May 2005 - openSUSE Security - openSUSE Mailing Lists

Mozilla-release for 9.1 / 9.0...
by pelibali 06 Jun '05

06 Jun '05

Hi, After I saw today the newest MozillaFirefox release 1.0.4 appearing on a YOU server for SUSE 9.1; really hope, that the about 3 weeks ago promised mozilla-related packages will be also released for SUSE 9.1 and 9.0 (maybe last shot for 8.2?): http://www.novell.com/linux/security/advisories/2005_28_mozilla_firefox.html Would be possible to know please, that was it just seemingly skipped or let's say shifted because new vulnerabilities? Interestingly in both http://www.novell.com/linux/security/advisories/2005_12_sr.html http://www.novell.com/linux/security/advisories/2005_13_sr.html there was not a single word about that. Best regards, Pelibali

2 1

Why has IPv6 support worsend in SUSE 9.3
by Arjen Runsink 01 Jun '05

01 Jun '05

L.S. Does anyone know why IPv6 support has moved backwards in SUSE 9.3? This has made me seriously move to *BSD for my SOHO firewall/router/server box. It was almoste perfect in 9.2 but in 9.3 we are back to a level that looks like pre millenium support for IPv4!! BB, Arjen

3 3

Fou4s 0.13.1 released
by Markus Gaugusch 31 May '05

31 May '05

Hi! I've fixed a bug reported and analyzed by Bjorn Tore Sund, which caused i586 packages to be installed on an x86_64 machine. This is only relevant for packages which have been installed with fou4s-0.13.0 on x86_64 machines. Everyone else has no problem and there are not other changes. (I would still upgrade every machine, because the internal rpmcache version has changed and import/export functionality depends on equal cache versions). To find out if fou4s has installed a wrong package, please run the following command: rpm -qa --qf "%{INSTALLTIME} %{NAME}-%{VERSION} %{ARCH}\n" | sort -n Look at the lines below the latest fou4s update and check the arch. I'm really sorry for any inconvenience this may have caused, but I don't have access to any x86_64 machines. As we have discussed on fou4s-devel, I'm open for any sponsoring in that area [1]. Fou4s development has been a lot of fun, but apart from the great guys at selfnet.at who offer me free hosting, it hasn't produced any real benefit yet. Encouraging comments are still very welcome, though :-) Markus Gaugusch http://fou4s.gaugusch.at/ [1] http://fou4s.gaugusch.at/archives/fou4s-devel/2005-May/000439.html PS: The --arch parameter is not yet fixed, but on the TODO list ... -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \

1 0

ServerTokens Directive Apache with SLOX4.1
by steve nutt 31 May '05

31 May '05

Hello: I am trying to reduce the amount of information given out when someone tries to Banner Grab for Version information. I read that "ServerToken" directive in httpd.conf file will limit the amount of information given out. First off I didn't find the "ServerToken" in the httpd.conf with a search. So I added it in the Global Setting section (where I found it on RedHat box). Set it to "ServerToken Prod" or "OS" or "Min" no quotation marks of course. I found "ServerSignature On" changed it to "Off", restarted httpd, and then ran "HEAD / HTTP/1.0" and it still comes back with HEAD / HTTP/1.0 200 OK Content-Length: 720 Content-Type: text/html Last-Modified: Wed, 11 May 2005 20:16:21 GMT Client-Date: Tue, 31 May 2005 04:49:32 GMT 404 Not Found Date: Tue, 31 May 2005 04:31:44 GMT Server: Apache/2.0.49 (Unix) PHP/4.3.9 # How do I get rid of this an say something else Content-Length: 1335 Content-Type: text/html; charset=ISO-8859-1 Client-Date: Tue, 31 May 2005 04:49:33 GMT Client-Response-Num: 1 Proxy-Connection: close X-Cache: MISS from firewall.domainname X-Powered-By: PHP/4.3.9 # How do I get rid of this and say something else I guess my question should be what controls the amount of information given out ServerTokens, ServerSignature, or something else? And to configure these items do I make my changes in the httpd.conf, or httpd.conf.SuSEconfig, or in /etc/sysconfig/apache? Which file and variable controls what gets displayed. I have made changes to SeverTokens and ServerSignature in httpd.conf and httpd.conf.SuSEconfig, and HTTPD_SEC_SAY_FULLNAME directive to "no" in /etc/sysconfig/apache at different times and then restarted the httpd with rchttpd restart, and then did the "HEAD / HTTP/1.0" from the command line and I always get the above with no changes. What AM I DOING WRONG? Any help here would be appreciated. Thanks: Steve

