December 1999 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

multi-services server securing
by Gediminas Grigas 16 Aug '00

16 Aug '00

Hello there, I feel erroneusly (?) secure after .host.denyed in.telnetd and in.sshd from everywhere except one pc, which is denying all exept keyboard. I belive that if i can keep hosts.deny and hosts.allow files safe, and from time to time patch most actual security holes i`ll be conditionaly safe. Em i wrong? Probably I do. I just cant imaginate how system can be cracked in lower stage, so that is my problem. I heard that inetd is very insecure, and some peoples using tcpd (or soundlike). I run harden_suse, but was forced to answer 8/10 to no, as my server should provide a lot of public services, and have world writible directories as well. And thats right - this script was developed not for systems like mine one. However i`ll run SuSE-firewall-3.0 script, to make my system even stronger. But thats all. I dont know what can i do else. I should keep folowing services open: httpd; smptd; pop3d; ftpd; snmpd; named; inetd; sshd; nscd. So if you know how to keep them at minimal risk, or know some holes at those, i would be very gratefull for any info and/or tips. I dont ask to do work for me - link to good manual would be nice too. By the way i have SuSE 6.3 (2.2.13). Thanks in advice. Sincerely Yours, Gediminas Grigas mailto:gedas@kryptis.lt

5 5

Firewall Performance
by Thomas Michael Wanka 31 Dec '99

31 Dec '99

Hi all, I need to know how much a firewall based an ipchains (no extra software) decreases system performance. I have a server running Linux with two subnets, 1 with all the workstations (currently all MS OS) are connected to, 2 the old 10base2 network with the printer and the PC running NetBSD connected to the Internet. This router has firewalling functionality installed, but if there is not too much performance loss, I thought it was a good Idea to have packet filtering and port blocking active on the server too. Any suggestions and recommendations? Thanks in advance mike

1 0

Firewall Performance
by Thomas Michael Wanka 31 Dec '99

31 Dec '99

Hi all, I need to know how much a firewall based an ipchains (no extra software) decreases system performance. I have a server running Linux with two subnets, 1 with all the workstations (currently all MS OS) are connected to, 2 the old 10base2 network with the printer and the PC running NetBSD connected to the Internet. This router has firewalling functionality installed, but if there is not too much performance loss, I thought it was a good Idea to have packet filtering and port blocking active on the server too. Any suggestions and recommendations? Thanks in advance mike

1 0

Firewall Performance
by Thomas Michael Wanka 31 Dec '99

31 Dec '99

Hi all, I need to know how much a firewall based an ipchains (no extra software) decreases system performance. I have a server running Linux with two subnets, 1 with all the workstations (currently all MS OS) are connected to, 2 the old 10base2 network with the printer and the PC running NetBSD connected to the Internet. This router has firewalling functionality installed, but if there is not too much performance loss, I thought it was a good Idea to have packet filtering and port blocking active on the server too. Any suggestions and recommendations? Thanks in advance mike

1 0

Firewall Performance
by Thomas Michael Wanka 31 Dec '99

31 Dec '99

Hi all, I need to know how much a firewall based an ipchains (no extra software) decreases system performance. I have a server running Linux with two subnets, 1 with all the workstations (currently all MS OS) are connected to, 2 the old 10base2 network with the printer and the PC running NetBSD connected to the Internet. This router has firewalling functionality installed, but if there is not too much performance loss, I thought it was a good Idea to have packet filtering and port blocking active on the server too. Any suggestions and recommendations? Thanks in advance mike

1 0

suse-firewall
by Tummis＠t-online.de 30 Dec '99

30 Dec '99

Hi, I installed the suse_firewallscript two weeks ago and it works fine. But i get a dynamic IP from my Provider and so i cannot a static-IP in my rcfirewall. This is a part of my bootmassage snip starting Firewall Initialization: ppp0: error fetching interface information: Device not found ppp0: error fetching interface information: Device not found Warning: faulty interface information for ppp0. No interfaces active! exiting ... failed Master Resource Control: Failed services in runlevel 2: firewall_setup I don`t like this. What can i do? Thanks Klaus -- "Klaus Tumczak"<tummis(a)t-online.de> Linux User#155359 (http://counter.li.org/) Machine#68483 (http://counter.li.org/)

