January 2002 - openSUSE Security - openSUSE Mailing Lists

Tripwire setup confusion
by Togan Muftuoglu 28 Jan '02

28 Jan '02

Hi, I am in the process of using tripwire before I put the machine on the net. Iam following Marc's article on securing websserver which is at the SuSE website. However couple of things are not clear. This is on SuSE 7.3. So what is the actual thing rpm -q tripwire tripwire-1.2-357 According to rpm -qi Location of the binary is /var/adm/tripwire/bin/tripwire. Tripwire wants its configuration files /var/adm/tripwire/tw.config The database has to be saved at /var/adm/tripwire/db when I do rpm -ql tripwire ... /usr/sbin/tripwire ... /usr/share/lib/tripwire/db So do I create the /var/adm/tripwire directory and it's contents or ? -- Togan Muftuoglu

1 0

RE: [suse-security] mirkforce
by christian.burri＠synecta.ch 28 Jan '02

28 Jan '02

Mirkforce is **NOT** a virus, ie, it doesnt replicate itself, it does not "propagate". Rather than that, mirkforce is a "clone flooder" type IRC client that will load heaps of virtual interfaces on youre box and make clones join IRC thru them (it will typically try to load as much interfaces as possible in your local class C subnet.) I repeat: Mirkforce is NOT a virus Dont spread false and inaccurate info, please. Mirkforce may however be part of or contained in <insert your favorite rootkit name here> Cheers Chris .-. /v\ L I N U X // \\ >I know KungFu!!< /( )\ ^^-^^ Delia Wakelin <d.wakelin@un An: suse-security(a)suse.com n.ac.uk> Kopie: Thema: [suse-security] mirkforce 28.01.2002 09:18 recently received the message below. Is mirkforce a problem for suse ? --> We are currently dealing with an outbreak of hacked Linux boxes running "Mirkforce". Mirkforce is an IRC virus, which is spreading rapidly. We are unsure as to how it propagates, but essentially once a hacked linux box launches the software, it will fill all the ips not used of the network where the computer is located (the /24) by creating virtual aliases on the main interface. After it will just simulate x connections from each ip, and will target one or more irc servers and probably be used in some action against some users/channels. Computer examined were root kitted and some DDOS tools were installed and activated on it. **PLEASE** search the linux servers on your network, and if you have some machines logging arp changes or else, try to find the server which suddenly stole ips from others servers. This software is probably running only on Linux (all the versions found were for Linux). Search the linux running recently reported holed daemons (named, rpc, ftpd, etc..) and try to find suspicious accesses and to reinstall/remove useless daemons. Usually the server hacked will be one of the not listed ones, it seems that the mirkforce is not using the primary IP of the server hacked. Output from the help of the software ./mIRKfORCE -h mIRKfORCE 2.o [+0wnz] by ipLord, this copy is registred to haschmannen usage: mIRKfORCE [options] flag <arg> : explanation [default] -------------------------------------------- -i <interface> : Interface [eth0] -t <secs> : h0st check timeout [7] -h : This help (also try /help once inside) -r : Remove all IPaliases created by mIRKfORCE -v : Verbose mode, print common irceventz fer the klonez -d : Debug mode (lotsa raw ircprintouts) As always, these problems can be avoided by running properly patched and secured machines. Regards, -- Dr. Delia Wakelin Tel: 44 (0) 191 227 4958 Division of Psychology email mailto:d.wakelin@unn.ac.uk University of Northumbria www http://www.unn.ac.uk/~evdw3 Newcastle upon Tyne NE1 8ST -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

mirkforce
by Delia Wakelin 28 Jan '02

28 Jan '02

recently received the message below. Is mirkforce a problem for suse ? --> We are currently dealing with an outbreak of hacked Linux boxes running "Mirkforce". Mirkforce is an IRC virus, which is spreading rapidly. We are unsure as to how it propagates, but essentially once a hacked linux box launches the software, it will fill all the ips not used of the network where the computer is located (the /24) by creating virtual aliases on the main interface. After it will just simulate x connections from each ip, and will target one or more irc servers and probably be used in some action against some users/channels. Computer examined were root kitted and some DDOS tools were installed and activated on it. **PLEASE** search the linux servers on your network, and if you have some machines logging arp changes or else, try to find the server which suddenly stole ips from others servers. This software is probably running only on Linux (all the versions found were for Linux). Search the linux running recently reported holed daemons (named, rpc, ftpd, etc..) and try to find suspicious accesses and to reinstall/remove useless daemons. Usually the server hacked will be one of the not listed ones, it seems that the mirkforce is not using the primary IP of the server hacked. Output from the help of the software ./mIRKfORCE -h mIRKfORCE 2.o [+0wnz] by ipLord, this copy is registred to haschmannen usage: mIRKfORCE [options] flag <arg> : explanation [default] -------------------------------------------- -i <interface> : Interface [eth0] -t <secs> : h0st check timeout [7] -h : This help (also try /help once inside) -r : Remove all IPaliases created by mIRKfORCE -v : Verbose mode, print common irceventz fer the klonez -d : Debug mode (lotsa raw ircprintouts) As always, these problems can be avoided by running properly patched and secured machines. Regards, -- Dr. Delia Wakelin Tel: 44 (0) 191 227 4958 Division of Psychology email mailto:d.wakelin@unn.ac.uk University of Northumbria www http://www.unn.ac.uk/~evdw3 Newcastle upon Tyne NE1 8ST

1 0

Re: [suse-security] openssl directory in suse 7.3
by Negrisan Laurentiu 28 Jan '02

28 Jan '02

You have instaled openssl and openssl-devel ? +++ SuSE73:~ # rpm -qa |grep ssl openssl-0.9.6b-34 mod_ssl-2.8.4-29 openssl-devel-0.9.6b-34 +++ If you want to compile some with ssl suport try with prefix for ssl /usr On Mon, 28 Jan 2002, Philipp Snizek wrote: > Hi all > > Just a dumb question: > How can I found out where openssl is installed? > whereis command sais /usr/bin/openssl, but this is not sufficient for squid > 2.5 ssl support enabled. I'm looking for the headers and/or development > directory. > > thanx > Philipp > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > ++++++++++++++++++->>>>>NetRaptores.com<<<<<-++++++++++++++++++ Laurentiu Negrisan * Network System Engineer * Linux Registered User #191866 * CCNA +++++++++++++++-<<<<<Cellular:+40 90011477>>>>>-+++++++++++++++

