September 1999 - openSUSE Security - openSUSE Mailing Lists

Fwd: Mail delivery failed: returning message to sender
by Derek J. Balling 22 Sep '99

22 Sep '99

Can the listowner, if you're out there, confirm that the mailing list DOES in fact set the SMTP-Envelope to the mailing-list-owner or the like? This could either have come to me because my address was still in the SMTP envelope (which would be broken) or if the end-recipient's MTA actually looks at the From: address to send a bounce message (even more broken). Either way, can we get it corrected? >X-Failed-Recipients: rnilsen@localhost >From: Mail Delivery System <> >To: dredd(a)megacity.org >Subject: Mail delivery failed: returning message to sender >Date: Thu, 23 Sep 1999 01:08:00 +0200 > >This message was created automatically by mail delivery software. > >A message that you sent could not be delivered to all of its recipients. The >following address(es) failed: > > rnilsen@localhost: > unknown local-part "rnilsen" in domain "localhost" > >------ This is a copy of the message, including all the headers. ------ > >Return-path: <dredd(a)megacity.org> >Received: from rn (localhost) [127.0.0.1] > by rn with esmtp (Exim 2.05 #1 (Debian)) > id 11TvO7-0003Mk-01; Thu, 23 Sep 1999 01:01:23 +0200 >X-daxnet-delivery-id: 199909221316 >Received: from pop1.c2i.net > by fetchmail-4.6.4 POP3 > for <rnilsen/localhost> (single-drop); Thu, 23 Sep 1999 01:01:23 CEST >Received: from lists.suse.com (host1.colo.suse.com [209.144.167.132]) > by falk.c2i.net (8.9.3/8.9.3) with SMTP id PAA19336 > for <rnilsen(a)c2i.net>; Wed, 22 Sep 1999 15:16:00 +0200 (MET DST) >Received: (qmail 12689 invoked by alias); 22 Sep 1999 13:21:57 -0000 >Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm >Precedence: bulk >X-No-Archive: yes >list-help: <mailto:suse-security-help@suse.com> >list-unsubscribe: <mailto:suse-security-unsubscribe@suse.com> >list-post: <mailto:suse-security@suse.com> >X-Mailinglist: suse-security >Delivered-To: mailing list suse-security(a)suse.com >Received: (qmail 12682 invoked from network); 22 Sep 1999 13:21:57 -0000 >Delivered-To: suse-security(a)suse.com >Message-Id: <4.2.0.58.19990922061324.00a63ad0(a)mail.megacity.org> >X-Sender: dredd(a)mail.megacity.org >X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.0.58 >Date: Wed, 22 Sep 1999 06:14:52 -0700 >To: Stephan Lauffer <lauffer(a)ph-freiburg.de>, > cogNiTioN <cognition(a)bigfoot.com> >From: Derek Balling <dredd(a)megacity.org> >Cc: Peter Griessl <griessl(a)ihs.ac.at>, suse-security(a)suse.com >In-Reply-To: <Pine.LNX.4.10.9909221449400.8166-100000(a)lis1.ph-freiburg.d > e> >References: <Pine.LNX.3.96.990922102549.26926A-100000(a)Pingu.cognite.net> >Mime-Version: 1.0 >Content-Type: text/plain; charset="iso-8859-1"; format=flowed >Subject: Re: [suse-security] nscd and other demons >Content-Transfer-Encoding: 8bit >X-MIME-Autoconverted: from quoted-printable to 8bit by falk.c2i.net id >PAA19336 >X-UIDL: 7e1d5eda2b21d85bcef7609360f2ea37 > >At 02:56 PM 9/22/99 +0200, Stephan Lauffer wrote: > >Maybe - if you´re the sysadmin of a server, you must check and modify > >the system in any cases. > >A "normal user" instead normally does not have a internet > >connection 24h a day and also no static ip-adress. So it´s not very > >important, if the security-level of the system is not very high. > >I would contest this. In the US, at least, 24h/static is becoming a fairly >common beast, with the proliferation of Cable Modems and xDSL. Considering >that the "power user" is the one most likely to go for those connection >options, and the "power user" is also the one most likely to be running >Linux, there's a correlation there that should not be overlooked. > >... because "power user" != "knowledgeable system administrator" > >D > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com

1 0

APOP auth (was Re: [suse-security] nscd and other demons)
by Chrissy LeMaire 22 Sep '99

22 Sep '99

It would be cool if the popper rpm came with APOP already configured for qpopper. APOP uses a different database for passwords (so if you crack the password, you still cant login via shell..you can just check mail), and also sends the passwords over an encrypted channel. but then again.. you cant have apop AND clear text.. and alot of email clients dont support apop (Qualcomm's Eudora for win32 does ;).. so maybe have two copies of qpopper. One that does clear text and one that does APOP ..and uncomment the one you prefer out of inetd.conf I love APOP:) >By the way; pop3, imap, ftp, telnet, samba without encrypt passwords, nis >are not secure. So, if you´re planing to sell a secure distribution, you >must not distribute netscape, because all users can configure a pop3 >account. ;) >pop3 without ssl, oder imap without ssl is a high risc.

