December 2000 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] FTP security
by Nix 15 Dec '00

15 Dec '00

I suggest you have a look at PuTTY which is also free, and has a command line scp (pscp.exe) which is compatible with SSH1 and SSH2 It also have a 3rd party Windows GUI that looks a little like CuteFTP for those people who are typing impaired :) Take a look at: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Nix At 09:49 AM 14/12/2000 +0100, you wrote: >Hello ! > > > Could anyone suggest me the freeware soft for secure way of using FTP > > server under suse 7.0? Could it be SSH solution? I need to connect from NT > > box (ftp client) to suse (ftp server). > >The best SSH-Client I have seen so far is TeraTerm with >SSH-Extension. You can find it here: >http://www.zip.com.au/~roca/ttssh.html > >An scp-client is available at the website of the University of >Freiburg. Opposed to other clients, it supports SSH 1.0 protocoll. You >find it at: >http://www.uni-freiburg.de/rz/pc/software/scp/ > >Good luck ! > >Armin > > > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com

3 3

Re: [suse-security] SuSEfirewall and "reject"
by Tobias Schulze 15 Dec '00

15 Dec '00

Hello, thanks for all, I solved the problem. Tobias

1 0

Limit traffic per user
by RENE 15 Dec '00

15 Dec '00

Hello there anybody has some idee how to limit the traffic of my subnet ( 100 Maschines) per IP to my internet, i would allow 30K/s per maschine Please help Thx Rene

2 1

Re: [suse-security] FTP security
by AndriusD＠labas.com 15 Dec '00

15 Dec '00

>>It also have a 3rd party Windows GUI ... [skipped] where could that be located? I didn't find any references on PuTTY site. thank you, ------------------ andriusd(a)labas.com Nix <suse(a)nix.his To: suse-security(a)suse.com peed.com> cc: Subject: Re: [suse-security] FTP security 2000.12.15 01:17 I suggest you have a look at PuTTY which is also free, and has a command line scp (pscp.exe) which is compatible with SSH1 and SSH2 It also have a 3rd party Windows GUI that looks a little like CuteFTP for those people who are typing impaired :) Take a look at: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Nix At 09:49 AM 14/12/2000 +0100, you wrote: >Hello ! > > > Could anyone suggest me the freeware soft for secure way of using FTP > > server under suse 7.0? Could it be SSH solution? I need to connect from NT > > box (ftp client) to suse (ftp server). > >The best SSH-Client I have seen so far is TeraTerm with >SSH-Extension. You can find it here: >http://www.zip.com.au/~roca/ttssh.html > >An scp-client is available at the website of the University of >Freiburg. Opposed to other clients, it supports SSH 1.0 protocoll. You >find it at: >http://www.uni-freiburg.de/rz/pc/software/scp/ > >Good luck ! > >Armin > > > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Fwd: Re: [suse-security] FTP security
by jpriddy＠midsouth.rr.com 15 Dec '00

15 Dec '00

Whoops, my apologies Nix, wrong address. Anyway, here was my email that was supposed to go to suse-security (if i wasn't using this stupid email client): John >Date: Thu, 14 Dec 2000 17:35:30 -0600 >To: Nix <suse(a)nix.hispeed.com> >From: "jpriddy(a)midsouth.rr.com" <jpriddy(a)midsouth.rr.com> >Subject: Re: [suse-security] FTP security > >I use the ssh.com client http://ftp.ssh.com/pub/ssh/ from my win2k box at >home. Its free for non-profit/student, but not for commercial >use. http://www.ssh.com/products/ssh/ssh_license_agreement.html > >John >At 10:17 AM 12/15/2000 +1100, you wrote: >>I suggest you have a look at PuTTY which is also free, and has a >>command line scp (pscp.exe) which is compatible with SSH1 and >>SSH2 >> >>It also have a 3rd party Windows GUI that looks a little like CuteFTP >>for those people who are typing impaired :) >> >>Take a look at: >> http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html >> >>Nix >> >> >>At 09:49 AM 14/12/2000 +0100, you wrote: >> >>>Hello ! >>> >>> > Could anyone suggest me the freeware soft for secure way of using FTP >>> > server under suse 7.0? Could it be SSH solution? I need to connect >>> from NT >>> > box (ftp client) to suse (ftp server). >>> >>>The best SSH-Client I have seen so far is TeraTerm with >>>SSH-Extension. You can find it here: >>>http://www.zip.com.au/~roca/ttssh.html >>> >>>An scp-client is available at the website of the University of >>>Freiburg. Opposed to other clients, it supports SSH 1.0 protocoll. You >>>find it at: >>>http://www.uni-freiburg.de/rz/pc/software/scp/ >>> >>>Good luck ! >>> >>>Armin >>> >>> >>> >>>--------------------------------------------------------------------- >>>To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >>>For additional commands, e-mail: suse-security-help(a)suse.com >> >> >>--------------------------------------------------------------------- >>To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >>For additional commands, e-mail: suse-security-help(a)suse.com .

