May 2023 - openSUSE Users - openSUSE Mailing Lists

[oS-en] Testing the new configuration of firewalld
by Carlos E. R. 02 May '23

02 May '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Content-ID: <5bf6502a-a6a1-9cf4-dce1-355b4d5b564b(a)Telcontar.valinor> Hi, (This is a thinking aloud post, so of course there is conflict in what I say) So I converted my miniserver to use firewalld instead of SuSEfirewalld, using "susefirewall2-to-firewalld" script. I added the rule to block incoming packets from the router. The resulting config is: Isengard:/etc/firewalld/zones # firewall-cmd --list-all external (active) target: default icmp-block-inversion: no interfaces: eth0 wlan0 sources: services: dns http https mountd nfs nfs3 ntp rpc-bind ssh ports: 12854/tcp 50000/tcp 12858/udp 47981/udp 38059/tcp 56517/udp 40399/tcp protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: address-unreachable bad-header beyond-scope communication-prohibited destination-unreachable echo-reply failed-policy fragmentation-needed host-precedence-violation host-prohibited host-redirect host-unknown host-unreachable ip-header-bad network-prohibited network-redirect network-unknown network-unreachable no-route packet-too-big parameter-problem port-unreachable precedence-cutoff protocol-unreachable reject-route required-option-missing source-route-failed time-exceeded timestamp-reply timestamp-request tos-host-redirect tos-host-unreachable tos-network-redirect tos-network-unreachable ttl-zero-during-reassembly ttl-zero-during-transit unknown-header-type unknown-option rich rules: rule family="ipv4" source address="192.168.1.55/32" port port="5556" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="2908" protocol="udp" accept rule family="ipv4" source address="192.168.1.129/32" port port="53" protocol="udp" accept rule family="ipv4" source address="192.168.1.57/32" accept rule family="ipv4" source address="192.168.1.14/32" port port="2049" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="80" protocol="tcp" accept rule family="ipv4" source address="192.168.1.0/24" port port="80" protocol="tcp" accept rule family="ipv4" source address="192.168.1.5/32" protocol value="icmp" accept rule family="ipv4" source address="192.168.1.14/32" port port="514" protocol="udp" accept rule family="ipv4" source address="192.168.1.14/32" port port="4080" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="4080" protocol="tcp" accept rule family="ipv4" source address="192.168.1.7/32" port port="137" protocol="tcp" accept rule family="ipv4" source address="172.26.0.0/16" protocol value="udp" accept rule family="ipv4" source address="192.168.1.126/32" port port="2049" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="4243" protocol="tcp" accept rule family="ipv4" source address="192.168.1.54/32" port port="4243" protocol="tcp" accept rule family="ipv4" source address="192.168.1.129/32" port port="53" protocol="tcp" accept rule family="ipv4" source address="192.168.1.7/32" protocol value="udp" accept rule family="ipv4" source address="192.168.1.7/32" port port="139" protocol="tcp" accept rule family="ipv4" source address="192.168.1.127/32" port port="873" protocol="tcp" accept rule family="ipv4" source address="192.168.1.1/32" port port="162" protocol="udp" accept rule family="ipv4" source address="192.168.1.55/32" accept rule family="ipv4" source address="192.168.1.0/24" port port="111" protocol="tcp" accept rule family="ipv4" source address="192.168.1.129/32" port port="5000" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="8080" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="4001" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="25" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="4000" protocol="tcp" accept rule family="ipv4" source address="192.168.1.1/32" port port="50000" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="445" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="5353" protocol="tcp" accept rule family="ipv4" source address="192.168.1.56/32" port port="5556" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="4120" protocol="udp" accept rule family="ipv4" source