November 2000 - openSUSE Security - openSUSE Mailing Lists

Security books
by RoMaN SoFt / LLFB!! 28 Nov '00

28 Nov '00

Hi. I need to know which is the better choice in buying a book about Cisco-security: * CISCO IOS Network Security https://www.compman.co.uk/cgi-win/browse.exe?ref=317220 (£ Sterling) 42.29 Number of pages: 500 Date Published: Jun 1998 * Cisco IOS 12.0 Network Security: Cisco IOS Reference Library https://www.compman.co.uk/cgi-win/browse.exe?ref=366660 (£ Sterling) 31.49 Number of pages: 988 Date Published: Aug 1999 Apparently the 2nd book is more recent than the 1st. Nevertheless, the 2nd is cheaper.. :-? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Can password security be improved using MDE in suse70
by Bo Jacobsen 28 Nov '00

28 Nov '00

I understand that the password security of linux can be improved in RH70 by selecting MDE, kerberos or something similar. I personally is a little tired of having to restrict passwords to max 8 characters because it reduces the security of the password. If anybody knows how to improve the password security on a SuSE 7.0 system i would appresiate the information. Thanks in advance Bo Jacobsen bjc(a)image.dk

6 8

[Fwd: Re: [suse-security] How secure is sendmail]
by Jochen E. Fuehring 28 Nov '00

28 Nov '00

1 0

capabilities bit 8 (CAP_SETCAP)
by andreas.baetz＠herma.de 28 Nov '00

28 Nov '00

when root is reading the capabilities via capget on a plain suse 6.3 system with kernel 2.2.13 the result is: effective: 0xFFFFFEFF (bit 8 cleared) permitted: 0xFFFFFEFF (bit 8 cleared) inherited: 0xFFFFFEFF (bit 8 cleared) with kernel 2.2.16 the result is: effective: 0xFFFFFEFF (bit 8 cleared) permitted: 0xFFFFFEFF (bit 8 cleared) inherited: 0x0 Every bit can be set via capset, except bit 8. I think the capabilities with bit 8 cleared are set by init, but I wonder what the reason is that even root is not allowed to use or set this capability ? looking in capabilities.h couldn't explain this. Please forgive me if this is the wrong list, but I think it is security-related. Andreas ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

1 0

Re: Re: [suse-security] A simple and secure FTPd
by r.maurizzi＠gvs.it 28 Nov '00

28 Nov '00

> saddly i fear that the solution "out of the box" is the only way to follow > when someone likes to deploy workstations in a small/medium/large > environment `-( This is certainly true if you install the workstations using the provided setup tools: I've had some success in installing and then copying a "secure" workstation on other PCs, as in: install & configure what you can, apply known fixes, create a disk image and "clone" the system to other computers using tools like Ghost, DriveImage or GNU parted (or even dd :-), then add required local customization (hostname, X server or computer name and video driver, depending on the OS). You are obviously limited by the flexibility of your OS' configuration structure and drivers (linux/unix do a very good job in this area compared to Win*.*) and by how many (wildly) different HW configuration you have. For our LAN (around 100 clients) this works rather well, and I'd say on larger LAN the gains are even greater (if you plan carefully your PC purchasing). The BIG problem that remains is updates installation. In Linux something has been done, but the tools are so primitive that for now (IMHO) it's still better to do it yourself (lest someone ends up eating all your file descriptors after 25 days...). On windows you are on your own even with SMS and the likes, since windows "packages" tends to nuke your machines when they find something "strange". Maybe now that Microsoft "innovated" the MSI (Microsoft installer) package idea from the Linux world something will change, but I doubt (since sometime I got nicely "nuked" with RPMs too, and many windows people cannot test their installation on a significant number of different system). I'd say that the problem boils down on the amount of "LAN environment planning" you are able to do before you start building the LAN or when you're about to do a major upgrade. Obviously in the most common situations this thing is very difficult to do because of all the pressures from users and other problems, and in the end this become the main reason for unstable and/or poorly secured LANs. I've had more than an argument with all my "bosses" over the year on these kind of things, and only sometimes I've been able to convince them... (this is a sad job! :) Ciao, Roberto.

