November 2000 - openSUSE Security - openSUSE Mailing Lists

SuSE Security Announcement: openssh/ssh (SuSE-SA:2000:47)
by Roman Drahtmueller 24 Nov '00

24 Nov '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: openssh/ssh Announcement-ID: SuSE-SA:2000:47 Date: Friday, November 24th, 2000 16:30 MET Affected SuSE versions: 6.4, 7.0 Vulnerability Type: clientside remote vulnerability Severity (1-10): 6 SuSE default package: yes Other affected systems: systems w/ openssh versions before 2.3.0 Content of this advisory: 1) security vulnerability resolved: openssh problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information openssh is an implementation of the secure shell protocol, available under the BSD license, primarily maintained by the OpenBSD Project. Many vulnerabilities have been found in the openssh package, along with a compilation problem in the openssh and ssh packages in the SuSE-7.0 distribution: An openssh client (the ssh program) can accept X11- or ssh-agent forwarding requests even though these forwarding capabilities have not been requested by the client side after successful authentication. Using these weaknesses, an attacker could gain access to the authentication agent which may hold multiple user-owned authentification identities, or to the X-server on the client side as if requested by the user. These problems have been found/reported by Markus Friedl <markus.friedl(a)informatik.uni-erlangen.de> and Jacob Langseth <jwl(a)pobox.com>. A problem in the configure script in both the openssh and ssh package on the SuSE-7.0 distribution caused the sshd programs to not be linked against the tcp-wrapper library. By consequence, access rules for the sshd server-side service as configured in /etc/hosts.allow and /etc/hosts.deny were ignored. This has been reported to us by Lutz Pressler <lp(a)SerNet.DE>. We thank these individuals for their contribution. Sebastian Krahmer <krahmer(a)suse.de> found a small tmp file handling problem in the perl script `make-ssh-known-hosts´. A (local) attacker could trick the perl program to follow symbolic links and thereby overwriting files with the privileges of the user calling make-ssh-known-hosts. The solution for the first three problems (agent+X11-forwarding, missing libwrap support) is an upgrade to a newer package. The tmp file problem can be easily solved by hand. Please see the special install instructions below. Note: Upon public request, we also provide update packages for the SuSE-6.3 Intel distribution, even though the openssh packages was not included in this distribution. special install instructions: ===================================== To find out which package (ssh or openssh) you use, please use the command `rpm -qf /usr/bin/ssh´. __ case openssh: Please follow the instructions below to download and install the update package. Afterwards, restart the sshd daemon: `rcsshd restart´. __ case ssh: before SuSE-7.0 (excluding 7.0): In the file /usr/bin/make-ssh-known-hosts, please change the line (around line 102) $private_ssh_known_hosts = "/tmp/ssh_known_hosts$$"; to read $private_ssh_known_hosts = "~/ssh_known_hosts$$"; and you are done. SuSE-7.0: Please follow the instructions below to download and install the update package. Afterwards, restart the sshd daemon: `rcsshd restart´ Please choose the update package(s) for your distribution from the URLs listed below and download the necessary rpm files. Then, install the package using the command `rpm -Uhv file.rpm´. rpm packages have an internal md5 checksum that protects against file corruption. You can verify this checksum using the command (independently from the md5 signatures below) `rpm --checksig --nogpg file.rpm', The md5 sums under each package are to prove the package authenticity, independently from the md5 checksums in the rpm package format. i386 Intel Platform: SuSE-7.0 ftp://ftp.suse.de/pub/suse/i386/update/7.0/sec1/openssh-2.3.0p1-0.i386.rpm 3c7b9044ffb64f9f74c904eb2b278eb2 source rpm: