January 2000 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] ftpd
by Security Webmaster OKDesign oHG 30 Jan '00

30 Jan '00

-----Ursprüngliche Nachricht----- Von: Michael Schönwiese <admin(a)obelix.at> An: Matthias Meyer <matthias.meyer(a)ewetel.net> Cc: Security Webmaster OKDesign oHG <security(a)okdesign.de>; SuSE-Security-List <suse-security(a)suse.com> Datum: Samstag, 29. Januar 2000 22:19 Betreff: Re: [suse-security] ftpd >Hi ! > >I installed the proftpd today and I am quite happy with that ! >proftp is a package wich comes with Suse. >For documentation on this, look at www.proftpd.net ReHi, thanks for the tip, but I'm quite happy with wu.ftpd. I already had a look at proftpd earlier and found wu.ftpd being better, at least IMHO. --- Stephan

1 0

ftpd
by Security Webmaster OKDesign oHG 29 Jan '00

29 Jan '00

Hi folks, I just found some strange behaviour of my ftpd (wu.ftpd). When logging in as anonymous, the user is pointed to /usr/local/ftp and a chroot is done. Okay, this is correct and what I want. But, no matter what subdirs and what files are in this directory, the user cannot see anything, no files, no subdirs, nothing. For the user it seems as if the directory is totaly empty. Hmm, I think I did something wrong, but I cannot find any error. Does one of you know what could be the cause of this ? (BTW, file-permissions is NOT the error) Maybe I did something wrong when trying to secure the server :-( Thanks in advance --- Stephan

4 3

Re: [suse-security] Re: VPN zwischen 2 PC im Internet
by Security Webmaster OKDesign oHG 29 Jan '00

29 Jan '00

Very nice of you to write in spanish language. Unfortunately there will be only a few people here knowing this language good enough to understand what you tell. You are right when saying that this is an english list, but you aren't doing any better ! If you don't understand german and what someone is writing, perhaps this one can't speak english but has a urgent security-question. So please just ignore it and don't blame this list with unnecessary statements. Okay, I'm doing the same right now, but I think this is something concerning everybody. Sorry for continuing this "threat". Have a nice day. --- Stephan -----Ursprüngliche Nachricht----- Von: Francisco M. Marzoa Alonso <fmmarzoa(a)idecnet.com> An: Steffen Dettmer <steffen(a)dett.de> Cc: suse-security(a)suse.com <suse-security(a)suse.com> Datum: Samstag, 29. Januar 2000 17:24 Betreff: Re: [suse-security] Re: VPN zwischen 2 PC im Internet >A mi la verdad es que todo esto me parece de puta madre, seguramente era >interesantísimo el tema, pero mazo eh? es mas, me he dicho que como me >parece tan interesante voy a contestar yo añadiendo mis comentarios... > >Steffen Dettmer wrote: >> >> * Torsten Behne wrote on Fri, Jan 28, 2000 at 21:37 +0100: >> > nicht und halte es für gefählich. Ferner muss für jeden Port den ich >> > brauche ein ssh-client laufen, ist zuviel. Ich möchte VPN nutzen. >> >> Muß nicht, wie Du selbst schreibst: > >No estoy de acuerdo, seguramente querías decir selbst donde pusiste >schreibst y viceversa, anda que me vas a explicar tu a mi ahora como >hablar alemán XDDDDDDDDD > >> >> > Ich finde nur Informationen wie ich eine VPN verbindung per pppd >> > (o.Änhliches) erzeugen kann. Nun sind allerdings beide Rechner pemanent >> > am Internet, bei verschiedenen Providern, und da gibt es keine Einwahl. >> >> Vielleicht mal das VPN-Howto? Wozu brauchst Du eine Einwahl? Die >> meisten möchten das anders herrum! > >Ah bueno, eso si, lo del brauchst totalmente de acuerdo, especialmente >si viene precedido de un Wozu o luego se pone un möchten... > >> >> pppd ist jedenfalls eine sehr nette Idee, finde ich :) Wo klemmts >> genau? > >Yes yes, a lot... pero mazo, eh?... i'm very sure de que si escribimos >everybody in english seguramente será mas probable que we'll be able to >*understand between us*, cogeis la idea o tb. voy a tener to learn a >hundred languages to everyone use his own y no me conteis las peliculas >de siempre sobre babelfish which translations are patetic, with all my >respetos por los desarrolladores de that web translator. > >Esta discusión ya la hemos tenido other times but i think while algunos >insists in escribir en el idioma que le salga de los cojones somepeople >here will protestar por ello and i think that's perfectamente legítimo >dado que this list is an *english list*. > >Don't blame me, i would like a lot to learn german, specially because i >go to germany every August to a heavy metal festival on Wacken, but have >no time... So... please... write in english... If any day i learn >german, anyway, i'll use another list to practise it... ;-P > >Have a good one everybody. > > >> >> oki, >> >> Steffen >> >> -- >> Dieses Schreiben wurde maschinell erstellt, >> es trägt daher weder Unterschrift noch Siegel. >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >> For additional commands, e-mail: suse-security-help(a)suse.com > >-- >Francisco M. Marzoa Alonso > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

