December 1999 - openSUSE Security - openSUSE Mailing Lists

Re: http log entry
by Martin P. Peikert 08 Dec '99

08 Dec '99

Hello, on one of our boxes - not the webserver - these ports were probed, too, but from another IP-adress. The admin of the gateway told me, that it was 'probably some kid with a new hacker toy'. Martin -- ---------------------------------------------------- Martin Peikert EN 636 Fachgebiet Theoretische Elektrotechnik TU Berlin Sekretariat EN 2 fon 314-23881 fax 314-22284 http://www-tet.ee.tu-berlin.de/peikert/index.html ----------------------------------------------------

1 0

Re: [suse-security] SSH clients
by Security Webmaster OKDesign oHG 07 Dec '99

07 Dec '99

>TeraTerm is a free, open source terminal emulator for Window$. A SSH >plugin is available, however, I have not set it up yet. >http://hp.vector.co.jp/authors/VA002416/teraterm.html Well, I useTTpro and the TTSSH-plugin on my client and it works great. Very easy to set up, you can use pw-authentication, RSA-authentication and rhosts, depending on what the server provides. I can advise it. Of course just IMHO :-) ---Stephan

1 0

Re: [suse-security] ssh-authentication
by Security Webmaster OKDesign oHG 07 Dec '99

07 Dec '99

Hi again, now it works. The problem was, that the homedir of the user had the mods drwxrwxr-x. I changed it to drwxr-xr-x, now it works... Hmm, strange.... How can I manage it that the group has write-access to this directory ? And why does the sshd not allow access when the group has write-access ? Sorry, I don't understand this. Is this part of the security-behaviour of sshd or what ? And can this be changed ? TIA ---Stephan

4 4

ssh-authentication
by Security Webmaster OKDesign oHG 07 Dec '99

07 Dec '99

Hi again, first thanks to all those trying to help. Okay, I checked some things, here is the result: -I checked /etc/sshd_config. Nothing unusual. Allowed is only RSA-Authentication, the rest is left as was. -The machine is connected via router, but that doesn't matter, as I can acces the machine with ssh using _my_ key. I just can't access using the key from the user which should get access. - The file identity.pub was copied to authorized_keys, so this should work. - It was copied being the user itself (via su), so permissions should be correct. - No entries in /etc/sshd_config in the sections AllowHosts and DenyHosts. - I also checked my hosts.allow and hosts.deny - files. Nothing in there what could cause the problem. - BTW: The clock was set wrong on myclient. I forgot to set it correct after making a bios-update. Thanks for the tip. Okay, here are the file-permissions: drwxr-xr-x . drwxrwxr-x .. (it's okay that the group has full access) -rw -r--r-- authorized_keys -rw------- identity -rw-r--r-- identity.pub -rw------- random_seed And this is the message when using ssh -v: Trying RSA authentication with key 'xxx' Remote: Bad file modes for /~_USERDIR_/. / Server refused our key. Permission denied. What comes to my mind: I set up a chroot for ftp-accesses, thats why the dir is set to ~_USERDIR_/. / Maybe this is something important ??? But should not, as the /. / at the end just means that the user cannot escape from his homedir with ftp... Okay, any ideas what is wrong ??? TIA. ---Stephan

1 0

ipchains and napster
by alex medvedev 06 Dec '99

06 Dec '99

hi, thanks for the replies every one! my ipchains rules: # ipchains -L Chain input (policy ACCEPT): target prot opt source destination ports - all ------ anywhere ns.external.org n/a - all ------ anywhere fw.internal.org n/a Chain forward (policy DENY): target prot opt source destination ports MASQ all ------ 192.168.111.0/25 anywhere n/a Chain output (policy ACCEPT): target prot opt source destination ports - all ------ ns.external.org anywhere n/a - all ------ fw.internal.org anywhere n/a the setup: internet --- linux with ipchains ---- win98 with napster people from the internet can see and download my files on win98. -alexm