address="192.168.1.126/32" port port="873" protocol="tcp" accept rule family="ipv4" source address="192.168.1.0/24" port port="2049" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="4242" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="4243" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="1252" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="4243" protocol="udp" accept rule family="ipv4" source address="192.168.1.14/32" port port="8081" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="9090" protocol="tcp" accept rule family="ipv4" source address="192.168.1.129/32" port port="2049" protocol="tcp" accept rule family="ipv6" source address="fc00::/64" port port="5353" protocol="udp" accept rule family="ipv4" source address="192.168.1.1/32" port port="514" protocol="udp" accept rule family="ipv4" source address="192.168.1.128/32" port port="1625" protocol="tcp" accept rule family="ipv4" source address="192.168.1.127/32" port port="2049" protocol="tcp" accept rule family="ipv4" source address="192.168.1.129/32" port port="4080" protocol="tcp" accept rule family="ipv4" source address="192.168.1.54/32" accept rule family="ipv4" source address="192.168.1.128/32" port port="137" protocol="udp" accept rule family="ipv4" source address="192.168.1.0/24" port port="2049" protocol="udp" accept rule family="ipv4" source address="192.168.1.7/32" port port="53" protocol="udp" accept rule family="ipv4" source address="192.168.1.129/32" port port="9090" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="162" protocol="udp" accept rule family="ipv4" source address="192.168.1.129/32" port port="4000" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="8000" protocol="tcp" accept rule family="ipv4" source address="192.168.1.50/32" port port="53" protocol="tcp" accept rule family="ipv4" source address="192.168.1.0/24" port port="111" protocol="udp" accept rule family="ipv4" source address="192.168.1.7/32" port port="514" protocol="udp" accept rule family="ipv4" source address="192.168.1.5/32" port port="162" protocol="udp" accept rule family="ipv4" source address="192.168.1.14/32" port port="514" protocol="tcp" accept rule family="ipv4" source address="192.168.1.7/32" port port="5353" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="873" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" protocol value="icmp" accept rule family="ipv4" source address="192.168.1.128/32" port port="4754" protocol="udp" accept rule family="ipv4" source address="192.168.1.128/32" port port="53" protocol="tcp" accept rule family="ipv4" source address="192.168.1.56/32" port port="5558" protocol="tcp" accept rule family="ipv4" source address="192.168.1.128/32" port port="53" protocol="udp" accept rule family="ipv4" source address="192.168.1.129/32" port port="4001" protocol="tcp" accept rule family="ipv4" source address="192.168.1.15/32" port port="2049" protocol="tcp" accept rule family="ipv4" source address="192.168.1.1/32" protocol value="udp" accept rule family="ipv4" source address="192.168.1.0/24" port port="22" protocol="tcp" accept rule family="ipv4" source address="192.168.1.14/32" port port="6666" protocol="udp" accept rule family="ipv4" source address="192.168.1.54/32" port port="5558" protocol="tcp" accept rule family="ipv6" source address="fe80::/64" port port="5353" protocol="udp" accept rule family="ipv4" source address="192.168.1.50/32" port port="53" protocol="udp" accept rule family="ipv4" source address="192.168.1.7/32" port port="3553" protocol="udp" accept rule family="ipv4" source address="192.168.1.54/32" port port="5556" protocol="tcp" accept rule family="ipv4" source address="192.168.1.1/32" protocol value="icmp" accept rule family="ipv4" source address="192.168.1.7/32" port port="515" protocol="tcp" accept rule family="ipv4" source address="192.168.1.5/32" port port="514" protocol="udp" accept rule family="ipv4" source address="192.168.1.128/32" port port="138" protocol="udp" accept rule family="ipv4" source address="192.168.1.56/32" accept rule family="ipv4" source address="192.168.1.128/32" port port="139" protocol="tcp" accept rule family="ipv4" source address="192.168.1.55/32" port port="5558" protocol="tcp" accept rule family="ipv4" source address="192.168.1.129/32" port port="8081" protocol="tcp" accept rule priority="10" source mac="ROUTER_MAC" reject Isengard:/etc/firewalld/zones # So, I want to try the access to apache and ssh from outside. I connect via ssh to a Friend's machine, and try. Ipv4 first. carlos@Friend:~ $ curl http://isengard_rmt_dns ^C carlos@Friend:~ $ No response on port 80, good. carlos@Friend:~ $ curl http://isengard_rmt_dns:50000 <html><body><h1>Hola tio.