November 2000 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] gs read shared libraries from working directory ??
by dproc＠dol.net 07 Nov '00

07 Nov '00

My SuSE 6.3 (intel) is ok " libc.so.6 => /lib/libc.so.6 (0x401e2000) " The rpm I have installed is gs_both-5.10-69 On Fri, 03 Nov 2000, alex medvedev wrote: > fyi > same on my 6.4 and redhat 6.2 with > /usr/bin/gs > /usr/bin/gs_both > /usr/bin/gs_x11

1 0

dialin-problem
by Daniel Quappe 06 Nov '00

06 Nov '00

hi, in the last days i've got warnings like Nov 2 14:58:15 server ipppd[1682]: demuxprotrej: Unrecognized Protocol-Reject for protocol 0x43 in my dialin-server-warn-log. since i'm reading this list i am a little bit nervous about those topics :-) does anybody know something about the warning and can tranquilize my mind ?! thanks and greets, daniel

1 0

Centralized logs
by RoMaN SoFt / LLFB!! 06 Nov '00

06 Nov '00

Hi susesec! I want to do remote-loggins, I mean, a centralized system which involves a machine getting logs via syslogd using remote funcionality. I've been reading some little info and it seems that this method is very insecure (at least via standard syslogd -the one which comes which current Linux distros, Suse included-). I need to implement it in a secure way. Any ideas? Has somebody tried the SecureSyslog from Core SDI? Any other program?? I'd like to read from all of you :-) =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

quake3 dedicated server + susefirewall (4.0), broadcast
by Wolfram Schlich 05 Nov '00

05 Nov '00

hello list! when I try to get the list of local q3-servers, nothing appears. but when I specify the server, I can connect and play without problems. I inserted port 27960 into the *_SERVICES_* lists. any ideas?! thanks in advance. -- Mit freundlichen Grüssen | Wolfram Schlich ------------------------------------------------------------------ | E-Mail: wolfram(a)schlich.org * ICQ #: 35713642 | Postal: Berghof * 56626 Andernach * Germany | Tel.: +49-(0)2636-941194

3 4

Re: [suse-security] same ip for two interfaces
by Kurt Seifried 05 Nov '00

05 Nov '00

>that would cause more configuration issues on the servers in the dmz, right >??? Nope. Just set the default gateway to 10.0.0.1 and everything would work. My ISP for example uses 192.168.* and 10.* for basically all of it's routers/etc/etc, they all have a "Real" IP on the "external" interface (i.e. connection point), and clients like me have a "real" IP for our machines. Guess what? You're reading email sent from a server in this network =). >i mean default gw and ip-address of the server are supposed to be on the >same net. so i had to add one more route to the default gateway ??? huh? not at all. No reason you can't have server with 1.2.3.4, 1.2.3.5, etc talking to 10.0.0.1 as their default gateway. Just make sure they know where 10.0.0.1 is, i.e.: route add -net 10.0.0.0 netmask 255.255.255.0 eth0 or route add -host 10.0.0.1 eth0 Another note: if your ISP was willing to play ball your firewall could use "non routed internal" IP's on all interfaces, the advantage would be you save a "Real" IP, and no external people can talk directly to the firewall. Prolly another strong reason my ISP does it on all the stuff (hard to attack something you can't route packets directly to). >am i right, not really sure !! On an unrelated note: if I receive an out of office reply or annoying bounce from you (like volvo's full mailbox guy for example, or the broken mail account at a certain company) I will block your domain from my mailserver until a) I flush my rules in a few months or b) you contact me from another host and can show you've fixed it. I'm sick of getting bounces from security mailing lists. -Kurt

9 11

Last sendmail question
by Kai Seefeldt 04 Nov '00

04 Nov '00

Hi, i have an final sendmail question: If I enter "abuse.net 550 We don't accept mail from spammers" in the /etc/mail/acces.db, relaying from abuse.net is rejected, and it works. But how can I reject relaying fom ANY Domain excluded one, something like: "mydomain.com OK" "ALL_OHERS 550 We don't accept mail from spammers" Thanks a lot for your help (I am a bloody beginner) Kai Seefeldt

4 7

Re: [suse-security] mail relaying, SuSE 7.0
by Volker Kuhlmann 04 Nov '00

04 Nov '00

> I don't use SuSE's default configuration, so in part I'm guessing > here. Anyway DM is for masquerading, i.e. every mail (except for exposed > users) to leave your machine is masqued to look like it came from > username(a)elec.canterbury.ac.nz. If this is your machine name, it shouldn't > be neccessary though. > I am guessing that elec.canterbury.ac.nz is your machine? No way! Somehow I think I stuffed it up. When I have the machine at university, its name is xxx.elec.canterbury.ac.nz. I don't need it for email there. When I take it home, I didn't change its name. With xxx.elec.canterbury.ac.nz, a lot of hosts won't accept email from me as the name does not resolve outside uni. This is one reason I set the FROM_HEADER to elec.canterbury.ac.nz - it's incorrect, but it resolves. But then I can't send email to university :-(. Perhaps the better question to ask is: what host name does one set for dial-up networking? Where? Is it ok to change the host name in ip-up.local? Does a masquerading host always relay? Perhaps I'm thick, but SuSE asks the question as "What From header to put into mail and news postings", which is inconspicious enough, but when that leads to open relays I have to ask myself whether that is a bug in SuSE's setup. Volker

