November 2005 - openSUSE Security - openSUSE Mailing Lists

OT: X Server with cygwin. Was Re:[suse-security] safety with scp
by miguel gmail 07 Dec '05

07 Dec '05

Hi > Nevertheless gives a nice X-Server. > ;-) Oh, yes, i forgot it. Problem is... i am unable to use it. The first time i used cygwin i did it with administrator w2k user. From then on, i use a regular user, but with administration rights, though (company policy). Administrator user can launch X server, but not any other user (at this point, i really miss the su - linux capability). When i launch the startx command, this is what i get (in a popup window): A fatal error has occurred and Cygwin/X will now exit. Please open /tmp/XWin.log for more information. Vendor: The cygwin X Project Release: 6.8.2.0-2 Contact: blah blah XWin was started with the following command-line: X :0 -multiwindow -clipboard The main cygwin windows shows: Mcalerom@MCALEROMAC2K ~ $ startx Welcome to the XWin X Server Vendor: The Cygwin/X Project Release: 6.8.2.0-2 Contact: cygwin-xfree(a)cygwin.com XWin was started with the following command line: X :0 -multiwindow -clipboard Fatal server error: Cannot open log file "/tmp/XWin.log" waiting for X server to begin accepting connection .. .. .. .. .. .. .. .. .. .. winDeinitMultiWindowWM - Noting shutdown in progre giving up. xinit: Connection refused (errno 111): unable to xinit: No such process (errno 3): Server error. The closest thing i could find to the log file mentioned above was c:\cygwin\tmp\XWin.log, but the last time this file was updated was by mid september :-? Welcome to the XWin X Server Vendor: The Cygwin/X Project Release: 6.8.2.0-2 Contact: cygwin-xfree(a)cygwin.com XWin was started with the following command line: X :0 -multiwindow -clipboard ddxProcessArgument - Initializing default screens winInitializeDefaultScreens - w 1400 h 1050 winInitializeDefaultScreens - Returning _XSERVTransmkdir: Owner of /tmp/.X11-unix should be set to root (II) XF86Config is not supported (II) See http://x.cygwin.com/docs/faq/cygwin-x-faq.html for more information (==) FontPath set to "/usr/X11R6/lib/X11/fonts/misc/,/usr/X11R6/lib/X11/fonts/TTF/,/usr/X11R6/lib/X11/fonts/Type1/,/usr/X11R6/lib/X11/fonts/CID/,/usr/X11R6/lib/X11/fonts/75dpi/,/usr/X11R6/lib/X11/fonts/100dpi/" winAdjustVideoModeShadowGDI - Using Windows display depth of 32 bits per pixel winAllocateFBShadowGDI - Creating DIB with width: 1400 height: 1050 depth: 32 winInitVisualsShadowGDI - Masks 00ff0000 0000ff00 000000ff BPRGB 8 d 24 bpp 32 null screen fn ReparentWindow null screen fn RestackWindow InitQueue - Calling pthread_mutex_init InitQueue - pthread_mutex_init returned InitQueue - Calling pthread_cond_init InitQueue - pthread_cond_init returned winInitMultiWindowWM - Hello winInitMultiWindowWM - Calling pthread_mutex_lock () winMultiWindowXMsgProc - Hello winMultiWindowXMsgProc - Calling pthread_mutex_lock () MIT-SHM extension disabled due to lack of kernel support XFree86-Bigfont extension local-client optimization disabled due to lack of shared memory support in the kernel (--) Setting autorepeat to delay=500, rate=31 (--) winConfigKeyboard - Layout: "0000040a" (0000040a) (--) Using preset keyboard for "Spanish (Spain, Traditional Sort)" (40a), type "4" (--) 3 mouse buttons found Could not init font path element /usr/X11R6/lib/X11/fonts/CID/, removing from list! winInitMultiWindowWM - pthread_mutex_lock () returned. winMultiWindowXMsgProc - pthread_mutex_lock () returned. winInitMultiWindowWM - pthread_mutex_unlock () returned. winInitMultiWindowWM - DISPLAY=127.0.0.1:0.0 winMultiWindowXMsgProc - pthread_mutex_unlock () returned. winMultiWindowXMsgProc - DISPLAY=127.0.0.1:0.0 winProcEstablishConnection - Hello winInitClipboard () winProcEstablishConnection - winInitClipboard returned. winClipboardProc - Hello DetectUnicodeSupport - Windows NT/2000/XP winClipboardProc - DISPLAY=127.0.0.1:0.0 winInitMultiWindowWM - XOpenDisplay () returned and successfully opened the display. winClipboardProc - XOpenDisplay () returned and successfully opened the display. winMultiWindowXMsgProc - XOpenDisplay () returned and successfully opened the display. winMultiWindowXMsgProcErrorHandler - ERROR: BadWindow (invalid Window parameter) I know it is very OT, but i thought it was worthy to give it a try... -- Saludos, miguel

5 6

Re: [suse-security] SuSEfirewall2 drop/reject on ip address
by Polarizer 29 Nov '05

29 Nov '05

> Could someone tell me how to configure SuSEfirewall2 to drop packets based > source address(s)/range? Any help would be appreciated. Take a look at the configuration file "/etc/sysconfig/SuSEfirewall2" <quote> ## Type: string # # 25.) # Do you want to load customary rules from a file? # # This is really an expert option. NO HELP WILL BE GIVEN FOR THIS! # READ THE EXAMPLE CUSTOMARY FILE AT /etc/sysconfig/scripts/SuSEfirewall2-custom # FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom" </quote> in "/etc/sysconfig/scripts/SuSEfirewall2-custom" are examples which may help you to meet your needs. Good place to block an address range seems to be "fw_custom_after_antispoofing()". hope that helps the polarizer http://www.codixx.de/polarizer.html

1 0

SuSEfirewall2 drop/reject on ip address
by Wade Grant 29 Nov '05

29 Nov '05

Could someone tell me how to configure SuSEfirewall2 to drop packets based source address(s)/range? Any help would be appreciated. wade G. "Privilege becomes arrogance. Arrogance promotes injustice. The seed of ruin blossom." Frank Herbert. 1984. God Emperor of Dune.