</h1></body></html>carlos@Friend:~ $ Correct response on a high port. carlos@Friend:~ $ ssh cer@isengard_rmt_dns ^C carlos@Friend:~ $ No response on port 22, correct. carlos@Friend:~ $ ssh -p 51000 cer@isengard_rmt_dns The authenticity of host '[isengard_rmt_dns]:51000 ([IPv4_ADDR]:51000)' can't be established. ECDSA key fingerprint is SHA256:ILyba.... Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '[isengard_rmt_dns]:51000,[IPv4_ADDR]:51000' (ECDSA) to the list of known hosts. cer@isengard_rmt_dns: Permission denied (publickey). carlos@Friend:~ $ Expected response on a high port. Notice that on IPv4 the router intervenes with translations (virtual server). Incoming to port 51000 is sent to Isengard on LAN, port 22. Incoming to port 50000 is sent to port Isengard on LAN, port 50000. (not the actual ports, I edited them for privacy; but close). The Virtual Server config of the router doesn't work on IPv6 - correct, it is a NAT hack. Apache on IPv6 and high port: carlos@Friend:~ $ curl http://[Ipv6_ADDR]:50000 <html><body><h1>Hola tio.</h1></body></html>carlos@Friend:~ $ This is correct. carlos@Friend:~ $curl http://[Ipv6_ADDR] <html><body> <h1>Welcome to Isengard</a></h1> <h3>Letras: \ | @ # € </h3> <h2> <a href="/ficheros" title="Ficheros">[ficheros]</a> <br> <a href="/ficheros/mirrors" title="Mirrors">[Mirrors]</a> <br> <a href="/data/hoard/TheHoard/jd">[Shared J]</a> <br> <a href="/data/hoard/">[Data]</a> <br> <a href="/data/waterhoard/Fusion/Videos">[Fusion]</a> <br> <a href="/data/My_Book/Fusion/Videos">[Fusion MyBook]</a> <br>   </h2> </body></html> carlos@Friend:~ $ Now, this is not correct, it is the response expected INSIDE the LAN. That means a problem in the Apache configuration for virtual hosts, but also that port 80 is not closed on IPv6. ssh on IPv6 and default port: carlos@Friend:~ $ ssh cer@Ipv6_ADDR The authenticity of host 'Ipv6_ADDR (Ipv6_ADDR)' can't be established. ECDSA key fingerprint is SHA256:ILyba. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'Ipv6_ADDR' (ECDSA) to the list of known hosts. cer@Ipv6_ADDR: Permission denied (publickey). carlos@Friend:~ $ Well, this is not correct, it should be denied by the rich rule. Obviously, computers have their own mind, but I'm not familiar with the firewalld "mind". And I'm getting a headache. There is this rule: rule family="ipv4" source address="192.168.1.1/32" port port="50000" protocol="tcp" accept which might conflict with: rule priority="10" source mac="ROUTER_MAC" reject but it is for Ipv4 only, so it shouldn't. It seems that: services: dns http https mountd nfs nfs3 ntp rpc-bind ssh takes precedence over the rich rule denying packets via router. [headache] Obviously, being a server, both ssh and http have to be open even if the packet is incoming from the router, but not on the 22 and 80 ports, but on the high ports only. So maybe I have to remove the line services: dns http https mountd nfs nfs3 ntp rpc-bind ssh move all that to rich rules that open those ports on IPv4 only, and open generically ports 50000 and 51000 only. Wait, ssh comes from the router on port 22, it is translated. Making sshd listen on 51000 is not that easy. So, generically open port 50000. Open port 22 on IPv4, close on IPv6? Or open generically. Ideas? (Can I write comments in xml file /etc/firewalld/zones/external.xml?) - -- Cheers Carlos E. R. (from 15.4 x86_64 at Telcontar) -----BEGIN PGP SIGNATURE----- iHoEARECADoWIQQZEb51mJKK1KpcU/W1MxgcbY1H1QUCZEg+2Rwccm9iaW4ubGlz dGFzQHRlbGVmb25pY2EubmV0AAoJELUzGBxtjUfVN8kAnjDt2n+lyVtMRz7zT+Ih EiOCzJ8mAJ4pxKkBZj3nxuRjOT9DM7TClL87Tg== =tCZ9 -----END PGP SIGNATURE-----

