December 2000 - openSUSE Security - openSUSE Mailing Lists

no use of reverse namelookup
by Ruprecht Helms 13 Dec '00

13 Dec '00

Hi, how can I say a host, that it should not try to identify the name of a ipadress using reverse namelookup. The nameserver we use has no in-addr. arpa and isn't working with ptr-records. At the moment the hosts will try to identify the name and after a little time they get a timeout. Thanks for help in advance. Regards, Ruprecht ----------------------------------------------------------- INTERNOLIX Standards for eBusiness ------------------------------------------------------------ INTERNOLIX AG Ruprecht Helms System-Engineer http://www.internolix.com mail:helms@internolix.com Weiherstr. 20 Tel: +49-[0]7533-9945-71 78465 Konstanz Fax: +49-[0]7533-9945-79

1 0

European Council hacking-tools ban - update
by Boris Lorenz 13 Dec '00

13 Dec '00

Hi, recently we discussed the plans of the European Council to ban hacking tools and to introduce an overall tightened surveillance of ISPs and their customers in cooperation with the members of the european union. The EC now has dropped their plans according the ban of these tools after strong objections from the industry and a whole lot of angry sysadmins (including myself). However, there are more doubtful paragraphs in this draft convention which still is more or less inacceptable for most of us. The original draft version of the European Council's cyber crime convention can be found here: conventions.coe.int/treaty/en/projets/cybercrime.htm The EC-draft update can be read here: www.theregister.co.uk/content/1/15206.html Boris <bolo(a)lupa.de> ---

4 7

emailing logs (with encryption)
by Nix 13 Dec '00

13 Dec '00

Does anyone have an easy/quick way to automatically mail the gzipped log files created by /etc/cron.daily/aaa_base_rotate_logs to an external email address? GPG encryption would be an optional added bonus. Sorry for asking such an easy question, but I pretty much suck at shell code... Networks are much more my thing :) TIA -Nix -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking

2 1

Secure file transfers
by Dany Allard 13 Dec '00

13 Dec '00

I am trying to setup an FTP server that will only accept file from one ip per customer. example customer A ftp's into customer's A account on the ftp server from ip xxx.xxx.xxx.12 customer B ftp's into customer's B account on the ftp server from ip xxx.xxx.xxx.10 I want to stop customer A ftp's into customer B's account on the ftp server from ip xxx.xxx.xxx.12 I do not want customer A to be able to get to customer B's account. I can deny access to all machines in the host.deny file and allow only xxx.xxx.xxx.10 and xxx.xxx.xxx.12 but customer A/B can still get to both accounts? It is possible to lock this down more? Thanks in Advance Dany Allard P.S. let me know if you need more info

2 3

Problem with sslwrap
by Gordon F. Cichon 13 Dec '00

13 Dec '00

Hi all, I'd like to set up an encrypted access to imap using ssl. I installed the sslwrap package of suse 7.0, and installed it according to the instructions in /usr/share/doc/packages/sslwrap/README.SuSE. However, if somebody tries to connect, I get an error message in the syslog: Dec 10 16:21:39 mango sslwarp[16004]: error: cannot execute /usr/sbin/sslwarp: I tried to start the program by hand (/usr/sbin/sslwarp -cert /usr/ssl/certs/raspberry_internal.pem -port 143 -accept 993), this time I get a similar error: > bash: /usr/sbin/sslwarp: No such file or directory However, if I start the program from within gdb, everything works fine. (It is an unstripped ELF executable, BTW). What is wrong with it? Is it my fault? Or is there some memory uninitialized in this program? Thanks for your help in advance. :-) Gordon.