2 1

unsubscrive
by Profunser Andreas TSN 31 May '05

31 May '05

unsubscribe

4 3

url redirected
by Gary Saptaputra 31 May '05

31 May '05

Hi, Is there a tools that can check whether your suse box got hacked or not? It's suse enterprise 9. Whenever I tried to access my webpage hosted on suse box, I always get redirected to external website. It looked like someone has been intercepting the request. Hope anyone can give me some insight on how to get rid of this. Thks. __________________________________________________ Do You Yahoo!? Download the latest ringtones, games, and more! http://sg.mobile.yahoo.com

4 3

*****SPAM***** [suse-security] Mail server access fine from outside, not inside
by Antonio Montani Jimenez 30 May '05

30 May '05

Greetings, i have a webpage and a mail server accesible from the internet. However, i cant access both of them internally using my public adress, i have to access it through the internal address, 192.168..... is it a firewall problem, i presume... but i havent fdigured it out... i tried dnating anything going to my public adress from anywhere to be forwarded to the mail server, and it works from the outside, but not on the inside. any suggestions? thanks in advance �Tienes alguna duda en tu VIDA? www.howstuffworks.comIf You Ask Me A Fu**in' Question You'd Better Be Prepared For The AnswerNoel GallagherOasis Frontman17/10/02 __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new Resources site http://smallbusiness.yahoo.com/resources/

2 1

Questions about patch levels
by steve nutt 28 May '05

28 May '05

Hello, Can anyone on this list refer me to a document that explains how SUSE patch version works? For instance we have a SLOX 4.1 mail server that is based in part on Suse Enterprise Server 8.0 and United Linux that is running apache-1.3.26-163. Now this is a very old version of apache but what is the 163 exactly? I need to know if this version is still vulnerable. How do I know what was fixed within this version, and for that matter earlier versions. This particular apache version 1.3.26 has a lot of problems. Our scanner is lighting up like a Christmas tree everytime it is scanned. It is fully patched but !!!!! Someone said the fix is back ported or something. What is backported mean. Why dont they just upgrade to the newer version with the fix? How do you know what fixed what? I need some help. Ive got a boss that is on me to get his figured out. Is there a document or a database that will tell me if a particular vulnerability has been patched and what version did it. Thanks Steve

2 1

watching freeradius server with bigsister
by Sebastian Uhlig - ICA 27 May '05

27 May '05

Hello list, I mabye off topic so please answer to my private e-mail address. I try to add my radius server to the uxmon-net file of my big sister installation. host.example.com(host_example_com) secret="XYZ" port="1812" user="username" pass="xyz" time="5" radius Also I installed the Athen::Radius Modul from CPAN, rebooted the server, cleared the caches, but I didn't seem to work. If I try the user account manual through radtest from the bigsister server it works without any problems. Any ideas or a mission impossible? Thanks in advantage. Sebastian

1 0

Broken update
by Bjorn Tore Sund 27 May '05

27 May '05

Given that the maintenance info is out for SLES and the packages are coming in with fou4s and YOU I assume the security announcement for libtiff is pending soon. The rpms for SuSE 9.2 x86-64 are broken. The libtiff rpm tries to put files in /usr/lib, in conflict with libtiff-32bit - the files should be going into /usr/lib64. I recommend not forcing the updates in, but waiting for the fixed packages from SuSE - which I assume are on their way? Lots of stuff may otherwise be broken... Bjørn -- Bjørn Tore Sund Phone: (+47) 555-84894 Stupidity is like a System administrator Fax: (+47) 555-89672 fractal; universal and Math. Department Mobile: (+47) 918 68075 infinitely repetitive. University of Bergen VIP: 81724 Support: system(a)mi.uib.no Contact: teknisk(a)mi.uib.no Direct: bjornts(a)mi.uib.no

