August 1999 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

multi-services server securing
by Gediminas Grigas 16 Aug '00

16 Aug '00

Hello there, I feel erroneusly (?) secure after .host.denyed in.telnetd and in.sshd from everywhere except one pc, which is denying all exept keyboard. I belive that if i can keep hosts.deny and hosts.allow files safe, and from time to time patch most actual security holes i`ll be conditionaly safe. Em i wrong? Probably I do. I just cant imaginate how system can be cracked in lower stage, so that is my problem. I heard that inetd is very insecure, and some peoples using tcpd (or soundlike). I run harden_suse, but was forced to answer 8/10 to no, as my server should provide a lot of public services, and have world writible directories as well. And thats right - this script was developed not for systems like mine one. However i`ll run SuSE-firewall-3.0 script, to make my system even stronger. But thats all. I dont know what can i do else. I should keep folowing services open: httpd; smptd; pop3d; ftpd; snmpd; named; inetd; sshd; nscd. So if you know how to keep them at minimal risk, or know some holes at those, i would be very gratefull for any info and/or tips. I dont ask to do work for me - link to good manual would be nice too. By the way i have SuSE 6.3 (2.2.13). Thanks in advice. Sincerely Yours, Gediminas Grigas mailto:gedas@kryptis.lt

5 5

ssh-authtication
by Security Webmaster OKDesign oHG 06 Dec '99

06 Dec '99

Hi folks, umm, I have a small problem. When setting up our server, I tried to get the best security as possible. Maybe I changed some config-file to fit our needs to allow ssh-logins only from specified users.(But I have no idea which file this was :-(( ) Now I want to allow another user to login using ssh. I made ssh-keygen for this user, entered the password, copied identity.pub to authorized_keys in the .ssh-directory. But when trying to login via ssh, servers sends permission denied. What else must be done ? TIA ---Stephan

3 2

PGP
by Scott McEachern 01 Dec '99

01 Dec '99

Does anyone know if PGP works with Netscape's Messenger? I was at the pgp site and it listed a lot of mail clients, no Netscape. -- mailto:scott.mceachern@sympatico.ca On the side of the software box, in the "System requirements section", it said "Requires Windows 95 or better." So I installed Linux.

3 2

Apache Source Tree under 6.1
by Niall Cosgrove 20 Sep '99

20 Sep '99

hi, apache.spec tells me not to run under a production system so how do I get the source tree for the 6.1 apache.rpm (binary) that i am already running on my production system do suse have any plans to syncronise their source archive with the binaries that they supply? Niall (feeling a bit disappointed/confused)

13 13

ftp & cgi.script security roundup
by Dan 31 Aug '99

31 Aug '99

hi all, probably newbie-stuff to most, but who knows of a reference giving the points to watch in using these two services, including "internal bugs" . i read the announcement about suse not having the wuftp-bug, but still... thanks for any advice or referral. dan :-]

1 0

SuSE Security Announcement
by Thomas Biege 31 Aug '99

31 Aug '99

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: cron-3.0.1-75 (Vixie Cron) and previous versions Date: Fri Aug 27 17:56:48 CEST 1999 Affected: maybe all Unix operatingsystems using crond ______________________________________________________________________________ Some security holes were discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on as "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description Three security threats were found in the vixie crond, which is shipped with SuSE Linux. 1) no boundchecking on a local buffer, while copying data from MAILTO 2) passing invalid options to sendmail 3) it doesn't drop root privileges while sending acknowledge mail to a user 2. Impact 1) local root compromise by putting arbitrary code on the stack 2/3) triggering a local denial-of-service attack by starting alot of sendmail daemons execute sendmail with options that only root could apply (like '-C'), which also leads to local root compromise 3. Solution Updated the crond package from our FTP server. ______________________________________________________________________________ Here are the md5 checksums of the upgrade packages, please verify these before installing the new packages: bfc9ab01fdfd36eebb3cc398bbb34c37 cron-3.0.1-84.i386.rpm (6.2) 8998dbecf020d8a6f7ba1a2885f986da cron-3.0.1-82.i386.rpm (6.1) ______________________________________________________________________________ You will find the update on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/cron-3.0.1-84.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/cron-3.0.1-82.i386.rpm Webpage for patches: http://www.suse.de/patches/index.html or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - unmoderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to majordomo(a)suse.com with the text subscribe suse-security or subscribe suse-security-announce in the body of the message. Or just issue a echo subscribe suse-security | mail majordomo(a)suse.com or echo subscribe suse-security-announce | mail majordomo(a)suse.com ______________________________________________________________________________ If you want to report *NEW* security bugs in the SuSE Linux Distribution please send an email to security(a)suse.de or call our support line. You may use pgp with the public key below to ensure confidentiality. ______________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBN8ogGney5gA9JdPZAQGYTggAkropbyQJN3dFi4EZZoyaQxNgzNorCTaS 5aqZFKZNelcl1lUtNpjwfIhHGDjsbScBBpoVa2entvGiyytQphu6S89YBTEtHRiy fp+DICgHqO90LtSMxVXU9rYsuXqneAtdBLXjzOkN49asS/nYWoZO4TQiWotGASTF SxEW9evQgWgfD2dEMI2LPzoc/ygK81P2e5ezzBuiOTxTpkjkfYPsRlFOMZX93Thr 68xYtaB0PhOA3NVf+BDSDZNIVnaPN3yfaLqP6KRfZ5q0uRNudereeNpRfbtv6pwD zDyuZvcG986Chybd67NpvUs36osTVp8ugs2MyGl/s/833W7umh5ulA== =ruO5 -----END PGP SIGNATURE-----