1 0

followup
by Chrissy LeMaire 22 Sep '99

22 Sep '99

Hey All... after much troubleshooting.. i found that its possible my previous statement about ipchains and slow ftp speeds may have had nothing to do with eachother. After turning off the firewall, the speeds were the same *slaps forehead*.. I'm not sure if these were the results before.. my mind is cluttered ;) Anyways, can it be possible that theres something slowing it down in 6.1. Everything was nice and fast in 6.0... netstat shows a bit of data in the Send-Qs Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 59860 my.host:ftp-data other.host:1093 ESTABLISHED is that normal? the servers at my uni show all 0s in the send-q.. but the isp i used to work for shows a bit.. any suggestions would be helpful.. or if you were one of the "me toos" did you ever fix the problem? Thanks Chrissy

2 1

Re: [suse-security] nscd and other demons
by Derek Balling 22 Sep '99

22 Sep '99

At 02:56 PM 9/22/99 +0200, Stephan Lauffer wrote: >Maybe - if you´re the sysadmin of a server, you must check and modify >the system in any cases. >A "normal user" instead normally does not have a internet >connection 24h a day and also no static ip-adress. So it´s not very >important, if the security-level of the system is not very high. I would contest this. In the US, at least, 24h/static is becoming a fairly common beast, with the proliferation of Cable Modems and xDSL. Considering that the "power user" is the one most likely to go for those connection options, and the "power user" is also the one most likely to be running Linux, there's a correlation there that should not be overlooked. ... because "power user" != "knowledgeable system administrator" D

3 3

Fwd: Re: [suse-security] nscd and other demons
by Martin P. Peikert 22 Sep '99

22 Sep '99

On Wed, 22 Sep 1999 you wrote: >And then give the user a choice of what demons it wants run, Try editing the configuration file! >and then warn >the user of the security risks involved with the running of that demon, I don't think that this is always possible. Most (I hope so!) of the security related bugs are not known at the date of the distribution release. >possibly by directing them to some security documentation. Most users will >be unaware of what demons are running, True. That's not their job, its the job of your sysadmin. >and what those demons are, so >they're unlikly to know about the security of them. More advanced users >are less likly to use yast for getting demons started. Why? Edit the config - see above... > >Just an idea. > >cog >-- ,------------------------------, >,====================| S H U N A N T I O N L I N E |===================, >| David M. Webster '------------------------------' (aka cogNiTioN) | >|=======================================================================| >| cognition(a)bigfoot.com |=============| cognite.net will be online RSN. | >'====== I use Linux everyday to up my productivity - so up yours! ======' -- ---------------------------------------------------- Dipl. Math. Martin Peikert EN 636 TU Berlin fon 314-23881 Sekretariat EN 2 fax 314-22284 http://www-tet.ee.tu-berlin.de/peikert/index.html ----------------------------------------------------

1 0

ipchains
by flea 20 Sep '99

20 Sep '99

Hello, sorry if your on the the other SuSE lists as this is now being posted to both. Sadly, I didn't get much help there. I'm trying to set up my linux box to do the following jobs: 1. I want to use it to act as a proxy(is this the right word) for the rest of my lan. it's already doing that nicely. 2. I really don't want to serve anything to the outside world. 3. I would like to be able to access sshd, httpd and ftpd to the lan only. So far, I've used hosts.deny with ALL:ALL, and hosts.allow ALL:192.168.0.3 I'd like to extend that to everything that starts with 192.168., but I'm not sure how. Can I use ALL:192.168.*/32(24?) or somthing like this? I've also tried to to add the following line to rc.firewall (where all my chains live now): /sbin/ipchains -A input -p tcp -i ! eth1 -s 0/0 -d 0/0 80 -j DENY This seems to be working, just wanted to see if anybody could tell me if this is the best way to do this and if it will effectivly block out traffic on eth0 to port 80. If this does work, then I'll add two more but change the port to 21 and 22 (sshd and ftpd) Thanks in adavance, flea

