November 2000 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

Re: is SuSE going to implement libsafe?
by marc＠suse.de 18 Feb '01

18 Feb '01

Hi, >I have just read an Bell Labs anouncement, that they are going to release >libsafe under GNU licence, and that some major Linux distros are going to >be using it. SuSE was not amongst them, why is that? I think that libsafe would >be a good echnacement against buffer overflow. > >Anouncement is on: >http://www.bell-labs.com/news/2000/april/20/1.html just because something new pops up please be careful with questions like "when will you implement it?" ;-) There are several questions to ask: a) is it STABLE and does it NOT affect the stability of other programs? b) does it bring additional security problems into the system? c) is the security protection effective? Well, of course the SuSE Security Team already reviewed libsafe. Here are the answers: a) unsure. it would have to be tested very intensive. this was not done yet. b) the code might have vulnerabilities, however the protection gained is higher even if a vulnerability would be present c) okay, now the tough part: libsafe is a dynamic library which is set in the environment which checks several dangerous functions, which can be a security problem. Because it is a dynamic library, it is NO protection against local attackers, just against remote attackers on network services. (if an attacker wants to attack a local suid file, he would just reset his library path environment). Next thing: it does not check for all known vulnerabilites. It even doesn't protect against all buffer overflows, It just protects against *some* overflows. those which happen because of insecure use of strcat/strcpy etc. summary: I can not remember a vulnerability in a network service for the last year which this tool would have prevented. Therefore: as long as this tool is not enhanced to also protect open/fopen calls against symlink/hardlink/pipe attacks, several more buffer overflow types, system/exec* function protection etc. it is not useful to use this tool. I would rather propose to use the secumod module which comes with SuSE Linux since 6.3 and maybe the secure-linux kernel patch from www.openwall.com - these two tools enhance your security. (and btw, install seccheck, hardensuse and firewals and use them - then your security is very high) Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

5 4

telnet as a root on a suse 6.3 suse server
by Francesco Masiello 02 Jan '01

02 Jan '01

I must be able to telnet from a terminal (not a console) as a root without using su. In solaris i could do that editing /etc/default/login file,but i can't find it on this Operating System. How can i do ? Thanks

8 7

SuSE Security Announcement: netscape (SuSE-SA:2000:48)
by Roman Drahtmueller 13 Dec '00

13 Dec '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: netscape Announcement-ID: SuSE-SA:2000:48 Date: Thursday, November 30th, 2000 19:00 MET Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0 Vulnerability Type: clientside remote vulnerability Severity (1-10): 4 SuSE default package: yes Other affected systems: systems w/ netscape versions before 4.76 Content of this advisory: 1) security vulnerability resolved: netscape problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information Michal Zalewski <lcamtuf(a)DIONE.IDS.PL> has found a buffer overflow in the html parser code of the Netscape Navigator in all versions before and including 4.75. html code of the form <form action=foo method=bar> <input type=password value=long string here> more form tags </form> can crash the browser. It may be possible for an attacker to supply a webpage that executes arbitrary code as the user running netscape. As of today, no exploit code is known to exist in the wild. SuSE provides an update package for the vulnerable software. It is recommended to upgrade to the latest version found on our ftp server as described below. The update package introduces Netscape version 4.76. NOTE: Please note that Netscape-4.76 is not available for the glibc-2.0-based SuSE Distributions SuSE-6.0 and 6.1 because Netscape doesn't provide any binaries for the glibc version in these distributions (glibc-2.0). For SuSE-6.0 and 6.1, we provide a libc5-based version of netscape-4.76 which runs smoothly on all i386-based SuSE distributions 6.x and 7.x, provided the package shlibs5 is installed. The package can be found in the update/5.3 directory on our ftp server (see below). There are no packages available for platforms other than i386. NOTE: The packages on our ftp servers date back to October 31st. Since there is no release notes or README file with equivalent content in the netscape tarball, SuSE security was not aware of the fact that this release of netscape fixes the known problems. This information can be obtained from (along with information about other bugfixes) http://home.netscape.com/eng/mozilla/4.7/relnotes/windows-4.76.html . Please choose the update package(s) for your distribution from the URLs listed below and download the necessary rpm files. Then, install the package using the command `rpm -Uhv file.rpm´. rpm packages have an internal md5 checksum that protects against file corruption. You can verify this checksum using the command (independently from the md5 signatures below) `rpm --checksig --nogpg file.rpm', The md5 sums under each package are to prove the package authenticity, independently from the md5 checksums in the rpm package format. Intel i386 Platform SuSE-7.0 SuSE-6.4 SuSE-6.3 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/7.0/xap1/netscape-4.76.glibc21.i386… 7ccebaca7df0937a3c08fc30a27af858 SuSE-6.1 SuSE-6.0 ftp://ftp.suse.com/pub/suse/i386/update/5.3/xap1/netscape-4.76.libc5.i386.r… 3c4f06c5fea4755083524eb135627380 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - ssh/openssh Several inconsistencies and configuration bugs have been introduced in the SuSE rpm packages for the update of openssh (SuSE-SA:2000:47) that cause the openssh software to not work as reliably as usual. The packages are about to be reworked, the openssh announcement will be reissued. - pidentd The in.identd daemon on SuSE distributions can be crashed remotely. We're working on a fix. - bash1 bash, version 1, handles temporary files in an unsafe manner that allows a local attacker to overwrite arbitrary files as the user running a bash1 with input redirection of the "<< EOF" style. The bash1 package is not used per default in SuSE-distributions. We're working on a fix (update packages). - tcsh The paragraph above about bash version 1 applies to the tcsh as well, in all versions. The tcsh is not used by SuSE scripts. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOiacFHey5gA9JdPZAQEy5Qf+NlySb8Nk3N5KUFHMf4zh/tVQfyCiXEW5 GUJ5M3Y8quHZq2KX/ErCXWws2/RJAIdHnyEAkeXigwZ001l0MqnWM5PqAWUUGXRh X4isNVr2IeV07RnhIyLdYUj4sDBfmDf1Xwyf/cl6SYcHmeo9/dnfz4ImanYuO9iF cd1gjSWQVCGkP6C28p99GaK3IfzUMvfZjiINS1/mURKSeiQMsOTd4ktOtBvKJY4O SVe8d9is1lUqoiRME1q0+ri3iRLYGWQDDrjukg1SUXVO3jgEXi+lBrO0fs3Stb7o OKRaMnWJvsoHmemRWBMHo7mnBtdYkubQqF6iSIVC60NuW/VJmV9YWg== =Nv3j -----END PGP SIGNATURE-----

