March 2005 - openSUSE Security - openSUSE Mailing Lists

(SUSE-SA:2005:018)
by tshilson＠mmm.com 25 Mar '05

25 Mar '05

I looked at this announcement and did not find how to get the update files for my SuSE SLES 8 on zSeries. Do I need to look elsewhere for the updates? Thanks, tom - - - - - - - - - - - - Toto, I have a feeling we're not in the mainframe world any more. _/) Tom Shilson ~~~~~ Unix Team / IT Server Services Aloha Tel: 651-733-7591 tshilson at mmm dot com Fax: 651-736-7689

2 1

update process
by suse 25 Mar '05

25 Mar '05

Please, point me to manual about suse update process. We have a set of machines running suse 9.1 and want to have exact copy of ftp.suse.com/pub/suse/i386/update/9.1/ in local dir (local mirror), we are using wget, but it does not remove files absent in mentioned location. Sorry for pretty dumb question, we have no time to google/etc, just help if you can.

3 2

Re: [suse-security] mysql and kernelupdates
by Philippe Vogel 24 Mar '05

24 Mar '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 O.K. Then I was too fast and have to wait a little more time. Funny is I use Göttingen and got different types of machines which got different updates (2x smp (p3/p4), 2x single cpu (p3/p4)). On one I didn't get mysql and kernel, but on the others I got all updates. This looks a littlebit strange for me. That's the reason why I asked. Philippe Arjen de Korte schrieb: > Philippe Vogel schreef: > >> There are several exploits in the described packages, but why >> aren't there any packages for YOU or am I too fast with my >> conclusion? > > > Way too fast. Not all the mirrors are updated and that's probably > why YOU is not seeing the updates. But if you look at the (really > slow at the moment) SuSE ftp servers, the packages are there. The > GWD Göttingen servers are usually pretty fast in picking them up > and generally give better throughput (just finished downloading > them from there). > > Regards, Arjen > - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQkMgx0Ng1DRVIGjBAQIJZwb/aN/rAj6eH3YLjCMTckfJPSDKCKQGvD0y btGoAgxe7jGjA/46kNzrcvpxYjMmE8D3tQM7OkRCTNFnOtu3fk2li0gfLV87rlvg hBnwAJauPF8DjhBJd9rBZKSOn4k5Z4YDGztnewGUr0PkvjBw/F2FHMbhhMdMV/ec S3+BG6I537IU9UwyqzKPJBxMz+hwIl2f76u0herCw8OD/Jc3qvflisJJ/SvC8aTz QUeC8bEFoaj3RpsMkpmK2GMFEaoQ5IotecfF06DJB4DzBfjuHk3kae/OAwQyF5jK N5WqPNC1pqo= =tfY9 -----END PGP SIGNATURE-----

1 0

Re: [suse-security] heimdal (kerberos) with openssh
by paul kaiser 24 Mar '05

24 Mar '05

i created a principals in the database using kadmin -l. i copied the information regarding the local host to /etc/krb5.keytab and /etc/srvtab on each local host using ktutil get. from reading the literature i am assuming /etc/krb5.keytab contains only the principals for that particular host, and not the principals for every host. --- Roland Kuhn <rkuhn(a)e18.physik.tu-muenchen.de> wrote: > Hi Paul! > > On Mar 23, 2005, at 5:36 PM, paul kaiser wrote: > > > i am using suse professional 9.1. > > > > i have installed heimdal (kerberos) from the distribution cdroms on a > > realm > > server. i have installed openssh from the distribution cdroms on all > > hosts. > > all the hosts are kerberos clients > > > > authentication and ticket granting appear to be working fine on all > > hosts. > > if i am reading the suse manual correctly, i should be able to slogin > > between > > hosts without being asked for a password. > > > > this is actually working from any host to the kerberos server! > > however, slogin from the server to any other host > > and slogin between any two (non-server) hosts prompts for a password. > > > > i have recompiled openssh > > --with-pam --with-kerberos5=/usr/lib/heimdal > > but to no avail. the same prompting for password occurs. > > > > any suggestions would be appreciated! > > Have you created host principals and stored the relevant keystashes on > the respective hosts? > > Ciao, > Roland > > -- > TU Muenchen, Physik-Department E18, James-Franck-Str. 85747 Garching > Telefon 089/289-12592; Telefax 089/289-12570 > -- > A mouse is a device used to point at > the xterm you want to type in. > Kim Alm on a.s.r. > __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/

