October 2000 - openSUSE Security - openSUSE Mailing Lists

Option "nosuid" of "mount"
by Anibal Vasquez 25 Oct '00

25 Oct '00

Hello list! >From man mount: nosuid Do not allow set-user-identifier or set- group-identifier bits to take effect. (This seems safe, but is in fact rather unsafe if you have suidperl(1) installed.) Would somebody tell me why it´s rather unsafe to use this option if suidperl is installed? I have all man pages installed but have no one for suidperl allthough a have a file /usr/bin/suidperl. I also couldn´t find anything about this program in the SuSE-sites. Thanks in advance! Anibal

3 2

SuSE Firewall 4.0
by Schulz, Wolfgang 25 Oct '00

25 Oct '00

Hello I'm using SuSE 7.0 with Firewall 4.0 After startup I always get: mfw: setsockopt failed: Invalid argument What could be the reason for this? Thanks Wolfgang

1 0

How to do a Stealth NIC
by Randy Taylor 25 Oct '00

25 Oct '00

Looks like the answer is: ifconfig <device> up If you do it this way the interface comes up with no IP address, but it won't ARP or participate in any other way. The interface can be put in promiscuous mode. This information is from a friend of mine whom I asked about the "Stealth NIC" question privately. I'll need to run some tests to be sure this works, but the early results are promising. Many thanks again to suse-security list for your help. Randy

1 0

"Stealth" NIC - How?
by Randy Taylor 25 Oct '00

25 Oct '00

Hello all :) I am trying to set up a NIC to run in "stealth" mode. Some folks call this "transparent" mode and I've heard it referred to as a NIC with an unbound IP stack. This NIC will act as a passive (and undetectable) packet capture hardware device for a commercial intrusion detection system. I am running SuSE 6.4 and the NIC will be one of two PCMCIA NICs in a Dell Inspiron 7000 laptop. I've been told a stealth NIC can be done in Solaris via its "plumb" argument to ifconfig, although I haven't tried it myself. I've also been told a similar operation can be done in RedHat by taking all the IP info out of the /etc/sysconfig/network-scripts/ifcfg-eth0 file and restarting the network (/etc/rc.d/init/g/network restart). Again, I have not done this personally. In Microsoft OS'es, unbinding the protocol stack from the NIC is trivial. I have looked for a solution like the RedHat procedure for SuSE 6.4 but have not been able to find one. Does anyone on the list have a method for creating a stealth NIC in SuSE? If so, please let me know. Many thanks in advance, Randy

7 8

Proftpd issues on SuSE 6.3
by Thomas Michael Wanka 25 Oct '00

25 Oct '00

Hi, I have a SuSE 6.3 server connected to the net. Installed are apache, qmail, courier-imap and proftpd (from the SuSE CDs), everything works fine, I use the Alias directive of proftpd so that users log in with an "virtual" username and a real users password. I am in the process of switching to another internet access, to keep things consistent, I set up a second PC, installed an identic SuSE, copied the user and group filesand the necessary directory structures (with all permissions). So basically I have two identic PCs. On the new PC I cannot connect with the "virtual" user names to proftpd, but - and that absolutely scares me - with *any* user and password combination! That is e.g. I can login through proftpd with the username "qmailq" (the user required for maintaining the queue of qmail) and the matching password, this user has a valid homedir, the shell is set to "/dev/null". It is absolutely not possible to do that on the original PC, I double and triple checked the configurationfiles of both PCs. If there are no further clues I have no other choice but to expect the new system to be compromised. Thanks in advance mike

2 1

Security issues when using Samba?
by Anibal Vasquez 25 Oct '00

25 Oct '00

Good morning people! I have apache running on a linux-machine. Now the guy who cares about the www-sites doesn´t want to log into the linux-machine to update the sites (let´s say with scp) but he wants just to copy the new files on a network device on his windows-machine on which he wants to mount the httpd-directories of the linux-machine then running samba. My question is: is it secure to let samba authenticate a user on the linux-machine (lets say a current user "webmaster" who only owns the needed directories)? Does the option "encrypt passwords=yes" provide an acceptable level of security (this last question is may be OT?)? Between the www-guy´s machine and the linux-machine are two or three routers, the whole network is about 150 machines big. All this other machines must be considered untrusted. Any of the files exported by samba are public, so no encryption of data is need. Any other suggestions concerning security in this case? Thanks a lot! Anibal

14 19

Re: AW: [suse-security] Help!
by Roman Drahtmueller 24 Oct '00

24 Oct '00

> > can i do this change for a network? x.x.x.255 ?? > > regards toralf Yes. Have a look at the file, please. It's explained there. Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

1 0

[offtopic] proxy problems
by Stiefenhofer, Marek ECOFIS 24 Oct '00

24 Oct '00

>Well, Windows 98's Internet Conection Sharing (aka,ICS) What is then >? >It does NAT, that's for sure, i've used it for long... So You can set >it >to work as a gateway >If you want NAT on your Windows Machine,maybe you should look closer >on your >proggie's configuration.. I've tested some similar proggies and they >sometimes >suport NAT, but not selected by default ... A Proxy-Service does by definition neither NAT nor routing. So you can't use a SOCKS-Proxy as "Default-Internet-Gateway". I guess the mentioned program ICS implements only PAT - not NAT - but thats maybe a bit too far in the details... Marek

2 1

RE: [suse-security] proxy problems
by Diogo Bacelar Quintela 24 Oct '00

24 Oct '00

- -----Original Message----- From: suse-security-return-3591-dbq=mega.ist.utl.pt(a)suse.com [mailto:suse-security-return-3591-dbq=mega.ist.utl.pt@suse.com]On Behalf Of Markus Gaugusch Sent: tera-feira, 24 de Outubro de 2000 7:37 To: Steffen Beck Cc: suse-security(a)suse.com Subject: Re: [suse-security] proxy problems |> I am running Windows ME on one of my computers, recently I |> download an internet sharing program that sets up a proxy on port |> 1080 ... Now I want my linux box to go through this proxy ( linux |> --> Win ME --> Internet ) but there is a problem .. |Port 1080 is a SOCKS proxy. There are socks client (and |server) implementations for linux, and AFAIR there es a |"preload" version of socks, allowing you to connect transparently |with every program through the socks server. |> What I do is that I setup the gateway on my linux box to my |> windows machine ( gateway == Win ME IP ) and sets the DNS address |> to my |> ISP's .. |this is only possible if the host would do masquerading (which |windows can't do), so don't set a gateway. Well, Windows 98's Internet Conection Sharing (aka,ICS) What is then ? It does NAT, that's for sure, i've used it for long... So You can set it to work as a gateway If you want NAT on your Windows Machine,maybe you should look closer on your proggie's configuration.. I've tested some similar proggies and they sometimes suport NAT, but not selected by default ... Diogo Quintela |bye! |Markus |__________________________ |Markus Gaugusch ICQ 11374583 |markus(a)gaugusch.dhs.org |99 - --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

proxy problems
by Steffen Beck 24 Oct '00

24 Oct '00

Hi all I am running Windows ME on one of my computers, recently I download an internet sharing program that sets up a proxy on port 1080 ... Now I want my linux box to go through this proxy ( linux --> Win ME --> Internet ) but there is a problem .. What I do is that I setup the gateway on my linux box to my windows machine ( gateway == Win ME IP ) and sets the DNS address to my ISP's .. It doesn't work, what have I done wrong ? Thanks in advance Steffen Beck Sign up for your "FREE E-MAIL" @ MADMAIL http://www.madmail.com

2 1