1 0

RE: SuSEfirewall2 blocks all external network traffic to or from any computer on my network, including the firewall-machine itself
by Sebastian J. Bronner 28 Jan '02

28 Jan '02

For every connection attempt, there is a log entry like the following: Jan 27 20:57:47 brose kernel: SuSE-FW-ACCESS_DENIED_FOR_INTIN=eth0 OUT= MAC=00:20:78:10:a2:db:00:00:0c:8c:56:54:08:00 SRC=206.126.0.13 DST=206.126.5.12 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=56009 DF PROTO=TCP SPT=110 DPT=1026 WINDOW=17520 RES=0x00 ACK URGP=0 -- Sebastian J. Bronner waschtl(a)sbronner.com

1 0

harden_suse-3.5 and SuSE 7.3
by Togan Muftuoglu 28 Jan '02

28 Jan '02

Hi, harden_suse version 3.5 looks like max_version supported is 7.2. What are the problem possiblities when I run this with a 7.3 machine

1 0

ssh upgrade
by Webmaster 28 Jan '02

28 Jan '02

Hi List, It may sound silly, but reading so many ssh threads, I ask your advice (since being fairly busy I would like to save myself from hassle) on upgrading or not a running ssh-1.2.27-239 to SuSe openssh-2.9.9p.2-73.i386.rpm? Please, do not mock me, but if it would go smooth, I do it, but delay it if needs extra efforts. Antal ++++++++++++++++++ Kreorg Oktatóközpont http://www.kreorg.hu kreorg(a)kreorg.hu Tel:+36-1-321-00-31 Fax:+36-1-397-27-80 GRID Erő a változáshoz.

1 0

Re: [hangout] OPENSSH trouble
by Ruben Safir 28 Jan '02

28 Jan '02

OK Problem fixed. It's 2.9 going to 2.3 I needed to create the proper authorized_keys2 with proper permissions on the server AND I needed to recreate proper ./id_dsa.pub and ./id_rsa.pub files on the the client and include them, especially the DSA, into the server authorized_keys2. Of course, all fo this is well documented. I needed to walk through Dejanews to put all the peices together. That's why sysadmins get the big bucks... Now the problem is that SUSe doesn't have a openssh 3.0 RPM The source RPM on openssh.org's sites seems, to my eyes, to be asking for Redhat specific RPM dependencies. Should I just roll my own with openssl and openssh? Ruben On 2002.01.25 17:33:49 -0500 Michael Osten wrote: >>Are you using 2.9x on one machine and 3.0.x on the other? >> >> >> >>--------- >>------------- >>Michael Osten >>Reefedge Inc. >> >> >> >> >> >> -- __________________________ Brooklyn Linux Solutions __________________________ http://www.mrbrklyn.com - Consulting http://www.brooklynonline.com - For the love of Brooklyn http://www.nylxs.com - Leadership Development in Free Software http://www.nyfairuse.org - The foundation of Democracy http://www2.mrbrklyn.com/resources - Unpublished Archive or stories and articles from around the net http://www2.mrbrklyn.com/mp3/hooked.mp3 - Spring is coming.... http://www2.mrbrklyn.com/downtown.html - See the New Downtown Brooklyn.... 1-718-382-5752

2 1

Logs on /var/log/messages
by Leonel Rivas 28 Jan '02

28 Jan '02

Hello all I appreciate very much the answers to my question about launching-stopping services on demand, i was asking because of logs like this: sshd[5052]: Did not recieve identification string from ::ffff:66.92.175.131 or sshd[5054]: scanned from ::ffff:130.149.50.221 with ssh-1.0-SSH_Version_Mapper. Don't panic. (Both ip's are unknown to me) What should i do? What is the best way to secure (or trust in) SSH? Im using a Suse7.2 box (installed some days ago, so almost everithing is on defaults yet) Thanks __________________________________________________ Do You Yahoo!? Great stuff seeking new owners in Yahoo! Auctions! http://auctions.yahoo.com

2 1

Syslog and Chrooted application's logs
by Togan Muftuoglu 27 Jan '02

27 Jan '02

Hi, I have to chrooted services bind8 and apache. They are chrooted via compartment and I have a parameter which is identical in both of the init files init_bind8 (from the README of compartment) and init_apache DEV_LOG="/jail/dev/log" and in the /etc/rc.config file in SYSLOGD_PARAMS="-a /jail/dev/log" I have Chrooted bind loging properly to the main system log while chrooted apache persists to log "/jail/apache/var/log/httpd" What is the silly mistake I am doing here ? -- Togan Muftuoglu

4 3

2nd loopback interface for security testing on isolated systems?
by Paul Elliott 27 Jan '02

27 Jan '02

I have a single computer which I connect to the internet via dialup. I use SuSEfirewall2. I would like to test my security with nmap, satan, cops ect. The problem is it is not realistic to do the test using the loopback interface because I have decided the localhost is safe. There are a number of programs that I have told to bind there open ports to the loopback interface. This means the program allow connections from the localhost but not from the outside world. Sendmail for one: If you turn sendmail entirely off then fetchmail does not work because it delivers mail by dumping it into port 25. But I do not need sendmail to listen to the outside world because I recieve mail via fetchmail, and I do not want to worry about sendmail exploits. Same with appache SuSE's info servers work by running appache. I want to review documention but see not reason to serve the outside world or worry about new appache exploits. So I have told appache to listen by binding to the loopback interface. Also I have told SuSE firewall not to protect from the internal network, and made the loopback interface my connection to the internal network. (I told it to trust itself.) Because of all this the results of an attack thru the loopback interface would not be realistic. I have an idea! Create a 2nd loopback interface, and treat it as an untrusted interface similarly to ppp0! Then I could tell nmap, satan, ect to run its simulated attack thru this new interface! Questions: Is this a good idea? (I only have 1 computer, and cannot run a test from the outside.) How would I implement it? What would be the proper ifconfig, route commands to setup such a test interface? Would there be a large penalty for setting up such an interface and letting it run all the time, so I could do testing any time after installing any new software perhaps? -- Paul Elliott 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