martian source
by Andreas Kunberger 28 Jan '00

28 Jan '00

I've just installed SuSE 6.3 and now I get ever few secods the syslog msg: kernel: martian source cc05eb00 for 32cb2395, dev eth0 kernel: ll header: ff ff ...... Does anybody knon if this is a seurity related msg? Anderas Kunberger ITV Denkendorf

2 1

NFS(d) configuration...
by DEMERRE DIETER 28 Jan '00

28 Jan '00

-----BEGIN PGP SIGNED MESSAGE----- Hi, I'm running nfs-server-2.2beta37-1 on my machine I'm working on a HP-UX workstation running 10.20 On the HP-UX is running an automount which has in /etc/auto.mount following lines: >>>/etc/auto.mount>>> =hp -host -rw,suid,soft <<</etc/auto.mount<<< On my linux machine, I'm - as said - running nfsd. in /etc/exports, we find: >>>/etc/exports>>> /home/ftp (ro,insecure,all_squash) /home/ddemerre/prg/ps_api my_hp.our.domain(rw, secure, \ no_root_squash, map_static=/etc/nfs/psapi.map, \ anonuid=99, anongid=99) /home/ddemerre/prg/ps_api *.our.domain(ro, secure, \ all_squash, anonuid=99, anongid=99) <<</etc/exports<<< In /etc/nfs/psapi.map I put >>>/etc/nfs/psapi.map>>> uid 0-103 - uid 104 1000 uid 1001-65536 - gid 0-36 - gid 37 500 gid 38-65536 - <<</etc/nfs/psapi.map<<< It's like this: on HP i have a user with id(gid) == 104(36), which I would like to map to the uid(gid) 1000(500) i.e. the user dd (id==104, gid==36) on the HP workstation should have the permissions on the mounted device /hp/anthony/home/ddemerre/prg/ps_api like the user ddemerre (id==1000,gid==500) on the linux machine. With above configuration, I remark that *all* users on my_hp can access /hp/anthony/home/ddemerre/prg/ps_api as user ddemerre on that nfs-mount. what am I doing wrong ? Besides in /var/log/messages, I get multiple instances like this one.... about every 30 seconds... >>>/var/log/messages>>> nfsd[491]: Unable to setgroups: Operation not permitted last message repeated 127 times last message repeated 271 times <<</var/log/messages There is not much documentation on exports apart from the stuf in man, which I read, and thought to have been applying... Help greatly appreciated. B.T.W. changing the UID's on HP-UX or linux is not possible because of usage in different networks, which would cause *too big* a change... oh and B.T.W.2. I did not forget /usr/sbin/exportfs... Merry Greetings from - Z'ge Groetjes vanwege *** Dieter Demerre ----- ddemerre(a)acm.org ** http://www.angelfire.com/de/ddemerre/ ******************************************** Wanna get rid of idle Processor cycles ? distributed.net ? Try synchronising outlook. ******************************************** - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 6.5.1 Int. for non-commercial use <http://www.pgpinternational.com> mQENAzhXiLAAqQEIAMsoaNcCZFHswGBK1J4dRJvjUA7XwIICCKIKwU1HZIz5meGk rbSgfK3SwJaqQOTRveKjPYtiZ7D6H19bjsO+P9bvdvEZHLC4dCQIvJfSMlcvSvLN 2S/wpfqaDZBsFDk2WnBmah9wilrm3QE4ATbWgGDeRd/XvPuRNc10FiZjRnEp5h+1 PcBppgljLhlJuBFEKxEXxjUsyBTl1zM3Gex8u+vNvg80DtlnlUB7Kc++JkJOSa3e 7FZAN7WEXztH9rKQmeCc/a1S00zHoPBeJnsfhjaX/nUhL2MH0AfTn0fX2W7LxgEQ J9MJhxr8Ejlsj+a5wQD2OFGk4Ttn4ftB++EuukMABRG0IURpZXRlciBEZW1lcnJl IDxkZGVtZXJyZUBhY20ub3JnPokBFQMFEDhXiLDh+0H74S66QwEBr2MIAJyuK5vb 4gMBZNelDedU53df23VfyrychlEH5E2fudaqpt3pspCQgX78KK4vLWsFr9ycUUYF 0FdTQBCUuhvj8BShexU9VocxjuoSaNuNwMqNZCWIAWx3OksvkTiNmXUC8rswxYKu Z81O8LQifpjSe4tifAoZvdSBjrvKNyx6UfAWLrYlaUOmzxzRtulIIW8L429aU//a ivhdBmBs4TKR9/NTCwI1Z/OY8Kc46keOI4cmdTNDGDYjlZHNi7UG8kj4XxajL40o 6yLY7m2TfXBbRB2aK10CjinpPhi+Vk6fA3KJ9/a4am4o2Oe8Tvqm8DPp0BM4VuyW dT7wQMNZk5WW0Ho= =kTdL - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.1 Int. for non-commercial use <http://www.pgpinternational.com> iQEVAwUBOJGxweH7QfvhLrpDAQGtDggAwhgYxJL5FVTpq9Ee7Ar20LmPRe3YO13k 9BfuH3nHlmrLO1SGVBU7+q/RkQA6ES3jU0x4dMLcgEVW9IGV3Y8UT2UDpMNRuyt3 dW0ZdlUXH5+bXdBzUAdoe6OKWn4Ud1OR8XFOA0+eyYub69C8BEF06ZNDNMWfw46u xGmYI9WYSEr4ztf38eoe/Bqum6SqQND3Y+PR6q2lNS/xEz+c1t3LYpSbiSzHQZkE 5DjNFZ6Udkiwu1bCgR9wqZK5HdG1CPbspljZ6x+UzQOvUCYXFbYjNik6X6A9jRsI ccj+7RNmKyBrLrCiOHYI4afWNgLEChHn/SoWnYbSl9RBp71rPtXZHQ== =AF90 -----END PGP SIGNATURE-----