2 1

firewall on an old 386-laptop?
by udo.siebigteroth＠de.abb.com 04 Nov '00

04 Nov '00

Hi all, i've got an old 386-laptop with 6MB memory and 60 MB HD. Do i have any chance to use this box as a firewall? How much memory/HD is needed at least for a firewall? Regards, Udo

2 1

Sendmail Hash, all but my domain
by Kai Seefeldt 03 Nov '00

03 Nov '00

Hi, some people still relay by using my server, though it should be forbidden by default in sendmail 8.9.3 Dow I wanted to change the "/etc/mail/access.db" and I edited the "/etc/mail/access" file and made: "makemap -hash /etc/mail/access.db < /etc/mail/access", but makemap did not work in Suse6.4, i think there is another command that does the same job, what is it? How can I definde the all mails are rejected BUT mails that come from mydomain.de. Is this enough? >If anybody knows how to stop relaying in Sendmail 8.9.3 ,PLEACE TELL MY, I also would pay you if you fix this problem.< Thanks for your attention, Kai Seefeldt

5 4

Proxy-Suite
by Ulf Ziemann 03 Nov '00

03 Nov '00

Hello ! I'm using SuSE Linux 6.4 and fwproxy-1.7-38. I have "AllowMagicUser" enabled. If I make an outbound ftp- connection with ein ip-number(dummy(a)123.456.789.1) everything works. But if i use a name (dummy(a)ftp.server.de) I get following error USER-WRN bad 'USER@' dest 'ftp.exemplar.com:(nil)' from 192.168.30.20 The nameserver is working without problems. Any hint ?? Ulf -- Dipl.-Ing. Ulf Ziemann Hochheimer Straße 47 - 99094 Erfurt FON : 0361 / 78930-70 FAX : 0361 / 78930-80 E-MAIL : ulf.ziemann(a)prodesigncad.de

1 0

AW: [suse-security] same ip for two interfaces
by Bauer, Juergen 02 Nov '00

02 Nov '00

>> hi folks, >> >> can somebody see a (security) problem in assigning the external and the dmz >> interface the same IP-Address ? >> all the ipchains rules are using the interface switch (-i). > >Why on earth would you do that? That is so f**ked up. Use an "internal" IP on >the internal interface, like 10.0.0.1, as long as the machines in the dmz/etc >know how to get to it (which they will) everything is fine. the INTERNAL interface has a private ip address (192.168.x.x). i am talking about the EXTERNAL and the DMZ interface !! i want to do that, because they've got only 8 public ip-addresse (so 6 actually) >> thanx, >> >> jb > >-Kurt > jb

3 2

Re: [suse-security] Security Crash course
by Scott_Smith＠mastercard.com 02 Nov '00

02 Nov '00

Hello World, Thanks for all the great input. Here is a compilation of the answers I received. The question was, where to find information in order to come up to speed fast on UNIX/LINUX security issues. It should be noted that no brain cells were injured in making this compilation, all insights and comments belong to other members of this list. I received several recommendations multiple times (prayer seemed to be a popular recommendation?) but obviously only listed them once. I have also cannibalized several of the e-mails to make them fit the format below. Once again, thanks for all the help! Scott ** BOOKS ** "Web Security & Commerce": By Simson Garfinkel with Gene Spafford "Secrets and Lies : Digital Security in a Networked World" by Bruce Schneier "Applied Cryptography" by Bruce Schneier "Computer Security Basics" By Deborah Russell & G.T. Gangemi, Sr. -- snip -- "Computer Security Basics" really covers historical ground so I would not recommend it if you are in a hurry, "Web Security & Commerce" is a little dated but is still relevant, "Applied Cryptography" is a must read if one is going to implement cryptographic protocols such as SSH or SSL and "Secrets and Lies" is a must read. So if you get just one read "Secrets and Lies"". Try "Linux System Security" for in depth coverage of security features & software on Linux. Well written and goes into good detail on algorithms (the SSH chapter is very useful if you're trying to visualize the protocol) and recommendations. http://www.phptr.com/ptrbooks/ptr_0130158070.html Practical UNIX & Internet Security, 2nd Edition Classic O'Reilly guide to security on a UNIX system http://www.oreilly.com/catalog/puis/ ** NET ** http://www.linuxsecurity.com/ is a nice starting point. If you're looking for Documentation, go to http://www.linuxdoc.org/ . http://www.suse.de/~marc/ Of particular interest are the harden_suse and seccheck scripts. Once you understand everything they do and why you'll know more about security than most admins. Linux Administrator's Security Guide (LASG) now Linux Security Knowledge Base (LSKB) (Thanks Kurt!) Read it end to end. http://securityportal.com/lskb/ ** LISTS ** One good place to keep up on current security problems is the bugtraq listserve. ... snip ... Go to http://www.securityfocus.com/ for a link to the Bugtraq archives and FAQs, which include subscription info.