1 0

RE: Simple to exploit SQL Injection ?
by suse＠karsites.net 29 Nov '05

29 Nov '05

Hi all. Would this be of relevance: from php.ini: ; Use Sybase-style magic quotes (escape ' with '' instead of \'). ; Leave this OFF! magic_quotes_sybase = OFF HTH - KR On Mon, 28 Nov 2005, Victor Chapela wrote: > To: 'Jason binger' <cisspstudy(a)yahoo.com>, webappsec(a)securityfocus.com > From: Victor Chapela <victor(a)sm4rt.com> > Subject: RE: Simple to exploit SQL Injection ? > > Jason, > > I agree with Rich, it seems your ' is being escaped by > adding a second one. This should be interpreted by the > database as a single quote within the quoted string '...'.

1 0

Re: [suse-security] problems after update to new php4-corefiles with YaSt
by Polarizer 29 Nov '05

29 Nov '05

> Just my question - how can i go back to the last > php Version (php4-4.3.4-43.44) until this is > fixed. > Depending on your Suse version you'll find previously installed php versions right here: /var/lib/YaST2/you/mnt/i386/update/X.X/rpm/i586/php4-* where X.X is to replace with your version.subversion roll back with "rpm -i" optionally w/ "--nodeps" and/or "--force" polarizer http://www.codixx.de/polarizer.html

2 1

problems after update to new php4-corefiles with YaSt
by Michael Weber 29 Nov '05

29 Nov '05

Hi, cause it was a security update i just try it here. After the Update of the php4 corefiles with Yast we have *real* problems with the "simulate static" Functions of Typo3 on our Server. After the update i found a replaced php.ini, with no php.ini.rpm whatever backup. The replacement with the old php.ini dont work so i guess its a bug in the update (php4-4.3.4-43.46.3). Just my question - how can i go back to the last php Version (php4-4.3.4-43.44) until this is fixed. Luckily thats my first problem with a Update but it have to be solved very fast. tia, Michael Weber

1 1

How to make SuSEfirewall2 accept packets passing bridge-interface
by David Huecking 29 Nov '05

29 Nov '05

Hi! I had set up a router as follows: - eth1/ ppp0 is external interface to a DSL-modem to the internet - eth0 is a ethernet-interface to internal net/ switch => everything was fine. SuSEFirewall2 set up the routing to and from the internet for the internal clients and provided some protection from the internet. Now I added a wireless-card for the router also acting as a wireless access-point: - ath0 is interface of wireless-card running in hostap-mode Then I build a bridge-interface from eth0 and ath0 and gave it the former IP of eth0. - br0 bridge made of ath0 and eth0 Routing from the wired and wireless clients to the internet works like a charm. What does not work ist bridging from physical interface eth0 to ath0 so that I can reach my server attached to the LAN-switch from my wireless notebook. I get logging-entries like that: SFW2-FWDint-DROP-DEFLT IN=br0 OUT=br0 PHYSIN=eth0 PHYSOUT=ath0 SRC=192.168.42.6 DST=192.168.42.2 Could anybody tell me what to write into /etc/sysconfig/SUSEFirewall2 or in /etc/sysconfig/scripts/SuSEfirewall2-custom to accept packets crossing my bridge. Bridge was set up like that: brctl addbr br0 brctl addif br0 ath0 brctl addif br0 eth0 ifconfig ath0 0.0.0.0 ifconfig eth0 0.0.0.0 ifconfig br0 192.168.42.5 Thanks in advance for any tips. -- Eat, sleep and go running, David Hücking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216

6 9

Re: [suse-security] Problems with latest SuSE apache2-mod_php5 from SuSE update
by Stefan Seifert 28 Nov '05

28 Nov '05

/>> I have encountered a problem with apache2-mod_php5-5.0.3-14.13.i586.rpm / />> on SuSE 9.3. / />> / />> After installing the following mod_rewrite directive does not work anymore: / />> / />> RewriteRule ^(.*)(index|content)\.html myscript.php [PT] / />> / />> / />> The script is no longer executed, but a empty response of (I think) type / />> x-httpd-php is sent back. Rolling back to / />> apache2-mod_php5-5.0.3-14.11.i586.rpm fixes that issuse. / > i got the same problem with php4. error.log shows following messages: > ------------------------------ > [notice] child pid 8975 exit signal Segmentation fault (11) > ----------------------------- > i have additional eaccelerator running. maybe the problem depends from > this tool. can't test it atm. I can confirm this problem with patch php4-52615 on SuSE 9.1 and apache2-mod_php4-52618 on SuSE 9.3 No accelerators used. I get a segfault on every subrequest that's using PHP, e.g. PHP scripts that are included via SSI and PHP scripts that run as 404 errorpage. I think rewrites run as subrequest, too, so that's why they're broken. Rolled back the update for now. regards, Stefan Seifert

