November 2001 - openSUSE Security - openSUSE Mailing Lists

Is this true?
by Praise 29 Nov '01

29 Nov '01

Hi List, I have my tmp directory on my / filesystem. Obviously executables are allowed for this filesystem. A friend of mine, though, claims that this can be a security problem because it helps attackers to run local exploits. From my point of view, it can do no more harm than an executable from an user's home directory. I am almost sure about that, but as I am not a guru I ask for further explanation. Is /tmp a danger if it can contains executables?? Note: I have to allow executables from users' home dir. Praise

5 4

Iptables and dpts:ipcserver:65535
by Michael Appeldorn 29 Nov '01

29 Nov '01

Hi list, just check the output of iptables -L -v on a new box and saw an entry Chain input_ext (1 references) 307 35343 ACCEPT tcp -- any any anywhere anywhere state ESTABLISHED tcp dpts:ipcserver:65535 flags:!SYN,RST,ACK/SYN with 35343 transferred bytes against an ipcserver at port $ffff. Is it what i think - an interprozess (interchain) communication of netfilter - or should i be worry about that. Yours Michael

1 0

IPTables
by BLeonhardt＠analytek.de 29 Nov '01

29 Nov '01

HI, I'm very new with Firewalling and have read some HOWTOs ... not the whole IPTABLES or NAT Howto ... haven't much time at the moment. My Question is quiet simple : How do I setup a rule, that specify that the localhost ( linux-box ) cannot be pinged from outside ??? And ... how can I log all connection tried from outside ??? I've setup a "simple" isdn-router and a quiet simple firewall ... nearly everything is allowed, yet ... but this will change in some days/weeks :-) Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ________________________________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40

8 9

proftpd disparaged
by John Andersen 29 Nov '01

29 Nov '01

Somewhere on this list in the last few days someone said proftpd was "a mess" but never said why, or wether this "mess" was security related. Could the poster elaborate please?? And VSFTPD?? Any opinions on that one? -- _________________________________ John Andersen / Juneau Alaska

2 1

Open Relay - qmail
by abaesche＠worklab.de 29 Nov '01

29 Nov '01

Hi all, I have a problem with our qmail-server. It´s a open relay. I have run some bugfixes but it doesn´t fix this. Have anybody a idear? thanks

4 3

RE: [suse-security] RE: user selection for ssh connections
by Reckhard, Tobias 29 Nov '01

29 Nov '01

> >Is it possible to exclude individual users from connecting via > >SSH? I'd like to have a list of users that are allowed to > >connect and a list of those that are not. Can it be done? If > >so, how? > > Of course. > > You may want to exclude/include users/services with > > /etc/hosts.deny /etc/hosts.allow Is there a way to do that without requiring the SSH client system to be running identd? I wouldn't place any trust into information generated by remote systems.. I believe you can configure the allowed users in sshd's configuration file itself, though. Check the keywords AllowGroups, AllowUsers, DenyGroups and DenyUsers. HTH Tobias

1 0

RE: [suse-security] Antwort: RE: [suse-security] Antwort: Re: [su se-security] IPTables ... Logging ( HOMEWORK )
by Reckhard, Tobias 29 Nov '01

29 Nov '01

Re Bruno >> Please do make an effort to do your homework and read up on >> the subject >> yourself. > > ... sorry ... !!!! .... I said some days before I'm quiet new with > firewalling, so I don't know what's just usual and what not ... > ... otherwise I'm not new with networking ... Oh, there's no problem with being a newbie at all, and you are a rather well-behaved one. ;-) > ... and I thought this Mailing-List is to help if somebody > has a problem > ... isn't it ? Sure. I believe that's what we're doing, wouldn't you agree? Still, I feel we must be allowed to (politely) urge people to RTM. > So, I've blocked everything with UDP going out except 53 ... > is that ok ? Well, there's no answer to that, really, not at the moment. We have no way of telling if that's OK for you, we don't know your requirements, your risks, etc. It's a typical constellation, if that's any help to you. However, I wouldn't enforce DNS security with a packet filter alone, I'd set up a caching proxy for that, preferrably dnscache from the djbdns suite, but coupled with a good packet filter, BIND shouldn't pose all too much of a threat either, if you can live with its deficiencies. Note: No discussion BIND vs. djbdns, please, this is my own, personal opinion. We've dealt with the topic before. Cheers, Tobias

1 0

New (Open)SSH exploit?!?
by Christoph Wegener 29 Nov '01

29 Nov '01

Hi, in freebsd-security this link was issued: http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=100696253318793&w=2 Now I wonder if this is really a new exploit or maybe the old problem with CRC32 . Any hints?!? Christoph -- .-. Ruhr-Universitaet Bochum /v\ L I N U X Lehrstuhl fuer Biophysik // \\ >Penguin Computing< c/o Christoph Wegener /( )\ Gebaeude ND 04/Nord ^^-^^ D-44780 Bochum, GERMANY Tel: +49 (234) 32-25754 Fax: +49 (234) 32-14626 mailto:cwe@bph.ruhr-uni-bochum.de http://www.bph.ruhr-uni-bochum.de

1 0

RE: user selection for ssh connections
by Michael Appeldorn 29 Nov '01

29 Nov '01

>Is it possible to exclude individual users from connecting via >SSH? I'd like to have a list of users that are allowed to >connect and a list of those that are not. Can it be done? If >so, how? Of course. You may want to exclude/include users/services with /etc/hosts.deny /etc/hosts.allow You should at 1st harden your system (close all) with harden_suse e.g and then you can open each service seperatly. Michael Appeldorn

1 0

Antwort: RE: [suse-security] Antwort: Re: [suse-security] IPTables ... Logging ( HOMEWORK )
by BLeonhardt＠analytek.de 29 Nov '01

29 Nov '01

Please do make an effort to do your homework and read up on the subject yourself. ... sorry ... !!!! .... I said some days before I'm quiet new with firewalling, so I don't know what's just usual and what not ... ... otherwise I'm not new with networking ... ... and I thought this Mailing-List is to help if somebody has a problem ... isn't it ? So, I've blocked everything with UDP going out except 53 ... is that ok ? Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ________________________________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40

1 0