3 4

SuSE Security Announcement: netscape (SuSE-SA:2000:48)
by Roman Drahtmueller 13 Dec '00

13 Dec '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: netscape Announcement-ID: SuSE-SA:2000:48 Date: Thursday, November 30th, 2000 19:00 MET Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0 Vulnerability Type: clientside remote vulnerability Severity (1-10): 4 SuSE default package: yes Other affected systems: systems w/ netscape versions before 4.76 Content of this advisory: 1) security vulnerability resolved: netscape problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information Michal Zalewski <lcamtuf(a)DIONE.IDS.PL> has found a buffer overflow in the html parser code of the Netscape Navigator in all versions before and including 4.75. html code of the form <form action=foo method=bar> <input type=password value=long string here> more form tags </form> can crash the browser. It may be possible for an attacker to supply a webpage that executes arbitrary code as the user running netscape. As of today, no exploit code is known to exist in the wild. SuSE provides an update package for the vulnerable software. It is recommended to upgrade to the latest version found on our ftp server as described below. The update package introduces Netscape version 4.76. NOTE: Please note that Netscape-4.76 is not available for the glibc-2.0-based SuSE Distributions SuSE-6.0 and 6.1 because Netscape doesn't provide any binaries for the glibc version in these distributions (glibc-2.0). For SuSE-6.0 and 6.1, we provide a libc5-based version of netscape-4.76 which runs smoothly on all i386-based SuSE distributions 6.x and 7.x, provided the package shlibs5 is installed. The package can be found in the update/5.3 directory on our ftp server (see below). There are no packages available for platforms other than i386. NOTE: The packages on our ftp servers date back to October 31st. Since there is no release notes or README file with equivalent content in the netscape tarball, SuSE security was not aware of the fact that this release of netscape fixes the known problems. This information can be obtained from (along with information about other bugfixes) http://home.netscape.com/eng/mozilla/4.7/relnotes/windows-4.76.html . Please choose the update package(s) for your distribution from the URLs listed below and download the necessary rpm files. Then, install the package using the command `rpm -Uhv file.rpm´. rpm packages have an internal md5 checksum that protects against file corruption. You can verify this checksum using the command (independently from the md5 signatures below) `rpm --checksig --nogpg file.rpm', The md5 sums under each package are to prove the package authenticity, independently from the md5 checksums in the rpm package format. Intel i386 Platform SuSE-7.0 SuSE-6.4 SuSE-6.3 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/7.0/xap1/netscape-4.76.glibc21.i386… 7ccebaca7df0937a3c08fc30a27af858 SuSE-6.1 SuSE-6.0 ftp://ftp.suse.com/pub/suse/i386/update/5.3/xap1/netscape-4.76.libc5.i386.r… 3c4f06c5fea4755083524eb135627380 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - ssh/openssh Several inconsistencies and configuration bugs have been introduced in the SuSE rpm packages for the update of openssh (SuSE-SA:2000:47) that cause the openssh software to not work as reliably as usual. The packages are about to be reworked, the openssh announcement will be reissued. - pidentd The in.identd daemon on SuSE distributions can be crashed remotely. We're working on a fix. - bash1 bash, version 1, handles temporary files in an unsafe manner that allows a local attacker to overwrite arbitrary files as the user running a bash1 with input redirection of the "<< EOF" style. The bash1 package is not used per default in SuSE-distributions. We're working on a fix (update packages). - tcsh The paragraph above about bash version 1 applies to the tcsh as well, in all versions. The tcsh is not used by SuSE scripts. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOiacFHey5gA9JdPZAQEy5Qf+NlySb8Nk3N5KUFHMf4zh/tVQfyCiXEW5 GUJ5M3Y8quHZq2KX/ErCXWws2/RJAIdHnyEAkeXigwZ001l0MqnWM5PqAWUUGXRh X4isNVr2IeV07RnhIyLdYUj4sDBfmDf1Xwyf/cl6SYcHmeo9/dnfz4ImanYuO9iF cd1gjSWQVCGkP6C28p99GaK3IfzUMvfZjiINS1/mURKSeiQMsOTd4ktOtBvKJY4O SVe8d9is1lUqoiRME1q0+ri3iRLYGWQDDrjukg1SUXVO3jgEXi+lBrO0fs3Stb7o OKRaMnWJvsoHmemRWBMHo7mnBtdYkubQqF6iSIVC60NuW/VJmV9YWg== =Nv3j -----END PGP SIGNATURE-----

