January 2000 - openSUSE Security - openSUSE Mailing Lists

lpr vulnerabilities?
by A Nourai 22 Jan '00

22 Jan '00

There has been a lot of talk about lpr vulnerabilities since the Redhat Security repositry announced that their lpr had to major vulnerabilities. I am wondering if the lpr daemon in SuSE is affected, since securtyfocus suggests 'many distributions' are. Just wondering. Thanks.

3 4

[suse-security] Firewall 1.8 (fwd)
by marc＠suse.de 22 Jan '00

22 Jan '00

Hi, >I've been upgrading to Firewall 1.8 and had a problem within >SuSEfirewall itself. It appears to wedge under SuSE 6.2 on an >ipchains DENY for IP@ppp0 which happens to be my dynamic dialup IP. > >This happens in the IP Spoofing & Circumventrion [sic] section >where there is a > for j in $DEV_INT_NET $FW_LOCALNETS; do > $IPCHAINS -A input -j "$DENY" -i $i -s $j $LDC > done > >It wedges on $FW_LOCALNETS which is set to IP@ppp0. > >Omitting $FW_LOCALNETS allows the script to run to completion and the >firewall to be "set up". I don't (yet) understand what is trying to be >achieved in this particular section of code. I especially don't >understand why ipchains would wedge. Perhaps it's because there is >no DNS as such on the firewall. > >I'm also getting other warnings about ipchains not understanding >IP@ppp0. > >Have I messed up the rc.firewall configuration? YES! ;-) FW_LOCALNETS are networks in your internal LAN which should be allowed to access the internet via masquerading. don't put any ip addresses of the firewall there. Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

2 2

[suse-security] Firewall script in SuSE 6.3 (fwd)
by marc＠suse.de 21 Jan '00

21 Jan '00

Hi, update to v1.4 from the ftp/www update site. >I have installed the above and configured it, (Just with a very simple config to disallow almost everything), but, when I run '/sbin/init.d/firewall start' I get the message, >Starting Firewall Initialization: Warning: you must enable IP forwarding for packets to be forwarded at all: >Use `echo 1 > /proc/sys/net/ipv4/ip_forward' >I have already enabled IP Forwarding in yast and re-started but I try it anyway - it accepts it but when I then run 'firewall start' again it says the same thing. > >Any ideas?? > >Regards >Andy Bennett >andy(a)itosn.com Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

wu.ftpd-chroot
by Frank Dittberner 21 Jan '00

21 Jan '00

I have installed wu.ftpd with chroot for the users home-directories, but when i make any directory with ftp i don´t get the normal rights (rwxr-xr-x). my umask is 022 (/etc/profile) and wu.ftpd is started with options -a -u 022 in the /etc/inetd.conf. under the console i have the normal rights when i mkdir. how can i get the normal rights with ftp? cya Frank Dittberner PS: sorry for my bad english, i´m from germany.

1 0

Possible problems with harden_suse & undo script
by andy 21 Jan '00

21 Jan '00

I have run this script and then run the undo script for it and now, (I am assuming the 2 are related but perhaps not), I can't receive any incoming EMail. The mailer daemon creates the message, '550 /var/spool/mail/andy... Can't create output: Permission denied'. The file has permissions -rw------. If I change the permissions, of course, to -rw-rw-rw- I can receive mail again but this means my files are world read and writable. I am assuming it is this script because it asks the questions about SUID and SGID programs but I suppose it could have been something I've done. In any event has anyone any ideas. TIA andy(a)itosn.com

1 0

Firewall 1.8
by Bernd Felsche 21 Jan '00

21 Jan '00

Hi, I've been upgrading to Firewall 1.8 and had a problem within SuSEfirewall itself. It appears to wedge under SuSE 6.2 on an ipchains DENY for IP@ppp0 which happens to be my dynamic dialup IP. This happens in the IP Spoofing & Circumventrion [sic] section where there is a for j in $DEV_INT_NET $FW_LOCALNETS; do $IPCHAINS -A input -j "$DENY" -i $i -s $j $LDC done It wedges on $FW_LOCALNETS which is set to IP@ppp0. Omitting $FW_LOCALNETS allows the script to run to completion and the firewall to be "set up". I don't (yet) understand what is trying to be achieved in this particular section of code. I especially don't understand why ipchains would wedge. Perhaps it's because there is no DNS as such on the firewall. I'm also getting other warnings about ipchains not understanding IP@ppp0. Have I messed up the rc.firewall configuration? -- Real Name: Bernd Felsche Email: nospam.bernie(a)perth.DIALix.com.au http://www.perth.dialix.com.au/~bernie - Private HP

