October 2000 - openSUSE Security - openSUSE Mailing Lists

FW: InterScan eManager Content Management Notification! (VBS Type Filter)
by Tilch Andreas 17 Oct '00

17 Oct '00

I hope that none paid for this tool. This was the answer I got when I replied to the question before. Just because there was the word .vbs in the body, it blocked this message. This won't happen with inflex. Andreas Tilch Unix Systems Administrator National Foods Ltd Mebourne-Victoria Australia -----Original Message----- From: ContentMaster(a)grohe.at [mailto:ContentMaster@grohe.at] Sent: Tuesday, October 17, 2000 4:20 PM To: andreas.tilch(a)natfoods.com.au Subject: InterScan eManager Content Management Notification! (VBS Type Filter) ******Message from InterScan E-Mail VirusWall NT****** The following mail was blocked by InterScan eManager Content Management. Source mailbox: <andreas.tilch(a)natfoods.com.au> Destination mailbox(es): <dkehoe(a)weycogroup.com>,<suse-security(a)suse.com> Policy: VBS Type Filter Action: Quarantine ContentMaster(a)GROHE.AT has encountered a Virus infected EMail and acted accordingly. ******************* End of message *******************

1 0

SuSE Alpha and Update issue
by Nix 17 Oct '00

17 Oct '00

Hey roman. Well, I finally received my copy of SuSE 7.0 for intel.. A clean install from DVD worked beautifully on my main workstation, as did an update from 6.4 off CD on my notebook... I even have the ftp version running AOK on my Sparc, however I am at a loss to find a version of SuSE 7.0 for my new alpha :( I have checked a couple of the mirrors, plus ftp.suse.de and ftp.suse.com. If you can point me in the right direction, I would be stoked (as I won't have to install RH6.2-Alpha *grin*) Anyway, onto the security Question... (this being the security list and all) After installing SuSE7.0 from CD/DVD and manually installing the updates from the /updates folder on ftp.suse.com I then thought what the hell, lets test out the new cable modem, and did a complete system update from the ftp server. I noticed however, that while most of the rpms on ftp.suse.com ARE newer versions than on the CD, some are the same version with a newer timestamp, and some are not in sync with the ones in /update Any chance of an explanation of with the different versions??? Cheers Nix At 07:29 AM 16/10/2000, you wrote: >Hi, > >as some of you might have noticed already, the German SuSE-7.0 ftp version >is out (it has been published on ftp.gwdg.de, all mirrors should be in >sync by now, see http://www.suse.de/de/support/download/ftp/inland.html) >As usual, the German version has all the crypto packages included. > >By consequence, the crypto packages on ftp.suse.de:/pub/suse/i386/7.0 will >disappear by the end of this week. > >We are sorry that it took so long until the ftp version came out - there >is a whole variety of reasons responsible for this. Future versions of the >distribution will be published on the ftp server(s) after a period of >about two to six weeks, if everything goes right. > >Thanks, >Roman.

1 1

Shred File Wiper Insecure File Deletion Vulnerability
by Fred Miller 16 Oct '00

16 Oct '00

Shred File Wiper Insecure File Deletion Vulnerability BugTraq ID: 1788 Remote: No Date Published: 2000-10-06 Relevant URL: http://www.securityfocus.com/bid/1788 Summary: A vulnerability exists in Shred v1.0, a file-wiping utility for Linux and generic Unix. A flaw in the utility's handling of buffered I/O leads to a failure to properly overwrite data. As a result, files which have been processed by Shred remain recoverable by certain disk utilities. -- Fred A. Miller Systems Admin. Cornell Univ. Press Services fm(a)cupserv.org

1 0

Updating packages
by Jurjen Oskam 16 Oct '00

16 Oct '00

Hi everybody. Consider the following scenario: You have installed and actively use package X. Suppose an exploit is discovered for that package. SuSE provides a fix, and as a good admin you get the new RPM and install the fix. You do this with YaST1, so SuSEconfig is automatically run after installing. According to YaST, the fix is installed. SuSEconfig ran OK. So everything seems like that you succesfully updated. But: suppose the package was running when you updated? The running copy, is that (after SuSEconfig did its work) the old vulnerable version, or the new patched version? I suppose it's different for each kind of program. Something that's spawned by inetd and only runs for a short time gets updated rapidly: the executable is replaced by the package update and the next time it's spawned by inetd the new executable gets run. On the other end of the spectrum you have the kernel update: after installing the RPM from YaST (and SuSEconfig), you need to reboot, of course. But how is it with the packages in between? For example, the recent libc update? When does that update take effect? I didn't take any chances and rebooted the machine, but was this necessary? And suppose a proftpd running in daemon mode? After installing a patch, is the running daemon automatically restarted by YaST or SuSEconfig, or is that the admin's work? I'd really like some info on this. I always stayed on the safe side and restarted things (or even rebooted with a kernel- or libc-update) manually. But there's nothing in YaST or SuSEconfig that says to reboot or restart a package! So even though you installed that (for example) proftpd patch, an old, vulnerable proftpd is still running, even though YaST and SuSEconfig say the package is successfully updated. In other words: you're still vulnerable, perhaps without realizing it. Could anybody provide some input on this? When is it necessary to restart a package, or drop to single user mode, or even reboot? Of course, on production servers you'd like to keep downtime to a minimum, so a simple restart of (e.g) proftpd is far more preferable to a complete reboot. end -- Jurjen Oskam * carnivore! * http://www.stupendous.org/ for PGP key assassinate nuclear iraq clinton kill bomb USA eta ira cia fbi nsa kill president wall street ruin economy disrupt phonenetwork atomic bomb sarin nerve gas bin laden military -*- DVD Decryption at www.stupendous.org -*-

2 2

SuSE Security Announcement: traceroute (SuSE-SA:2000:041) (repost)
by Roman Drahtmueller 16 Oct '00

16 Oct '00

You have received a Security Announcement about traceroute already. An update package in the 6.4-i386 tree got confused with an older version. This older version file has been replaced by the new file under the old name in order to prevent the installation of an older package without the security fixes. I apologize. Here is the corrected advisory: -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: traceroute Announcement-ID: SuSE-SA:2000:041 Date: Monday, October 16th, 2000 16:10 MEST Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0 Vulnerability Type: local root compromise Severity (1-10): 6 SuSE default package: yes Other affected systems: Linux systems using the NANOG traceroute Content of this advisory: 1) security vulnerability resolved: traceroute problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The security problem in the traceroute program as shipped with SuSE Linux distributions is completely different from the one reported on security mailing lists a few days ago (`traceroute -g 1 -g 1') by Pekka Savola <pekkas(a)netcore.fi>. SuSE distributions do not contain this particular traceroute implementation. The problem in our traceroute was discovered independently and reported to us by H D Moore <hdm(a)secureaustin.com>. The problem in the implementation of traceroute that we ship is a format string parsing bug in a routine that can be used to terminate a line in traceroute's output to easily embed the program in cgi scripts as used for web frontends for traceroute. Using a specially crafted sequence of characters on the commandline, it is possile to trick the traceroute program into running arbitrary code as root. If you want to temporarily work around this security vulnerability, you can disable traceroute for normal users by clearing the suid bit on the file /usr/sbin/traceroute: chmod -s /usr/sbin/traceroute . Do not forget to change the respective line in /etc/permissions to read: /usr/sbin/traceroute root.root 755 We have prepared update packages on our ftp server that eliminate the vulnerability in the traceroute program. Note that the traceroute program is contained in the nkita or the nkitb package, depending on the distribution version. Distributions starting with SuSE-6.4 contain the traceroute program in the nkitb package which is not required by the boot process and therefore counts as an additional package. Download the update package from locations described below and install the package with the command `rpm -Fhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/nkitb-2000.10.4-0.i386.rpm 6c8f713a071a96c287942f880cd5919c source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/nkitb-2000.10.4-0.src.rpm c01db9ee70a9ac01cba1bace93cfdd16 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/nkitb-2000.10.4-0.i386.rpm 321b78de11928a3361edf0a044721383 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/nkitb-2000.10.4-0.src.rpm 61aa9e2e4272606d2bd70828a72c957c SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/nkita-2000.10.4-0.i386.rpm 6c5932e4083de6f499e4c77fcadbffc1 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/nkita-2000.10.4-0.src.rpm 9debb8804293384057d69254614a1496 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/nkita-2000.10.4-0.i386.rpm 49269283c6d39a234f61303b2e918413 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/nkita-2000.10.4-0.src.rpm 1cc00eb9b37b37a51fc249db3b51f6e1 SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/nkita-2000.10.4-0.i386.rpm 2fe1c6d70fcf1272da95f33ad7ad1010 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/nkita-2000.10.4-0.src.rpm 74d6f2e623b7fcac1b0881b1bfbe0880 SuSE-6.0 Please use the update packages from the 6.1 distribution. Sparc Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/nkitb-2000.10.4-0.sparc.rpm e9bc3512b6182f540e74308c02d81f65 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/nkitb-2000.10.4-0.src.rpm 8fba03e9cef63ae076b10fb61c800e39 AXP Alpha Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/nkitb-2000.10.4-0.alpha.rpm 7850969c7b3beaf3fd1ce8b2a9246be0 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/nkitb-2000.10.4-0.src.rpm 6e5a964177b6cf87524119c747f0220b SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/nkita-2000.10.4-0.alpha.rpm 6440a6a7da903829cff57a5f8c7cda91 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/nkita-2000.10.4-0.src.rpm 53bf05462378c384e8a46f3c6c368c67 PPC Power PC Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/nkitb-2000.10.5-0.ppc.rpm 407d1c6731228f5d3e9addd108d31224 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/nkitb-2000.10.5-0.src.rpm 8fba03e9cef63ae076b10fb61c800e39 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/nkitb-2000.10.4-0.ppc.rpm c432a5b8d37640be6e325ef9603f9cba source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/nkitb-2000.10.4-0.src.rpm edf24c1989c85616d1caf53872e61f17 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: A set of security announcements is following this advisory. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOesfuXey5gA9JdPZAQFSZAgAkrGudnGaS0ZRcnpWa27nRN4tMOU+Eh/d zYrl/zuOlHPuEgXBrl382XAJLNCIomchR9aSmY28ETWVk8HbGu7n1YB4MxIj994I XzDAU6eL4YuJErfTnMuCdoAiHltFJn3eRci/lSmTV/ZNK0LQm3BhIOFWJyTbPNaY nA2UqaAz1HGu0jEDDC5o8JrSvjuqCJv3BWmFLTimg/xuuaOV3S5cSYgum6c/w/ph Q78Q7xLj+RGSBKBP0NDsNwXoW+bV1cQWcGQlOo02nGt3Vk41vhdYAtSAdskEmiWT pwYkHgVja+3ct0iX4pDdo4KWCVeZ6YqTh29fKlt9bIDT1mXa2q7YqQ== =G34Y -----END PGP SIGNATURE-----

1 0

SuSE Security Announcement: traceroute (SuSE-SA:2000:041)
by Roman Drahtmueller 16 Oct '00

