December 2000 - openSUSE Security - openSUSE Mailing Lists

Restricted IMAPaccess
by Duane Kehoe 22 Dec '00

22 Dec '00

I would suggest looking at SuSE's email server. Version 2.0 will be coming out in the states soon and it uses cyrus, postfix, ldap, and has a really nice html configuration tool for every piece of the the email server. We have been using it at my company as betas and will be going live with the production version as soon as possible. Also it provides a web client interface, pop3 checking, imap checking and all from your favorite mail client including ssl abilities. -- ____________________________________________________________ Long live the Penguin!!! Duane Kehoe Phone # 414.908.1814 Junior Programmer/Analyst Fax # 414.908.1814 Weyco Group, Inc. Email: dkehoe(a)weycogroup.com

3 2

the next study from MS about Windows and Linux ....
by OKDesign oHG Security Webmaster 22 Dec '00

22 Dec '00

Hello, just for your information. Those ppl being more experienced in english as I am may translate it. The most interesting sentence is definitely the last one about who ordered this study ... :-)) ---------------------------------------------------------------------- 2. TUEV IT Studie zeigt: Windows 2000 besser als Linux Die in einem Nutzungskontext von 50 Benutzern in einem Unternehmens- netzwerk durchgefuehrte Untersuchung umfasste folgende Kriterien: Ergonomische Gestaltungsqualitaet, Gesamtkostenrechnung, Stabilitaet, Verfuegbarkeit, Skalierbarkeit und Sicherheit. Verglichen wurden die Produkte Microsoft Windows 2000 Professional und Advanced Server, RedHat Linux 6.2 und Suse Linux 6.4. Die am 24. November 2000 veroeffentlichte Studie der TUEV Informationstechnik GmbH war von der Microsoft GmbH, Unterschleissheim, in Auftrag gegeben worden. Eine Kurzfassung der Studie ist unter folgendem Link verfuegbar: http://www.microsoft.com/germany/directaccess/newsletter/181200/rdr2 ---------------------------------------------------------------------- This is taken from the latest "Direct Access Newsletter" for MS-Dealers. --- -------------------------------------------- Stephan M. Ott // OKDesign oHG Internet-Providing und Netzwerkmanagement smo(a)okdesign.de ..... http://www.okdesign.de fon. +49 961 3814139 .. fax. +49 961 3814140 mobil 0171-8351130 ... oder ... 0171-7858064 --------------------------------------------

5 4

firewall with 2 ports and mask only one of the two, possible ?
by Dipl. Phys. J�rg Schl�ger 22 Dec '00

22 Dec '00

Hi, I can´t find the solution for the following problem: Net 1 (10.1.0.0) | firewall / \ internet <-> ippp0 isdn0 | | internet <-> ippp0 isdn0 \ / firewall | Net 2 (10.2.0.0) I use SuSe 7.0 and the firewall should masquerade on ippp0 (for some systems) but not on isdn0. I need to allow samba on isdn0 with a list of systems between Net1 and Net2. Can this be done with kernel 2.2.16 ? Thanks J. Schläger

4 3

trouble getting sftp to work
by linux＠actionbusinesssystems.com 21 Dec '00

21 Dec '00

Howdy. I have Pro_ftp working fine. I also have the suse firewall working, and ftp works through it (ports 20 and 21 open). I need to close this down and run only sftp. I have ports 155, 989 and 990 open, and /var/log/messages tells me that my password is accepted, but my windows client (cuteftp) never gets more than socket connected (if that). Ok, so I try a different route, opening a tunnel via ssh and pointing cuteftp to localhost on whatever locl port I chose. /var/log/messages tells me "login successful" but cuteftp tells me that I can't log in. Ok, what am I missing here? Thanks for taking the time to help me get this running right. Joey Kelly System & Network Administrator ActionBusinessSystems.com && Gimme this! Gimme that! Hurry up or I'll knock you flat!

1 0

IP Masquerade
by John Trickey 21 Dec '00

21 Dec '00

Hi, I have looked through the archives and found a thread on the problem but no conclusion. Does anybody know if there is an answer to the following. I am running SuSE as a dialup gateway to my ISP using ppp with dynamic IPADDR assignment, ipchains, ipmasq etc. The problem comes when the link is dropped and then almost immediately re-established. ipmasq remembers connections from the old session and tries to continue using them. I would like to be able to flush the masquerade table but have not been able to find out how to do it. I have considered : Unloading the masq modules: This is not an option as the wayward link may not be the only interface relying on them. ICMP unreachable to force new connection: I have anti-spoofing rules which are dynamically configured with the IP address of the ppp link. Outbound these are set as REJECT but this does not work as the ICMP unreachable is sent to the old ppp IP address which also is bounced by the anti spoof rule - Oh mayhem :-) Reducing the masq timeouts: The problem rarely occurred with ipfw as the timeouts were much shorter but there were other problems with slow sites hanging because masq had forgotten about them. I do not really want to go back to there and given that the network drop-out is about 35 secs, the required timeout would be ridiculously short. Looking at it, the major problem is the udp "sessions", particularly dns lookup. The tcp sessions eventually time out when they get no response but the udp "sessions" are refreshed every time there is an outbound packet. Anybody heard anything or got any better ideas? John

2 1

SSLftp???
by linux＠actionbusinesssystems.com 21 Dec '00

21 Dec '00

Howdy. I'm reading the article about secure web servers (http://www.suse.de/en/linux/webserver/seczones.html) and I see something about SSLftp --- yet when I searched SuSE's site, I got not hits about that. I do want to run encrypted ftp if at all possible. How do I do that? Thanks :) Joey Kelly System & Network Administrator ActionBusinessSystems.com && Gimme this! Gimme that! Hurry up or I'll knock you flat!