1 0

SMTP AUTH for Sendmail
by Boris Kantwerk 15 Dec '00

15 Dec '00

Hi *, for enabling SMTP AUTH for Sendmail, I have to build cyrus-sasl. While compiling the 1.5.25 version I get following warning: *** Warning: This library needs some functionality provided by -ldes. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** The inter-library dependencies that have been dropped here will be *** automatically added whenever a program is linked with this library *** or is declared to -dlopen it. I ignored it and now get following error-message while 'telnet localhost 25': Dec 13 03:56:49 localserver sendmail[19218]: unable to dlopen /usr/lib/sasl/libdigestmd5.so: /usr/lib/sasl/libdigestmd5.so: undefined symbol: des_key_sched I searched on the internet and don't find a shared version of libdes. Where do I get it or how do I compile the cyrus-sasl without that warning? Thanx, Boris.

1 0

RE: [suse-security] Firewall Loging
by Raffy 15 Dec '00

15 Dec '00

> what would be the best way to centralize the loging of about 15 > firewalls onto one single machine (so... maybe crontab entry moving the > logs to this single machine?) I suggest you use syslog on each machine to forward the messages to a centralized machine. If you wanna do that at all. (be aware that if you ftp them or scp, it means that the logging machine runs those services. I'm not sure if you want that.) > and... which tools could I use on this machine to analyze these log > files automatically? Good question, very good one. And a lot of people already asked about doing that. There are even research projects running for that. Okay, I can give you some ideas: If you send messages from _15_ firewalls to a centralized machine, you will end up with HUGE amounts of data. So I suggest that you install some kind of preadapter on those machines, which is filtering all your messages before they are sent. Now the thing about filter is that you say that the entry is either accepted or not. So you either have the information or loose it. My appraoch on such things is that I keep _some_ information of the logentry and try to correlate them. This is not easily done and involves quite a bit of coding. I once developed a LogAnalyer which did exactly that. You could define rules about what the Analyzer should remember. E.g. a machine's IP, which made a request on some port. If the same source would appear over and over again, I could was able to detect portscans, rangescans and so on. (also if the scan is done over a long period of time). Unfortunately this tool is not available. My former employer (IBM) does not allow me to do anything with the tool... :-( [IT SUCKS; I KNOW!] Depending on the firewall product you use, there may be some tools out there which do quite intelligent filtering and even correlation. I hope this at least gives you some input about how to approach the problem. Feel free to contact me again if _you_ have some ideas or wanna know about the LogAnalzyer... (I guess some things I am allowed to tell you :-) Thanks Raffy

1 0

[OT] Email Clients (was: list moderation, message mangling)
by Nix 14 Dec '00

14 Dec '00

> > If anyone know about an equavelent to Eudora for Linux I would LOVE to > > hear about it. > > > > Kmail and the like just don't cut it... Yet. > > > > -Nix >If you are looking for sheer functionality and don't mind using the >console, then the pine/procmail combo is the best that I have come across. >Granted it is archaic, but it really is pretty powerful once you get past >the lack of GUI. > >If you are looking for GUI, then I would say that Netscape Mail (when it >doesn't catch on fire) or Kmail is about the best there is right now. Yeah, I have tried all those options, and nothing stacks up to Eudora IMHO. the multiple account handling is almost perfect in Eudora... And the filters, while possible not quite as powerful as what you can do with procmail, are more than powerful enough, and damn easy to setup. Cheers Nix

4 4

ip's and dmz question
by tecnicos 14 Dec '00

14 Dec '00

hi all i'm trying to put my web server in the correct place i have a firewall that give access to the (masqued)LAN now i think i should build a DMZ to put the webserver in. that's how i think it should be: INET | | eth1 IP:DHCP --------------- DMZ | | | FIREWALL |eth2 IP: PRIVATE/PUBLIC???? | |------------------ | | | -------------- --------- |eth0 IP:192.168.0.254 | WWW | IP: PUBLIC | --------- GateWay: ISP-Gateway | LAN Gateway: firewall ip(192.168.0.254) + Any Suggenstion? + what ip should eth2 use? Thaks a lot... ...and sorry for my english Karlos

1 0

[Fwd: [suse-security] FTP security]
by Net Man 14 Dec '00

14 Dec '00

Sorry, my netscape messenger messed up -- this was supposed to go to the mail list, not to the original poster -- sorry. --J.K. -- Joey Kelly Network Administrator ActionBusinessSystems.com ////////////////////////////////////// // Gimme this! Gimme that! // // Hurry up or I'll knock you flat! // //////////////////////////////////////

1 0

Re: [suse-security] list moderation, message mangling (was: TIS FWTK)
by Volker Kuhlmann 14 Dec '00

14 Dec '00

Hey guys, stop this silly discussion. :0 fhw * ^From suse-security-return- * ^X-Mailinglist: suse-security$ | sed -e '/^[Ss][Uu][Bb][Jj][Ee][Cc][Tt]:/ !bend' \ -e 's/\[suse-security\]//' \ -e :end Problem fixed. (untested) Volker PS No doubt someone could improve on the sed bit.