5 6

Linux 7.0
by C.Richartz＠wzl.rwth-aachen.de 13 Dec '00

13 Dec '00

Hi, my name is Chris and I just started using LINUX. Now my problem I have to install a very save server. The server should work as a file-server which is also WWW-router, firewall and Mailserver for a network of 25 workstations with Windows NT. 5 Days ago I started working in LINUX but my employer wants me to create a server that is saver than a very save NT-system. I'm not able to create such a system by myself!! Please Help me Greetings Chris

7 6

Re: [suse-security] Secure file transfers
by Kurt Seifried 12 Dec '00

12 Dec '00

Yes you can chroot the user to their own directory trivially. www.proftpd.net tells all. -Kurt > Dany wrote: > > I am not too familiar with proftp. Will that restrict access to the > user's home directory. > I only want them to be able to access thier home directory/subdirectories > but nothing else. > > Thanks > > Dany Allard > > Kurt Seifried wrote: > > > Or just use proftpd instead of doing it all ass backwards with wuftpd: > > > > <Directory /home/ftp/foo/customer1> > > <LIMIT WRITE> > > Order Allow,Deny > > Allow from 1.2.3.4 > > Deny from all > > </LIMIT> > > <LIMIT READ> > > Order Allow,Deny > > Allow from 1.2.3.4 > > Deny from all > > </LIMIT> > > </Directory> > > > > And so on. > > > > Kurt >

1 0

Saint scanner
by Steffen Beck 12 Dec '00

12 Dec '00

i'm having trouble running Saint 2.0 BETA1 ... the installation went through perfect but when i try to scan my other comps it keeps on writing 'Broken Pipe' and netscape freezes .. anybody know what's wrong ?? thanks in advance... Systemx Sign up for your "FREE E-MAIL" @ MADMAIL http://www.madmail.com

2 1

Re: [suse-security] /var/log/messages
by Thomas Reitelbach -677 12 Dec '00

12 Dec '00

This usually happens when either if your syslogd is not running or if you created a new /var/log/messages file and forgot to restart your syslogd. >>> "Raffy" <suse(a)raffy.ch> Dienstag, 12. Dezember 2000 08:49:56 >>> > I have just installed SuSE 7 about a month ago and have not had any messages > recorded to /var/log/messages since Nov 21. Is this a sign of a healthy system > or could there be a problem? I don't think your syslogd is running. (ps aux | grep syslogd) Normally syslog is set up in a manner that it will print a "Mark" every now and then in the logfile. So you SHOULD have some entries in there if it is working correctly! Or did you twiddle with your /etc/syslogd.conf? Make sure you have set the correct routing for your messages in there. Raffy --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

RE: [suse-security] /var/log/messages
by Raffy 12 Dec '00

12 Dec '00

> I have just installed SuSE 7 about a month ago and have not had any messages > recorded to /var/log/messages since Nov 21. Is this a sign of a healthy system > or could there be a problem? I don't think your syslogd is running. (ps aux | grep syslogd) Normally syslog is set up in a manner that it will print a "Mark" every now and then in the logfile. So you SHOULD have some entries in there if it is working correctly! Or did you twiddle with your /etc/syslogd.conf? Make sure you have set the correct routing for your messages in there. Raffy

1 0

Re: [suse-security] importing users
by tschweikle＠FIDUCIA.de 11 Dec '00

11 Dec '00

Hi > On Sat, 9 Dec 2000, Robert Casties wrote: > >> On Fri, 8 Dec 2000, Oliver Hensel wrote: >> >> > > Best would be, if the user-data could also be included into samba (samba >> > > should act as an login-server for his domain) >> > >> > This however should be perfectly possible, just export the SAM from NT, >> > and import the hashes into /etc/smbpasswd, which you need anyway. But then >> > there's no login to the Linux machine (POP3, FTP...). >> >> For that you can use PAM-SMB which authenticates unix users against a >> NT-PDC and samba. You will have to twiddle your PAM settings if you have >> mixed userbases I guess. > > But then you have to keep the NT-PDC, which is not what the original user > wanted, if I remember right. No, you don't. Just use one samba server to authenticate against. With 'pam_smb.conf' leave the second server line empty. No space. Just CR. Otherwise sometimes authentication works against some ghost server nowhere configured... I remember there where programmes exporting the whole user and group database of a NT PCD. But don't ask me where to find them. I am not sure, but I think they where included on that technical reference CD. -- Thomas

