January 2000 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Passwords
by Frank Hart 31 Jan '00

31 Jan '00

Brian Galbraith <brian.galbraith(a)bigfoot.com> writes: > However I was still able to log in as root using abcdefgh, AND > abcdefghxy > How can this happen? I have now changed it to abcdejkl and now have > proper access restored. Unix, and Linux, only look at the first eight characters of your password. So if your password is 12345678 or 12345678910112, for Linux it's the same. > (These examples are for illustration purposes only, and bear no > resemblance to the actual passwords) > > Regards > Brian HTH, -- Frank Hart - mailto:frhart@home.nl SuSE Linux 6.3 - Kernel 2.2.14 on a i686 450 Mhz with 128 Mb RAM

6 7

Re: [suse-security] yp & shadowed passwds
by Eilert Brinkmann 31 Jan '00

31 Jan '00

Christoph Schaefer <christoph.schaefer(a)student.uni-tuebingen.de> wrote: > I want to have shadowed passwords on my yp-net because I do not want > that every user can see the encrypted passwords. > I have only one master ypserver, no slaves but about 20 clients. That's > why it would be great if I have to change only some config options on the > master. As others already pointed out you can't have a "protected" NIS map for shadow passwords. > Is there any cheap-dirty-little trick? Yes, there is a *dirty* trick. Don't distribute the encrypted passwords via NIS. Set the password field in the NIS map passwd to "x" and keep a shadow file locally on every host. Then the shadow file must be updated by other means, e.g. secure copy, which can be done automatically by a cron job. Although I don't know the exact procedures used here, something like this is done in our faculty's network (NIS servers: Solaris; clients: Solaris, Linux, Irix). I don't know much about NIS configuration, but this should be possible with a Linux server, too. Ok, it's not really the solution you asked for... Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0

POP3 with Outlook SSL
by F. Spitzer, GEOSYSTEMS 31 Jan '00

31 Jan '00

Hi, I am wondering if anyone has an idea how to implement a POP3-concention over SSL from Microsoft (Outlook 98, Outlook-Express) on a Linux mailserver I am currently using Qpop that comes with SuSE 6.3 as default POP3-Daemon. The windoof-clients are using Outlook 98 and Express as mail-reader-program (I am not happy with this but this was a company wide decision). To get POP3 secure the clients are using the port-forwarding option of ssh32 for windows. Most of the users are bored of this. You also have a lot of network traffic due to the open connections in the background. So I am looking for a better method. The best way would be to use the build in SSL option of Outlook. Any idea how to get this working with Linux? Thanks for your help in advance. Fritz Fritz Spitzer Systemintegration und Anwendungen _____________________________________________________________________ Abonnieren Sie kostenlos die E-GEONEWS unter http://www.geosystems.de/support/newslist GEOSYSTEMS GmbH Riesstraße 10 D - 82110 Germering GERMANY E-Mail: f.spitzer(a)geosystems.de Telefon: +49-(0)89-89 43 43 0 (Ext. 20) Telefax: +49-(0)89-89 43 43 99 URL: http://www.geosystems.de/ Wissensbasierte Klassifizierung in ERDAS IMAGINE 8.4: Infos zum IMAGINE Expert Classifier unter http://www.geosystems.de/news

2 1

yp & shadowed passwds
by Christoph Schaefer 31 Jan '00

31 Jan '00

Salut! I want to have shadowed passwords on my yp-net because I do not want that every user can see the encrypted passwords. I have only one master ypserver, no slaves but about 20 clients. That's why it would be great if I have to change only some config options on the master. Is there any cheap-dirty-little trick? I am using ypserv version 1.3.9 and ypbind version 1.6 from suse6.3. br, Christoph --- Anything that is good and useful is made of chocolate.

3 2

passwords
by willy 31 Jan '00

31 Jan '00

Hi, the UNIX/Linux password encoding mechanism is a derivation of DES, which uses a 56-bit encoding key (eight 7-bit characters). I.e. the crypt() function takes the user's password, pads it out to 8 (!) characters, and then uses 7 bits of each character to form a 56-bit DES key. This key is used to encrypt a 64-bit block of zeros, ... The final output is a string of 11 characters. A "salt" 2-character string is added to the first string. Thus, a complete encoded password entry consists of 13 characters. (see the second field in /etc/shadow) With Extended crypt the plaintext password can be longer than 8 characters; best regards willy -- Willy Luchian Paedagogische Hochschule ZIM - System- u. Netzadministration Bismarckstrasse 10; D-76133 Karlsruhe/Germany willy(a)ph-karlsruhe.de phone: +49-721-9254744 ********************************************************** Raffiniert ist der Herrgott, aber boshaft ist er nicht. A. Einstein **********************************************************

