- Arch-general - lists.archlinux.org

[arch-general] A question regarding lxc
by Piyush P Kurur 01 Apr '11

01 Apr '11

Can anyone please tell me whether my understanding of lxc is correct. Say I have lxc containers foo1, foo2 and bar1, bar2 such that (1) foo1 and foo2 have seperate file hiearchy and (2) bar1 and bar2 share /usr /bin/ (i.e. directories where executables and shared libraries are kept) via read only bind mount. I would expect that in configuration (2) for common shared libraries, only one copy would be loaded where as for (1) both will load its own versions of the shared library even if they are identical otherwise. Is that correct? The next question is what is the best way to check this out. Regards ppk

1 0

[arch-general] Updating hylafax to 6.0.5 - strange error - need help? fchmod(int, __mode_t) throw ()’ throws different exceptions
by David C. Rankin 01 Apr '11

01 Apr '11

Guys, I was working with hylafax in ABS on the 6.0.4 to 6.0.5 upgrade and I ran into a strange error related to "throws different exceptions": <snip> 86-64 -mtune=generic -O2 -pipe -c Dispatcher.c++ In file included from Sys.h:34:0, from Dispatcher.c++:27: /usr/include/sys/stat.h:299:47: error: declaration of ‘int fchmod(int, __mode_t) throw ()’ throws different exceptions ../port.h:32:12: error: from previous declaration ‘int fchmod(int, mode_t)’ make[3]: *** [Dispatcher.o] Error 1 make[3]: Leaving directory `/home/david/arch/pkg/bld/hylafax/src/hylafax-6.0.5/libhylafax' make[2]: *** [default] Error 2 make[2]: Leaving directory `/home/david/arch/pkg/bld/hylafax/src/hylafax-6.0.5/libhylafax' make[1]: *** [dirs] Error 2 make[1]: Leaving directory `/home/david/arch/pkg/bld/hylafax/src/hylafax-6.0.5' make: *** [default] Error 2 ==> ERROR: A failure occurred in build(). Aborting... I'm getting better at sorting this stuff out, but exception handling problems are the exception... no pun intended. Any ideas? upstream issue? -- David C. Rankin, J.D.,P.E.

1 0

[arch-general] ArchLinux for mipsel (Loongson)
by Heiher 31 Mar '11

31 Mar '11

Hello, Main page : http://dev.lemote.com:2001/ Docs : http://dev.lemote.com:2001/archlinux/other/docs/ -- Best regards! Heiher

1 0

[arch-general] [signoff] kernel26 2.6.37.6-1
by Tobias Powalowski 31 Mar '11

31 Mar '11

Upstream update. This package is NOT in testing (2.6.38 currently resides there), but at: http://dev.archlinux.org/~tpowa/kernel26/ please signoff for both arches. greetings tpowa -- Tobias Powalowski Archlinux Developer & Package Maintainer (tpowa) http://www.archlinux.org tpowa(a)archlinux.org

1 0

[arch-general] cancel request to reopen a feature request
by Kyle 31 Mar '11

31 Mar '11

Is there a way to cancel a request to reopen a feature request? Seems I jumped the gun just a little when I requested to reopen it, as the package release that implements the feature took a little time to get to my mirror of choice, and I based my request on the prior release. The task in question is #23517, and it should indeedd remain closed, as the feature has been implemented and I have successfully tested it. The error message I pasted in the task is from the previous release, which was still the latest version on my chosen mirror at the time I encountered the error. BTW, I would like to thank the Arch developers for such a quick response to my rather minor feature request. It was fixed just over two hours after I submitted it. You guys rock! ~Kyle

2 1

[arch-general] Display "Flicker" with 2.6.37.5-1 & nvidia 270.30-3 (dual head)
by David C. Rankin 30 Mar '11

30 Mar '11

Guys, Can anyone else confirm seeing display "Flicker" on startup with the new kernel and nvidia driver? What I mean by "Flicker" is that dark bands 1/8-1/4 screen wide (vertically) will appear as horizontal bars for a fraction of a second for the first few minutes after boot. (It is not hardware warming up/etc.. -- it happens on reboot as well and this box runs 24/7) The bars appear causing what looks like an old vertical timing sync problem on a CRT monitor, even though this is LCD. I am running dual-head and have seen other posts suggesting the problem is primarily a dual-head problem. After install of the new kernel and nvidia driver (2.6.37.5-1 & nvidia 270.30-3) the flicker was really bad, to the point I didn't think it was ever going to quit. The display has settled down, but I still get the flicker every time I switch desktops. (switching from desktop 1 -> desktop 2, with kpager) I don't know what software package may be at the bottom of this? (Xorg? Nvidia?) I would like to know if anyone else has experienced this and if you have any thoughts on which package it may be. Thanks. -- David C. Rankin, J.D.,P.E.