3 2

Apache: ".htaccess" files readable
by Bernd Jedamzik 29 Dec '99

29 Dec '99

Apache 1.3.6 (SuSE 6.2) Hello, the folloging lines in "httpd.conf" should "prevent .htaccess files from being viewed by Web clients" as the comment says: |<Files .htaccess> |Order allow,deny |Deny from all |</Files> But it IS viewable for people having PASSED the login-window in the Web client. (For failed login, it works ok.) I have a line "AllowOverride All" in the "http.conf"; the ".htaccess" file contains the following: |deny from all |AuthType Basic |AuthUserFile /usr/local/httpd/htpasswd.users |AuthName "Intranet" |require valid-user |satisfy any Is it a bug in design? How can I prevent the ".htaccess" file from being viewable to people passed the login? Thanks Bernd

1 0

Re: [suse-security] suse-firewall
by Dan Am 28 Dec '99

28 Dec '99

Look earlier. The interface has not come up and is thus not found. At least ethX-interfaces come up aalready in runstate 1. Maybe that helps. dan -----Ursprüngliche Nachricht----- Von: Klaus Tumczak <Tummis(a)t-online.de> An: suse-security(a)suse.com <suse-security(a)suse.com> Datum: Dienstag, 28. Dezember 1999 03:32 Betreff: [suse-security] suse-firewall >Hi, >I installed the suse_firewallscript two weeks ago and it works fine. >But i get a dynamic IP from my Provider and so i cannot a static-IP in >my rcfirewall. >This is a part of my bootmassage > >snip >starting Firewall Initialization: ppp0: error fetching interface information: Device not found >ppp0: error fetching interface information: Device not found >Warning: faulty interface information for ppp0. > >No interfaces active! exiting ... > failed >Master Resource Control: >Failed services in runlevel 2: firewall_setup > >I don`t like this. What can i do? >Thanks >Klaus > >-- >"Klaus Tumczak"<tummis(a)t-online.de> >Linux User#155359 (http://counter.li.org/) >Machine#68483 (http://counter.li.org/) > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

logging problem with wvdial.dod
by Robert C. Paulsen, Jr. 27 Dec '99

27 Dec '99

Hello, I now have the new fierwals package set up and working in combination with the wvdial.dod script from SuSE's web site. Please see another of my messages to this list that points to the changes I needed to make to wvdial.dod to get it working. I am still having one problem with the firewals script. I get *many* mesages like the following in /var/log/messages. There must be some mismatch between my Samba configuration and my rc.firewall configuration. I would appreciate it if someone would take a look at my smb.conf and rc.firewall which I have placed on my web site: http://paulsen.home.texas.net/smb.conf http://paulsen.home.texas.net/rc.firewall Here is a sample of the log messages: Dec 27 07:44:27 home kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.1:137 192.168.0.255:137 L=78 S=0x00 I=46162 F=0x0000 T=64 (#5) Dec 27 07:44:29 home kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.1:137 192.168.0.255:137 L=78 S=0x00 I=46163 F=0x0000 T=64 (#5) Dec 27 07:44:30 home kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.1:137 192.168.0.255:137 L=78 S=0x00 I=46164 F=0x0000 T=64 (#5) Dec 27 07:44:31 home kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.1:137 192.168.0.255:137 L=78 S=0x00 I=46165 F=0x0000 T=64 (#5) Dec 27 07:44:43 home kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.1:138 192.168.0.255:138 L=215 S=0x00 I=46168 F=0x0000 T=64 (#5) Dec 27 07:44:45 home kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.1:138 192.168.0.255:138 L=215 S=0x00 I=46169 F=0x0000 T=64 (#5) Dec 27 07:44:47 home kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.1:138 192.168.0.255:138 L=215 S=0x00 I=46170 F=0x0000 T=64 (#5) Dec 27 07:44:49 home kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.1:138 192.168.0.255:138 L=215 S=0x00 I=46173 F=0x0000 T=64 (#5) Dec 27 07:44:51 home kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.1:138 192.168.0.255:138 L=215 S=0x00 I=46174 F=0x0000 T=64 (#5) Dec 27 07:44:51 home kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.1:137 192.168.0.255:137 L=96 S=0x00 I=46175 F=0x0000 T=64 (#5) Dec 27 07:44:53 home kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.1:137 192.168.0.255:137 L=96 S=0x00 I=46176 F=0x0000 T=64 (#5) Dec 27 07:44:54 home kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.1:137 192.168.0.255:137 L=96 S=0x00 I=46177 F=0x0000 T=64 (#5) Dec 27 07:44:55 home kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.1:137 192.168.0.255:137 L=96 S=0x00 I=46178 F=0x0000 T=64 (#5) Dec 27 07:44:56 home kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.1:137 192.168.0.255:137 L=96 S=0x00 I=46179 F=0x0000 T=64 (#5) Dec 27 07:44:58 home kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.1:137 192.168.0.255:137 L=96 S=0x00 I=46180 F=0x0000 T=64 (#5) -- ____________________________________________________________________ Robert Paulsen http://paulsen.home.texas.net

