!security Bridg!

dear forum members,
i came across of very serious security problem. few minutes ago i have tried to install Skype (skype-1.4.0.118-suse.i586.RPM) downloaded from skype website.As usual i tried to install it with clicking on it - then as expected YAST password manager popped up and ask me for password - i typed it in and install started. But!!! it didn't go further then "Reading Installed Packages" and then yast install window would dissappear from screen.

Next is what astonished me. I tried to install it again thinking that probably something went wrong first time - same thing. Then i have tried again and few times again, after getting same result during the last attempt being angry i have just ran my hand on the keyboard when asked for a password and pushed "enter" key. To my suprise it didn't tell me that i have typed in wrong password but just started to " install" package (unsuccessfully of course).

Then i have tried to start yast - pop up password window - i typed wrong password - it got accepted!!!!!! to try if it didn't just opened a YAST manager without functioning i tried unistall Firefox and it did unistall it.

So .... installing skype didn't work, but insted my system is accepting any password!!!!!

what i have found later is after more then five minutes security kicks back in. what i mean is it doesn't accept wrong passwords any more. but with every new attempt to install Skype - security is down for a 5 or so minutes.

please tell me if you need some log files to look at this more in details (and please tell me where i find those logs)

senserely

Nikolai

dear forum members,
i came across of very serious security problem. few minutes ago i have tried to install Skype (skype-1.4.0.118-suse.i586.RPM) downloaded from skype website.As usual i tried to install it with clicking on it - then as expected YAST password manager popped up and ask me for password - i typed it in and install started. But!!! it didn't go further then "Reading Installed Packages" and then yast install window would dissappear from screen.

Next is what astonished me. I tried to install it again thinking that probably something went wrong first time - same thing. Then i have tried again and few times again, after getting same result during the last attempt being angry i have just ran my hand on the keyboard when asked for a password and pushed "enter" key. To my suprise it didn't tell me that i have typed in wrong password but just started to " install" package (unsuccessfully of course).

Then i have tried to start yast - pop up password window - i typed wrong password - it got accepted!!!!!! to try if it didn't just opened a YAST manager without functioning i tried unistall Firefox and it did unistall it.

So .... installing skype didn't work, but insted my system is accepting any password!!!!!

what i have found later is after more then five minutes security kicks back in. what i mean is it doesn't accept wrong passwords any more. but with every new attempt to install Skype - security is down for a 5 or so minutes.

please tell me if you need some log files to look at this more in details (and please tell me where i find those logs)

senserely

Nikolai
[/b]

failure of installation could happen for many reasons. you can get more info if try to install from terminal:

rpm -Uhv <path-to-skype>/skype...rpm (need to be root and remember about Tab key :-) )

also can check YaST log

about password it could be related to kdesu daemon that cashes passwords for some time
true, i didn't experience such a behaviour and my suggestion is just an idea
after you enter root password for 1st time check if kdesud is running
man kdesu for details

a little bit aside of topic: it could be a good idea to restrict skype with apparmor

failure of installation could happen for many reasons. you can get more info if try to install from terminal:

rpm -Uhv <path-to-skype>/skype...rpm (need to be root and remember about Tab key :-) )

also can check YaST log

about password it could be related to kdesu daemon that cashes passwords for some time
true, i didn't experience such a behaviour and my suggestion is just an idea
after you enter root password for 1st time check if kdesud is running
man kdesu for details

a little bit aside of topic: it could be a good idea to restrict skype with apparmor
[/b]

i got miissing dependences:

error: Failed dependencies:
********libQtCore.so.4 is needed by skype-1.4.0.118-suse.i586
********libQtDBus.so.4 is needed by skype-1.4.0.118-suse.i586
********libQtGui.so.4 is needed by skype-1.4.0.118-suse.i586
********libQtNetwork.so.4 is needed by skype-1.4.0.118-suse.i586
********libsigc-2.0.so.0 is needed by skype-1.4.0.118-suse.i586

and of course after:

zypper install libQtCore.so.4 libQtDBus.so.4 libQtGui.so.4 libQtNetwork.so.4 libsigc-2.0.so.0

i got:

package 'libQtCore.so.4' not found
package 'libQtDBus.so.4' not found
package 'libQtGui.so.4' not found
package 'libQtNetwork.so.4' not found
package 'libsigc-2.0.so.0' not found

how can i install Skype?
and where i do find the logs which are showing what is going on with security during Skype install?


