April 2005 - openSUSE Security - openSUSE Mailing Lists

How do I run multiple syslogd daemons in SuSE Linux 9.1 Pro?
by Escudero, Peter Louis 08 Apr '05

08 Apr '05

I have a Dell PE1750 running SuSE Linux 9.1 Pro, which I'd like to turn into a syslog server. Since I can only have 8 local facilities (local0 - local7), which are not enough for all the devices we have on the network, I need to run multiple syslogd daemons. Is this feasible, & how do I do it? Any info you can provide will be greatly appreciated. Peter Escudero

3 3

Re: [suse-security] Open Source Protocol Analyzers
by Duain_Christensen＠bcbsil.com 08 Apr '05

08 Apr '05

Try snort. It is free. I think the url is www.snort.org. It is a full fledged network intrusion detection system. Duain ----- Original Message ----- From: "Lucky Leavell" [susesec(a)UniXpress.com] Sent: 04/07/2005 07:29 PM To: suse-security(a)suse.com Subject: [suse-security] Open Source Protocol Analyzers OS: SuSE 9.2 Pro We are currently using ethereal to analyze various attacks on our network but it is rather time consuming and we were wondering if there are any good protocol analyzers out there which can summarize and present the results. The commercial appliance NetVCR looks good but with a starting price of $US 10,000, it is WAY beyond our means. Thank you, Lucky Leavell -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here ------------------------------------------------------------------------------ ********** The information contained in this communication is confidential, private, proprietary, or otherwise privileged and is intended only for the use of the addressee. Unauthorized use, disclosure, distribution or copying is strictly prohibited and may be unlawful. If you have received this communication in error, please notify the sender immediately at (312)653-6000 in Illinois; (972)766-6900 in Texas; or (800)835-8699 in New Mexico. ********** ==============================================================================

1 0

RE: [suse-security] Choice of Security Scanners
by Baenen Eric P Contr AFRL/HEC 07 Apr '05

07 Apr '05

We use Nessus here in our local environment and love it... and it's WAY cheaper than ISS... ;-) ...I've never been a big fan of ISS. Another good commercial product though is STAT - I've used this before for some time. http://www.stat.harris.com/index.asp More polished than Nessus - but also a lot more expensive - we eventually dropped it because Nessus does the job quite adequately for free. Or I've heard good things about Sunbelt Software's Network Security Inspector http://www.sunbeltsoftware.com/SunbeltNetworkSecurityInspector.cfm Hope this helps. Eric Eric Baenen Program Manager - Scientific Network Environments General Dynamics - Advanced Information Systems Phone: 937-255-8180 FAX: 937-255-8845 2255 H Street (AFRL/HEC) Area B Bldg 248 Rm 108 Wright Patterson AFB, OH 45433 -----Original Message----- From: tshilson(a)mmm.com [mailto:tshilson@mmm.com] Sent: Thursday, April 07, 2005 3:28 PM To: suse-security(a)suse.com Subject: [suse-security] Choice of Security Scanners We are setting up a formal security scanning program for Lintel and Lin-z (Linux on zSeries) systems. The favored scanner is ISS because that is what we use for our Windows systems. I understand that Nessus is a better choice for Linux systems. What scanners are you using and what do you see as the strong and weak points? If you reply to me off-list I will publish a summary next week. Thanks tom - - - - - - - - - - - - Toto, I have a feeling we're not in the mainframe world any more. _/) Tom Shilson ~~~~~ Unix Team / IT Server Services Aloha Tel: 651-733-7591 tshilson at mmm dot com Fax: 651-736-7689 -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Choice of Security Scanners
by tshilson＠mmm.com 07 Apr '05

07 Apr '05

We are setting up a formal security scanning program for Lintel and Lin-z (Linux on zSeries) systems. The favored scanner is ISS because that is what we use for our Windows systems. I understand that Nessus is a better choice for Linux systems. What scanners are you using and what do you see as the strong and weak points? If you reply to me off-list I will publish a summary next week. Thanks tom - - - - - - - - - - - - Toto, I have a feeling we're not in the mainframe world any more. _/) Tom Shilson ~~~~~ Unix Team / IT Server Services Aloha Tel: 651-733-7591 tshilson at mmm dot com Fax: 651-736-7689

1 0

SuSE Firewall, specific deny
by Pablo Ronco 07 Apr '05

07 Apr '05

I´ve set a rule to allow masquerading for some hosts and some nets for some services i.e.: web access for my net 172.16.4.0/23 FW_MASQ_NETS="172.16.4.0/23,0/0,tcp,80 172.16.4.0/23,0/0,tcp,443" The thing is that I need to deny some specific host, for example 172.16.4.43 from been able to access the web. How do I configure this without specifying each one allowed?? Other question, SuSEfirewall 2 is a statefull packet filter firewall, is it the any special treatment for FTP passive and active connections? What I mean is that the firewall has to be able to open the TCP port dynamically defined during the FTP session stablishment. Regards, Pablo Ronco

1 0

fresh software on suse's site
by John 07 Apr '05

07 Apr '05

Hi all I am wondering if suse maintains in a rpm mode all the new software that is being created. For example the new php 4.10, mysql 4.11 thanks in advance.