16 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: traceroute Announcement-ID: SuSE-SA:2000:041 Date: Monday, October 16th, 2000 16:10 MEST Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0 Vulnerability Type: local root compromise Severity (1-10): 6 SuSE default package: yes Other affected systems: Linux systems using the NANOG traceroute Content of this advisory: 1) security vulnerability resolved: traceroute problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The security problem in the traceroute program as shipped with SuSE Linux distributions is completely different from the one reported on security mailing lists a few days ago (`traceroute -g 1 -g 1') by Pekka Savola <pekkas(a)netcore.fi>. SuSE distributions do not contain this particular traceroute implementation. The problem in our traceroute was discovered independently and reported to us by H D Moore <hdm(a)secureaustin.com>. The problem in the implementation of traceroute that we ship is a format string parsing bug in a routine that can be used to terminate a line in traceroute's output to easily embed the program in cgi scripts as used for web frontends for traceroute. Using a specially crafted sequence of characters on the commandline, it is possile to trick the traceroute program into running arbitrary code as root. If you want to temporarily work around this security vulnerability, you can disable traceroute for normal users by clearing the suid bit on the file /usr/sbin/traceroute: chmod -s /usr/sbin/traceroute . Do not forget to change the respective line in /etc/permissions to read: /usr/sbin/traceroute root.root 755 We have prepared update packages on our ftp server that eliminate the vulnerability in the traceroute program. Note that the traceroute program is contained in the nkita or the nkitb package, depending on the distribution version. Download the update package from locations described below and install the package with the command `rpm -Fhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/nkitb-2000.10.4-0.i386.rpm 6c8f713a071a96c287942f880cd5919c source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/nkitb-2000.10.4-0.src.rpm c01db9ee70a9ac01cba1bace93cfdd16 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/nkitb-2000.7.11-0.i386.rpm 118075b7fc295be86b3659bf9b3fa778 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/nkitb-2000.10.4-0.src.rpm 61aa9e2e4272606d2bd70828a72c957c SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/nkita-2000.10.4-0.i386.rpm 6c5932e4083de6f499e4c77fcadbffc1 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/nkita-2000.10.4-0.src.rpm 9debb8804293384057d69254614a1496 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/nkita-2000.10.4-0.i386.rpm 49269283c6d39a234f61303b2e918413 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/nkita-2000.10.4-0.src.rpm 1cc00eb9b37b37a51fc249db3b51f6e1 SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/nkita-2000.10.4-0.i386.rpm 2fe1c6d70fcf1272da95f33ad7ad1010 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/nkita-2000.10.4-0.src.rpm 74d6f2e623b7fcac1b0881b1bfbe0880 SuSE-6.0 Please use the update packages from the 6.1 distribution. Sparc Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/nkitb-2000.10.4-0.sparc.rpm e9bc3512b6182f540e74308c02d81f65 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/nkitb-2000.10.4-0.src.rpm 8fba03e9cef63ae076b10fb61c800e39 AXP Alpha Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/nkitb-2000.10.4-0.alpha.rpm 7850969c7b3beaf3fd1ce8b2a9246be0 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/nkitb-2000.10.4-0.src.rpm 6e5a964177b6cf87524119c747f0220b SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/nkita-2000.10.4-0.alpha.rpm 6440a6a7da903829cff57a5f8c7cda91 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/nkita-2000.10.4-0.src.rpm 53bf05462378c384e8a46f3c6c368c67 PPC Power PC Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/nkitb-2000.10.5-0.ppc.rpm 407d1c6731228f5d3e9addd108d31224 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/nkitb-2000.10.5-0.src.rpm 8fba03e9cef63ae076b10fb61c800e39 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/nkitb-2000.10.4-0.ppc.rpm c432a5b8d37640be6e325ef9603f9cba source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/nkitb-2000.10.4-0.src.rpm edf24c1989c85616d1caf53872e61f17 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: A set of security announcements is following this advisory. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOesNgHey5gA9JdPZAQGk/wf+Jkjci3YR373FXlRomv2gy+fvhlHsQI8t wQSqlzOSPUHUlPWnxWRxOLx+tLjGX0I69lR5i2PKIFDiudBBKbiZR4pb4LGux8dk ekhs/pxfDgk9J+RBreEBdcKb4YirGWjMVVWfBydMOp0Atp4wNQ+Ab3hyxunKxr4p 3J+c8z8FwFGfEr7piHZMkRP/cP3S5CYrLe856yea2Unn6B4EoKBhBdL/AAfKPsUD o6JsUzm5hcYeFd2XJfnuIWceNvr8uQZxltqx8EqCmtFKfSSbDIHv3/Rq+fd9rQ8Z qERcmDuZRh8d7+VTM0QELuQWxCSICM/pUHk+9xYO5u+OtmomXe/EkA== =kQe2 -----END PGP SIGNATURE-----

3 5

Re: [suse-security] SuSE Security Announcement: traceroute (SuSE-SA:2000:041)
by Boris Kantwerk 16 Oct '00

16 Oct '00

Hi *! Whats the differenz between nkitb and nkita? I've installed both on my SuSE 6.2-System! x:~ # rpm -qa | grep nkit nkita-99.6.25-8 nkitb-2000.7.11-0 Which one do I have to update? Or both? Or should I remove one of the package? Thanx, Boris. > SuSE-6.4 > > ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/nkitb-2000.7.11-0.i386.rpm > 118075b7fc295be86b3659bf9b3fa778 > > SuSE-6.2 > > ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/nkita-2000.10.4-0.i386.rpm > 49269283c6d39a234f61303b2e918413

2 1

SuSE Security Announcement: gnorpm (SuSE-SA:2000:040)
by Roman Drahtmueller 16 Oct '00

16 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: gnorpm Advisory-ID: SuSE-SA:2000:040 Date: Monday, October 16th, 2000 15:45 MEST Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0 Vulnerability Type: tmp race / local file overwrite Severity (1-10): 4 SuSE default package: no Other affected systems: Systems using gnorpm Content of this advisory: 1) security vulnerability resolved: gnorpm problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information gnorpm is a graphical user interface to the rpm subsystem for the gnome desktop. Insecure temporary file handling may cause the gnorpm package to overwrite arbitrary files on the system. As a workaround solution it is recommended to make sure that no active user processes on the system while performing software updates with gnorpm. This can be accomplished by bringing the linux system down to runlevel 1 (multi-user without network) and starting the network by hand (rci4l_hardware start; rci4l start;rcnetwork start; rcroute start). IMPORTANT NOTE: SuSE provides update packages for the vulnerable gnorpm package. However, tests have revealed that the new gnorpm version from Alan Cox does not work reliably with the rpm subsystem in older SuSE distributions. Adding patches to these gnorpm versions has proven to not increase the reliability of the package either. For this reason we do not provide update packages for the SuSE distributions prior to (and including) SuSE-6.3. Please update your system to a more recent base installation (SuSE-7.0 recommended) or use the workaround as described above if you need to use gnorpm in a multi user and possibly hostile environment. Download the update package from locations desribed below and install the package with the command `rpm -Fhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/gnm3/gnorpm-0.95-3.i386.rpm 6aa5ea031f48d903bf3fb4e2328fc4c7 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/gnorpm-0.95-3.src.rpm a6df0b51a50b0f82a1d0e77d46587d82 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/gnm3/gnorpm-0.95-3.i386.rpm 2f47a772c634c35d989078287668e67d source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/gnorpm-0.95-3.src.rpm 04a7c41f0537ef513495efc49c105b1b Sparc Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/gnm3/gnorpm-0.9-159.sparc.rpm 467a2839f7df52c31eb42b97ebb8dd0d source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/gnorpm-0.9-159.src.rpm eb09af61e93eab32a55c6538d0b45bc4 AXP Alpha Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/gnm3/gnorpm-0.95-4.alpha.rpm b99a121e1469f958413b26eef1fd7ce9 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/gnorpm-0.95-4.src.rpm a65ba20f86d5d0693ecc3e77520ff584 PPC Power PC Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/gnm3/gnorpm-0.95-3.ppc.rpm 9ad07eb2c2c437ed427d8ec5cb2b8439 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/gnorpm-0.95-3.src.rpm ffdb55e153b7e07cad91830eafb088b9 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: A set of security announcements is following this advisory. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOesJuHey5gA9JdPZAQFOaQf7BeD4f+p2nnW6HurZfmn3286FAOGGdEeO 7fYP+ECHNIgzwa9QSVjbbG/sDMbLiND4sv+z4Bi/7v6qm1rMIGrR1t3yYSAQLvJQ RiW5Vvg3epdhZA4IVb+T0UDGLzSztWs5kfKmELUV2DCPwNA3ot6WXKJr64x27Ewj bygg78xtIAvpLFa1IwHezllVPrdMjHJvIfMDV2bukLrVMTfax4sf8EmnPexIVTSW hXp/+63HHWKXaELMvD3UHV6P9kjCcbqNsoerJCQ9KlaSC5dujMj31P5J5hsYSsOG I+6T34rmFMuzANDc3AzMyQZb3zXBx6f2ozmHhQ1Ur/0b2+db0xknRw== =bbjh -----END PGP SIGNATURE-----

1 0

7.0-i386-ftp-de
by Roman Drahtmueller 16 Oct '00

16 Oct '00

Hi, as some of you might have noticed already, the German SuSE-7.0 ftp version is out (it has been published on ftp.gwdg.de, all mirrors should be in sync by now, see http://www.suse.de/de/support/download/ftp/inland.html) As usual, the German version has all the crypto packages included. By consequence, the crypto packages on ftp.suse.de:/pub/suse/i386/7.0 will disappear by the end of this week. We are sorry that it took so long until the ftp version came out - there is a whole variety of reasons responsible for this. Future versions of the distribution will be published on the ftp server(s) after a period of about two to six weeks, if everything goes right. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

2 1

RE: [suse-security] How FW-Router w/o masquerading ?
by Reckhard, Tobias 16 Oct '00

16 Oct '00

Hi > >To answer your question re security and PAT (You are almost certainly > running > >PAT and not NAT) Yes, PAT for the most part only allows outgoing > connections > >with the exception of DNS and someother UDP connections. (UDP is > connectionless > >and as such is tricky to NAT/PAT/Masquerade/Firewall) > > Two Qs: > > 1) What's the difference between PAT and NAT? > PAT is what Cisco calls n:1 NAT, i.e. the mapping of many (i.e. n) IP addresses to 1. In order to do this and still keep connections separable, you need to modify the source port, so, in effect, you're using the source port as the key to map private IP addresses to the one public one. Whether you say PAT (Ciscospeak), IP Masquerading (Linuxspeak) or n:1 NAT (general term) doesn't really matter, people should understand you either way. Incidentally, any n:m NAT scheme with n<m needs to use port translation, so the term PAT is pretty much just as ambiguous as NAT is. > 2) I'd like some more information about how secure is a (private-IP) > intranet behind a router performing NAT/PAT or similar (which obviusly > has got a real IP address). > NAT is *not* a security mechanism. It provides functionality, not security, at least not by itself. Maybe minimal additional security, because you can use RFC1918 addresses and these *should* not be routed on the Internet, but you'd be foolish to rely on that. > My personal thoughts are that if the NAT > device isn't implementing any port forwarding to any internal machine, > the said machine is safe. > Why should it be? It can communicate freely with the Internet. Therefore, it is vulnerable to any attacks that do not require that a connection be initiated from the Internet. NAT doesn't buy you any more security than a packet filter does and I consider that the minimum requirement. > Correct? So, the intranet would be safe for > external attacks (supposing router access is not granted and its > configuration is safe from hackers) without needing a fw or > router-filters, isn't it? Am I missing some interesting > points? > NAT is not a security device, that's all there is to it. It is very useful, but you need to complement it with conventional network security mechanisms. In and of itself, it provides very minimal security enhancement (mainly in the 'security by obscurity' department), but often gives a false sense of security. HTH Tobias

1 0

How FW-Router w/o masquerading ?
by Andreas Fiesser 16 Oct '00

16 Oct '00

I've got an Cisco dial-in ISDN-router to connect a LAN to the InterNet. Mr. Boss wants a firewall to be placed behind the Cisco. Now I thought I could set up an old 486/40 box with two NICs and SuSE 7.0 to do the trick. It's no problem to install the box with an own dial-in device (modem). It does firewalling and masquerades the LAN nicely. If I switch of masquerading and set the world device to eth1 (towards the Cisco), it stops incoming packets from the LAN. I can watch them com in on eth0 with tcpdump but they don't show up on eth1 of the "firewall" PC. They come through when I enable masquerading again but then I get double MASQ and my LAN boxes get confused. How can I solve this with yast ? I'd rather not set up own rule sets before I get deeper into the topic. I'd like at least the protection that the SuSE dudes could produce with their sophisticated script. Btw. I asume real clever hackers get in almost everywhere but they are rare. On the other hand there are thousands of script kiddies scanning The Net when they are home from school or the whole day if they have a flat rate. Their scanners are pounding our Cisco which presumably doesn't offer services to the outside itself but does masquerade our LAN. Is there a potential danger that a subseven probaply lurking in a LAN-box could answer the call of such a scan and offer it's services to the attacker ? In other words doesn't masqurading itself offer a good deal of security since it hides our PCs ? Later Andreas

4 3

https
by Kai seefeldt 16 Oct '00

16 Oct '00

Hi! How can I use/activate https? I have Suse 6.4 and Apache, i think Apache has already somithing installes... How can I set up an virtual https:// site? Thanks a lot! Kai Seefeldt ------------------------------------- Support(a)1-2-3-gaestebuch.de http://www.1-2-3-gaestebuch.de/index.htm?rf=eMail

3 2

RE: [suse-security] SuSEfirewall & portscan
by Reckhard, Tobias 16 Oct '00

16 Oct '00

Hi > Probably asked a few times on this list but don't shoot me. > I have the SuSEfirewall up and running and closed everything > FW_SERVICES_EXTERNAL_TCP & UDP = "" and also INCOMING_HIGHPORTS_TCP & UDP > = > "". > A portscan (nmap) however reveals that all the upd ports are open! Is this > a > risk or not and how are these closed with the help of the script? > This is probably a false nmap report because you're 'deny'ing all UDP packets to your hosts, i.e. you're dropping them on the floor silently. Since nmap doesn't receive an ICMP message telling it that there's no service listening at the destination port, it assumes that there is one there. In contrast to nmap's assessment, you're safe, you've closed all the UDP ports. HTH Tobias