1 0

gss-sample problem
by Michael Kehm 02 Nov '00

02 Nov '00

Hi all, I am trying to do a demo to show the Interoperability between Windows <-> Linux using Kerberos. Has anyone run successfully the gss-server <-> gss-client scenario between these 2 boxes? I successfully ran the scenario: Linux (client) -> Linux (server) using Linux KDC Linux (client) -> Linux (server) using Windows KDC On the following scenarios the client simply hang: Win (client) -> Linux (server) using Linux KDC Win (client) -> Linux (server) using Windows KDC Has anyone an idea or hint what I have done wrong? I am pretty new in the kerberos stuff so any help is welcome!! Thanks Michael

1 0

mail relaying, SuSE 7.0
by Volker Kuhlmann 02 Nov '00

02 Nov '00

Hello all, I have a problem with mail relaying. Testing my machine (at home) with the test at http://www.abuse.net/relay.html, I found that it was indeed relaying. That was a surprise, because I thought I had a default configuration and that the default would not allow relaying. I selected "host with permanent net connection" in yast. In order to get things going, I had to set FROM_HEADER="elec.canterbury.ac.nz" in rc.config, which leads to a DMelec.canterbury.ac.nz line in sendmail.cf. Without this, email to kuhlmav(a)elec.canterbury.ac.nz leaves my host (as /var/log/mail shows), but never arrives - presumably because the university's mail gateway cantva.canterbury.ac.nz trashes it. I remember having had problems before if the sending host's (mine) FQN doesn't resolve (although it seemed I can put anything I want, as long as it resolves). How can I configure things to make email work, but block relaying? Thanks for any help, Volker

10 11

Re: [suse-security] same ip for two interfaces
by Richard Voss 02 Nov '00

02 Nov '00

<delurk> hi all, Minder slecht betekent niet goed, het betekent alleen maar beter. >>> Robert Casties <robert.casties(a)philo.unibe.ch> 11/02/00 01:51PM >Not automatically I think. How would you setup routing for two same IPs >anyway? If I'm not mistaken, this is easily accomplished on Sun Enterprise-class servers. For some reason Sun binds a NIC to a processor, so one processor handles all interrupts for networktraffic. This can cause a situation where (on a multiprocessor machine) one processor shows a load of 100%, while all other processors are idle. This leads to intermittant network hiccups, when this one processor can't handle these interupts fast enough. Adding another network adapter, and assigning this the same ip-adress can solve this problem. I'd have to check how routing etc work but afaik it's a fairly standard solution. richard <lurk>

1 0

login shell
by Peter Hinse 02 Nov '00

02 Nov '00

Hi, I do have the following problem: I want users to have access to their homedir via FTP, but without shell-access (telnet, shh) - however, I (as root) want to be able to su to the useraccount and execute programs. Which login shell do I have to use in /etc/passwd? Best regards, Peter Hinse hinse(a)gmx.de

7 6

AW: [suse-security] same ip for two interfaces
by Bauer, Juergen 02 Nov '00

02 Nov '00

aaahhhh, finally somebody's understanding my question. the reason i am asking this: the watchguard firewall is linux based. they have a configuration which is called "drop-in". all three interfaces get the same ip plus one or more virtuell ips. the ipchains programmer is paid by watchguard (see howto). i dont think that they use ipchains for there rules, but i asked my self if this is possible with ipchains on a standard distro. i dont like these "all-in-one" solutions, they are not very flexible. but i like the idea of saving some ips. by, jb -----Ursprüngliche Nachricht----- Von: Roman Drahtmueller [mailto:draht@suse.de] Gesendet: Donnerstag, 2. November 2000 12:09 An: Kurt Seifried Cc: suse-security(a)suse.com Betreff: Re: [suse-security] same ip for two interfaces The whole thing is interesting from the academic standpoint. What would happen with two interfaces of the same IP? Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

upgrading apache
by Mourik JanC. Heupink 02 Nov '00

02 Nov '00

Hello. I want to upgrade apache to the latest version. I'm running SuSE 6.2. (i know: rather old, but this is what the situation is like) Anyway: how to proceed? Should I download the latest apache from the SuSE 7.0 version, and just install this, or will it break things? (dunno: library versions and stuff?) An alternative could be to download the apache-elf version from www.apache.org, and install that. But will it work? (since it is a generic linux version, not SuSE specific) Don't want to just try out, because we are running a webserver on the machine, and I don't want to mess that up... Thanks very much, Mourik Jan

1 1

Re: Re: [suse-security] same ip for two interfaces
by emm＠eggler.ch 02 Nov '00

02 Nov '00

> > the INTERNAL interface has a private ip address (192.168.x.x). > > i am talking about the EXTERNAL and the DMZ interface !! > > > > i want to do that, because they've got only 8 public ip-addresse (so 6 > > actually) > > So use 10.0.0.1 on the DMZ interface. as long as no-one on the INTERNET needs to > talk directly to that interface it'll work fine. I.e. a traceroute would show > > 1.2.3.4 (your isp's router) > 5.6.7.8 (external ip on your firewall) > * * * (can't talk to him....) > 5.6.7.9 (IP of your server on the DMZ). > > See? > > -Kurt > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com If you do not have enough IP numbers consider port forwarding. E. g., everything that comes in on your firewalls external ip address on port 80 is forwarded to the http-server/proxy in the dmz. In such a setup, the dmz host can have a private address and reside in a private network. With such a setup you can provide a complete internet service (web, email, dns etc.) on just one IP number (if you do not have several hosts for the same service - e. g. http/80 on host1 and host2). --emmerich

