September 1999 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Firewall Script
by Richard 26 Sep '99

26 Sep '99

Daniele Thanks for writing..... > ut I think that you should read the Firewall HOWTO, to understand what > a firewall is, or how a firewall works. After this you are able to > write your own "rules" (read the ipchains-HOWTO to understand what a > rule is). > This is the sort of thing that I get all of the time. I've read all of the howtos and even printed some of them out. Hardly any of it is of any use to anyone. I've even got a very big bookshop down the road which will get hold of a book for me and allow me to read it without paying for it. Nothing doing there either. Finally I've contacted a publisher and asked him if we can publish -- a book that covers the security aspects of linux. The ones that are available are completely useless. I've read most of them so I should know. Perhaps SuSE would like to contribute to a new book on security issues ? I can get advice for free from at least twelve British universities. My reason for writing to the SuSE security list is that I can get a different point of view from the inward looking and conservative opinions that England is full of. Anyway I've finally worked it out :-) Thanks to everyone :-) Richard Sheffield UK

1 0

Scanning from ftp.suse.com
by Russell Evans 25 Sep '99

25 Sep '99

I have the scanlogd package installed on my linux box. It has repeatedly logged scanning from 209.144.167.150:20 when I am downloading updates and KDE 1.2 packages from ftp.suse.com. My box sits behind a Cisco 675 that is doing NAT. The box being scanned is on the 10.0.0.0 network. It seems because I have an established connection with ftp.suse.com, my box can be scanned, even though the box is on a non-routable address space. I am not an expert and am wondering if the scanning is really coming from ftp.suse.com or am I being lead to that conclusion by the person scanning. The fact that I have wiped out my original install, as well as all the other nodes in my small network, changed network node numbers, was scanned again only after logging on to ftp.suse.com, and the fact that the only node scanned on my small home network was the only one connected to ftp.suse.com, makes me believe that the scanning is started when I connect to ftp.suse.com. Any help would be appreciated. Thank you Russell

2 1

Port 113?
by Jochen Lillich 25 Sep '99

25 Sep '99

Hi! Our firewall detects (and denies) connections from our external web server to our mail servers port 113 (ident). What causes the web server to use that port? And should I permit these connections? Regards, Jochen -- *** Linux BBS: Die deutsche Website fuer Linux-News und -Infos *** http://www.linuxbbs.org/

2 1

Re: [suse-security] Location of the Apache document root
by Volker Kuhlmann 25 Sep '99

25 Sep '99

> Well, if i'm not badly wrong with my files, SuSE 6.2 default > configuration does allow to follow symlinks. /etc/httpd/httpd.conf: I didn't check the docs. If symlinks are enabled by default, may I ask SuSE why that is really necessary. If I understand things correctly, both Bugtraq and the apache authors consider that to be a security risk too big to take. The default should be "safe", not "make things easy for idiots/M$-users/ex-M$-users". "safe" and "easy" are not necessarily mutually exclusive. > Nope. You can set an alias to point to wherever you want. Good - then get everything out of /usr/local. That is *MY* place (having the default doc root in there is a good idea though, as long as it's empty). Being new to SuSE, finding /usr/local not empty was rather annoying. It's a sign of being disorganised, IMHO. > I'd place no example scripts at all in the cgi-bin. I'd place them in > the apache documentation under /usr/doc/packages/apache so that anyone > willing to experiment with them may chose to copy them manually to the > cgi-bin. Yes please. Default = "safe". If some sysop wants the scripts, copy them. In that case, there's more work to be done anyway so it doesn't make things more difficult for the inexperienced, and it doesn't put users at risk who don't use the stuff. > In the ideal case, the cgi-bin should left empty in order to separate > locally installed scripts from those that comes with the distribution. That is also a question of being organised? (Hey you Germans?!???) Volker

