April 2023 - openSUSE Users - openSUSE Mailing Lists

[oS-en] Migrating SuSEfirewall2 to firewalld
by Carlos E. R. 25 Apr '23

25 Apr '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I have to finally do that migration. There is a script and some docs: https://en.opensuse.org/Firewalld https://github.com/openSUSE/susefirewall2-to-firewalld/blob/master/README.md The sequence of commands is: susefirewall2-to-firewalld If you like the output, then susefirewall2-to-firewalld -c To commit. This prints at the end (after a run of 14 minutes): INFO: ################################################################################## INFO: INFO: Your SuSEfirewall2 rules have been migrated to FirewallD. A celebration is in order! INFO: INFO: Please note that the firewalld rules haven't been made permanent yet. INFO: Use 'firewall-cmd --list-all-zones' to verify you are happy with the proposed INFO: configuration and then use 'firewall-cmd --runtime-to-permanent' to make it permanent. INFO: However, you are advised to look at the following resources and/or INFO: commands before making permanent changes to your firewall: So I do that (claims success). But something is wrong, the rules are not actually written. I confirm with "firewall-config" that there are no rich rules at all. I saw while the script was running text like these: INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.1/32 port port=514 protocol=udp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.1/32 protocol value=icmp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.1/32 port port=162 protocol=udp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.1/32 port port=53792 protocol=tcp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.5/32 port port=514 protocol=udp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.5/32 protocol value=icmp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.5/32 port port=162 protocol=udp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.7/32 port port=514 protocol=udp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.7/32 port port=53 protocol=udp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.7/32 port port=139 protocol=tcp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.7/32 port port=137 protocol=tcp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.7/32 port port=5353 protocol=tcp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.7/32 port port=515 protocol=tcp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.7/32 port port=3553 protocol=udp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.14/32 port port=514 protocol=udp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.14/32 port port=514 protocol=tcp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.14/32 port port=6666 protocol=udp accept" for zone="external" INFO: Enabling rich rule="rule family=ipv4 source address=192.168.1.14/32 protocol value=icmp accept" for zone="external" But they were not actually written. Not in "runtime", nor in "permanent". Nor in /etc/zones. This is the content of /etc/firewalld/zones/external.xml: <?xml version="1.0" encoding="utf-8"?> <zone> <short>External</short> <description>For use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description> <service name="ssh"/> <masquerade/> <interface name="eth0"/> <interface name="wlan0"/> </zone> /etc/firewalld/policies/allow-host-ipv6.xml: <?xml version="1.0" encoding="utf-8"?> <policy priority="-15000" target="CONTINUE"> <short>Allow host IPv6</short> <description>Allows basic IPv6 functionality for the host running firewalld.</description> <rule family="ipv6"> <icmp-type name="neighbour-advertisement"/> <accept/> </rule> <rule family="ipv6"> <icmp-type name="neighbour-solicitation"/> <accept/> </rule> <rule family="ipv6"> <icmp-type name="router-advertisement"/> <accept/> </rule> <rule family="ipv6"> <icmp-type name="redirect"/> <accept/> </rule> <ingress-zone name="ANY"/> <egress-zone name="HOST"/> </policy> Isengard:~ # firewall-cmd --list-all external (active) target: default icmp-block-inversion: no interfaces: eth0 wlan0 sources: services: ssh ports: protocols: forward: no masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: Isengard:~ # Isengard:~ # firewall-cmd --list-rich-rules Isengard:~ # That's all. Nothing was actually migrated from SuSEfirewal2. So, what can I do to actually migrate SuSEfirewall2 to firewalld? - -- Cheers Carlos E. R. (from 15.4 x86_64 at Telcontar) -----BEGIN PGP SIGNATURE----- iHoEARECADoWIQQZEb51mJKK1KpcU/W1MxgcbY1H1QUCZEekoRwccm9iaW4ubGlz dGFzQHRlbGVmb25pY2EubmV0AAoJELUzGBxtjUfVOisAmwfwhICegxmduEAav/Nu QM3NpQDtAJ45OmpRadedzwYYm4rLj011abVMtg== =MQ0M -----END PGP SIGNATURE-----

