December 2000 - openSUSE Security - openSUSE Mailing Lists

SAMBA password synchronization with NIS
by J. Mell 30 Dec '00

30 Dec '00

Hi list, we have a mixed environment of SuSE 7.0 Linux machines and Windows machines. The windows machines access a SAMBA 2.07 server on one of the Linux machines. As more and more functions are going over to the Linux machines (POP e-mail etc.) we want to have one synchronized password database. We use NIS on the Linux machines for authentification and there the problems come up: If we set the SAMBA server to synchronize unix passwords, SAMBA will call the Linux password program - in our case yppasswd - to set a new password on the Linux side. Unfortunately yppasswd asks for the root password first. This means that I would have to put the server's root password in plain text into SAMBA's password chat in SAMBA's configuration file which I obviously cannot do. Any ideas how this can be solved? Any tips for good reading about the password synchronization problem with NIS? Jürgen Mell

1 0

Login restriction
by Raffy 29 Dec '00

29 Dec '00

I have a user on my system who needs an ssh login shell. I don't want that user to escape his home directory. Is there an easy solution to restrict him to only his home. I could use chroot to do so, but that would involve quite some work, wouldn't it. Thanks Raffy

1 0

[OT] KDM missing in action
by Nix 29 Dec '00

29 Dec '00

OK, quick question, although a little off topic. My KDM seems to be missing in action on all my machines that I have installed SuSE 7.0 on. I'm not sure if this is due to the fact that I'm running KDE2?? Does anyone have any pointers on how to get KDM back. I normally boot to a console myself, but I have just set up a machine in the lounge room for the purpose of playing MP3s, and having a nice gui login would be good. (XDM works currently, but it's ugly..) -Nix Friends dont send friends .exe attachments. See also "Bloody Idiot".

1 0

SSH
by Richard 29 Dec '00

29 Dec '00

Dear All I'm having some problems with SSH that don't really make too much sense to me. Previously I had a Debian dialup box that dialed when I did 'isdnctrl dial ippp0' from the SuSE 6.4 box with SSH. There was no problem with that at all. Just recently I thought it was time to upgrade the internet facing box and changed to SuSE 7.0. My Compaq notebook got the same software at the same time. Very nice software with a great deal of choice. However, I now find that if I try to connect to the new 7.0 box with the old 6.4 box then nothing happens. I'm using Open SSH on all of them and on the 6.4 box it's version 1.2.2. On the new box and the notebook it's version 2.1.1p1. I can get all of the machines to see each other on the network which is based around a small hub. But SSH just refuses to do anything. The login command I use normally is...... 'ssh root@nameofthebox' I'm sure that I've missed something here but I can't think what. As I say the 6.4 box connected straight up to my old Debian box without a problem. Can anyone point me in the right direction here ? Read 'man ssh' and the SuSE database. Still can't figure it out. Also done some RTFM with several books. Thanks -- Richard

2 1

Firewall question -- Forwarding ports
by Waldack, Jesse (CAP, CARD) 28 Dec '00

28 Dec '00

I wish to forward a few ports into a MASQed computer (specifically, 192.168.1.12 on my LAN). I think it has something to do with changing option 13 in firewall.rc (FW_FORWARD_TCP/UDP) but I don't quite understand the syntax. If I am on the right track, can someone please walk me through the meaning of the syntax? If I am way off, can someone point me in the right direction? I am running SuSE 6.4. Thanks in advance for your assistance. -Jesse