5 6

Linux 7.0
by C.Richartz＠wzl.rwth-aachen.de 13 Dec '00

13 Dec '00

Hi, my name is Chris and I just started using LINUX. Now my problem I have to install a very save server. The server should work as a file-server which is also WWW-router, firewall and Mailserver for a network of 25 workstations with Windows NT. 5 Days ago I started working in LINUX but my employer wants me to create a server that is saver than a very save NT-system. I'm not able to create such a system by myself!! Please Help me Greetings Chris

7 6

RPM-Update on all boxes in a LAN
by gtschakert＠gmx.de 05 Dec '00

05 Dec '00

Hi, after reading the last security-announcement I ask myself if there is a tool to update the new rpm automatically to all the boxes in my LAN. What I want to do is the following: I recieve the security-announcement: I decide to install or not and download the rpm. I start a script, which will install the rpm to the boxes of my choice. I don't want to login on every box, install the rpm and go to the next box. I hoped alice would do things like that, but I think alice is only a tool for new installation (and you have to make a floopy-disk or a CD). And I think, some month ago, I have read about a scripting-language for system administrators, but I don't remember where. Anybody, who can help me.

12 16

Re: [suse-security] Re: password files for proftp
by Max Lindner 03 Dec '00

03 Dec '00

Hello Thom Am Don, 30 Nov 2000 schrieb Thorsten Marquardt: > Hello Magus > > Am 30-Nov-00 schrieb Magus Ba'al: > > > I got this from http://www.proftpd.net/docs/complex-virtual.conf > > > > AuthUserFile /where.ever.you.want.to.stick.it > > AuthGroupFile /where.ever.you.want.to.stick.it > > > > What _I_ prefer to do is create a directory, let's call it /var/domains. > > Because I host multiple domains, I put the auth files in /var/domains with > > the name , and then create a dir in /var/domain/(domain name). It keeps it > > neat and tidy for me if I ever need to find anything related to the > > domain. > > so far so good. But I don't know how to create the AuthUserFile itself. > why don't you use the program 'htpasswd', afaik it's delivered with apache. htpasswd makes a file with a username&password-File. this files contains in each line one user. It's build like the /etc/passwd: username:passwd:uid:gid:comments:Home-dir:shell but with htpasswd, you've only the 1st and 2nd entry, the others have to be edited by you. that's the way I do it... Max

2 1

Ftp Services disabled
by Pao Sayaovang 01 Dec '00

01 Dec '00

Hello: Im a newbie at Linux. Recently setup a SuSE 7.0 LinUx box and had everything going well. Until, I made a few changes in the /etc/rc.config and somehow disabled my FTP Services. I've also made changes in my etc/rc.config.d/firewall.rc.config too and now I totally blocked out of my ftp services. I know I'm not being clear on the info I've given but can anyone help me get started with re-enabling ftp services again. Is it? start Inetd="yes"?? start Proftpd="yes"???? Thanks, ___________________________ Pao Sayaovang Weyco Group, Inc DID(414) 908~1813 Fax(414) 908~1913 psayang(a)weycogroup.com

7 6

SuSE Linux 6.x 7.0 Ident buffer overflow
by Rash 01 Dec '00

01 Dec '00

http://linuxtoday.com/news_story.php3?ltsn=2000-11-28-024-04-SC-SS Has anybody exploit for this subj? I wanna check myself and my friends :-)

4 3

any nntp proxy ?
by Olivier Hislaire 30 Nov '00

30 Nov '00

Hi, I need to install a nntp proxy on my suse 6.3, and I tried acmennrp. When I start it, it justs stops without a single (error) message; I bet there is something missing. Since I cannot read java (sorry),and cannot find a clue of a documentation neither any logged message anywhere (yes, syslogd is configured and working all right), what else can I do ? Does anybody knows about using acmennrp (proxy mode only), or any other SW that woul do it ? Thanks, Olivier. ------------------------------------------------------------------------------------------------ Olivier Hislaire MSG International Email: O.Hislaire(a)msg-i.com 97 Avenue de Tervuren Phone: +32 (0)2 735.91.59 Ext. 55 1040 Brussels Fax: +32 (0)2 732.12.19 Belgium http://www.msg-i.com ------------------------------------------------------------------------------------------------

5 4

How secure is sendmail
by Max Lindner 30 Nov '00

30 Nov '00

Hi! I'm must make a decision wether to install sendmail or not. I've heard that sendmail is unsecure, but it is also used very often. My case would be a server without really sensitive data, only public html-files on apache and so on. What do you think about sendmail? Do you know other mail-deamons which are more secure? Thanks for help, Max Lindner

16 18

seccheck package
by Impriser 30 Nov '00

30 Nov '00

I just ran the checkneverlogin command out of the seccheck.rpm. There I realized that the script warns me about users which have the shell set to /bin/false which should be perfectly okay. Or do I have to erase the /bin/false in the /etc/shells file in order for the script to work right? Thanks Raffy

1 0

AW: [suse-security] Scanning encrypted Mails
by Stiefenhofer, Marek ECOFIS 30 Nov '00

30 Nov '00

I don't know about products, but here're some ideas: You need clients that encrypt mails with two public keys: first the usual encryption by the recipients public key. Second encryption by your scanners public key. So your scanner is able to decrypt the Email, scan it and probably drop it if it is infected. But you've still the problem, that the scanners private key must be located in a very safe environment. bye marek

1 0

Scanning encrypted Mails
by Peter Lange 30 Nov '00

30 Nov '00

Hi folk, I look for a solution to encrypt/decrypt mails. But, I have to scan them for malicous code also. All suggestions are welcome. I would prefer a centralized solution (8 Branches 500 Mails per day) I thought about a second DMZ to encrypt/decrypt on something like a keyserver. Then forward to the Contentscanner and then if the mails are clean forward to the internal Mailserver. Anybody out there know about a "keyserver"? thanks Peter

3 2

Re: SuSE Linux 6.x 7.0 Ident buffer overflow (fwd)
by Roman Drahtmueller 30 Nov '00