2 1

wvdial and dial-on-demand
by Robert C. Paulsen, Jr. 27 Dec '99

27 Dec '99

Hello, I now have the new fierwals package set up and working in combination with the wvdial.dod script from SuSE's web site: http://sdb.suse.de/sdb/en/html/hoe_wv_dod_start.html The script there needed to be fixed up a little in order to get it working. I have placed my working copy on my web site: http://paulsen.home.texas.net/wvdial.dod Comments near the top of the script explain what I needed to do. It could still use a little work on it's formatting. -- ____________________________________________________________________ Robert Paulsen http://paulsen.home.texas.net

1 0

wvdial.dod and new firewall script (6.3)
by Robert C. Paulsen, Jr. 25 Dec '99

25 Dec '99

Hello, I have both the subject scripts working fine. I get dial-on-demand from wvdial.dod and I can set up masqurading/packet-filter with the firewall script (from the new firewals package). I can't figure out how to get the firewall script to run automatically after the dial-up connection is made (and the ppp networking is established). It is a little inconvenient to have to run the firewall script manually after getting ppp to connect on demand! How can I get pppd and/or wvdial to run the firewall script? Thanks. -- ____________________________________________________________________ Robert Paulsen http://paulsen.home.texas.net

1 0

msq bei SuSE6.3
by Security Webmaster OKDesign oHG 22 Dec '99

22 Dec '99

Hi folks, I recently installed the new SuSE 6.3 and since then I try to enable masquerading. Unfortunately without effort. In the earlier versions it was enabled and configured with the 4 (or 5) lines in rc.config beginning with MSQ... In this version it seems at it must be enabled and configured within /etc/rc.firewall. I tried many times but I can't get it to work. Maybe masquerading is enabled but the firewall (which must be running, as far as I read out of the readme-file) prevents it from working, or it is still disabled. Can anyone please give me a working configuration ? Or tell me what could be the reason ? If you need more info, e.g. my actual config, I`ll mail it. Thanks in advance. --- Stephan

2 1

Strange Nameserver-Messages in Syslog
by Stefan Salzer 21 Dec '99

21 Dec '99

Hi there, I think this has been asked before, but I could not find an answer! (btw: Is this list archived somewhere?) Since upgrading to SuSE 6.3, I find the following messages in my syslog, what do they mean? I know that the named has had several vulnerabilitites, but I thought they were fixed by suse? The Nameserver has several primary and secondary domains, so it has to be running. "rpm -q bind" says "bind-4.9.7-101" --- cut --- Dec 17 22:12:51 havanna named[148]: NSTATS 945465171 945181057 A=162718 NS=3 CNAME=3 SOA=1271 PTR=177530 MX=2894 TXT=1 AAAA=3 AXFR=15 ANY=8174 Dec 17 22:12:51 havanna named[148]: XSTATS 945465171 945181057 RR=40119 RNXD=1465 RFwdR=31813 RDupR=234 RFail=1310 RFErr=0 RErr=0 RAXFR=15 RLame=840 ROpts=0 SSysQ=6107 SAns=320645 SFwdQ=31954 SDupQ=3636 SErr=54 RQ=352612 RIQ=0 RFwdQ=31954 RDupQ=537 RTCP=106 SFwdR=31813 SFail=624 SFErr=5 SNaAns=84099 SNXD=12605 Dec 17 23:26:11 havanna named[148]: NSTATS 945469571 945181057 A=165024 NS=3 CNAME=3 SOA=1292 PTR=179680 MX=2921 TXT=1 AAAA=3 AXFR=15 ANY=8248 Dec 17 23:26:11 havanna named[148]: XSTATS 945469571 945181057 RR=40426 RNXD=1472 RFwdR=32088 RDupR=235 RFail=1310 RFErr=0 RErr=0 RAXFR=15 RLame=840 ROpts=0 SSysQ=6142 SAns=324952 SFwdQ=32227 SDupQ=3640 SErr=54 RQ=357190 RIQ=0 RFwdQ=32227 RDupQ=537 RTCP=106 SFwdR=32088 SFail=624 SFErr=5 SNaAns=84918 SNXD=12662 --- cut --- Thanks for any pointer you could give me... Stefan Salzer -- Qualität ist nicht was man verspricht, sondern was man hält! ======================================================================== = Wollen Sie unseren kostenlosen Newsletter "cinNews" beziehen? = = unter http://news.cin.de können Sie ihn abonnieren! = = -------------------------------------------------------------------- = = Stefan Salzer e-Mail: salt(a)cin.de = = Connect Internetworking Telefon: +49 6106 8498 0 = = Hauptstr. 139 Telefax: +49 6106 8498 299 = = 63110 Rodgau WWW: http://www.cin.de = = Germany = ========================================================================