1 0

Building a firewall box
by Togan Muftuoglu 02 Nov '00

02 Nov '00

Hi everyone, I feel a little bit confused on which direction I should be going, hence I need some advice, pointers and clarification on establishing a firewall. I am setting up a LAN of 10 PC's. The LAN will have access to the internet via cable modem. This is what I thought of doing. A) Setting up a 486/Pentium MMX as the firewall / router. B) Use either of the following 1) Phoenix adaptive firewall ( I could only found it for SuSE 6.3 which probably will not work with SuSE 7.0) 2) Sinus firewall 3) T.REx Open Source proxy firewall 1) What could be my concerns regarding security, if I am running a stock SuSE pre compiled Kernel. What specific things I should be looking to enable / disable ? As far as I understand, if using a pre compiled stock SuSE kernel ,my option of using SINUS firewall is out of the choices. Hence I thought of using T.Rex if using stock kernel. 2) I thought of recompiling the kernel with the SuSE default config options, so I can get Sinus back into choices for proxy firewalls ( yet by doing this most probably Suse Installation support will not be very helping since I am not using the SUSE pre compiled kernel. Result questionable SuSE support availability) 3) Recompiling the after patching it with openwall security patch ( The question is SuSE kernel is pre 2.2.17 so which patch I use; 2.2.16 or 2.2.17) and then make the choice for the proxy firewall. Could some one please kindly help me with a road to choose and if possible pros and cons of the my choices and/or proxy firewalls I have found (any other suggestion is more than welcomed) Thanks in advance -- Togan Muftuoglu toganm(a)turk.net 100% MS FREE Absolutely no component of Microsoft was used in the generation or posting of this e-mail. So it is virus free

2 4

same ip for two interfaces
by Bauer, Juergen 02 Nov '00

02 Nov '00

hi folks, can somebody see a (security) problem in assigning the external and the dmz interface the same IP-Address ? all the ipchains rules are using the interface switch (-i). thanx, jb