30 Nov '00

This is my answer to bugtraq. Roman. ---------- Forwarded message ---------- _From: Roman Drahtmueller <draht(a)SUSE.DE> _To: BUGTRAQ(a)SECURITYFOCUS.COM Date: Wed, 29 Nov 2000 05:50:05 +0100 Subject: Re: SuSE Linux 6.x 7.0 Ident buffer overflow > Platforms: SuSE Linux 6.x 7.0 > Risk Level: High > Author: Niels Heinen > Vendor Status: Notified patches will be available today. > *************************************************************************** First off, we thank Niels Heinen for contacting us at our security contact address security(a)suse.de. We have agreed on this date to release the information about the bug. > Impact of the vulnerability: > ==================== > This advisory details a buffer overflow vulnerability under SuSE Linux > that can enable a malicious user to cause Identification Protocol > (Ident) handling to crash. Due to the overflow, the system will no > longer be able to establish certain connections which use Ident, for > example IRC (Internet Relay Chat) connections. If the Ident daemon is > not running, users wishing to connect to IRC will not be allowed to > make a connection. In the this case the vulnerability could be used in > a denial of service attack to keep a person of irc. It's not clear at > this present time whether this vulnerability could be exploited in > such a way that arbitrary code is executed. If so, this will happen > with the privileges of the user "nobody" in a default installation. Thomas Biege, Sebastian Krahmer, Adrian Schröter and myself have been looking at the code, each of us having found a glitch (the multithreaded implementation makes debugging an interesting adventure! :-). It turned out that the daemon dies because of a misinterpretation of the return value of vsnprintf() (which was subject to a change in glibc2.1). Upon detecting that the buffer is too short to keep the data, the daemon decides to "int *p = (int *) NULL; *p = 4711;", or, in other words, segfault and commit suicide. This is bright because a return address on the stack that might have been overwritten is not used (An actual buffer overflow doesn't take place, though.). OTOH, it's not very bright since the auth service is denied as a consequence of the daemon shooting itself in the foot. The risk imposed by the crashed daemon is considerably low. Personally, I find that this behaviour suits the necessity and the usefulness of the protocol itself. > Who's vulnerable ? > ============== > This vulnerability has been tested on SuSE version 6.x and version > 7.0. Previous versions may also be affected. Further testing will > reveal whether other Linux distributions are vulnerable. in.identd in older releases of the SuSE Linux distribution can be crashed, too. Other vendors ship this daemon, too, and will release advisories about the issue soon. With the release of the SuSE-7.0 distribution, the in.identd daemon is contained in a seperate package - before 7.0, it was included in the nkitb package. We will provide updates for the 6.x and 7.0 distributions as usual, but it will take another few days since changes in the nkitb package need thorough testing. In the meanwhile, you may want to disable the service by changing START_IDENTD="yes" # default to START_IDENTD="no" in /etc/rc.config and by killing the daemon (`killall in.identd´. Thanks to Niels for pointing this out, too. If you want to know more about the identd, please install the package "rfc" that can be found in the documentation series of all SuSE distributions and read rfc1413.txt, to be found in /usr/doc/rfc or /usr/share/doc/rfc (SuSE-7.0). Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

SuSE Linux 6.x 7.0 Ident buffer overflow (fwd)
by Roman Drahtmueller 30 Nov '00

30 Nov '00

This mail is from Niels Heinen. He has been in contact with us and reported the problem earlier. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ---------- Forwarded message ---------- _From: Niels Heinen <niels.heinen(a)UBIZEN.COM> _To: BUGTRAQ(a)SECURITYFOCUS.COM Date: Tue, 28 Nov 2000 17:20:11 +0100 Subject: SuSE Linux 6.x 7.0 Ident buffer overflow *************************************************************************** Subject: Ident buffer overflow Platforms: SuSE Linux 6.x 7.0 Risk Level: High Author: Niels Heinen Vendor Status: Notified patches will be available today. *************************************************************************** Impact of the vulnerability: ==================== This advisory details a buffer overflow vulnerability under SuSE Linux that can enable a malicious user to cause Identification Protocol (Ident) handling to crash. Due to the overflow, the system will no longer be able to establish certain connections which use Ident, for example IRC (Internet Relay Chat) connections. If the Ident daemon is not running, users wishing to connect to IRC will not be allowed to make a connection. In the this case the vulnerability could be used in a denial of service attack to keep a person of irc. It's not clear at this present time whether this vulnerability could be exploited in such a way that arbitrary code is executed. If so, this will happen with the privileges of the user "nobody" in a default installation. Who's vulnerable ? ============== This vulnerability has been tested on SuSE version 6.x and version 7.0. Previous versions may also be affected. Further testing will reveal whether other Linux distributions are vulnerable. Technical description: ================ By sending longer than expected strings to the identd port, a remote attacker can crash the daemon. The daemon will also fail to leave any log message given the right length of he string. Seeing the following in the logfile (/var/log/messages) date: suse-machine in.identd[xxx]: s_snprintf(...) = ?: buffer overrun is a clear indication of being attacked by a message length producing log entries. Some other Linux distributions are not vulnerable in the same way, but have to be looked at for suspicious log entries. Another test machine running Red Hat issued here a "Full buffer closing connection" error. Workarounds: =========== If you don't need the Ident, you can keep risk lowest by disabling the ident deamon. This can be done by editing /etc/rc.config. Look for a line like below: START_INDENTD="yes" Change the yes value into no and save the file. After that type as root killall -9 in.identd to stop the ident deamon. More information: ============== Bug finder: Niels Heinen (niels.heinen(a)ubizen.com) Suse web site: http://www.suse.com Suse security email: security(a)suse.com SecurityWatch.com: http://www.securitywatch.com Ident RFC: http://andrew2.andrew.cmu.edu/rfc/rfc1413.html The Disclaimer: ============= *********************************************************************************** All documents and services are provided as is. Ubizen expressly disclaims all warranties, express or implied, including without limitation any implied warranties of merchantability or fitness for a particular purpose, and warranties as to accuracy, completeness or adequacy of information. Ubizen cannot be held accountable for any incorrect or erroneous information. By using the provided documents or services, the user assumes all risks. ***********************************************************************************

1 0

Re: Re: [suse-security] dowloading pictures
by admin＠eregion.de 30 Nov '00

30 Nov '00

> > Hey guys; > > I use to download a lot of pictures of the Net. > > Uhh huh...... look, this is suse-security not using-suse-to-download-porn. Yea.. as if the fact which kind of files he is concerned/worried about matters... > > How can a deleted picture reappear again as thumbnail? > > Is this a bug or do I have a hacker controlling my Trash? > > Yes, a hacker hacked your system and took control of your trash. That's > obviously the explanation. We really need a moderator :P. Yea.. a KDE 'hacker' as in kernel hacker, i.e. programmer... this orginates in the fact that kfm does not update the thumbnails properly... no black hat in that... and I think we really need a moderator, but not to rule out such questions... If someone is concerned that Weird Thnigs(TM) happening on his box might orginate in some intrusive action by someone else, why shouldn't he/she ask here... bye M.H.

