You know another thing that would be nice would be if suse set up a way of downloading patches fro say within yast i.e something like you go to update system and then it checks the ftp site and determines which packages need updating preferably only those for which security anouncement have been made some of us really can't go hunting all over their web site for the latest patches. Noah ksemat@eahd.or.ug

Hi Thomas, there's a packet named 'autorpm' existing, I think it's on www.kaybee.org. Unfortunately it does not work with Suse, but the functionality it provides is great. I wish somebody would implement such a packet (or change autorpm, that it works also with Suse ;-). my two cents (has nothing to do with security, I know) Thomas Forbriger wrote:

On Wed, 2 Aug 2000 ksemat@wawa.eahd.or.ug wrote:

...

You know another thing that would be nice would be if suse set up a way of downloading patches fro say within yast i.e something like you go to update system and then it checks the ftp site and determines which packages need updating preferably only those for which security anouncement have been made some of us really can't go hunting all over their web site for the latest patches.

Well, what I really would like to have is:

- A SuSE distribution that comes with the SuSE public PGP key on the CD-Rom (thus regarding it as being trusted). - A YaST-option that allows download and update of SuSE-packages from the SuSE-FTP-server using the rpm -K and checking the PGP signature of the package againts the public key on CD (and the checksum as well) automatically.

That would make live much easier and updates much more trusted and it would make the average SuSE installation being more up-to-date and thus (hopefully) more secure.

Cheers, Thomas

|--------------------------------------------------------------------------| | Thomas Forbriger email: Thomas.Forbriger@geophys.uni-stuttgart.de | | Universitaet Stuttgart - Institut fuer Geophysik | | Richard-Wagner-Str. 44 D-70184 Stuttgart Germany | | Tel ++49 (711) 121-3593 or 3422 or 3424 or 3590 | Fax ++49 (711) 2361218 | | http://www.geophys.uni-stuttgart.de/thof | | "... there's nothing more bizarre than reality..." (M. Kindermann) |

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

Wow! Now that was really quick kepp it up please! thanks. On Thu, 3 Aug 2000, Lenz Grimmer wrote:

Date: Thu, 3 Aug 2000 16:56:58 +0200 (CEST) From: Lenz Grimmer To: suse-security@suse.com Subject: Re: [suse-security] SuSE security reputation, etc..

Hi,

On Thu, 3 Aug 2000, Gerd Bitzer wrote:

...

there's a packet named 'autorpm' existing, I think it's on www.kaybee.org. Unfortunately it does not work with Suse, but the functionality it provides is great. I wish somebody would implement such a packet (or change autorpm, that it works also with Suse ;-).

One of our developers hacked autorpm to work with SuSE Linux as well. You can get the RPM from here (within the nex few hours, mirroring to the outside may take a while):

http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.noarch.rpm http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.src.rpm

This package already includes a suse-update configuration. Enjoy!

Bye, LenZ -- ------------------------------------------------------------------ Lenz Grimmer SuSE GmbH mailto:grimmer@suse.de Schanzaeckerstr. 10 http://www.suse.de/~grimmer/ 90443 Nuernberg, Germany Our life is a trip between two eternities.

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

Noah ksemat@eahd.or.ug

Okay can someone give me pointers as to how to install this package? the noarch refused with an error of autorpm can not be installed and the src though it is installed I can't seem to be able to use it. Is there a tar.gz package for this I am really not used to rpms especially without a readme. On Fri, 4 Aug 2000, Herman Knief wrote:

Date: Fri, 04 Aug 2000 22:54:42 -0700 From: Herman Knief To: Lenz Grimmer Cc: suse-security@suse.com Subject: Re: [suse-security] SuSE security reputation, etc..

You guys rock! I've just pushed this onto several of my systems and it's working beautifully.

- Herman

Lenz Grimmer wrote:

...

Hi,

On Thu, 3 Aug 2000, Gerd Bitzer wrote:

...

there's a packet named 'autorpm' existing, I think it's on www.kaybee.org. Unfortunately it does not work with Suse, but the functionality it provides is great. I wish somebody would implement such a packet (or change autorpm, that it works also with Suse ;-).

One of our developers hacked autorpm to work with SuSE Linux as well. You can get the RPM from here (within the nex few hours, mirroring to the outside may take a while):

http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.noarch.rpm http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.src.rpm

This package already includes a suse-update configuration. Enjoy!