3 4

[oS-en] Suddenly, mouse wheel doesn't work.
by Carlos E. R. 25 Apr '23

25 Apr '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Suddenly, mouse wheel doesn't work. It was working, and suddenly it stopped working. I was seeing strange messages in log related to usb, so I unplugged/replugged the mouse, no effect. I downgraded the kernel several versions, no effect. Middle button, which shares the wheel, works. Leap 15.4. XFCE. What can I do to diagnose? This one is a trackball. I connected at the same time a second mouse, cheapo, and it works fine. Telcontar:~ # hwinfo --mouse 59: USB 00.1: 10503 USB Mouse [Created at usb.122] Unique ID: PsRb.FBtr+tYVKV1 Parent ID: k4bc.029GFTetOb3 SysFS ID: /devices/pci0000:00/0000:00:01.3/0000:03:00.0/usb1/1-13/1-13:1.1 SysFS BusID: 1-13:1.1 Hardware Class: mouse Model: "Holtek USB Keyboard" Hotplug: USB Vendor: usb 0x04d9 "Holtek Semiconductor, Inc." Device: usb 0x2020 "USB Keyboard" Revision: "1.01" Compatible to: int 0x0200 0x0001 "Generic USB Mouse" <=== WTF? No such thing. Driver: "usbhid" Driver Modules: "usbhid" Device File: /dev/input/event3 Device Files: /dev/input/event3, /dev/input/by-id/usb-CYKB13_USB_Keyboard-event-if01, /dev/input/by-path/pci-0000:03:00.0-usb-0:13:1.1-event Device Number: char 13:67 Speed: 1.5 Mbps Module Alias: "usb:v04D9p2020d0101dc00dsc00dp00ic03isc01ip02in01" Driver Info #0: XFree86 Protocol: explorerps/2 GPM Protocol: exps2 Config Status: cfg=new, avail=yes, need=no, active=unknown Attached to: #62 (Hub) 61: USB 00.0: 10503 USB Mouse [Created at usb.122] Unique ID: Mwf_.z_8Swe_nwg5 Parent ID: 2XnU.BpLUUanApo2 SysFS ID: /devices/pci0000:00/0000:00:08.1/0000:29:00.3/usb5/5-3/5-3:1.0 SysFS BusID: 5-3:1.0 Hardware Class: mouse Model: "Logitech TrackMan Wheel" <========= Hotplug: USB Vendor: usb 0x046d "Logitech, Inc." Device: usb 0xc404 "TrackMan Wheel" Revision: "2.20" Compatible to: int 0x0210 0x0023 Driver: "usbhid" Driver Modules: "usbhid" Device File: /dev/input/mice (/dev/input/mouse0) Device Files: /dev/input/mice, /dev/input/mouse0, /dev/input/event0, /dev/input/by-path/pci-0000:29:00.3-usb-0:3:1.0-event-mouse, /dev/input/by-id/usb-Logitech_Trackball-event-mouse, /dev/input/by-id/usb-Logitech_Trackball-mouse, /dev/input/by-path/pci-0000:29:00.3-usb-0:3:1.0-mouse Device Number: char 13:63 (char 13:32) Speed: 1.5 Mbps Module Alias: "usb:v046DpC404d0220dc00dsc00dp00ic03isc01ip02in00" Driver Info #0: Buttons: 3 Wheels: 1 XFree86 Protocol: explorerps/2 GPM Protocol: exps2 Config Status: cfg=new, avail=yes, need=no, active=unknown Attached to: #64 (Hub) Telcontar:~ # - -- Cheers Carlos E. R. (from 15.4 x86_64 at Telcontar) -----BEGIN PGP SIGNATURE----- iHoEARECADoWIQQZEb51mJKK1KpcU/W1MxgcbY1H1QUCY9gjZRwccm9iaW4ubGlz dGFzQHRlbGVmb25pY2EubmV0AAoJELUzGBxtjUfV/vAAmwYh1wv5utPK0ta/zdr5 cu6bp5ThAJ9nYxhbeAvQzSu6GWB0joUYDysLsg== =TWyg -----END PGP SIGNATURE-----

8 23

rtkit-daemon
by mh＠mike.franken.de 24 Apr '23

24 Apr '23

Hi *, is there any documentation on how to configure rtkit-daemon for openSUSE? I found a few hints regarding pipewire, but they seem to be at least in part inconsistent with each other. And I couldn't find any more general doc. Especially I have the following questions: Do I have to put a user in the rtkit group, if he wants to run a program like Citrix, which requests realtime capabilites? Or do I have to create a config file in /usr/etc/security/limits.d/? Is so, what should it contain? Do I have to configure something else? TIA. Bye. Michael.