12 156

[oS-en] Another SuSEfirewall2 to firewall conversion.
by Carlos E. R. 02 May '23

02 May '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, This particular post is rantish. Telcontar:~ # time susefirewall2-to-firewalld -c 2>&1 | tee susefirewall2-to-firewalld_2.2.txt ... Error: INVALID_PORT: 30000:30100 FIREWALLD ERROR: Command 'firewall-cmd ' failed But: /etc/sysconfig/SuSEfirewall2 192.168.1.126,tcp,smtp 192.168.1.126,tcp,imap 192.168.1.126,tcp,imaps\ 192.168.1.126,tcp,ftp 192.168.1.126,tcp,ftp-data 192.168.1.126,tcp,http \ # 192.168.1.126,tcp,30000:30100 \ 192.168.1.126,tcp,nfs 192.168.1.126,udp,sunrpc 192.168.1.126,tcp,rsync \ 192.168.1.127,tcp,smtp 192.168.1.127,tcp,imap 192.168.1.127,tcp,imaps\ 192.168.1.127,tcp,ftp 192.168.1.127,tcp,ftp-data 192.168.1.127,tcp,http \ # 192.168.1.127,tcp,30000:30100 \ 192.168.1.127,tcp,nfs 192.168.1.127,udp,sunrpc 192.168.1.127,tcp,rsync \ The line that triggers the error is commented out! I will delete it, of course. - -- Cheers Carlos E. R. (from 15.4 x86_64 at Telcontar) -----BEGIN PGP SIGNATURE----- iHoEARECADoWIQQZEb51mJKK1KpcU/W1MxgcbY1H1QUCZE5fhxwccm9iaW4ubGlz dGFzQHRlbGVmb25pY2EubmV0AAoJELUzGBxtjUfVtLwAnRvBv8Yc6XXRxeW+kxCm f6qp8BajAJ93uud6tgspD2+i1/XPRbVH+8nffQ== =Re/K -----END PGP SIGNATURE-----

7 35

firewalld - RT_TO_PERM_FAILED
by Per Jessen 02 May '23

02 May '23

2023-05-01 17:45:41 ERROR: ZONE_CONFLICT: eth1 2023-05-01 17:45:41 WARNING: Runtime To Permanent failed on zone 'external': org.fedoraproject.FirewallD1.Exception: ZONE_CONFLICT: eth1 2023-05-01 17:45:42 ERROR: RT_TO_PERM_FAILED That is as far as I got with migrating Carlos' SFW2 setup. Trying to debug the iptables rules to spot what might be wrong - well, a little overwhelming, particularly because I am not familiar with firewalld's setup. -- Per Jessen, Zürich (16.4°C) Member, openSUSE Heroes (2016 - present) We're hiring - https://en.opensuse.org/openSUSE:Heroes

3 5

Tumbleweed_KDE3 - Repository 'kde3' is invalid
by Michael Hamilton 02 May '23

02 May '23

I've been seeing these errors on zypper ref of Tumbleweed_KDE3 since yesterday. Anyone know what's up? % zypper ref ... Repository 'kde3' is invalid. [Tumbleweed_KDE3|https://download.opensuse.org/repositories/KDE:/KDE3/openSU…] Valid metadata not found at specified URL History: - File './repodata/c034ba8eb3ba6a812e4ad661b72aa2694b24cf28708ec024c62f31033d17f2bd36949e1f35f458ed67432fbb5ca69707c2f52d27d99b775911390e96f1966bcb-filelists-ext.xml.gz' not found on medium 'https://download.opensuse.org/repositories/KDE:/KDE3/openSUSE_Tumbleweed' - Can't provide ./repodata/c034ba8eb3ba6a812e4ad661b72aa2694b24cf28708ec024c62f31033d17f2bd36949e1f35f458ed67432fbb5ca69707c2f52d27d99b775911390e96f1966bcb-filelists-ext.xml.gz ... Thanks, Michael

