February 2000 - openSUSE Security - openSUSE Mailing Lists

How to nuke PAM?
by Sebastian Willing 17 Feb '00

17 Feb '00

Hello! Because someone@suse decided to use PAM, I can't manage my system any longer. Entering a user in /etc/passwd and /etc/shadow or using useradd causes every normal program to find and authenticate the user. But some programs are infected with the PAM-virus and they don't find any of the users. It's no major problem, because noone needs tools like "passwd" or "proftpd". Is there any chance to nuke this virus out of the system without a complet reinstall? Yours, S.Willing

1 0

Cracklib with Suse 6.0
by Sascha Spiekermann 17 Feb '00

17 Feb '00

Greetings, I just want to ensure that the users of my small server (everyone is allowed to use telnet except of me as root) choose some kind of "secure" password. In the moment I try to force this by running john the ripper over the passwordfiles periodly. Most of the passwords can't be guessed in a few hours, and that's safe enough for the enviroment. But I'd like the passwd program to do the job. Is there any possibility to install a program with cracklib-support under Suse 6.0? Or something similar? -Sascha Spiekermann --- Cannot locate coffee... Operator halted! --- Callidus(a)bigfoot.com www.project-mindstorm.de ->Die Wissensdatenbank im WWW --- PGP 5.5.3i Fingerprint: B56B 8466 4E9C E758 4C8A 599C 3D87 747C Public Key request via: eMail / Keyserver

2 1

RE: [suse-security] firewals.rpm 1.4 and dynamic ip on ippp0
by Wood, Alan 16 Feb '00

16 Feb '00

I have placed everything mine does in ip-up.local, the thing that you have to remember is that ip-up.local has to be an executable file - if you cannot run it from a command line, then the system will not run it when you dial. Don't forget that it will be run as root probably.... Alan > ---------- > From: A Nourai[SMTP:nagash@ozemail.com.au] > Sent: 16 February 2000 15:54 > To: christoph.steigmeier(a)zurich.ch; suse-security(a)suse.com > Subject: Re: [suse-security] firewals.rpm 1.4 and dynamic ip on ippp0 > > make a file called ip-up.local in /etc/ppp/ and put > 'firewall restart 'in it without the ''. > From memory ip-up executes ip-up.local. > You can always check up on this and make sure that it actually does. > ----- Original Message ----- > From: <christoph.steigmeier(a)zurich.ch> > To: <suse-security(a)suse.com> > Sent: Thursday, February 17, 2000 2:36 AM > Subject: [suse-security] firewals.rpm 1.4 and dynamic ip on ippp0 > > > > > > > > Hello > > > > I work with SuSE Linux 6.3 and the SuSE-Firewall-Package firewals.rpm. I > did the > > upgrade to 1.4 :-) > > > > Because my providers works with dynamic ip-addresses when i dial in with > my isdn > > fritz card, i always have to restart manually the firewall with the > command > > > > /sbin/init.d/rc2.d/S99firewall_setup restart > > > > that it works with the new ip-adr. > > > > I tried to build this command in the /etc/ip-up script (right after > where > the > > old ipfwadm rules are commented out), but it does not work. > > > > I dont know what i am doing wrong. > > > > Thank you for help and greetings > > > > Christoph > > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

firewals.rpm 1.4 and dynamic ip on ippp0
by christoph.steigmeier＠zurich.ch 16 Feb '00

16 Feb '00

Hello I work with SuSE Linux 6.3 and the SuSE-Firewall-Package firewals.rpm. I did the upgrade to 1.4 :-) Because my providers works with dynamic ip-addresses when i dial in with my isdn fritz card, i always have to restart manually the firewall with the command /sbin/init.d/rc2.d/S99firewall_setup restart that it works with the new ip-adr. I tried to build this command in the /etc/ip-up script (right after where the old ipfwadm rules are commented out), but it does not work. I dont know what i am doing wrong. Thank you for help and greetings Christoph

2 1

Suse 6.3 masquerade
by JIM 16 Feb '00

16 Feb '00

Hi, I have just installed suse 6.3 (minimal installation) on a box which will be the firewall for my network. I want to do ip masquerading. I have read on July 1999 sysadmin magazine that suse has a scipt for masquarading located on /sbin/init.d. but i can't find susch a script. Which package have i do to install? Thanks