1 0

delivery problems of this list
by Volker Kuhlmann 21 Jan '00

21 Jan '00

Often when I send something to a SuSE mailing list I get error msgs back because the list could not deliver to some subscriber I have never heard of. It would be better if SuSE set up the list so that this kind of error gets junked straight away, better not generated in the first place. In the mean time, this procmail recipe should take care of the problem. It is activated by adding it into $HOME/.procmailrc for those who filter their incoming email through procmail (which is a thing definitely worth learning about). -----cut----- ### SuSE email lists, errors delivering to others :0 * ^From: MAILER-DAEMON(a)suse\.com * ^Subject: failure notice /dev/null -----cut----- This junks everything sent from MAILER-DAEMON(a)suse.com with a subject of "failure notice". It probably covers all of SuSE's mailing lists. Volker

1 0

Re: [suse-security] Correction: was :(re: [suse-security] netscape call chown)
by Volker Kuhlmann 20 Jan '00

20 Jan '00

> > chmod -f -R go-rxw $HN & > > where $HN is $HOME/.netscape > Aha, the scripts ends by doing 'exec' on netscape -- so if chmod does not > finish until exec, the shell is replaced by the netscape process.. and the > One way of fixing it is to add "wait" before running exec. Or don't > run the chmod in the background -- but that will make startup slower, if The only acceptable way of running the chmod before netscape is to not do it in the background, or not to exec netscape. Anything else is asking for trouble due to unknown execution times. Not exec'ing netscape is undesirable. netscape starts/runs so damn slow I don't think it would make much of a difference. Volker

1 0

Antwort: Re: [suse-security] More than one IP-Addresses on an ethernet interface
by gerhard.possler＠westernacher.de 19 Jan '00

19 Jan '00

Hi, I have tried to use IP-Aliasing also but with something like eth0:1 192.168.1.1/24 eth0:2 192.168.2.1/24 (your example is not so good because 10.0.0.1 and 10.0.0.2 are is same subnet ;-)) as hardware it was an 3Com 3C59x 10/100 and an NE2000 noname, so for the 3Com IP-Aliasing was not possible but for the NE2000 ( !!?). An problem with HW-Driver? Aliasing was needed for an transition phase because we have changed our IP range. As circumvention we changed the IP range on all systems ( buh....) in 1 day, so IP-Aliasing was not needed anymore. regards gerhard Thomas Biege <thomas(a)suse.de> am 19.01.2000 13:20:33 An: Felix.Ohmberger(a)conceptnet.ch Kopie: suse-security(a)suse.com Thema: Re: [suse-security] More than one IP-Addresses on an ethernet interface Hi, > > I want configure a Firewall with ipchains for a box with one external > > (Internet) and one internal ethernet cards. > > On the internal network I use two webserver machines. So I should > > configure two IP-Addresses on the external interface to point to the > > different webservers. > > 1. How do I configure two IP-Addresses on one ethernet interface? Use alias devices. ifconfig eth0:1 10.0.0.1 ifconfig eth0:2 10.0.0.2 Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47 --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com ------------------------------------------------------------------------ Gerhard Possler "Wer neue Wege geht, braucht starke Partner." Westernacher AG Am Hubengut 3 76149 Karlsruhe, Germany phone: +49-721/9772-0 fax: +49-721/9772-249 http://www.westernacher.de

1 0

More than one IP-Addresses on an ethernet interface
by Felix.Ohmberger＠conceptnet.ch 19 Jan '00

19 Jan '00

> Hello > > I want configure a Firewall with ipchains for a box with one external > (Internet) and one internal ethernet cards. > On the internal network I use two webserver machines. So I should > configure two IP-Addresses on the external interface to point to the > different webservers. > 1. How do I configure two IP-Addresses on one ethernet interface? > 2. How do I configure the rule with ipchains to forward the http protocol > to the corresponding webserver? > > Thanks in advance > Felix

3 2