4 4

Re: [suse-security] Close all ssh sessions
by Polarizer 28 Nov '05

28 Nov '05

Miguel ALBUQUERQUE schrieb: > Hi, > > How can one force closing an open ssh session ? I want to disconnect a > user right after executing a script no waiting for a timeout. Is that > possible ? I've 3 ideas 1st) What about to replace the login shell in /etc/passwd with the script the user can invoke. If script is done user gets logged out :O)_ youruser:x:1000:1000::/var/tmp/:/bin/yourscript 2nd) One can invoke a script via ssh a.ip.addr.ess "command" so if you can disable interactive sessions in sshd it will fulfill your requirements (Dunno how to accomplish that ad hoc) 3rd) man bash PPID The process ID of the shell's parent. This variable is readonly. If one invokes a script this variable should contain the PID of the underlying bash. Just kill -9 $PPID in the of the script. Hope that helps the polarizer http://www.codixx.de/polarizer.html

4 3

RE: [suse-security] problem with apache reverse proxy
by Dörfler Andreas 25 Nov '05

25 Nov '05

well done, thanks :) right, missing / was only in the example :) problem was ProxyPreserveHost On .... ive set RequestHeader unset Accept-Encoding now, think i dont need more ?! greetings andy --free your mind, use open source http://www.mono-project.com ASCII ribbon campaign ( ) - against HTML email X & vCards / \ > -----Original Message----- > From: sf(a)sfritsch.de [mailto:sf@sfritsch.de] > Sent: Friday, November 25, 2005 10:06 AM > To: suse-security(a)suse.com > Subject: Re: [suse-security] problem with apache reverse proxy > > Hi, > > > ProxyPassReverse ^/(.*)$ http://test2.kempten.lan$1 > (here is a / missing, put this is probably only in the example?) > > > if the backend server uses named virtual hosts as in your case, > you must use one of > > * ProxyPreserveHost Off on the reverse proxy > * mod_header with RequestHeader set Host in a <Proxy> block on the > reverse proxy > * ServerAlias dummy.domain.de , etc. on the backend server > > Hope this helps. > > Cheers, > Stefan > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

problem with apache reverse proxy
by Dörfler Andreas 25 Nov '05

25 Nov '05

hi there, after many trys i hope the list can help me. becuase of security reasons i setup a reverse proxy for multible domains problem is, with the following config i only get the primary domain vhosts on reverse proxy: <VirtualHost *:80> ServerName dummy.domain.de ProxyPass / http://test.domain.lan/ ProxyPreserveHost On CacheDisable / ProxyPassReverse ^/(.*)$ http://test.domain.lan/$1 </VirtualHost> <VirtualHost *:80> ServerName dummy2.domain.de ProxyPass / http://test2.domain.lan/ ProxyPreserveHost On CacheDisable / ProxyPassReverse ^/(.*)$ http://test2.kempten.lan$1 </VirtualHost> /etc/hosts on both servers: 192.168.1.1 test.domain.lan test2.domain.lan vhosts on webserver: <VirtualHost test.domain.lan> User xxx Group xxx ServerAdmin xxx DocumentRoot /srv/www/test/ ServerName test.domain.lan ErrorLog xxx TransferLog xxx ScriptAlias xxx </VirtualHost> <VirtualHost test2.domain.lan> User xxx Group xxx ServerAdmin xxx DocumentRoot /srv/www/test/ ServerName test2.domain.lan ErrorLog xxx TransferLog xxx ScriptAlias xxx </VirtualHost> <VirtualHost www.domain.lan> User xxx Group xxx ServerAdmin xxx DocumentRoot /srv/www/test/ ServerName test.domain.lan ErrorLog xxx TransferLog xxx ScriptAlias xxx </VirtualHost> when i access the pages via test.domain.lan everything ok but when i try it via rev proxy dummy.domain.de i get www.domain.lan page (primary website) and not the from rev proxy requested test.domain.lan well, i can do it with squid too but i have no clue how to configure it for multible domains greetings andy --free your mind, use open source http://www.mono-project.com ASCII ribbon campaign ( ) - against HTML email X & vCards / \

2 1

Close all ssh sessions
by Miguel ALBUQUERQUE 24 Nov '05

24 Nov '05

Hi, How can one force closing an open ssh session ? I want to disconnect a user right after executing a script no waiting for a timeout. Is that possible ? Thanx Miguel Albuquerque Network Administrator CODaLIS SA Chemin de Trèfle-Blanc 18 1228 Plan-Les-Ouates / CH TEL : +41 22 827 30 80 FAX : +41 22 827 30 33 http://www.codalis.ch DISCLAIMER - This message is intended for the use of the named person only. The information contained in this E-mail is confidential and any disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly prohibited. This message does not represent a formal commitment by Codalis SA. Codalis SA is neither liable for the proper and complete transmission of the information contained in this communication nor for any delay in its receipt.

