January 2006 - openSUSE Security - openSUSE Mailing Lists

How to change NIC speed on SuSE 9.1 Pro
by Escudero, Peter Louis 13 Jan '06

13 Jan '06

How do I change the NIC speed from 10Mbps to 1Gbps? Below are some relevant info. The machine is a Dell PE1750. The corresponding port on the Cisco 6509 switch is set to auto-negotiate. hostname:~ # /etc/init.d/network status Checking optional network interfaces: eth0 device: Broadcom Corporation NetXtreme BCM5704 Gigabit Ethernet (rev 02) eth0 configuration: eth-id-00:0f:1f:67:d8:5c eth0 IP address: x.x.x.x/24 running eth1 device: Broadcom Corporation NetXtreme BCM5704 Gigabit Ethernet (rev 02) eth1 No configuration found for eth1 unused Checking mandatory network interfaces: lo lo IP address: 127.0.0.1/8 running Checking service network . . . . . . . . . . . . . . . . . running hostname:~ # ethtool eth0 Settings for eth0: Supported ports: [ MII ] Supported link modes: 10baseT/Half 10baseT/Full 100baseT/Half 100baseT/Full 1000baseT/Half 1000baseT/Full Supports auto-negotiation: Yes Advertised link modes: 10baseT/Half 10baseT/Full 100baseT/Half 100baseT/Full 1000baseT/Half 1000baseT/Full Advertised auto-negotiation: Yes Speed: 10Mb/s Duplex: Full Port: Twisted Pair PHYAD: 1 Transceiver: internal Auto-negotiation: on Supports Wake-on: g Wake-on: d Current message level: 0x000000ff (255) Link detected: yes Thanks, Peter Escudero

2 1

access from strange IP-address
by Markus Gerke 13 Jan '06

13 Jan '06

Hello everybody, today someone accessed my apache-server from 141.201.152.145 . the ns-entry is work-mm. (see below). Does someone know, why the toplevel-domain is missing in this name? Regards, Markus nslookup 141.201.152.145 Server: 130.75.1.32 Address: 130.75.1.32#53 Non-authoritative answer: 145.152.201.141.in-addr.arpa name = work-mm.

4 4

Licensing
by Joop Boonen 11 Jan '06

11 Jan '06

All, I have a question. This might not be the right mailing list. I'm going to do the certification program NCLE en NCLP. I would like to know what another good certification might be? Regards, Joop.

1 0

suse-security-unsubscribe-micro77=gmail.com@suse.com
by Micro small 11 Jan '06

11 Jan '06

1 0

Patch Noifications
by Ron Joffe 11 Jan '06

11 Jan '06

A thread on another list I follow talked about server uptime, and reboot requirements due to patches (security). The understood result at the end of the thread was that the only time a reboot was required was after a kernel patch. My questions is two fold. First is this group aware of any other patches that would require user interaction. For example if I have set up automatic updates, in what instances would I need to reboot and/or manually restart a damon. Second question, if there are any user interaction from previous question, what method of notification (email) is there to notify an admin of the requirement (otherwise the machin is not protected for that security vulnerability). Thanks, Ron