3 2

IPChains (nice set of rules)
by Matthias Jaenichen 31 Aug '99

31 Aug '99

Hi, is there anyone arround who is willing to send me a/his set of IPChain-Rules? I'd prefer rules for a 192.168.x.x -NET and I'd prefer them commented. I already had a look inside the HowTOs and I found it would be more easy to modify a existing set than to start from scratch. TNX for your help. Matthias

2 1

PGP
by Richard 30 Aug '99

30 Aug '99

Hello I remember seeing an SuSE.de address some time ago which was an ftp site for pgp download. Can anyone send the address to me ? Thanks Richard Sheffield UK

2 1

Re: [suse-security] SuSE Security Announcement
by Orlando Ortiz 30 Aug '99

30 Aug '99

The below only states a fix for SuSE 6.1 and 6.2, does that mean that 5.3 isn't affected or that SuSE is no longer supporting 5.3 for security updates? ______________________________ Reply Separator _________________________________ Subject: [suse-security] SuSE Security Announcement Author: "Thomas Biege" <thomas(a)suse.de> at LCS-MHSLINK Date: 8/30/99 2:10 AM -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: cron-3.0.1-75 (Vixie Cron) and previous versions Date: Fri Aug 27 17:56:48 CEST 1999 Affected: maybe all Unix operatingsystems using crond ______________________________________________________________________________ Some security holes were discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on as "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description Three security threats were found in the vixie crond, which is shipped with SuSE Linux. 1) no boundchecking on a local buffer, while copying data from MAILTO 2) passing invalid options to sendmail 3) it doesn't drop root privileges while sending acknowledge mail to a user 2. Impact 1) local root compromise by putting arbitrary code on the stack 2/3) triggering a local denial-of-service attack by starting alot of sendmail daemons execute sendmail with options that only root could apply (like '-C'), which also leads to local root compromise 3. Solution Updated the crond package from our FTP server. ______________________________________________________________________________ Here are the md5 checksums of the upgrade packages, please verify these before installing the new packages: bfc9ab01fdfd36eebb3cc398bbb34c37 cron-3.0.1-84.i386.rpm (6.2) 8998dbecf020d8a6f7ba1a2885f986da cron-3.0.1-82.i386.rpm (6.1) ______________________________________________________________________________ You will find the update on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/cron-3.0.1-84.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/cron-3.0.1-82.i386.rpm Webpage for patches: http://www.suse.de/patches/index.html or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - unmoderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to majordomo(a)suse.com with the text subscribe suse-security or subscribe suse-security-announce in the body of the message. Or just issue a echo subscribe suse-security | mail majordomo(a)suse.com or echo subscribe suse-security-announce | mail majordomo(a)suse.com ______________________________________________________________________________ If you want to report *NEW* security bugs in the SuSE Linux Distribution please send an email to security(a)suse.de or call our support line. You may use pgp with the public key below to ensure confidentiality. ______________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBN8ogGney5gA9JdPZAQGYTggAkropbyQJN3dFi4EZZoyaQxNgzNorCTaS 5aqZFKZNelcl1lUtNpjwfIhHGDjsbScBBpoVa2entvGiyytQphu6S89YBTEtHRiy fp+DICgHqO90LtSMxVXU9rYsuXqneAtdBLXjzOkN49asS/nYWoZO4TQiWotGASTF SxEW9evQgWgfD2dEMI2LPzoc/ygK81P2e5ezzBuiOTxTpkjkfYPsRlFOMZX93Thr 68xYtaB0PhOA3NVf+BDSDZNIVnaPN3yfaLqP6KRfZ5q0uRNudereeNpRfbtv6pwD zDyuZvcG986Chybd67NpvUs36osTVp8ugs2MyGl/s/833W7umh5ulA== =ruO5 -----END PGP SIGNATURE----- --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1