1 0

Re: [suse-security] SuSEfirewall & portscan
by Peter ten Have 15 Oct '00

15 Oct '00

* Peter ten Have wrote on Sun, Oct 15, 2000 at 10:54 +0200: > A portscan (nmap) however reveals that all the upd ports are open! Is this a > risk or not and how are these closed with the help of the script? You can check the firewall rules with ipchains -nvL|less (use a large xterm :)) Did you used nmap against localhost? It's not uncommon to open localhost and loopbackdevice. Of couse you have to scan from outside your network. oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel. --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com The scan was performed by someone from the outside: Port State Service 1/udp open tcpmux 2/udp open compressnet 3/udp open compressnet 4/udp open unknown 5/udp open rje 6/udp open unknown 7/udp open echo ............................. Strange thing is though that NO TCP ports show up, only the UDP. The complete scan shows 1-1025 UDP are open and also 3130 squid-ipc -Peter-

1 0

Alternate FTP server to wuftpd...
by Ryan Kirwin 15 Oct '00

15 Oct '00

Greetings, A few days ago there was some comments on the security holes in wuftpd. I'm looking to replace it on our SuSE 6.4 server, any suggestions for another ftp server? Are there update packages that patch wuftpd's security holes well enough? Thanks, Ryan -- Ryan Kirwin, Systems Developer Embedded Systems Development FedEx, Colorado Springs (719) 262.1606

5 4

Router and bridges
by Steffen Beck 15 Oct '00

15 Oct '00

Hey guys ... I thank you all for the huge amount of replies I got on my thread concerning the difference between routers and bridges. I know what both of them is now so stop replying to the thread anymore .. thanks :) Steffen Beck Sign up for your "FREE E-MAIL" @ MADMAIL http://www.madmail.com

1 0

SuSEfirewall & portscan
by Peter ten Have 15 Oct '00

15 Oct '00

Hi all, Probably asked a few times on this list but don't shoot me. I have the SuSEfirewall up and running and closed everything FW_SERVICES_EXTERNAL_TCP & UDP = "" and also INCOMING_HIGHPORTS_TCP & UDP = "". A portscan (nmap) however reveals that all the upd ports are open! Is this a risk or not and how are these closed with the help of the script? Thank you, -Peter-

2 1

Re: [suse-security] Tunneling X-Sessions through SSH/SSL
by Anibal Vasquez 14 Oct '00

14 Oct '00

> Steffen Dettmer wrote: > [...] > Well, I think you should use your favorite search engine to > search for "xdm ssl stunnel ssh encryption" or something like > that?! Well, thanks for your answer! Actually, I´m asking here because I couldn´t find anything usefull on this topic in the web, and thought someone here could tell me where to begin reading. Thanks again, Anibal

1 0

ssh x forwarding again
by alex medvedev 14 Oct '00

14 Oct '00

hallo, ssh x forwarding question: machine_inside ---- FW ----- internet ---- machine_outside can a user sitting on the secured by the firewall (FW) machine_inside ssh out to the machine_outside, then display an xterm from the machine_inside on the screen of the machine_outside? so that a user of the machine_outside can type commands on the machine_inside. this is important since i was told that this is possible. i do not see how it is doable; however, i am not an expert... if this is possible then ssh can be a door for people who do not have a dialup to get in from the outside but have ssh access... hope the above is understandable. thanks, -alexm

2 1

Tunneling X-Sessions through SSH/SSL
by Anibal Vasquez 14 Oct '00

14 Oct '00

Hi people! Has someone of you ever set up an encrypted X-connection between an xdm and an X-server? What has to be done for it? Could you please lead me to the right info sources? Thanks in advance, Anibal

2 3

Redirection to a Private network address on a firewall
by Steven Thompson 14 Oct '00

14 Oct '00

Hi All If you set-up a DMZ with a private network address. Is it possible to configure IPCHAINS to redirect SQL server client requests & HTTP requests from the Internet to a Server sitting in the DMZ with a private network address. Internet ------Legal IP Address----|-----------Internal Private Network 10.x.x.x | | DMZ Private Network 192.168.x.x Thanks in advance Steven

4 3

Re: [suse-security] PAM and tcp wrappers
by Sridhar 14 Oct '00

14 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hello what u r referring to is the vanilla config of tcpd, i use it, everyone uses that. i'm not saying that. servers without tcpd is unthinkable.. almost. xinetd promises to phase it out, but the point i'm making is to filter it after the login process runs. the client should never know what cut the connection, whether it's the login, the ip address, the time.. the more the tcpd is hidden the better. tcpd is indispensible ;) cheers cheedu On Thu, 12 Oct 2000, none none wrote: > tcp wrappers can be use to "filtered" the services running on inetd.conf > using those files: /etc/hosts.allow and /etc/hosts.deny. > you just to indicate the service to call tcp-wrappers on inetd.conf. > > > >From: Sridhar <omicron(a)symonds.net> > >Reply-To: omicron(a)symonds.net > >To: suse-security(a)suse.com > >Subject: [suse-security] PAM and tcp wrappers > >Date: Thu, 12 Oct 2000 23:46:07 +0530 (IST) > > > >-----BEGIN PGP SIGNED MESSAGE----- > >Hash: SHA1 > > > >hello > > i just wonder if tcp wrappers can be used in pam > >authentication. For instance, in case of services where authentication is > >required, like ssh,telnet, ftp, rlogin, is it possible to deny a login > >based on the person's ipaddress, or execute a command like the tcp > >wrappers. If somebody's portscanning me for interesting ports, it would > >definitely be helpful if he thinks the ports are open for him, but > >whatever he does, he cannot get in. I wud indeed prefer tcp wrappers to be > >_behind_ the login . Has it been done ? > > That would beat the hell out of nmap ;) > > > >regards > >cheedu > > > >-----BEGIN PGP SIGNATURE----- > >Version: GnuPG v1.0.2 (GNU/Linux) > >Comment: For info see http://www.gnupg.org > > > >iD8DBQE55f/wrHJM2EAbaXwRAiviAJ4nemb4Ps8u84m9gvI06yMi8RUw3wCgo1KR > >M+lyKdH2lyyGufsMsrIsIpg= > >=VV11 > >-----END PGP SIGNATURE----- > > > > > >--------------------------------------------------------------------- > >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > >For additional commands, e-mail: suse-security-help(a)suse.com > > > > _________________________________________________________________________ > Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. > > Share information about yourself, create your own public profile at > http://profiles.msn.com. > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.2 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE56F0irHJM2EAbaXwRAvT4AJ9k6566VZtnK3IrPj79bn17hoM3lQCfQbns lsNdSeP1kpQ0s91L1swL1PE= =l8NX -----END PGP SIGNATURE-----

2 1

Re: [suse-security] Updating packages
by Oliver Hensel 14 Oct '00

14 Oct '00

Hi. On Sat, 14 Oct 2000, Jurjen Oskam wrote: [snip] > I suppose it's different for each kind of program. Something that's > spawned by inetd and only runs for a short time gets updated rapidly: > the executable is replaced by the package update and the next time > it's spawned by inetd the new executable gets run. That's a clear case at first sight, but what is with the already connected clients? Will they get disconnected to be forced to use the new Package? I think not. > > On the other end of the spectrum you have the kernel update: after > installing the RPM from YaST (and SuSEconfig), you need to reboot, of > course. That's also a clear case, but AFAICS not possible to automatically do this. > > > But how is it with the packages in between? For example, the recent > libc update? When does that update take effect? I didn't take any > chances and rebooted the machine, but was this necessary? Yes, running Daemons still use the old library. (Please correct me, if I'm wrong!) > > And suppose a proftpd running in daemon mode? After installing a > patch, is the running daemon automatically restarted by YaST or > SuSEconfig, or is that the admin's work? It should be in the respective RPM package, since then it works in all cases. I think I've seen such things in some packages (eg inetd, apache). Simply call /etc/rc.d/inetd restart (which is at /sbin/init.d in SuSE, don't ask). > I'd really like some info on this. I always stayed on the safe side > and restarted things (or even rebooted with a kernel- or libc-update) > manually. But there's nothing in YaST or SuSEconfig that says to > reboot or restart a package! So even though you installed that (for > example) proftpd patch, an old, vulnerable proftpd is still running, > even though YaST and SuSEconfig say the package is successfully > updated. In other words: you're still vulnerable, perhaps without > realizing it. To be on the safe side, this should be made whenever possible. But you can't always reboot. So except for kernel or important system libraries it should suffice to restart the service (via init scripts, eg. rcinetd or killall -9 inetd; /usr/sbin/inetd ) > Could anybody provide some input on this? When is it necessary to > restart a package, or drop to single user mode, or even reboot? Of > course, on production servers you'd like to keep downtime to a > minimum, so a simple restart of (e.g) proftpd is far more preferable > to a complete reboot. see above greetings olli -- -------------------------------------- Oliver Hensel <oliver.hensel(a)gmx.net> <ohensel(a)security-academy.de> http://www.ohensel.de/ Training + Consulting Unix - Linux - Firewalls - Security --------------------------------------

2 1

XXX a suggestion
by MaD dUCK 14 Oct '00

14 Oct '00

when discussing as we are currently, could we take care only to reply to the list or only to the author but not both. it's not a biggy and i am a newbie here, so maybe i should not propose that, but getting the same mail twice can be annoying... martin madduck(a)madduck.net (greetings from the heart of the sun)

2 2

kcore
by Yasholomew Yashinski 13 Oct '00

13 Oct '00

from /proc/: -r-------- 1 root root 50335744 Oct 13 17:31 kcore Is this a deletable kernel core file, or a mandatory proc entry? -- ..Yashy Who use an ancient meditation technique, Zum Kiddykiddy Poof -- refined over the centuries in the Cracker Temples of Kaffiristan -- to guide their quantum calculations. Zero knowledge and knowledge of zero are both crucial in quantum calculating, of course -- which is why Kabul, Redmond, and Montreal have emerged as leading research centers for the study of non-orthogonal state vectors, polarized freedom, and entangled quants. -Vin McLellan <vin(a)shore.net>

2 1

RE: [suse-security] Router and Bridges
by Reckhard, Tobias 13 Oct '00

13 Oct '00

Hi > > > A bridge will forward any packet that hits it, <...> > > > > Nope, by definition a bridge will only forward packets to the subnet > where the > > destination is listening. A repeater would forward any traffic. > > Right, but AFAIK a bridge knows nothing about (IP-) subnets but only about > (Ethernet) Segments which might be coincident. A bridge only looks at > Ethernet headers, only a router looks at IP headers. > True, but a bridge or (layer 2) switch still performs routing. On level 2, yes, but that's still routing. The algorithms are typically different between layer 2 (spanning tree) and layer 3 (distance vector, OSPF, etc.), but routing can be and is performed on both layers. > But these days most "real" devices are mixtures of both. > Really? My impression is that 'layer 3 switches' are still pretty new. They're being pushed, yes, but I presume that they're still quite a bit more expensive than pure layer 2 managed switches (with VLAN abilities, perhaps), which in turn cost more than unmanaged switches and those more than hubs (multi-port repeaters). Cheers Tobias

4 3

bridged & router
by Philipp Snizek 13 Oct '00

13 Oct '00

HI guys please let me close this bridge and router discussion with that: a bridge connects two different types of nets (atm to ethernet to tokenring to whatever). All these nets are running on the same protocol, e.g. tcp/ip. A router routes from one subnet to another. A bridge doesn't do that. cu guys & have fun! Philipp

1 0

Re: [suse-security] Suse Firewall 2.6
by MaD dUCK 13 Oct '00

13 Oct '00

these are icmp packets, "destination-unreachable". you probably have a policy on the output chain of DENY and don't let the icmp packets pass. you should NEVER NEVER NEVER block "destination-unreachable", and the following should also stay open: ipchains -A output -p icmp --icmp-type destination-unreachable -j ACCEPT ipchains -A output -p icmp --icmp-type source-quench -j ACCEPT ipchains -A output -p icmp --icmp-type time-exceeded -j ACCEPT ipchains -A output -p icmp --icmp-type parameter-problem -j ACCEPT ipchains -A output -p icmp --icmp-type echo-request -j ACCEPT and repeat that all for the input chain. martin madduck(a)madduck.net (greetings from the heart of the sun)