3 2

Martian source... Need to have route to other networks via internal interface. What to do?
by Sergei Keler 24 Nov '05

24 Nov '05

Hi! I have SLES9 and two interfaces eth0 & eth1. eth0 has real ip address like 217.x.x.x eth1 has local ip address 192.168.0.1/24 Default gateway on this system belongs to real ip address network 217.x.x.x via eth0. eth0 is described as External inteface in suse firewall. eth1 is described as Internal one. No NAT etc. Kernel security is on. LAN has several nets like 192.168.x.0/24. Accessing net like 192.168.1.0/24 i got 'martian source' kernel message. I tried to make route to 192.168.1.0/24 via 192.168.0.254 but still have same error log. Where to dig? I dont want to create aliases for each network (it works but too ugly). Is possible the pretty solution for me? Next, what you recommend as linux implementation of Cosco's EIGRP? Ciscos use EiGRP to keep routes between them using 192.168.0.254/24 net. Sergei Keler General DataComm IT-manager tel.: +7(812)325-1085 fax: +7(812)325-1086

5 8

SuSE Firewall/Router
by OIivier Grossmann 24 Nov '05

24 Nov '05

Hello, i've configured a suse 10.0 base machine with router functionality and a proxyserver (squid). I've activated package forwarding and have two network cards. The problem is i can specify the proxy server or i couldn't - it doesn't matter!! It is important that every client have to specify the proxyserver - only over the proxy! How can I do that? Greet Olivier

4 3

Re: [suse-security] SuSEfirewall2 - scripts (SuSE 9.3)
by Robert Uhl 23 Nov '05

23 Nov '05

Hi, > There is are 3rd Script "SuSEfirewall2_final" > > The firewall starts in 3 stages > > 1]init > > Description: SuSEfirewall2_init does some basic setup and is the phase 1 > of 3 of the SuSEfirewall initialization > > 2]setup > > Description: SuSEfirewall2_setup does some basic setup and is the phase > 2 of 3 of the SuSEfirewall initialization. > > 3]up and running > > Description: SuSEfirewall2_final does finally set all the firewalling > rules. Phase 3 of 3 of SuSEfirewall setup. > > All 3 scripts call /sbin/SuSEfirewall2 with different parameters. Okay, I think SuSE 9.3 does not really have the 3rd phase anymore since the script SuSEfirewall2_init and SuSEfirewall2_setup tell: ### BEGIN INIT INFO # Provides: SuSEfirewall2_init # Required-Start: $local_fs boot.localnet # Required-Stop: # Should-Stop: $network # Default-Start: B # Default-Stop: # Short-Description: SuSEfirewall2 phase 1 # Description: SuSEfirewall2_init does some basic setup and is the # phase 1 of 2 of the SuSEfirewall initialization ### END INIT INFO and### BEGIN INIT INFO # Provides: SuSEfirewall2_setup # Required-Start: SuSEfirewall2_init $network $local_fs # Should-Start: $ALL # Required-Stop: $local_fs # X-UnitedLinux-Should-Stop: # Default-Start: 3 4 5 # Default-Stop: 0 1 2 6 # Short-Description: SuSEfirewall2 phase 2 # Description: SuSEfirewall2_setup does some basic setup and is the # phase 2 of 2 of the SuSEfirewall initialization. ### END INIT INFO # X-SuSE-Dep-Only I just wanted to add that. Here is a locate of the SuSE firewall scripts bash:/etc # locate SuSEfirewall2_ /etc/init.d/boot.d/K11SuSEfirewall2_init /etc/init.d/boot.d/S11SuSEfirewall2_init /etc/init.d/rc3.d/K01SuSEfirewall2_setup /etc/init.d/rc3.d/S21SuSEfirewall2_setup /etc/init.d/rc4.d/K01SuSEfirewall2_setup /etc/init.d/rc4.d/S21SuSEfirewall2_setup /etc/init.d/rc5.d/K01SuSEfirewall2_setup /etc/init.d/rc5.d/S21SuSEfirewall2_setup /etc/init.d/SuSEfirewall2_init /etc/init.d/SuSEfirewall2_setup /etc/preload.d/SuSEfirewall2_final /etc/preload.d/SuSEfirewall2_init /etc/preload.d/SuSEfirewall2_setup /lib/scpm/resource_types/service/status/SuSEfirewall2_final /lib/scpm/resource_types/service/status/SuSEfirewall2_init There is just one SuSEfirewall2_final entry displayed which even calls the SuSEfirewall2_setup script. I can't find any reason to have this file? Does somebody do? Regards, Robert.

1 0

SuSEfirewall2
by Robert Uhl 23 Nov '05

23 Nov '05

Hi, I am currently dealing with the SuSEfirewall 9.3 and I hope that somebody knows more or figured out more about it then the pour documentation tries to do. I did work quiet a while on the iptables but this SuSE system really does not make a difference in terms of complexity. Sorry. Is there any better documentation about it then you can find in /usr/share/doc/packages/SuSEfirewall2 I found these two scripts e.g.: SuSEfirewall2_init SuSEfirewall2_setup Why does SuSE needs two scripts? Does SuSE plan to change main things on the firewall system in future? Since they did from version to version. Regards, Robert.

