February 2004 - openSUSE Security - openSUSE Mailing Lists

SuSE 8.0 kernels approved
by Thomas Biege 24 Feb '04

24 Feb '04

Hi, I approved the 8.0 kernels a few minutes ago. You can expect them within the next half hour on our mirrors. Bye, Thomas -- Thomas Biege <thomas(a)suse.de>, SUSE LINUX AG, Security Support & Auditing -- # If you have the "driftnet" program installed, webcollage can display a # collage of images sniffed off your local ethernet, instead of pulled out # of search engines: in that way, your screensaver can display the images # that your co-workers are downloading! -- xscreensaver source-code

3 2

RE: [suse-security] access via SSH
by sematin＠mtn.co.ug 24 Feb '04

24 Feb '04

> This is > confermed to be open using nmap > scanning localhost (127.0.0.1) > > Looking in /var/log/messages I notice that the boxes that > want to gain access > will be DROPPED by SuSE FW. Perhaps you shouldn't scan on the localhost itself but from a remote machine :-) Noah.

1 0

Online_update
by Ness, Todd 24 Feb '04

24 Feb '04

I am trying to make a patch to install an update on my set of suse 8.1 machines from my local update server. I have made a build-key for myself, I have added it to /usr/lib/rpm/gnupg/pubring.gpg I have signed the patch file and the rpm with this build key. When I run online update I get this error... jdsai:~ # online_update -s Types of patches to be installed: security recommended Product: Java Desktop Version: 2003 Architecture: i386 Language: de URL: nfs://192.168.1.104/tftpboot/updates Path: ./i386/update/Java-Desktop/2003/patches Error retrieving patches: ERROR(InstSrc:error) Here is my patch file: jdsai:/tmp # cat /root/COE-vc-patch.asc -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ## ## Patch description of patch coe version checker Kind: security Shortdescription.english: EDS COE Version check Longdescription.english: Provides the ability to check what base version and patched version the machine is at. Size: 5101 UpdateOnlyInstalled: false Postscript: Packages: ## ## -----> coe-version-check <----- ## Filename: coe-version-check.rpm Series: noarch Label: coe-version-check Size: 5101 6536 RpmGroup: System/Packages Copyright: EDS Version: 1.0.0b Requires: gtk sh-utils fileutils rpmlib -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQFANqpqMDPDHXXSOZARAqmAAKCIf5IK8IpbzBmHWOw+mY0bB3/AUgCggRDO tJjmyYWG8ByloXDsN4oByAc= =rBm0 -----END PGP SIGNATURE----- If I strip off the suse build signature and resign with my signature those patch files work fine. Does anybody have any clues? Todd Ness EDS - Platform Infrastructure Engineering Phone:+1-303-255-4530 mobile : 303-263-2589 pager mail: nessts(a)vtext.com

2 1

RE: [suse-security] Can a Suse box be a proxy gateway and a DNSserver at the same time??
by sematin＠mtn.co.ug 24 Feb '04

24 Feb '04

What setting are you changing? What makes you think that it is this setting that affects the said services? Incidentally dns takes very little resources both in terms of memory and processor so that shouldn't be a big consideration at this point. You can run multiple services all on the same box like mail, squid, dns, http etc. Noah. > -----Original Message----- > From: Joao M.C. Alvega [mailto:JSuse@netcabo.pt] > Sent: 24 February 2004 22:05 > To: suse-security(a)suse.com > Subject: Re: [suse-security] Can a Suse box be a proxy > gateway and a DNSserver at the same time?? > > > The problem is this, for me to have the Dns working i need to > change a setting in /etc/sysconfig/network/sysconfig from > "yes" to "no" and that makes squid work or dns Server not > both at the same time! and yes 1 Ghz in my small network is i > think that's enought! because thet setting allows the > resolv.conf file to be writen or not. i'm new at linux so > ther are something that i dont undertstand very well! > > On Mon, 2004-02-23 at 18:43, Dana Hudes wrote: > > They're different programs responding on different ports to > different > > protocols. If you have enough processor power and RAM, I > see no reason why > > not. > > On Tue, 24 Feb 2004, Joao M.C. Alvega wrote: > > > > > Hello, i'm having some problems. > > > Does anyone know if it's possible to make a Bind to work > in the same > > > machine as Squid? If so could anyone explain me how? Here > bind will > > > work as a DNS Server(master) and not a cache. > > > > > > thank you very munch for any help tha may come! > > > > > > > > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

