Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #5419 > unrolled thread
| Started by | Emilio Pozuelo Monfort <pochu@debian.org> |
|---|---|
| First post | 2018-05-23 11:50 +0200 |
| Last post | 2018-05-26 09:00 +0200 |
| Articles | 3 — 3 participants |
Back to article view | Back to linux.debian.security
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Re: libprocps3 procps update this morning causing shorewall/iptables routing problems. Emilio Pozuelo Monfort <pochu@debian.org> - 2018-05-23 11:50 +0200
Re: libprocps3 procps update this morning causing shorewall/iptables routing problems. Jonathan Wiltshire <jmw@tiger-computing.co.uk> - 2018-05-24 15:20 +0200
Re: libprocps3 procps update this morning causing shorewall/iptables routing problems. Abhijith PA <abhijith@disroot.org> - 2018-05-26 09:00 +0200
| From | Emilio Pozuelo Monfort <pochu@debian.org> |
|---|---|
| Date | 2018-05-23 11:50 +0200 |
| Subject | Re: libprocps3 procps update this morning causing shorewall/iptables routing problems. |
| Message-ID | <vSyz7-1Gm-3@gated-at.bofh.it> |
On 23/05/18 11:36, Luke Hall wrote: > I have just realised that jessie updates are still pre-lts so this may > not be suitable for the list. Apologies if so.. Yes, debian-security@lists.debian.org would be more appropriate in this case. Adding that to Cc. Full quote below. Emilio >> This morning a number of our jessie firewall servers received these updates. >> >> 2018-05-23 06:53:20,879 INFO Allowed origins are: >> ['origin=Debian,codename=jessie,label=Debian-Security'] >> 2018-05-23 06:53:23,120 INFO Packages that will be upgraded: libprocps3 >> procps >> 2018-05-23 06:53:23,121 INFO Writing dpkg log to >> '/var/log/unattended-upgrades/unattended-upgrades-dpkg.log' >> 2018-05-23 06:53:24,836 INFO All upgrades installed >> >> Those machines, all running shorewall 4.6.4.3-2 and the 3.16.0-4-amd64 >> kernel stopped routing traffic through to hosts behind them and we found >> it necessary to restart shorewall for this to resume. I will do some >> further debugging this morning but I'm wondering if this affected anyone >> else. >> >> Thanks >> > >
[toc] | [next] | [standalone]
| From | Jonathan Wiltshire <jmw@tiger-computing.co.uk> |
|---|---|
| Date | 2018-05-24 15:20 +0200 |
| Message-ID | <vSYjT-174-1@gated-at.bofh.it> |
| In reply to | #5419 |
(CC because I'm not sure whether you're subscribed)
On 23/05/18 11:36, Luke Hall wrote:>>> This morning a number of our
jessie firewall servers received these updates.
>>>
>>> 2018-05-23 06:53:20,879 INFO Allowed origins are:
>>> ['origin=Debian,codename=jessie,label=Debian-Security']
>>> 2018-05-23 06:53:23,120 INFO Packages that will be upgraded: libprocps3
>>> procps
>>> 2018-05-23 06:53:23,121 INFO Writing dpkg log to
>>> '/var/log/unattended-upgrades/unattended-upgrades-dpkg.log'
>>> 2018-05-23 06:53:24,836 INFO All upgrades installed
>>>
>>> Those machines, all running shorewall 4.6.4.3-2 and the 3.16.0-4-amd64
>>> kernel stopped routing traffic through to hosts behind them and we found
>>> it necessary to restart shorewall for this to resume. I will do some
>>> further debugging this morning but I'm wondering if this affected anyone
>>> else.
Do you have a stray 'net.ipv4.ip_forward=0' or similar in
/etc/sysctl{.conf,.d}?
We also saw one instance of this problem, because the sysctls were
reloaded during the update and so forwarding became disabled. Restarting
shorewall of course fixes this by setting ip_forward back to 1.
All our other machines without ip_forward=0 in the configuration were
unaffected.
--
Jonathan Wiltshire
Red Hat Certified Engineer (#170-281-083)
Tiger Computing Ltd
ISO27001:2013 Certified
Tel: 01600 483 484
Web: https://www.tiger-computing.co.uk
Registered in England. Company number: 3389961
Registered address: Wyastone Business Park,
Wyastone Leys, Monmouth, NP25 3SR
[toc] | [prev] | [next] | [standalone]
| From | Abhijith PA <abhijith@disroot.org> |
|---|---|
| Date | 2018-05-26 09:00 +0200 |
| Message-ID | <vTBlf-8iz-7@gated-at.bofh.it> |
| In reply to | #5420 |
On Thursday 24 May 2018 06:01 PM, Jonathan Wiltshire wrote:
> (CC because I'm not sure whether you're subscribed)
>
> On 23/05/18 11:36, Luke Hall wrote:>>> This morning a number of our
> jessie firewall servers received these updates.
>>>>
>>>> 2018-05-23 06:53:20,879 INFO Allowed origins are:
>>>> ['origin=Debian,codename=jessie,label=Debian-Security']
>>>> 2018-05-23 06:53:23,120 INFO Packages that will be upgraded: libprocps3
>>>> procps
>>>> 2018-05-23 06:53:23,121 INFO Writing dpkg log to
>>>> '/var/log/unattended-upgrades/unattended-upgrades-dpkg.log'
>>>> 2018-05-23 06:53:24,836 INFO All upgrades installed
>>>>
>>>> Those machines, all running shorewall 4.6.4.3-2 and the 3.16.0-4-amd64
>>>> kernel stopped routing traffic through to hosts behind them and we found
>>>> it necessary to restart shorewall for this to resume. I will do some
>>>> further debugging this morning but I'm wondering if this affected anyone
>>>> else.
>
> Do you have a stray 'net.ipv4.ip_forward=0' or similar in
> /etc/sysctl{.conf,.d}?
>
> We also saw one instance of this problem, because the sysctls were
> reloaded during the update and so forwarding became disabled. Restarting
> shorewall of course fixes this by setting ip_forward back to 1.
>
> All our other machines without ip_forward=0 in the configuration were
> unaffected.
>
>
Do you think it is a regression in recent upload of procps in
oldstable-security ?
--abhijith
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.security
csiph-web