4 3

Re: [suse-security] msq bei SuSE6.3 (fwd)
by marc＠suse.de 20 Dec '99

20 Dec '99

Hi, > i got this news today and i tried to install the > firewall v1.4. I used "rpm -U firewals.rpm" as > you have recommended but i got this error: > faild dependencies: firewall conflicts with fct-1.1.0-61. > What is wrong ? I hve Suse V6.3. just do: rpm -e fct which will remove the buggy and shitty fct package. then install the update. Greets, Marc > -----Original Message----- > From: Marc Heuse [mailto:marc@suse.de] > Sent: Sunday, December 19, 1999 1:39 PM > To: security(a)okdesign.de > Cc: suse-security(a)suse.com > Subject: [suse-security] msq bei SuSE6.3 (fwd) > > > Hi, > > please, everyone who uses or wants to use the SuSE firewall script, please > update to at least v1.4, which rpm is available on the ftp site. > (if you feel like beta testing, v1.5 is available as .tar.gz file from > http://www.suse.de/~marc) > > before doing an update "rpm -U firewals.rpm", please execute the following > command: > "mv /etc/rc.firewall /etc/rc.firewall.orig" > and reconfigure the firewall after installing the update. > > >I recently installed the new SuSE 6.3 and since then I try to enable > >masquerading. Unfortunately without effort. > > the package builder forgot to create the start scripts in rc2.d, so the > firewall scripts can not be started during boot ... :-( > v1.4 also has got more masquerading features. > Everything is documented in the rc.firewall file. > > (I pasted below my signature the CHANGE file of the SuSE firewall script > since the version which is on the CD. current beta is v1.5, the version on > the update ftp rpm is v1.4) > > Greets, > Marc > -- > Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg > E@mail: marc(a)suse.de Function: Security Support & Auditing > "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" > Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C > > v1.5 16.12.99 (beta version) > * Changed the firewall setup during bootup, now there are three > parts: > 1) Filters everything incoming, just allows dhcp replies. > This is done before interface setup. > 2) Setup the filters, > This is done after interface and routing setup > 3) Final setup of the filters. This is only necessary, if > either FW_SERVICE_DNS or the FW_AUTOPROTECT features > are used. > This is done as the last step of runlevel 2 (or 3) > This fixes some problems an adds even more security through bootup > * Added FW_SERVICE_DHCLIENT in rc.firewall for dhclient users > * Fixed some typos (thanks Fabian) > > v1.4 26.11.99 (gamma version) -> SuSE update > * Added some text to rc.firewall to help understanding the > configuration options > > v1.3 18.11.99 (beta version) > ! SuSEfirewall, which rpm name is "firewals" was incorrectly build > for SuSE 6.3 - the start scripts in rc2.d are missing :-( > * Added "SuSEfirewall stop" option, which will disable the firewall > * Added new options to load rules anyway if the interface is not > active. Requires static IP addresses of course. > Check out FW_DEV_{WORLD,INT}_[device] examples in rc.firewall > * Added support for defining a masquerading interface and masq > modules > * Added special support for DNS (new question 14 inserted, set > FW_SERVICE_DNS to "yes", if you are running named.) > * Disallowing 0/0 in FW_LOCALNETS > * Fixed some more mixed up log_deny and log_accept definitions > * Added online kernel config for reassambling of fragmented packets > * Fixed two warning messages when ip_forwarding was of (FW_ROUTE=no) > * Added adaptions for SuSE 6.3 introduced by the package maintainer > :-) > * Added the GNU GPL licence file to the package > * Misc. beauty stuff > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > > -- Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

imap with chroot environment or something like that
by Dominic Santi 20 Dec '99

20 Dec '99

Hello at all I'm looking for a imapd version with chroot environment. Exist such a imapd or is there any other possibility to restrict the filesystem "export"? Thanks for help (in german or in english). sincerely yours dominic