3 2

MD5 passwords again
by Boris Kimel 27 Jan '02

27 Jan '02

Hello All, Sorry to annoy you, but POP3 doesn't recognize MD5 passwords. All other services are ok. POP3 works perfect for the users whose passwords were not changed yet (i.e. were not converted to MD5). Why should I want MD5 passwords? That's simple: we had a RedHat system using MD5 passwords and (i) we'd like to transfer all the users with their passwords to SuSE; (ii) the existing passwords are longer than 8 characters. Looks like I need further reading on the PAM, but maybe there's a proven approach? Thanks, -- Boris Kimel Webmaster and Network Administrator The Moscow Chemical Lyceum 4 Tamozhennyi Proezd Moscow, Russia. Phone: +7 095 1358941 Fax: +7 095 1355328 Email: kimel(a)1303.ru

6 8

Re: [suse-security] apache under inetd/tcpd: it's dead, isn't it?
by JW 27 Jan '02

27 Jan '02

At 08:39 PM 1/26/2002 -0600, you wrote: >Good point, but actually he needs to hange "htppd" to "http" for standard /etc/services. That might be why his way isn't working. err, s/hange "htppd"/change "httpd"/g Sorry ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

1 0

bug in SuSE Security Announcement: rsync (SuSE-SA:2002:004)???
by Carsten Mueller 27 Jan '02