4 7

RE: [suse-security] Router and Bridges
by Scott, David 13 Oct '00

13 Oct '00

A bridge will forward any packet that hits it, while a router is more selective, it will only forward when the packet destination is not in the local subnet. Depending on the network traffic bridges tend to cause broadcast storms (because they will forward any broadcast messages) with can impair performance. David Scott -----Original Message----- From: Holger van Lengerich [mailto:hvl@paderlinx.de] Sent: Thursday, October 12, 2000 5:34 AM To: Steffen Beck Cc: suse-security(a)suse.com Subject: Re: [suse-security] Router and Bridges On 12 Oct 2000, Steffen Beck wrote: > Hi all .. > > Can anyone tell me specifically what the difference is between a router and a bridge ? .. > > Thanks > Systemx A Router forwards network-packets on OSI-layer 3 (e.g. IP, IPX). A Bridge forwards packets on OSI-layer 2 (e.g. Ethernet/IEEE802.3, FDDI). Regards, Holger ----------------------------------------------------------------------- Holger van Lengerich paderLinx - Neue Informationsmedien GmbH Diplom-Informatiker Cheruskerstrasse 2b, 33102 Paderborn Holger.van.Lengerich(a)paderlinx.de Fon: +49 5251 8994 - 16 Fax: -20 ----------------------------------------------------------------------- --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

3 2

Re: [suse-security] Suse Firewall 2.6
by MaD dUCK 13 Oct '00

13 Oct '00

togan, if you add the two dns forwarders to FW_TRUSTED_NETS in 10.) and add 'domain' to both FW_SERVICES_TRUSTED_???, i think that should cut it. i don't know SuSEfirewall. seems like a fancy interface to ipchains. somehow i like using the latter better though since it is more flexible. i don't know for instance how to prevent the dns forwarders having privileged ssh access while allowing it to 127.0.0.0/8 and vice versa. martin ### from fw.config >10.) > # Which services should be accessible from trusted hosts/nets on the internet? > # > # Define trusted networks on the internet, and the TCP and/or UDP services > # they are allowed to use. > # > # Choice: leave FW_TRUSTED_NETS empty or any number of computers and/or > # networks, seperated by a space. e.g. "172.20.1.1", "172.20.0.0/16" > # > FW_TRUSTED_NETS="127.0.0.1 127.0.0.2 " > # > # leave FW_SERVICES_TRUSTED_* empty or any number of ports, known portnames > # (from /etc/services) and port ranges seperated by a space. > # e.g. "25", "ssh", "1:65535", "1 3:5" > # > FW_SERVICES_TRUSTED_TCP="ssh 53" > FW_SERVICES_TRUSTED_UDP="syslog time 4000" # Common: syslog time ntp madduck(a)madduck.net (greetings from the heart of the sun)

1 0

my ipchains setup
by MaD dUCK 13 Oct '00

13 Oct '00

this is my file. read through ipchains-restore, it does not contain ipchains. i am still a redhat person but suse 7.0 is in the mail, that's why i am already subscribed. so let me know if you guys don't have ipchains-restore and i can provide you with it. oh whatever, i'll attach it with a small patch i made so that empty lines in the config files won't screw up the setup. so ipchains is my setup file, the tarball is if you are interested. remember: patch ipchains-restore < ipchains-restore.patch. the firewall should simply enhance security and allow such things as local smtp/http/pop3 but not make them accessible to anything outside 127.0.0.0/8. and since i place no restrictions on the content sendable and don't forward packets, this is all in the input queue... and please also comment on the commented rules - i use them on other systems that are less or more restrictive in certain ways. oh, and please ignore my icmp line. i was misinformed :) martin ps: where i am, it is now friday the 13th with a full moon!!! i love the moon! madduck(a)madduck.net (greetings from the heart of the sun)

1 0

RE: [suse-security] Suse Firewall 2.6
by Reckhard, Tobias 13 Oct '00

13 Oct '00

In response to MaD dUCK's ipchains rules to allow DNS traffic to your forwarders: Note that more often than not, DNS queries are performed with UDP and not TCP. You will want to allow UDP packets to port 53 on your forwarders outbound and 'response' packets back in. Probably the safest and most efficient way to provide DNS is to run a server (the most recent BIND 8 or Bernstein's DNS tools) on the gateway machine, configured to cache only and to query from a specific port. That way you don't have to open up a large range of UDP and TCP ports to a large number of hosts. And you get the added benefit of DNS caching. Beware of BIND vulnerabilities, though, you need to keep up to date with those and upgrade appropriately. HTH Tobias

2 1

Suse Firewall 2.6
by Togan Muftuoglu 13 Oct '00

13 Oct '00

Hi everyone, After upgrading to 7.0 the Suse firewall was also upgraded to 2.6 and after adjusting to what I thought to be secure I started to get the following deny errors. Oct 13 09:24:18 isguzar kernel: Packet log: output DENY ppp0 PROTO=1 212.57.4.190:3 212.57.1.12:3 L=134 S=0xC0 I=2912 F=0x0000 T=255 (#3) Oct 13 09:24:19 isguzar kernel: Packet log: output DENY ppp0 PROTO=1 212.57.4.190:3 63.102.200.2:3 L=247 S=0xC0 I=2924 F=0x0000 T=255 (#3) Oct 13 09:24:19 isguzar kernel: Packet log: output DENY ppp0 PROTO=1 212.57.4.190:3 63.102.200.2:3 L=247 S=0xC0 I=2925 F=0x0000 T=255 (#3) In my named.conf file 63.102.200.2 and 212.57.1.12 are used as forwarders. Do I define these under trusted nets or some other place in the SuSE firewall config file. Thanks in advance -- Togan Muftuoglu toganm(a)turk.net 100% MS FREE Absolutely no component of Microsoft was used in the generation or posting of this e-mail. So it is virus free

2 2

RE: [suse-security] Suse Firewall 2.6
by Reckhard, Tobias 13 Oct '00

13 Oct '00

Hi all Accept my apologies if this mail is unreadable -- I've got to bear Outlook's crappiness here.. >icmp messages are vital to most traffic on the network and they cannot really >be used for hacking. of course, icmp floods (i.e. ping of death etc.) are >based on them, but your system should be immune. Actually, ICMP can be used in many ways to compromise a network and/or hosts. They are very useful in mapping protected networks, reconfiguring hosts and causing all sorts of other mischief. Note also that ICMP packets are generally able to carry a payload, making them attractive as tunneling instruments. In contrast to Kurt, though, I am of the opinion that *some* ICMP should be allowed so as to not infer with the proper operation of the network. Which these are depends on the exact situation -- refer to Chapman, Zwiky and Cooper: "Building Internet Firewalls, 2nd edition", chapter 22: Administrative Services, heading "ICMP and Network Diagnostics" (pgs. 647-654) for details. Regards Tobias

1 0

Router and Bridges
by Steffen Beck 13 Oct '00

13 Oct '00

Hi all .. Can anyone tell me specifically what the difference is between a router and a bridge ? .. Thanks Systemx Sign up for your "FREE E-MAIL" @ MADMAIL http://www.madmail.com

3 2

ipchains question
by Scott, David 12 Oct '00

12 Oct '00

I'm having a problem with ipchains, the problem is that if I uncomment the line "ipchains -P input REJECT", then the masqurading entries quit working (kind of) I can still masq to a telnet session but nothing else. Here's what I've got ( where $extip is the ipaddress of the external adapter (eth0)) any help is much appreciated David Scott # # config: # 192.168.100.0/16 -> eth1 # xxx.xxx.xxx.xxx/32 -> eth0 (internet) # ipchains -F input ipchains -F output ipchains -F forward ipchains -A input -i !lo -j DENY ipchains -A output -i !lo -j DENY ipchains -M -S 7200 10 60 ipchains -P forward DENY ipchains -A forward -s 192.168.100.0/24 -i eth0 -j MASQ ipchains -A forward -i lo -j ACCEPT ipchains -A input -p icmp --icmp-type destination-unreachable -j ACCEPT ipchains -A input -p icmp --icmp-type source-quench -j ACCEPT ipchains -A input -p icmp --icmp-type time-exceeded -j ACCEPT ipchains -A input -p icmp --icmp-type parameter-problem -j ACCEPT ipchains -A input -p icmp ! -s 192.168.100.0/24 --icmp-type echo-request -j REJECT # # accept DNS traffic on both UDP and TCP # ipchains -A input -p udp -s xxx.xxx.xxx.xxx 53 -j ACCEPT ipchains -A input -p tcp -s xxx.xxx.xxx.xxx -j ACCEPT # # accept incoming SMTP, GLFTPD, TELNET, AUTH requests # since tcp-wrappers handle the security for most of these # ipchains -A input -p tcp -d $extip smtp -j ACCEPT ipchains -A input -p tcp -d $extip www -j ACCEPT ipchains -A input -p tcp -d $extip glftpd -j ACCEPT ipchains -A input -p tcp -d $extip telnet -j ACCEPT ipchains -A input -p tcp -d $extip auth -j ACCEPT ipchains -A input -p tcp -d $extip 6363 -j ACCEPT ipchains -A input -p udp -d $extip 6363 -j ACCEPT ipchains -A input -p tcp -d $extip ssh -j ACCEPT ipchains -A input -p TCP -d $extip 6000 -j REJECT ipchains -A input -p TCP -d $extip netbios-ssn -j REJECT ipchains -A input -p TCP -d $extip time -j REJECT ipchains -P input REJECT

2 1

PAM and tcp wrappers
by Sridhar 12 Oct '00

12 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hello i just wonder if tcp wrappers can be used in pam authentication. For instance, in case of services where authentication is required, like ssh,telnet, ftp, rlogin, is it possible to deny a login based on the person's ipaddress, or execute a command like the tcp wrappers. If somebody's portscanning me for interesting ports, it would definitely be helpful if he thinks the ports are open for him, but whatever he does, he cannot get in. I wud indeed prefer tcp wrappers to be _behind_ the login . Has it been done ? That would beat the hell out of nmap ;) regards cheedu -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.2 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE55f/wrHJM2EAbaXwRAiviAJ4nemb4Ps8u84m9gvI06yMi8RUw3wCgo1KR M+lyKdH2lyyGufsMsrIsIpg= =VV11 -----END PGP SIGNATURE-----

1 0

RE: [suse-security] Alternate FTP server to wuftpd...
by Scott, David 12 Oct '00

12 Oct '00

glftpd is another good replacement -----Original Message----- From: jochen [mailto:jochen@teg-me.de] Sent: Thursday, October 12, 2000 9:13 AM To: suse-security(a)suse.com Subject: Re: [suse-security] Alternate FTP server to wuftpd... Hello, Ryan. Try porftpd. It's a real good replacement for wu(da horror)ftpd. I've been using it now for two years and I'm really happy withit. It's really simple to configure (apachelike syntax). Cya Jochen --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

RE: [suse-security] BIND DNS messages
by Steven Thompson 12 Oct '00

12 Oct '00

Thanks for the reply Roman "hint zone"?? I don't understand. My DNS server is supposed to be caching only server. What is the [196.4.160.2].53 DNS server trying to do? If the answer is obvious please point me to the right docs. Thanks Steven -----Original Message----- From: Roman Drahtmueller [mailto:draht@suse.de] Sent: 11 October 2000 12:54 To: Steven Thompson Cc: SuSE security mailing list (E-mail) Subject: Re: [suse-security] BIND DNS messages > > Hi All > > I have the following named messages in my log. Should I be concerned. Is it > trying to updated my Root server settings. > > Oct 11 06:26:31 warrior named[11843]: unrelated additional info > 'E.GTLD-SERVERS.net' type A from [196.4.160.2].53 Are you sure you configured your root-zone as a hint zone? > Thanks in advance > > Steven Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

4 3

secure file copying
by Marco 12 Oct '00

12 Oct '00

hi all, is there a way to copy/move a file (backup) secure over the network ? at this time we use ssh with a useraccount which has no password. sounds unsecure eh ? :) i know that it is possible for everyone on the machine "a" to connect to machine "b" when he knows 1) the non-password useracc and 2) the ip where the ssh-key with no-password is stored. what happens if the ssh-key with the non-passwd is stolen or may be used by an attacker to get more accounts or root ? i don´t know how this could help him, but i think its not the best way to transfer the files with this method. any ideas ? thx Marco A. --