5 6

[arch-general] OHCI: work around for nVidia shutdown problem
by Andre "Osku" Schmidt 30 Mar '11

30 Mar '11

Hello, do you have a nvidia usb controller? and had/have problems with usb devices staying powered on after shutdown? this patch added in 2.6.37 had the opposite effect on my system: https://patchwork.kernel.org/patch/341321/ but the helpful devs found a solution: http://marc.info/?l=linux-usb&m=130142049527638&w=2 so in my system all is fine again. but, as i didn't find anyone with this problem (the first patch having the opposite effect) anywhere, i wanted to ask you if you can test this patch and tell if your nvidia usb controller still (or now) works as supposed. if desired, i can also tell when (if) this patch gets included upstream. (so you don't need to hassle with this patch, but know when to check) cheers .andre

1 0

[arch-general] [signoff] kernel26-lts 2.6.32.36-1
by Andreas Radke 30 Mar '11

30 Mar '11

Upstream update with security fixes. Please signoff. -Andy

2 2

Re: [arch-general] Port 80 is shown open in port scan without any web server running
by Partha Chowdhury 30 Mar '11

30 Mar '11

On 30/03/11 14:16, Thomas Bächler wrote: > Am 30.03.2011 10:36, schrieb Partha Chowdhury: > > >>> sudo /sbin/iptables-save >>> # Generated by iptables-save v1.4.7 on Wed Mar 30 13:59:44 2011 >>> *filter >>> :INPUT DROP [2844:282816] >>> :FORWARD DROP [0:0] >>> :OUTPUT ACCEPT [9999:990098] >>> -A INPUT -i lo -j ACCEPT >>> -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT >>> -A INPUT -p tcp -m tcp --dport 54215 -j ACCEPT >>> -A INPUT -p udp -m udp --dport 54215 -j ACCEPT >>> COMMIT >>> # Completed on Wed Mar 30 13:59:44 2011 > The following is OT, but I have to say it: > > This is an affront to every admin of smaller or bigger networks. It > hurts my eyes. What do you try to achieve by dropping unwanted traffic? > You even drop ICMP entirely - dropping ICMP is the cause of a large > number of problems. > > There is no security advantage, but you deliberately prevent proper > communication between yourself and other computers on the internet. > Well I picked this configuration from Red Hat training books, except for port 54215 which I open for bit torrent. What do you suggest about the ideal iptables configuration for basic desktop user - allowing proper connection as you said and yet stay secure from malicious port scanners ? On 30/03/11 14:20, Jan de Groot wrote: > . Try doing an nmap -sV and > you'll see what software is running on the proxyserver. I did what you said: > nmap -sV 115.187.45.97 > > Starting Nmap 4.20 ( http://insecure.org ) at 2011-03-30 15:06 IST > Interesting ports on 115.187.45.97: > Not shown: 1696 filtered ports > PORT STATE SERVICE VERSION > 80/tcp open http? > 1 service unrecognized despite returning data. If you know the > service/version, please submit the following fingerprint at > http://www.insecure.org/cgi-bin/servicefp-submit.cgi : > SF-Port80-TCP:V=4.20%I=7%D=3/30%Time=4D92F9D0%P=i686-pc-linux-gnu%r(Help,D > SF:DD,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nServer:\x20squid/3\.2\.0\.4-2 > SF:0110203\r\nMime-Version:\x201\.0\r\nDate:\x20Wed,\x2030\x20Mar\x202011\ > SF:x2009:37:20\x20GMT\r\nContent-Type:\x20text/html\r\nContent-Length:\x20 > SF:3234\r\nX-Squid-Error:\x20ERR_INVALID_REQ\x200\r\nContent-Language:\x20 > SF:en\r\nX-Cache:\x20MISS\x20from\x20Streamride\r\nVia:\x201\.1\x20Streamr > SF:ide\x20\(squid/3\.2\.0\.4-20110203\)\r\nConnection:\x20close\r\n\r\n<!D > SF:OCTYPE\x20html\x20PUBLIC\x20\"-//W3C//DTD\x20HTML\x204\.01//EN\"\x20\"h > SF:ttp://www\.w3\.org/TR/html4/strict\.dtd\">\n<html><head>\n<meta\x20http > SF:-equiv=\"Content-Type\"\x20content=\"text/html;\x20charset=utf-8\">\n<t > SF:itle>ERROR:\x20The\x20requested\x20URL\x20could\x20not\x20be\x20retriev > SF:ed</title>\n<style\x20type=\"text/css\"><!--\x20\n\x20/\*\n\x20Styleshe > SF:et\x20for\x20Squid\x20Error\x20pages\n\x20Adapted\x20from\x20design\x20 > SF:by\x20Free\x20CSS\x20Templates\n\x20http://www\.freecsstemplates\.org\n > SF:\x20Released\x20for\x20free\x20under\x20a\x20Creative\x20Commons\x20Att > SF:ribution\x202\.5\x20License\n\*/\n\n/\*\x20Page\x20basics\x20\*/\n\*\x2 > SF:0{\n\tfont-family:\x20verdana,\x20sans-serif;\n}\n\nhtml\x20body\x20{\n > SF:\tmargin:\x200;\n\tpadding:\x200;\n\tbackground:\x20#efefef;\n\tfont-si > SF:ze:\x2012px")%r(SSLSessionReq,DE3,"HTTP/1\.1\x20400\x20Bad\x20Request\r > SF:\nServer:\x20squid/3\.2\.0\.4-20110203\r\nMime-Version:\x201\.0\r\nDate > SF::\x20Wed,\x2030\x20Mar\x202011\x2009:37:20\x20GMT\r\nContent-Type:\x20t > SF:ext/html\r\nContent-Length:\x203240\r\nX-Squid-Error:\x20ERR_INVALID_RE > SF:Q\x200\r\nContent-Language:\x20en\r\nX-Cache:\x20MISS\x20from\x20Stream > SF:ride\r\nVia:\x201\.1\x20Streamride\x20\(squid/3\.2\.0\.4-20110203\)\r\n > SF:Connection:\x20close\r\n\r\n<!DOCTYPE\x20html\x20PUBLIC\x20\"-//W3C//DT > SF:D\x20HTML\x204\.01//EN\"\x20\"http://www\.w3\.org/TR/html4/strict\.dtd\ > SF:">\n<html><head>\n<meta\x20http-equiv=\"Content-Type\"\x20content=\"tex > SF:t/html;\x20charset=utf-8\">\n<title>ERROR:\x20The\x20requested\x20URL\x > SF:20could\x20not\x20be\x20retrieved</title>\n<style\x20type=\"text/css\"> > SF:<!--\x20\n\x20/\*\n\x20Stylesheet\x20for\x20Squid\x20Error\x20pages\n\x > SF:20Adapted\x20from\x20design\x20by\x20Free\x20CSS\x20Templates\n\x20http > SF:://www\.freecsstemplates\.org\n\x20Released\x20for\x20free\x20under\x20 > SF:a\x20Creative\x20Commons\x20Attribution\x202\.5\x20License\n\*/\n\n/\*\ > SF:x20Page\x20basics\x20\*/\n\*\x20{\n\tfont-family:\x20verdana,\x20sans-s > SF:erif;\n}\n\nhtml\x20body\x20{\n\tmargin:\x200;\n\tpadding:\x200;\n\tbac > SF:kground:\x20#efefef;\n\tfont-size:\x2012px"); > > Service detection performed. Please report any incorrect results at > http://insecure.org/nmap/submit/ . > Nmap finished: 1 IP address (1 host up) scanned in 114.226 seconds So it seems my ISP is running squid version 3.2.0.4-20110203 in transparent mode , just like you said. Interestingly when connecting to random ip addresses on port 80, the error page returned is quite different from normal ones. http://www.freeimagehosting.net/image.php?280f0ef980.png Does this transparent proxy pose any threat and what can I do to stop that ?