27 Jan '02

hello! i´ve just installed the rsync update on a i386 suse 7.0 box. now i get the following error while using rsync: rsync -az -e ssh data.cdb 10.0.0.5:/service/tinydns/root/data.cdb Segmentation fault server-6:/service/tinydns/root # unexpected EOF in read_timeout unexpected EOF in read_timeout when i use rsync without the z flag i get the following error: rsync -a -e ssh data.cdb 10.0.0.5:/service/tinydns/root/data.cdb Warning: unexpected read size of 0 in map_ptr Warning: unexpected read size of 0 in map_ptr i think it is not an ssh-error, cause normal ssh connection to the remote box works fine: ssh 10.0.0.5 Last login: Tue Jan 8 21:14:16 2002 from xxxxxxxxxxxxxx Have a lot of fun... ssh-version local: OpenSSH_3.0.2p1, SSH protocols 1.5/2.0, OpenSSL 0x0090581f rsync-version local: rsync version 2.3.2 protocol version 21 rsync-version remote: rsync version 2.4.6 protocol version 24 what´s the problem? regards Carsten Mueller At 17:04 25.01.2002, Sebastian Krahmer wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >______________________________________________________________________________ > > SuSE Security Announcement > > Package: rsync > Announcement-ID: SuSE-SA:2002:004 > Date: Fri Jan 25 17:00:00 CET 2002 > Affected SuSE versions: 6.4, 7.0, 7.1, 7.2, 7.3 > Vulnerability Type: remote command executionn > Severity (1-10): 7 > SuSE default package: no > Other affected systems: All systems with vulnerable rsync. > > Content of this advisory: > 1) security vulnerability resolved: rsync negative array indexing > problem description, discussion, solution and upgrade information > 2) pending vulnerabilities, solutions, workarounds > 3) standard appendix (further information) > >______________________________________________________________________________ > >1) problem description, brief discussion, solution, upgrade information > > The rsync program allows users and administrators to synchronize > files and > whole directory structures on different machines. It is common practise > to allow remote users to mirror ftp servers via anonymous rsync access. > There exist several signedness bugs within the rsync program which allow > remote attackers to write 0-bytes to almost arbitrary stack-locations, > therefore being able to control the programflow and obtaining a shell > remotely. These bugs have been fixed. > > It is recommended (also stated in the rsync documentation) to use the > "use chroot" option in rsyncd's configuration file (/etc/rsyncd.conf) > to limit the impact of a possible attack. Since this workaround does > not completely solve the security problem, we recommend to update the > package as described below. > > We want to express our gratitude to Andrew Tridgell and Martin Pool, > the rsync authors and maintainers, for their excellent cooperation in > this matter. > > Please download the update package for your distribution and verify its > integrity by the methods listed in section 3) of this announcement. > Then, install the package using the command "rpm -Fhv file.rpm" to apply > the update. > > To be sure that the update takes effect, kill any existing instances of > the rsync-program. > In case you run rsync via the inetd superserver, you do not need to > restart any of your services. Inetd will automatically use the new > binary. > If you used run your rsync-service with the "rsync --daemon" command, > restart your rsync with "rync --daemon" again, this time using the new > binary. > > > i386 Intel Platform: > > SuSE-7.3 > ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/rsync-2.4.6-288.i386.rpm > ce6d9226a8a9a5644ece29926c1f51d7 > source rpm: > ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/rsync-2.4.6-288.src.rpm > 0e354408f232b25fe0089b97073009a3 > > SuSE-7.2 > ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/rsync-2.4.6-289.i386.rpm > 1ff42b8149e21644d23fe71c40a3ec5a > source rpm: > ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/rsync-2.4.6-289.src.rpm > 83407b4dfad94d21af60ba3e8025e6cd > > SuSE-7.1 > ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/rsync-2.4.6-288.i386.rpm > 26533f97af4474b450ad43a171c5571f > source rpm: > ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/rsync-2.4.6-288.src.rpm > dcd1345446871320962e91d979ddb25b > > SuSE-7.0 > ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/rsync-2.3.2-124.i386.rpm > f16f81e5a0a11ba951b6f923cbae2abd > source rpm: > ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/rsync-2.3.2-124.src.rpm > cd36ce735b4ca91f92fc2f3c7603037f > > SuSE-6.4 > ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/rsync-2.3.2-123.i386.rpm > c9330c9123757f89ed94382874122c82 > source rpm: > ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/rsync-2.3.2-123.src.rpm > d97478d6fe9f2419b8700c52be4d888a > > > Sparc Platform: > > SuSE-7.3 > ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n2/rsync-2.4.6-135.sparc.rpm > 669f52233aed0766dd72788741691558 > source rpm: > ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/rsync-2.4.6-135.src.rpm > 85ddaa9518d19f6341a68ce254668f0b > > SuSE-7.1 > ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/rsync-2.4.6-135.sparc.rpm > d68ebcdba8caa16360e225fc9d28dc54 > source rpm: > ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/rsync-2.4.6-135.src.rpm > b9f1f43d0248b763aef46bd610233285 > > SuSE-7.0 > ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/rsync-2.3.2-5.sparc.rpm > 50b9cefa5f4bf86fc1e20184c15fb542 > source rpm: > ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/rsync-2.3.2-5.src.rpm > ffbc3ff43c339cbbe12317bb98587df3 > > > AXP Alpha Platform: > > SuSE-7.1 > ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/rsync-2.4.6-123.alpha.rpm > 3b602bd23179a7b6ce162d2d377394af > source rpm: > ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/rsync-2.4.6-123.src.rpm > 65f9d53cb48b8456466a27d9cde04339 > > SuSE-7.0 > ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/rsync-2.3.2-30.alpha.rpm > 2056422feb3b2b53285413ca746f2f4e > source rpm: > ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/rsync-2.3.2-30.src.rpm > 88c3a630df0e3073a8be55b0008371a0 > > SuSE-6.4 > ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/rsync-2.3.2-31.alpha.rpm > 18ea59b5c4d4641b62cef9c11f535ae8 > source rpm: > ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/rsync-2.3.2-31.src.rpm > 091659d90d3e079c0f8d4518c2c42f9f > > Power PC Platform: > > SuSE-7.3 > ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/rsync-2.4.6-150.ppc.rpm > f5576fca06f5d22b1410aaba399e0791 > source rpm: > ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/rsync-2.4.6-150.src.rpm > 1baeeffafe1c7dd75189cbfe704bddf0 > > SuSE-7.1 > ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/rsync-2.4.6-151.ppc.rpm > 04102efb5a83b5190fe6b02146ec522b > source rpm: > ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/rsync-2.4.6-151.src.rpm > 4a21e9f5b36f6767436c6ea92f5d17e7 > > SuSE-7.0 > ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/rsync-2.3.2-133.ppc.rpm > 897e0010ccf09c85a8c8797dc77394e1 > source rpm: > ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/rsync-2.3.2-133.src.rpm > 7ff150ba5f39ab527aa67308154273e2 > > SuSE-6.4 > ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/rsync-2.3.2-133.ppc.rpm > 65ac31f12bacb9284fd2286aec7beab0 > source rpm: > ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/rsync-2.3.2-133.src.rpm > 4b43552a939f080a3e93fe65a88bd139 > > > >______________________________________________________________________________ > >2) Pending vulnerabilities in SuSE Distributions and Workarounds: > > - pine > The popular mail client "pine" was found vulnerable to an attack where > shell metacharacters inside an URL could be used to execute arbitrary > commands if pine passes the URL to an external viewer on the > commandline. The pine packages on SuSE products are not vulnerable to > this weakness because they contain a patch that works around this > problem since it is not new. > > > - xchat > We are working on updates for the xchat packages in the SuSE Linux > 7.0 and 7.1 distributions that are vulnerable to an encoding bug > while receiving and decoding ctcp datagrams. This bug can lead > an xchat IRC client to execute IRC protocol specific commands to an > IRC server such as channel mode changes. > >______________________________________________________________________________ > >3) standard appendix: authenticity