4 3

Re: [suse-security] SuSE Firewall/Router
by Polarizer 23 Nov '05

23 Nov '05

There is an alternative way. One can use Web Proxy Auto Discovery (WPAD) to provide proxy informations to clients. You can reach that aim by dhcp or DNS-HTTP combination. [1] http://wi-fiplanet.webopedia.com/TERM/W/WPAD.html The polarizer http://www.codixx.de/polarizer.html

1 0

Re: [suse-security] SuSEfirewall2
by Polarizer 23 Nov '05

23 Nov '05

> Is there any better documentation about it then you can find in /usr/share/doc/packages/SuSEfirewall2 Here[1] you'll find a Susefirewall2 documentation. Document is rather old, as Susefirewall2 itself is too. > I found these two scripts e.g.: > > SuSEfirewall2_init > SuSEfirewall2_setup > > Why does SuSE needs two scripts? > There is are 3rd Script "SuSEfirewall2_final" The firewall starts in 3 stages 1]init Description: SuSEfirewall2_init does some basic setup and is the phase 1 of 3 of the SuSEfirewall initialization 2]setup Description: SuSEfirewall2_setup does some basic setup and is the phase 2 of 3 of the SuSEfirewall initialization. 3]up and running Description: SuSEfirewall2_final does finally set all the firewalling rules. Phase 3 of 3 of SuSEfirewall setup. All 3 scripts call /sbin/SuSEfirewall2 with different parameters. [1] http://sourceforge.net/project/showfiles.php?group_id=42064 the polarizer http://www.codixx.de/polarizer.html

1 0

Re: [suse-security-announce] SUSE Security Announcement: phpMyAdmin remote code execution (SUSE-SA:2005:066)
by Scott Leighton 23 Nov '05

23 Nov '05

On Friday 18 November 2005 5:35 am, Marcus Meissner wrote: > ___________________________________________________________________________ >___ > > SUSE Security Announcement > > Package: phpMyAdmin > Announcement ID: SUSE-SA:2005:066 > Date: Fri, 18 Nov 2005 11:00:00 +0000 Anyone else having a problem after this YOU update? I have three boxes, all of them started crapping out with the following error message when trying to access phpMyAdmin, Fatal error: main(): Failed opening required './' (include_path='.:/usr/share/php') in /srv/www/htdocs/phpMyAdmin/libraries/grab_globals.lib.php on line 70 That file, grab_gobals.lib.php is one that was changed by the YOU update. Commenting out the 'require' on line 70 makes the error go away, but I'm sure that's not really the right solution. Scott -- POPFile, the OpenSource EMail Classifier http://popfile.sourceforge.net/ Linux 2.6.11.4-21.9-default x86_64 SuSE Linux 9.3 (x86-64)

3 4

Problems with latest SuSE apache2-mod_php5 from SuSE update
by suse＠weberhofer.at 23 Nov '05

23 Nov '05

I have encountered a problem with apache2-mod_php5-5.0.3-14.13.i586.rpm on SuSE 9.3. After installing the following mod_rewrite directive does not work anymore: RewriteRule ^(.*)(index|content)\.html myscript.php [PT] The script is no longer executed, but a empty response of (I think) type x-httpd-php is sent back. Rolling back to apache2-mod_php5-5.0.3-14.11.i586.rpm fixes that issuse. Best regards, Johannes Weberhofer -- |--------------------------------- | weberhofer GmbH | Johannes Weberhofer | information technologies, Austria | | phone : +43 (0)1 5454421 0 | email: office(a)weberhofer.at | fax : +43 (0)1 5454421 19 | web : http://weberhofer.at | mobile: +43 (0)699 11998315 |----------------------------------------------------------->>

3 2

Re: [suse-security] SlightlyOT: [was] How do I encrypt the swap (partition[s]) under SuSE 9.3 Prof ?
by Carlos E. R. 21 Nov '05

21 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 El 005-11-19 a las 06:36 -0200, Ariel Sabiguero Yawelak escribió: > > You might consider erasing the swap partition when powering off, using > > for the purpose "/etc/init.d/halt.local". The perfomance while in use > > will be better, but halting will be much slower. > > > Again you are not 100% sure. > It has been discussed several times about the posibility of un-erasing erased > data, but we can consider that unerasing and trying to recover data from swap > might be not very useful. Erasing the swap, as it is not a file, and because we are talking security here, means overwriting the swap data with something else. Even in that case, data is recoverable, if you have the means; but I suppose the ordinary thief picking a portable does not have those means, and if he has those means then he is not ordinary thief and even encryption will not deter him much. > But on the other hand, you are leaving your information thief-readable > whenever halt.local is not executed. If the system does not shut down clearly, > or the thief knows that he has to unplug the cable (remove the batery) instead > of initing-6 he is done. If the thief can get to my PC while running, I have bigger worries. He might be armed! > Ok, you can say that whenever *you* shut down the system, then it is "safe", > and I agree :-) > It is only a matter of how much you want to be secure and all-data-encription > is the way to be MORE confident on the solution. Yes. But I'm not that "paranoid". As I use "suspend to disk", what worries me is that the password to the encrypted partitions is saved in clear in the swap partition - this a pending problem. And encrypting the swap partition would not solve it, because then I could not suspend to disk, and also I fear that swapping would be much slower. - -- Saludos Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFDgLihtTMYHG2NR9URAsrPAKCSIoiwc9CjbYVSWSH8XP+4I0mEwQCffj6p LAsJqAEOquTUtkfeIVQf/lk= =lgEw -----END PGP SIGNATURE-----

4 7

How do I encypt the swap (partition[s]) under SuSE 9.3 Prof ?
by Christoph Merk 21 Nov '05

21 Nov '05

Hello All, Can anyone tell me how to encrypt swap under SuSE 9.3? This is standard on Mac's and should be as well possible in 9.3. Regards and thnx for your help Chris PS: Sorry for writing in German on the first posting. Should not happen again ;-)