4 3

Kerberos Error on gss-client/server sample
by Michael Kehm 12 Oct '00

12 Oct '00

Hi, I am currently in the stage of preparing a sample scenario for demonstrating MIT Kerberos capabilities on Linux (SuSE Linux V7.0). The sample scenario includes the demonstration of the connection and access of a client to a kerberized server. In regards to this I have a problem concerning the usage of the simple gss-server and gss-client contained in MIT Kerberos V5 Release 1.2. Problem description Executing gss-server with "sample" as service name on a dedicated system "lxserver.foo.bar.com" (in my sample scenario this box is also the KDC) succeeds without a problem. Executing gss-client on a second system "lxclient.foo.bar.com" fails with the following error: GSS-API: Server not found in Kerberos database. Despite that error message, the service principle (sample/lxserver.foo.bar.com(a)FOO.BAR.COM) for the server is definitely included in the Kerberos database. Executing the gss-client on the same box as the gss-server succeeds without any problem and verifying the ticket issued by the KDC shows that a session ticket for the sample server has been issued. DNS is in place and both systems are able to resolve the respective host names and via reverse look up the respective IP Addresses. Even more interestingly is the fact, that the sclient and sserver sample do run without an error report while distributed on two systems. Any help or hint would be highly appreciated. Thx, Michael

1 0

SuSE Security Announcement: esound
by Roman Drahtmueller 11 Oct '00

11 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: esound Date: Wednesday, October 11th, 2000 19:00 MEST Affected SuSE versions: 6.3, 6.4, 7.0 Vulnerability Type: local user compromise Severity (1-10): 3 SuSE default package: yes Other affected systems: Linux systems using esound with unix domain socket support Content of this advisory: 1) security vulnerability resolved: esound problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information esound, a daemon program for the Gnome desktop, is used for sound replay by various programs such as windowmanagers and other applications. The esound daemon creates a directory /tmp/.esd to host a unix domain socket. Upon startup, the daemon changes the modes of the socket, but a race condition allows an attacker to place a symlink into the directory to point to an arbitrary file belonging to the victim. By consequence, an attacker may be able to change the permissions of any file belonging to the victim. If the victim's userid is root, the attacker may be able to change the modes of any file in the system. SuSE distributions before SuSE-6.3 were not vulnerable to this attack because unix domain sockets were not supported by the esound daemon as shipped with these distributions. The only efficient solution for the problem is to store the unix domain socket in a directory where only the user has write access to. The user's home directory is such a location. Update packages that fix the race conditions by placing the sockets into the user's home directory are available for download. It is recommended to apply the fix on systems where multiple users can access the local filesystem. Note: Not all filesystems support unix domain sockets. The fix might not work if the user's home directory is on such a filesystem (such as AFS, eg.). In such rare cases, administrators are usually aware of such limitations. SuSE default installations do not have this limitation. Download the update package from locations desribed below and install the package with the command `rpm -Fhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/snd1/esound-0.2.19-15.i386.rpm 9d8addaa5ba29554a727eb34ae5189f4 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/esound-0.2.19-15.src.rpm a9724b99a96430b1b7c1f741a8e8d528 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/snd1/esound-0.2.16-75.i386.rpm 6f32f0867d1597a5129d0516438d9cca source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/esound-0.2.16-75.src.rpm 94ca6842981f7a501300d9edfc5cbf73 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/snd1/esound-0.2.15-21.i386.rpm 16a5804a2f27e62d73df40d206b047ca source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/esound-0.2.15-21.src.rpm c86689fd5d9f719135e1263dd5a38832 Sparc Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/snd1/esound-0.2.19-15.sparc.rpm 112648ef64c351952f832b180fcca23c source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/esound-0.2.19-15.src.rpm a0bb3e3517ca83c13abd6827a8d2295e AXP Alpha Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/snd1/esound-0.2.16-75.alpha.rpm d2efefb21a6424a81e63788d972db49d source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/esound-0.2.16-75.src.rpm a69ebae320c6f118f4b9e07f2a9af4d2 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/snd1/esound-0.2.15-21.alpha.rpm 19942e308eda0c0d505bb64da734ad8d source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/esound-0.2.15-21.src.rpm 6f337d6864111d27fa93ef2bc3cb7b5a PPC Power PC Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/snd1/esound-0.2.19-16.ppc.rpm be6daabfee0e7e629b848814be81d9d0 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/esound-0.2.19-16.src.rpm c77475b2c8fff104f8662bb9179efb64 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/snd1/esound-0.2.16-75.ppc.rpm f0e1aa54c3fdf7c6c02b34bedc51ee0f source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/esound-0.2.16-75.src.rpm 9acd25b5521201386bb73bc707382646 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - gnorpm A race condition has been found in the gnorpm program, a GUI for the rpm system. The issue will be addressed in a following announcement. - ncurses The ncurses library contains buffer overflows that are exploitable when user-supplied terminfo databases are processed. This imposes a security risk on programs/binaries that are linked against libncurses and run with special privileges. Both workaround and clean solution is to remove the suid bit from all executable files with setuid bit set. The issue will be addressed in a following security announcement. - apache mod_rewrite A bug has been discovered in the apache package that allows attackers to read arbitrary files on a system that runs apache. The responsible apache module named "mod_rewrite" is not used by default on SuSE installations of the apache package. The issue will be addressed in a following security announcement. - cfengine A format string parsing bug causes the cfengine package to be vulnerable to a remote root attack. Update packages are available, the security announcement is pending. - usermode/userhelper userhelper is a suid helper program designed to let the user who is logged on to the console execute some programs with root privileges. SuSE distributions do not contain the usermode package and therefore are not vulnerable to the security problems recently discovered in the usermode package. - tmpwatch The tmpwatch packages as shipped with SuSE distributions are not vulnerable to the attacks as discussed on security forums because we ship an older version that does not provide the functionality that can be exploited. - lprNG The versions of the lprNG package that come with SuSE distributions are not vulnerable to the format string parsing errors as discussed in security forums. - traceroute The traceroute program has been found vulnerable to a bug (`traceroute -g 1 -g 1') in many distributions. Newer SuSE distributions have a different implementation of the traceroute program and are not vulnerable to the bug found by Pekka Savola <pekkas(a)netcore.fi>. The vulnerability could not be verified in older SuSE distributions. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOeSeQHey5gA9JdPZAQHrvQf/Rr4f0JNuNIRymhcGou60OfvkDjXOH2yi iT/CG9+uQns6QCyNe4jFjMNoFjCt//eZG2zMOO/22RiiCXUbPKeLPXVgyZYDN5VS F1JDJfxYIoHrU+eQnDO1QVM0QpXbeSU4J6YIXxneZaZ0uP2kqi6y0o36UQtwzk3j tRY/H1NsNWcKPYYTYWgmKZUQNd5n+Jq3cSf8DQAPWzoRoLGPo1+yp/SGuOyZbKN/ mEwTcsFxdOGgHtBOcHfRaAcb4nBHQ9QApKZTan8ndLTUIrhFb9C06gh9BEGmaqLD jENF4MnWIlxGX5EaW0nLSJ2Ts4uh8julg9qteJGLN949+2ECfgzqag== =oZfu -----END PGP SIGNATURE-----

1 0

Console blanking
by Jan 11 Oct '00

11 Oct '00

Hi. das ist das erste mal, dass ich in eine Liste schreibe, also verzeiht Fehler. Ich habe einen Laptop (NoName), mit einer s3virge. Die Grafikkarte hat auch einen ausgang für einen Externen Monitor. Es gibt die Kombis LCD LCD + EXTERN EXTERN Jedes mal, wenn sich consoleblanking einschaltet, springt der Monitor/Graphikkarte nicht wieder an. Ich muss immer erst zwischen den obigen Kombis einmal umschalten. Wer weiss wie ich diesen Fehler behebe? cu jan

2 1

disable init=/bin/sh?
by Frank Steiner 11 Oct '00

11 Oct '00

Hi, just stepped on this option to type "linux init=/bin/sh" at the boot prompt, which gives me a root shell. For me, that's really a security problem: We have some computers here which we cannot protect with boot-passwords because they have to come up automatically after a power drop. Can I somehow disable this possibility of passing an alternative init-parameter for my SuSE 6.4? Best regards, Frank -- Dipl.-Inform. Frank Steiner mailto:fst@informatik.uni-kiel.de Lehrstuhl f. Programmiersprachen mailto:fsteiner@web.de CAU Kiel, Olshausenstraße 40 Phone: +49 431 880-7265, Fax: -7613 D-24098 Kiel, Germany http://www.informatik.uni-kiel.de/~fst/

6 10

BIND DNS messages
by Steven Thompson 11 Oct '00

11 Oct '00

Hi All I have the following named messages in my log. Should I be concerned. Is it trying to updated my Root server settings. Oct 11 06:26:31 warrior named[11843]: unrelated additional info 'E.GTLD-SERVERS.net' type A from [196.4.160.2].53 Oct 11 06:26:31 warrior named[11843]: unrelated additional info 'F.GTLD-SERVERS.net' type A from [196.4.160.2].53 Oct 11 06:26:31 warrior named[11843]: unrelated additional info 'J.GTLD-SERVERS.net' type A from [196.4.160.2].53 Oct 11 06:26:31 warrior named[11843]: unrelated additional info 'K.GTLD-SERVERS.NET' type A from [196.4.160.2].53 Oct 11 06:26:31 warrior named[11843]: unrelated additional info 'A.GTLD-SERVERS.net' type A from [196.4.160.2].53 Oct 11 06:26:31 warrior named[11843]: unrelated additional info 'M.GTLD-SERVERS.net' type A from [196.4.160.2].53 Oct 11 06:26:31 warrior named[11843]: unrelated additional info 'G.GTLD-SERVERS.net' type A from [196.4.160.2].53 Oct 11 06:26:31 warrior named[11843]: unrelated additional info 'C.GTLD-SERVERS.net' type A from [196.4.160.2].53 Oct 11 06:26:31 warrior named[11843]: unrelated additional info 'I.GTLD-SERVERS.net' type A from [196.4.160.2].53 Oct 11 06:26:31 warrior named[11843]: unrelated additional info 'B.GTLD-SERVERS.net' type A from [196.4.160.2].53 Oct 11 06:26:31 warrior named[11843]: unrelated additional info 'D.GTLD-SERVERS.net' type A from [196.4.160.2].53 Thanks in advance Steven

2 1

Firewall Setup
by Dustin Huptas 11 Oct '00

11 Oct '00

Hello, at the moment I have the following Setup: Internet | | Cisco Router | | Firewall(SuSE 6.2) -- Webserver(SuSE 6.3) -- Proxy (SuSE 6.3) Mailserver | | --- internal network The firewall serves as a packet filter. The Web-/Mailserver and the Proxy are each connected via an public ip. The clients from the internal network are all masqueraded with the proxy ip, even if one of the clients do not use the proxy. Is it possible to have all public ip´s connected to the firewall´s ethernet device from which they are routed to the webserver and proxy(and the clients on the internal network as well). My approach is to have only the firewall directly connected to the internet and to give even the web-/mailserver and the proxy only internal ip adresses. I think this would be more secure?! Sorry for my bad english and my (not) understanding of firewalls and security! Thanks in advance Dustin

7 10

Opening ports for VPN through firewall
by Eldon Berg 10 Oct '00

10 Oct '00

I have Suse 6.4 running as a firewall very well. I have to have some of my internal computers (W95) telnet via a Checkpoint client software to a VPN server on the internet. I have included both the ip address of the VPN server and the computer I telnet to in the fw_trusted_nets and set the fw_services_trusted_tcp to 1:65535. The VPN authenticates itself but will not connect to allow the telnet session to start. I went around the firewall and all connect just fine. Any suggestions? Eldon Berg __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com

3 2

rpc.statd
by Steffen Beck 10 Oct '00

10 Oct '00

I was wondering if anyone out there know how to find the buffer address for the rpc.statd service remotely, either with a use of a script or some kind or any other method that can catch it ... I already know how to filter the address locally using the GNU Debugging program so don't bother :) Steffen Beck Sign up for your "FREE E-MAIL" @ MADMAIL http://www.madmail.com

1 0

RE: [suse-security] passive ftp? active ftp?
by John Trickey 09 Oct '00

09 Oct '00

On Monday, October 09, 2000 8:34 AM, Philipp Snizek [SMTP:mailinglist@bluewin.ch] wrote: > Please can somebody tell me the difference between active ftp and > passive > ftp? Philipp, The normal (active) operation of ftp is as follows: Client establishes session with server by calling it on port 21. This is the control channel over which all commands and returned status information is carried. However it is not used for data. When a PUT,GET,LS,DIR ... command is sent, a second channel (data) is established to send the file/directory listing... . This second channel is established by the server calling the client on port 20. This causes problems when the client is behind a firewall and/or NAT device as the connect for the data channel may not be allowed past the firewall (security policy) or it may not be able to find the client if NAT is in use and the device does not remember ftp state. ie if A connects to B on port 21, then B can be expected to connect to A on port 20. To overcome this, passive mode is used. In this mode the control channel is established in the same way but the data channel, instead of being set up from the server, is now set up from the client. To do this, the server tells the client (over the control channel) that it is listening on port NNNN and the client establishes the channel by calling the server on the nominated port. This satisfies the security policy of not allowing inbound connects and will allow a dumb NAT device to register the session and so correctly pass traffic. Hope this answers your question. John