1 0

Re: Possible problems with firewall 1.5 script
by marc＠suse.de 19 Dec '99

19 Dec '99

Hi, > Nice script. I will be the first to admit I still need to learn alot more > about packet filtering however I am getting continuous deny entries like > > Dec 17 15:47:24 machine_name kernel: Packet log: input DENY eth0 PROTO=17 > 222.111.100.128:520 222.111.100.255:520 L=32 S=0x00 I=7066 F=0x0000 T=64 (#6) > Dec 17 15:47:24 machine_name kernel: Packet log: input DENY eth1 PROTO=17 > 192.168.0.1:520 192.168.0.255:520 L=32 S=0x00 I=7067 F=0x0000 T=64 (#5) have you the routing daemon running on your firewall? from the rule number which denied the packets, it looks like that (#4 and #5) ... the reason is simple: the firewall itself sends a broadcast to the network. because it's a broadcast the same firewall interface, which sent the packet also receives a copy. then the filter rules hit, because the screening rules identify this packet as an ip-spoofed packet ... solution: don't run broadcast services on the firewall. especially samba (hi frank :-) , and routed are a very bad idea. to subvert or DOS the firewall through RIP spoofing is rather trivial... I'll add something for a future version of the script. > Also I added > $IPCHAINS -M -S 14400 10 60 > > to the SuSEfirewall script since I like to keep ssh sessions to my work > open for long periods of time. Might want to consider adding this by default. any other opinions? do you people think this is a good idea? > And any pointers towards VPN Masquerading would be helpful. Specifically, > do I need to VPN Masquerading Kernel Patch for SuSE 6.3 (kernel 2.2.13)? have you taken a look at the freeswan package? Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

[suse-security] msq bei SuSE6.3 (fwd)
by marc＠suse.de 19 Dec '99

19 Dec '99

Hi, please, everyone who uses or wants to use the SuSE firewall script, please update to at least v1.4, which rpm is available on the ftp site. (if you feel like beta testing, v1.5 is available as .tar.gz file from http://www.suse.de/~marc) before doing an update "rpm -U firewals.rpm", please execute the following command: "mv /etc/rc.firewall /etc/rc.firewall.orig" and reconfigure the firewall after installing the update. >I recently installed the new SuSE 6.3 and since then I try to enable >masquerading. Unfortunately without effort. the package builder forgot to create the start scripts in rc2.d, so the firewall scripts can not be started during boot ... :-( v1.4 also has got more masquerading features. Everything is documented in the rc.firewall file. (I pasted below my signature the CHANGE file of the SuSE firewall script since the version which is on the CD. current beta is v1.5, the version on the update ftp rpm is v1.4) Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C v1.5 16.12.99 (beta version) * Changed the firewall setup during bootup, now there are three parts: 1) Filters everything incoming, just allows dhcp replies. This is done before interface setup. 2) Setup the filters, This is done after interface and routing setup 3) Final setup of the filters. This is only necessary, if either FW_SERVICE_DNS or the FW_AUTOPROTECT features are used. This is done as the last step of runlevel 2 (or 3) This fixes some problems an adds even more security through bootup * Added FW_SERVICE_DHCLIENT in rc.firewall for dhclient users * Fixed some typos (thanks Fabian) v1.4 26.11.99 (gamma version) -> SuSE update * Added some text to rc.firewall to help understanding the configuration options v1.3 18.11.99 (beta version) ! SuSEfirewall, which rpm name is "firewals" was incorrectly build for SuSE 6.3 - the start scripts in rc2.d are missing :-( * Added "SuSEfirewall stop" option, which will disable the firewall * Added new options to load rules anyway if the interface is not active. Requires static IP addresses of course. Check out FW_DEV_{WORLD,INT}_[device] examples in rc.firewall * Added support for defining a masquerading interface and masq modules * Added special support for DNS (new question 14 inserted, set FW_SERVICE_DNS to "yes", if you are running named.) * Disallowing 0/0 in FW_LOCALNETS * Fixed some more mixed up log_deny and log_accept definitions * Added online kernel config for reassambling of fragmented packets * Fixed two warning messages when ip_forwarding was of (FW_ROUTE=no) * Added adaptions for SuSE 6.3 introduced by the package maintainer :-) * Added the GNU GPL licence file to the package * Misc. beauty stuff

1 0

RE: [suse-security] delay of msgs on the announce list
by Volker Kuhlmann 17 Dec '99

17 Dec '99

> By analyzing that I think, suse-security is a direct list and > suse-security-announce is a moderated list, e. g. an individual > here named "hatred" proofed und passed the mail. Yes perhaps, I was wondering too whether it has something to do with the approvement process, but 12 hours is rather a long time which you can only really explain by taking the time difference between Europe/USA into account. Still, the problem remains - suse-security-announce is not a high-priority get-important-info-fast type list. It would be nice if SuSE changed the handling of this list - those SuSE employees which issue security announcements should have write-access to the list in that case. Volker