2 1

Re: [suse-security] heimdal (kerberos) with openssh
by paul kaiser 24 Mar '05

24 Mar '05

usePAM is set to YES i should also mention i am running 2.6 kernel. i know that causes problems for openAFS clients. thanks for your assistance. --- Mike Rose <mr349(a)cam.ac.uk> wrote: > > Not sure this is what you need, but have you set: > > usePAM YES > > in /etc/ssh/sshd_config > > undocumented config parameter - well done openssh! > > > > Mike Rose > TCM & BSS Computer Officer > University of Cambridge > http://www.bio.phy.cam.ac.uk/ > http://www.tcm.phy.cam.ac.uk/ > http://www.phy.cam.ac.uk/research/bss/ > > On Wed, 23 Mar 2005, paul kaiser wrote: > > > i am using suse professional 9.1. > > > > i have installed heimdal (kerberos) from the distribution cdroms on a realm > > server. i have installed openssh from the distribution cdroms on all hosts. > > all the hosts are kerberos clients > > > > authentication and ticket granting appear to be working fine on all hosts. > > if i am reading the suse manual correctly, i should be able to slogin > between > > hosts without being asked for a password. > > > > this is actually working from any host to the kerberos server! > > however, slogin from the server to any other host > > and slogin between any two (non-server) hosts prompts for a password. > > > > i have recompiled openssh > > --with-pam --with-kerberos5=/usr/lib/heimdal > > but to no avail. the same prompting for password occurs. > > > > any suggestions would be appreciated! > > > > > > > > > > > > __________________________________ > > Do you Yahoo!? > > Yahoo! Sports - Sign up for Fantasy Baseball. > > http://baseball.fantasysports.yahoo.com/ > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > > __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/

1 0

heimdal (kerberos) with openssh
by paul kaiser 24 Mar '05

24 Mar '05

i am using suse professional 9.1. i have installed heimdal (kerberos) from the distribution cdroms on a realm server. i have installed openssh from the distribution cdroms on all hosts. all the hosts are kerberos clients authentication and ticket granting appear to be working fine on all hosts. if i am reading the suse manual correctly, i should be able to slogin between hosts without being asked for a password. this is actually working from any host to the kerberos server! however, slogin from the server to any other host and slogin between any two (non-server) hosts prompts for a password. i have recompiled openssh --with-pam --with-kerberos5=/usr/lib/heimdal but to no avail. the same prompting for password occurs. any suggestions would be appreciated! __________________________________ Do you Yahoo!? Yahoo! Sports - Sign up for Fantasy Baseball. http://baseball.fantasysports.yahoo.com/

3 2

Enabling bittorrent in Suse 9.2 Firewall via Yast
by Thomas Frayne 24 Mar '05

24 Mar '05

I have a home laptop computer with Suse 9.2 installed, and with the default firewall configuration and no services enabled. I want to download the Knoppix iso using bittorent. To do this, I need to install bittorrent and enable the firewall to use it in Suse 9.2. I would prefer to use Yast to change the firewall configuration, but I don't know how. The bittorrent documatation indicates that I should insert the iptables rule iptables -t nat -I PREROUTING -p tcp --dport 6881:6889 -j DNAT --to- destination <host> I think that this is to open the firewall to allow other machines participating in the bittorrent download to send me parts of the iso file and get parts from me that I have already received. Is that right? I looked at Yast Firewall Configuration: Services/Edit additional services, and found that I could open ports 6881:6889 for tcp, but I don't see how to limit the uses of these ports to bittorrent. Does this have to be done? Is there a way to do it via Yast? If not, what is the best way to do a temporary iptables change to enable bittorrent without letting anything else into my computer? Should I use a script file to enable/disable bittorrent? Where should I look for information that will answer these questions?

2 1

RE: [suse-security] OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 23 Mar '05

23 Mar '05

> -----Original Message----- > From: edwin [mailto:edwin@nsi.co.id] > Sent: Wednesday, March 23, 2005 3:31 PM > > I implement same thing with no problem. > What is firewall you use? > Before go to squid.conf I think better to check the firewall. > firewall is ok > ifconfig eth0:1 your_external_IP_but_different_from_proxy_IP > > after that you should forward all the request to > your_external_IP_but_different_from_proxy_IP port https port forward > it to your internal_OWA_IP port 80 or 443, set this on your firewall > configuration u meen nat right ? think thats my last problem now. i can enter username and password but after that i get redirected too the private ip, funny, private ip on the net. but nat isnt the way i want to go, if i handle it that way no squid needed and its a direct access to the internal lan. isnt there any other way ? or im complete wrong ?