verification, additional information > > - Package authenticity verification: > > SuSE update packages are available on many mirror ftp servers all over > the world. While this service is being considered valuable and important > to the free and open source software community, many users wish to be > sure about the origin of the package and its content before installing > the package. There are two verification methods that can be used > independently from each other to prove the authenticity of a downloaded > file or rpm package: > 1) md5sums as provided in the (cryptographically signed) announcement. > 2) using the internal gpg signatures of the rpm package. > > 1) execute the command > md5sum <name-of-the-file.rpm> > after you downloaded the file from a SuSE ftp server or its mirrors. > Then, compare the resulting md5sum with the one that is listed in the > announcement. Since the announcement containing the checksums is > cryptographically signed (usually using the key security(a)suse.de), > the checksums show proof of the authenticity of the package. > We disrecommend to subscribe to security lists which cause the > email message containing the announcement to be modified so that > the signature does not match after transport through the mailing > list software. > Downsides: You must be able to verify the authenticity of the > announcement in the first place. If RPM packages are being rebuilt > and a new version of a package is published on the ftp server, all > md5 sums for the files are useless. > > 2) rpm package signatures provide an easy way to verify the authenticity > of an rpm package. Use the command > rpm -v --checksig <file.rpm> > to verify the signature of the package, where <file.rpm> is the > filename of the rpm package that you have downloaded. Of course, > package authenticity verification can only target an uninstalled rpm > package file. > Prerequisites: > a) gpg is installed > b) The package is signed using a certain key. The public part of this > key must be installed by the gpg program in the directory > ~/.gnupg/ under the user's home directory who performs the > signature verification (usually root). You can import the key > that is used by SuSE in rpm packages for SuSE Linux by saving > this announcement to a file ("announcement.txt") and > running the command (do "su -" to be root): > gpg --batch; gpg < announcement.txt | gpg --import > SuSE Linux distributions version 7.1 and thereafter install the > key "build(a)suse.de" upon installation or upgrade, provided that > the package gpg is installed. The file containing the public key > is placed at the toplevel directory of the first CD (pubring.gpg) > and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . > > > - SuSE runs two security mailing lists to which any interested party may > subscribe: > > suse-security(a)suse.com > - general/linux/SuSE security discussion. > All SuSE security announcements are sent to this list. > To subscribe, send an email to > <suse-security-subscribe(a)suse.com>. > > suse-security-announce(a)suse.com > - SuSE's announce-only mailing list. > Only SuSE's security annoucements are sent to this list. > To subscribe, send an email to > <suse-security-announce-subscribe(a)suse.com>. > > For general information or the frequently asked questions (faq) > send mail to: > <suse-security-info(a)suse.com> or > <suse-security-faq(a)suse.com> respectively. > > ===================================================================== > SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. > The <security(a)suse.de> public key is listed below. > ===================================================================== >______________________________________________________________________________ > > The information in this advisory may be distributed or reproduced, > provided that the advisory is not modified in any way. In particular, > it is desired that the cleartext signature shows proof of the > authenticity of the text. > SuSE GmbH makes no warranties of any kind whatsoever with respect > to the information contained in this security advisory. > >Type Bits/KeyID Date User ID >pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> >pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> > >- -----BEGIN PGP PUBLIC KEY BLOCK----- >Version: GnuPG v1.0.6 (GNU/Linux) >Comment: For info see http://www.gnupg.org > >mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA >BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz >JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh >1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U >P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ >cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg >VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b >yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 >tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ >xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 >Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo >choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI >BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u >v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ >x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 >Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq >MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 >saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o >L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU >F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS >FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW >tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It >Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF >AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ >3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk >YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP >+Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR >8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U >8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S >cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh >ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB >UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo >AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n >KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohc >BBMRAgAcBQI57vSBBQkDwmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8s >AJ98BgD40zw0GHJHIf6dNfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQ >EQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACe >OO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vf >iUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEI >SZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9g >TPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23p >QUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1y >PqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IX >SzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd9DYJ8UUT >mIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Via5/gO7fJ >EpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13CNZZNZfD >qnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp271hhQBe >RmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlEt5ucTXst >Zy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMGB/9g+9V3 >ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZwrbSTM5Lp >C/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6TtIJlGG6pq >UN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFLrWn7mfoG >x6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5HRKMWpO+M >9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMag8zFbpeq >PQUsDv9V7CAJ1dbriEwEGBECAAwFAjnu9JIFCQPCZwAACgkQqE7a6JyACspLIgCb >BQd/++0pB9yZWDhqxHtTpdCXRsAAnik7bYHlTxQfohiXYsEJcWrDn7l8 >=ojbD >- -----END PGP PUBLIC KEY BLOCK----- > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.3i >Charset: noconv > >iQEVAwUBPFF+6ney5gA9JdPZAQEjBwf7B2B8w1lFpiL8bgy3ttUzNRTFIRnre7yq >QLcn8XdhF1iSvtDpgiajVsutYrRbEeVImcAWmXeLOIZMY/qwc4uLBwxrF2ng0Uph >QhAebyewpFtMmIQrb/7AAOcudpgbHWsSRJYacbqYutQvJJ73vuFh+HOjErFoFx8p >ZqtVC5IvOuE+HomaS/WBPjBdvIDrHSUaJq+fFFTYKozAEg/PpM++vePI5xauaEoP >t6Wvazswwe1Qlx2rV2NvE/4TLFyxL2fHEQTtEIdSsa6za7WXmC2QqIhv4Y5zdckA >8CpPFJ0M/nTzmEf40i67myIGtOVgjb5MWaOv2ybya9ORPIHScdZxSQ== >=8z44 >-----END PGP SIGNATURE----- > >-- >~ >~ perl self.pl >~ $_='print"\$_=\47$_\47;eval"';eval >~ krahmer(a)suse.de - SuSE Security Team >~ > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com