1 0

sinusfirewall
by Ralf Palmisano 29 Nov '00

29 Nov '00

Friends, don´t mind please! Can someone tell me what happend to www.sinusfirewall.org? Thanx and stay tuned ... Ralf

2 1

dowloading pictures
by Faessen Jean-Paul 29 Nov '00

29 Nov '00

Hey guys; I use to download a lot of pictures of the Net. As I have yet no CD Rewritable I put some on floppy. Let's say I put picture A on the floppy. After putting it on I delete the picture so it goes to Trash. After the work is done,I empty Trash. I go surfing again,with the necessary downloads. I open my user home directory,I open my floppy and kdf. Then I click "show thumbnails". Weird thing happens as often the old picture A is shown as a thumbnail,but if you open it it's the newly downloaded picture you see. How can a deleted picture reappear again as thumbnail? Is this a bug or do I have a hacker controlling my Trash? Greetings Jean-Paul

2 1

count traffic
by vladimir m. bondarev 29 Nov '00

29 Nov '00

Hello, suse-security. i'm sorry to bother you with this question, but i've spent much time with this problem and haven't solved it yet. so, the situation: eth0 is connected to local network (vlan-29) (10.51.29.x) eth1 is connected to internet eth2 is connected to local network (vlan-30, vlan-31) (10.51.30.x and 10.51.31.x) there is a very big lan and just one server connects it to internet. i need to count traffic for all ips in lan (vlan-29,30,31) that goes from server (10.51.29.50 for vlan-29, 10.51.30.10 for vlans-30,31) to users. i count web traffic with squid, but i also need to count icq (we're using socks for it) and mail (everybody have mailboxes on server) traffic. masq enabled only for chosen users (not so many), so i don't need to count ftp, irc traffic. can anyone help me to solve this problem? thanks in advance. Friday, November 24, 2000 -- vladimir m. bondarev, icq uin: 62393277 paradox team web: http://scene.org.ru

5 11

Is there a software tool to manage safely the bandwidth on Linux 7.0, PPc Edition? Ideally, I'd like to control the transmit/receive (www, ftp, mail) of a given IP address. Thanks for any help
by abarguia＠mail.belgavillage.be 29 Nov '00

29 Nov '00

3 2

Re: [suse-security] How secure is sendmail
by r.maurizzi＠gvs.it 29 Nov '00

29 Nov '00

Stefan Suurmeijer <stefan(a)symbolica.nl> wrote: > I'm getting a little > tired of people who call sendmail insecure without having a valid example > of where postfix or qmail is superior to sendmail IMHO, security-wise the main strength of postfix/exim/qmail is that they are easier to understand and to configure than sendmail: this avoid errors from beginner admins (as I am) that expose their systems to spam or worse. I'd say that if you've been using sendmail for a lot of time and know it well, it is as secure as the others (as in, you know how to secure it if needed). I would not recommend using it before a lot of studying (docs, but also "live" discussion on mailing lists): unless you absolutely need some feature only sm has, go with one of the others, especially if you suspect you won't have the time it takes to know sendmail well. Ciao, Rob!

2 1

Re: [suse-security] suse irc support channel (fwd)
by David Abraham 29 Nov '00

29 Nov '00

There already is a active #SuSE channel on irc.linux.com. There is also a new channel on the same server #susesecurity. See you there. DA On Fri, 24 Nov 2000, vladimir m. bondarev wrote: > Date: Fri, 24 Nov 2000 11:29:37 +0300 > From: vladimir m. bondarev <nrgg(a)aaanet.ru> > To: suse-security(a)suse.com > Subject: [suse-security] suse irc support channel > > Hello. > > some time ago i'd talked with someone about suse irc support and > information channel, but i've lost his email :( so i want to write > here about that. > > i want to make suse irc channel at efnet. i will make all necessary > stuff myself, but i need some help from SuSe. > > <snipped>

3 2

popper
by Rash 29 Nov '00

29 Nov '00

Hello suse-security, I have SuSE 6.1 When somebody trying to get mail from my POP3 server (qpopper v2.53) I see string " Unable to get canninical name of client, err = 0" What is mean? It's working, but i want to make my logs cleaner. POP3 working under Xinetd. --

2 1

Bandwidth control
by abarguia＠mail.belgavillage.be 29 Nov '00

29 Nov '00

Is there a software tool to manage safely the bandwidth on Linux 7.0, PPc Edition? Ideally, I'd like to control the transmit/receive (www, ftp, mail) of a given IP address. Thanks for any help

2 1

Re: [suse-security] Is there a software tool.. oops.
by abarguia＠mail.belgavillage.be 29 Nov '00

29 Nov '00

Sorry, the message was inadvertently put in the title :(

1 0

Re: RE: [suse-security] how to handle attacks by abused systems
by r.maurizzi＠gvs.it 29 Nov '00

29 Nov '00

Not that being ignored in these cases is common, and at least in my (not so big) experience a mail has been more than enough to have the offending computer secured. Anyway, a lot of what you can do in these circumstances depends on the laws of the state(s) where you and your unwillful attacker live: in Italy for example is perfeclty legal/plausible to inform the police authorities of the attack and have them handle the case (and in some universities sysadmins are required to do this). Obviosly doing this isn't very polite ;) , but if an Italian sysadmin continues to ignore my warnings and I continue to get attacked by his computers, then that's another option I have. A question to all listmembers: in your state, are there laws that allow you to sue an attacker, or otherwise allow you to seek police assistance, even when *no damages* have been done to your systems? A cross reference could be useful, since if I know that (for example) in France there are similar laws that disallow the use of computers as intrusion devices, then I could "escalate the problem" to the police even for extranational attacks from there (they should contact their colleagues in the other state, as long as there are collaboration treaties). CIao, Roberto.

5 8

date
by Rash 29 Nov '00

29 Nov '00

Hello suse-security, I have SuSE 6.1 When i'm rebooting my system, the date always changing to GMT-time. I checked my rc.config, there is no "-u" option. What should I touch to change my system time to local time? Tnx. --

2 1

SCSLog
by Olivier Hislaire 29 Nov '00

29 Nov '00

Hi, I have noticed the following data with scslog: # lsmod Module Size Used by nls_iso8859-1 2236 0 (autoclean) rtl8139 12320 2 (autoclean) serial 42932 1 (autoclean) scslog 135613033 # At this stage, kernel logging does not appear anymore - and sometimes one of my eth inerfaces hangs as well. Should I live with that and keep rebooting my (6.3) SuSE box each day or so ? That figure comes from my 'firewall' machine, but the 'proxy' shows the same. Olivier. ------------------------------------------------------------------------------------------------ Olivier Hislaire MSG International Email: O.Hislaire(a)msg-i.com 97 Avenue de Tervuren Phone: +32 (0)2 735.91.59 Ext. 55 1040 Brussels Fax: +32 (0)2 732.12.19 Belgium http://www.msg-i.com ------------------------------------------------------------------------------------------------

2 1

passive mode ftp
by Lars 29 Nov '00

29 Nov '00

hi, since i've installed suse 7.0 my windows ftp-client is transferring datas only in passive mode. with suse 6.3 the same ftp-client was transfering in normal/active mode. why did suse 7.0 always entering the passive mode? where can i activate the active/normal mode? thx lars