1 0

CERT to disclose software flaws
by Fred Miller 09 Oct '00

09 Oct '00

CERT to disclose software flaws The security incident response center will give software companies 45 days to fix security flaws, joining the trend toward open discussion of vulnerabilities. http://www.zdnet.com/zdnn/stories/news/0,4586,2637904,00.html -- Fred A. Miller Systems Admin. Cornell Univ. Press Services fm(a)cupserv.org

2 1

proxy for everything
by Philipp Snizek 09 Oct '00

09 Oct '00

Hi all Do you know a proxy which proxies everything? I need ssl, http, nntp, pop, smtp, ftp/ftp-data I have seen falcon from falcon.naw.de (a good one but still very much in development) and DeleGate, which does not convince me very much. Please tell me if you some other thanx Philipp

3 2

SuSE: tmpwatch
by Roman Drahtmueller 09 Oct '00

09 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- Hello, the tmpwatch packages as shipped with SuSE distributions are not vulnerable to the attacks as discussed on security forums, initiated and discovered by zenith parsec <zenith_parsec(a)THE-ASTRONAUT.COM>. The version of tmpwatch that we ship is a bit older than the bleeding edge, but it has proven to do what it says, which is just as important. We did not (silently) fix the problems in the package - the version that we use does not have the features that cause the security problems. Undoubtedly, the utility has its use. But for efficient (temp-watch competes for 100% system resources) and reliable monitoring of directories without any race conditions it would be necessary to have the kernel do the major part of the work. Thanks, Roman. - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOeHtbney5gA9JdPZAQGl5Qf/WDVAqiaioXHfe2UZ9H9ofTX6DnmFbtRx cSGN2ws7MD6/ebUJ06QRVxpnaYe76NDV8tJCk9nV+I2XpLD5fLq+oEIk/0EJ6M5+ 7RXG7FxkxLxRsWUqyHfDGtoHn3H43evWp5QLlaz087YYrpGcD9odOgWMSxs340ex dYJf5/wKnXIX/SxNLbxRuOzyA7RU2FD46i/uzmXNjmVyzolbsNTCn0/LCmToahaA UmqakzKkhJu++13pPfPAks0TTLwbwWOYCiBbQrmdGyu3BB8rqsl/vw72O9O0Ocue e6y75DvqtiFDJlVhf/i7yMqiDW6Vo9J0HU+h/dSI/QdXZUj18pNJ2w== =uWou -----END PGP SIGNATURE-----

1 0

ftp data
by Philipp Snizek 09 Oct '00

09 Oct '00

hello I have some misconfiguration in squid.conf I believe. ftp's so far ok, but what's wrong if ftp-data does not work over squid 2.3? I configured the browser on the client using passive ftp and squid's confiugred the same way. Moreover I have tried ftp by using always_direct ftp. Please help. thank you. Philipp

1 0

Re: [suse-security] passive ftp? active ftp?
by anyware＠wachtler.de 09 Oct '00

09 Oct '00

On Mon, Oct 09, 2000 at 09:34:23AM +0200, Philipp Snizek wrote: > Hello > > Please can somebody tell me the difference between active ftp and passive > ftp? > > thank you > Philipp If you do some ftp then you have a server somewhere in the world and a client program on your system. The servers runs day after day and waits for connections, he 'listens' on a port (usually port 21). The client connects to that port and then the client sends commands, and the server responses if you are lucky. To transfer data (after a get or put command perhaps) they do NOT use this existing connection, they open another one instead. But which of both plays the the server (listening) and which plays the client (connecting) to establisg this second channel? - If the client chooses the 'passive' mode, then he sends a PASV command to the server. The server opens a port for the data connection (usually port 20 I believe) and sends an answer to the client containing the host adresse. The client connects to this adress/port combination. - If the client chooses the 'active' mode, then he creates the listening side of the connection, sends his adress to the server, and the server connects. Since in passive mode the server sends an adress it is able to let the client connect to any other server (gateway) by sending the appropriate adress. Klaus -- ---------------------------------------------------------------------- Klaus Wachtler Breidingstr. 17 D-29614 Soltau Tel. +49-5191-70271, +49-171-4553039 Fax: +49-5191-70272 email AnyWare(a)Wachtler.de http://www.wachtler.de ----------------------------------------------------------------------

1 0

passive ftp? active ftp?
by Philipp Snizek 09 Oct '00

09 Oct '00

Hello Please can somebody tell me the difference between active ftp and passive ftp? thank you Philipp

1 0

strange ftp-scan
by Peter Münster 08 Oct '00

08 Oct '00

Hello, today I got about 50 messages like the following in /var/log/messages: Oct 7 10:11:51 gmv wu.ftpd[14694]: connect from 211.56.234.227 Oct 7 10:11:51 gmv ftpd[14694]: FTP session closed ... and it's still going on! What could be the deeper meaning, when someone it making connections the whole day long? Any hint is appreciated! Peter P.S.: I'm running wu-2.4.2-academ[BETA-18](1) -- Peter Münster http://w3pm.stormloader.com/

8 16

Suggestion to the SuSE security people
by Bo Jacobsen 08 Oct '00

08 Oct '00

Hi there, I have a suggestion to you security guys, that could make life a lot easier for a lot of us out here, and at the same time really make the SuSE security update feature shine, compared to the other linux distributions. I have noticed that since 24/9-00 six updates to SuSE 7.0 has been posted on your security site. At this rate it could turn out to be a very time consuming job having to update Linux all the time. To make this a much easier task, I suggest that you, on top of the usual downloadable update files, make available a gzip file containing all the updates relevant to your latest distribution (7.0 at this moment). Every time a new update is posted you also post a new gzip file that includes all earlier updates AND the new one. This file could be called SU1, SU2... SUn. (SU = Security Update). The gzip file should, besides the .rpm files, include a shell script that could automate all the updates. The script could maybe do something like this: for (first_update to last_update present in the gzip file) do { if (module or program that the updated relates to is installed on the target system) { do_update = false if (this update is older then the one installed) do_update = ask_user_if_ok_to_update () else if (module has not been updated) { if (running update will overwrite config file(s) that the user/system may have edited) { if (do_update = ask_user_if_ok_to_update ()) make copy (.bak) of config file(s) } } if (do_update) run the rmp update } else do_nothing } A procedure like this could really make a difference. Updating could now be almost totally automated, and if SuSE would post an e-mail to this forum when a new update is released, I'm sure a lot of SuSE installations would be updated much more frequently then is the case today. I for one would update our systems a lot more frequently. Lets also say that you put a subject string like "Announce: SuSE security update SU05 is released ...." in the e-mail, and in the Message body a link to the newest update file. Users could then make a filter in their e-mail client that would redirect all mail coming from SuSE containing this subject string, to a high priority mailbox. When the user opens the mail, he just clicks on the link and this baby would rock'n role. Of cause I could write the script my self, but that would not make the downloading easier at all, and here I see a opportunity for SuSE, with very little effort, to really make thinks much more "user friendly". Thanks in advance Bo Jacobsen bjc(a)image.dk

12 19

Re: [suse-security] network options
by Matthias Krawen 07 Oct '00

07 Oct '00

At 22:43 06.10.2000 -0500, you wrote: >Sure you can do that with dhcp. go to www.no-ip.com and register a >subdomain of no-ip.com, download the updater client (works for BTW: Does anybody know some Dynamic-IP Services which is doing this professional with some redundancy ? Thx. Matthias Compositiv EDV- und Kommunikationslösungen, PC-Service Matthias Krawen Peiffersweg 9 22307 Hamburg Tel: 040 / 611 673 - 40 EMail: info(a)compositiv.de Fax: 040 / 611 673 - 41 http://www.compositiv.de

1 0

Re: [suse-security] network options
by Russell Evans 07 Oct '00

07 Oct '00

Cleaned up the grammer, I hope. I hate it when I sound like an idiot. The Cisco 675 will do PAT, port address translation as will as NAT, network address translation. You want to do a, set nat entry add, on the 675 to open a port on the DHCP addressed WAN port. This port will be forwarded to the specified computer's IP address and port. The full command you want to use is, set nat entry add inside_ipaddress port. The inside_ipaddress port is the computer's IP address / port you wish opened. The full command for port fowarding is set nat entry add inside_ipaddress port outside_ipaddress port protocol. By leaving the outside address unspecified, the Cisco 675 will open a port on any address you recieve on the wan port via dhcp. If you specify the address then it will break, if you are ever assigned a new one. To assign a name to your box I would suggest. www.dhs.org. Sign up for a dyn.dhs.org host and then apply the DHCP address that the Cicso 675 has on it's wan0-0 port. Use the command sh nat on the Cisco to get the DHCP address you recieved. cbos#sh nat NAT is currently enabled Inside Global Address set to 216.160.111.159 Inside Local Inside Global Timer Flags Protocol 10.0.0.30: 222 216.160.111.159: 222 0 0x2041 *** 10.0.0.10: 25 216.160.111.159: 25 0 0x2041 *** 10.0.0.10: 22 216.160.111.159: 22 0 0x2041 *** You can see that I have two computers. I have PAT pointing connections for ssh (22) , and SMTP (25), and port 222, which is ssh running on the second host. You can only point one port on the wan interface to one computer / port, so to ssh in the second computer required another port to be opened and the sshd deamon on the that host to listen on port 222. I used 222 because it is easy for me to remember. ssh myhost.dyn.dhs.org 222 There where a few times when I wanted access to my computers when away, where service had been interrupted and I had recieved a new DHCP address. Of course being away from the systems I had no way of know what the address assigned was and myhost.dyn.dhs.org was not pointing to the new address. I had no way to know what to connect to and was locked out. To fix this, I used a script and setup the Cicso 675 to log its syslog to one of my machines. The cisco commands are cbos#set syslog SET SYSLOG requires one of the following arguments disabled Turn off Syslog enabled Turn on Syslog port Set Syslog Port Number remote Set Remote IP Address test Test Syslog server So enable it and use set syslog remote ipaddress to point the logging to your computer. Using yast, it is very easy to setup syslog to accept traffic from other host. System Administration/Change configuration/ look for SYSLOGD_PARAMS and add -r to the options. Now do as root /sbin/init.d/syslog restart, and then on the cisco use the command cbos#set syslog test HELLO, this is cool. To test that this works, use, as root, on the host with syslogd accepting input from the 675 , the command, grep HELLO, /var/log/messages Now every time the cisco picks up a new address it will log this fact to the syslog daemon on your computer. The script will search for the ip address logged in /var/log/messages and if it does not match the current DNS setting at dhs.org it will change them to match. Set up the attached file with the appropraite settings for your dhs.org account. Then set up a cron job as root to run the script every hour or so. It has to be root because only root has access to /var/log/messages. When run, the script will test the current DNS settings of your dyn.dhs.org host on the dhs.org DNS server, if the current ip address of the cisco matches, then logger logs this fact to syslog. If the ipaddress isn't the same, the script updates your settings and logs if it was successful or not. Thank you Russell > I get service through USWest and I believe that I have a Cisco > 675 DSL modem. I'm interested in what you develop for a setup on this... > > Thanks, > Ryan

1 0

Re: [suse-security] network options
by Russell Evans 07 Oct '00

07 Oct '00

USWest DSL and USWest's "cheap / basic" ISP service use the cisco 675 in route mode not bridge mode. What you suggest can only be done in bridge mode. Most ISP's using USWest dsl to deliver service to their customers, use bridge mode because it is easier to setup and support for them. USWest.net uses route mode. Thank you Russell > Sure you can do that with dhcp. go to www.no-ip.com and register a > subdomain of no-ip.com, download the updater client (works for > win/linux/mac) load it up on the firewall and setup port forwarding on the > firewall to forward in your ftp/http/smtp/pop/telnet/ssh whatever > connections. I am doing exactly that - dsl line, linux firewall, three > computers behind the firewall one of which is http/ftp/smtp/pop server. >

1 0

network options
by Edward Miles 07 Oct '00

07 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, this is my situation... i have dsl, and i get dhcp-assigned addresses (as many as i want) i want to have my linux box setup so that i can firewall off certain things from the rest of my network but i want the computers behind the firewall to still be out on the internet with their public ips is there a way to put these boxes behind the linux one and still get dhcp? and how would it be setup so that the systems behind the linux box can still be available from the outside? (ie i have an ftp server running on my windows box that i would still like to have available) thanks in advance! - -ed -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.3 iQA/AwUBOd4xsDy2xdXHhmxFEQKejwCeKrrJQ9nLyvXHSIQeZpjbOHSUQrIAnR/U AUiZZIBbouEWyOqlZHbope6W =G+yi -----END PGP SIGNATURE-----