10 20

RE: [suse-security] Look Familiar ?
by floyd.williams＠ps.ge.com 14 Dec '00

14 Dec '00

Do you guys know if there are advance networking tools for SuSe?If so , where are they. I normally work with RedHat but I thought I would have SuSe a try. -----Original Message----- From: Richard [mailto:r.ibbotson@zetnet.co.uk] Sent: Thursday, December 14, 2000 9:57 AM To: suse-security(a)suse.de Subject: RE: [suse-security] Look Familiar ? Boris On Thu, 14 Dec 2000, you wrote: > I for myself did not experience any dedicated probes/scans to this particular > port, nor can I imagine any way of exploiting it. > > Anyone with more info, list? Yes, I did have a look in /etc/services to see what was on port 199 before I sent mail to this list. I was surprised that port 199 was recorded in the log. Not quite sure what to make of it. After putting a '#' against the service in /etc/services I find that some web pages are slow to download. But not all. Thank you -- Richard --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

RE: [suse-security] Look Familiar ?
by Raffy 14 Dec '00

14 Dec '00

> I was surprised that port 199 was recorded in the log. Not quite sure > what to make of it. After putting a '#' against the service in > /etc/services I find that some web pages are slow to download. > But not all. Hang on a second. As far as I know (I hope that I am right), the entries of /etc/services don't have anything to do with the system and about accepting connections or anything. It's simply a conversion table from "servicenames" to portnumbers. Nothing else. Is that right? So this should not have had an impact on your system behaviour. Am I wrong? Raffy

2 1

Look Familiar ?
by Richard 14 Dec '00

14 Dec '00

Dear All Anyone seen anything like this before ? 06/27/2000 09:20:20 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked 06/28/2000 10:00:41 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked 06/29/2000 09:55:35 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked 06/29/2000 15:56:57 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked 06/30/2000 09:35:41 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked 06/30/2000 22:39:04 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked 07/01/2000 09:58:55 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked 07/01/2000 22:48:33 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked 07/02/2000 10:05:19 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked 07/03/2000 09:51:02 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked 07/04/2000 09:21:58 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked 07/04/2000 15:17:18 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked 07/05/2000 05:05:06 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked 07/05/2000 10:06:47 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked 07/09/2000 18:02:58 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked 07/09/2000 23:37:55 Host: bolehill.bolehill.co.uk/192.168.0.2 Port: 199 TCP Blocked This is from my own dialup machine at home. The log is from portsentry which is useful if you use the internet in the UK with an ISP. Thanks -- Richard http://www.sheflug.co.uk

2 2

PING when mail arrives
by Raffael Arthur Marty 14 Dec '00

14 Dec '00

I block all pings to my mail/dns-server at the firewall. Now in my fw-logs I found that everytime I get a mail from a certain domain, I have two ping-entries in the logfiles. I found that it is the DNS-Server of the sender which is pinging me. 1. Why does the other DNS-Server ping me? (And send the mail after 2 failed attempts) 2. Should I allow ping to the mail/dns server? What implications would that have? Thanks Raffy

5 6

Re: [suse-security] FTP security
by Armin Schöch 14 Dec '00

14 Dec '00

Hello ! > Could anyone suggest me the freeware soft for secure way of using FTP > server under suse 7.0? Could it be SSH solution? I need to connect from NT > box (ftp client) to suse (ftp server). The best SSH-Client I have seen so far is TeraTerm with SSH-Extension. You can find it here: http://www.zip.com.au/~roca/ttssh.html An scp-client is available at the website of the University of Freiburg. Opposed to other clients, it supports SSH 1.0 protocoll. You find it at: http://www.uni-freiburg.de/rz/pc/software/scp/ Good luck ! Armin

1 0

[suse-security] FTP security
by AndriusD＠labas.com 14 Dec '00

14 Dec '00

Could anyone suggest me the freeware soft for secure way of using FTP server under suse 7.0? Could it be SSH solution? I need to connect from NT box (ftp client) to suse (ftp server). thank you, ------------------ andriusd(a)labas.com