[code]

i got miissing dependences:

error: Failed dependencies:
********libQtCore.so.4 is needed by skype-1.4.0.118-suse.i586
********libQtDBus.so.4 is needed by skype-1.4.0.118-suse.i586
********libQtGui.so.4 is needed by skype-1.4.0.118-suse.i586
********libQtNetwork.so.4 is needed by skype-1.4.0.118-suse.i586
********libsigc-2.0.so.0 is needed by skype-1.4.0.118-suse.i586

and of course after:

zypper install libQtCore.so.4 libQtDBus.so.4 libQtGui.so.4 libQtNetwork.so.4 libsigc-2.0.so.0

i got:

package 'libQtCore.so.4' not found
package 'libQtDBus.so.4' not found
package 'libQtGui.so.4' not found
package 'libQtNetwork.so.4' not found
package 'libsigc-2.0.so.0' not found

how can i install Skype?
and where i do find the logs which are showing what is going on with security during Skype install?
[code]
[/b]

these libraries are in the following packages:
libqt4-32bit
libqt4-dbus-1-32bit
libqt4-x11-32bit
libsigc++2-32bit

found with simple search here: http://packages.opensuse-community.org/
and can be installed from oss repo: http://download.opensuse.org/distrib.../repo/oss/suse
also present on installation dvd

note, these are the 32bit libraries for 64bit system (assumming you run 64bit 10.3) and you may need to install the corresponding 64bit packages without "-32bit"

the easiest way to do it is with yast - either set up oss repo either put in installation dvd
generally it's a good idea to put in the installation dvd each time you install something because almost every missing dependency could be met

i am not sure you'll find a special log for your security problems but check out general YaST log

these libraries are in the following packages:
libqt4-32bit
libqt4-dbus-1-32bit
libqt4-x11-32bit
libsigc++2-32bit

found with simple search here: http://packages.opensuse-community.org/
and can be installed from oss repo: http://download.opensuse.org/distrib.../repo/oss/suse
also present on installation dvd

note, these are the 32bit libraries for 64bit system (assumming you run 64bit 10.3) and you may need to install the corresponding 64bit packages without "-32bit"

the easiest way to do it is with yast - either set up oss repo either put in installation dvd
generally it's a good idea to put in the installation dvd each time you install something because almost every missing dependency could be met

i am not sure you'll find a special log for your security problems but check out general YaST log
[/b]

i have them all installed but still getting error message:

error: Failed dependencies:
********libQtCore.so.4 is needed by skype-1.4.0.118-suse.i586
********libQtDBus.so.4 is needed by skype-1.4.0.118-suse.i586
********libQtGui.so.4 is needed by skype-1.4.0.118-suse.i586
********libQtNetwork.so.4 is needed by skype-1.4.0.118-suse.i586
********libsigc-2.0.so.0 is needed by skype-1.4.0.118-suse.i586

and yes you are right, i am on 64bit machine.

i have them all installed but still getting error message:

[/b]

check the versions according to http://www.skype.com/intl/en/downloa.../linux/choose/ at the bottom of page. may try to reinstall them. i hadn't 32bit packages when try to install skype but after installed them everything was ok.

i have them all installed but still getting error message:

error: Failed dependencies:
********libQtCore.so.4 is needed by skype-1.4.0.118-suse.i586
********libQtDBus.so.4 is needed by skype-1.4.0.118-suse.i586
********libQtGui.so.4 is needed by skype-1.4.0.118-suse.i586
********libQtNetwork.so.4 is needed by skype-1.4.0.118-suse.i586
********libsigc-2.0.so.0 is needed by skype-1.4.0.118-suse.i586

and yes you are right, i am on 64bit machine.
[/b]

Search http://rpm.pbone.net/ for example: "libQtCore.so.4". Then look for suse distro version; then look for provides "libQtCore.so.4"; then install that rpm using Yast. If Yast doesn't have the repro; use http://packages.opensuse-community.org/; there you can D/L the rpm or use the repro as a yast-source.