2 1

Permissions of /root
by "Plüm, Rüdiger, MTC-SWW" 11 Dec '00

11 Dec '00

Hello, does anybody know a good reason why the permission.paranoid sets /root to mode 711? The harden_suse script suggests setting the mode for /root to 700. (This is IMHO the right mode for /root) The Versions 6.3, 6.4 and 7.0 of SUSE Linux seem to be affected from this bug or feature (bug or feature depends on your answers :-)) Regards, Rüdiger Plüm -- Rüdiger Plüm Mannesmann TeleCommerce Department: Web Engineering, MTC-SWW Phone: +49 2102 97 21 58 Fax: +49 2102 97 12 08 Email: ruediger.pluem(a)it-mannesmann.de Address: Rehhecke 50, D-40885 Ratingen

5 4

SuSEfirewall & Samba
by Slava Uvarov 11 Dec '00

11 Dec '00

Hi! I'm not expert in ipchains, but... Isn't it better in SuSEfirewall script to change the line test "$FW_SERVICE_SAMBA" = yes && { # baah, these samba rules look evil! $IPCHAINS -A input -j "$ACCEPT" -p udp -d 0/0 137:138 $LAA } to test "$FW_SERVICE_SAMBA" = yes && { # baah, these samba rules look evil! $IPCHAINS -A input -j "$ACCEPT" -p udp -d 0/0 137:138 -i FW_DEV_INT $LAA } Is any sense to allow Samba not only for Internal network? Am I wrong? Slava Uvarov. mailto:slavau@softcontrol.hu

1 0

Antwort: Re: [suse-security] Permissions of /root
by tschweikle＠FIDUCIA.de 11 Dec '00

11 Dec '00

> The only sense I can make out of the 711 permission is that root wants > to have an executable script in /root/bin, which other users should be > able to execute. Permissions 0711 on a directory don't make files inside it executable. Permissions 0711 on a directory mean group and world are allowed to change into that directory. But while not having the readable flag set, these are not allowed to look at directory content. Thus Permissions set: 0711 /root 0700 /root/bin 0755 /root/public_html Assume nobody.nobody: cd /root/public_html ls -> dir list cd /root/bin -> error - no permission cd /root ls -> error - no permission cd bin -> error - no permission this weakens security a little bit. root especially has to be suspicious about files in '/root'. They all mustn't be readable by group and world. This is problematic if root tends to be your working account -- but you know, you mustn't work being root... ;-) -- Thomas