1 0

SuSE Security Announcement - pine
by thomas＠suse.de 16 Dec '99

16 Dec '99

-----BEGIN PGP SIGNED MESSAGE----- _____________________________________________________________________________ SuSE Security Announcement Package: pine-4.10 Date: Wed Dec 15 18:32:56 MET 1999 Affected SuSE versions: 5.3 - 6.3 Vulnerability Type: remote command execution SuSE default package: no Other affected systems: all unix systems using the pine prior 4.21 ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The pine mail agent doesn't filter special shell characters in URLs. 2. Impact An attacker can trick a user using pine to executing shell commands by sending an email with malicious formatted URL embedded in it. 3. Solution Update the package from our FTP server. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: bbfa5cb60f8f5c29f18bb14744071953 pine-4.21-11.alpha.rpm (6.1, AXP) b2980666737dd4a4db46e1c3d3c7aea0 pine-4.21-11.i386.rpm (5.3, x86) d70ef356f093683c85cba53cc573c1b5 pine-4.10-40.i386.rpm (6.0, x86) 7286ed1525c94a7b36c7a2c68ccb4890 pine-4.21-11.i386.rpm (6.1, x86) 159d028af3aaca959cada37c7a68cc07 pine-4.21-11.i386.rpm (6.2, x86) df36f3e6da96dc4c6a5811302e5b926f pine-4.21-13.i386.rpm (6.3, x86) ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/pine-4.21-11.alpha.rpm ftp://ftp.suse.com/pub/suse/i386/update/5.3/n1/pine-4.21-11.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.0/n1/pine-4.10-40.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/pine-4.21-11.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/pine-4.21-11.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/pine-4.21-13.i386.rpm or try the following web pages for a list of mirrors: http://www.suse.de/de/support/download/ftp/inland.html http://www.suse.de/de/support/download/ftp/ausland.html or http://www.suse.de/en/support/download/ftp/germ_mirrors.html http://www.suse.de/en/support/download/ftp/int_mirrors.html Our webpage for patches: http://www.suse.de/de/support/download/updates/index.html or http://www.suse.de/en/support/download/updates/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOFkEYXey5gA9JdPZAQGTEQf8D5HbyQraHg8gKT6aN2HXYZ8c4FqbH8+L piI/XfpVoEkg3tXDomt+JeGmXEa22veNooqfXQIdTvU2mWR6adgdP4297a/+id7N vM9KE2RRJPTSZBeKM2uLtvz2yc6cgb2hZmgQUY0eNmYi9FbZJiUqweueZG9TS1GS o+ddCgZSrw6XgkoyiquyFWE5b/EKD8uO+XtGJQhToylgkVGUERFHy0AeSc6hSjMV BBWKFTkwgJouY6h/+0BXxOTozHtSL6vgSjma7eBK/O/60Z36t7ZLReIAz1OC4BoB nRcTk2tk4NTiExBngaa18oMJ4Tz6T0DdLuqudGEcI3J5tKocWadwsQ== =vE4K -----END PGP SIGNATURE-----