1 0

pam_smb_auth.so
by tschweikle＠FIDUCIA.de 23 Sep '99

23 Sep '99

Hi! following the instructions given with pam_smb_auth.so I get: sshd[2158]: pam_smb: Local UNIX username/password check incorrect. sshd[2158]: pam_smb: Configuration Data, Primary XCNLM00S, Backup XCNLM00S, Domain NLM2. sshd[2158]: pam_smb: Correct NT username/password pair sshd[2158]: fatal: Connection closed by remote host. The host is listed as beeing part of the NT domain. pam_smb.conf holds the domain and the PDC (no BDC used PDC again instead). Authentification for samba users works for this host. Security is set to domain, password server is XCNLM00S. Any clues? -- Thomas Schweikle

1 0

IPchains
by Richard 23 Sep '99

23 Sep '99

Hello Thanks for the help with the last one. I'd like to configure the firewall to work with ipchains. What do I add to ipchains -P input DENY to get my mail apps, web browser and ftp to work with ipchains ? Receiving mail is on port 110. Sending mail is on port 25. My ISPs cache for the browser is on 3128. Not quite sure about ftp. I've read the howto and it's very clear how to enable ipchains but not so clear on how to enable ports. Thank you Richard Sheffield UK

3 2

Re: [suse-security] Location of the Apache document root (was: Apache Source Tree under 6.1)
by Volker Kuhlmann 23 Sep '99

23 Sep '99

> > I'd place the apache manual to /usr/doc/packages/appache/manual/ and > > set a symlink from /usr/local/httpd/htdocs/manual -> > > /usr/doc/packages/appache/manual to allow the example page to refer to > > the manual. Thus after installing one might decide to leave or to > > delete this link in order to have or to have not the apache manual on > > the server. > This is definitely a reasonable idea. I will change this in the next > major release of SuSE Linux. However I prefer an Alias to a symlink. By default, apache will not follow symlinks, at least not to outside the main document root. This is at least the default Red Hat 6.0 setup, and should be the default setup for any good distribution. The alias therefore seems a much better idea. Or does that have to be in the main document root too? > > While we're on the security list, cgi-bin is non-empty. I remember that > > by some default on some distribution it contained a file with serious > > security problems?!? > > > The programs in our cgi-bin should all be harmless. However I will > change the permissions in secure and paranoid settings to 000. As was pointed out before, the program is testcgi. However, I now backtracked the Bugtraq list, and the script I was referring to is cachmgr.cgi. -----from bugtraq: cachemgr.cgi is the manager interface to Squid web proxy/cache server. As all manager interface tools access to it SHOULD have restricted access by default, not open for public access. If you are not using the box as a Squid www proxy/cache server then uninstall the package by executing "/etc/rc.d/init.d/squid stop ; rpm -e squid". If you are indeed using the Squid proxy server software, then make the following actions to at least minimally secure access the manager interface: mkdir /home/httpd/protected-cgi-bin mv /home/httpd/cgi-bin/cachemgr.cgi /home/httpd/protected-cgi-bin/ and add the following directives to /etc/httpd/conf/access.conf and srm.conf --- start access.conf segment --- # Protected cgi-bin directory for programs that # should not have public access <Directory /home/httpd/protected-cgi-bin> order deny,allow deny from all allow from localhost #allow from .your_domain.com AllowOverride None Options ExecCGI </Directory> --- end access.conf segment --- --- start srm.conf segment --- ScriptAlias /protected-cgi-bin/ /home/httpd/protected-cgi-bin/ --- end srm.conf segment --- Then execute "/etc/rc.d/init.d/httpd restart" to reconfigure your Apache HTTP server to allow localhost access to http://localhost/protected-cgi-bin/cachemgr.cgi. Change the allow rules accordingly if you have other stations that need access to the protected-cgi-bin directory. You are also recommended to move any other cgi-bin programs not inteded for public access from /home/httpd/cgi-bin to /home/httpd/protected-cgi-bin, if you have any. Disclaimer: Squid does not install cachemgr.cgi in a HTTP accessible directory by default. It is the administrators responsibility (or in this case the RedHat package maintainer) to set up proper HTTP access to it. ----- end from bugtraq Volker