6 6

weird postfix error
by Nix 28 Dec '00

28 Dec '00

Can anyone explain these weird error messages? I have just started playing with postfix, and it's not bad, but this seems to be a weird glitch. I was testing the limits of message size, both of postfix and a couple of third party mail providers, and came up with this log. Dec 27 14:35:32 fw postfix/master[541]: warning: file size limit 524288000 < message_size_limit 1024000000 -- reset Now, I have looked at http://www.postfix.org/resource.html#size and I HAVE increased the Message Size Limit as this log states, but I can't figure out how to increase the file size limit... Also I would LOVE to know how to stop postfix from listening on a port, but still process the queue. Currently I have told postfix to listen on localhost only, and have Obtuse SMTPD listening on all other interfaces... This works fine, but is a bit of a hack. You should be able to stop it from listening totally like you can with sendmail. (Note, you can do this, but then it fails to process the mail queue...) If anyone can help me with this, to save me from subscribing to the postfix mailing list..... Would be much appreciated. Kurt? I seem to remember you being a postfix monkey?? (Bah.. really I just wanted to post something to the list to see if everyone is still alive!!! Is it only ME who is working between xmas and new year or are there other idiots out there too???) /me stops playing with postfix and gets back to work... -Nix Dec 27 13:33:14 fw postfix/cleanup[426]: 3DDA3823E: message-id=<5.0.2.1.0.20001227130542.02f9cda8(a)mail.itaudit.com.au> Dec 27 13:35:59 fw postfix/smtpd[425]: disconnect from unknown[172.20.1.8] Dec 27 13:35:59 fw postfix/qmgr[402]: 3DDA3823E: from=<peter(a)nixon.net>, size=124216353 (queue active) Dec 27 14:35:32 fw postfix/master[541]: warning: file size limit 524288000 < message_size_limit 1024000000 -- reset Dec 27 14:35:32 fw postfix-script: stopping the Postfix mail system Dec 27 14:35:32 fw postfix/master[400]: terminating on signal 15 Dec 27 14:35:32 fw postfix/master[551]: warning: file size limit 524288000 < message_size_limit 1024000000 -- reset Dec 27 14:35:35 fw postfix-script: starting the Postfix mail system Dec 27 14:35:35 fw postfix/master[597]: warning: file size limit 524288000 < message_size_limit 1024000000 -- reset Dec 27 14:35:35 fw postfix/master[597]: daemon started Dec 27 14:52:15 fw postfix/qmgr[599]: 3DDA3823E: from=<peter(a)nixon.net>, size=124216353 (queue active) Dec 27 17:14:53 fw postfix/smtpd[864]: connect from localhost[127.0.0.1] Dec 27 17:15:15 fw postfix/smtpd[864]: warning: Illegal address syntax from localhost[127.0.0.1] in VRFY command: hs;ldfkj Dec 27 17:18:13 fw postfix/smtpd[864]: disconnect from localhost[127.0.0.1] Dec 27 17:25:16 fw postfix/master[904]: warning: file size limit 524288000 < message_size_limit 1024000000 -- reset Dec 27 17:25:16 fw postfix-script: stopping the Postfix mail system Dec 27 17:25:16 fw postfix/master[597]: terminating on signal 15 Dec 27 17:25:16 fw postfix/master[914]: warning: file size limit 524288000 < message_size_limit 1024000000 -- reset Dec 27 17:25:16 fw postfix-script: starting the Postfix mail system Dec 27 17:25:17 fw postfix/master[956]: warning: file size limit 524288000 < message_size_limit 1024000000 -- reset Dec 27 17:25:17 fw postfix/master[956]: daemon started Dec 27 17:41:57 fw postfix/qmgr[958]: 3DDA3823E: from=<peter(a)nixon.net>, size=124216353 (queue active) Dec 27 17:42:34 fw postfix/master[1003]: warning: file size limit 524288000 < message_size_limit 1024000000 -- reset Dec 27 17:42:34 fw postfix-script: stopping the Postfix mail system Dec 27 17:42:34 fw postfix/master[956]: terminating on signal 15 Dec 27 17:42:34 fw postfix/master[1013]: warning: file size limit 524288000 < message_size_limit 1024000000 -- reset Dec 27 17:42:35 fw postfix-script: starting the Postfix mail system Dec 27 17:42:35 fw postfix/master[1055]: warning: file size limit 524288000 < message_size_limit 1024000000 -- reset Dec 27 17:42:35 fw postfix/master[1055]: daemon started Dec 27 17:59:15 fw postfix/qmgr[1057]: 3DDA3823E: from=<peter(a)nixon.net>, size=124216353 (queue active) Dec 27 21:10:22 fw postfix/smtp[1081]: 3DDA3823E: to=<peter(a)paulsjourney.com>, relay=mail.paulsjourney.com[64.65.2.56], delay=27428, status=sent (250 ok 977915228 qp 4515) Dec 28 00:00:10 fw postfix/pickup[1459]: 13579823E: uid=0 from=<root> Dec 28 00:00:10 fw postfix/cleanup[1823]: 13579823E: message-id=<20001227230009.13579823E(a)fw.fallen.com.au> Dec 28 00:00:10 fw postfix/qmgr[1057]: 13579823E: from=<root(a)fw.fallen.com.au>, size=976 (queue active) Dec 28 00:00:11 fw postfix/local[1827]: 13579823E: to=<root(a)fw.fallen.com.au>, relay=local, delay=2, status=sent (mailbox) Dec 28 00:00:11 fw postfix/cleanup[1823]: 705088240: message-id=<20001227230009.13579823E(a)fw.fallen.com.au> Dec 28 00:00:11 fw postfix/qmgr[1057]: 705088240: from=<root(a)fw.fallen.com.au>, size=1108 (queue active) Dec 28 00:00:11 fw postfix/local[1827]: 13579823E: to=<root(a)fw.fallen.com.au>, relay=local, delay=2, status=sent (forwarded as 705088240) Dec 28 00:00:14 fw postfix/smtp[1828]: 705088240: to=<peter(a)nixon.net>, relay=inbound.nixon.net.criticalpath.net[209.228.32.54], delay=3, status=sent (250 ok 977925489 qp 21788) Dec 28 00:01:46 fw postfix/pickup[1459]: 8FF6A823E: uid=0 from=<root> Dec 28 00:01:46 fw postfix/cleanup[1823]: 8FF6A823E: message-id=<20001227230146.8FF6A823E(a)fw.fallen.com.au> Dec 28 00:01:46 fw postfix/qmgr[1057]: 8FF6A823E: from=<root(a)fw.fallen.com.au>, size=1531 (queue active) Dec 28 00:01:46 fw postfix/local[1827]: warning: biff_notify: Connection refused Dec 28 00:01:46 fw postfix/local[1827]: 8FF6A823E: to=<root(a)fw.fallen.com.au>, relay=local, delay=0, status=sent (mailbox) Dec 28 00:01:46 fw postfix/cleanup[1823]: 94A6E8240: message-id=<20001227230146.8FF6A823E(a)fw.fallen.com.au> Dec 28 00:01:46 fw postfix/qmgr[1057]: 94A6E8240: from=<root(a)fw.fallen.com.au>, size=1662 (queue active) Dec 28 00:01:46 fw postfix/local[1827]: 8FF6A823E: to=<root(a)fw.fallen.com.au>, relay=local, delay=0, status=sent (forwarded as 94A6E8240) Dec 28 00:01:49 fw postfix/smtp[1828]: 94A6E8240: to=<peter(a)nixon.net>, relay=inbound.nixon.net.criticalpath.net[209.228.32.54], delay=3, status=sent (250 ok 977925584 qp 22400) You have moved your mouse. Windows will now reboot.