1 0

Re: [suse-security] SuSE Security Announcement - lprold-update
by Eilert Brinkmann 28 Jan '00

28 Jan '00

John Pinder <jpinder(a)gte.net> wrote: > I just downloaded the lprold.rpm package for SuSE 6.1, and just used: > > gpg --print-md MD5 lprold-3.0.48-4.i386.rpm > > I got the following checksum: > > lprold-3.0.48-4.i386.rpm: 63 40 BD 65 17 29 C5 35 CC 2A E2 FF 0E 08 0A > 47 > > This does not seem to match that given in the announcement. Am I doing > something wrong? > Maybe a gpg problem? > > Or did I do this correctly, and the package just does not have the > correct checksum? > Has anybody else checked this package and got the correct checksum? You are right. I just downloaded this package from ftp.suse.com and using md5sum I got the same checksum as you. For the update packages for SuSE 6.2 and 6.3 (from our local mirror) I got the following checksums: af82f4fea307acb584e38a0696ad247b .../update/6.2/n1/lprold-3.0.48-4.i386.rpm 3404fb4e939203c8b8145e7880035869 .../update/6.3/n1/lprold-3.0.48-4.i386.rpm These differ from those in the announcement, too. After the first announcement there was a second one in which SuSE apologized for wrong checksums in the first one -- but the "corrected" checksums were the same as in the original announcement. The problem seems to be that the checksums in the announcements are those of an older version. The current version we downloaded from the servers is lprold-3.0.48-4, while the file names in the announcements show lprold-3.0.48-0 (-0 instead of -4). Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

3 2

Re: [suse-security] sendmail 8.9 open relay ?
by Security Webmaster OKDesign oHG 28 Jan '00