2 1

OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 23 Mar '05

23 Mar '05

hi there, after reading multible sites over a long time i hope im getting help via this list, im running crazy here sheme: client (www) -> squid (www - public ip) -> firewall -> owa (lan - private ip) squid.conf: visible_hostname host.domain.tld https_port 443 cert=/etc/squid/server.crt key=/etc/squid/server.key hosts_file /etc/squid/hosts http_port 127.0.0.1:8080 httpd_accel_host srv066 httpd_accel_port 80 httpd_accel_uses_host_header off httpd_accel_single_host on httpd_accel_with_proxy off acl acl_testmail dstdomain srv066 http_access allow acl_testmail acl to_index urlpath_regex /$ acl to_favicon urlpath_regex /favicon.ico$ acl to_exchange urlpath_regex /exchange http_access allow to_index http_access allow to_favicon http_access allow to_exchange acl all src 0.0.0.0/0.0.0.0 header_access Accept-Encoding deny all never_direct allow all http_access deny all when i try the connect via https://host.domain.tld, the following error ocoured: While trying to retrieve the URL: http://srv066 The following error was encountered: * Unable to forward this request at this time. This request could not be forwarded to the origin server or to any parent caches. The most likely cause for this error is that: * The cache administrator does not allow this cache to make direct connections to origin servers, and * All configured parent caches are currently unreachable. its an urgent problem, so i hope getting help here greetings andy --free your mind, use open source http://www.mono-project.com ASCII ribbon campaign ( ) - against HTML email X & vCards / \

3 2

RE: [suse-security] OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 23 Mar '05

23 Mar '05

> -----Original Message----- > From: Philippe Vogel [mailto:filiaap@freenet.de] > Sent: Wednesday, March 23, 2005 1:05 PM > What about port-acls? > > #Recommended minimum configuration: > #acl all src 0.0.0.0/0.0.0.0 > #acl manager proto cache_object > #acl localhost src 127.0.0.1/255.255.255.255 > #acl SSL_ports port 443 563 > #acl Safe_ports port 80 # http > #acl Safe_ports port 21 # ftp > #acl Safe_ports port 443 563 # https, snews > #acl Safe_ports port 70 # gopher > #acl Safe_ports port 210 # wais > #acl Safe_ports port 1025-65535 # unregistered ports > #acl Safe_ports port 280 # http-mgmt > #acl Safe_ports port 488 # gss-http > #acl Safe_ports port 591 # filemaker > #acl Safe_ports port 777 # multiling http > #acl CONNECT method CONNECT sure my fool, added now to conf > Point #1: Before getting access to any port it is useful to get > correct acls for all used ports. > > Point #2: Is there a listen-port configured to let your squid run on > https-port? sure: https_port 443 cert=/etc/squid/server.crt key=/etc/squid/server.key > Point #3: Is there a reason in caching https-content as this is > insecure as https should not be cached!? now my english have an break ... > Point #4: I would do this with safe ports: > > http_access deny !Safe_ports > http_access deny CONNECT !SSL_ports right ... added to squid.conf: extension_methods SEARCH PROPFIND PROPATCH MKCOL MOVE BMOVE DELETE BDELETE BPROPFIND BPROPATCH REPORT the connect now works but i dont recieve the formular login on 443 from outlook web access. clients moves to https://host.domain.tld/exchange request tp accept certificate (from squid), long load following and after a while it breaks with: While trying to retrieve the URL: http://srv066:443/exchange The following error was encountered: * Connection Failed The system returned: (111) Connection refused The remote host or network may be down. Please try the request again. problem i see there: its http and not https, and https is needed anyone knows if there if there changes on the owa to do ? actual config looks like this: visible_hostname host.domain.tld https_port 443 cert=/etc/squid/server.crt key=/etc/squid/server.key hosts_file /etc/squid/hosts http_port 127.0.0.1:8080 httpd_accel_host srv066 httpd_accel_port 443 httpd_accel_uses_host_header off httpd_accel_single_host on httpd_accel_with_proxy off acl acl_testmail dstdomain srv066 http_access allow acl_testmail acl to_index urlpath_regex /$ acl to_favicon urlpath_regex /favicon.ico$ acl to_exchange urlpath_regex /exchange http_access allow to_index http_access allow to_favicon http_access allow to_exchange acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl SSL_ports port 443 563 acl Safe_ports port 80 8080 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 563 # https, snews acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl Safe_ports port 3401 # snmp acl CONNECT method CONNECT http_access allow all http_access allow SSL_ports http_access deny !Safe_ports extension_methods SEARCH PROPFIND PROPATCH MKCOL MOVE BMOVE DELETE BDELETE BPROPFIND BPROPATCH REPORT

1 0