4 14

Little TW nuisances
by Per Jessen 24 Apr '23

24 Apr '23

>> Patrick Shanahan wrote: >> >>> * Per Jessen <per(a)opensuse.org> [04-23-23 10:54]: >>>> I don't rememeber the last time I did a TW installation from >>>> scratch. >>> >>> >>> yeah, once you get it installed the first time, "It Just Works" :) >> >> Still, occasionally some minor surprises - network config now is >> networkmanager only, at least by default. It was easy to install >> wicked though. Next I had to add 'net.ifnames=0' to the boot config. >> Good stuff. > > Another small surprise - unable to restart syslog. "Unit > var-run.mount not found". It does in fact not exist. On a 2nd TW > system, that unit seems to have been provided by systemd-sysvcompat. nscd complains about not finding /etc/services and /etc/nsswitch.conf - (the symlinks to /usr/etc are missing). question - do files in /etc/ override same-named files in /usr/etc ? For instance, I want to change the logrotate config for /var/log/messages. Do I create /etc/logrotate.d/syslog with the new definition or should I give that config file a different name? syslog-ng doesn't seem to use /usr/etc, the default config went into /etc. -- Per Jessen, Zürich (14.1°C) Member, openSUSE Heroes (2016 - present) We're hiring - https://en.opensuse.org/openSUSE:Heroes

4 25

Tumbleweed QEMU/KVM missing something
by bent fender 24 Apr '23

24 Apr '23

As far as I can tell everything needed is installed and up to date but when I click Yast>Virtualizastion>Create-VM (OR command virt-manager) all I get is the virt-manager GUI popup saying "Unable to connect to libvirt qemu:///system Failed to Connect socket to '/var/run/libvirt/virtqemud-sock': No such file or directory" The deails blurb says: Unable to connect to libvirt qemu:///system. Failed to connect socket to '/var/run/libvirt/virtqemud-sock': No such file or directory Libvirt URI is: qemu:///system Traceback (most recent call last): File "/usr/share/virt-manager/virtManager/connection.py", line 925, in _do_open self._backend.open(cb, data) File "/usr/share/virt-manager/virtinst/connection.py", line 171, in open conn = libvirt.openAuth(self._open_uri, File "/usr/lib64/python3.10/site-packages/libvirt.py", line 147, in openAuth raise libvirtError('virConnectOpenAuth() failed') libvirt.libvirtError: Failed to connect socket to '/var/run/libvirt/virtqemud-sock': No such file or directory I can launch KVM no probs in Leap-15.4 though Background: I'm trying to run win-11 and one Yast popup cought my eye: "NetworkManager is being used. Bridge configuration must be done manually" (I use usb wifi adapters exclusively) Other related qieuestion: If my mobo does not support UEFI, does that limit UEFI in a VM i.e. win-11 required TPM and EFI?

6 19

isolinux.bin missing or corrupt
by Per Jessen 23 Apr '23

23 Apr '23

Newbie alert - it has been _years_ since I've tried to boot from USB - today I have tried two TW ISOs - first TW Rescue CD i686, next TW DVD x86_64. Copied them to USB with 'dd'. Booting either one produces $SUBJ. Any hints? -- Per Jessen, Zürich (17.8°C) Member, openSUSE Heroes (2016 - present) We're hiring - https://en.opensuse.org/openSUSE:Heroes

5 15

wifi5 vs wifi6
by Per Jessen 22 Apr '23

22 Apr '23

Just fyi - the most recent issue (uh, from two weeks back) of c't magazine had an article on how best to utilise Mesh-WLANs. One of the conclusions, unrelated to the mesh topic, was - unless you are currently having speed issues on Wifi5, don't bother with Wifi6. -- Per Jessen, Zürich (17.8°C) Member, openSUSE Heroes (2016 - present) We're hiring - https://en.opensuse.org/openSUSE:Heroes