5 6

Location of vmlinuz with EVMS
by Jose_Thomas＠Dell.com 06 Apr '05

06 Apr '05

Greetings, Install SLES 9 with EVMS option select gave me the following problem. With YaST, created a primary partition for /boot and grant 500MB space. Then create Logical Volumes (four volumes, namely swap, root, usr and home)under 0x8E being selected. Installation was successful, but when the System comes up /boot appears to be empty. Tried to locate vmlinuz, but failed to see anywhere in the system. However, if update the system with say new kernel, then the new vmlinuz will be created under /boot. But after the reboot the new kernel vanishes from /boot and SLES comes up with the old kernel. (The upgradation was performed with just rpm -Uvh kernel...) One more point is, if we run "evmsgui" to mount /boot partition then it was able to mount. Is something wrong with the observation? Will it be any kind of security issue? Hope somebody can clarify. TIA Jose

2 1

RE: [suse-security] fresh software on suse's site
by Baenen Eric P Contr AFRL/HEC 06 Apr '05

06 Apr '05

>From my page at https://www.washingtoncreek.com:4432/tiki/tiki-index.php?page=suse-rpms To find rpm packages... These are all good sites... http://www.usr-local-bin.org/linux.php http://packman.links2linux.org/ http://search.rpmseek.com/search.html?hl=com http://rpm.pbone.net/index.php3/stat/2/simple/2 BUT... even better is APT... http://linux01.gwdg.de/apt4rpm/ for SUSE 9.2 as an example, install these rpms ftp://ftp.gwdg.de/pub/linux/suse/apt/SuSE/9.2-i386/RPMS.suser-rbos/apt-0.5.15cnc7-0.suse092.rb0.i586.rpm ftp://ftp.gwdg.de/pub/linux/suse/apt/SuSE/9.2-i386/RPMS.suser-rbos/apt-devel-0.5.15cnc7-0.suse092.rb0.i586.rpm ftp://ftp.gwdg.de/pub/linux/suse/apt/SuSE/9.2-i386/RPMS.suser-rbos/apt-libs-0.5.15cnc7-0.suse092.rb0.i586.rpm just download them into a directory and as root at the command line type 'rpm -ivh apt*' and let rpm decide which order they need to be installed. Then copy http://ftp.gwdg.de/pub/linux/suse/apt/SuSE/9.2-i386/examples/sources.list.F… to /etc/apt as sources.list (copy the existing sources.list to something like sources.list.original just in case something goes wrong) You might want to edit this new sources.list and remove the entries for 'kernel-of-the-day' and 'kde-unstable' (highly recommended) Notice it will catch all the rpms from Packman, Funktronics, and many 'unofficial' packages from SUSE itself (suse-people, suse-projects) then as root at a command line do 'apt update' once that's done... 'apt search packagename' to find a package 'apt install packagename' (in some cases you might need to do 'apt install --no-checksig packagename' if they don't have a signature listed) apt takes care of all the dependencies - if the package you want needs other packages they will be retrieved and everything will be installed in the proper order. For security purposes - you can create a sources.list with just 'rpmkeys base update-drpm update-prpm update security-prpm security' or even just 'rpmkeys base security-prpm security' and then create a cronjob for root that does an 'apt upgrade' each night. APT will become your best friend for finding packages, installing packages and keeping packages current. Eric Eric Baenen Program Manager - Scientific Network Environments General Dynamics - Advanced Information Systems Phone: 937-255-8180 FAX: 937-255-8845 2255 H Street (AFRL/HEC) Area B Bldg 248 Rm 108 Wright Patterson AFB, OH 45433 -----Original Message----- From: John [mailto:isofroni@cc.uoi.gr] Sent: Wednesday, April 06, 2005 4:30 AM To: suse-security(a)suse.com Subject: [suse-security] fresh software on suse's site Hi all I am wondering if suse maintains in a rpm mode all the new software that is being created. For example the new php 4.10, mysql 4.11 thanks in advance. -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

4 3

RE: [suse-security] fresh software on suse's site
by Baenen Eric P Contr AFRL/HEC 06 Apr '05