3 2

Re: [suse-security] network options
by Russell Evans 07 Oct '00

07 Oct '00

The Cisco 675 will do PAT, port address translation as will as NAT, network address translation. You want to do a set nat entry add on the 675 to open a port on the DHCP address WAN port that will be forwarded to a computer IP address and port. The full command you want to use is command is set nat entry add inside_ipaddress port. The inside_ipaddress is the computer's IP address port is the port you wish opened. The full command for port fowarding is set nat entry add inside_ipaddress port outside_ipaddress port protocol. By leaving the outside address unspecified, the Cisco 675 will open a port on any address you recieve. If you specify the address then it will break if you are assigned a new one. Now, to assign a name to your box I would suggest. wwdhs.org. Sign up for a dyn.dhs.org host and then apply the DHCP address that the Cicso 675 has on it's wan0-0 port. Use the command sh nat on the Cisco to get the address. cbos#sh nat NAT is currently enabled Inside Global Address set to 216.160.111.159 Inside Local Inside Global Timer Flags Protocol 10.0.0.30: 222 216.160.111.159: 222 0 0x2041 *** 10.0.0.10: 25 216.160.111.159: 25 0 0x2041 *** 10.0.0.10: 22 216.160.111.159: 22 0 0x2041 *** You can see that I have two computers. I have PAT pointing connections for ssh and SMTP and 222, which is ssh running on the second host. You can only point one port to one computer, so to ssh in the second computer required another port to be opened. I used 222 because it is easy for me to remember. There where a few times that I wanted access to my computers when away where service had been interrupted and I recieved a new DHCP address. Of course being away from the systems I had no way of know the address assigned and so myhost.dyn.dhs.org was not pointing to my machine. To fix this I used a script and setup the Cicso 675 to log its syslog to one of my machines. The cisco commands aare cbos#set syslog SET SYSLOG requires one of the following arguments disabled Turn off Syslog enabled Turn on Syslog port Set Syslog Port Number remote Set Remote IP Address test Test Syslog server So enable it and use set syslog remote ipaddress to point the logging to your computer. Using yast, it is very easy to setup syslog to accept traffic from other host. System Administration/Change configuration/ look for SYSLOGD_PARAMS and add -r to the options. Now do as root /sbin/init.d/syslog restart, and then on the cisco use the command cbos#set syslog test HELLO, this is cool. to test that is works by using as root, the command, grep HELLO, /var/log/messages So now every time the cisco picks up a new address it will log this fact to the syslog daemon on your computer. The script will search for the ip address logged and if it does not match the current DNS setting at dhs.org it will change them to match. Now set up the attached file with the appropraite settings and set up a cron job as root to run it every hour or so. It has to be root because only root has access to /var/log/messages. This will test the current DNS settings of your dyn.dhs.org host on the dhs.org DNS server, if the current ip address of the cisco matches, then logger logs this fact to syslog. If the ipaddress isn't the same, the script updates your settings and logs if it was successful or not. #!/bin/sh # # # # ######################################## # Set these variables to your DHS Info # ######################################## LOGIN="" # your username PASSWORD="" # your password HOSTNAME="" # your hostname DHSDOMAIN="dyn.dhs.org" # your dynamic DHS domain ( dyn.dhs.org, 2y.net ) ATHome will not work with this script MAILHOST="" # where you want mail to this host delivered to LOGFILE="/var/log/messages" # your syslog file OFFLINE_URL="" # offline url if your want to redirect CLOAK="" # Y / N ( yes or no ) CLOAK_TITLE="" # I'm off line at the moment, will be back REAL SOON NOW ######################################################### # You shouldn't have to modify anything below this line # ######################################################### DATE=`date +%b" "%e` IPADDRESS="`grep "$DATE" "$LOGFILE" |grep IPCP | tail -n1 | cut -d " " -f26 | cut -d "^" -f1`" DHS="http://members.dhs.org/nic/hosts?hostscmd=edit&hostscmdstage=2&typ e=4&submit=Update&updatetype=Online&domain=$DHSDOMAIN&hostname=$HOSTNAM E&ip=$IPADDRESS&mx=$MAILHOST&offline_url=$OFFLINE_URL&cloak=$CLOAK&cloa k_title=$CLOAK_TITLE" if test "`nslookup $HOSTNAME.$DHSDOMAIN wombat.dhs.org | tail -n2 | grep Address:| cut -d " " -f3`" = "$IPADDRESS" ; then logger "IP `echo "$IPADDRESS"` is still mapped to `echo "$HOSTNAME.$DHSDOMAIN"` `date +%D" @ "%l:%M%p`" ; else lynx -dump -auth=$LOGIN:$PASSWORD $DHS sleep 30 if test "`nslookup $HOSTNAME.$DHSDOMAIN wombat.dhs.org | tail -n2 | grep Address:| cut -d " " -f3`" = "$IPADDRESS" ; then logger "IP `echo "$IPADDRESS"` is now mapped to `echo "$HOSTNAME.$DHSDOMAIN"` `date +%D" @ "%l:%M%p`" ; else logger "Unrecognized response updating ip record! `date +%D" @ "%l:%M%p`" fi fi exit Thank you Russell > I get service through USWest and I believe that I have a Cisco > 675 DSL modem. I'm interested in what you develop for a setup on this... > > Thanks, > Ryan

1 0

lynx-ssl
by Dieter Demerre 06 Oct '00

06 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- Is this program (still?) supported by SuSE and if not, what equivalent text-browser could be used to allow ssl-connections ? ******* Groetjes vanwege ***** Greetings From ******* Dieter Demerre - http://www.angelfire.com/de/ddemerre ddemerre(a)acm.org - ext.dieter.demerre(a)siemens.be Although this private and confidential e-mail has been sent to you through a personal Siemens account, it does NOT represent any official opinion of Siemens. If you are not the intended recipient of this e-mail and have received it in error, please notify the sender by replying with 'received in error' as the subject and then delete it from your mailbox. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.8 iQCVAwUBOdti9a5coohL2ygZAQFZMwP/aoLBae6bmP3AbPbJchZSqq3oGqypPfKS fpN9+KLDd649Y8nJLAXomENySj/ecv2P5nqi0o2UitNxiiTDeZ3MoXAOwTL5oVWy 2EX2KeO7rKu+Kd1aRHW9F/MgTiQFtlUJfP+fahRN//hDCVWbkuUQOkRKM2Qm01UA U98RCDBNol8= =Ufn0 -----END PGP SIGNATURE-----

5 5

Securityproblem on ypservers by building ypmaps
by Dipl. Phys. J�rg Schl�ger 05 Oct '00

05 Oct '00

Hi, I just changes users on a plain linux suse-7.0 on the ypserver as root After testing with my normal user rights and locking around I went to /var/yp typing make and got new ypmaps. All where build, only yppasswd because of my ristricted rights as normal user. In result every user can do the same and building new ypmaps, only the passwd is untouched. Is this a problem ? Jörg Schläger P.S.: at once I changed the permissions of the used programs for creating yp maps

1 0

General firewall question
by Sven Schultheiß 05 Oct '00

05 Oct '00

Hi, I have the following situation: Internet-----------Firewall-------------LAN | | DMZ What would be the most secure way under linux to redirect HTTP requests from my LAN to a transparent proxy in the DMZ? Thanks in advance, Sven

3 4

AW: [suse-security] Suggestion to the SuSE security people
by Gerd.Bitzer＠tesion.de 05 Oct '00

05 Oct '00

Hi, and more better there are also ported versions of autorpm directly from Suse under http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.noarch.rpm http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.src.rpm which work out of the box ;-) -----Ursprüngliche Nachricht----- Von: Kurt Seifried [mailto:listuser@seifried.org] Gesendet: Mittwoch, 4. Oktober 2000 11:09 An: Bo Jacobsen; Suse securityg group Betreff: Re: [suse-security] Suggestion to the SuSE security people Or you could just install autorpm or something similar. http://www.securityportal.com/lskb/10000050/kben10000077.html Personally I think your idea has merit, but it's way to ugly/crude. What I would like to see is SuSE doing something like Red Hat's network program, they'll be handling updates/etc/etc for people for a minimal cost. Ideally vendors should harass users to sign up on a security announcement mailing list during install, and post easy to read/understand advisories with exact instrcutions for update install (and run a sufficiently powerful ftp server to house all the updates). Also be nice if there was something nice and simple like windows update, go to a website, run a local thing to list what you got, remote site tells you what you need/etc. In any event all the vendors have a ton of work to do making updates easier for end users. Kurt Seifried - seifried(a)securityportal.com SecurityPortal, your focal point for security on the net. http://www.securityportal.com/ --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

4 3

sendmail ftp bug?
by Irmund Thum 04 Oct '00

04 Oct '00

2. and 3. Oktocer we had on a FTP-Server a surprising visit and an abuse of sendmail: *** log extract *** Oct 2 23:02:04 ftp sendmail[12220]: XAA12220: SYSERR: putoutmsg (ipb194.miami15.fl.pub-ip.psi.net) error on output channel sending "250 kbrabow(a)mail.win.org... Recipient ok": Broken pipe Oct 2 23:03:13 ftp sendmail[12232]: XAA12232: collect: premature EOM: Connection reset by ipb194.miami15.fl.pub-ip.psi.net Oct 2 23:03:13 ftp sendmail[12232]: XAA12232: SYSERR(root): collect: I/O error on connection from ipb194.miami15.fl.pub-ip.psi.net, from=<billbuk(a)rhein-neckar.de>: Connection reset by ipb194.miami15.fl.pub-ip.psi.net Oct 2 23:07:01 ftp sendmail[12291]: XAA12291: collect: premature EOM: Connection reset by ipb194.miami15.fl.pub-ip.psi.net Oct 2 23:07:01 ftp sendmail[12291]: XAA12291: SYSERR(root): collect: I/O error on connection from ipb194.miami15.fl.pub-ip.psi.net, from=<billbuk(a)rhein-neckar.de>: Connection reset by ipb194.miami15.fl.pub-ip.psi.net Oct 2 23:10:36 ftp sendmail[12308]: XAA12308: SYSERR: putoutmsg (ipb194.miami15.fl.pub-ip.psi.net) error on output channel sending "250 mozes(a)xentrix.net... Recipient ok (will queue)": Broken pipe Oct 2 23:33:30 ftp sendmail[13022]: XAA13022: SYSERR: putoutmsg (ipb194.miami15.fl.pub-ip.psi.net) error on output channel sending "250 doe(a)server.net... Recipient ok (will queue)": Broken pipe Oct 2 23:36:13 ftp sendmail[13052]: XAA13052: SYSERR: putoutmsg (ipb194.miami15.fl.pub-ip.psi.net) error on output channel sending "250 barbara(a)dropfatgetthin.com... Recipient ok (will queue)": Broken pipe Oct 3 04:58:17 ftp sendmail[17551]: EAA17551: SYSERR: putoutmsg (ipb145.miami15.fl.pub-ip.psi.net) error on output channel sending "250 <jogunz(a)aaamart.co.jp>... Sender ok": Broken pipe Oct 3 09:45:23 ftp sendmail[19163]: JAA19163: collect: premature EOM: Connection reset by ipa247.miami15.fl.pub-ip.psi.net Oct 3 09:45:23 ftp sendmail[19163]: JAA19163: SYSERR(root): collect: I/O error on connection from ipa247.miami15.fl.pub-ip.psi.net, from=<jimilesdeniles(a)ad.oita-u.ac.jp>: Connection reset by ipa247.miami15.fl.pub-ip.psi.net Oct 3 12:01:43 ftp sendmail[21313]: LAA21313: collect: premature EOM: Connection reset by ipa247.miami15.fl.pub-ip.psi.net Oct 3 12:01:44 ftp sendmail[21313]: LAA21313: SYSERR(root): collect: I/O error on connection from ipa247.miami15.fl.pub-ip.psi.net, from=<jimilesdeniles(a)ad.oita-u.ac.jp>: Connection reset by ipa247.miami15.fl.pub-ip.psi.net Oct 3 12:03:35 ftp sendmail[21390]: MAA21390: SYSERR: putoutmsg (ipa247.miami15.fl.pub-ip.psi.net) error on output channel sending "250 hala(a)intermediatn.net... Recipient ok (will queue)": Broken pipe Oct 3 12:09:14 ftp sendmail[21478]: MAA21478: SYSERR: putoutmsg (ipa247.miami15.fl.pub-ip.psi.net) error on output channel sending "250 elizabethex(a)fuse.net... Recipient ok (will queue)": Broken pipe Oct 3 13:35:20 ftp sendmail[22832]: NAA22800: smtp.vphos.net.: SMTP DATA-2 protocol error: 570 Command DATA Message rejected due to content Oct 3 18:57:23 ftp sendmail[26457]: SAA26457: SYSERR: putoutmsg (ipa178.miami15.fl.pub-ip.psi.net) error on output channel sending "250 wanda(a)adsnet.com... Recipient ok": Broken pipe *** message body was a typical "get rich quick scheme": *** extract *** I AM LIVING PROOF THAT IT WORKS!!! If you choose not to participate in this program, I am sorry. It really is a great opportunity with little cost or risk to you. If you choose to participate, follow the program and you will be on your way to financial security. If you are a fellow business owner and are in financial trouble like I was, or you want to start your own business, consider this a sign. I DID! $$ Sincerely, Johnathon Rourke ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ HERE'S HOW THIS AMAZING PROGRAM WILL MAKE YOU THOUSANDS OF DOLLAR$$$$!!!! PLAN SUMMARY: (1) You order the 4 reports listed below ($5 each). They come to you by email. (2) Save a copy of this entire letter and put your name after Report #1 and move the other names down. (3) Use any of the hundreds of bulk email services (search for "Bulk Email") and have them send 25,000 - 50,000 emails for you (about $49+) (4) Orders will come to you by postal mail - simply email them the Report they ordered. *** etc . *** Can somenody give me a hint or point me to a documentation? Thanks, i.t -- Mit freundlichen Gruessen Irmund Thum, PP Active GmbH Candidplatz 11, 81543 Muenchen tlf +49 89 748828 43, fax...-11