ftp://ftp.suse.de/pub/suse/i386/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm aebcda19518208497671e752bbdfaeb8 SuSE-6.4 ftp://ftp.suse.de/pub/suse/i386/update/6.4/sec1/openssh-2.3.0p1-0.i386.rpm 04c17b0eba99c798ae401fb9aafbc7e4 source rpm: ftp://ftp.suse.de/pub/suse/i386/update/6.4/zq1/openssh-2.3.0p1-0.src.rpm 2003ab41cfa32ef39b11b4977ef4cd1f SuSE-6.3 ftp://ftp.suse.de/pub/suse/i386/update/6.3/sec1/openssh-2.3.0p1-0.i386.rpm 04c17b0eba99c798ae401fb9aafbc7e4 source rpm: ftp://ftp.suse.de/pub/suse/i386/update/6.3/zq1/openssh-2.3.0p1-0.src.rpm 2003ab41cfa32ef39b11b4977ef4cd1f Sparc Platform: SuSE-7.0 ftp://ftp.suse.de/pub/suse/sparc/update/7.0/sec1/openssh-2.3.0p1-0.sparc.rpm 898aaaacee88777429496f1a5658076f source rpm: ftp://ftp.suse.de/pub/suse/sparc/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm 97868b04de04a0baafcee69ebbbe6079 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.de/pub/suse/axp/update/7.0/sec1/openssh-2.3.0p1-0.alpha.rpm dd12c60b2744455780c976b115b26f27 source rpm: ftp://ftp.suse.de/pub/suse/axp/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm 6df5af1a88fda4d8fc1a493e4d10bc01 SuSE-6.4 ftp://ftp.suse.de/pub/suse/axp/update/6.4/sec1/openssh-2.3.0p1-0.alpha.rpm 99de4bb6f183be1b69a610744f4566bc source rpm: ftp://ftp.suse.de/pub/suse/axp/update/6.4/zq1/openssh-2.3.0p1-0.src.rpm aa56e311205ba58478c815760452367e PPC Power PC Platform: SuSE-7.0 ftp://ftp.suse.de/pub/suse/ppc/update/7.0/sec1/openssh-2.3.0p1-0.ppc.rpm 72f7c339991e54a476585012423dda62 source rpm: ftp://ftp.suse.de/pub/suse/ppc/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm 749ccc55396944ad43c1977e55903958 SuSE-6.4 ftp://ftp.suse.de/pub/suse/ppc/update/6.4/sec1/openssh-2.3.0p1-0.ppc.rpm 59727fa055e5d835bc4e455302b1ef49 source rpm: ftp://ftp.suse.de/pub/suse/ppc/update/6.4/zq1/openssh-2.3.0p1-0.src.rpm 7e42dbad4e50a2ad9156e94cf2a93955 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: Clarification: In my message (Subject: "SuSE: miscellaneous"), dated Wed, 15 Nov 2000, concerning the paragraph about runtime linking problems in gs (GhostScript) , I have stated that the problem will be fixed in future versions of the SuSE distribution. This does not touch the fact that we will of course provide fixes for the older distributions. - pine The packages (version 4.30) are on our ftp server and can be downloaded. The SuSE security announcement is pending. - netscape Michal Zalewski <lcamtuf(a)DIONE.IDS.PL> has reported a buffer overflow in Netscape's html parser code. A specially crafted html document may cause the browser to execute arbitrary code as the user calling the netscape program. The packages are available for download on ftp.suse.com. A security announcement is on the way to address the issue. - gs (ghostscript) Two vulnerabilities have been found in the ghostscript package as shipped with SuSE distributions: Insecure temporary file handling and a linker problem that could make gs runtime-link against ./libc.so.6. We're currently working on update packages. In the meanwhile, it is advised to not run gs or applications that call gs from within a world- writeable directory. - jed The text editor jed saves files in /tmp upon emergency termination in an insecure way. This problem was fixed with the release of SuSE-6.3 after a SuSE-internal code audit by Thomas Biege <thomas(a)suse.de>. The information about the existence of this bug was not communicated to the public because the editor was not very widely used at that time. We will provide update packages for the SuSE releases 6.0, 6.1 and 6.2 shortly. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOh6OSney5gA9JdPZAQFsKAf/Rn7V0D4N4nRRhWcYvvtNeIYfYsitOByR 7W/Q1Mbh3WIjDehw+3enCZi9PBB5GnoMVyMRthaUH1+1zY5DT8q/bkpgvhW3pD+F pP/ksNRwJte2mZNdd/7UUu/cS8ditCIRO65JGyttqdU6VhoGLFgXiZPE0YWcfyJj VoCRR4Jv6peCodSZdfOe5DVZUTfZATdp8Fm1A5+0XAVwfgr3n/J/aoJgkRwWJ/Kr szGp7Q9TeIOzKZJOHxwKnQ+c+8ge0F2h02WsI8cq6B8HMhVwYnV4rXU4E7CmYnzm sn6lKj7qTykqajNi1zqPjGpUDNU7gH1L5zMXiiisgkacT9bavwF7lw== =Uskv -----END PGP SIGNATURE-----