2 1

ssh-authtication
by Security Webmaster OKDesign oHG 06 Dec '99

06 Dec '99

Hi folks, umm, I have a small problem. When setting up our server, I tried to get the best security as possible. Maybe I changed some config-file to fit our needs to allow ssh-logins only from specified users.(But I have no idea which file this was :-(( ) Now I want to allow another user to login using ssh. I made ssh-keygen for this user, entered the password, copied identity.pub to authorized_keys in the .ssh-directory. But when trying to login via ssh, servers sends permission denied. What else must be done ? TIA ---Stephan

3 2

napster and ip masquerading
by alex medvedev 06 Dec '99

06 Dec '99

hi, internet ----- suse with masquerading ------- win98 laptop with napster People CAN download stuff from my win98 laptop... even when it is on a private subnet... what the hell? -alexm P.S. for info on napster: www.napster.com

2 1

Re: [suse-security] OpenSSH????????
by Chris Saia 04 Dec '99

04 Dec '99

Lenz Grimmer <grimmer(a)suse.de> writes: > This RPM is not made by SuSE. But we are also working on > it. However, it does not compile cleanly yet... Hm? Interestingly enough, I'm the one that provided Damien with the spec file which he uses to build the SRPM. (There's also a bug in that SRPM in that the symlinks aren't made on the first install -- patch to the spec file is being sent to openssh-unix-dev momentarily.) The actual RPM (well, SRPM) is made by Damien Miller, using my SuSE spec file, rcsshd file and fillin template for rc.config. He doesn't build RPM's for SuSE because his build/packaging system is RedHat, so he can only easily make a SuSE S(ource)RPM. No, this package is not blessed by SuSE, Inc., but I'd be flattered if they considered it. :) I'd love to build and feed Damien SuSE RPM's and SRPM's, except that there's the matter of US Export Laws (on strong encryption), and while I don't think I'd get caught, I'm going to just grumble for now. If you'd rather not grab his source RPM, simply download the whole tar file (openssh-1.2pre15.tar.gz). The SuSE-specific files I generated are sitting in [srcroot]/packages/suse/. Be sure to get the spec patch from the mailing list as the one in pre15 has a bug. -- =============================================================================== csaia(a)wtower.com, WTnet IRC Administrator - http://www.wtower.com/~csaia/ GNU Privacy Guard Public Key information is available at the above URL. ===============================================================================

1 0

[OFF-TOPIC] List dedicated to Netscape Enterprise Server
by Christian Pinheiro 04 Dec '99

04 Dec '99

In the course of configuring and using the Netscape Enterprise Server software, we have discovered that there is no single mailing list dedicated to this complex application, and that the traffic on the "netscape.server" newsgroup is too low to be useful. We would have benefited (and still would benefit) greatly from a list dedicated to the configuration and administration of the Netscape Enterprise Server software, and we believe that others using this software would find such a resource highly useful. Consequently, we have decided to host, on an experimental basis, a list dedicated to discussing problems related to the Netscape Enterprise Server software. We invite all interested in participating to subscribe. To subscribe, please send an e-mail (no subject needed) to: majordomo(a)lists.veritel.com.br with the following text in the first line of the body of the message: subscribe nes-managers-l [<your e-mail address>] Because this list is experimental, we are not, for the moment, hosting archives for the list. (Please note that, aside from being a user of software produced by Netscape, we have no association with Netscape, and this list has not been endorsed by nor has any connection with Netscape.) -- Christian M. C. Pinheiro System Administrator - VeritelNet <pinheiro(a)veritel.com.br>

1 0

OpenSSH????????
by Mr. M 04 Dec '99

04 Dec '99

OpenSSH is a recent project developed by the OpenBSD team - www.openbsd.org Their goal was to create a version of SSH that is not burdened by copyright laws. OpenSSH has been adopted for use by the FreeBSD team and also for Debian GNU/Linux. My question is directed to SuSE. Will this be ported for use with SuSE Linux? Mario For more info check out: www.openssh.org

7 8