2 3

Bad MD5 & GPG on XFree86 SRC
by Bernie Hoefer 26 May '05

26 May '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I noticed the x86_64 XFree86 source has a bad MD5 sum and GPG signature. I've check a mirror and get the same result. I hadn't seen anybody else mention it on the list, so I thought I'd just ask about it. === > # wget ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/XFree86-4.3.99.902-43… > > # rpm --checksig XFree86-4.3.99.902-43.42.5.src.rpm > XFree86-4.3.99.902-43.42.5.src.rpm: sha1 MD5 GPG NOT OK === - -- Bernie Hoefer PGP e-mail is welcome! Get my 1024 bit signature key from: <http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x446A6F93>. "The more I know, the more I realize how much I do not understand." -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFClVznckGmqURqb5MRAvMIAJ0SeG7+vHjTfcuDjv8e+1Kjcdz7cACfS2lc RKrDYAVtyTKkNgnC3tSdt9k= =bCPd -----END PGP SIGNATURE-----

2 2

RE: [suse-security] Iptables rules for nat to apache ip based virtual hosts
by Kummer, Ben 25 May '05

25 May '05

Hi Stefan, > I have got one official ip address and a dmz with an apache > webserver with ip based virtual hosts config. > iptables -t nat -A PREROUTING -i $INF -p tcp --sport 1024: -d > www.mydomain.com --dport 80 -j DNAT --to 1.2.3.4:80 > > iptables -A FORWARD -p tcp -d 1.2.3.4 --dport 80 -i $INF -j ACCEPT > > Do I need an application level gateway for this config or >From my point of view you need for each private ip an official ip to setup the ip tables solution. Either you use an application level gateway eg apache with rewrite/proxy rules to check the HTTP header, or you setup apache with named based virtual host, which should be more simple. Best regards Ben -- Ben Kummer, VDIVDE-IT, Rheinstr. 10b, 14513 Teltow Germany fon: +493328/435106 fax: +493328/435281 email:kummer@vdivde-it.de

1 0

OpenOffice_org1-1.1.3-4.2 released TWICE (?)
by pelibali 25 May '05

25 May '05

Hi, I couldn't find a logical explanation, maybe someone could help me to understand the situation: Last month the youpdated version '1.1.3-4.2' of OpenOffice_org1 was released and few days ago '1.1.3-4.3' appeared on the mirrors. Until this point everything seems be fine, but while comparing the .spec files of the above source rpms, interestingly only a single line, containing the version numbers differs in them. Is there an explanation to release the same YOU update actually twice with different version numbers or do I miss something? Thanks, Pelibali

2 1

Iptables rules for nat to apache ip based virtual hosts
by Stefan.Junge＠ssi-schaefer.de 24 May '05

24 May '05

Hello together, I have got one official ip address and a dmz with an apache webserver with ip based virtual hosts config. Now I have got the problem, that my prerouting / forward rule does not work properly. E.g. iptables -t nat -A PREROUTING -i $INF -p tcp --sport 1024: -d www.mydomain.com --dport 80 -j DNAT --to 1.2.3.4:80 iptables -A FORWARD -p tcp -d 1.2.3.4 --dport 80 -i $INF -j ACCEPT This does work for one domain. But of course any further prerouting rule is set to the first nat ip address. Do I need an application level gateway for this config or could this feature be achieved by iptables? Thanks for any advice! Regards, Stefan

1 0

Re: [suse-security] Banning dynamic IPs (Was: *SPAM* Tuerkei in die EU)
by Carlos E. R. 24 May '05