4 4

re putty
by webmaster 24 Nov '00

24 Nov '00

Hi Peter, Thanks for the idea, putty indeed works better - without the nagging ads. What I feel at this moment - just downloded it - that it does not save sessions Bye Antal

2 1

tcp syncookie kernel option
by Philipp Snizek 24 Nov '00

24 Nov '00

Hi all Yesterday there was a discussion about kernel options like tcp_syncookies. Exactly to this matter I hope to get an answer to the following: Taken from http://www2.little-idiot.de/firewall/zusammen-49.html I quote: Syn cookies sollte man ausschalten, zumal diese einen Angriff nur dann verhindern, wenn der Angreifer mit LINUX und aktivierten SYN Cookies arbeitet. Ansonsten sind diese fur DoS anfallig. End of quote. Translation: Syn cookies should be disabled. An attack can only be prevented, if the attacker uses with Linux and SYN cookies activated as well. SYN cookies enabled is susceptible on DoS. Please don't hang me because of translation erros. Does anybody have more information (I do not mean www.bb-zone.com - I didn't find much there) about this? Whether it is true and mainly what DoS attacks it does not defend against? Thank you Philipp

2 1

sshd2 start at boot
by webmaster 24 Nov '00

24 Nov '00

Well, after reboot it logged this Nov 23 11:07:55 mand sshd2[117]: Listener created on port 22. Nov 23 11:07:55 mand sshd2[118]: Daemon is running. Nov 23 11:08:05 mand sendmail[138]: starting daemon (8.9.3): SMTP+queueing@00:30:00 Nov 23 11:08:06 mand sshd[144]: error: bind: Address already in use Nov 23 11:08:06 mand sshd[144]: fatal: Bind to port 22 failed: Transport endpoint is not connected. And when connecting from intranet machine of private IP, it logs this: at the 3rd row it seems to be swithing on to sshd, but I do not know where is sshd in inet.d Nov 23 11:08:35 mand sshd2[118]: connection from "192.168.42.2" Nov 23 11:08:36 mand sshd2[172]: DNS lookup failed for "192.168.42.2". Nov 23 11:08:36 mand sshd[172]: log: Generating 768 bit RSA key. Nov 23 11:08:37 mand sshd[172]: log: RSA key generation complete. Nov 23 11:08:37 mand sshd[172]: log: Connection from 192.168.42.2 port 1224 Nov 23 11:08:37 mand sshd[172]: log: Could not reverse map address 192.168.42.2. Nov 23 11:08:43 mand sshd[172]: log: Password authentication for antal accepted. /-------------------------/ Antal Leisen webmaster(a)kreorg.hu Kreorg Educational Center Budapest, Hungary

2 1

Zip on a fileserver
by gtschakert＠gmx.de 24 Nov '00

24 Nov '00

Hello, I have the following problem. I build a box for fileserving with nfs. No user is allowed to login directly to the computer, but some user wishes to use programs like zip to compress their data. They zip their data on another box which means, the data are transferred to their box which zips the data and then the data are transferred back to the server. This solution is naturally not the optimum, because it cost a lot of time and raises the network traffic. Now my question is: Is it possible to allow the users to zip directly on the server without giving them the possibility to log in. regards Guido