2 1

Re: [suse-security] nscd and other demons
by cogNiTioN 23 Sep '99

23 Sep '99

On Wed, 22 Sep 1999, Martin P. Peikert wrote: > Try editing the configuration file! See below, > >and then warn > >the user of the security risks involved with the running of that demon, > > I don't think that this is always possible. Most (I hope so!) of the > security related bugs are not known at the date of the distribution release. Fair point, but there are ways to set up a service to make it more bullet proof. Off hand I can't think of an eg, which doesn't help my case. Wasn't there some talk on this list a month or so back where starting some demon with a certain tag made it open to DoS attacks? > >possibly by directing them to some security documentation. Most users will > >be unaware of what demons are running, > > True. That's not their job, its the job of your sysadmin. Sorry should have been more specific. By user, I ment someone who uses Linux at home, and are both the sysadmin and the only user. Someone in the situation I am. > >and what those demons are, so > >they're unlikly to know about the security of them. More advanced users > >are less likly to use yast for getting demons started. > > Why? Edit the config - see above... Why what? Why are more advanced users less likly to use yast? That seem to be the question you're asking, but given it's followed by "Edit the config" I don't think that's what you ment. Like I said, editing the config files is fine if you know where they are, know how to edit them, and know what format to add entries in, if you are a more advanced user. I personally stopped using yast after it messed with my sendmail and ppp configs, which I'd spent week getting to work. I like knowing how to do stuff manually, I dislike 'clever' programs. Others do like them, and some people need them. I think Linux should be open to everyone, not just those able to learn, and 'roll their own' config files. Home Linux users may well be new to Unix, they may not know where the configuration files are, or even that they exist. Some won't know what demons are, or don't full understand the concept of them, and are unlikly to use them. Assuming that the user who is also the sysadmin will know about stuff like this is, IMNSHO, stupid. If they came from a Windows world, they had everything avaliable through a point and click control panel. Now I don't use X so I'm not sure on this, but I'm willing to bet that there isn't the equivilent of the Control Panel for KDE/Gnome, not one which covers stuff like starting and stopping demons, anyway. > >Just an idea. Obviously an idea that doesn't go down well with people who think that the only people able to run Linux should be the ones who already know how to. cog -- ,------------------------------, ,====================| S H U N A N T I O N L I N E |===================, | David M. Webster '------------------------------' (aka cogNiTioN) | |=======================================================================| | cognition(a)bigfoot.com |=============| cognite.net will be online RSN. | '====== I use Linux everyday to up my productivity - so up yours! ======'

2 1

Re: [suse-security] YaST problems
by Casey Bralla 23 Sep '99

23 Sep '99

I believe YaST uses case sensitive user names, while eMail always defaults to lowercase. You may want to check this. On Tue, 21 Sep 1999 14:07:47 -0500, Bryan Porter wrote: >Greetings : > >I'm running SuSE 6.2 and am having some problems with YaST... if I add a >user to my system, then try to send mail to that user, or su to that >user, or do anything to that user, I get a 'User does not exist' error. >HOWEVER, the user is listed in both the shadow and passwd files, belongs >to a vaild group, has a mail spool and a home directory. I'm more that a >little confused. :) > >Any help here would be greatly appreciated. > >Regards, >Bryan Porter > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > Casey Bralla Chief Nerd In Residence The NerdWorld Organisation http://www.NerdWorld.org LinuxList(a)NerdWorld.org

1 0

Re: [suse-security] nscd and other demons
by Chris Saia 23 Sep '99

23 Sep '99

dproc(a)dol.net writes: >> One paper to start securing linux is >> http://www.interact.com/~lspitz/linux.html > interact.com is not showing up on our nameservers. He probably means www.enteract.com. -- =============================================================================== csaia(a)wtower.com, WTnet IRC Administrator - http://www.wtower.com/~csaia/ GNU Privacy Guard Public Key information is available at the above URL. ===============================================================================

1 0