1 0

postfix as mailrouter?
by Philipp Snizek 04 Oct '00

04 Oct '00

Hi 2 u all Postfix is very new to me, I just heard that it is quite secure and this is the reason why I have chosen it. But that's not the problem anyway. Please tell me if postfix can do what I need it for: I have an internal network running on 10.0.0.0/24. I have an ipchains paket filter running on a suse 7.0 box, connecting my internal network to the outside. It is said that paketfilter are not as secure as proxies. At the moment I just have SSL, HTTP and FTP/FTP-DATA running over Squid. I need postfix (or some other mail proxy) also running on this box. This enables me to close DNS, SMTP and POP ports, disable routing and ipchains. The mailservers I receive mail from are outside my network (I have no DMZ running - not yet). I communicate through ipchains with my ISP's mail- and popservers. This means that postfix should act like a smtp and pop forwarder. Thank you Philipp Snizek

1 0

scanner
by Philipp Snizek 04 Oct '00

04 Oct '00

Hi all Does anybody know about a more powerful scanner than nmap? I need it to scan my own firewall. Thanx a lot Philipp Snizek

4 4

SuSE FTP-Proxy
by Steven Thompson 04 Oct '00

04 Oct '00

Hi All Is the SuSE FTP-Proxy used mainly for inbound connections, as it warns you that if do not specify a destination FTP-Server the FTP-Proxy service will fail. <Quote> /etc/proxy-suite/ftp-proxy.conf # Where to redirect incoming FTP traffic. This destination # will be used if a client has not set its own target. # WARNING: ftp-proxy will refuse to run if this directive # is not set. # # DestinationAddress server.domain.tld<Quote> Question 2 Are you able to set the "DestinationAddress" to a FTP Server sitting on a private network address. For example your DMZ was a private network i.e. 192.168.x.x Question 3 Is it possible to setup the FTP-Proxy for outbound connections only or is IP-Masquerade safe enough for outbound ftp connections. Thanks in advance Steven

2 1

SuSE: userhelper/usermode
by Roman Drahtmueller 03 Oct '00

03 Oct '00

Hi there, SuSE distributions do not ship with the usermode package that contains the userhelper program. Therefore, SuSE distributions are not vulnerable to the recently published attacks that target the usermode package. Regards, Roman Drahtmüller, SuSE Security. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

1 0

firewals-2.1-5 (from 6.4), 1x dev-world, 2x dev-int
by W.Schlich 03 Oct '00

03 Oct '00

hello list! I have installed firewals 2.1-5 on one of my machines. it has two internal devices (eth0: 192.168.0.10, eth1: 192.168.1.10) and one external (ippp0). both internal nets can connect to the internet w/o problems, but connecting to each other seems to be a problem, since there is no customizable ruleset in the firewall config for that (routing, forwarding etc. between internal ifaces) --snip-- Chain forward (policy DENY): target prot opt source destination ports fw_masq all ------ 192.168.0.0/23 0.0.0.0/0 n/a DENY all ----l- 0.0.0.0/0 0.0.0.0/0 n/a --snip-- after executing --snip-- ipchains -D forward 2 ipchains -A forward -s 192.168.0.0/23 -d 192.168.0.0/23 -j ACCEPT --snip-- the machines on the two different nets can connect to each other. the firewall is also a smb server, hence it tries to broadcast to both nets, which unfortunately is also denied. any idea to modify the SuSEfirewall script that it fits my needs? I'm not that familiar with ipchains :( thanx in advance. Mit freundlichen Grüssen | Wolfram Schlich ------------------------------------------------------------------ | E-Mail: wolfram(a)schlich.org * ICQ #: 35713642 | Postal: Berghof * 56626 Andernach * Germany | Tel.: +49-(0)2636-941194

3 4

www.sun.com and SuSEFirewall
by Chris Clarke 03 Oct '00

03 Oct '00

Hi, I asked this question earlier, but maybe I was too wordy and people deleted quickly: I'm running the most recent version of suse firewall, and can't seem to get through to www.sun.com because it keeps wanting to connect back to a 6xxxx tcp port on my firewall. I have now tried changing allow_incoming_high_ports_tcp/udp temporarily to yes to get at it, but this didn't work, the firewall is still denying the incoming connection. Every other website and ftp site I use works through this firewall. I desperately need to get StarOffice onto my laptop. Can anyone tell me what I need to do to the firewall to get into sun.com? Thanks, Chris. __________________________________________________ Do You Yahoo!? Yahoo! Photos - 35mm Quality Prints, Now Get 15 Free! http://photos.yahoo.com/

2 1

identd/AUTH for SMTP Mail connections
by Steven Thompson 03 Oct '00

03 Oct '00

Hi I have a lot of mail servers trying to connect to my identd port (113) when sending mail to me. <Quote> The problem comes about because the firewall silently drops the SYN packet. The e-mail server is expecting an immediate SYN-ACK (identd supported) or RST (identd not supported), but when the firewall drops the packet it keeps trying until the connection times out. http://www.robertgraham.com/pubs/firewall-seen.html#slow-email <Quote> How do you reconfigure the firewall to RST all those connections the incomming smtp requests on the identd port (113) using "pchains". Thanks in advance Steven

3 2

/tmp as homedirectory (update of package "aaa_base")
by Peter Meijer 02 Oct '00

02 Oct '00

Hello SuSE experts, on the second of May 2000 Marc Heuse from SuSE posted an *updated* security announcement regarding the package "aaa_base": >>[...] 3. Solution 1) Update the package from our FTP server. 2) The root user will receive a email with the accounts listed which have a homedirectory in /tmp. You have to fix this by hand, because some installations might break if they rely on information saved in the (unsafe) /tmp homedirectory. The email will give more information what to do. [...]<< Of course I updated the package immediately. Unfortunately, however, I never got an eMail with information on how to do part 3.2 (I wonder if this happens only to me :-(; I do not find this problem on the list). Currently three users on my *server* system (SuSE 6.2 running httpd, ftpd, samba, and sendmail) have a homedirectory in /tmp: -- games (I haven' t installed any games...) -- wwwrun -- firewall (not installed on _this_ server...) Nobody's homedirectory is in /var/lib/nobody (nobody.nogroup). I changed that some time ago, following the instructions given in another security announcement by SuSE. My questions: What do I have to do in order to secure my system *without* breaking it up?! Should I delete the users 'games' and 'firewall'? Should I move the homedirectory of user 'wwwrun' to /var/lib/wwwrun (wwwrun.nogroup)? Thanks in advance! Kind regards, Peter -- Sent through GMX FreeMail - http://www.gmx.net

1 0

kernel upgrade
by semat 02 Oct '00

02 Oct '00

I downloaded kernel 2.2.16 from ftp.suse.com to upgrade the 2.2.14 that came with my 6.4 however when I try to upgrade using rpm -Uvh I get a host of errors about conflicts with existing files like /boot/vmlinuz config.h and so on. Even if I use the option --force it does not work. For the source I had to use rpm -Uvh --nodeps --force lx_suse.rpm in order for it to be installed at all. When I try this with the k_eide.rpm I get a message about a bad file descriptor. Can anyone help me with this?

2 1

NIS interoperability
by Alan Miller 02 Oct '00

02 Oct '00

Since this question is "security" relevant and I don't know where else to ask I thought I ask it here. My NIS Server is a Solaris box. My NIS Clients are (primarily) SuSE boxes (6.0,6.4,7.0). On the NIS server I've moved the encrypted passwds into the passwd.adjunct file. This seems to be okay for the SuSE 7.0 boxes. Login is successful. However on 6.0 and 6.4 boxes the login always fails with "login incorrect". A trace between client (SuSE 6.4, or 7.0) and server basically shows: client -> server Get Map Name: passwd.byname, Key=<user> server -> client Key Matched: Value = user:##user:uid:gid:gcos:home:sh client -> server Get Map Name: passwd.adjunct.byname, Key=<user> server -> client Key Matched: Value = user:##user:uid:gid:gcos:home:sh client -> server Get Map Name: shadow.byname, Key=<user> server -> client Key Matched: Value = EMPTY This is security relevant since the idea behind passwd.adjunct is that it hinders normal user's from retrieving the encrypted passwords via "ypcat passwd". Alan +--------------------------------------------------------------------+ | Alan Miller BinTec Commmunications AG | | System/Network Administrator Südwestpark 94 | | Voice: +49 911 96 73 14 55 D-90449, Nürnberg | | Fax: +49 911 96 73 14 99 Germany | | mailto:alan@bintec.de http://www.BinTec.de | +--------------------------------------------------------------------+

1 0

SuSE: traceroute
by Roman Drahtmueller 02 Oct '00

02 Oct '00

Hi, SuSE ships a different implementation of traceroute in the distributions. It is not susceptible to the attacks as mentioned by other Linux vendors. Regards, Roman Drahtmüller. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

4 4

Stopping X from listening on port 6000 in SuSE 6.4
by Nix 02 Oct '00

02 Oct '00

Hi Guys, I know there was a thread about this several months ago, but I can't find it in my mail archive, and there doesn't seem to be an easy way to search the archive on the suse site. I basically need to know which file I need to edit to Stop X from listening on port 6000 in SuSE 6.4 Sorry to ask a newbie question, but my communication options are limited at the moment as I'm on a slow dialup in Hong Kong. on another note, I just installed the updated version of openssh from the suse ftp server and noticed that it now supports tcp wrappers by default. Thanks guys, saved me a recompile. Cheers Nix

2 1

Re: [suse-security] firewals package - NFS exports
by Volker Kuhlmann 01 Oct '00

01 Oct '00

On Sat, 02 Sep 2000 09:46:25 +0200, Gerhard Sittig wrote: [about ports used by NFS] > No, due to the "dynamic" nature of RPC. You might want to have a > filter hooked up in the portmapper stream (ports 111 udp+tcp) > generating rules on the fly as connections get established and > closed. It's very much like FTP data sessions. Sounds ideal. Is there such a filter which is freely available, or does everyone cook their own? Volker

1 0

RAS sorry...
by paul wagner 01 Oct '00

01 Oct '00

Dear List and reader, I' m very sorry for writing my announce in german and using my nickname. Thanks to all who answered and of course to those who translated the message. I think I' ll try to satisfiy my boss with a PPP-Server.... I posted the message in security list 'cause I thought it would be better to keep security aspects high... ;-) Thankfull Paul

1 0

RAS
by sobek 01 Oct '00

01 Oct '00

Hi Liste, könnt ihr mir helfen? Ich brauch einen RAS für Linux. D.h. mein Chef will sich direkt ins Modem einwählen um Zugriff aufs LAN zu haben. Gibt es da vieleicht ein fertiges Tool für? Wenn ja: kann man eine Firewall auf auf dem gleichen Rechner laufen lassen ider besser auf einem anderen? mfg Paul

7 7