August 1999 - openSUSE Security - openSUSE Mailing Lists

"logrotate"
by Huk 30 Aug '99

30 Aug '99

Hello all, I have problem with suse "logrotate" ,after backups logs from /etc/logfiles all backups has permission root.root 644,but in /etc/logfiles i write correct owner.group and permission. For example it's happends with default logfiles from SuSE 6.0 installation: nickaa@mordor:~/download > ls -l /var/spool/uucp total 915 -rw------- 1 uucp uucp 0 Авг 25 15:07 Debug -rw-r----- 1 uucp uucp 339460 Авг 30 18:41 Log -rw-r--r-- 1 root root 231117 Июл 10 19:45 Log-990710.gz -rw-r--r-- 1 root root 226680 Авг 26 08:15 Log-990826.gz -rw-r----- 1 uucp uucp 19948 Авг 30 18:21 Stats -rw-r--r-- 1 root root 109317 Авг 30 09:15 Stats-990830.gz drwxr-xr-x 5 uucp uucp 1024 Июн 6 00:52 lcmail nickaa@mordor:~/download > cat /etc/logfiles |grep uucp /var/spool/uucp/Log +2048k 640 uucp.uucp /var/spool/uucp/Stats +1024k 640 uucp.uucp -- /Huk (mailto: nickaa(a)soldier.net)

1 0

WU-FTPD Security Update
by Thomas Biege 30 Aug '99

30 Aug '99

Hi, SuSE Linux is not vulnerable to the new wu-ftpd security breach. We ship wu-ftpd-2.4.2-beta-18, which doesn't use the mapped_path stuff. Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = E3 42 DA D1 3B 9C 23 D0 93 1F B8 2E 6B 9A 45 82

1 0

Access Control Lists & ext2fs?
by Andreas Gruenbacher 28 Aug '99

28 Aug '99

Dear All, [My apologies for posting to two lists at once, to anybody who considers this inappropriate.] I am desperate to find that SuSE Linux, and Linux in general AFAIK, does not support anything similar to Access Control Lists as known from Windows NT's NTFS, or some commercial *NIXes. The user/group/world permissions scheme has inherent limitations that make it almost impossible to implement advanced permission schemes; most notably this scheme is not extensible (One cannot simply grant/ deny permissions to an additional user or group). Has anybody got suggestions on how to remedy this restriction with current releases? Are there other ways to implement more elaborate security schemes on the filesystem level? Rémy Card, the maintainer of ext2fs, presented some slides on implementing ACL's at the Second International Linux and Internet Conference, in Berlin, Germany, on May 23 and 24 1996: <ftp://tsx-11.mit.edu/pub/linux/packages/ext2fs/slides/berlin96/acl-1.eps.gz> This was way back in time though---I wonder whether this will become a feature of Linux anytime soon; especially since the latest developer kernel sources seem not to include anything like that. Two guys from University Bremen did some work on that as part of their Live! project: <http://aerobee.informatik.uni-bremen.de/acl_eng.html> Their code didn't get adopted (yet), it seems. Any ideas or suggestions are welcome. Andreas ----------------------------------------------------------------------- Andreas Gruenbacher, a.gruenbacher(a)computer.org

1 0

Re: [suse-security] IP Chains
by Richard 28 Aug '99

28 Aug '99

Robert > ipchains -P input DENY > > Note that things are case sensitive! > > But before you go too much further, read IPCHAINS-HOWTO. The > Works fine. I'll have a good look into the Howto once again. Thank you :-) Richard Sheffield UK

1 0

IP Chains
by Richard 28 Aug '99

28 Aug '99

Hello I'm a bit new to the concept of ipchains. Can someone explain what command to issue to block folk from outside my machine from getting into it from the internet. I've tried IP chains -P input deny but that isn't accepted by the ipchains utility. What's the correct sytnax ? Also.... how do I include a command for protecting X- windows ? It's a standalone machine just now but I'll connect it to the network eventually. Thank you Richard Sheffield UK

2 3

wu-ftpd update in sight?
by Lutz Jaenicke 28 Aug '99

28 Aug '99

Hi, last week another buffer overflow in wu-ftpd 2.5.0 was found. A patch was issued from the developers on Wednesday. Is SuSE-wuftpd also endangoured? When will the fix be available? Reference: bugtraq id 599: Multiple Vendor Wu-Ftpd Buffer Overflow Vulnerability Uh, I nearly forgot to ask about bugtraq id 602: Vixie Cron Buffer Overflow Vulnerability Regards, Lutz Jaenicke PS. For my HP-UX systems I have recompiled wu-ftpd myself, but I don´t want to waste my time if a suse_update is issued soon. -- Lutz Jaenicke Lutz.Jaenicke(a)aet.TU-Cottbus.DE BTU Cottbus http://www.aet.TU-Cottbus.DE/personen/jaenicke/ Lehrstuhl Allgemeine Elektrotechnik Tel. +49 355 69-4129 Universitaetsplatz 3-4, D-03044 Cottbus Fax. +49 355 69-4153