3 6

apache under inetd/tcpd: it's dead, isn't it?
by m3047＠inwa.net 27 Jan '02

27 Jan '02

Not looking for a list of reasons why this isn't a good idea, just simply: is anybody out there successfully running apache httpd 1.3.12 or later under SuSE linux 6.4 or later inetd/tcdp? Being a troglodyte, I had to try it; I couldn't get it to work (nobody home on port 80), and didn't spot anything in various logs. The things I set were: /etc/rc.config: START_HTTPD=no httpd.config: ServerType inetd /etc/inetd.conf: httpd stream tcp nowait root <path to tcpd> (continued line) <path to apache> -f <path to httpd.conf> (continued line) <standard modules> (I also tried wwwrun instead of user root, and without tcpd.) Oh well, on to more productive things. -- Fred Morris m3047(a)inwa.net

3 3

Re: [suse-security] PHP-Majordomo to execute commands on demand?
by Leonel Rivas 27 Jan '02

27 Jan '02

Whoa Greg, that sounds very interesting, can you give ,me some more details? Thanks Leo --- Gregor Bruhin <gregor.bruhin(a)bluewin.ch> wrote: > Hi, > > Know I know a bit more, I can give you other ideas > perhaps :-) > > 1) > > I did the following thing @home for my "intranet" & > linux-internet-gateway > > I setup a tiny webserver which runs as root :-( ( I > know very bad idea but > there is no other solution i think ! ) > With a few scripts it will do all I want (lanch > internet connection, map > drives, launch services, etc.) > > -> know you can secure this > add a script to you main server which will put a > "1" in a file somewhere > when it is launched and replace the 1 with a 0 after > 5 sec > in the tiny webserver you just add acheck, check > if the 1 is present in > the file otherwise you don't reply > the tiny server must be run on a strange port > and REALY do nothing if > there is not a 1 in the file > (result, many conditions must be met, difficult > for a hacker, but also > for you because you have many chances to make > mistakes. Summary: you have to > access first you normal webserver and execute your > special script, then you > have 5 secs to connect to your tiny root webserver > and autentificate) > > > > 2) > > - setup a new special user with complicated name & > password > - setup a chrooted env. for this user > - setup ssh access on a very special port (high > port, unused by trojans, and > not scanned by default by nmap etc.) limit login to > the created user (be > sure to check all sshd security options) > - do not use a normal shell for this user but rather > a home-made interpreter > which will only write a few things in a text file in > a chrooted jail > - write a script which will get data from this text > file and do some actions > (this script will be executed every 5 min. by cron > for ex.) > > it's just an idea like an other ... > > > OTHERS) > > This won't sove all your problems but can help. > > I don'tknow which services you plan to use but try > to limit allowed IP's, > limit allowed users, use unusual ports. > Disable icmp replys, configure a local firewall to > slow down scanners. > Hide or fake the banners of the daemons if possible. > Update your system as often as possible. > Install tripwire, scanlogd, chkrootkit etc. > Make Ba ba backups :-) ... > > have fun :-) > > Greg > > > ----- Original Message ----- > From: "Leonel Rivas" <leorivas(a)yahoo.com> > To: <suse-security(a)suse.com> > Sent: Saturday, January 26, 2002 7:24 PM > Subject: Re: [suse-security] PHP-Majordomo to > execute commands on demand? > > > > I've done so: leave ssh running , and after > logging, > > run the inetd to have other services, then, i stop > it > > before leaving. BUT, checking the messages file, a > > have already found some ssh scans (it tells DONT > > PANIC, and dunno what it means), so i decided to > close > > the most srevices and run them as needed... is ssh > (on > > suse 7.2) safe enough? > > Thanks for the help, im not so new on linux, but > new > > on security issues. > > Leo > > > > > > --- Andrea Naggi <mailing-lists(a)naggi.it> wrote: > > > You could actually leave SSH running all the > > time > > > and from there you can > > > start or stop services as needed... SSH should > > be > > > safe enough... > > > Anyway the idea is good and should be possible > > to > > > realize it with ssl and an > > > apposite php/perl page on your webserver. > > ENGARDE > > > linux uses a page like > > > that written in perl and running under ssl > > > encryption to control all the > > > system services and even the shutdown or rebbot > > of > > > the server. > > > Regards > > > Andrea Naggi > > > > > > ----- Original Message ----- > > > From: "Leonel Rivas" <leorivas(a)yahoo.com> > > > To: <suse-security(a)suse.com> > > > Sent: Saturday, January 26, 2002 4:19 PM > > > Subject: [suse-security] PHP-Majordomo to > > execute > > > commands on demand? > > > > > > > > > > Hi everybody > > > > > > > > Im trying to improve security by making the > > > minimal > > > > services to run on a 7.2 server, now, my > > question > > > is > > > > how to make services run and stop on demand, > > like > > > ssh > > > > or inetd. Is possible to make.. say a web page > > > under > > > > ssl to launch and stop such services? or maybe > > a > > > > majordomo mail with the apropriate password? > > the > > > idea > > > > is to have ONLY apache and sendmail running > > all > > > the > > > > time, nothing more, then, run ftpd or ssh as > > > needed, > > > > then stop it. > > > > Thanks > > > > > > > > > > __________________________________________________ > > > > Do You Yahoo!? > > > > Great stuff seeking new owners in Yahoo! > > Auctions! > > > > http://auctions.yahoo.com > > > > > > > > -- > > > > To unsubscribe, e-mail: > > > suse-security-unsubscribe(a)suse.com > > > > For additional commands, e-mail: > > > suse-security-help(a)suse.com > > > > > > > > > > > > > > > > > > > > > > > > __________________________________________________ > > Do You Yahoo!? > > Great stuff seeking new owners in Yahoo! Auctions! > > http://auctions.yahoo.com > > > > -- > > To unsubscribe, e-mail: > suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: > suse-security-help(a)suse.com > > > > > __________________________________________________ Do You Yahoo!? Great stuff seeking new owners in Yahoo! Auctions! http://auctions.yahoo.com

1 0

Re: Fwd: Can I create/activate a 2nd loopback device?
by Paul Elliott 26 Jan '02

26 Jan '02

> > How do I -- is it possible to create or activate a second loop device? > > What would be the commands do do this? > I have done some research, and I believe I have the answer to my own question. First I do not want to use IP aliasesing. That means more than one IP number for the same loop back 'device'. I believe data going into one alias would be available to be read at both on the other 'end'. Programs bound to one alias would recieve connections from both. Clearly that is not what I want. However I believe it is possible to patch the kernel to create more that one actual loopback 'device'. I believe a patch has already been published to do this: http://www.uwsg.iu.edu/hypermail/linux/kernel/9509/0204.html I believe that if I install this patch I will get 2 seperate loopback 'devices' one of which can be used for security testing. Please tell me if I have gotten all this correctly? Thank You. -- Paul Elliott 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

1 0

Re: [suse-security] PHP-Majordomo to execute commands on demand?
by Leonel Rivas 26 Jan '02

26 Jan '02

I've done so: leave ssh running , and after logging, run the inetd to have other services, then, i stop it before leaving. BUT, checking the messages file, a have already found some ssh scans (it tells DONT PANIC, and dunno what it means), so i decided to close the most srevices and run them as needed... is ssh (on suse 7.2) safe enough? Thanks for the help, im not so new on linux, but new on security issues. Leo --- Andrea Naggi <mailing-lists(a)naggi.it> wrote: > You could actually leave SSH running all the time > and from there you can > start or stop services as needed... SSH should be > safe enough... > Anyway the idea is good and should be possible to > realize it with ssl and an > apposite php/perl page on your webserver. ENGARDE > linux uses a page like > that written in perl and running under ssl > encryption to control all the > system services and even the shutdown or rebbot of > the server. > Regards > Andrea Naggi > > ----- Original Message ----- > From: "Leonel Rivas" <leorivas(a)yahoo.com> > To: <suse-security(a)suse.com> > Sent: Saturday, January 26, 2002 4:19 PM > Subject: [suse-security] PHP-Majordomo to execute > commands on demand? > > > > Hi everybody > > > > Im trying to improve security by making the > minimal > > services to run on a 7.2 server, now, my question > is > > how to make services run and stop on demand, like > ssh > > or inetd. Is possible to make.. say a web page > under > > ssl to launch and stop such services? or maybe a > > majordomo mail with the apropriate password? the > idea > > is to have ONLY apache and sendmail running all > the > > time, nothing more, then, run ftpd or ssh as > needed, > > then stop it. > > Thanks > > > > __________________________________________________ > > Do You Yahoo!? > > Great stuff seeking new owners in Yahoo! Auctions! > > http://auctions.yahoo.com > > > > -- > > To unsubscribe, e-mail: > suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: > suse-security-help(a)suse.com > > > > > > > > __________________________________________________ Do You Yahoo!? Great stuff seeking new owners in Yahoo! Auctions! http://auctions.yahoo.com

