="192.168.1.56/32" port port="5558" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="53" protocol="udp" accept rule family="ipv4" source address="192.168.1.129/32" port port="4001" protocol="tcp" accept rule family="ipv4" source address="192.168.1.15/32" port port="2049" protocol="tcp" accept rule family="ipv4" source address="192.168.1.1/32" protocol value="udp" accept rule family="ipv4" source address="192.168.1.0/24" port port="22" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="6666" protocol="udp" accept rule family="ipv4" source address="192.168.1.54/32" port port="5558" protocol="tcp" accept rule family="ipv6" source address="fe80::/64" port port="5353" protocol="udp" accept rule family="ipv4" source address="192.168.1.50/32" port port="53" protocol="udp" accept rule family="ipv4" source address="192.168.1.7/32" port port="3553" protocol="udp" accept rule family="ipv4" source address="192.168.1.54/32" port port="5556" protocol="tcp" accept rule family="ipv4" source address="192.168.1.1/32" protocol value="icmp" accept rule family="ipv4" source address="192.168.1.7/32" port port="515" protocol="tcp" accept rule family="ipv4" source address="192.168.1.5/32" port port="514" protocol="udp" accept rule family="ipv4" source address="192.168.1.128/32" port port="138" protocol="udp" accept rule family="ipv4" source address="192.168.1.56/32" accept rule family="ipv4" source address="192.168.1.128/32" port port="139" protocol="tcp" accept rule family="ipv4" source address="192.168.1.55/32" port port="5558" protocol="tcp" accept rule family="ipv4" source address="192.168.1.129/32" port port="8081" protocol="tcp" accept rule priority="10" source mac="ROUTER_MAC" reject Isengard:/etc/firewalld/zones # So, I want to try the access to apache and ssh from outside. I connect via ssh to a Friend's machine, and try. Ipv4 first. carlos@Friend:~ $ curl http://isengard_rmt_dns ^C carlos@Friend:~ $ No response on port 80, good. carlos@Friend:~ $ curl http://isengard_rmt_dns:50000 <html><body><h1>Hola tio.</h1></body></html>carlos@Friend:~ $ Correct response on a high port. carlos@Friend:~ $ ssh cer@isengard_rmt_dns ^C carlos@Friend:~ $ No response on port 22, correct. carlos@Friend:~ $ ssh -p 51000 cer@isengard_rmt_dns The authenticity of host '[isengard_rmt_dns]:51000 ([IPv4_ADDR]:51000)' can't be established. ECDSA key fingerprint is SHA256:ILyba.... Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '[isengard_rmt_dns]:51000,[IPv4_ADDR]:51000' (ECDSA) to the list of known hosts. cer@isengard_rmt_dns: Permission denied (publickey). carlos@Friend:~ $ Expected response on a high port. Notice that on IPv4 the router intervenes with translations (virtual server). Incoming to port 51000 is sent to Isengard on LAN, port 22. Incoming to port 50000 is sent to port Isengard on LAN, port 50000. (not the actual ports, I edited them for privacy; but close). The Virtual Server config of the router doesn't work on IPv6 - correct, it is a NAT hack. Apache on IPv6 and high port: carlos@Friend:~ $ curl http://[Ipv6_ADDR]:50000 <html><body><h1>Hola tio.</h1></body></html>carlos@Friend:~ $ This is correct. carlos@Friend:~ $curl http://[Ipv6_ADDR] <html><body> <h1>Welcome to Isengard</a></h1> <h3>Letras: \ | @ # € </h3> <h2> <a href="/ficheros" title="Ficheros">[ficheros]</a> <br> <a href="/ficheros/mirrors" title="Mirrors">[Mirrors]</a> <br> <a href="/data/hoard/TheHoard/jd">[Shared J]</a> <br> <a href="/data/hoard/">[Data]</a> <br> <a href="/data/waterhoard/Fusion/Videos">[Fusion]</a> <br> <a href="/data/My_Book/Fusion/Videos">[Fusion MyBook]</a> <br>   </h2> </body></html> carlos@Friend:~ $ Now, this is not correct, it is the response expected INSIDE the LAN. That means a problem in the Apache configuration for virtual hosts, but also that port 80 is not closed on IPv6. ssh on IPv6 and default port: carlos@Friend:~ $ ssh cer@Ipv6_ADDR The authenticity of host 'Ipv6_ADDR (Ipv6_ADDR)' can't be established. ECDSA key fingerprint is SHA256:ILyba. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'Ipv6_ADDR' (ECDSA) to the list of known hosts. cer@Ipv6_ADDR: Permission denied (publickey). carlos@Friend:~ $ Well, this is not correct, it should be denied by the rich rule. Obviously, computers have their own mind, but I'm not familiar with the firewalld "mind". And I'm getting a headache. There is this rule: rule family="ipv4" source address="192.168.1.1/32" port port="50000" protocol="tcp" accept which might conflict with: rule priority="10" source mac="ROUTER_MAC" reject but it is for Ipv4 only, so it shouldn't. It seems that: services: dns http https mountd nfs nfs3 ntp rpc-bind ssh takes precedence over the rich rule denying packets via router. [headache] Obviously, being a server, both ssh and http have to be open even if the packet is incoming from the router, but not on the 22 and 80 ports, but on the high ports only. So maybe I have to remove the line services: dns http https mountd nfs nfs3 ntp rpc-bind ssh move all that to rich rules that open those ports on IPv4 only, and open generically ports 50000 and 51000 only. Wait, ssh comes from the router on port 22, it is translated. Making sshd listen on 51000 is not that easy. So, generically open port 50000. Open port 22 on IPv4, close on IPv6? Or open generically. Ideas? (Can I write comments in xml file /etc/firewalld/zones/external.xml?) - -- Cheers Carlos E. R. (from 15.4 x86_64 at Telcontar) -----BEGIN PGP SIGNATURE----- iHoEARECADoWIQQZEb51mJKK1KpcU/W1MxgcbY1H1QUCZEg+2Rwccm9iaW4ubGlz dGFzQHRlbGVmb25pY2EubmV0AAoJELUzGBxtjUfVN8kAnjDt2n+lyVtMRz7zT+Ih EiOCzJ8mAJ4pxKkBZj3nxuRjOT9DM7TClL87Tg== =tCZ9 -----END PGP SIGNATURE-----