2 1

setuid query
by Maciej Chodzko-Zajko 02 Nov '00

02 Nov '00

I have a strange problem that occurs only on SuSE, but not on RedHat. We have a java application that runs setuid. In order for this to work, the following scenario is followed : script1 run by user, this then calls the jre and the first part of the java application, which then calls prog1 prog1 has setuid and setgid - this then calls script 2 (usually as the owner of this program) script2 on all other systems, gets executed in setuid mode (ie as owner of prog1) On our SuSE system, script2 is not executed with setuid, we have managed to drop out somehow. Now, the id for the owner of the program is 500, group is 101, so this should be above any "setuid limit". I have exactly the same user/group id definitions on my RedHat box and do NOT get this problem. Any ideas ? Maciej Chodzko-Zajko MERANT Answerline Product Manager Email: Maciej(a)Merant.com <mailto:Maciej@Merant.com> Int.PVCS.Answerline(a)Merant.com <mailto:Int.PVCS.Answerline@Merant.com> WWW: http://www.merant.com <http://www.merant.com/> begin 600 Merant Internal.jpg M_]C_X``02D9)1@`!`0$!+`$L``#_VP!#``,"`@,"`@,#`P,$`P,$!0@%!00$ M!0H'!P8(#`H,#`L*"PL-#A(0#0X1#@L+$!80$1,4%145#`\7&!84&!(4%13_ MVP!#`0,$!`4$!0D%!0D4#0L-%!04%!04%!04%!04%!04%!04%!04%!04%!04 M%!04%!04%!04%!04%!04%!04%!04%!3_P``1"`#Q`E<#`2(``A$!`Q$!_\0` M'P```04!`0$!`0$```````````$"`P0%!@<("0H+_\0`M1```@$#`P($`P4% M!`0```%]`0(#``01!1(A,4$&$U%A!R)Q%#*!D:$((T*QP152T?`D,V)R@@D* M%A<8&1HE)B<H*2HT-38W.#DZ0T1%1D=(24I35%565UA96F-D969G:&EJ<W1U M=G=X>7J#A(6&AXB)BI*3E)66EYB9FJ*CI*6FIZBIJK*SM+6VM[BYNL+#Q,7& MQ\C)RM+3U-76U]C9VN'BX^3EYN?HZ>KQ\O/T]?;W^/GZ_\0`'P$``P$!`0$! M`0$!`0````````$"`P0%!@<("0H+_\0`M1$``@$"!`0#!`<%!`0``0)W``$" M`Q$$!2$Q!A)!40=A<1,B,H$(%$*1H;'!"2,S4O`58G+1"A8D-.$E\1<8&1HF M)R@I*C4V-S@Y.D-$149'2$E*4U155E=865IC9&5F9VAI:G-T=79W>'EZ(a)H.$ MA8:'B(F*DI.4E9:7F)F:HJ.DI::GJ*FJLK.TM;:WN+FZPL/$Q<;'R,G*TM/4 MU=;7V-G:XN/DY>;GZ.GJ\O/T]?;W^/GZ_]H`#`,!``(1`Q$`/P#]4Z***`"B MBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`*** M0G%`"T4W=1NH`=13&DV]:C:Z5:!I-D]%5OMJ4?;4H*Y)=BS14*W*M3P^>E!+ M36X^BF[J-U`AU%-W4;J`'44QI`O6H_M2T#LV3T5!]K6@72FE<?*^Q/13!(&Z M4NZF2.HINZC-`#J***`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHH MH`****`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@ M`HHHH`****`"BBB@`HHHH`****`"DSBD)P::\@4<T#M<?D4PN!U-5WNUZ"J< MD[%N#Q0;1I.6YI-,%[YJK+>E3@54,K'O0J-)S18VC24=R?[<WO2_;7/8TD-H MV<D5;2W4#D4$R<(]"H;EW/0U(D/G#FK:P)Z4[8%'`Q2L9NHOLHI_81[4&Q`] M*MD@=:AEN54$4`ISEL1^4L?0TR2Z,1P*KR3,QX/%1DDGGFFD="IWUD6?MS>] M'VYO>H%B9^E68;4]Q3!J$1/MK^AIZ73MV-6%MU`Y%2+"@'2D8.<.Q$%,B4PV MF?2K)`45&TZJ<4K&:;Z$7V,>HH^R;?2K"L&&13L46#GD4G=H^F:C^V..QK0, M:GJ*C,"9Z4)6+4X]44_MSCL:/MS>]3RVV1P*IM;,M,VCR2+\5SO')J7S!_>K M'W,G&<4OFOZT"=&^QLJP/>ER*SX;H!>35F.X5SQ0<\H-%BBF[LTHY%!F+111 M0`4444`%%%%`!1110`4444`%%%%`!1110`4444`%%%%`!1110`4444`%%%%` M!1110`4444`%%%%`!1110`4444`%%%%`!1110`4444`%%%%`!32>*":AFE"J M0.M`TKB3S>6.M4I+HMD4R64NQ':HJ:1W0II+4***DBC+L/2F;-V'0P>8>:OP MVP04Z*(*H..:F`Q4G#.HV]``P.E&12U&QP,T&`_(II.!4/V@9IDMP"#0:*#N M-N+C`ZU1=RYR:'<L3FFTT=T(**"IX8/,ZTV"/>U:4,03M0V14GRZ(;%;!0*G M`YI0,4M(X6V]Q,4M%%`AK<U0NQM-:!&:J7:B@UINTB&"Z(.VKR.&`YK&/#<5 M9MIRIY-%C>I3OJC3SFC%,1]PR*?0<>P8ICIN!R*DHH#8SY[0#FJ3`J<&MIE! M&#5*[@]*#KIU.C*-/CD,9R*:1@TE5N=35R]#=%B*NJV0.:Q0Q4Y%7+6<DC)J M=CEJ4^J-#.:6F(<\T^@Y`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`** M**`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHH MH`****`&GK6;=288BM%N]95U_K*#HHJ[(:***L[0J_:1Y451')K4M%&RI9C5 M=HEA0,4M)TI:1P!4;K\AJ2D;I0-&5/E"2*A+$]ZN7<6!TJC31Z$&FKA2CDTE M.C&YQ3-"_:Q8P<5<Q44(`05-4GFS=V%%%%!