SuSEfirewall2 Anti SPOOFING
by Stephen Prendergast 24 Feb '04

24 Feb '04

Guys I've got myself a little confused over some issues I'm having on this and despite reading Togan's primer don't seem to be winning. ADSL router -10.10.99.1 | DHCP , DNS | eth1 10.10.99.5 | ssh | eth0 10.10.200.254 | squid, squidguard, internal http | rest of Lan SuSEfirewall2 FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS domain" Logs I get the following when the firewall has been started and the browsers hang - squid trying for dns resolution I suspect Feb 24 17:57:37 localhost kernel: SuSE-FW-DROP-ANTI-SPOOF IN=eth1 OUT= MAC=00:80:ad:8e:f9:64:00:d0:41:0e:92:1f:08:00 SRC=10.10.99.1 DST=10.10.99.5 LEN=148 TOS=0x00 PREC=0x00 TTL=64 ID=51956 PROTO=UDP SPT=53 DPT=1052 LEN=128 Squid is setup to use the nameserver from resolv.conf as 10.10.99.1 as provided by dhcp. Does this indicate I should provide a local dns rather than pass through the firewall ? Cheers, all help warmly appreciated. -- Stephen Prendergast SP Software Ltd 07 570 1452 021 466 247

1 0

Re: [suse-security] access via SSH
by Bill.Light＠kp.org 23 Feb '04

23 Feb '04

Upgrade your version of Putty Richard Farla <farla-klep(a)planet.nl> 02/23/04 01:21 PM To: suse-security(a)suse.com cc: Subject: [suse-security] access via SSH Greetings, After upgrade from 8.0 to 8.2 I have problems accessing my system with SSH. >From the box to another system theire is no problem, but from other linux-boxes or windows (using Putty) I cannot access it anymore. The firewall is on, also services allowed is SSH and I also tell firewall to accept tru port 22. I read a lot of info and went tru some conf files but I do not know where the problems is located exactly Richard -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Fwd: access via SSH
by Richard Farla 23 Feb '04

23 Feb '04

1 0

SuSEfirewall2 and multiple IPs for interface
by Ralf Ronneburger 23 Feb '04

23 Feb '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi everyone, on SuSEfirewall2 with SuSE 9.0 and an interface with 2 IPs assigned to it the following setting: FW_SERVICES_*_TCP="www" does seem to translate to: "allow incoming port 80 on the outside interface for the primary IP". What if I want to allow it for both IPs? Do I have to write my own rule into SuSEfirewall2-custom? Thanks a lot, Ralf -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFAM52OLbWu9MVtJiYRAj6HAJsEYF8BCw4BmxLoMGDvNGa7r1xX0wCfam1c gi+As0RG3LlH2mvml1c7xdg= =KM/B -----END PGP SIGNATURE-----

5 6

Linux Kernel (SuSE-SA:2004:005)
by Peter Buenemann 23 Feb '04

23 Feb '04

Hi, Have been just looking for 8.0 kernel patch - and it is still not available Bye Peter Buenemann

2 1

Re: [suse-security] pptpd - assigning remote peer IPs depending on username?
by Marc Samendinger 23 Feb '04

23 Feb '04

> -----Original Message----- > From: Stefan Gofferje [mailto:suse-security@gofferje.homelinux.org] > Sent: Sunday, February 22, 2004 7:23 PM > To: suse-security(a)suse.com > > > Hi, > > does anyone know a (non-RADIUS) way to assign remote peer's IP in > dependance of the remote username, so that e.g. sgofferj always gets > 192.168.5.1, hmueller always gets 192.168.5.2 and so on...? sure, its documented in your /etc/ppp/chap-secrets # Secrets for authentication using CHAP # client server secret IP addresses hmueller * secretpassword 192.168.5.2 > Regards, > Stefan marc

2 1