Bye, LenZ -- ------------------------------------------------------------------ Lenz Grimmer SuSE GmbH mailto:grimmer@suse.de Schanzaeckerstr. 10 http://www.suse.de/~grimmer/ 90443 Nuernberg, Germany Our life is a trip between two eternities.

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

Noah ksemat@eahd.or.ug

Try ftp.suse.com or a mirror of it and grab it from the 6.4 distribution: /pub/suse/i386/6.4/suse/d1/perl_net.rpm It worked fine in my 6.3 box :-) Artemios G. Voyiatzis "Think negative" ----- Original Message ----- From: "Avi Schwartz" To: "SuSE Security" Sent: Saturday, August 05, 2000 4:50 PM Subject: Re: [suse-security] SuSE security reputation, etc..

When I tried to install it on 6.3 it complained that it needs perl_net. When can I find it?

Thanks, Avi

Herman Knief wrote:

...

You guys rock! I've just pushed this onto several of my systems and

it's

...

working beautifully.

- Herman

Lenz Grimmer wrote:

...

Hi,

On Thu, 3 Aug 2000, Gerd Bitzer wrote:

...

there's a packet named 'autorpm' existing, I think it's on www.kaybee.org. Unfortunately it does not work with Suse, but the functionality it provides is great. I wish somebody would implement such a packet (or change autorpm, that it works also with Suse ;-).

One of our developers hacked autorpm to work with SuSE Linux as well. You can get the RPM from here (within the nex few hours, mirroring to the outside may take a while):

http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.noarch.rpm http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.src.rpm

This package already includes a suse-update configuration. Enjoy!

Bye, LenZ -- ------------------------------------------------------------------ Lenz Grimmer SuSE GmbH mailto:grimmer@suse.de Schanzaeckerstr. 10 http://www.suse.de/~grimmer/ 90443 Nuernberg, Germany Our life is a trip between two eternities.

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

-- Avi Schwartz Get a Life avi@CFFtechnologies.com Get Linux

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

Hi, I just followed this thread and found it a great idea to manage different passwds for pop/ftp and local. But how can I make the system using different passwds? thanks Benjamin On Thu, 3 Aug 2000, Roman Drahtmueller wrote:

...

% On the other side, Linux distributors could do even better. My wishlist % for Suse: % - configure security level (like harden_suse questions) with yast, and % make it more granular.

Great idea.

We see that there is a narrow path between the resulting complexity of a more detailed and granular configuration tool on the one side and the user's skills (plus patience and time) to use it on the other side. If a user can answer all detailed questions, he's probably capable of fixing unwanted configuration items himself. By consequence, the configuration can't exceed a certain level

...

From this standpoint, the existing system (/etc/permissions / chkstat / yast / harden_suse for the truly paranoid) surely has its advantages - it needs more consistency and completeness though. We're working on it.

...

% - by default, no shell user should be allowed to log in to ftp/telnet/pop % using the same password or at all

Here's what throws me. I understand you to say that the default should be for a console-only system. Is that what you meant?? I also don't know what you mean by "same password"...

This is a no-go. By default, a SuSE distribution doesn't have any users with a password after the installation, and only root can access the machine. Since it is generally considered to be a bad idea to log on as root without encryption, root login is only possible on the console and via ssh. If you add users and issue passwords, you usually expect them to log on. If we disable this possibility by default, we remove what people expect when they use a network transparent O/S.

...

% - have an installation option, that compares installed packages versus % ftp.suse.com and lists known vulnerabilites and available fixes, and does % updates on request

That would be nice, too :-)

Yes, indeed. There are many problems to face: Let rpm work flawlessly, let the tool work seamlessly with the servers, in short: Do everything necessary that the system works. Yet, there are still situations where the upgrade of a package may fail because local configuration changes have been made. In this case, we'd have to blame it on the administrator. I must admit that I don't like this idea. We're thinking of a semi-automatic solution.

...

% % I think, that a lot of security can be gained my making defaults more % secure, or easy, selectable installation options. Few systems get the % attention, that they should ..

Yep. Few users, me included, even know all of the places to look, much less have the time to go and get updated packages and install them and make sure they really don't break anything else...

Agreed. I think you see the trade-off btw. secure configuration and the ease of use.

...

% Len Rose wrote: % % > http://www.abcnews.go.com/sections/tech/FredMoody/moody.html % > It really sucks that SuSE wasn't even mentioned.

:-) Thank you, Len, for providing the link to the page.

Roman. -- - - | Roman Drahtm�ller // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | N�rnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com