28 Jan '00

Hi Lenz, of course you and Nick are correct. SuSE6.0 came with sendmail 8.8. I forgot to mention that I updated to sendmail 8.9. /etc/sendmail.cf tells: ##### @(#)cfhead.m4 8.9 (Berkeley) 1/18/97 ##### ##### @(#)cf.m4 8.24 (Berkeley) 8/16/95 ##### As far as I can see this means sendmail is version 8.9. Or am I wrong ? --- Stephan -----Ursprüngliche Nachricht----- Von: Lenz Grimmer <grimmer(a)suse.de> An: SuSE-Security-List <suse-security(a)suse.com> Datum: Freitag, 28. Januar 2000 13:25 Betreff: Re: [suse-security] sendmail 8.9 open relay ? >Hi, > >On Thu, 27 Jan 2000, Nick Zentena wrote: > >> Security Webmaster OKDesign oHG wrote: >> > >> > just received a message from the "famous" :-) ORBS database claiming that >> > our server is open for mail-relaying. >> > Hmm, as far as I remeber, this was correct for the earlier versions and I >> > was told (from SuSE I think, but not sure about this) that sendmail would be >> > safe starting with SuSE6.0. >> > Well, I did install SuSE6.0 and thought this would be ok now. >> > I did some checks by myself and found out that the server is indeed still >> > open for relays. >> >> SuSE6.0 came with sendmail 8.8. No? If so it defaults to open relay. >> 8.9 fixed that. > >Correct: > >> rpm -qp /CD-ARCHIVE/6.0/suse-i386-1/CD1/suse/n1/sendmail.rpm >sendmail-8.8.8-45 > >We switched to sendmail 8.9 with SuSE Linux 6.1 > >Bye, > LenZ > >-- >------------------------------------------------------------------ > Lenz Grimmer SuSE GmbH > mailto:grimmer@suse.de Schanzaeckerstr. 10 > http://www.suse.de/~grimmer 90443 Nuernberg, Germany >

2 1

sendmail 8.9 open relay ?
by Security Webmaster OKDesign oHG 28 Jan '00

28 Jan '00

Hi folks, just received a message from the "famous" :-) ORBS database claiming that our server is open for mail-relaying. Hmm, as far as I remeber, this was correct for the earlier versions and I was told (from SuSE I think, but not sure about this) that sendmail would be safe starting with SuSE6.0. Well, I did install SuSE6.0 and thought this would be ok now. I did some checks by myself and found out that the server is indeed still open for relays. Did I forget some configuration details ? Or what else can I do to close mail-relaying ? Thanks in advance. --- Stephan

5 4

AW: [suse-security] sendmail 8.9 open relay ? / Relay test
by Stefan Becker 28 Jan '00

28 Jan '00

Hi, This Web page has alot of infos about mail abuse. http://maps.vix.com/tsi/ar-test.html SMTP Relay Tester the way that I have tested our Sendmail configuration is to 1) connect to the host that the mail server is on 2) from there, telnet to a friendly host at "mail-abuse.org" telnet mail-abuse.org 3) the results are like .... Relay test 17 >>> RSET <<< 250 Reset state >>> MAIL FROM:<spamtest(a)lufa-sp.vdlufa.de> <<< 250 <spamtest(a)lufa-sp.vdlufa.de>... Sender ok >>> RCPT TO:<mail-abuse.org!relaytest(a)lufa-sp.vdlufa.de> <<< 550 <mail-abuse.org!relaytest(a)lufa-sp.vdlufa.de>... Relaying denied Relay test result All tests performed, no relays accepted. Connection closed by foreign host. This Web page has alot of infos about mail abuse. http://maps.vix.com/tsi/ar-test.html SMTP Relay Tester > Hi folks, > just received a message from the "famous" :-) ORBS database claiming that > our server is open for mail-relaying. > Hmm, as far as I remeber, this was correct for the earlier versions and I > was told (from SuSE I think, but not sure about this) that sendmail would be > safe starting with SuSE6.0. > Well, I did install SuSE6.0 and thought this would be ok now. > I did some checks by myself and found out that the server is indeed still > open for relays. > Did I forget some configuration details ? > Or what else can I do to close mail-relaying ? > Thanks in advance. > > --- Stephan > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com

1 0

AW: [suse-security] Mail Virus-Scanner under Linux
by Michael Hamm 27 Jan '00

27 Jan '00

> >I am looking for an Mail-Virus-Scanner, allready tested AMAVIS with McAfee >but not very happy (see security problems with amavis). >Have you some other solutions? (Comercial Solutions also) btw. Will SuSE >distribute an Mail-Virus-Scanner? > I use a script called ScanMail with success.... cu Michael

2 1