`4444`)G%5+LBK351O7P30:TU M>12;J:`<&DHJCT#0MI\@"KH(XK'@8JXK3B?<!4G%5A9W)J***#G"HI4W5+36 MZT#3L9$Z[7J*K%T/GJO31Z4=(a)I\;[&IE%.Q6YK6[;DJ<=*J6I^6K8Z5)YLU9 MBT444$!1110`4444`%%%%`!1110`4444`%%%%`!1110`4444`%%%%`!1110` M4444`%%%%`!1110`4444`%%%%`!1110`4444`%%%%`!1110`QN]9ETGS9K5( MJM/%N!-!K3ERLRZ*>Z%#S3*H]#<*TK.3Y:S:G@EVD"DS.I'F1K#I2U'')N45 M)2//:L%(1FEHH$03Q[EK,FC\MJV&ZU4N(<YXXI;'12G9V,ZI[=<G-1.I4D5+ M;M@XJF=<MC4C'R"GTR(Y04^D>:PHHHH$%%%-)ZT`-E;"YK-NWW&K5Q,-N*SB MQ8Y-".NE'J)114T$>^J;L=+=E<C7((-:%JQ.*!;#;TYIT$10\U+.:<U)%E:6 MFK3J#D$SBF.P%.8X%4[J;'0TKEQCS,J7#9>HJ5CN.:2K1Z*5E8*55W'%%6;: M$EN:&*3Y5<M6RX6K(Z4R-`HQ3^E2>=)W8M%%%!(4444`%%%%`!1110`4444` M%%%%`!1110`4444`%%%%`!1110`4444`%%%%`!1110`4444`%%%%`!1110`4 M444`%%%%`!1110`4444`%-9<C%.HH`J36N^J$D91L5LD9J&2%6!XYH.B%5K1 MF12@X-6I;4YX%0&%E[55SK4DR>WN2#BKL<H<=:R.0:DCG93R>*1E.ES:HUP> M*=5**Z4#GFK"W"M2.1P:)*:RY4BE#YI3S01L4;BVXS51048<5L%`1@U`]N"> M*1TPJ:68^%LH*FJ"-"O6IMU,PEN+29%-,@'6HGN56@%%LE9@.]5Y[C;D9J": MYR#@U59RW4T+4Z(4NK%DDWFF4H!)P*FCMF8T]CI;44,BC+M[5H06_EXI8H`H MR1S4X&*6YR5*G-H@`I<"DW4UI0*#"UQ^132V.]0/=**JS7&>AH-(TW(L3W.` M>:H22&0TA8MU-"H6Z"FE8[(P4!M+C-2I;,:MPVP[BBX2J*)!!;;B":OQQ;,4 MJ(!TIXXI''.;D%+1109!1110`4444`%%%%`!1110`4444`%%%%`!1110`444 M4`%%%%`!1110`4444`%%%%`!1110`4444`%%%%`!1110`4444`%%%%`!1110 M`4444`%%%%`!28I:*`&D<U&\(:IJ*!IM%)K$$]JA>SVUI$9I"F:#559(R6@( MI5=D[&M,PJ>U(;=#VI%^U3W*"W;+V-2"^;T/Y5:^S)Z4GD)Z4"YX/H0"\8]C M3C='TJ7R%H\A:";P[%<WC#M^E--ZQ['\JMBW0CI2_9D]*!\T.Q1,S,.AJ*1" MYK3$"CM2^2M,I54MD9!C8=J;M/H:V?(7TI/LR>E!7MUV,E"5;.*MI<%>QJT; M=!VI/(6D)U(RW1!]K;T_2D-\P[&I_(6C[.OI1<B\.Q5-ZQ[&F&=F[&KXMT/: ME^S)Z4RN>"V1EE"YS3TML]:TO(6E$0'2EJ#K=BDMCG!J9+3;5C;2CBF9.I)C M53:.!3@.*6B@S$I:**`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHH MH`****`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@ M`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`*3%+10`F*,4M%`!1110`44 M44`%%%%`!28I:*`$Q1BEHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****` M"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`* M***`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HH MHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB M@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****` M"BBB(a)`HHHH`****`(_,YZT]3D5GSR%)./6K<$H*"K<;*Y*=R:DR*#TJ&8D)Q M4%I7)MP]:-P]:S&F9.II%N&8XS2-O9,U,BC.:K6[,>M6`<4S%JSL*2*C\SG& M:1Y`N<U2$I:7&>*N,;D-V-!6S3ZBCY`J6H*"BBB@`I,B@]*BE.U:`)=P]:-P M]:S)+A@>M,^TMZULJ39'.C6W#UHW#UK)^TMZT?:6]:?LF+G1K;AZT;AZUD_: M6]:DBG9B!FDZ;0^=&G134.5%.K$L****`$SBC</6D;K5*YE96X.*J,>9V$W8 MO;AZT;AZUD_:6]:/M+>M:^R9'.C6W#UHW#UK)^TMZTJW)]:7LF'.C5R*6J4= MR#U-6ED#=*S<6BT[CZ*0'-+4C"BBB@`HHHH`*3(H)Q5>>7;FFE=V%L6-P]:- MP]:RFN6SUJ2&X)ZFM73:5R>9&CG-+3(SD4^L2PHHHH`****`"D)`I:JWCE!Q MZ4TKNPF[%G</6C(K)%RV>M6[>?<>35N#1*DF7**0-FEK,L****`$W"C</6JM MPY4\&J9N6SUK6--M7(<DC6W#UHSFJ$$S-U-7D.5J)1Y2D[CJ***D8FX4;AZU M4N9"AX-5/M+#O6L8.1#DD:VX>M&X>M9/VEO6C[2WK5>R8N=&MN'K1N'K63]I M;UH^TMZT>R8<Z-;</6C(K)%RV>M787+#FHE!Q*4KEG(HR*KRL0.*C,K#O4I7 M"Y<R**J1RLQY-%%K#N5KS[WXT6\Q!Q1>?>_&JX.#76E>)@W9FPC[A2LNX8JC M:S]C5]/F7-<LH\K-XLH7,/-1PP_/6BT88\T+&JG(J#I56RL$<>RG2$`4%N*J M7,XVX'6JBKLYF^K(KF;FH8.91498L>:?!_K176E9'/>[-6/H*EJ*/H*EKC9T MA1112`0]*AF^Y4QZ5#-]RFMP,R7[U1U)+]ZFH,L!7<MCE8F*,5HPVZD"IOLR M>E9.HD7R,R,5+;CYQ6E]F3TI1;HIX%2ZB:&H,>GW!3J0#`I:YS8****`&MUK M/O/O5H-UK/O/O5K3^(SGL4Z7%)5RUB#CFNINRN9)7*F#Z4E:IMDQTJK/!C.! M4*HF4X-%4'%6[:;&!53I3HV(854E=$Q=F;*'*]:=4$+905,.E<3T.D6BBBD` M444AXH`1^!6?>/SBKDSX2LR9]S5M36MS.;T(J<APPIM%=1B:T#Y05..E4+:0 M<"KP;I7%)69T)Z#J***@H****`"J=_\`=_"KE4[_`.[^%:0^(F6QFT^*3RVS M3**[#G-2WFW+5D'CK6/#(58#M6E'*"H]:Y)QLS>+N3T4@.:6LBRE<]:SSUK0 MN>M9YZUV4]CGEN6;;M6E']T5FVW:M*/[HK&IN:0V'4445B:%&[ZU0(.