24 May '05

El 2005-05-23 a las 12:27 +0200, Rainer Duffner escribió: > Carlos, > > it's not about blocking dynamic ips sending mail (or surfing the web). > Just dynamic ips sending mail without going through a mailserver that is not > an MX! Dana Hudes said just that, block all traffic: |> Your issue is permanent blocking. This is controversial. |> The idea has been to exert pressure on ISPs whose users complain. |> This is of limited success. the idea is that if dialup and dhcp (cable, |> dsl) users found they could not access major portions of the internet |> -- not just for e-mail but web browsing as well -- then they would be |> motivated to complain to their ISPs who would act more forcefully and |> quickly against spammers etc. . If somoene could get yahoo and hotmail |> and google to "sign on" to such a program then yes there would be a |> dramatic amount of complaints. > Normaly, it should go like this: > > | customer with dyn.IP|------>|MX of provider/hoster/whoever|------>|my > | MX|<-----|me myself via IMAP on dynamic IP| > > (SMTP)................................(SMTP) > > I myself do SMTP-AUTH to allow relaying. > > OK, so I have my own mailserver - but if I didn't have that, I'd subscribe to > some online mail-service that allowed me to relay through their MX via > SMTP-AUTH. The problem, or problems, are several. For one thing, the smtp relay servers my ISPs provide are not reliable: they may fail to send an email, and worse, they don't inform me of that, or they do several days late. But even if I use the relay, they have policies that impede my use of them seriously, like only accepting email with a "From" address of theirs. Therefore, I can not send all my email through only one relay server, or not at all for redirection accounts (like sourceforge). Unfortunately, Postfix transport file does not has rules to select which relay server to choose based on the FROM address, only on the TO part. I need that feature. I was told (thanks, Arjen) to try 'esmtp' (http://esmtp.sourceforge.net/) - I've downloaded it, waiting for compilation -but a comment I read makes me afraid that it will not work well with non permanent connections. Thus, I have no alternative (yet?) but to use Postfix for direct sending. In my opinion, the best solution would be a method to really identify who is sending, regardless of the type of IP he is using. A cryptographic signature, probably, for the "FROM" header, not the contents (signing the contents is a problem with domainkeys with lists like SuSE's) At least in Spain, with a court order, it is possible to identify the spammer with the IP, because there are listings correlating each IP and timestamp to the phone used, and thus, the person responsible. > Please don't cc to the SuSE-list. Ein? You mean, email you direct, without a CC to the list? :-o I'll try, but I'm sure your server will reject my dynamic IP server. [...] Impossible, it rejected me: (host mail.** [*.*.*.26] said: 451 Dynamic IP Addresses See: http://www.dnsbl.sorbs.net/lookup.shtml?213.94.2.24 (in reply to RCPT TO command)) Thus, I resend to the list instead. Sorry. -- Saludos Carlos Robinson

3 2

RE: [suse-security] *****SPAM***** Tuerkei in die EU
by Dörfler Andreas 23 May '05

23 May '05

in general blocking ips isnt the best and blocking dynamic ips is more then a stupid idea. on another mailinglist someone wrote rules for spamassassin http://mailscanner.prolocation.net/german.cf. isnt a good idea to activate the rule forever but for a few weeks it will be ok greetings andy --free your mind, use open source http://www.mono-project.com ASCII ribbon campaign ( ) - against HTML email X & vCards / \ > -----Original Message----- > From: Robert Schiele [mailto:rschiele@uni-mannheim.de] > Sent: Thursday, May 19, 2005 6:15 AM > This list seems rather useless to me because most of these > IPs are dial-ins > and thus will change frequently. > > Robert

9 15

Spoofing email address
by Farmer, Alan 23 May '05

23 May '05

Since subscribing to this list I have been getting NDRs that indicate that someone is spoofing my email address. Has anyone else on the list noticed a similar problem? I am not suggesting that the email list has been compromised. It could be a coincidence but I thought that I would ask. Thanks

3 2

SSH connection problem
by Laboratorio Civitanova 23 May '05

23 May '05

Hi all! I've a server with six ethernet devices of the same brand. They manage six different networks. I've, also, a SuSeFirewall2 with ssh service open from the internal networks. Everything works well, but sometime I'm not able to connect to the ssh service on the server, even if it forwards the packets (http, ftp...) nicely!!!! All stranges, I noticed, were collisions on two network devices maded, probably, from a damaged switch or samething like! Who know the cause? Anyone may help me?