6 14

[arch-general] Port 80 is shown open in port scan without any web server running
by Partha Chowdhury 30 Mar '11

30 Mar '11

Hallo to everyone on the list. It is my first message in a while. I have recently changed my internet provider as i have moved. My previous provider was a DSL provider and the current one is the local cable operator.Now with current provider port 80 is shown open in every port scan test , all other ports being shown as stealth. But with the previous provider , every port scanned was shown as stealth. I am not running any web service . And the change in software being the one that is used to authenticate. Previously it was rp-pppoe now it is the GNU/Linux client of cyberoam software. Output from lsof: > sudo /bin/lsof -i > COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME > pdnsd 1207 nobody 4u IPv4 2434 TCP localhost:domain > (LISTEN) > pdnsd 1207 nobody 5u IPv4 2435 UDP localhost:domain > pdnsd 1207 nobody 8u IPv4 81232 UDP > 172.16.37.164:40131->AS-20144-has-not-REGISTERED-the-use-of-this-prefix:domain > linc 1214 root 5u IPv4 2448 UDP *:55089 > ntpd 1216 root 16u IPv4 2451 UDP *:ntp > ntpd 1216 root 17u IPv4 2455 UDP localhost:ntp > ntpd 1216 root 18u IPv4 2456 UDP 172.16.37.164:ntp > X 1377 root 1u IPv4 2964 TCP *:x11 (LISTEN) > gweather- 1538 partha 18u IPv4 78973 TCP > 172.16.37.164:53421->a125-56.222-11.deploy.akamaitechnologies.com:http > (CLOSE_WAIT) Iptables configuration: > sudo /sbin/iptables-save > # Generated by iptables-save v1.4.7 on Wed Mar 30 13:59:44 2011 > *filter > :INPUT DROP [2844:282816] > :FORWARD DROP [0:0] > :OUTPUT ACCEPT [9999:990098] > -A INPUT -i lo -j ACCEPT > -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT > -A INPUT -p tcp -m tcp --dport 54215 -j ACCEPT > -A INPUT -p udp -m udp --dport 54215 -j ACCEPT > COMMIT > # Completed on Wed Mar 30 13:59:44 2011 With my new provider, I have to provide a static ip 172.16.37.x to eth0 and then start the linc daemon to authenticate, after that i am allocated a public ip. Now my question is: why is port 80 open and does it indicate any security vulnerability ?

3 3