>E;31 M!NM,^S)Z5O&:BK&3C<R,4E:4L"@&L]QAB*VC)2,W&PVEQ3HUW-6A%;H4YHE) M1&HW,T`YK2MNE2BV3'2GK&%Z5A.:DK&D8V&.N>U1O%D>E6-M&VLKEV*R1%31 M5G;11<+&9>?>_&JU6;S[WXU6KMCL<\MQ5."#6C;7&5`S6;4D+[&]J4H\R"+L M;(P:1N*A@E#"G32!5S7)9WL=%R.>;8#S6=(VYB:?<2[SQ4-=4(\J,92N%20? MZT5'4D'^M%6]B%N:L?05+44?05+7"SJ"BBBD`AZ5#-]RICTJ&;[E-;@9DOWJ M2/[XI9?O4U#AA7:MCEZFK!T%3U3AN%&*F^U)ZUR-.YT)HFHJ'[4GK3EG5NE3 M9CNB2BD!R*6D,****`&MUK/O/O5H-UK/O/O5K3^(SGL4ZOV?W1]*H5=LVPM; MSV,X;E\=*BFQM-/$(a)`YJM/.IKFC%MFS>A0?[YH3[PI&.6)IT8)85V;(Y^IIP M?<6IQTJ&$805,.E<3W.E"T445(PI#TI:8[8!H`K7+_)BLZI[B3+$57KL@K(P MF[L**G6+*9Q43+M-6G<BP^!L.!6I&<@<UD(<,*T;9\FL*JZFL&6Z*0'-+7.: MA1110`53O_N_A5RJ=_\`=_"M(?$3+8S:**?&NYL5V'.,JQ;S8-0NA4T@.*EI M20T[,V(GW#-2UG6L^!@]:O*^17)*-F;IW*MSUK//6M"YZUGGK733V,9;EFV[ M5I1_=%9MMVK2C^Z*QJ;FD-AU%%%8F@4444`5YONFLN3[YK4F^Z:RY/OFNFD8 MS'1?>K4B^Y67%]ZM2+[E*J.!*.E+2#I2USFH4444`%%%%`&5>?>_&JU6;S[W MXU6KNCL<TMQP0D4VKMK&&3FJ\T15B>U)25[!;2XZ";R^].FN=ZXS5:BGRJ]P MN]@IVPXS3HHR[<5<:("+WI.26@U&YGU)!_K13#U-/@_UHJGL2MS5CZ"I:BCZ M"I:X6=04444@$/2H9ON5,>E0S?<IK<#,E^]4=22_>I@&37<MCE849J>.W+8J M7[*?2DY)%<K*>:LVW44_[*?2I(X2IS42DFAJ+N7%^Z*6D7[HI:Y#<****`&M MUK/O/O5H-UK/O/O5K3^(SGL4ZDCE*#%1TH4D<5UF),UR2*A))-)2CDBE9(+M M@!FK=M!GFGPPJ5!JTD87I6$ZG1&L8]1Z#"]*=2`8I:YS4****`"J\[8!YJ9N M*HWDF*N*NR6[(J2G+FF(a)9-!YI\6,\UV;(Y]V7H5S&.*JW2;35N.50O6JUVX; MI7/&_,:RM8JU;LVYZU4J2%]IK>2NC.+LS83D4ZH8&^2I1S7$]SH%HHHI#"J= M_P#=_"KE4[_[OX5I#XB9;&;5BT'SU7JS9_>_&NJ6Q@MR::#()Q5%AM)%;&W( MJE<0>E8PGT9I*/4J*<$&K]O/NP,U0(P:=&^PUK*/,B(NQ=N#DU0/6K#2@U7H M@K*P2=RS;=JTH_NBLVV[5I1_=%85-S2&PZBBBL30****`*\WW367)]\UJ3?= M-9<GWS732,9CHOO5J1?<K+B^]6I%]RE5'`E'2EI!TI:YS4****`"BBB@#*O/ MO?C5:K-Y][\:K5W1V.:6YHV/W*?<)N'2F6'*599<US2=I&T=C(DC\LTBKN.* MOS0;C38[?:V<5JJBL9\NH^UAV5)<?ZNI0H4<5%<?ZNL+WE<UM9&4>II\'^M% M,/4T^#_6BNQ['.MS5CZ"I:BCZ"I:X6=04444@$/2H9ON5,>E0S?<IK<#,E^] M21_?%++]ZFQ\.*[5L<O4U(`,"I\57(a);IQ4^ZN.6YTH7%&*3=1NJ1CJ*0<TM` M!1110`UNM9]Y]ZM!NM9]Y]ZM:?Q&<]BG5J!<H:JU>M!E?PK>;LC..Y5ECVDF MF5?N(LKQ5!E*G!IQE=":L7+:?/%7AUK&1]C9K1MIMW6L:D>J-(RZ%NBD!R*6 ML#4***0]*`&2G"UF7+[FJ[<OA*S"2QR:Z*2ZF,V)12@%C@4\0.>U=!F-#$=S M2$YI_D/Z4>0_I2N@LR.EI3&R]13:8&E;/\E6QTK*MI"&`K31L@5QS5F=$7=# MZ***S*"J=_\`=_"KE4[_`.[^%:0^(F6QFU9L_O?C5:K-G][\:ZI;&$=S22DD M3=2I3ZXNITF5<P[6S5:M>6,,IK-FB*$FNF$KJQA*-M2*BBBMC,M6W:M*/[HK M-MNU:4?W17+4W-X;#J***Q-`HHHH`KS?=-9<GWS6I-]TUER??-=-(QF.B^]6 MI%]RLN+[U:D7W*54<"4=*6D'2EKG-0HHHH`****`,J\^]^-5JLWGWOQJM7=' M8YI;FEI_W:MU4T_[M7*Y)_$;QV$P/2C`]*6BH'80]*@N/]74YZ5!<?ZNJCN@ M>QE'J:?!_K13#U-/@_UHKM>QS+<U8^@J6HH^@J6N%G4%%%%(!#TJ&;[E3'I4 M,WW*:W`S)?O4P'!S3Y?O5'7<MCE992[V8J3[?5*BIY(CYF7?M]/CO-Y`K/J: MW^^*EPC8:DS63E13J:GW!3JY#H"BBB@!K=:S[S[U:#=:S[S[U:T_B,Y[%.K] MG]T?2J%7[/[H^E;SV,X;EMAD=*SKF/G-:8&:@FC!4USP=F;-71E5+#+L(IL@ MPYIE=>Z.?9FO"^4'-3`UG6KDXYJ^O:N.4>5G2G=#Z:QX-.J*7[IJ!E&YDR2, MU4J2<Y>F5W15D<TG=D]LF7%:(C'''Z57MD&`:N#I7-4E=FT59#=OM2%>.E24 M5D64KB/Y3Q^E9]:\R?)67*N&KJINZ,9H2(X<5IP-D"LH=:O69)HJ*Z%!]"_1 M35IU<IN%4[_[OX5<JG?_`'?PK2'Q$RV,VK-G][\:K59L_O?C75+8PCN:24^F M)3ZXF=(TCCI5>YBWCI^E6J:5S0G9B:N8LB;&Q3:OW,0ZU1(P:[(RYD<\E8LV MW:M*/[HK-MNU:4?W16%3<UAL.HHHK$T"BBB@"O-]TUER??-:DWW367)]\UTT MC&8Z+[U:D7W*RXOO5J1?<I51P)1TI:0=*6N<U"BBB@`HHHH`RKS[WXU6HHKN MCL<TMS2T_P"[5RBBN2?Q&\=@HHHJ"A#TJ"X_U=%%5'=">QE'J:?!_K1117:] MCF6YJQ]!4M%%<+.H****0"'I4,WW***:W`S)?O5'117<MCE84444Q!4UO]\4 M44GL-;FLGW!3J**X#J"BBB@!K=:S[S[U%%:T_B,Y[%.K]G]T?2BBMY[&<-R\ MO2HI?NFBBN6.YT&5+]\TRBBNU;'*]RW:=16@O:BBN6IN;PV'U%+]TT45FMRS M*F^^:8.M%%=RV.5[FE;?=%6ATHHKCGN=$=A:***@HCF^X:RI^M%%=%(RF1CK M5ZRHHK2>Q$=RZM.HHKC.@*IW_P!W\***TA\1,MC-JS9_>_&BBNJ6QA'<TDI] M%%<3.D****0%2YZ5FM]XT45U4]C">Y9MNU:4?W1116=3<N&PZBBBL30****` J*\WW367)]\T45TTC&8Z+[U:D7W***54<"4=*6BBN<U"BBB@`HHHH`__9 ` end