3 2

SuSE hardening script
by Mueller, Thomas 21 Dec '00

21 Dec '00

Hi, I got a problem here. I runned the SuSE hardening script on Version 7.0 Professional with all options set to "yes". After that I deinstalled it with undo_harden_suse and rebooted the machine. I did that beacuse I found out that I still need telnet and ftp access. Well after all, I re enabeld the Inetd and tried but I the server always denies the acces :-( Can anybody help me out here? Thanks in advance Thomas Mueller P.S: I'm new to this list, so please don't mind if I forgot to describe anything. Corporate Express Deutschland GmbH Bereich IT Thomas Müller Schulze-Delitzsch-Str. 24-26 70565 Stuttgart Tel.: 0711/90676-636 Fax: 0711/90676-313 Thomas.Mueller(a)cexp.de

3 2

Re: [suse-security] the next study from MS about Windows and Linux ....
by Nix 21 Dec '00

21 Dec '00

At 01:42 PM 20/12/2000 +0100, you wrote: >Come on guys, let's give credit where credit's due. First of all, >designing a test at which Winblows would outperform Linux takes a lot of >effort. Then to find some "unpartial", "expert" Microsoft employees to >declare that it does. It should comfort us all to know that an out of the >box installation of Microsoft (no mention of security updates!) is way >more secure than that of a linux installation. And of course it offers a >lot more functionality (??????! Did they even install linux?). > >Sigh, let's not take this seriously, ok ;-) Unfortunately, as I can only understand english, I was not able to read the article under discussion, however I would like to make a few points here. However first, let me say, that as most of you know I am a BIG linux proponent, and use it extensively, however I do try to keep an open mind on things... You said: "First of all, designing a test at which Winblows would outperform Linux takes a lot of effort." This is not the case. There are still quite a few areas where Windows (and other OS's like solaris) far out perform Linux. As the mindcraft tests showed convincingly, Linux 2.2 series kernels SUCK at high throughput TCP due the the single threaded nature of the Kernels tcp stack. In other words, put 2 cpu's with 2 100Mb NIC's in a machine pumping bulk amounts of TCP and NT will run rings around linux. Put 4 cards and 4 cpus and it becomes even more apparent. Now, thanks to the hard work of Dave Miller and Alexi, the 2.4 series is going to KICK BUTT all over NT (and 2000). See http://www.linux.org.au/projects/calu/cdrom/papers/davem/ for the text of a talk I was present at CALU (Conference of Australian Linux Users) in July 99 where he talks about this... I'm sure there is more up-to-date stuff somewhere... (If you want to hear what he's up to these days come and join me in Janurary at the next CALU (http://linux.conf.au) DaveM will be talking on "A Zero-copy and Delayed Fragment Reassembly Framework for Linux" WOO! Anyway... (Got a little sidetracked there) There are still areas (even in 2.4 series kernels) where NT (and other enterprise class OS's) will legitimately outperform Linux. By 2.6 series Linux might be the most scalable OS out there, but don't stick your head in the sand... Linux is good.. great even, but it's not the Ultimate do EVERYTHING os..... yet.... -End morning rant here- -Nix -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking

2 1

Re: [suse-security] the next study from MS about Windows and Linux ....
by christian.burri＠synecta.ch 21 Dec '00

21 Dec '00

Hello World! This surely is OT but I want to contribute with this anyways: Im currently in education, the proper term would be "apprenticeship", I think (Azubi, Lehrling), right now in the field of Networking & System Administration. My Boss went to vacations for this Month (December), so its currently _me_ who gets all the phone calls when things break...hehe :/ My message for you: Use WinBlows XY and you have something to do...at least one thing daily that breaks, that you have to go fix, travel to a customer, look at the situation, solve the Problem etc.. Keeps you quite busy, assuring you wont have much time to do something other then running around and fixing things that suddenly break ("y does my laptop not work today?? it worked fine yesterday...I NEED MY LAPTOP NOW!!") without any reason or explanation. You'll find yourself diggin' through Tech Support Areas on Tech Support Websites and you will find that the Problem you are experiencing does either exist nowhere else in the world or that it should have been fixed in "release 4.6" of the software, while you are running 5.0 etc blah blah. You will find that you aint got time to do any paperwork or read eMail lists or to do something else, wether useful or not, unless you love to work at least 13 hours each day.... We have some Linux systems, too, here, plus also a few at some customer sites, and -what wonder- _not one single little unworthy issue_ with them Linux boxen in all of the whole time. nothing. niente. nada. No phone call, no mail no nothing. They are just like "Install, Configure and Run". Now what I am thinking about this: Thank M$ for all the braindead chiat they release, cause else you (the sysadmin) would get quite bored, all the time sitting in the office and *nothing* happens, noone calls you, no problems... and after like 3 months your boss would prolly tell you that "We dont need you anymore, you can go home, your job here is done..." So, don't worry - be happy ... it's the Micro$oft way of increasing productivity ;-) Hehe Greetz to ya all out there Chris B. Junior System- & Network Engineer Synecta Informatik AG CH-9000 St. Gallen .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^

1 0

Re: [suse-security] AV for SuSE 6.4?
by Nix 21 Dec '00

21 Dec '00

At 10:25 AM 21/12/2000 +0100, you wrote: >Well, I only see to choices here (the third is illegal and won't even mention >it), to pay or not to pay, therefore using a free antivirus software, but >then... is there anything free and good? I once heard of such a project, but >I lost the URL. Do you know something about that? The forth option is to not use Virus prone software :-) -Nix -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking

1 0