Maybe you’ll have to stay calm until your up2date packages get “re-new-ed” .. so, wait a few days if first try fails.

• Security Fix for VMware ISAPI Extension
• Setting ActiveX killbit
• Security Fix for Local Privilege Escalation on Host System
• Update to Freetype 2.3.7

More info can be found in VMware’s Release Notes

 
Quote from the opensuse-security-announce mailing list:

With the release of an mysql security fix on August 13 we have released
the last update for SUSE Linux 10.1. (Actually 10.1 was discontinued on
May 31st, but the queue took a bit longer to flush from all updates.)

 
See: http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00004.html

• First of all, disable nscd (name service cache daemon)!
• Install winbind, samba client and kerberos tools

In this test enviroment, the Domain is “D1COMP”; the realm “D1COMP.LAN”

• Edit /etc/krb5.conf


[libdefaults]
default_realm = D1COMP.LAN
clockskew = 300
[realms]
D1COMP.LAN = {
kdc = 172.31.7.27 ## One of your Domain Controllers
default_domain = d1comp.lan
admin_server = 172.31.7.27
}
[logging]
kdc = FILE:/var/log/krb5/krb5kdc.log
admin_server = FILE:/var/log/krb5/kadmind.log
default = SYSLOG:NOTICE:DAEMON

[domain_realm]
.d1comp.lan = D1COMP.LAN

[appdefaults]
pam = {
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
proxiable = false
retain_after_close = false
minimum_uid = 1
}

• obtain Kerberos ticket


# kinit Administrator@D1COMP.LAN
Password for Administrator@D1COMP.LAN:
#


• check Kerberos ticket


# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: Administrator@D1COMP.LAN
--------
Valid starting Expires Service principal
12/12/07 16:16:01 12/13/07 02:16:45 krbtgt/D1COMP.LAN@D1COMP.LAN
renew until 12/13/07 16:16:01
--------
Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached


• Adjust /etc/samba/smb.conf


[global]
workgroup = D1COMP
printing = cups
printcap name = cups
printcap cache time = 750
cups options = raw
map to guest = Bad User
include = /etc/samba/dhcp.conf
logon path = \\%L\profiles\.msprofile
logon home = \\%L\%U\.9xprofile
logon drive = P:
usershare allow guests = No
idmap gid = 10000-20000
idmap uid = 10000-20000
realm = D1COMP.LAN
security = ADS
template homedir = /home/%D/%U
template shell = /bin/bash
winbind refresh tickets = yes


• Join the Active Directory


# net join -S d1comp -UAdministrator%Password
Using short domain name -- D1COMP
Joined 'SERVER' to realm 'D1COMP.LAN'

# /etc/init.d/winbind start
Starting Samba WINBIND daemon ... done


• Basic Check:


# wbinfo -t
checking the trust secret via RPC calls succeeded

# wbinfo -g
D1COMP\domain guests
D1COMP\domain users
D1COMP\...


• Check support of ntlm authentication:


# wbinfo -a d1comp\\user%password
plaintext password authentication succeeded
challenge/response password authentication succeeded

ntlm_auth requires access to the privileged winbind pipe in order to function properly.

• Enable this by changing group of the winbind_privileged directory to the group you run Squid as (cache_effective_group setting in squid.conf).


chgrp squid /var/lib/samba/winbindd_privileged

• Edit squid.conf to enable both the winbind basic and ntlm authenticators. IE will use ntlm and everything else basic:


auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 10
#auth_param ntlm max_challenge_reuses 0
#auth_param ntlm max_challenge_lifetime 2 minutes
#auth_param ntlm use_ntlm_negotiate off
auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param basic children 5
auth_param basic realm Domain Proxy Server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
authenticate_cache_garbage_interval 10 seconds
##
# Credentials past their TTL are removed from memory
authenticate_ttl 0 seconds
##
## acl entries to require authentication:
acl AuthorizedUsers proxy_auth REQUIRED
http_access allow all AuthorizedUsers


This howto is no guarantee to get it work, but kind of reminder for me : /
Special thanks to Adrian Chadd and the wiki @ squid-cache.org!