12 156

[oS-en] Another SuSEfirewall2 to firewall conversion.
by Carlos E. R. 02 May '23

02 May '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, This particular post is rantish. Telcontar:~ # time susefirewall2-to-firewalld -c 2>&1 | tee susefirewall2-to-firewalld_2.2.txt ... Error: INVALID_PORT: 30000:30100 FIREWALLD ERROR: Command 'firewall-cmd ' failed But: /etc/sysconfig/SuSEfirewall2 192.168.1.126,tcp,smtp 192.168.1.126,tcp,imap 192.168.1.126,tcp,imaps\ 192.168.1.126,tcp,ftp 192.168.1.126,tcp,ftp-data 192.168.1.126,tcp,http \ # 192.168.1.126,tcp,30000:30100 \ 192.168.1.126,tcp,nfs 192.168.1.126,udp,sunrpc 192.168.1.126,tcp,rsync \ 192.168.1.127,tcp,smtp 192.168.1.127,tcp,imap 192.168.1.127,tcp,imaps\ 192.168.1.127,tcp,ftp 192.168.1.127,tcp,ftp-data 192.168.1.127,tcp,http \ # 192.168.1.127,tcp,30000:30100 \ 192.168.1.127,tcp,nfs 192.168.1.127,udp,sunrpc 192.168.1.127,tcp,rsync \ The line that triggers the error is commented out! I will delete it, of course. - -- Cheers Carlos E. R. (from 15.4 x86_64 at Telcontar) -----BEGIN PGP SIGNATURE----- iHoEARECADoWIQQZEb51mJKK1KpcU/W1MxgcbY1H1QUCZE5fhxwccm9iaW4ubGlz dGFzQHRlbGVmb25pY2EubmV0AAoJELUzGBxtjUfVtLwAnRvBv8Yc6XXRxeW+kxCm f6qp8BajAJ93uud6tgspD2+i1/XPRbVH+8nffQ== =Re/K -----END PGP SIGNATURE-----

7 35