1 0

shaping problem
by Jochen Vogel 26 Jan '02

26 Jan '02

hi, i would try to limit my upload queue and get the following error: tc qdisc add dev ppp0 root tbf rate 100kbit latency 50ms burst 1500 RTNETLINK answers: Invalid argument what´s wrong?? thanx for help

1 0

Re: [suse-security] Which ISP owns some IP?
by Shirley Louise Coffie 26 Jan '02

26 Jan '02

SamSpade is good, but I'd go straight to http://www.arin.net/ myself. ShirZ >From: John Andersen <jsa(a)pen.homeip.net> >Reply-To: jsa(a)pen.homeip.net >To: "Juan Carlos S.C" <juancarlos.silla(a)dyr.es>, lista seguridad suse ><suse-security(a)suse.com> >Subject: Re: [suse-security] Which ISP owns some IP? >Date: Fri, 25 Jan 2002 01:18:04 -0900 > >On Friday 25 January 2002 02:04 am, Juan Carlos S.C wrote: > > Hello * : > > > > How can i know the owner of an IP address. There is no reverse mapping > > for dial-up address but each ISP has his own range of IP's. > > > > Could I know from where connecctions come, far away from traceroute? > > Yes, it could be IP spoofing but ... > >Quick and easy: http://www.samspade.org/ > >I'm sure there are more high-tec ways but it works and does a lot >with one click. >-- >_________________________________ >John Andersen / Juneau Alaska > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > "And the day came when the risk to remain in the bud was more painful than the risk it took to bloom." - Anaïs Nin _________________________________________________________________ Send and receive Hotmail on your mobile device: http://mobile.msn.com

2 1

SuSE Security Announcement: rsync (SuSE-SA:2002:004)
by Sebastian Krahmer 25 Jan '02

25 Jan '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: rsync Announcement-ID: SuSE-SA:2002:004 Date: Fri Jan 25 17:00:00 CET 2002 Affected SuSE versions: 6.4, 7.0, 7.1, 7.2, 7.3 Vulnerability Type: remote command executionn Severity (1-10): 7 SuSE default package: no Other affected systems: All systems with vulnerable rsync. Content of this advisory: 1) security vulnerability resolved: rsync negative array indexing problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The rsync program allows users and administrators to synchronize files and whole directory structures on different machines. It is common practise to allow remote users to mirror ftp servers via anonymous rsync access. There exist several signedness bugs within the rsync program which allow remote attackers to write 0-bytes to almost arbitrary stack-locations, therefore being able to control the programflow and obtaining a shell remotely. These bugs have been fixed. It is recommended (also stated in the rsync documentation) to use the "use chroot" option in rsyncd's configuration file (/etc/rsyncd.conf) to limit the impact of a possible attack. Since this workaround does not completely solve the security problem, we recommend to update the package as described below. We want to express our gratitude to Andrew Tridgell and Martin Pool, the rsync authors and maintainers, for their excellent cooperation in this matter. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. To be sure that the update takes effect, kill any existing instances of the rsync-program. In case you run rsync via the inetd superserver, you do not need to restart any of your services. Inetd will automatically use the new binary. If you used run your rsync-service with the "rsync --daemon" command, restart your rsync with "rync --daemon" again, this time using the new binary. i386 Intel Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/rsync-2.4.6-288.i386.rpm ce6d9226a8a9a5644ece29926c1f51d7 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/rsync-2.4.6-288.src.rpm 0e354408f232b25fe0089b97073009a3 SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/rsync-2.4.6-289.i386.rpm 1ff42b8149e21644d23fe71c40a3ec5a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/rsync-2.4.6-289.src.rpm 83407b4dfad94d21af60ba3e8025e6cd SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/rsync-2.4.6-288.i386.rpm 26533f97af4474b450ad43a171c5571f source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/rsync-2.4.6-288.src.rpm dcd1345446871320962e91d979ddb25b SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/rsync-2.3.2-124.i386.rpm f16f81e5a0a11ba951b6f923cbae2abd source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/rsync-2.3.2-124.src.rpm cd36ce735b4ca91f92fc2f3c7603037f SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/rsync-2.3.2-123.i386.rpm c9330c9123757f89ed94382874122c82 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/rsync-2.3.2-123.src.rpm d97478d6fe9f2419b8700c52be4d888a Sparc Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n2/rsync-2.4.6-135.sparc.rpm 669f52233aed0766dd72788741691558 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/rsync-2.4.6-135.src.rpm 85ddaa9518d19f6341a68ce254668f0b SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/rsync-2.4.6-135.sparc.rpm d68ebcdba8caa16360e225fc9d28dc54 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/rsync-2.4.6-135.src.rpm b9f1f43d0248b763aef46bd610233285 SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/rsync-2.3.2-5.sparc.rpm 50b9cefa5f4bf86fc1e20184c15fb542 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/rsync-2.3.2-5.src.rpm ffbc3ff43c339cbbe12317bb98587df3 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/rsync-2.4.6-123.alpha.rpm 3b602bd23179a7b6ce162d2d377394af source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/rsync-2.4.6-123.src.rpm 65f9d53cb48b8456466a27d9cde04339 SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/rsync-2.3.2-30.alpha.rpm 2056422feb3b2b53285413ca746f2f4e source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/rsync-2.3.2-30.src.rpm 88c3a630df0e3073a8be55b0008371a0 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/rsync-2.3.2-31.alpha.rpm 18ea59b5c4d4641b62cef9c11f535ae8 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/rsync-2.3.2-31.src.rpm 091659d90d3e079c0f8d4518c2c42f9f Power PC Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/rsync-2.4.6-150.ppc.rpm f5576fca06f5d22b1410aaba399e0791 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/rsync-2.4.6-150.src.rpm 1baeeffafe1c7dd75189cbfe704bddf0 SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/rsync-2.4.6-151.ppc.rpm 04102efb5a83b5190fe6b02146ec522b source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/rsync-2.4.6-151.src.rpm 4a21e9f5b36f6767436c6ea92f5d17e7 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/rsync-2.3.2-133.ppc.rpm 897e0010ccf09c85a8c8797dc77394e1 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/rsync-2.3.2-133.src.rpm 7ff150ba5f39ab527aa67308154273e2 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/rsync-2.3.2-133.ppc.rpm 65ac31f12bacb9284fd2286aec7beab0 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/rsync-2.3.2-133.src.rpm 4b43552a939f080a3e93fe65a88bd139 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - pine The popular mail client "pine" was found vulnerable to an attack where shell metacharacters inside an URL could be used to execute arbitrary commands if pine passes the URL to an external viewer on the commandline. The pine packages on SuSE products are not vulnerable to this weakness because they contain a patch that works around this problem since it is not new. - xchat We are working on updates for the xchat packages in the SuSE Linux 7.0 and 7.1 distributions that are vulnerable to an encoding bug while receiving and decoding ctcp datagrams. This bug can lead an xchat IRC client to execute IRC protocol specific commands to an IRC server such as channel mode changes. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohc BBMRAgAcBQI57vSBBQkDwmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8s AJ98BgD40zw0GHJHIf6dNfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQ EQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACe OO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vf iUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEI SZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9g TPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23p QUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1y PqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IX SzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd9DYJ8UUT mIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Via5/gO7fJ EpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13CNZZNZfD qnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp271hhQBe RmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlEt5ucTXst Zy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMGB/9g+9V3 ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZwrbSTM5Lp C/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6TtIJlGG6pq UN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFLrWn7mfoG x6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5HRKMWpO+M 9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMag8zFbpeq PQUsDv9V7CAJ1dbriEwEGBECAAwFAjnu9JIFCQPCZwAACgkQqE7a6JyACspLIgCb BQd/++0pB9yZWDhqxHtTpdCXRsAAnik7bYHlTxQfohiXYsEJcWrDn7l8 =ojbD - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBPFF+6ney5gA9JdPZAQEjBwf7B2B8w1lFpiL8bgy3ttUzNRTFIRnre7yq QLcn8XdhF1iSvtDpgiajVsutYrRbEeVImcAWmXeLOIZMY/qwc4uLBwxrF2ng0Uph QhAebyewpFtMmIQrb/7AAOcudpgbHWsSRJYacbqYutQvJJ73vuFh+HOjErFoFx8p ZqtVC5IvOuE+HomaS/WBPjBdvIDrHSUaJq+fFFTYKozAEg/PpM++vePI5xauaEoP t6Wvazswwe1Qlx2rV2NvE/4TLFyxL2fHEQTtEIdSsa6za7WXmC2QqIhv4Y5zdckA 8CpPFJ0M/nTzmEf40i67myIGtOVgjb5MWaOv2ybya9ORPIHScdZxSQ== =8z44 -----END PGP SIGNATURE----- -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~

