May 2008 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] Update to blacklist keys generated on debian?
by Benji Weber 16 May '08

16 May '08

Greetings, Will we get an online update to blacklist the keys generated on debian prior to their recent openssl update[0] ? As lots of people use Debian and derivatives such as Ubuntu I expect that quite a number of people will be using keys generated on these to connect to suse servers. Therefore, unless the weak keys are blacklisted on the suse servers, the servers are made vulnerable by this exploit. Since the exploit is so public, presumably it would be prudent to push out an online update that blacklists the keys that would make people's machines vulnerable? Apologies if I have missed the update, I can't see it in the released updates or publictest. [0] http://lists.debian.org/debian-security-announce/2008/msg00152.html -- Benjamin Weber --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 1

[opensuse-security] Re: strong password with libcrypt
by Jay Jesus Amorin 16 May '08

16 May '08

Hi, Is there a way to implement strong password on sles10? I have hear about libcrypt, how will i implement it with strong password, like if a user change his password, sles will try to decrypt it, and if the password fails then he will inform the user like hey improve your password. Please help. Thanks, Jay --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

4 4

Re: [opensuse-security] OpenSUSE release md5 and SHA1 values and signature?
by name 14 May '08

14 May '08

The SUSE software web site mentioned in reply to the post was: http://software.opensuse.org/ This site does not have the SUSE Public Key number listed or as a link. Why not add the SUSE Public Key number and the MD5 and SHA1? It does allow you to select various download options, and will download SUSE software for OpenSUSE. The http://download.opensuse.org/distribution/10.3/iso/dvd/MD5SUMS does have the MD5SUMS file for the stable 10.3, however, there is no SUSE Public Key and the MD5SUMS is not signed. I can NOT verify it is an authentic SUSE MD5SUMS file. Why not put the SUSE Public Key on the SUSE web site http://software.opensuse.org, as well as the MD5, SHA1, and sig files. To quote from the security announcement: "To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command: gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc " --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] OpenSUSE release md5 and SHA1 values and signature?
by name 13 May '08

13 May '08

Hi, I want to verify the authenticity of OpenSUSE stable release and development release CD and DVD images. In the security announcement under "Authenticity Verification and Additional Information" it indicates that: "SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature." I can verify the security announcement letter. I would like to verify the OpenSUSE stable release and development release CD and DVD images that you can download from the web and mirror sites. Why not put the MD5 with each CD and DVD image that you can download along with a signature to verify it with? Also, why not put the public key number that is used to sign each release and distribution on the download pages so that it is easy to find. I was able to find a "SuSE Package Signing Key" and verify its authenticity, but it was not the same key used on the release(s). Please advise on what I can do to verify the authenticity of OpenSUSE stable and development releases on CD and DVD? Thanks! --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

Re: [opensuse-security] Re: only wheel members can su as root
by Jay Jesus Amorin 13 May '08

13 May '08

yes your idea should work on my case. thanks marcin 2008/5/13 Marcin Matyla <mata23(a)poczta.fm>: > Hi > > If You want use wheel group with sudo, don't use pam. Just type in visudo this > line: > %wheel ALL= /sbin/fdisk > and all users in wheel group will be able use fdisk with their passwords or > > %wheel ALL=NOPASSWD: /sbin/fdisk > for use fdsik without type their password. > > regards > Marcin > > Dnia wtorek, 13 maja 2008, napisałeś: > > > hi > > > > can this be also used in sudo. > > > > Iike i would limit only sudo to wheel members. > > > > I have this on my /etc/pam.d/sudo: > > #%PAM-1.0 > > auth include common-auth > > auth required /lib/security/pam_wheel.so trust use_uid > > account include common-account > > password include common-password > > session include common-session > > > > but $sudo /sbin/fdisk -lu /dev/hda is not working > > > > please help > > > > > > thanks > > > > > > jay > > > > On Mon, Apr 28, 2008 at 4:25 PM, Marcin Matyla <mata23(a)poczta.fm> wrote: > > > Hi > > > > > > IMHO the best way is using pam_wheel.so. > > > You have to replace one line i /etc/pam.d/su and /etc/pam.d/su -l > > > #auth include common-auth > > > auth required pam_wheel.so trust use_uid > > > > > > and then only users in wheel group will be able use command su. > > > > > > Regs. > > > Marcin > > > > > > Dnia sobota, 26 kwietnia 2008, Jay Jesus Amorin napisał: > > > > Hi, > > > > > > > > Please bear with me, I'm new to this group and suse as well. my > > > > question is, is there a way to configure suse that only users that are > > > > member of the group wheel can su as root? > > > > > > > > Thanks > > > > > > > > J > > > > --------------------------------------------------------------------- > > > > To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org > > > > For additional commands, e-mail: opensuse-security+help(a)opensuse.org > > > > > > ---------------------------------------------------------------------- > > > Potega wampirow na wyciagniecie reki - sprawdz! > > > http://link.interia.pl/f1da3 > > > > > > --------------------------------------------------------------------- > > > To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org > > > For additional commands, e-mail: opensuse-security+help(a)opensuse.org > > > -- Ang nagtanong ay tanga. Ang hindi nagtanong ay nanatiling tanga. -jayamorin

1 0