1 0

RE: [suse-security] Setting up a firewall
by DEMERRE DIETER 16 Dec '99

16 Dec '99

-----BEGIN PGP SIGNED MESSAGE----- > -----Original Message----- > From: Brian Galbraith [mailto:brian.galbraith@bigfoot.com] > Sent: donderdag 16 december 1999 12:35 ... > don't need....but I would still like to set up a firewall. I > have all the > relevant packages installed, and have tried to configure, > using kfirewall. > All the rules remain in place while my system is running, but > if I shut the > system down..when I restart......all the rules have > disappeared, and I have > to reconfigure again. > Can anyone give me guidance on how to retain the rules in memory. // - ------<snip>---------------------------------------------------------- [For SuSE and RedHat systems] // Look up in /etc/inittab the runlevel you're running in. // is probably 2 or 3 for SuSE and 3 or 5 for RedHat // can be found between id: and :initdefault: // replace in what follows $RUNLEVEL by that value. [SuSE:] #export INDPATH=/sbin/init.d #export RLPATH=$INDPATH/rc$RUNLEVEL.d [RedHat:] #export INDPATH=/etc/rc.d/init.d #export RLPATH=$INDPATH/../rc$RUNLEVEL.d [All of the above:] #cd $INDPATH #echo '#!/bin/sh'>firewall #chmod u+x firewall #chown root.root firewall // put all commands to load the rules at the end of $INDPATH/firewall ... // Following you should change the 30 and 70 to acceptable // values for your system. // Typically it's right after S<n>network and right before K<n>network ln -s $INDPATH/firewall $RLPATH/S30firewall ln -s $INDPATH/firewall $RLPATH/K70firewall #echo Good luck !!! :D} // - ------<snip>---------------------------------------------------------- > Ideally I should run the system constantly.......but I am > afraid that Linux > does not yet have an Encarta equivalent for the youngsters:-( You should test VMWare. I'm not sure it's capable of "tunneling" sound-systems, but for the rest, it looks OK... Merry Greetings from - Z'ge Groetjes vanwege *** Dieter Demerre ----- ddemerre(a)acm.org ** http://www.angelfire.com/de/ddemerre/ ******************************************** Wanna get rid of idle Processor cycles ? distributed.net ? Try synchronising outlook. ******************************************** - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 6.5.1 Int. for non-commercial use <http://www.pgpinternational.com> mQENAzhXiLAAqQEIAMsoaNcCZFHswGBK1J4dRJvjUA7XwIICCKIKwU1HZIz5meGk rbSgfK3SwJaqQOTRveKjPYtiZ7D6H19bjsO+P9bvdvEZHLC4dCQIvJfSMlcvSvLN 2S/wpfqaDZBsFDk2WnBmah9wilrm3QE4ATbWgGDeRd/XvPuRNc10FiZjRnEp5h+1 PcBppgljLhlJuBFEKxEXxjUsyBTl1zM3Gex8u+vNvg80DtlnlUB7Kc++JkJOSa3e 7FZAN7WEXztH9rKQmeCc/a1S00zHoPBeJnsfhjaX/nUhL2MH0AfTn0fX2W7LxgEQ J9MJhxr8Ejlsj+a5wQD2OFGk4Ttn4ftB++EuukMABRG0IURpZXRlciBEZW1lcnJl IDxkZGVtZXJyZUBhY20ub3JnPokBFQMFEDhXiLDh+0H74S66QwEBr2MIAJyuK5vb 4gMBZNelDedU53df23VfyrychlEH5E2fudaqpt3pspCQgX78KK4vLWsFr9ycUUYF 0FdTQBCUuhvj8BShexU9VocxjuoSaNuNwMqNZCWIAWx3OksvkTiNmXUC8rswxYKu Z81O8LQifpjSe4tifAoZvdSBjrvKNyx6UfAWLrYlaUOmzxzRtulIIW8L429aU//a ivhdBmBs4TKR9/NTCwI1Z/OY8Kc46keOI4cmdTNDGDYjlZHNi7UG8kj4XxajL40o 6yLY7m2TfXBbRB2aK10CjinpPhi+Vk6fA3KJ9/a4am4o2Oe8Tvqm8DPp0BM4VuyW dT7wQMNZk5WW0Ho= =kTdL - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.1 Int. for non-commercial use <http://www.pgpinternational.com> iQEVAwUBOFjf5eH7QfvhLrpDAQFGzQf+ONssxHn7GI/St9h6iYj9jvpq+XB96oQQ XkSuBU4MFL6Vyf7ZGuHKja/vqSZB9DIN+2YsC3qkD6mFjmAIPwPcJEJ5phY1hAQy v9gylCTkGyKZa1Vml++LmgJca4tu6OyInPx18gFWKhSQbi36u8gzJHpaqRe7Dtlb Gk2AW6oeUKD/5Og/Amkzcr8n96dXtgHGFKMKxg9aOJ0LE1uY1dB/phojFumERqvN ifGEnRgfAWtU+m2WKy0xzOYoN+lXTV9jVLc2LKSUQT0zHBX0zNgeyjFDhe7MCkPo uueLIodcTER5mg4ucuE76k1Ga/3XBka7xJu7d7V5xgbGbA/r6OnINQ== =chON -----END PGP SIGNATURE-----

1 0

Setting up a firewall
by Brian Galbraith 16 Dec '99

16 Dec '99

I have a stand alone system with a dynamic IP address and occasional connection to the internet via a modem. I have shutdown all the services I don't need....but I would still like to set up a firewall. I have all the relevant packages installed, and have tried to configure, using kfirewall. All the rules remain in place while my system is running, but if I shut the system down..when I restart......all the rules have disappeared, and I have to reconfigure again. Can anyone give me guidance on how to retain the rules in memory. Ideally I should run the system constantly.......but I am afraid that Linux does not yet have an Encarta equivalent for the youngsters:-( Regards Brian -- ---------------------------------- E-Mail: Brian Galbraith <brian.galbraith(a)bigfoot.com> Date: 16-Dec-1999 Time: 11:33:00 Powered by SuSE Linux PGP Keys from http://www.freedomhound.com/pgp/en/ This message was sent by XFMail 1.4.4 ----------------------------------