10 18

Re: SuSE 9.1 + quota = deadlock - SOLVED!!!
by Marcus Meissner 21 Nov '05

21 Nov '05

On Mon, Nov 21, 2005 at 11:50:37AM +0100, Jan Kara wrote: > Hello, > > > any idea when a bugfixed kernel will be available via YOU? this > > weekend we had to reboot our systems more than once :-( > I'm sorry but have you created a bugzilla entry as I asked you? I > could not find it in our bugzilla. Otherwise I've already sent the patch > to Marcus. Marcus do you have any idea when there will be a release of > a new updated kernel? Should I do anything for that? The problem is that users can create only bugzillas for 10.0 or later... We will not release a 9.1 kernel from the SLES9_SP2 branch again, the next will be from the SLES9_SP3 branch. I take the issue is not there in the SP3 branch, so it should be safe. (9.1 is using the SLES 9 kernels.) An update should be released mid of december. If you need it earlier, check the SP3 kernel from: ftp://ftp.suse.com/pub/projects/kernel/kotd/sles9-beta-i386/SLES9_SP3_BRANC… (careful please.) Ciao, Marcus

1 0

SPAM: unsubscribe
by stephan＠sc-config.de 20 Nov '05

20 Nov '05

unsubscribe

1 0

Re: Re: [suse-security] libwrap supported services
by Petteri Hakkarainen 20 Nov '05

20 Nov '05

Good try guys, BUT...:-) I tried both rpm and ldd way and got plenty of services listed. After a quick look I could not find either portmap or telnet (both installed on the system), yet I know they are libwrap supported software. Petteri -----Original Message----- From: Christian Boltz <suse-security(a)cboltz.de> To: suse-security(a)suse.com Date: Thu, 17 Nov 2005 21:52:33 +0100 Subject: Re: [suse-security] libwrap supported services Hello, Am Donnerstag, 17. November 2005 12:31 schrieb Armin Schoech: [...] > > Do you think this is a complete list of services (with the files in > > /etc/xinetd.d, of course)? > > --> I don't really know. But if you really want to be sure, you could > use a command like > "ldd /usr/sbin/* /sbin/* ..." > > to list all libraries used by the different programs. Then you have > to look for "libwrap" to find the tcp-wrapper. This will list only > programs using the shared version of libwrap, though. For a fast overview, you can also try rpm -q --whatrequires libwrap.so.0 ;-) > Programs compiled linking libwrap statically are probably much harder > to nail down. I guess rpm also doesn't know about them. Regards, Christian Boltz -- One of the main reasons for the downfall of the Roman Empire was that, lacking zero, they had no way to indicate successful termination of their C programs. -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

6 12

SuSE 9.1 + quota = deadlock - SOLVED!!!
by Christopher Lenzberger 20 Nov '05

20 Nov '05

any idea when a bugfixed kernel will be available via YOU? this weekend we had to reboot our systems more than once :-(

1 0

Re: [suse-security] libwrap supported services
by Petteri Hakkarainen 18 Nov '05

18 Nov '05

(Sorry Armin for emailing directly to you.) Thx dudes. I consider this case closed. A few words, though. >>The executable "telnet" is the client. Only "telnetd" >>is the daemon that is linked against libwrap. That's very true. I spoke about telnet, meant telnetd:-) >>But you seem to have a strange system. The suggested >>syntax works on my SuSE 9.1 and SuSE 9.3 systems. To tell you the truth, I just had a RHEL 4 in hand to play with the suggestions, so maybe the system was a little strange. I'll do some checking on SLES9 in days to come. Anyway, I wonder that there's no list available about all the services to allow/deny with libwrap. Petteri

1 0

LPRng with kerberos authentication
by Mats Folke 18 Nov '05

18 Nov '05

Hi all! Management is forcing me to use LPRng with kerberos authentication in order to print my documents. Right now I'm using CUPS, with some lpr configuration. However, it seems as if the lprng rpm packet (SUSE 9.3) is not compiled with kerberos support. Can someone verify this? Is it possible to solve this situation without compiling my own lprng with kerberos support? I googled, but i couldn't find any lprng-rpm for SUSE 9.3 with kerberos. Is it the same for SUSE 10? One option is of course to upgrade if it solves this problem. Hopefully some of you can help me, otherwise I'll just have to compile my own version. Kind regards, -- Mats Folke Avd. System och interaktion Div. of Systems and Interaction Inst. för Systemteknik Dept. of Computer Science and Electrical Engineering Luleå tekniska universitet Luleå University of Technology Sweden tel: 0920 49 3065 telephone: +46 920 493065

1 0

(kein Betreff)
by Dirk Goldmann 18 Nov '05

18 Nov '05

/suse-security /*unsubscribe(a)suse.com*

1 0

Re: Re: [suse-security] libwrap supported services
by Petteri Hakkarainen 17 Nov '05