2 1

Security books
by RoMaN SoFt / LLFB!! 28 Nov '00

28 Nov '00

Hi. I need to know which is the better choice in buying a book about Cisco-security: * CISCO IOS Network Security https://www.compman.co.uk/cgi-win/browse.exe?ref=317220 (£ Sterling) 42.29 Number of pages: 500 Date Published: Jun 1998 * Cisco IOS 12.0 Network Security: Cisco IOS Reference Library https://www.compman.co.uk/cgi-win/browse.exe?ref=366660 (£ Sterling) 31.49 Number of pages: 988 Date Published: Aug 1999 Apparently the 2nd book is more recent than the 1st. Nevertheless, the 2nd is cheaper.. :-? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Can password security be improved using MDE in suse70
by Bo Jacobsen 28 Nov '00

28 Nov '00

I understand that the password security of linux can be improved in RH70 by selecting MDE, kerberos or something similar. I personally is a little tired of having to restrict passwords to max 8 characters because it reduces the security of the password. If anybody knows how to improve the password security on a SuSE 7.0 system i would appresiate the information. Thanks in advance Bo Jacobsen bjc(a)image.dk

6 8

[Fwd: Re: [suse-security] How secure is sendmail]
by Jochen E. Fuehring 28 Nov '00

28 Nov '00

1 0

capabilities bit 8 (CAP_SETCAP)
by andreas.baetz＠herma.de 28 Nov '00

28 Nov '00

when root is reading the capabilities via capget on a plain suse 6.3 system with kernel 2.2.13 the result is: effective: 0xFFFFFEFF (bit 8 cleared) permitted: 0xFFFFFEFF (bit 8 cleared) inherited: 0xFFFFFEFF (bit 8 cleared) with kernel 2.2.16 the result is: effective: 0xFFFFFEFF (bit 8 cleared) permitted: 0xFFFFFEFF (bit 8 cleared) inherited: 0x0 Every bit can be set via capset, except bit 8. I think the capabilities with bit 8 cleared are set by init, but I wonder what the reason is that even root is not allowed to use or set this capability ? looking in capabilities.h couldn't explain this. Please forgive me if this is the wrong list, but I think it is security-related. Andreas ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

1 0

Re: Re: [suse-security] A simple and secure FTPd
by r.maurizzi＠gvs.it 28 Nov '00

28 Nov '00

> saddly i fear that the solution "out of the box" is the only way to follow > when someone likes to deploy workstations in a small/medium/large > environment `-( This is certainly true if you install the workstations using the provided setup tools: I've had some success in installing and then copying a "secure" workstation on other PCs, as in: install & configure what you can, apply known fixes, create a disk image and "clone" the system to other computers using tools like Ghost, DriveImage or GNU parted (or even dd :-), then add required local customization (hostname, X server or computer name and video driver, depending on the OS). You are obviously limited by the flexibility of your OS' configuration structure and drivers (linux/unix do a very good job in this area compared to Win*.*) and by how many (wildly) different HW configuration you have. For our LAN (around 100 clients) this works rather well, and I'd say on larger LAN the gains are even greater (if you plan carefully your PC purchasing). The BIG problem that remains is updates installation. In Linux something has been done, but the tools are so primitive that for now (IMHO) it's still better to do it yourself (lest someone ends up eating all your file descriptors after 25 days...). On windows you are on your own even with SMS and the likes, since windows "packages" tends to nuke your machines when they find something "strange". Maybe now that Microsoft "innovated" the MSI (Microsoft installer) package idea from the Linux world something will change, but I doubt (since sometime I got nicely "nuked" with RPMs too, and many windows people cannot test their installation on a significant number of different system). I'd say that the problem boils down on the amount of "LAN environment planning" you are able to do before you start building the LAN or when you're about to do a major upgrade. Obviously in the most common situations this thing is very difficult to do because of all the pressures from users and other problems, and in the end this become the main reason for unstable and/or poorly secured LANs. I've had more than an argument with all my "bosses" over the year on these kind of things, and only sometimes I've been able to convince them... (this is a sad job! :) Ciao, Roberto.

1 0

A simple and secure FTPd
by RoMaN SoFt / LLFB!! 28 Nov '00

28 Nov '00

Hi. I'm usign ProFtpd 1.2.0rc2 which is a ftpd with nice features. Nevertheless I only need simple ftp functionality: simple ftp access to some users account (not anonymous ftp). And I'm wondering which ftpd could be the securest one for this task. I suppose the more complex a program, more insecure is. So I guest Proftpd is more susceptible as being found vulnerable to some new (potential) vulns. Is it secure the following ftpd: 220 xxxx FTP server (Version 6.4/OpenBSD/Linux-ftpd-0.16) ready ??? What are your choices, apart from the said daemons? Another problem with Proftpd is some nasty bug related to "No port command" (it's known by proftpd developers).. although this is not security related. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 4

Re: [suse-security] A simple and secure FTPd
by Antonio Cavallo 28 Nov '00

28 Nov '00

this is my 2 cents tip, currently there's a secure ftp wrapper called safetp: http://www.cs.berkeley.edu/~smcpeak/SafeTP/ with that program you can use the ftp server you like more (my choice is ncftpd, free for personal use). from windog workstation the users can use any ftp client they like: acting as proxy this safetp encrypt the ftp password exchange. IMHO definetivly the lack of groupware tools as a simple (and secure) way to share files between users and from users and the rest of the world, the lack of acl, and the lack of really automatic way to install machines make the linux boxes administration a nightmare and normally are menace to the system security (how many sites are using ssh? many? but there're many more with a broken syslogd:-( ). best regards, antonio cavallo

2 2

ssh-update
by Thomas Kronseder 28 Nov '00

28 Nov '00

Hi ! After updating openssh according to the last respective scurity anouncement, I could not use the X11-interface for ssh-add, as it complains ssh_askpass: exec(/usr//lib/ssh-askpass): Datei oder Verzeichnis nicht gefunden obviously the correct path should be /usr/lib/ssh/ssh-askpass (a symlink in /usr/lib to /usr/lib/ssh/ssh-askpass circumvents the problem) There's another point with the ssh-add X11-interface I'm struggling since I've installed openssh: with X11-interface I cannot use special characters on the german keyboard, while it works fine if the passphrase is entered via the console. Does anybody know know a workaround ? With best regards, Thomas Kronseder

2 1

Re: [suse-security] SuSE 7.0 shuts down after three beeps
by Thomas Reitelbach -677 27 Nov '00