6 6

Re: [suse-security] User private groups?
by Alex Hargrove 10 Jan '06

10 Jan '06

Hi Susan- Thanks for the reply, that clears it up some... I am coming to SUSE from the NetWare world, where by default users can't see anything except those files/dirs that they have been explicitly given rights to (or through inheritance from a parent dir), so this is all sort of new to me. Thanks again! Alex >>> Susan Dittmar <S.Dittmar(a)eureca.de> 01/09/06 3:04 AM >>> Quoting Alex Hargrove (ahargrove(a)cgresd.net): > Sorry, I guess I wasn't very clear. I intentionally asked why SUSE > doesn't do this, because RedHat does by default. To me, it seems more > secure to use User Private Groups, unless I am missing something... I can't see why this makes the system more secure. How secure your system is (with respect to groups) is decided by what members of the 'users' group may do. That you can reduce to a minimum, if you want to increase security. Otherwise, 'users' is just the one group every true user is in (as opposed to the pseudo users for special services, like wwwrun and such). Giving something to that group just means giving it to every true user. And for anything else, there's the option not to allow access for any group (via chmod and umask) or to another, more restrictive group. Just my 2c, Susan PS: While re-reading this, one scenario came to my mind where you might be lazy enough to want something like that. Suppose you have a directory structure which is shared by a group of users. There, for the directories, the group-s-bit is set, making sure that anything created there belongs to the same group as the directory wherein it's created. Now if something is created there, you want the group-write-bit set, so the rest of the group can change it. So you set umask to something very open, giving automatical write access to the group. So far, everything is fine. But, if you are lazy, you leave that umask active even when working in other directories. Now giving group-write-access is a rather insecure thing (which it might be in the shared directory aswell, but that's another toppic), which can be, at least to some extent, remedied by giving each user an unique group. Still, I would rather think about, for example, a cronjob opening up those files newly created in the shared directory for the group than opening up everything by setting the default-umask to something this open. There might be programs relying, for the security of their data, on the standard 0022 umask (which they then should check, of course, but we all know that even programmers are users, and as lazy as users). -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

RE: [suse-security] User private groups?
by Alex Hargrove 09 Jan '06

09 Jan '06

Sorry, I guess I wasn't very clear. I intentionally asked why SUSE doesn't do this, because RedHat does by default. To me, it seems more secure to use User Private Groups, unless I am missing something... I know how to use chmod/chgrp, and I know I can do it manually, but I was really asking how I can do it automatically upon user creation with SUSE. >>> <GarUlbricht7(a)netscape.net> 1/6/2006 12:36:37 PM >>> "Alex Hargrove" wrote on Fri, 6 Jan 2006 11:29:39 AM EST: > Hi all- > > I'm wondering why SUSE doesn't utilize User Private Groups, > and is there a way to change the system > so that it does use them? (snip) Hi Alex, A small suggestion, don't think of it as "SUSE", but rather the "UNIX/Linux community", of which you are not part. Also remember that this community has in the past strong DOD ties, including funding, mind-set, etc. (and there are many who will argue that mind-set continues -- with that said, you can do what you said as Sys Admin for with your system - The tools are there including chown & chmod, plus SUDO for creating "User Private Groups". And on your SuSE box using using YAST ==> "SECURITY & USERS" ==> "User management" and ==> "Group Management your task is relatively easy. Also see "man chown" and "man chmod" if YAST doesn't do it for you. In my case I found reading: http://www.codecoffee.com/tipsforlinux/articles/032-1.html very helpful. YMMV. ~Gar -- __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

SUSE Security Beginner
by John Cesario 06 Jan '06

06 Jan '06

I was wondering if there was any documentation written relating to securing a SuSe Server running AMP. All help is appreciated, -JC

1 0

RE: [suse-security] User private groups?
by GarUlbricht7＠netscape.net 06 Jan '06

06 Jan '06

"Alex Hargrove" wrote on Fri, 6 Jan 2006 11:29:39 AM EST: > Hi all- > > I'm wondering why SUSE doesn't utilize User Private Groups, > and is there a way to change the system > so that it does use them? (snip) Hi Alex, A small suggestion, don't think of it as "SUSE", but rather the "UNIX/Linux community", of which you are not part. Also remember that this community has in the past strong DOD ties, including funding, mind-set, etc. (and there are many who will argue that mind-set continues -- with that said, you can do what you said as Sys Admin for with your system - The tools are there including chown & chmod, plus SUDO for creating "User Private Groups". And on your SuSE box using using YAST ==> "SECURITY & USERS" ==> "User management" and ==> "Group Management your task is relatively easy. Also see "man chown" and "man chmod" if YAST doesn't do it for you. In my case I found reading: http://www.codecoffee.com/tipsforlinux/articles/032-1.html very helpful. YMMV. ~Gar -- __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

1 0

User private groups?
by Alex Hargrove 06 Jan '06

06 Jan '06

Hi all- I'm wondering why SUSE doesn't utilize User Private Groups, and is there a way to change the system so that it does use them? (I'm talking about when a user is created, instead of making the "users" group the primary group, create a group named the same as the user and make that the primary, i.e. instead of jdoe:users, do jdoe:jdoe). TIA!

1 0