17 Nov '05

Thx Armin, Last time I had a look on a SLES9 box, there were no such list in allow or deny file. It seems that the implementation is a little different with workstation versions (including inetd/xinetd). Do you think this is a complete list of services (with the files in /etc/xinetd.d, of course)? Petteri -----Original Message----- From: Armin Schoech <armin.schoech(a)web.de> To: suse-security(a)suse.com Date: Thu, 17 Nov 2005 09:08:20 +0000 (UTC) Subject: Re: [suse-security] libwrap supported services Hi Petteri, > Is there a list (or a way to find out in a running system) somewhere > for libwrap supported services? > --> in SuSE 9.3 at least, there is a list of services and some other information in /etc/hosts.allow On my system it looks like: # /etc/hosts.allow # See `man tcpdX and `man 5 hosts_accessX for a detailed description # of /etc/hosts.allow and /etc/hosts.deny. # # short overview about daemons and servers that are built with # tcp_wrappers support: # # package name | daemon path | token # ---------------------------------------------------------------------------- # ssh, openssh | /usr/sbin/sshd | sshd, sshd-fwd-x11, sshd-fwd-<port> # quota | /usr/sbin/rpc.rquotad | rquotad # tftpd | /usr/sbin/in.tftpd | in.tftpd # portmap | /sbin/portmap | portmap # The portmapper does not verify against hostnames # to prevent hangs. It only checks non-local addresses. # # (kernel nfs server) # nfs-utils | /usr/sbin/rpc.mountd | mountd # nfs-utils | /sbin/rpc.statd | statd # # (unfsd, userspace nfs server) # nfs-server | /usr/sbin/rpc.mountd | rpc.mountd # nfs-server | /usr/sbin/rpc.ugidd | rpc.ugidd # # (printing services) # lprng | /usr/sbin/lpd | lpd # cups | /usr/sbin/cupsd | cupsd # The cupsd server daemon reports to the cups # error logs, not to the syslog(3) facility. # # All of the other network servers such as samba, apache or X, have their own # access control scheme that should be used instead. # # In addition to the services above, the services that are started on request # by inetd or xinetd use tcpd to "wrap" the network connection. tcpd uses # the last component of the server pathname as a token to match a service in # /etc/hosts.{allow,deny}. See the file /etc/inetd.conf for the token names. # HTH, Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50

3 2

Wie richtet man einen Encrypted Swap unter 9.3 ein?
by Christoph Merk 17 Nov '05

17 Nov '05

Hallo Liste, kann mir bitte jemand sagen, wie man unter SuSE 9.3 Prof. die Swap Partition verschluesselt? Beim Mac ist das eine Standard Option, solte also unter 9.3 auch ohne weiteres moeglich sein. Vielen Dank fuer Eure (Mit-)Hilfe. thnx Chris

2 1

libwrap supported services
by Petteri Hakkarainen 17 Nov '05

17 Nov '05

Is there a list (or a way to find out in a running system) somewhere for libwrap supported services? Petteri

2 1

safety with scp
by piet 14 Nov '05

14 Nov '05

Good morning group, I want to access my server(home based SuSE-box) through the Internet so I can upload images with winscp from my XP-laptop. Is it safe to just open port 22 for the external world, or do I need extra safety measures? regards, piet

10 16

/etc/shadow unchanged but password not valid anymore
by David Huecking 14 Nov '05

14 Nov '05

Hi! I'm facing something like a miracle: On a SuSE 9.3 PC from time to time for some users the login is denied but the accounts are not set up with expiration nor are they disabled and the /etc/shadow is unchanged (compared with diff and md5sum with a copy of the file). In the log you get: Nov 12 22:12:34 tombombadil sshd[8677]: error: PAM: Authentication failure for bla from dslb-... Two other accounts still work every time. Hashing-algorithm for files in /etc/default/passwd is blowfish (CRYPT=des but CRYPT_FILES=blowfish). When running a passwd bla as root and defining the same password as before everything ist fine again. I ran chkrootkit (from a clean enviroment) on the machine without finding anything suspicious. Can anyone give me a hint? -- Eat, sleep and go running, David Hücking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216

2 1

AppArmor
by Thorsten Scherf 14 Nov '05

14 Nov '05

Hi, I just tried to install AppArmor on a SuSE Linux 10.0 System, but without success. YAST2 does not offer me any packages when searching for AppArmor and/or Subdomain. So, the question is, is AppArmor only available in SLES or in the Novell Desktop System? Happy Day. Thorsten

4 6

Web Server Security
by Markus Gaugusch 12 Nov '05

12 Nov '05

Hi, Does anyone think, that it makes sense to let have /bin/bash the following permissions? -rwx---r-x 1 root www 490716 Sep 9 18:12 /bin/bash With that setting, anyone exploiting the webserver could not execute /bin/bash (if course the same permissions could also be applied to /bin). Has anyone ever tried this? Does it break things? Did I find something cool? ;-) Markus -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \

8 9

logrotate ALERT
by Bruno Cochofel 11 Nov '05

11 Nov '05

I'm getting this alert under /var/log/messages: ... linux logrotate: ALERT exited abnormally with [1] and ... STATS dropped 0 Can someone tell me if this is a problem? If so, how can I fix it? Thanks, Bruno

2 1

Re: [suse-security] safety with scp
by m3047＠inwa.net 10 Nov '05

10 Nov '05

A low-tech alternative: why be complicated when you don't need to? You are not running ssh at the moment. Do you send and receive e-mail while on the road? Can you/do you run a mailserver? Set up a special account and allow it to receive e-mail from anywhere, but use procmail to filter so that everything which is not sent by you and/or doesn't fit some profile of the messages containing images is discarded. There are mail-based authentication techniques as well, if you feel a need to go that far rather than simply sifting through the accumulated messags when you return home. -- Fred Morris http://www.inwa.net/~m3047/contact.html