1 0

PINE and holes
by Tobias Burnus 02 Nov '00

02 Nov '00

Hi, the FreeBSD has recently issued two security warnings concerning PINE 4.21 SA-00:47: pine4 port allows denial of service SA-00:59: pine4 port contains remote vulnerability ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:47.pine.asc http://www.securityfocus.com/frames/?content=/templates/archive.pike%3Fthre… and on the pine site they claim that they fixed these security related bugs in 4.30. | Bugs that have been addressed in this release include: | | * Incoming mail with an extremely long From address can cause a | buffer overflow on the stack (security) | * X-Keywords crash for unix formatted mailboxes | * Pine crashes when replying to or forwarding messages with certain | types of attachments Can we expect an update or is SuSE's 4.21-123 not vulnerable to either bugs. Tobias

6 8

Xinetd
by Boris Kantwerk 02 Nov '00

02 Nov '00

Hi *! Security reasons decided me to use xinetd instead of inetd. I installed the xinetd-2.1.8.8p3-40.rpm on my SuSE 6.2 running a 2.1.16 kernel. On starting the daemon I receive following error message: modprobe: Can't locate module net-pf-10 What kernel option or anything else can help to get this module? Thanx, Boris.

2 3

preventing login screen emulation?
by Michael Grundel 02 Nov '00

02 Nov '00

Hi! My problem: Any user can write a simple program that emulates the behavior of the console login. Executed in a console it waits for an unsuspecting user and logs the username/password to a file. It then shows login incorrect and exists (starting the real login-program). Most users will assume they had a typo in the password and will not know that their password was stolen. This is a problem e.g. at university labs with linux-PCs and many "creative" users. Is there a way to prevent a user from "emulating" a login screen (especially for the console)? I think in WinNT this problem is solved by pressing Ctrl-Alt-Del before logging in and it is guarateed that that key-combination will be answered by the OS login screen. Is there anything similar for linux? Michael -- eMail: m1chael(a)gmx.net PGP key available on request

4 6

NOQUEUE: HELO/EHLO attack?
by Volker Tanner 01 Nov '00

01 Nov '00

Dear list members, as we only run a dial up mailserver I'm not very experienced with security issues. So it got me by surprise to find this in my /var/log/mail: Oct 31 17:15:50 kbsvr07x sendmail[26682]: NOQUEUE: h-62.96.138.42.user.addcom.de [62.96.138.42] (may be forged): HELO/EHLO attack? Oct 31 17:15:51 kbsvr07x sendmail[26682]: NOQUEUE: Null connection from h-62.96.138.42.user.addcom.de [62.96.138.42] (may be forged) What does it mean? I run tripwire regularly, it does not show anything unusual, neither do my other logfiles. Normally I have the mailserver connecting our ISP at this time to fetch mail, so the dial-up connection was correctly initiated. Dial in is disabled. I ran nslookup at the given address, the hostname fits it, the information in whois database don't tell me anything I can find useful. Thank you for the answers Greetings VOlker

1 0

Re: [suse-security] preventing login screen emulation?
by Volker Kuhlmann 01 Nov '00

01 Nov '00

> The last that comes into my mind is a small script or program that runs > started by init and that kills all non-root (and possibly others) programs > on the machine. It could be bound to ctrl-alt-del like the following > (/etc/inittab): Hmmmm. There goes multi-user... :-(( (I mean someone could have legitimate processes running wihtout terminal.) > Personally, I dislike the ctrl-alt-del thing. It seems to me that it > should teach people that rebooting just like in old DOS times isn't really > necessary any more and that there has been some progress since color TV > was invented. That's a good one to add to "quotable quotes" :-) Volker

2 1