06 Apr '05

-----Original Message----- From: Marcus Meissner [mailto:meissner@suse.de] Sent: Wednesday, April 06, 2005 12:42 PM To: Baenen Eric P Contr AFRL/HEC Cc: Bob Vickers; suse-security(a)suse.com Subject: Re: [suse-security] fresh software on suse's site <SNIP> Actually the critical parts of the Firefox 1.0.2 patches are already in the previous Firefox update release. Eric> Very cool - I wasn't aware of this. And the number of Mozilla problems is just staggering currently, we have finished one update when the next issue is there already. Eric> If you are lucky enough to be dealing only with Linux machines - that is part of the beauty of Linux... Eric> So many easy ways of dealing with this in an enterprise environment. Eric> Novell's own ZENworks for system/application/patch management (good for mixed environments too) Eric> Setting YOU to auto patch nightly (or weekly) -- if only YOU could be configured to do only security patches nightly, but everything else on a case by case basis Eric> Have machines mount /opt or another designated apps directory (/usr/local/, etc.) from an NFS server - patch/update once on the NFS server - every machine mounting the volume is instantly 'patched' Eric> Using APT to patch nightly, weekly or whatever schedule or method you want to script Eric> Using cron and scripts to patch/install whatever you want whenever you want across the environment without ever having to touch a machine physically

1 0

RE: [suse-security] fresh software on suse's site
by Baenen Eric P Contr AFRL/HEC 06 Apr '05

06 Apr '05

Novell/SUSE is a great company - but they are not the fastest when it comes to releasing new versions with the latest security patches. For example - everyone should upgrade to Firefox 1.0.2 and Thunderbird 1.0.2 because of the latest security vulnerabilities. They're not available via YaST/YOU yet - but they are available via the APT repository - and those are just two examples. If you subscribe for example to Secunia security advisories (http://secunia.com/secunia_security_advisories/) - security patched versions for the identified vulnerabilities are generally available on the APT repository for SUSE a fair amount before SUSE officially pushes them out via YOU. Depends on how paranoid you are - whether you are willing to wait for the official versions from SUSE or get the latest patches sooner via APT (and admittedly take your chances with the stability of the apps - occassionally less stable than the official versions that come later). Eric Eric Baenen Program Manager - Scientific Network Environments General Dynamics - Advanced Information Systems Phone: 937-255-8180 FAX: 937-255-8845 2255 H Street (AFRL/HEC) Area B Bldg 248 Rm 108 Wright Patterson AFB, OH 45433 -----Original Message----- From: Bob Vickers [mailto:bobv@cs.rhul.ac.uk] Sent: Wednesday, April 06, 2005 10:43 AM To: suse-security(a)suse.com Subject: RE: [suse-security] fresh software on suse's site I'm puzzled as to what this advice is doing on a security list. Installing random pieces of software may make your computer funkier and more exciting to use but it definitely won't make it more secure. My advice (for an important machine) would be never touch an RPM unless it is an official SuSE one. If you want extra software install it by hand in /usr/local or some other place that is different from the places SuSE install software. Bob On Wed, 6 Apr 2005, Baenen Eric P Contr AFRL/HEC wrote: > > >From my page at https://www.washingtoncreek.com:4432/tiki/tiki-index.php?page=suse-rpms > > To find rpm packages... > > These are all good sites... > http://www.usr-local-bin.org/linux.php > > http://packman.links2linux.org/ > > http://search.rpmseek.com/search.html?hl=com > > http://rpm.pbone.net/index.php3/stat/2/simple/2 > > BUT... even better is APT... > > http://linux01.gwdg.de/apt4rpm/ > > for SUSE 9.2 as an example, install these rpms > ftp://ftp.gwdg.de/pub/linux/suse/apt/SuSE/9.2-i386/RPMS.suser-rbos/apt-0.5.15cnc7-0.suse092.rb0.i586.rpm > ftp://ftp.gwdg.de/pub/linux/suse/apt/SuSE/9.2-i386/RPMS.suser-rbos/apt-devel-0.5.15cnc7-0.suse092.rb0.i586.rpm > ftp://ftp.gwdg.de/pub/linux/suse/apt/SuSE/9.2-i386/RPMS.suser-rbos/apt-libs-0.5.15cnc7-0.suse092.rb0.i586.rpm > > just download them into a directory and as root at the command line type 'rpm -ivh apt*' and let rpm decide which order they need to be installed. > > Then copy > http://ftp.gwdg.de/pub/linux/suse/apt/SuSE/9.2-i386/examples/sources.list.F… > to /etc/apt as sources.list (copy the existing sources.list to something like sources.list.original just in case something goes wrong) > > You might want to edit this new sources.list and remove the entries for 'kernel-of-the-day' and 'kde-unstable' (highly recommended) > > Notice it will catch all the rpms from Packman, Funktronics, and many 'unofficial' packages from SUSE itself (suse-people, suse-projects) > > then as root at a command line do 'apt update' > > once that's done... > > 'apt search packagename' to find a package > > 'apt install packagename' (in some cases you might need to do 'apt install --no-checksig packagename' if they don't have a signature listed) > > apt takes care of all the dependencies - if the package you want needs other packages they will be retrieved and everything will be installed in the proper order. > > For security purposes - you can create a sources.list with just 'rpmkeys base update-drpm update-prpm update security-prpm security' or even just 'rpmkeys base security-prpm security' and then create a cronjob for root that does an 'apt upgrade' each night. > > APT will become your best friend for finding packages, installing packages and keeping packages current. > -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1