27 Nov '00

Sorry for the bad quoting... it's not me making this mistake, it's the bad novell groupwise :-( I think you have enabled Power Management in your Computer BIOS. Check the APM options you compiled into your kernel - may be you did something different since your last installation on 6.2 and now you are confusing your BIOS. The three beeps tell you that your PC is going into "sleep-mode" now and it may be that your PC does not react any more when you have a broken BIOS. That's all i think. Anyone any further ideas? greetings Thomas >>> <thunder7(a)xs4all.nl> Montag, 27. November 2000 07:27:56 >>> I recently upgraded to SuSE 7.0 (the evaluation version), and it has now done an automatich sort of shutdown every day it's been running. There are three short beeps and then the screen gets black and the 'power' light on the computer starts blinking. For all I can see the computer is dead - it doesn't react to anything short of the reset button. Now I am fairly convinced this isn't some kind of virus on my installation CD, but what else can it be? I've used a kernel (2.2.18pre23) which is a 'known-good' kernel - it didn't crash SuSE 6.2. There are no messages in /var/log/messages. The apmd daemon is not running, in fact, there's almost nothing running: UID PID PPID C STIME TTY TIME CMD root 1 0 0 06:19 ? 00:00:05 init root 2 1 0 06:19 ? 00:00:04 [kflushd] root 3 1 0 06:19 ? 00:00:00 [kupdate] root 4 1 0 06:19 ? 00:00:00 [kpiod] root 5 1 0 06:19 ? 00:00:01 [kswapd] root 151 1 0 06:32 ? 00:00:00 /sbin/kerneld root 239 1 0 06:32 ? 00:00:00 /usr/sbin/ipppd pidfile /var/run root 273 1 0 06:32 ? 00:00:00 /usr/sbin/syslogd root 277 1 0 06:32 ? 00:00:01 /usr/sbin/klogd -c 1 at 360 1 0 06:32 ? 00:00:00 /usr/sbin/atd root 375 1 0 06:32 ? 00:00:00 /usr/sbin/inetd root 384 1 0 06:32 ? 00:00:00 /usr/sbin/lpd root 430 1 0 06:32 ? 00:00:00 /usr/sbin/sshd root 439 1 0 06:32 ? 00:00:00 /usr/sbin/cron qmails 463 1 0 06:32 ? 00:00:00 qmail-send qmaill 465 463 0 06:32 ? 00:00:00 splogger qmail root 466 463 0 06:32 ? 00:00:00 qmail-lspawn ./Mailbox qmailr 467 463 0 06:32 ? 00:00:00 qmail-rspawn qmailq 468 463 0 06:32 ? 00:00:00 qmail-clean root 539 1 0 06:32 tty1 00:00:00 login -- root root 540 1 0 06:32 tty2 00:00:00 login -- root root 541 1 0 06:32 tty3 00:00:00 login -- jurriaan root 542 1 0 06:32 tty4 00:00:00 login -- jurriaan root 543 1 0 06:32 tty5 00:00:00 /sbin/mingetty tty5 root 544 1 0 06:32 tty6 00:00:00 /sbin/mingetty tty6 root 545 1 0 06:32 tty7 00:00:00 /sbin/mingetty tty7 root 546 1 0 06:32 tty8 00:00:00 /sbin/mingetty tty8 root 547 1 0 06:32 tty9 00:00:00 /sbin/mingetty tty9 root 548 1 0 06:32 tty10 00:00:00 /sbin/mingetty tty10 root 593 539 0 07:06 tty1 00:00:00 -bash root 774 540 0 07:07 tty2 00:00:00 -bash jurriaan 1653 541 0 07:08 tty3 00:00:00 -bash jurriaan 2321 542 0 07:09 tty4 00:00:00 -bash jurriaan 2766 2321 1 07:11 tty4 00:00:09 slrn --spool jurriaan 5299 1653 0 07:23 tty3 00:00:00 mutt jurriaan 5300 5299 0 07:24 tty3 00:00:00 sh /usr/local/bin/vi72 /tmp/mutt jurriaan 5350 5300 0 07:24 tty3 00:00:00 vi -s /usr/local/etc/vi_textwidt jurriaan 5351 5350 0 07:26 tty3 00:00:00 /bin/bash -c ( ps -ef) >/tmp/voj jurriaan 5352 5351 0 07:26 tty3 00:00:00 ps -ef The computer shuts down even if it is running computations, which makes no sense to me. If there is anybody here who can relate the three beeps to anything, please let me know. Searching the web or SuSE's support database didn't help. Jurriaan -- As of next week, passwords will be entered in Morse code. GNU/Linux 2.2.18pre23 SMP 2x999 bogomips load av: 0.12 0.04 0.05 --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Logs stats
by RoMaN SoFt / LLFB!! 27 Nov '00

27 Nov '00

Hi. I want some advices about *free Unix* programs for making some kind of stats from a syslog file. For example, a program able to get POP3 and SMTP stats, if fed by a /var/log/mail syslog file. Any idea? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Samba problems with large files
by Stefan Suurmeijer 27 Nov '00

27 Nov '00

Hi, I'm experiencing a strange problem. I have installed SuSE 7.0 on an ASUS CuBX MB with a celeron 600, and use samba and ISC dhcpd. Everything works fine, except when I try to copy large (>100MB) files. I copied a ghost image to the SuSE box without problem (almost 500 MB). However, when I try to copy it from the SuSE box to another machine, SuSE totally freezes. Copying smaller (~10MB) files is no problem. I have all but ruled out a hardware conflict, so I'm running out of options. Has anyone on this list experienced a similar problem? TIA Stefan

2 2

FTP data can't go back through
by Olivier Hislaire 27 Nov '00

27 Nov '00

Hi - again :-) I am having trouble while connecting to ftp sites: I can connect and issue some commands, but 'dir' hangs: the firwall stops the result (data). My configuration is the following: public SuSE6.3 SuSE6.3 ftp client (192.168.32.7) ftp <---> ftp-proxy <---> firewall <---> (private server (192.168.32.193) LAN) As far as I can see, the firewall's log shows the following: input DENY eth0 proto=6 192.168.32.193:40000 192.168.32.7 (2042) L=60 S=0x08 I=42279 F=0x4000 T=64 SYN (#57) What firewall configuration directive should do it ? Any help appreciated. Olivier. ------------------------------------------------------------------------------------------------ Olivier Hislaire MSG International Email: O.Hislaire(a)msg-i.com 97 Avenue de Tervuren Phone: +32 (0)2 735.91.59 Ext. 55 1040 Brussels Fax: +32 (0)2 732.12.19 Belgium http://www.msg-i.com ------------------------------------------------------------------------------------------------