1 0

Re: [suse-security] importing users
by Nix 11 Dec '00

11 Dec '00

http://au1.samba.org/samba/ftp/pwdump/ http://au1.samba.org/samba/docs/man/smb.conf.5.html#unixpasswordsync unix password sync (G) This boolean parameter controls whether Samba attempts to synchronize the UNIX password with the SMB password when the encrypted SMB password in the smbpasswd file is changed. If this is set to true the program specified in the "passwd program" parameter is called *AS ROOT* - to allow the new UNIX password to be set without access to the old UNIX password (as the SMB password has change code has no access to the old password cleartext, only the new). By default this is set to "false". See also "passwd program", "passwd chat". Default: unix password sync = False Example: unix password sync = True If you do a little more reading (I'm not going to do all your work for you) or ask on the correct mailing list (ie samba) you will have no trouble setting up Samba to do pass-through authentication to an NT server for a period of time. Everytime someone logs onto the domain, and a local account doesn't exist on the unix server, samba will automatically add it for you. Cheers -Nix At 05:57 PM 8/12/2000 +0100, you wrote: >Hi Stephan. > >On Fri, 8 Dec 2000, OKDesign oHG Security Webmaster wrote: > > > Hi folks, > > > > finally one of our clients is interested in switching from WinDoof to > Linux. > > But he needs some tool to import the existing users on WindowsNT to > Linux in > > a secure manner (that means, not only importing the users, but also the > > passwords; but he don't know all passwords) > > Is there any way to do this efficiently ? > >IMHO it's not possible to import the passwords from WinNT to Linux due to >the fact that they use different hashing algorithms (Linux crypt(), which >is a better form of DES, WinNT uses some kind of MD5 (?)). If you can get >Linux to use the same hashing algorithm (perhaps MD5 with PAM? I don't >know for sure), it should be somehow possible. But I don't really know of >any efficient (and really secure) method. >Sure, you could crack the passwords with l0phtcrack, and import them under >Linux, not what I'd call secure and/or efficient :-). > > > Best would be, if the user-data could also be included into samba (samba > > should act as an login-server for his domain) > >This however should be perfectly possible, just export the SAM from NT, >and import the hashes into /etc/smbpasswd, which you need anyway. But then >there's no login to the Linux machine (POP3, FTP...). > >Greetings >olli > > > > > Thanks in advance > > > > --- > > -------------------------------------------- > > Stephan M. Ott // OKDesign oHG > > Internet-Providing und Netzwerkmanagement > > smo(a)okdesign.de ..... http://www.okdesign.de > > fon. +49 961 3814139 .. fax. +49 961 3814140 > > mobil 0171-8351130 ... oder ... 0171-7858064 > > -------------------------------------------- > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > > > > > > > >-- >-------------------------------------- >Oliver Hensel <oliver.hensel(a)gmx.net> > <ohensel(a)security-academy.de> > http://www.ohensel.de/ > > Training + Consulting > Unix - Linux - Firewalls - Security >-------------------------------------- > > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Firewalling - Checkpoint
by Roman Ernst 11 Dec '00

11 Dec '00

Does there already exist a solution like Checkpoint for Linux (stonebeat, failover, nice editing of rules,.......) Or is somebody working on such a solution??? Roman Ernst

4 4

Re: [suse-security] Firewalling - Checkpoint
by Nix 11 Dec '00

11 Dec '00

OK, I did have the date a day forward.. sorry. I am a +11 timezone though. I'm in Sydney which is ESDT Cheers Nix At 10:20 PM 10/12/2000 +0100, you wrote: >At 21:33 11.12.00 +1100, Nix wrote: > >Hi, would you mind to check your time, date and timezone/summertime >settings? Your messages are always far ahead: > >Ur Time: >Date: Mon, 11 Dec 2000 21:45:22 +1100 > >UTC: >Received: (qmail 30591 invoked from network); 10 Dec 2000 10:46:17 -0000 > >Reg. >Matthias Jänichen >

1 0

Nessus reports teardrop security hole, What to do
by Bo Jacobsen 10 Dec '00

10 Dec '00

I have tested my internal firewall (Suse7.0 2.2.16) with Nessus 1.03. It reported a security hole that would make it possible to crash the machine using the teardrop attack. Does anyone know what this teardrop is all about, and how to close this hole. Thanks in advance Bo Jacobsen bo(a)image.dk

2 1

RE: [suse-security] Nessus reports teardrop security hole, What to do
by Raffy 10 Dec '00

10 Dec '00

> I have tested my internal firewall (Suse7.0 2.2.16) with Nessus 1.03. > It reported a security hole that would make it possible to crash > the machine using the teardrop attack. > Does anyone know what this teardrop is all about, and how to close this hole. http://www.wwdsi.com/demo/saint_tutorials/teardrop.html Raffy