3 2

tumbleweed - missing module tg3 ?
by Per Jessen 22 Apr '23

22 Apr '23

Bit of a longshot - I ran a zypper dup on office24, my tw i586 test system. For some reason, this didn't go according to plan. To investigate I tried loading the tumbleweed installer i586 - didn't work. No network interface found. afaict, because module tg3 isn't available. I tried the tumbleweed 64bit installer - same thing, no network interface. afaict, because module tg3 isn't available. I'm going to plug in another nic, different chip. -- Per Jessen, Zürich (16.1°C) Member, openSUSE Heroes (2016 - present) We're hiring - https://en.opensuse.org/openSUSE:Heroes

2 4

ssh user port settings
by Patrick Shanahan 21 Apr '23

21 Apr '23

I change ssh port 22 to a high port on all my installs but have one box that respects the assignment for root but not for <user>. I change both ssh.config and sshd.config so that including the port assignment is not normally required (within local network). errant machine respects the port assignment for rute but uses port 22 for <user>. What have I missed? -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri Photos: http://wahoo.no-ip.org/piwigo paka @ IRCnet oftc

6 12

NFS Null pointer with 5.14.21-150400.24.60
by Uwe Bonnes 21 Apr '23

21 Apr '23

Hello, this crash happened twice when 5.14.21-150400.24.60 was booted and storing a ~35 MB mbox via NFS.I rebooted to 5.14.21-150400.24.55 and stored that file multiple times again with no problem: [ 2815.995840] BUG: kernel NULL pointer dereference, address: 0000000000000590 [ 2815.995865] #PF: supervisor write access in kernel mode [ 2815.995876] #PF: error_code(0x0002) - not-present page [ 2815.995886] PGD 0 P4D 0 [ 2815.995898] Oops: 0002 [#1] PREEMPT SMP NOPTI [ 2815.995912] CPU: 1 PID: 1654 Comm: nfsd Tainted: G N 5.14.21-150400.24.60-default #1 SLE15-SP4 9096397fa6646928cc6d185ba417f2af65b536f1 [ 2815.995932] Hardware name: Wortmann Terra 3100/Terra 3100, BIOS 080015 04/28/2011 [ 2815.995943] RIP: 0010:nfsd4_copy+0x14d/0x510 [nfsd] [ 2815.996045] Code: f0 01 00 00 e8 44 f9 26 e1 49 8b 85 70 0b 00 00 4e 8b 2c e0 e8 24 84 27 e1 bf f4 ff ff ff e8 ba 96 fe ff 48 8b 3d eb 0d 56 e2 <48> c7 04 25 90 05 00 00 90 05 00 00 ba 58 06 00 00 48 c7 04 25 98 [ 2815.996074] RSP: 0018:ffffa3c680c53dc0 EFLAGS: 00010246 [ 2815.996096] RAX: 0000000018270000 RBX: ffff93e6212fa2e0 RCX: ffffffffc0b22bc4 [ 2815.996117] RDX: 000000000000001a RSI: ffff93e6212300b4 RDI: ffff93e600042c00 [ 2815.996138] RBP: ffffa3c680c53df0 R08: 0000000000000000 R09: ffffa3c680c53cb0 [ 2815.996158] R10: 0000000000000000 R11: ffff93e60273eb40 R12: 000000000000000d [ 2815.996179] R13: ffff93e6105f6000 R14: ffff93e6212fa7bc R15: ffff93e6212fa848 [ 2815.996200] FS: 0000000000000000(0000) GS:ffff93e63bc80000(0000) knlGS:0000000000000000 [ 2815.996222] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2815.996242] CR2: 0000000000000590 CR3: 00000001042dc000 CR4: 00000000000006e0 [ 2815.996264] Call Trace: [ 2815.996286] <TASK> [ 2815.996314] ? nfsd4_proc_compound+0x4e4/0x6d0 [nfsd b83567b8ddafcaed6594f0c02db5f3f6ad3d7661] [ 2815.996419] nfsd4_proc_compound+0x4e4/0x6d0 [nfsd b83567b8ddafcaed6594f0c02db5f3f6ad3d7661] [ 