2 1

ntp and SuSEfirewall
by Jonathan 16 Feb '00

16 Feb '00

I am having trouble allowing ntp through the firewall, it keeps denying the packet. I am running ntpq from a client machine inside the firewall. In rc.firewall I have set #9 FW_SERVICES_EXTERNAL_UDP="ntp" FW_SERVICES_INTERNAL_UDP="ntp" and #10 FW_SERVICES_TRUSTED_UDP="ntp" what do I have set wrong???? TIA

1 0

Re: [suse-security] FTP = PortScan???
by Eilert Brinkmann 16 Feb '00

16 Feb '00

"Admin" <admin(a)eregion.de> wrote: > On 16 Feb 2000 10:26:19 +0100, Eilert Brinkmann wrote: > > >"Admin" <admin(a)eregion.de> wrote: > >> Feb 13 19:17:30 aragorn scanlogd: From 209.144.167.150:20 to 192.168.238.3 ports 3021, 3022, 3023, 3024, 3025, 3026, 3027, 3028, 3029,..., flags ??r??u, TOS 08, TTL 49, started at 19:17:15 > > > >In the situation you describe you can be sure this is *not* a > >portscan. Your FTP data connections trigger this warning. > > so why didn't I get portscan log eintries just now, I had the same > script which runs on sundays (when the log entries happen) run > manually just a few minutes ago, and guess what, no portscan entries > in the logfiles... scanlogd writes this messagages when it detects a large number of connections within a short time. Maybe this time you did fewer transfers or there was more time between connections. Just a guess... Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

2 1

Re: [suse-security] sshd (IdleTimeout)
by Guardian Angel 16 Feb '00

16 Feb '00

Hi, As I am a new person round here .. this may be irrelevant / wrong, but it is the way I would start looking at it ... >I know, this is useless: >If you connect through a firewall, this will be the reason >for these lost connections. I do have this problem myself. >Pushing a key every 10 minutes is not the best solution... >Does anyone know, how to reconfigure suse firewalls to do the >job? <from ipmasquerade how-to> # MASQ timeouts # # 2 hrs timeout for TCP session timeouts # 10 sec timeout for traffic after the TCP/IP "FIN" packet is received # 60 sec timeout for UDP traffic (MASQ'ed ICQ users must enable a 30sec firewall timeout in ICQ itself) # ipchains -M -S 7200 10 60 </from ipmasquerade how-to> I hope that is of use :-) Pat ______________________________________________ FREE Personalized Email at Mail.com Sign up at http://www.mail.com?sr=mc.mk.mcm.tag001

4 3

Re: [suse-security] FTP = PortScan???
by Admin 16 Feb '00

16 Feb '00

On 16 Feb 2000 10:26:19 +0100, Eilert Brinkmann wrote: >"Admin" <admin(a)eregion.de> wrote: >> me, too.... Got portscans every weekend, and guess from where? ftp.suse.com! >> exactly the same time I do some wget on ftp.suse.com, I get portscanned by their ftp server! >> here's the log: >> >> Feb 13 19:17:30 aragorn scanlogd: From 209.144.167.150:20 to 192.168.238.3 ports 3021, 3022, 3023, 3024, 3025, 3026, 3027, 3028, 3029,..., flags ??r??u, TOS 08, TTL 49, started at 19:17:15 > >In the situation you describe you can be sure this is *not* a >portscan. Your FTP data connections trigger this warning. > so why didn't I get portscan log eintries just now, I had the same script which runs on sundays (when the log entries happen) run manually just a few minutes ago, and guess what, no portscan entries in the logfiles... bye Mathias -- eregion.de -- administrative account

1 0

Re: [suse-security] FTP = PortScan???
by Eilert Brinkmann 16 Feb '00

16 Feb '00

"Admin" <admin(a)eregion.de> wrote: > me, too.... Got portscans every weekend, and guess from where? ftp.suse.com! > exactly the same time I do some wget on ftp.suse.com, I get portscanned by their ftp server! > here's the log: > > Feb 13 19:17:30 aragorn scanlogd: From 209.144.167.150:20 to 192.168.238.3 ports 3021, 3022, 3023, 3024, 3025, 3026, 3027, 3028, 3029,..., flags ??r??u, TOS 08, TTL 49, started at 19:17:15 In the situation you describe you can be sure this is *not* a portscan. Your FTP data connections trigger this warning. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0