2 2

AW: DECO
by Leen de Braal 01 May '23

01 May '23

-- M vr gr L. de Braal BraHa Systems NL - Terneuzen T +31 115 649333 -----Oorspronkelijk bericht----- > Afzender: Bill Walsh <bill(a)kctu.com> > Verstuurd: Maandag 1st Mei 2023 16:55 > Aan: users(a)lists.opensuse.org > Onderwerp: Re: DECO > > On 5/1/23 08:57, Carlos E.R. wrote: > > This box works on demand, only one video stream is received at a time. > > The user selects what to see with the IR remote control, the box sends > > the appropriate command to the server cloud, then the server cloud > > sends back the stream direct to the client. Each client a different > > stream. > > Uhm..................Not sure that is correct. Spain being in a parallel > universe may work that way but I doubt it. All the signals are present > all the time. Each is on it's own frequency [ channel ]. The decoder box > just tunes in the appropriate frequency that you want. Over the air, > cable, satellite all work this way. Yes, that used to be TV. What Carlos says is used for IP TV, here they call it interactive TV. Analog TV over the air is already switched off here, over cable it will follow shortly. Only thing left will be IP TV. BTW: here is in the Netherlands. > > -- > In times of Tyranny and injustice when law oppresses the people, the outlaw > takes his place in history. > ~ > · Robin Hood · 2010 · Screen Title >

3 2

Tumbleweed install with secure boot failing
by Wolfgang Rosenauer 01 May '23

01 May '23

Hi, just got a new laptop with Windows 11 installed and I'm not supposed to remove Win 11 completely ;-) but want to install Tumbleweed in dual boot. Since apparently I'm installing only every few years it's always again "interesting". I downloaded a recent Tumbleweed snapshot and wrote it to a USB stick but I cannot boot from it as the system tells me that the secure boot signature is invalid. When trying to search for the issue I cannot find much. I found that Tumbleweed should be supporting secure boot completely and therefore I have no idea what might be wrong as apparently is meant to just work. Any pointers? Thanks, Wolfgang

5 11

sfw2 to firewalld conversion
by Per Jessen 01 May '23

01 May '23

Carlos was right, it is ancient news - the script is dated 2016. I guess it is well off-topic too, but at least it is SUSE related :-) I needed a bit of a distraction, I've been working on a website, so after dinner I installed the migration script on my tw64 test box, along with firewalld. If need be, I can wipe the whole slate clean. After starting firewalld (with an empty config I presume), I tried the first run of susefirewall2-to-firewalld. It took 5m49s - seemed to spend much of it with a whole slew of icmps. Two initial comments - after looking at the output - the conversion script isn't quite ipv6 aware: INFO: RICH: Adding rich rule="rule family=ipv4 source address=fe80::/64 port port=5353 protocol=udp accept" to zone="ext" INFO: RICH: Adding rich rule="rule family=ipv4 source address=fc00::/64 port port=5353 protocol=udp accept" to zone="ext" INFO: RICH: Adding rich rule="rule family=ipv4 source address=fe80::/64 port port=5353 protocol=udp accept" to zone="int" It does however seem to understand your "from:to": port-range syntax: INFO: Adding port(s)="30000-30010/tcp" to zone="external" INFO: Adding port(s)="4664/tcp" to zone="external" INFO: Adding port(s)="427/tcp" to zone="external" INFO: Adding port(s)="5060-5100/udp" to zone="external" -- Per Jessen, Zürich (14.6°C) Member, openSUSE Heroes (2016 - present) We're hiring - https://en.opensuse.org/openSUSE:Heroes

2 11