July 2000 - openSUSE Security - openSUSE Mailing Lists

harden_suse & gdm
by Stephen nyc 26 Jul '00

26 Jul '00

Folks - I ran the harden suse scripts today and have run into a little problem with gdm. System is clean suse 6.4 install, clean helix-gnome 1.2 install. run level 3 booted to gdm login window. Before running the harden script (options y y y y n n y n y y - modified workstation) on startup I would get the gdm login window. I could switch back to console 1, and log in either way. Now I boot to the gdm login window - it accepts no keyboard inputs, making it impossible to login or change consoles. Interestingly enough, now that it is disabled, I can run gdm fine from a root login and behavior is as expected. This probably has something to do with some of the permission resets and that gdm can access the keyboard - can someone point me in the right direction for repairing this, or help me understand the benefit of this behavior. Thanks. - Steve __________________________________________________ Do You Yahoo!? Get Yahoo! Mail � Free email you can access from anywhere! http://mail.yahoo.com/

3 2

RE: [suse-security] Limiting Bandwidth Use by protocol
by Wood, Alan 25 Jul '00

25 Jul '00

How about a small stick to rap the knuckles of the users who are sending these large emails ;-) If you make it a large one, it may be useful for general physical security as well......... :-P All serious suggestions also welcome. Alan > ---------- > From: Steven Thompson[SMTP:steven@bidorbuy.co.za] > Sent: 25 July 2000 13:05 > To: SuSE security mailing list (E-mail) > Subject: [suse-security] Limiting Bandwidth Use by protocol > > Hi I have a problem where my outbound smtp traffic is to high. Can some > one > please recommend what is the best method of limiting the bandwidth > utilisation. (e.g. a traffic shaper). I'm currently running SuSE 6.4 > kernel > 2.2.16 > > Thanks in advance > > Steven Thompson > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

2 1

Network problem
by Battisti Markus 25 Jul '00

25 Jul '00

I have a linux box (suse 6.3)with 2 IP adreses eth0 eth0:1 and a default route to a eth0 reachable host now i have the problem with the default route i comes a tcp package from eth0:1 the answer send trough eth0 (e.g ping or nslookup,ssh) is it possible to set 2 "default gatways" one for eth0 and one for eth0:1 thank you for help ,,, /'^'\ ( o o ) oOOO--(_)--OOOo---------------------- Mit Freundlichen Grüssen/Best Regards Battisti Markus ICQ:42524700 mailto:markus.battisti@protask.at This message was sent using 100% recyclable electrons

2 1

Limiting Bandwidth Use by protocol
by Steven Thompson 25 Jul '00

25 Jul '00

Hi I have a problem where my outbound smtp traffic is to high. Can some one please recommend what is the best method of limiting the bandwidth utilisation. (e.g. a traffic shaper). I'm currently running SuSE 6.4 kernel 2.2.16 Thanks in advance Steven Thompson

2 1

dhcpd patch
by Kurt Seifried 25 Jul '00

25 Jul '00

This came up on linux audit list, I think it's rather useful, Thomas/Marc, would you guys have any comments on the following patch for dhcpd? http://users.phri.nyu.edu/~edelkind/custom/public/patches/dhcp-2.0+paranoia. patch It let's you specify user/group to run dhcpd as, and -t for chrooting it (just like BIND). I think it would be nice (hint =) if SuSE included this in their DHCPD package and maybe even defaulted to running dhcpd as a non root user (not hard to do, all it needs to write to is the leases file). Kurt Seifried SecurityPortal, your focal point for security on the net http://www.securityportal.com/

4 6

Antwort: [suse-security] ncsa_auth
by gerhard.possler＠westernacher.de 24 Jul '00

24 Jul '00

Hi all, gerhard.possler(a)westernacher.de am 21.07.2000 14:33:05 An: suse-security(a)suse.com Kopie: Thema: [suse-security] ncsa_auth Hi all, Where can I find ncsa_auth ??? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ;-) found it: in the SQUID source .... but it is not in the Suse-distribution.... why? ------------------------------------------------------------------------ Gerhard Possler "Wer neue Wege geht, braucht starke Partner." Westernacher AG Am Hubengut 3 76149 Karlsruhe, Germany phone: +49-721/9772-0 fax: +49-721/9772-188 http://www.westernacher.de ------------------------------------------------------------------------ Gerhard Possler "Wer neue Wege geht, braucht starke Partner." Westernacher AG Am Hubengut 3 76149 Karlsruhe, Germany phone: +49-721/9772-0 fax: +49-721/9772-188 http://www.westernacher.de