1 0

A simple and secure FTPd
by RoMaN SoFt / LLFB!! 28 Nov '00

28 Nov '00

Hi. I'm usign ProFtpd 1.2.0rc2 which is a ftpd with nice features. Nevertheless I only need simple ftp functionality: simple ftp access to some users account (not anonymous ftp). And I'm wondering which ftpd could be the securest one for this task. I suppose the more complex a program, more insecure is. So I guest Proftpd is more susceptible as being found vulnerable to some new (potential) vulns. Is it secure the following ftpd: 220 xxxx FTP server (Version 6.4/OpenBSD/Linux-ftpd-0.16) ready ??? What are your choices, apart from the said daemons? Another problem with Proftpd is some nasty bug related to "No port command" (it's known by proftpd developers).. although this is not security related. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 4

Re: [suse-security] A simple and secure FTPd
by Antonio Cavallo 28 Nov '00

28 Nov '00

this is my 2 cents tip, currently there's a secure ftp wrapper called safetp: http://www.cs.berkeley.edu/~smcpeak/SafeTP/ with that program you can use the ftp server you like more (my choice is ncftpd, free for personal use). from windog workstation the users can use any ftp client they like: acting as proxy this safetp encrypt the ftp password exchange. IMHO definetivly the lack of groupware tools as a simple (and secure) way to share files between users and from users and the rest of the world, the lack of acl, and the lack of really automatic way to install machines make the linux boxes administration a nightmare and normally are menace to the system security (how many sites are using ssh? many? but there're many more with a broken syslogd:-( ). best regards, antonio cavallo

2 2

ssh-update
by Thomas Kronseder 28 Nov '00

28 Nov '00

Hi ! After updating openssh according to the last respective scurity anouncement, I could not use the X11-interface for ssh-add, as it complains ssh_askpass: exec(/usr//lib/ssh-askpass): Datei oder Verzeichnis nicht gefunden obviously the correct path should be /usr/lib/ssh/ssh-askpass (a symlink in /usr/lib to /usr/lib/ssh/ssh-askpass circumvents the problem) There's another point with the ssh-add X11-interface I'm struggling since I've installed openssh: with X11-interface I cannot use special characters on the german keyboard, while it works fine if the passphrase is entered via the console. Does anybody know know a workaround ? With best regards, Thomas Kronseder

2 1

Re: [suse-security] SuSE 7.0 shuts down after three beeps
by Thomas Reitelbach -677 27 Nov '00