1 0

Re: [suse-security] TIS FWTK
by jjohnson＠penguincomputing.com 10 Dec '00

10 Dec '00

If you are going to take the time to use the built in firewalling code in linux why would use use a frontend to the program to modify the rules? Ipchains is *easy* to use. -miah On Fri, Dec 08, 2000 at 11:31:44AM -0500, Fred A. Miller wrote: > jjohnson(a)penguincomputing.com wrote: > > > > TIS FWTK is a complete waste of time. > > PMFirewall is VERY easy to use, and so far as I know, works on ALL > "flavors" of Linux. > > Fred > > -- > ----/ / _ Fred A. Miller > ---/ / (_)__ __ ____ __ Systems Administrator > --/ /__/ / _ \/ // /\ \/ / Cornell Univ. Press Services > -/____/_/_//_/\_,_/ /_/\_\ fm(a)cupserv.org

6 10

new updates for SuSEfirewall, harden_suse and seccheck
by marc＠suse.de 10 Dec '00

10 Dec '00

Hi folks! sorry, I've been away almost continuesly for the last 6 weeks ... Now I'm back (for two weeks ;-) and fixed the bugs which have been digged up the last two months. Please test them if you encountered problems with the old/original versions and report me if they are fine for you or not. Thank you very much for the many people who reported problems! as usual, download them from http://www.suse.de/~marc rpm updates will follow once enough people report me that these version solved their problems. SuSEfirewall v4.1 10.12.00 (beta release) * Added a fix to support splitbrain DNS on the firewall * I hope I finally fixed that reverse masquerading. Maybe I should not have included this feature in the first place, because it creates security holes - people: put your Webservers into a DMZ! ! Note that the hook fw_custom_before_forwardmasq() was renamed to fw_custom_before_masq ! seccheck v1.6 10.12.00 (gamma release) * fixed another DOS possbility (thanks to <dynamo(a)ime.net>) * fixed a bug in the weekly check where NFS/cdrom mounts were not excluded in one find query (thanks to kappes(a)physik.uni-bonn.de) harden_suse v2.7 10.12.00 (gamma release) * bugfixes (thanks to stefan.troeger(a)wirtschaft.tu-chemnitz.de) v2.6 26.10.00 (public beta) * important bugfix (thanks to Claus.Klein(a)marconi.com) * some minor bugfixes Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

1 0

importing users
by OKDesign oHG Security Webmaster 10 Dec '00

10 Dec '00

Hi folks, finally one of our clients is interested in switching from WinDoof to Linux. But he needs some tool to import the existing users on WindowsNT to Linux in a secure manner (that means, not only importing the users, but also the passwords; but he don't know all passwords) Is there any way to do this efficiently ? Best would be, if the user-data could also be included into samba (samba should act as an login-server for his domain) Thanks in advance --- -------------------------------------------- Stephan M. Ott // OKDesign oHG Internet-Providing und Netzwerkmanagement smo(a)okdesign.de ..... http://www.okdesign.de fon. +49 961 3814139 .. fax. +49 961 3814140 mobil 0171-8351130 ... oder ... 0171-7858064 --------------------------------------------