1 0

Fou4s 0.13.0 released
by Markus Gaugusch 22 May '05

22 May '05

Hi, Today I've released a new version of fou4s (Fast OnlineUpdate for SuSE). For everyone who has not seen it yet, it is a cron-job optimized version of YOU (YaST online update), very powerful, but still very easy to use. The latest version includes support for delta-RPMs, resulting in a much smaller download size (especially on new installations). Other fixes include improvement of source rpm handling and a better kernel update reboot notification. Markus Gaugusch http://fou4s.gaugusch.at/ -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \

1 0

Strange traffic.
by Wade Grant 20 May '05

20 May '05

I have reports of traffic hitting through a few iptable boxen that seems kind of interesting. Has anyone seen or heard of traffic on udp 1148? I am thinking it may just be some spy or mal ware. Any info you know of would be appreciated. wade G.

8 8

Strange events being triggered in Snort
by Neil Anderson 20 May '05

20 May '05

Hi, I'm hoping that someone will be able to shed some light on a bit of a strange problem I'm having with snort, snortcentre 2.x and BASE. This is a home set up so the sensor is also used for more mundane tasks like mySQL, Apache, web browsing, playing games etc. It seems that whenever the sensor makes a DNS query, it triggers an event in BASE with an SID of 9. Now, as far as I can see, event SID 9 doesn't exist. The set up is as follows: - Sensor runs SuSE 9.3 Pro with mySQL, Apache and snort - Snort is handled via SnortCentre 2.x which is configured to save alerts to an SQL database that BASE reads. - I have set $HOME_NET to be the private subnet of my LAN - I have set $EXTERNAL_NET = !$HOME_NET - Searching for SID 9 in snortcentre and on the snort webpage yields no results I have also had a look at the underlying databases. BASE's database has an entry for SID 9, but SnortCentre's doesn't. Any help or ideas would be gratefully receieved - I'm stumped. Thanks, Neil

1 0

RE: [suse-security] *****SPAM***** Tuerkei in die EU
by Carlos E. R. 20 May '05

20 May '05

Please, answer on list. If you reject dynamic adresses, I will not be able to email you direct. El 2005-05-19 a las 19:58 -0400, Dana Hudes escribió: > If the ISP didn't listen and users found they could not get to yahoo and > playboy and hotmail and 500 other of the top 1000 sites on the web because > their ISP was harboring hackers and spammers -- they would go elsewhere > and the ISP would go out of business. You are wrong. You live in a part of the world where that's may be true, but in mine I don't have so much choice, I can't go elsewhere. Many of the alternatives in fact hire resources from the main one. -- Saludos Carlos Robinson

1 0

Mozilla 1.0.4
by Anthony Edwards 19 May '05

19 May '05

RPMs for Mozilla 1.0.4 are now available at: http://ftp.suse.com/pub/projects/mozilla/firefox/1.0.4/ Are Mozilla 1.0.4 RPMs due to be made available via YOU shortly? -- Anthony Edwards anthony.edwards(a)uk.easynet.net

7 8

Re: [suse-security] *****SPAM***** Tuerkei in die EU
by Arjen Runsink 19 May '05

19 May '05

Hi ppl, > GEWALTEXZESS: > http://www.spiegel.de/politik/ausland/0,1518,345203,00.html To block this spam coming from Sober.P/Q infested windows systems there is a dnsblacklist and an ip list you can mirror if you whish. To make one thing clear. I am NOT the maintainer of these. sober-p.dnsbl.hostingxs.nl source: http://bas.dds.nl/rechtse-spam/rbl.sender-ips.txt BB, Arjen ----- Einde doorgestuurd bericht -----

2 3

best way to secure /dev/shm?
by Olivier Mueller 18 May '05

18 May '05

Hello, The last suse systems attacks I had to 'clean-up' were all based on php scripts copying and starting some stuff in /dev/shm. To improve the security a little bit, I'd like to have this pseudo filesystem 'noexec,nosuid' (like /tmp), but under suse linux it's not in the /etc/fstab (cf. http://www.eth0.us/?q=tmp for some other ideas). Is the only way to achieve that editing directely /etc/init.d/boot.shm ? It seem to be the case: in /etc/sysconfig/kernel you can only set the size, but not the other options... (suse 9.2 in this case) Or how would you do it? Btw, is that /dev/shm *really* necessary? :) regards, Olivier

2 1