2 1

/tmp as homedirectory
by Peter Meijer 27 Nov '00

27 Nov '00

Hello all, I posted the following message on the second of October, but unfortunately got no answer. If I have missed something, I apologize. On the second of May 2000 Marc Heuse from SuSE posted an *updated* security announcement regarding the package "aaa_base": >>[...] 3. Solution 1) Update the package from our FTP server. 2) The root user will receive a email with the accounts listed which have a homedirectory in /tmp. You have to fix this by hand, because some installations might break if they rely on information saved in the (unsafe) /tmp homedirectory. The email will give more information what to do. [...]<< Of course I updated the package immediately. Unfortunately, however, I never got an eMail with information on how to do part 3.2 (I wonder if this happens only to me :-(; I do not find this problem on the list). Currently three users on my *server* system (SuSE 6.2 running httpd, ftpd, samba, and sendmail) have a homedirectory in /tmp: -- games (I haven' t installed any games...) -- wwwrun -- firewall (not installed on _this_ server...) Nobody's homedirectory is in /var/lib/nobody (nobody.nogroup). I changed that some time ago, following the instructions given in another security announcement by SuSE. My questions: What do I have to do in order to secure my system *without* breaking it up?! Should I delete the users 'games' and 'firewall'? Should I move the homedirectory of user 'wwwrun' to /var/lib/wwwrun (wwwrun.nogroup)? Thanks in advance! Kind regards, Peter -- Sent through GMX FreeMail - http://www.gmx.net

1 0

secumod
by mathias rockel 27 Nov '00

27 Nov '00

Hi! I just installed a SuSE 7.0 web server, following some of the securtiy guidelines pointed out on the SuSE site. They also recommended installing secumod, but the guide was written for SuSE 6.4 initially and I had MASSIVE probems when secumod was running, so I threw it out again. Has someone any positive experinece or is there a nice alternative to secumod ? mats

1 0

SuSE 7.0 shuts down after three beeps
by thunder7＠xs4all.nl 27 Nov '00

27 Nov '00

I recently upgraded to SuSE 7.0 (the evaluation version), and it has now done an automatich sort of shutdown every day it's been running. There are three short beeps and then the screen gets black and the 'power' light on the computer starts blinking. For all I can see the computer is dead - it doesn't react to anything short of the reset button. Now I am fairly convinced this isn't some kind of virus on my installation CD, but what else can it be? I've used a kernel (2.2.18pre23) which is a 'known-good' kernel - it didn't crash SuSE 6.2. There are no messages in /var/log/messages. The apmd daemon is not running, in fact, there's almost nothing running: UID PID PPID C STIME TTY TIME CMD root 1 0 0 06:19 ? 00:00:05 init root 2 1 0 06:19 ? 00:00:04 [kflushd] root 3 1 0 06:19 ? 00:00:00 [kupdate] root 4 1 0 06:19 ? 00:00:00 [kpiod] root 5 1 0 06:19 ? 00:00:01 [kswapd] root 151 1 0 06:32 ? 00:00:00 /sbin/kerneld root 239 1 0 06:32 ? 00:00:00 /usr/sbin/ipppd pidfile /var/run root 273 1 0 06:32 ? 00:00:00 /usr/sbin/syslogd root 277 1 0 06:32 ? 00:00:01 /usr/sbin/klogd -c 1 at 360 1 0 06:32 ? 00:00:00 /usr/sbin/atd root 375 1 0 06:32 ? 00:00:00 /usr/sbin/inetd root 384 1 0 06:32 ? 00:00:00 /usr/sbin/lpd root 430 1 0 06:32 ? 00:00:00 /usr/sbin/sshd root 439 1 0 06:32 ? 00:00:00 /usr/sbin/cron qmails 463 1 0 06:32 ? 00:00:00 qmail-send qmaill 465 463 0 06:32 ? 00:00:00 splogger qmail root 466 463 0 06:32 ? 00:00:00 qmail-lspawn ./Mailbox qmailr 467 463 0 06:32 ? 00:00:00 qmail-rspawn qmailq 468 463 0 06:32 ? 00:00:00 qmail-clean root 539 1 0 06:32 tty1 00:00:00 login -- root root 540 1 0 06:32 tty2 00:00:00 login -- root root 541 1 0 06:32 tty3 00:00:00 login -- jurriaan root 542 1 0 06:32 tty4 00:00:00 login -- jurriaan root 543 1 0 06:32 tty5 00:00:00 /sbin/mingetty tty5 root 544 1 0 06:32 tty6 00:00:00 /sbin/mingetty tty6 root 545 1 0 06:32 tty7 00:00:00 /sbin/mingetty tty7 root 546 1 0 06:32 tty8 00:00:00 /sbin/mingetty tty8 root 547 1 0 06:32 tty9 00:00:00 /sbin/mingetty tty9 root 548 1 0 06:32 tty10 00:00:00 /sbin/mingetty tty10 root 593 539 0 07:06 tty1 00:00:00 -bash root 774 540 0 07:07 tty2 00:00:00 -bash jurriaan 1653 541 0 07:08 tty3 00:00:00 -bash jurriaan 2321 542 0 07:09 tty4 00:00:00 -bash jurriaan 2766 2321 1 07:11 tty4 00:00:09 slrn --spool jurriaan 5299 1653 0 07:23 tty3 00:00:00 mutt jurriaan 5300 5299 0 07:24 tty3 00:00:00 sh /usr/local/bin/vi72 /tmp/mutt jurriaan 5350 5300 0 07:24 tty3 00:00:00 vi -s /usr/local/etc/vi_textwidt jurriaan 5351 5350 0 07:26 tty3 00:00:00 /bin/bash -c ( ps -ef) >/tmp/voj jurriaan 5352 5351 0 07:26 tty3 00:00:00 ps -ef The computer shuts down even if it is running computations, which makes no sense to me. If there is anybody here who can relate the three beeps to anything, please let me know. Searching the web or SuSE's support database didn't help. Jurriaan -- As of next week, passwords will be entered in Morse code. GNU/Linux 2.2.18pre23 SMP 2x999 bogomips load av: 0.12 0.04 0.05

1 0

harden_suse disables lpd
by Bo Jacobsen 26 Nov '00

26 Nov '00

I have a problem with harden_suse using SuSE70 that also was present in SuSE6.4: After having run harden_suse (only saying yes to question 1, 2, 4 and 7) and editing /etc/rc.config making sure that lpd would run at startup, I was no longer able to print to my remote printserver. Running undo_harden_suse did not help. The following error was found in /var/log/message: lpd: apsfilter: unable to print job .... nothing else. I have tried to invoke lpd -f with the debug option but no aparent error messages apears. !!------------------------------------------------------------- When I edit /etc/lpd.conf and changes user=lp to user=root it starts working again !!!?. !!------------------------------------------------------------- If you know what the problem is please let me know. Thanks in advance Bo Jacobsen bjc(a)image.dk