2 1

SuSE 9.1 + quota = deadlock - SOLVED!!!
by Christopher Lenzberger 10 Nov '05

10 Nov '05

thanks a lot to jan kara for solving the problem - but will the be an upgraded package via yast-online-update sooner or later? i don't like rebooting the machine all the time... here the fix: ---snip When i_acl_default is set to some error we do not hold the lock (hence we are not allowed to drop it and reacquire later). --- linux-2.6.5/fs/reiserfs/inode.c 2005-11-05 08:57:09.000000000 +0100 +++ linux-2.6.5/fs/reiserfs/inode.c 2005-11-07 07:57:50.000000000 +0100 @@ -1884,7 +1884,7 @@ * iput doesn't deadlock in reiserfs_delete_xattrs. The locking * code really needs to be reworked, but this will take care of it * for now. -jeffm */ - if (REISERFS_I(dir)->i_acl_default) { + if (REISERFS_I(dir)->i_acl_default && !IS_ERR(REISERFS_I(dir)->i_acl_default)) { reiserfs_write_unlock_xattrs(dir->i_sb); iput(inode); reiserfs_write_lock_xattrs(dir->i_sb); ---snap

2 2

Fwd: Unzulässiger Anhang - Positivliste <KBS>
by miguel gmail 10 Nov '05

10 Nov '05

Sorry, list, my first two mails to the list (been listening for a long while), and always get this mail back. My knowledge of German is as closer to null as you wish. What is about? SPAM? Thanks! ---------- Forwarded message ---------- From: mailcheck(a)kbs.de <mailcheck(a)kbs.de> Date: Nov 10, 2005 12:07 PM Subject: Unzulässiger Anhang - Positivliste <KBS> To: miguel.listas(a)gmail.com GROUP Watchdog Server: bknns_02 ----------------------------------------------------------------------- Die von Ihnen mit einem oder mehreren Dateianhängen versandte E-Mail konnte nicht bzw. nur unvollständig zugestellt werden. Um eine sichere Zustellung Ihrer E-Mail zu gewährleisten, werden Sie gebeten, sich vor dem erneuten Versenden mit der knappschaftlichen Mail-Prüfinstanz ( mailto:mailcheck@kbs.de) in Verbindung zu setzten. Mitarbeiter der Bundesknappschaft erhalten weitere Informationen im Laufwerk I:\E-Mail\Weiterleitung.doc oder über eine der folgenden Telefonnummern: 61090 - 83110 - 61180 ----------------------------------------------------------------------- Mail-Info From: miguel gmail <miguel.listas(a)gmail.com> CC: SuSE-Security <suse-security(a)suse.com> Rec.: holger.winkler(a)bundesknappschaft.de Date: 10.11.2005 12:09:40 Subject: Re: [suse-security] safety with scp [KBS checked] ----------------------------------------------------------------------- Datei ist nicht erlaubt tkmime01 -- Saludos, miguel

2 1

clamav-0.87.1 Update
by Michael Schueller 08 Nov '05

08 Nov '05

Hello Team Security, since about a week there seems to be a new version of clamav released. Have you planned to release a upgrade for this ? Thanks for this Michael

4 3

patch.rpm vs .rpm in updating
by Max Belushkin 07 Nov '05

07 Nov '05

Hello list, I've recently set up SuSE 10.0 on a laptop and a PC. First the laptop, I ran the online update, but chose to remove the packages after the update. Then I realised I will also need to update the PC once the installation there completes, so I downloaded the relevant ".patch.rpm"s from a mirror. I conveniently placed them into the /var/lib/YaST/you/mnt/<.....> directory so YOU could find them. Well, during the online update, it didn't, and *then* I realised it downloads the full RPM packages during the update. The following questions arise: A) why download the full RPM, from what I read, the patch RPM does the same, but to an installed package? B) I renamed the .patch.rpm's to .rpm's, and YOU actually consumed that just fine. But, referring to A), does that actually have the same effect as installing a full RPM as YOU does? I would be grateful for any pointers, thank you!

2 1

VPS & Firewall problem
by Marek Mikuliszyn 04 Nov '05

04 Nov '05

Hello everyone! I've got a burning problem with my VPS running under SuSE with Plesk. Well... I've tried to configure firewall thru YaST tool and I configured sth badly cause I lost access to my server. No problem, I though cause I still could switch to Repair Mode with Plesk... so I did. But the problem is, that when I'm changing anything while under Repair Mode, after restart all changes are changing back to old/bad ones :/ I've tried to edit /etc/sysconfig/SuSEfirewall2 or even delete firwall script from /init.d/ with no effect - files are returning after restart. My question is: Could someone please tell me how to turn off this damn SuSEfirewall and configure firewall in future only thru iptables ? -- greetings, Marek Mikuliszyn

2 2

privacy of environment variables
by Bob Vickers 03 Nov '05

03 Nov '05

I have a question about privacy of environment variables. I was always brought up to believe that you must never store passwords or other sensitive information in environment variables, because the environment is visible to other users. This is certainly true on older Unix systems. But a colleague did some experiments (on SuSE 9.3) and found that ps only displays the environment for processes you own, which seems very sensible. Likewise /proc/pid/environ is only readable by the owner (or by root, of course). Now I don't want to rely on experiments, because there may be some other mechanism I haven't thought of. Can anyone point me to some authoritative information about the privacy of environment variables on modern Linux systems? The reason I ask is that my colleague is writing a script which will run rpcclient and smbclient. One option would be to use Expect, but environment variables are a much cleaner and simpler solution providing they are safe. Many thanks, Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London

4 3