September 2001 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

VPN masquerading
by Joost van der Lugt 06 May '02

06 May '02

Hi all, I am trying to set up VPN masquerading, for a Windows box, and just wondered if there was an easy way to do this, using just the firewall.rc.config script, or do both that plus the custom config script have to be used? I have seen the VPN how-to, however just wondered about a how to aply this with SuSE's scripts. Thanks for any suggestions, (PS if there is someone familiar with setting upo VPN on the SuSe box itself, I would be very interested as well..., of course) - Cheers, Joost

4 4

SuSEfirewall2 and DHCP relay
by Pablo A. Maurin 01 Nov '01

01 Nov '01

Hello everyone. I am currently using SuSEfirewall2 with the following configuration. FW_DEV_EXT="eth0" FW_DEV_INT="eth1 eth2" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24 192.168.254.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="ssh" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_INT_TCP="ssh" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" I have a firewall with 3 interfaces. eth0 is outside,public. eth1 is one local subnet (192.168.0/24), private. eth2 is a second internal private subnet(192.168.254/24). I have routing setup beween both subnets and I am able to ping across the firewall/router from one subnet to the other. Currently I have a DHCP server installed in the 192.168.0/24 subnet. Address 192.168.0.2. On the firewall I installed the DHCP realy package from the suse 7.2 CD It listenes on eth2 and forwards all request to 192.168.0.2 (the DHCP server). when I check the dhcp server logs I see that it is creating a lease for the new host on eth2 of the firewall. However the host is not receiving the address. I sure that it is a small misconfiguration on the firewall, but I cannot figure out what it is. Any help is greatly appreciated. If you need more information just e-mail me and I will try to get it. Thanks is advance, Pablo A. Maurin

2 1

patching SuSE
by Matthew Dalton 01 Oct '01

01 Oct '01

Please forgive the newbie question -- is there an easy way to patch Suse (7.1) all at once? The only way that I can see from the web-site is to download each patch individually. Thanks for helping! -- Matthew Dalton

4 4

IRC DCC stuff from behind a susefirewall2 NAT router
by Admin 01 Oct '01

01 Oct '01

Hi, see subject, any hints? neither inbound nor outbound dcc works... And as I am botmaster on some IRC bots I REALLY need DCC Chat :( bye M.Homann -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstіпt gegen §1 UWG und §823 I BGB (Beschluп des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der ќbermittelten persіnlichen Daten sowie deren Weitergabe an Dritte ist ausdrќcklich untersagt!

4 4

squid: timeout in SENT_PASV state
by Philipp Snizek 29 Sep '01

29 Sep '01

Hi all, please can somebody tell me what to do against this. Is this a ftp server that is not accepting pasv ftp? Or is it a misconfigured squid? Sep 29 21:23:54 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Sep 29 21:24:18 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Sep 29 21:24:41 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Sep 29 21:29:03 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Thank you all, Philipp

1 0

still battlecom with linuxserver
by Johannes Schäffner 28 Sep '01

28 Sep '01

ok, i have typed this: ipmasqadm autofw -A -v -r udp 2300 2400 -h 192.168.0.2 (client-ip) ipmasqadm autofw -A -v -r tcp 2300 2400 -h 192.168.0.2 ipmasqadm autofw -A -v -r tcp 47624 47624 -h 192.168.0.2 ipmasqadm autofw -A -v -r udp 47624 47624 -h 192.168.0.2 ipmasqadm autofw -A -v -r udp 28800 28900 -h 192.168.0.2 but it still don´t work. he always prints this at hte screen: Adding autofwd udp ports 2300 - 2400 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd tcp ports 2300 - 2400 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd tcp ports 47624 - 47624 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd udp ports 47624 - 47624 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd udp ports 28800 - 28900 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available what do i have to change?? -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

2 1

Virus scanner to detect macintosh viruses?
by Thorsten Marquardt 28 Sep '01

28 Sep '01

Hello, I like to know wether there is a linux virusscanner which detects virus for (better against) apple macintosh. Yours sincerly Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

2 1

Re: [suse-security] qmail.rpm ... -> courier imap -> virus scanners
by Martin Schichl 28 Sep '01

28 Sep '01

Hi! I've followed the discussion about qmail ... We are running qmail now for a couple of years without any problems (about 250 Mailclients in 50 different virtual domains) But let me get the discussion into a little bit other direction ... >There is no problem. I ran qmail-pop3d off Maildirs for several months, >until I dropped it and switched to courier-imap. On 6.3, procmail is >probably not yet aware of Maildir. 1.) I think of switching some of my users from pop3 to imap ... Matthias you wrote about courier-imap ... My questions: - any experience with imap on qmail? - do I have to switch the whole thing to imap, or can I run pop3 and imap parallel? - what's about security with imap? (ok ... I know pop3 does not have any either) - are there different distributions of imap servers? (which one fits into qmail with vchkpw) 2.) Another theme is about virus scanners in mailer daemons. I've read an article about virus scanners which can be implemented directly into the postfix system ... Any experience with virus scanners for qmail? OK, I think this is enough for today ... Martin ----------------------------------------------------------------- Dipl.-Ing. Martin Schichl SC&C Software, Communication & Consulting GmbH & Co KEG Grottenhofstr. 3, A-8053 Graz Tel. +43/(0)316/265-205, Fax +43/(0)316/265-234 mschichl(a)scc.co.at, http://scc.co.at

8 8

Re: [suse-security] Bastille and other Linux distros
by michael.ryan＠storm.ie 28 Sep '01

28 Sep '01

IMHO any tool/script which offers SuSE users another choice when armouring their system would naturally be welcome :) Regards, Michael "Niki Rahimi" <narahimi@us. To: suse-security(a)suse.com ibm.com> cc: Subject: [suse-security] Bastille and other Linux distros 09/27/2001 05:57 PM Hi Everyone, I work with a security group in IBM's Linux Technology Center and have recently been working on a project to get the Bastille security hardening script to run on SuSE. I would like to get feedback from the discussion list on this project. Would this be something the SuSE community would be receptive to? In case you're not familiar with Bastille, their web site is at www.bastille-linux.org. If you have any further questions about this, please let me know. Thanks, Niki A. Rahimi narahimi(a)us.ibm.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

3 2