3 3

RE: [suse-security] Weird X-Authentication-Warning ???
by ralf.vroomen＠itplus.nl 26 Nov '00

26 Nov '00

>define >(`confPRIVACY_FLAGS',`authwarnings,needmailhelo,novrfy,noexpn,noetrn,noverb ')dnl > >in your linux.mc file in /etc/mail and change it to: > >"define (`confPRIVACY_FLAGS',`needmailhelo,novrfy,noexpn,noetrn,noverb')dnl" Doesn't this just disable the warnings? If so... are they safe to ignore? m>m4 linux.mc >sendmail.cf >and copy this new sendmail.cf to /etc. Now... Aaaaah.. and have my sendmail.cf screwed up! >Alternatively, change the appropriate lines in >linux.mc and run /sbin/SuSEconfig (which installs a new sendmail.cf in case >linux.mc has changed). I don't use SuSEconfig to create my sendmail configuration. I have a cf generated not by linux.mc:) Can't I change "O PrivacyOptions=authwarnings" inside sendmail.cf to "O PrivacyOptions="? Ralf.

5 5

Weird X-Authentication-Warning ???
by ralf.vroomen＠itplus.nl 26 Nov '00

26 Nov '00

Hi! A little weird problem here. I have a SuSE 7.0 box (dell.broeders.yi.org) running sendmail set up to receve incoming email for @broeders.yi.org and dump them in the corresponding local users mail boxes. So now users can pop or imap to it to get there mail. All working well, but (there's the but ;) , there is a litte error in each message receved: ## Here it begins ## Return-Path: <owner-roxiowin(a)LISTSERV.ROXIO.COM> Received: from localhost ([127.0.0.1]) by broeders.yi.org (8.10.2/8.10.2) with ESMTP id eANA09r07802 for <ervee@localhost>; Thu, 23 Nov 2000 11:00:09 +0100 ## Here is the error I don't understand ## X-Authentication-Warning: dell.broeders.yi.org: Host [127.0.0.1] claimed to be localhost ## The rest ## Received: from pop.dds.nl by localhost with POP3 (fetchmail-5.4.0) for ervee@localhost (single-drop); Thu, 23 Nov 2000 11:00:09 +0100 (CET) Received: from shaman.dds.nl (shaman.dds.nl [194.109.21.25]) by feline.dds.nl (8.10.1/8.10.1) with ESMTP id eAN98Di13751; Thu, 23 Nov 2000 10:08:13 +0100 (MET) Received: from cherry.ease.lsoft.com (cherry.ease.lsoft.com [209.119.0.109]) by shaman.dds.nl (8.9.1/8.9.1) with ESMTP id KAA27408; Thu, 23 Nov 2000 10:12:46 +0100 (MET) Received: from peach (209.119.0.4) by cherry.ease.lsoft.com (LSMTP for Digital Unix v1.1b) with SMTP id <17.001F0C68(a)cherry.ease.lsoft.com>; Thu, 23 Nov 2000 4:05:49 -0500 Received: from LISTSERV.ROXIO.COM by LISTSERV.ROXIO.COM (LISTSERV-TCP/IP release 1.8d) with spool id 190411 for ROXIOWIN(a)LISTSERV.ROXIO.COM; Thu, 23 Nov 2000 04:04:37 -0500 Approved-By: deirdre_straughan(a)ROXIO.COM Received: from 208.236.45.160 by PEACH.EASE.LSOFT.COM (SMTPL release 1.0d) with TCP; Thu, 23 Nov 2000 04:00:29 -0500 Received: from aimexc02.corp.adaptec.com ([162.62.62.40]) by redfish.adaptec.com (8.8.8+Sun/8.8.8) with ESMTP id AAA19614 for <roxiowin(a)listserv.roxio.com>; Thu, 23 Nov 2000 00:55:28 -0800 (PST) Received: from roxio.com (ws108-66.corp.adaptec.com [162.62.108.66]) by aimexc02.corp.adaptec.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2650.21) id WAY1150C; Thu, 23 Nov 2000 01:00:25 -0800 X-Mailer: Mozilla 4.76 [en]C-CCK-MCD {Sony} (Win98; U) X-Accept-Language: en MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <3A1CDCB7.DEB7DFA1(a)roxio.com> Date: Thu, 23 Nov 2000 01:00:39 -0800 Reply-To: "Deirdre' Straughan" <deirdre_straughan(a)ROXIO.COM> Sender: Roxio for Windows <ROXIOWIN(a)LISTSERV.ROXIO.COM> From: "Deirdre' Straughan" <deirdre_straughan(a)ROXIO.COM> Subject: [ROXIOWIN] The VideoCD Story: Part 1 To: ROXIOWIN(a)LISTSERV.ROXIO.COM X-UIDL: 633a48b5b1c8fc6d834b4e7c7a7038f7 ## End ## So: "X-Authentication-Warning: dell.broeders.yi.org: Host [127.0.0.1] claimed to be localhost" is the. Has this something to do with it: "X-UIDL: 633a48b5b1c8fc6d834b4e7c7a7038f7" ??? Tips are welcome :) ThanX, Ralf Vroomen I.T.Plus bv Holland

4 3

openssh rpm problems
by Norbert Preining 24 Nov '00

24 Nov '00

I just want to inform SuSE that the openssh-2.3.0p1 has some problems because it is compiled with libexecdir=/usr/lib and therefor ssh-add searches for ask-pass in /usr/lib and not in /usr/lib/ssh, where it is installed. You have to fix this with --libexecdir=%{prefix}/lib/ssh instead of --libexecdir=%{prefix}/lib Best wishes Norbert -- ciao norb +-------------------------------------------------------------------+ | Norbert Preining http://www.logic.at/people/preining | | University of Technology Vienna, Austria preining(a)logic.at | | DSA: 0x09C5B094 (RSA: 0xCF1FA165) mail subject: get [DSA|RSA]-key | +-------------------------------------------------------------------+

1 0

suse irc support channel
by vladimir m. bondarev 24 Nov '00

24 Nov '00

Hello. some time ago i'd talked with someone about suse irc support and information channel, but i've lost his email :( so i want to write here about that. i want to make suse irc channel at efnet. i will make all necessary stuff myself, but i need some help from SuSe. first of all i need programmers help to write info bot for channel. and also i need to talk with suse administrators to make some irc bots, that will host this channel, i'll write scripts for them myself and do other things, just need shell accounts to put bots there. if you are insterested, please, contact me. Friday, November 24, 2000 -- vladimir m. bondarev, icq uin: 62393277 paradox team web: http://scene.org.ru

4 6