27 Nov '00

Sorry for the bad quoting... it's not me making this mistake, it's the bad novell groupwise :-( I think you have enabled Power Management in your Computer BIOS. Check the APM options you compiled into your kernel - may be you did something different since your last installation on 6.2 and now you are confusing your BIOS. The three beeps tell you that your PC is going into "sleep-mode" now and it may be that your PC does not react any more when you have a broken BIOS. That's all i think. Anyone any further ideas? greetings Thomas >>> <thunder7(a)xs4all.nl> Montag, 27. November 2000 07:27:56 >>> I recently upgraded to SuSE 7.0 (the evaluation version), and it has now done an automatich sort of shutdown every day it's been running. There are three short beeps and then the screen gets black and the 'power' light on the computer starts blinking. For all I can see the computer is dead - it doesn't react to anything short of the reset button. Now I am fairly convinced this isn't some kind of virus on my installation CD, but what else can it be? I've used a kernel (2.2.18pre23) which is a 'known-good' kernel - it didn't crash SuSE 6.2. There are no messages in /var/log/messages. The apmd daemon is not running, in fact, there's almost nothing running: UID PID PPID C STIME TTY TIME CMD root 1 0 0 06:19 ? 00:00:05 init root 2 1 0 06:19 ? 00:00:04 [kflushd] root 3 1 0 06:19 ? 00:00:00 [kupdate] root 4 1 0 06:19 ? 00:00:00 [kpiod] root 5 1 0 06:19 ? 00:00:01 [kswapd] root 151 1 0 06:32 ? 00:00:00 /sbin/kerneld root 239 1 0 06:32 ? 00:00:00 /usr/sbin/ipppd pidfile /var/run root 273 1 0 06:32 ? 00:00:00 /usr/sbin/syslogd root 277 1 0 06:32 ? 00:00:01 /usr/sbin/klogd -c 1 at 360 1 0 06:32 ? 00:00:00 /usr/sbin/atd root 375 1 0 06:32 ? 00:00:00 /usr/sbin/inetd root 384 1 0 06:32 ? 00:00:00 /usr/sbin/lpd root 430 1 0 06:32 ? 00:00:00 /usr/sbin/sshd root 439 1 0 06:32 ? 00:00:00 /usr/sbin/cron qmails 463 1 0 06:32 ? 00:00:00 qmail-send qmaill 465 463 0 06:32 ? 00:00:00 splogger qmail root 466 463 0 06:32 ? 00:00:00 qmail-lspawn ./Mailbox qmailr 467 463 0 06:32 ? 00:00:00 qmail-rspawn qmailq 468 463 0 06:32 ? 00:00:00 qmail-clean root 539 1 0 06:32 tty1 00:00:00 login -- root root 540 1 0 06:32 tty2 00:00:00 login -- root root 541 1 0 06:32 tty3 00:00:00 login -- jurriaan root 542 1 0 06:32 tty4 00:00:00 login -- jurriaan root 543 1 0 06:32 tty5 00:00:00 /sbin/mingetty tty5 root 544 1 0 06:32 tty6 00:00:00 /sbin/mingetty tty6 root 545 1 0 06:32 tty7 00:00:00 /sbin/mingetty tty7 root 546 1 0 06:32 tty8 00:00:00 /sbin/mingetty tty8 root 547 1 0 06:32 tty9 00:00:00 /sbin/mingetty tty9 root 548 1 0 06:32 tty10 00:00:00 /sbin/mingetty tty10 root 593 539 0 07:06 tty1 00:00:00 -bash root 774 540 0 07:07 tty2 00:00:00 -bash jurriaan 1653 541 0 07:08 tty3 00:00:00 -bash jurriaan 2321 542 0 07:09 tty4 00:00:00 -bash jurriaan 2766 2321 1 07:11 tty4 00:00:09 slrn --spool jurriaan 5299 1653 0 07:23 tty3 00:00:00 mutt jurriaan 5300 5299 0 07:24 tty3 00:00:00 sh /usr/local/bin/vi72 /tmp/mutt jurriaan 5350 5300 0 07:24 tty3 00:00:00 vi -s /usr/local/etc/vi_textwidt jurriaan 5351 5350 0 07:26 tty3 00:00:00 /bin/bash -c ( ps -ef) >/tmp/voj jurriaan 5352 5351 0 07:26 tty3 00:00:00 ps -ef The computer shuts down even if it is running computations, which makes no sense to me. If there is anybody here who can relate the three beeps to anything, please let me know. Searching the web or SuSE's support database didn't help. Jurriaan -- As of next week, passwords will be entered in Morse code. GNU/Linux 2.2.18pre23 SMP 2x999 bogomips load av: 0.12 0.04 0.05 --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Logs stats
by RoMaN SoFt / LLFB!! 27 Nov '00

27 Nov '00

Hi. I want some advices about *free Unix* programs for making some kind of stats from a syslog file. For example, a program able to get POP3 and SMTP stats, if fed by a /var/log/mail syslog file. Any idea? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1