1 0

language barriers
by brian-suse＠stech.cx 31 Jan '00

31 Jan '00

Sorry about the text/html header, everyone Original Message: # I can't see a problem with a post from a distressed user in a #language I don't understand, especially in the language this list #originates from (even if it is technically an English language list). #I guess it helps that I do read German. But I can't see flaming somebody #on a security list for posting off-language, the day may well come that #somebody posts the first warning of a nasty exploit in Chinese (at which #point I can only hope whoever answers provides enough translation for #the rest of us to get a heads-up). # Now, Francisco's reply was not only off-topic, but rude. (I can #say that because most of the Spanish I've picked up at all is off topic #and rude. I've got to note that Spanish insult is damned near poetic, #though.) I've had enough of this "talk in english or be flamed" stuff. We need to have a system of translation set up. My idea: someone sends a message to the list in a non-english language and the person who is assigned to that language translates it to english and sends out the translation. Each language which is represented in this list would have a translator and 1+ back-up translators, in case the main translator was taken away to server51 by the greys with red hats. There's also the option of creating seperate lists, but that would split the community a good bit in this arena. Build on it, fix it, etc. -Brian -- Betrayal lasts one night. The results are forever. "All things being considered, a lot of considering has been done" - Brian's razor.

4 3

SuSE firewall script + UDP ports
by J�rgen Mell 30 Jan '00

30 Jan '00

Hi folks, I would like to set up a firewall using the firewals 1.4-6 packet on a 2.2.14 kernel. My problem is, that I want to use nameserver services from the (insecure) internet and time server services. For the time servers, I have to have an open UDP port 1026 for incoming UDP connections. If I set FW_UDP_ALLOW_INCOMING_HIGHPPORTS = "dns 1026" I get error messages, which are caused by a special handling of the string 'dns' in the script. Up to now, the only solution I have found is to set that variable to 'yes', but that opens all my high UDP ports, and would really prefer to have only those ports open, which I really need. Is there a better solution available? Jürgen btw., it would have been nice, if the article in SuSE's support data base would mention, that the firewall script has to be restarted each time a new dial up connection has been made :-))

2 1

RE: [suse-security] Passwords
by Brian Galbraith 30 Jan '00

30 Jan '00

On 30-Jan-2000 Ian C. Ware wrote: > hi, > > typically, at least in most UNIX systems that I have worked on, not > just > LINUX, even though you set a different password, it only recognizes > the > first 8 characters. In your example, your second password was the > same with > the addition of two more characters. > > good luck, > > Ian Thanks to everyone Regards Brian ---------------------------------- E-Mail: Brian Galbraith <brian.galbraith(a)bigfoot.com> Date: 30-Jan-2000 Time: 16:01:52 Default Key 0x63EBA765 (DH/DSA) PGP Keys from http://math-www.uni-paderborn.de/pgp/ This message was sent by XFMail 1.4.4 ----------------------------------

1 0

Passwords
by Brian Galbraith 30 Jan '00

30 Jan '00

Hi I have been looking into passwords on my system (6.3) I have been using the same password for root and myself as a user (not good practise I know) This was ok for me....but now that I have also set up my children as users I wanted to change my root password to be sure that they could not watch me and gain root access. I discovered something which surprised me. I wanted to keep the new pass word similar ...but different. eg. My old pass phrase which I used for root and user brian was abcdefgh . I changed my root pass word to abcdefghxy. However I was still able to log in as root using abcdefgh, AND abcdefghxy How can this happen? I have now changed it to abcdejkl and now have proper access restored. (These examples are for illustration purposes only, and bear no resemblance to the actual passwords) Regards Brian ---------------------------------- E-Mail: Brian Galbraith <brian.galbraith(a)bigfoot.com> Date: 30-Jan-2000 Time: 15:23:22 Default Key 0x63EBA765 (DH/DSA) PGP Keys from http://math-www.uni-paderborn.de/pgp/ This message was sent by XFMail 1.4.4 ----------------------------------

3 2

Re: [suse-security] ftpd
by Security Webmaster OKDesign oHG 30 Jan '00

30 Jan '00

-----Ursprüngliche Nachricht----- Von: christian <christian(a)devils.ch> An: Security Webmaster OKDesign oHG <security(a)okdesign.de>; SuSE-Security-List <suse-security(a)suse.com> Datum: Samstag, 29. Januar 2000 23:17 Betreff: Re: [suse-security] ftpd >Hi to all, > >had same problem today. >And now following link from SuSE support database: > >http://sdb.suse.de/sdb/de/html/olh_ftp_ls.html > Nice. Thanks for the tip. I'm guilty of not having a look at the database :-( But anyway, this doesn't work :-((( When typing in the command shown in the database, I get crest@okdesign:~ > su - -c "mknod /usr/local/ftp/dev/null c 1 3 -m 666" Password: mknod: /usr/local/ftp/dev/null: No such file or directory What's wrong here ? TIA. --- Stephan

3 2