5 12

Fwd: noah 12/09/00:01.45 system check
by rjwohlfar＠bigfoot.com 10 Dec '00

10 Dec '00

I am trying to figure out if these log entries are an attack. Or if the Squid proxy is causing them. I'd appreciate any suggestions on their cause... These entries have been appearing for over a month. And they consistently appear every time I dial in (it's a dial-up ISP). The source address is always 222.22.22.22:53 or 222.22.22.25:53. The IP address 222.22.22.22 and 222.22.22.25 represent my ISP's DNS servers. I changed their real addresses to "222.22.22.22/25". But the log entries always come from the same two IP addresses. This is a dial-up ISP. So my IP address changes everytime. I understand that these packets are coming from port 53 (DNS). They always come from port 53. But The target port will change every time I dial in. For example, tomorrow the target address may be 222.22.22.44:111. Is Squid nmaking some request, and the firewall blocks the response? Thanks, in advance. -- Robert Wohlfarth ------ Forwarded message ------ Dec 9 01:31:27 noah kernel: Packet log: input DENY ppp0 PROTO=17 222.22.22.22:53 222.22.22.11:1187 L=121 S=0x00 I=23121 F=0x0000 T=125 (#27) Dec 9 01:31:32 noah kernel: Packet log: input DENY ppp0 PROTO=17 222.22.22.25:53 222.22.22.11:1187 L=121 S=0x00 I=27106 F=0x0000 T=126 (#27) Dec 9 01:31:37 noah kernel: Packet log: input DENY ppp0 PROTO=17 222.22.22.22:53 222.22.22.11:1187 L=77 S=0x00 I=46417 F=0x0000 T=126 (#27) Dec 9 01:31:40 noah kernel: Packet log: input DENY ppp0 PROTO=17 222.22.22.25:53 222.22.22.11:1187 L=77 S=0x00 I=16874 F=0x0000 T=126 (#27) Dec 9 01:31:43 noah kernel: Packet log: input DENY ppp0 PROTO=17 222.22.22.22:53 222.22.22.11:1187 L=77 S=0x00 I=49233 F=0x0000 T=126 (#27) Dec 9 01:31:49 noah kernel: Packet log: input DENY ppp0 PROTO=17 222.22.22.25:53 222.22.22.11:1187 L=77 S=0x00 I=15348 F=0x0000 T=126 (#27) Dec 9 01:31:55 noah kernel: Packet log: input DENY ppp0 PROTO=17 222.22.22.22:53 222.22.22.11:1187 L=77 S=0x00 I=59473 F=0x0000 T=126 (#27)

2 1

Linux.Conf.Au schedule is ready and it'll rock
by Nix 09 Dec '00

09 Dec '00

Hey guys This is slightly off topic, but then again, slightly On Topic as well. Please forgive me if I'm wasting 10sec of your day :-) For all of you Aussies (and other South East Asians) (and anyone else with a few spare days and too many Frequent Flyer Point to spare) it's time to scape some money together and get your arse along to this years Australian Linux Conference. Please see http://linux.conf.au/ for more details... I was at the last one in Melbourne (this one is in Sydney Thank God) and it went OFF!!!! (See http://www.linux.org.au/projects/calu/ for a mirror of the event.) Anyway, hopefully some of you will be able to make it, as I will be holding a "Birds of Feather" session on Security. If you have a look at http://linux.conf.au/papers/ I am second from the bottom :-) So, _please_ come along, and cheer/jeer and have a great time... Note: I do/will be running SuSE on my notebook, but will be talking about general linux/unix security as well as giving the SuSE a quiet plug where possible... *smirk* I have attached the latest announcement from the LCA-Announce Mailing List below FYI. Cheers Nix ----------------------------------------------------------------------------------------- Hi there once again, As I (hope by now) most of you are aware of the upcoming Linux Conference being held in Sydney. It has been a long and difficult road for most of the organisers. Attempting to work out a schedule when you have such well know Linux hackers as: John `maddog' Hall, Alan Cox, David Miller and Rik van Riel. As well as scheduling some of the up and coming greats: Richard Gooch, Juan Quintela, Daniel Phillips and Jeff Dike was not easy. And that was just the kernel hackers! We have some fantastic talks on distributed contents, clusters and large system administration. Plus plenty of eye-candy and war-stories from the front line of new architectures. A brief reminder: What: Linux.Conf.Au Where: Univeristy of New South Wales, Sydney When: 17th - 20th January 2001 Why: Because hackers and sunlight don't mix! How: Register using the forms at http://linux.conf.au/register/ Who: Speakers coming to the conference http://linux.conf.au/papers/ Cost: $99, $250 and $540 for students, hobbyists and corporates $50 late fee applies after December 31st 2000. Groups of 10 or more get a 10% discount, further details available upon request. Hope to see you there, Anand -- Linux.Conf.Au -- http://linux.conf.au/ 17th - 20th January, -- Alan Cox, David Miller, Sydney, Australia -- Tridge, maddog and you?

1 0