2 1

Cron exploit?
by Mr. M 27 Aug '99

27 Aug '99

There was an advisory on bugtraq today for a buffer overflow in the version of cron included with RedHat 4.2, 5.0, 6.0. I was wondering if anyone at SuSE would care to comment if we are vulnerable as well? TIA, Mario

2 1

Potential Local User Compromise
by Ben Livingood 27 Aug '99

27 Aug '99

In SuSE 6.1 if I start up X from console 1 it starts the Xserver on console 7. Even through a locking program if I hit ctrl-alt-f1 I can hop back to my old console and then background that process. The security problem is if someone local to the machine was to hop on and do the same he could gain access to my account, no fuss no muss. Is there a way to defeat that bypass other than running @ Level 3 in init.d? Ben -- To Regret one's Mistakes, Is To Regret One's Experiences -O. Wilde

4 3

Re: [suse-security] Apache Source Tree under 6.1
by Michael T. Reiff 26 Aug '99

26 Aug '99

HI Ralf Steenbock wrote: > > Well, if you look at the "Filesystem Hierarchy Standard -- > Version 2.0": 4.6 Does it have to be right, or the best solution, or reflect requirements in a real environment just because the FHS tells us so ??? > /usr/local : Local hierarchy > The /usr/local hierarchy is for use by the system administrator > when installing software locally. Exactly. So please tell me which *user* needs to run Apache locally ??? In other words : /usr local is for packages that no one else would need. So why then share it over the network ??? Personally, I found that /usr/local is often mounted to a small local disk (often < 4 GB), while /usr and /opt reside on large NFS volumes with oodles of GB's. Partly due to the fact that quite some people found it to make sense to put DB2 and/or its data there (along with other large stuff). > It needs to be safe from being overwritten when the system > software is updated. The "system software" is typically updated on the boot server (at least I hope so). > It may be used for programs and data that are shareable amongst > a group of hosts, but not found in /usr. In fact that's what the FHS says ... and I think the people who drafted that fine document should think this part over once more. Of course you could argue that /usr/local could be an exported server volume just as well, however /usr/local can (partly) be written by (some) users, and I just don't like the idea that Joe User would be able to spread his stuff across my network and pour it into my server. He's free to mess up his, and only his /usr/local dir mounted to his local disk. Btw, the KDE developers seem to share my view too. Would you really like to maintain a package like KDE in /usr/local on a couple dozen or hundreds of machines, with its hundreds of components in steady change ??? The way it is now, it's easy to test drive new releases while the production system can remain unchanged. Simply clone the disk behind /opt/kde and use the duplicate for toying around, and mount the original disk again next morning. > /var? You're kidding... "Linux System Administrators' Guide > 0.6": The /var contains data that is changed when the system > is running normally. It is specific for each system, i.e., not > shared over the network with other computers. Like I said, /var is not the best place, and if an exported mount exists for /opt, such stuff should go there. However, /opt is not necessarily existant on every unix machine (because it deosn't need to since it's available via NFS ... ) Btw I somehow got the impression that you assume I'd put the entire /var sub-tree on the same physical disk ... I may not be the ultimate unix guru, but I'm not *that* stupid neither ;-) -- C U ... Mike :-) (mr(a)java-factory.com) PGP Fingerprint: C8BE A34B 5CD3 660E 01C4 BA1F E42E 1E67 PGP Key ID: 0x7714DA0B 2048 Bit RSA / IDEA

2 2

RE: [suse-security] I Need to build a router (THIS WEEKEND!)
by "Schäfer, Axel" 25 Aug '99

25 Aug '99

Hi! You could use routed or gated. I am using routed, because we have a really big network with many routers here - they talk using RIP. I just started the service in the rc.config, and that was it (as far as I remember). You could too set up some static routes (I think). Look at man routed. I had positively not problems with it. Axel > -----Original Message----- > From: Arjen Runsink [mailto:arjen@technologist.com] > Sent: Wednesday, August 25, 1999 10:57 AM > To: suse-security(a)suse.com > Subject: [suse-security] I Need to build a router (THIS WEEKEND!) > > > Hello security people, > > I have been following this list for a while with much > interest being rather > a newbie to configuring a firewall/router (intermediate in > configuring a > linux system 'an sich'. > > Well, I have a problem that will arise this weekend, and to > solve it I need > a router with a static route (perhaps) on the outside that > just allows for > mounting an NT share. > > I need pointers and advice please. BTW, I am reading the IPCHAINS and > firewall How-To at the moment, but that is a lot of material > for something I > can only spend a few hours on. > > > TIA, Arjen > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0