1 0

SuSE Security Announcement
by Thomas Biege 20 Sep '99

20 Sep '99

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: pbpg-1.x Date: Tue Sep 21 00:35:49 MEST 1999 Affected: all Linux distributions using pbpg _____________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on as "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The /usr/bin/pg and /usr/bin/pb tools can be used to read any file on the system. 2. Impact An attacker can read e.g the /etc/shadow file or private email. 3. Solution Updated the pbgp package from our FTP server. ______________________________________________________________________________ Here are the md5 checksums of the upgrade packages, please verify these before installing the new packages: a3591927cdb148abdc32b677fa5caa33 pbpg-1.2-0.i386.rpm ______________________________________________________________________________ You will find the update on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update/6.2/ham1/pbpg-1.2-0.i386.rpm Webpage for patches: http://www.suse.de/patches/index.html or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, just send an emtpy message to suse-security-subscribe(a)suse.com or suse-security-announce-subscribe(a)suse.com like this: echo | mail suse-security-subscribe(a)suse.com or echo | mail suse-security-announce-subscribe(a)suse.com ______________________________________________________________________________ If you want to report *NEW* security bugs in the SuSE Linux Distribution please send an email to security(a)suse.de or call our support line. You may use pgp with the public key below to ensure confidentiality. ______________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBN+a4vney5gA9JdPZAQGH1wgAhPzCRONHsfVZehBJoZ9XtYkVs7cJIelU yIcuLP49JQj8j9ztqm1hW/opBExHyo4ZTlKR4j0j3Us7+IcZ/9aLJaXhEIr1kse5 0omdkTKvf2Aqqvs3j4Rc7J41sMwHY+HFf5HzSDHloDCrc8iqb4IjhKc3TWK9n8Zn bTlht9CD6TvehWU2w2tH32OGdbkKrEQLTeObTE8Z1/zme0s8cEnTbFRUZKJlrBgr L2JLbrMc9gxCl34sh26io0sZHt0CsYsWCHNsDVdmMYB362kXAnnasJOoT/r7Suxt T+sa8tKfwAo0GL30IIMJqI1ahPJg3Hn9qgOh0glGkGJ69tpJdANyag== =RkaP -----END PGP SIGNATURE-----

1 0

SuSE Security Announcement
by Thomas Biege 20 Sep '99

20 Sep '99

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: sccw-1.1 and earlier Date: Mon Sep 20 23:40:09 CEST 1999 Affected: all Linux distributions using sccw _____________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on as "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The /usr/bin/sccw tool can be used to read any file on the system. 2. Impact An attacker can read e.g the /etc/shadow file or private email. 3. Solution Updated the sccw package from our FTP server. ______________________________________________________________________________ Here are the md5 checksums of the upgrade packages, please verify these before installing the new packages: f70f788861bf0ee402405a7dc14431a sccw-1.1-32.i386.rpm (6.2) ______________________________________________________________________________ You will find the update on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update/6.2/ham1/sccw-1.1-32.i386.rpm Webpage for patches: http://www.suse.de/patches/index.html or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, just send an emtpy message to suse-security-subscribe(a)suse.com or suse-security-announce-subscribe(a)suse.com like this: echo | mail suse-security-subscribe(a)suse.com or echo | mail suse-security-announce-subscribe(a)suse.com ______________________________________________________________________________ If you want to report *NEW* security bugs in the SuSE Linux Distribution please send an email to security(a)suse.de or call our support line. You may use pgp with the public key below to ensure confidentiality. ______________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBN+a37ney5gA9JdPZAQFznAf/aG/yLAmiP9syFLnHsl87Rar9tslRPt4k 1/ujpI1Sx0ALMhMMf5zv4k118dxJ2iyir62XXj9waHaSTJmeXALj0Q/1bzo42jnr uhEe1R2va0neOfLVhOXU6ZakMEOPux6DtJ2KAR+YD8+fD98tWBYu9WuwipAZbLQ8 /B0XWrdPRPW8zt4mUKBy7h4HJMngRGmHigrBWgA4FAR4jM9NyMZ/8qbiWEVoE+g7 Swowsay5J06OC4fhCJqiUcAmR1JlXQoPAXF8pR9l8j/vALJ3/PnzpBa4xaT9UH96 CBSx0UYItH4VtTYYBpgte62hF48QDZD16URhobWl/BY3rpi3lBcrhQ== =IuJU -----END PGP SIGNATURE-----

1 0

only ftp login over ISDN
by Dominic Santi 20 Sep '99

20 Sep '99

hello all How can I restrict the "login" over ISDN to ftp? The user connect the Server over ISDN. And he can use only the ftp service. What is the right way? thanks for help best regards dominic

1 0

Apache Source Tree under 6.1
by Niall Cosgrove 20 Sep '99

20 Sep '99

hi, apache.spec tells me not to run under a production system so how do I get the source tree for the 6.1 apache.rpm (binary) that i am already running on my production system do suse have any plans to syncronise their source archive with the binaries that they supply? Niall (feeling a bit disappointed/confused)

13 13