Shorewall users - Nov 2004 - Upgrade from Hell

For those of you running SuSE 9.1, I do not recommend upgrading to 9.2
at this time. 

Refer to http://shorewall.net/myfiles.htm for information on my
configuration:

a) On Ursa:

	1) After the upgrade, both of the NICs were recognized as
"configured"
in YAST yet neither of them would start; ifup claimed that no
configuration could be found for either interface. Only got them running
again by deleting and re-adding them.

	2) The MAC address of eth0 appeared to change (appears to be a shift
right with big/little endian rotation). May be related to problem 1)
since the configurations are tied to the MAC.

b) On Tipper:

	1) The contents of my ~/.ssh directory were inexplicably moved to
~/.ssh/.ssh. Needless to say, ssh didn''t work well.

The ipsec tunnel between the systems failed to work after upgrading
''ursa''. A subsequent upgrade of ''tipper''
didn''t help. May be an openssl
problem as I''m seeing messages on both systems claiming that the CRL
has
expired even though I recreated it today!!!

 -Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

On Fri, 2004-11-05 at 21:09 -0800, Tom Eastep wrote:
> 
> The ipsec tunnel between the systems failed to work after upgrading
> ''ursa''. A subsequent upgrade of
''tipper'' didn''t help. May be an openssl
> problem as I''m seeing messages on both systems claiming that the
CRL has
> expired even though I recreated it today!!!
This one is solved and cannot be placed at the feet of the upgrade.

a) The CRL had expired.
b) When I reinstalled SuSE on the laptop recently, I messed up saving
and restoring the /etc/certs directory used by racoon. There should have
been a symbolic link to the crl named with the ca cert''s hash value
with
a .r0 suffix; there was rather a separate (expired) file by that
name :-(

-Tom

On Fri, 2004-11-05 at 21:09 -0800, Tom Eastep wrote:
> 
> Refer to http://shorewall.net/myfiles.htm for information on my
> configuration:
> 
> a) On Ursa:
> 
> 	1) After the upgrade, both of the NICs were recognized as
"configured"
> in YAST yet neither of them would start; ifup claimed that no
> configuration could be found for either interface. Only got them running
> again by deleting and re-adding them.
> 
> 	2) The MAC address of eth0 appeared to change (appears to be a shift
> right with big/little endian rotation). May be related to problem 1)
> since the configurations are tied to the MAC.
This is only slightly off-topic since it is going to bite anyone who
upgrades to a 2.6.8 or later kernel and who has Lite-On tulip cards
(such as the Netgear FA310TX) with a MAC address detected by older
kernels as beginning with 02:00. All Lite-On cards have the MAC address
byte-swapped in the card''s EEPROM but the older tulip drivers were only
"fixing" addresses beginning "A0:00" or "C0:00"
and were not fixing
addresses beginning "02:00". Starting with kernel 2.6.8, the driver is
also fixing "02:00" (and SuSE 9.2 includes a 2.6.8 Kernel).

This driver change is likely to appear in the 2.4 kernels at some point
as well so I am copying the LEAF list.

This diff listing shows what I''m talking about -- it is a change that I
had to make to my dhcpd.conf file to cause Ursa to continue to receive
the proper IP address:

gateway:~ # diff -au /etc/dhcpd.conf~ /etc/dhcpd.conf
--- /etc/dhcpd.conf~    2004-09-26 18:33:05.000000000 -0700
+++ /etc/dhcpd.conf     2004-11-05 14:51:10.738655528 -0800
@@ -24,7 +24,7 @@
        }
  
        host ursa.shorewall.net {
-               hardware ethernet 02:00:08:e3:4c:48;
+               hardware ethernet 00:02:e3:08:48:4c;
                fixed-address 192.168.1.5;
        }
  
gateway:~ #

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key