3 2

Re: [suse-security] sendmail (expn)
by ksemat＠wawa.eahd.or.ug 24 Jul '00

24 Jul '00

Thanks a lot. You just answered my next question about the goaway option. Meanwhile I would like to know about the buffer overflow bug in sendmail earlier than 8.9.3 I have a client who refuses to upgrade his sendmail. How does it work and is there a way for me to patch the sendmail without upgrading it? and where do I get the patch? On Sun, 23 Jul 2000, Ralf Folkerts wrote: > Date: Sun, 23 Jul 2000 15:46:40 +0200 > From: Ralf Folkerts <ralf(a)folkerts-net.de> > To: ksemat(a)wawa.eahd.or.ug > Cc: suse-security(a)suse.com > Subject: Re: [suse-security] sendmail (expn) > > ----- Original Message ----- > > I remember that somewhere in my fileysytem I set an option that turned > off > > the expn command in sendmail but I just don't remember where can > anyone > > remind me please where it is done? > > Hi Noah, > > you can disable this in the /etc/sendmail.cf File, using the Option > "PrivacyOptions"; I'll quote from the www.sendmail.org Site below... > > So it's e.g. putting an "O PrivacyOptions=noexpn" in the sendmail.cf > File -- or something more restrictive... > > ---<<<--- > PrivacyOptions=opt,opt,... > [p] Set the privacy options. ``Privacy'' is really a misnomer; many > of these are just a way of insisting on stricter adherence to the SMTP > protocol. > The options can be selected from: > > public Allow open access > needmailhelo Insist on HELO or EHLO command before MAIL > needexpnhelo Insist on HELO or EHLO command before EXPN > noexpn Disallow EXPN entirely > needvrfyhelo Insist on HELO or EHLO command before VRFY > novrfy Disallow VRFY entirely > restrictmailq Restrict mailq command > restrictqrun Restrict -q command line flag > noreceipts Don't return success DSNs > goaway Disallow essentially all SMTP status queries > authwarnings Put X-Authentication-Warning: headers in messages > The goaway pseudo-flag sets all flags except restrictmailq and > restrictqrun. If mailq is restricted, only people in the same group as > the > queue directory can print the queue. If queue runs are restricted, > only root and the owner of the queue directory can run the queue. > Authentication Warnings add warnings about various conditions that > may indicate attempts to spoof the mail system, such as using an > non-standard queue directory. > --->>>--- > > _ralf_ > > Noah ksemat(a)eahd.or.ug

1 0

sendmail (expn)
by ksemat＠wawa.eahd.or.ug 24 Jul '00

24 Jul '00

Hi all, I remember that somewhere in my fileysytem I set an option that turned off the expn command in sendmail but I just don't remember where can anyone remind me please where it is done? Noah ksemat(a)eahd.or.ug

2 2

Strange insmod warnings
by Stefan Suurmeijer 24 Jul '00

24 Jul '00

Hi all, I am getting some weird insmod warnings in /var/log/warn. --->SNIP Jul 23 20:29:10 mentat1 modprobe: modprobe: insmod ^P��` failed Jul 23 20:29:10 mentat1 modprobe: modprobe: insmod 0��` failed Jul 23 20:29:48 mentat1 modprobe: modprobe: insmod ^P��` failed Jul 23 20:29:48 mentat1 modprobe: modprobe: insmod 0��` failed Jul 23 20:31:43 mentat1 modprobe: modprobe: insmod ^P��` failed Jul 23 20:31:43 mentat1 modprobe: modprobe: insmod 0��` failed --->ENDSNIP Can anyone tell me where they come from, and more importantly, how to get rid of them? thanks, Stefan

2 3

SuSEfirewall & IP aliasing
by Peter ten Have 23 Jul '00

23 Jul '00

Anyone knows how to handle an "IP-aliased system" with SuSEfirewall? I've setup eth0:0....eth0:4 with Yast and configured Bind8. The system works well. Problem is that with SuSEfirewall routing/masquerading has to be set to "yes" and eth0:0....eth0:4 are treated as non-local (routing/masquerading "no" --> DENY). Filling FW_DEV_INT with "eth0 eth0:0 eth0:1..............." and making FW_DEV_INT_eth0:0....... FW_DEV_INT_eth0:4 leads to some ipchains error in which .168.10.1 cannot be found. How to handle ? thank you, peter

1 0