2 1

how to handle attacks by abused systems
by Stiefenhofer, Marek ECOFIS 24 Nov '00

24 Nov '00

Hi security experts, below some Email exchange as reaction to several attacks to our systems. My question: did I go to far? Would you agree In advising vulnarabilities on the attackeres systems. Any further comments? Bye Marek -----Ursprüngliche Nachricht----- Von: Stiefenhofer, Marek ECOFIS Gesendet am: Freitag, 24. November 2000 10:03 An: 'attacker(a)somewhere.com' Betreff: AW: ABUSE: Attacks by one of your hosts Warne, thank you for your kind interest. I am responsible for IT-Security in one of Germanys largest non-public wide area networks. So you received my Email out of standard procedure (we use Intrusion-Detection-Systems and alert most hacking attempts). I'm quite sure that our security is well set up. But you should consider implementing some more security systems and concepts to your site. The biggest problem you have is: your webservers are not protected by any kind of firewall. This offers attackers lots of possibilties. On webservers are usually more services running than just the http-service. As you don't use firewalls, everyone can check for this services and even use it and if someone has access to your server he can install new services such as trojan horses etc. here's an actual check of 123.123.123.123: 21/tcp open ftp -> Microsoft FTP Possibility for Denial-of-Service Attacks 25/tcp open smtp -> Mail, no problem 53/tcp open domain -> DNS, maybe a problem 80/tcp open http -> Your IIS still provides possibilities to remotely write files and execute commands 110/tcp open pop-3 -> POP3, DoS 125/tcp filtered locus-map 134/tcp open ingres-net -> don't know 135/tcp filtered loc-srv 137/tcp filtered netbios-ns 138/tcp filtered netbios-dgm 139/tcp filtered netbios-ssn 157/tcp filtered knet-cmp 443/tcp open https -> secure http, no problem 593/tcp filtered http-rpc-epmap 1030/tcp open iad1 -> don't know 5631/tcp open pcanywheredata -> either you use remote administration, or someone installed PC-Anywhere as trojan horse 8080/tcp open http-proxy -> http-proxy 12345/tcp open NetBus -> !!!!!NETBUS!!!!! This is a well-known trojan horse. Seems that someone has broken into your system 65301/tcp open pcanywhere -> see above As you can see your technical staff has closed all netbios ports. These services are used by Windows-Systems for their specific network communication (called SMB). That's good effort but not enough. As I tried to explain I could still attack all running services on your system and even break into. A Firewall would protect your systems by denying all access from the internet except the needed services (http, https, ftp, smtp). But this is still not secure. Now we come to the requested part "passive server check". As explained the firewall leaves the http service open. An attacker would search for bugs in the http-service. Such bugs are caused by the Operating System, by bad implemantations of the http-service or by customers scripts running on your server. Attackers use those bugs to create files on your webserver or remotely execute code. A passive scan is done by freely available tools (such as twwwscan) which check if certain files (usually scripts) exist on your webserver. An active scan checks how this files react to certain requests. Attackers use the found vulnarabilities to break into your systems. So one of the most important security issues is to learn about all known vulnarabilities and exploits and patch your internet-services. To get it clear: it is still possible to execute code on your server via a vulnarability called "newdsn.exe". People can still break into your systems and can still install trojan horses to attack other parts of your network. It is quite sure that you have been compromised and still are abused (NETBUS). Anyway I hope my answers will help you in securing your services. And don't hesitate to ask your technical staff to contact me. Best regards, Marek Stiefenhofer (IT Security) ECOFIS GmbH Tel.: (02 31) 75 45-1 17 FAX : (02 31) 75 45-2 22 e-mail: m.stiefenhofer(a)ecofis.de Besuchen Sie auch unseren neuen Online-Dienst: http://www.alleco.de -----Ursprüngliche Nachricht----- Von: Warne [mailto:attacker@somewhere.com] Gesendet am: Donnerstag, 23. November 2000 22:28 An: Stiefenhofer, Marek ECOFIS Betreff: RE: ABUSE: Attacks by one of your hosts Marek, I have tried to contact you by telephone, but have been unsuccessful. To introduce myself, my name is Warne Boulton, the General Manager and part owner of appHosting.com I was most concerned to receieve your email re the attack on your system via one of our servers. First, I hope that your security was better than ours and that no damage was done to your server or systems. Our technical people are have worked on the issue and tell me that all is ok. I was interested in the 'passive' test that was instigated. Can you provide me details (in laymans terms as I'm not technical) of how to run this test so that I can arrange for it to be re-run against our servers to ensure this doesn't happen again. Thank you and best regards Warne -----Original Message----- From: Stiefenhofer, Marek ECOFIS [mailto:m.stiefenhofer@ecofis.de] Sent: Wednesday, 22 November 2000 1:05 AM To: 'support(a)somewhere.com'; 'webmaster(a)somewhere.com'; 'abuse(a)somewhere.com'; 'postmaster(a)somewhere.com' Subject: ABUSE: Attacks by one of your hosts *** PGP Signature Status: good *** Signer: Marek Stiefenhofer <m.stiefenhofer(a)ecofis.de> *** Signed: 21.11.00 15:08:38 *** Verified: 24.11.00 08:54:16 *** BEGIN PGP VERIFIED MESSAGE *** Ladies and gentleman, according to our logfiles, one of your hosts (attacker.somewhere.com 123.123.123.123]) is the origin of several common attacks on our webservers. For the exact type of attacks and time (GMT+1) see attached log file. We understand such traffic as unauthorized access to our network and internal data and so far as criminal act. We may enforce you to stop those attempts in the future. A passive check of your webserver shows that there are several well-known possibilities for breaking into your system (see below). You should consider this host already being hacked and abused by third parties. We recommend to shut down the server and check for trojan horses etc. At least you should apply all patches provided by Microsoft to secure the IIS-Webserver. Checking: Remote File create,IIS DoS(newdsn.exe) !!! FOUND !!! Checking: Frontpage98 Hole(_vti_inf.html) !!! FOUND !!! Checking: IIS (showcode.asp) Hole !!! FOUND !!! Checking: RDS Securty Hole(msadcs.dll) !!! FOUND !!! Checking: IIS Path Reveal(anything.idq) !!! FOUND !!! Checking: IIS Path Reveal(anything.ida) !!! FOUND !!! Checking: Malformed Hit-Highlighting Argument !!! FOUND !!! Checking: Index Server Security Hole(null.htw) !!! FOUND !!! Checking: FrontPage 2k <=1.1 Path vul !!! FOUND !!! Checking: FrontPage 2k,IIS Multiple (shtml.dll) !!! FOUND !!! Checking: FrontPage MS-DOS Device DoS(shtml.exe) !!! FOUND !!! You are appreciated for calling or mailing me directly to get further information... Please acknowledge the receipt of this message. Kind Regards, Marek Stiefenhofer (IT Security) ECOFIS GmbH Tel.: +49-2 31 75 45-1 17 FAX : +49-2 31 75 45-2 22 e-mail: m.stiefenhofer(a)ecofis.de Besuchen Sie auch unseren neuen Online-Dienst: http://www.alleco.de *** END PGP VERIFIED MESSAGE *** ÿ