1 0

RE: [suse-security] delay of msgs on the announce list
by Freudenberger Joerg 16 Dec '99

16 Dec '99

Hello Volker, hello folks Here is a diff of the two aquivalent headers (track cut at leaving suse.com). By analyzing that I think, suse-security is a direct list and suse-security-announce is a moderated list, e. g. an individual here named "hatred" proofed und passed the mail. Yours Jörg === Attachment 1,3c1,3 < .... suse-security < Received: (qmail 3680 invoked by alias); 14 Dec 1999 22:22:53 -0000 < Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm --- > .... suse-security-announce > Received: (qmail 25233 invoked by alias); 15 Dec 1999 10:31:29 -0000 > Mailing-List: contact suse-security-announce-help(a)suse.com; run by ezmlm 6,13c6,15 < list-help: <mailto:suse-security-help@suse.com> < list-unsubscribe: <mailto:suse-security-unsubscribe@suse.com> < list-post: <mailto:suse-security@suse.com> < X-Mailinglist: suse-security < Delivered-To: mailing list suse-security(a)suse.com < Received: (qmail 3668 invoked from network); 14 Dec 1999 22:22:52 -0000 < Delivered-To: suse-security(a)suse.com < Message-Id: <19991214222702.2D30767AC(a)Galois.suse.de> --- > list-help: <mailto:suse-security-announce-help@suse.com> > list-unsubscribe: <mailto:suse-security-announce-unsubscribe@suse.com> > list-post: <mailto:suse-security-announce@suse.com> > X-Mailinglist: suse-security-announce > Delivered-To: mailing list suse-security-announce(a)suse.com > Delivered-To: moderator for suse-security-announce(a)suse.com > Received: (qmail 3669 invoked from network); 14 Dec 1999 22:22:52 -0000 > Delivered-To: suse-security-announce(a)suse.com > Approved: hatred > Message-Id: <19991214222702.3694767AE(a)Galois.suse.de> 16c18 < Subject: [suse-security] SuSE Security Announcement - wvdial --- > Subject: [suse-security-announce] SuSE Security Announcement - wvdial

1 0

delay of msgs on the announce list
by Volker Kuhlmann 16 Dec '99

16 Dec '99

Hello, why is it that the same msgs always seems to take hugely longer to come through on the security-announce list? This delay of 12 hours seems fairly standard. Considering that security-announce is for important security-related announcements this kind of lag can be a problem depending on what situation SUSE Linux is used in. Any chances of rectification by SuSE? > From suse-security-return-847-kuhlmav=elec.canterbury.ac.nz(a)suse.com Wed Dec 15 11:28:02 1999 > Date: Tue, 14 Dec 1999 23:27:02 +0100 (MET) > From: marc(a)suse.de (Marc Heuse) > Subject: [suse-security] SuSE Security Announcement - wvdial > Delivered-to: mailing list suse-security(a)suse.com > Delivered-to: suse-security(a)suse.com > From suse-security-announce-return-25-kuhlmav=elec.canterbury.ac.nz(a)suse.com Wed Dec 15 23:35:53 1999 > Date: Tue, 14 Dec 1999 23:27:02 +0100 (MET) > From: marc(a)suse.de (Marc Heuse) > Subject: [suse-security-announce] SuSE Security Announcement - wvdial > Delivered-to: mailing list suse-security-announce(a)suse.com > Delivered-to: moderator for suse-security-announce(a)suse.com Volker

1 0

CERT Advisory CA-99.15
by Johann G. Hautzinger 15 Dec '99

15 Dec '99

hi list, today the following cert advisory (99.15) reached my mailbox: ---snip--- CERT Advisory CA-99-15 Buffer Overflows in SSH Daemon and RSAREF2 Library Original release date: December 13, 1999 Last revised: -- Source: CERT/CC A complete revision history is at the end of this file. Systems Affected * Systems running some versions of sshd * Systems using products that use RSAREF2 (e.g., some SSL-enabled web servers) [...] ---snap--- they talk of sshd-1.2.27 which is exactely what i have (SuSE 6.3): SSH Version 1.2.27 [i686-unknown-linux], protocol version 1.5. Standard version. Does not use RSAREF. due to american export regulation this is not too bad (no rsaref) but according to my opinion bad enough when will we hear the "patch-song"? ;-) greetz from vienna Hannes -- Johann Georg Hautzinger, email: trema(a)eic.at, Tel.: 531 00 1907 Erste Bank AG - OE 0423 - Orga./Entw. Treasury u. Orga.Wertpapier Boersegasse 14, 1010 Wien http://treasury.erstebank.at

7 12