2815.996519] nfsd_dispatch+0x1a9/0x270 [nfsd b83567b8ddafcaed6594f0c02db5f3f6ad3d7661] [ 2815.996611] svc_process_common+0x2be/0x760 [sunrpc ee66caa7b4260761f5723a182d4844fb5a86c8ec] [ 2815.996757] ? nfsd_svc+0x380/0x380 [nfsd b83567b8ddafcaed6594f0c02db5f3f6ad3d7661] [ 2815.996851] ? nfsd_shutdown_threads+0x90/0x90 [nfsd b83567b8ddafcaed6594f0c02db5f3f6ad3d7661] [ 2815.996942] svc_process+0xdb/0xf0 [sunrpc ee66caa7b4260761f5723a182d4844fb5a86c8ec] [ 2815.997081] nfsd+0xed/0x160 [nfsd b83567b8ddafcaed6594f0c02db5f3f6ad3d7661] [ 2815.997173] kthread+0x154/0x180 [ 2815.997199] ? set_kthread_struct+0x50/0x50 [ 2815.997224] ret_from_fork+0x1f/0x30 [ 2815.997252] </TASK> [ 2815.997269] Modules linked in: rpcsec_gss_krb5 ipt_REJECT af_packet 8021q garp mrp stp llc nft_objref nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_tables ebtable_nat ebtable_broute ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_mangle iptable_raw iptable_security iscsi_ibft iscsi_boot_sysfs ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter bpfilter dmi_sysfs msr at24 regmap_i2c iTCO_wdt gpio_ich intel_pmc_bxt rtl8192ce(N) iTCO_vendor_support rtl_pci(N) rtl8192c_common(N) rtlwifi(N) mac80211 snd_hda_codec_idt snd_hda_codec_generic coretemp asus_wmi battery joydev libarc4 ledtrig_audio sparse_keymap snd_hda_codec_hdmi platform_profile pcspkr cfg80211 snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi i2c_i801 snd_hda_codec [ 2815.997449] lpc_ich mfd_core snd_hda_core snd_hwdep i2c_smbus snd_pcm jmb38x_ms snd_timer snd rfkill jme soundcore memstick mii thermal nfsd auth_rpcgss nfs_acl lockd grace sunrpc fuse configfs ip_tables x_tables ext4 crc16 mbcache jbd2 nouveau(N) hid_cherry hid_generic usbhid sr_mod drm_ttm_helper ttm cdrom sd_mod t10_pi i2c_algo_bit mxm_wmi(N) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec rc_core uhci_hcd ahci ehci_pci drm sdhci_pci libahci ehci_hcd libata usbcore cqhci sdhci mmc_core serio_raw wmi video button sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua scsi_mod [ 2815.997769] Supported: No, Unsupported modules are loaded [ 2815.997789] CR2: 0000000000000590 [ 2815.997809] ---[ end trace fae5fa8282f7f82e ]--- [ 2815.997827] RIP: 0010:nfsd4_copy+0x14d/0x510 [nfsd] [ 2815.997925] Code: f0 01 00 00 e8 44 f9 26 e1 49 8b 85 70 0b 00 00 4e 8b 2c e0 e8 24 84 27 e1 bf f4 ff ff ff e8 ba 96 fe ff 48 8b 3d eb 0d 56 e2 <48> c7 04 25 90 05 00 00 90 05 00 00 ba 58 06 00 00 48 c7 04 25 98 [ 2815.997954] RSP: 0018:ffffa3c680c53dc0 EFLAGS: 00010246 [ 2815.997976] RAX: 0000000018270000 RBX: ffff93e6212fa2e0 RCX: ffffffffc0b22bc4 [ 2815.997996] RDX: 000000000000001a RSI: ffff93e6212300b4 RDI: ffff93e600042c00 [ 2815.998017] RBP: ffffa3c680c53df0 R08: 0000000000000000 R09: ffffa3c680c53cb0 [ 2815.998037] R10: 0000000000000000 R11: ffff93e60273eb40 R12: 000000000000000d [ 2815.998058] R13: ffff93e6105f6000 R14: ffff93e6212fa7bc R15: ffff93e6212fa848 [ 2815.998079] FS: 0000000000000000(0000) GS:ffff93e63bc80000(0000) knlGS:0000000000000000 [ 2815.998101] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2815.998121] CR2: 0000000000000590 CR3: 00000001042dc000 CR4: 00000000000006e0

2 1