2 1

modutils update
by John 24 Nov '00

24 Nov '00

Hi, I'm a little confused about the modutils / modules security upgrade. The announcement from SuSE stated that 6.4/7.0 are affected, as it's only more recent versions of modutils that are vulnerable. However, the announcement on the kernel mailing list stated that modutils versions > 2.1.121 are vulnerable. Checking on my SuSE 6.1 system with /sbin/modprobe -V shows that it's running version 2.2.2-pre6. So - are versions of SuSE prior to 6.4 vulnerable to this problem as well? If so, will suse be producing an upgrade, or do I need to upgrade modutils from source? Thanks, J. | John Patterson / Jarel on Snowplains (telnet to snowplains.org 3456) | | Email: jarel(a)snowplains.org | Web: http://snowplains.org/~jarel/ |

6 7

AW: [suse-security] how to handle attacks by abused systems
by Stiefenhofer, Marek ECOFIS 24 Nov '00

24 Nov '00

Hi Peter, look at the bottom of my Email to Warne: +49-2 31 75 45-1 17

1 0

Re: [suse-security] count traffic
by Martin Peikert 24 Nov '00

24 Nov '00

Martin Peikert <martin.peikert(a)innominate.com> wrote: > > Hi Vlidimir, Sorry for the typo, Vladimir. Martin -- martin.peikert(a)innominate.com system engineer innominate AG clustering & security the linux architects tel: +49-30-308806-0 fax: -77 http://www.innominate.com

1 0

Re: [suse-security] SuSEfirewall www-server inside the DMZ
by Dpto. Tecnico - EDS Asturias S.L. 24 Nov '00

24 Nov '00

Hi, I have the same problem, but cannot solve it. Neither found any "Thomas Hildmann" post.. Can you describe what and how you did it.. thks all.

1 0