Hello
Last night, whilst merrily surfing and emailing, I decided to run up2date on my RH7 machine. I was prompted by the RHN advisory that lprng has a security flaw. I had already updated xinetd to the latest rpm version (2.1.8.9 pre 15-2)and was running fine. I selected LPRng -3.7.4-23 glibc -2.2-12 (+common) ,gnupg which I was investigating, and somewhere along the line losetup 2.10m-5.
I started the download, and continued surfing, albeit much more slowly on my laptop over the shared v90 modem. Intermittently I used the RH machine with star office to access pages as well.
Then something strange happened....
Star Office locked up, had to use kill app to stop.
Network connection seemed to stop.
But the download continued.
Up2date finished, and installed updates (have checked in log file).
Unable to ping my network, though can ping out.
Then I discovered that eth0 and lo were listed in the RHppp dialler interface list.
Ifconfig shows eth0 and lo as running, with correct addresses.
Network configuration shows all interfaces as before.
but the machine now looks for ppp1 as well.

I shutdown, and the system hangs, had to use power switch.
Reboot fsck stops at 80%, couldn't seem to run manually, so rebooted with old kernel, which worked. No network, but the hub lights flash, they just don't talk to each other.

This AM, slightly less inebriated, I reviewed the situation.

Boots with 2.4.2 kernel OK, pppdialler has eth0 and lo listed as well as my ISP.

ifconfig shows interfaces with correct ip and mask.

The windows laptop has had no changes to TCP/IP.

I checked bootlog, the logs are now stunningly brief, and all the rc.sysinit and sysctl stuff is gone, as is all the network stuff.

My tripwire db shows hundreds of changes,including lots in etc/sysconfig which seem to be attributable to the rpm changes.


I've booted from my 2.2.16 kernel, and if I try to ping, it first tells me that there is "no so_timestamp support fallback to siocgstamp" and then gives me destination host unreachable.

I flushed my iptables and defaulted to accept, no change.

It strikes me that I have somehow stuffed up my startup scripts. Does anyone have any suggestions as to what I can do, am I going to have to get the install CD's out again???

HELP ME!!!

Jim

Have investigated log files further.

in /var/log/secure I see lots of entries relating to SWAT access from localhost and my laptop. Then at 0328 I get...
jimsdesktop xinetd [485]:START swat pid =1210 from 207.236.3.96
This fails a second later, then there is another attempt at 0328, again rejected.
I switched off shortly after this, and todays entries are just localhost.
The ip in question is pingable, but I don't know what it is. Could be the yashy fw test recommended by unspawn, but I don't know how to verify that.

Am on the brink of reaching for the install CD, but fortunately I have to go to work now, so hopefully when I return in the morning, someone will have had a better idea!

Jim

Hi
I finally reached for the CD after stuffing whole system. Reinstalled, setup network, and it still didn't work. Hub lights still on. Turns out a non home made patch cable has failed somehow in that it seems to be in situ, and all lights on card and hub are on, but the bastard doesn't work, thus packets lost and host unreachable.
It is important to learn from ones mistakes!
Jim