1 0

locking down a SuSE install
by Net Man 13 Dec '00

13 Dec '00

Howdy. I am sure the issue of securing a new installation has been discussed here before. Is there a how-to on this? I am talking about the obvious things like commenting out finger, talk, etc. in /etc/inetd.conf, etc. but also the no-so-obvious things as well, but from a SuSE-specific standpoint. I have seen bits and pieces in the docs about running a secure SuSE sever, but is there a document with all of this information included in it? Thanks :) --Joey Kelly

1 0

Re: [suse-security] PING when mail arrives
by Raffy 13 Dec '00

13 Dec '00

> > Thanks for the help in setting up the firewall rules. I was more concerned > > about _WHY_ those pings came at all. Should I contact the admin of that > > DNS-Server or is that a normal behaviour? Any comments? > It's a normal behaviour. It's part of a process called 'route MTU discovery'. > ICMP is a basic part of the IP protocol suite, and you cannot claim to > be compliant with the IP standards if you do not support ICMP. Hang on. I am talking about PING (ICMP 8) not any other ICMP!!!! And I am sure that it is the DNS server which pings me. It's an AIX box... Raffy

1 0

Unknown Commands. Crackers?
by Rainer.Frohne＠t-online.de 13 Dec '00

13 Dec '00

Hello, I'm using a SuSE-Linux Imap Server 1.1. When I scrolled the last Commands for root at the command promt, I got lots of rows like this PROMPT_COMMAND='pwd>&8;kill -STOP $$' I never used this command and the server ran without an open root shell. Has anyone a hint for me? Thanks a lot! Rainer Frohne

3 2

Re: [suse-security] Permissions of /root
by tschweikle＠FIDUCIA.de 13 Dec '00

13 Dec '00

> In article <3A34FFF6.B2117425(a)gmx.net>, > *Jan Wulfes <info(a)der-blickfang.de> writes: >> >> Perhaps this is for the public_html dir (apache), which needs >> permission 711 in its parent dir. > > I can't really imagine, that anybody might want to have a public_html > dir in /root. I can: imagin a html-page listing your last logins. This can tighten security. -- Thomas

2 1

RE: [suse-security] PING when mail arrives
by Raffy 13 Dec '00

13 Dec '00

Thanks for the help in setting up the firewall rules. I was more concerned about _WHY_ those pings came at all. Should I contact the admin of that DNS-Server or is that a normal behaviour? Any comments? Thanks Raffy My original post: > I block all pings to my mail/dns-server at the firewall. Now in my fw-logs I found that > everytime I get a mail from a certain domain, I have two ping-entries in the logfiles. > I found that it is the DNS-Server of the sender which is pinging me. > > 1. Why does the other DNS-Server ping me? (And send the mail after 2 > failed attempts)

2 1

SSH and RSA SecurID Agent
by kelvin＠dubious.org 13 Dec '00

13 Dec '00

Hi, I have installed ACE Agent for linux on my SuSE 7.0 system. I have console, ftp and telnet access working a treat. When I try and SSH to the machine, SSH prompts me for a user password, even though my SecurID user has no password entry in /etc/shadow. If i simply press enter, I get an authentication failure. If I add a password to the user I can use SSH by entering the password and I am then prompted for the user's passcode. Is there any way that SSH can be configured not to prompt for a password if there is no password in /etc/shadow for that user? Alternatively, is there a SecurID authentication option in the /etc/ssh/sshd_config file ? Naturally I would like to be able to disable telnet and only use SSH for remote access. Regards, Kelvin.

2 1

ftp login tries with private IP
by webmaster 13 Dec '00

13 Dec '00

Dear List, Is it possible to trace back an intruder who tried to compromise as "webmaster" as if coming from an existing private intranet IP? I was working exactly on that intranet machine whose private IP appeared in logs, and I was using Powerpoint and nothing else was running in the time being logged. Attempted failed however since in.ftpd is not running. But his knowing the IP of intranet machine may indicate some sniffing, may it not. /-------------------------/ Antal Leisen webmaster(a)kreorg.hu Kreorg Educational Center Budapest, Hungary

4 3

Pentium4
by Herbert Huber 13 Dec '00

13 Dec '00

It is really not related to security ... sorry. But where can I get the kernel patch to detect the Penium4 in the right way under linux? SuSE has this stuff, but where is it? The only thing I can find is a complete boot disk for SuSE 7.0 on your web pages. That is only half of the story, because IBM's AFS-client cannot be loaded, using the SuSE-2.2.16-kernels. So I do really need this patch!! As compensation I can offer my experience in building AFS-clients for Linux. Regards /Herbert

2 1