3 2

Folder options.
by Russell Koehler 25 Jan '02

25 Jan '02

I was wondering if anyone new a way of preventing users from creating Directories on SUSE 7.3. I need the users to be able to read, write, copy, and move files, but not create folders. I am running SAMBA with a W2000 Domain controller. all users run W98SE. My kernel is 2.4.16.

2 1

status of new kernel 2.4.16
by Bob Vickers 25 Jan '02

25 Jan '02

Hello, A couple of times recently Roman (I think) has promised an imminent security announcement associated with the new 2.4.16 kernel. It hasn't arrived yet...could I ask whether there is a specific problem delaying it or whether it is general work overload? I'm not trying to get at SuSE here, and I know it delays you further if you have to answer too many "is it nearly ready?" messages; I am just looking for information to make an informed decision about whether to upgrade yet. One of our main production machines has stability problems on 2.4.7 so I would like to upgrade, but I don't want to move to 2.4.16 if it is being held back for stability reasons. Thanks, Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

2 1

SuSEFirewall-Masq and ipchains with 2.4.x
by R. Ullenboom 25 Jan '02

25 Jan '02

Hi, boot.msg when initializing SuSEFirewall: "WARNING: FTP/IRC/REALAUDIO etc. masquerading does not work with ipchains and the 2.4. kernel. Either move to a stable 2.2 or use SuSEFirewall2" I did change to SuSEFirewall2 at SuSE-FTP-update7.3. Install OK. Kernel 2.4.4. But the error-msg appears at least. What's wrong? Thanks 4 help, René

2 1

sendmail behind SuSEFirewall
by R. Ullenboom 25 Jan '02

25 Jan '02

Hi, I'm trying to initialize an TDSL-Gateway. Masq. over SuSEFirewall and transpararent Proxy with Squid seems to work. (From MS-Client: Ping from DOS-Kommand-Line to Internet-Adress: REACHED; Internet-Surfing from Webbrowser over Squid and also Downloads) Before i'm going to install this Firewall in our 3-Man-Office, I'd like to test some things at home. Sendmail's running on my Workstation in the Office. In the future it should exchange it's eMails behind the Firewall. Which ports do I have to aktivate in Susefirewall (FW_SERVICES_EXTERNAL_TCP und FW_SERVICES_INTERNAL_TCP)? Do I have to fill-in other Parameters somewhere else? Which way is the best to test sendmail-Firewall-Passing ("telnet 'pop3-server_Internet' 110" or stupid MS-Outlook-Client or someth. else?) Thanx for help, Rene

1 0