5 9

Saint Jude 0.0.7
by Fred A. Miller 27 Dec '00

27 Dec '00

Saint Jude 0.0.7 (Linux) by Tim Lawless (lawless(a)netdoor.com) Relevant URL: http://www.sourceforge.com/projects/stjude Saint Jude LKM is a Linux kernel module that implements the Saint Jude model for improper privilege transitions. This will permit the discovery of local, and ultimately, remote root exploits during the exploit itself. Once discovered, Saint Jude will terminate the execution, preventing the root exploit from occuring. This is done without checking for attack signatures of known exploits, and thus should work for both known and unknown exploits. -- ----/ / _ Fred A. Miller ---/ / (_)__ __ ____ __ Systems Administrator --/ /__/ / _ \/ // /\ \/ / Cornell Univ. Press Services -/____/_/_//_/\_,_/ /_/\_\ fm(a)cupserv.org

1 0

Re: Re[3]: [suse-security] NSCD
by r.maurizzi＠gvs.it 27 Dec '00

27 Dec '00

> This amount of users needs a lot of tuning and i think installing a > program like NSCD is or should be part of that tuning. I personaly run > SuSE on a web-servers and have NSCD turned of. The reason is that i only > read difficulties of NSCD and every pogram adds a security risc. Am I the only one for which NSCD creates problems with slow nameservers? As in: - Issue the command: "ping www.somestrangedomainname.com" - my DNS has to lookup the address from a far/slow DNS and doesn't reply before timeout - ping replies host unknown - NSCD caches the host unknown error - another ping returns error again for some time - "/etc/rc.d/nscd stop" (sorry for the RedHat-ism :) - "ping www.somestrangedomainname.com" - this times it's OK. I can easily imagine a lot of people that just installed linux being lost, and rebooting their machine to see "if it works this way". And the worst part is, it does work after the reboot... Someone should have a talk with the glib/nsdc people ;-) Ciao, Roberto.

5 5

Re: [suse-security] Firewall question -- Forwarding ports
by tecnicos 27 Dec '00

27 Dec '00

Hi Jesse, You are on the right direction, I think, but you are in the wrong option of the firewall.. what you need is to change the option 14 of the 4.1 version of the firewall this allows you to masq servers. That's what I'm actually using to my webserver.. Hope it helps... karlos.

1 0

Re: [suse-security] hack me! -- ipchains security
by 'MaD dUCK' 27 Dec '00

27 Dec '00

also sprach Philipp Snizek (on Sun, 24 Dec 2000 10:35:36PM +0100): > I accept that you use 100% ipchains to see how secure it is. But your > solution is not very fexible, e.g. ftp. Many ftp servers have (as you know) > data ports on >1024. Connections to them will not work (I beg your pardon if > I'm wrong, I just went very quickly through it). i think i am allowing them. specifically with the following two lines: -A ei-in -d 0.0.0.0/0 1024:65535 -p 6 -j accepted -A ei-in -d 0.0.0.0/0 1024:65535 -p 17 -j accepted where ei-in is the chain of packets arriving from a non-local machine on the external interface. > You can save up a lot of rulesets which will make your script easier to > control by using squid for www, ssl and pasv ftp. Also you can run bind as a > dns forwarder bound to your int eth (Not to your ext eth!). well, i am. currently, i don't forward 443 to squid, but 80 is automatically handled by squid without the need to specify a proxy. and i actually did not know that ftp can be handled by squid too. > I solved it the way that I have squid doing the main internet job. My > ipchains forward policy is set to deny. All others are set to accept. I just > run ipchains for pop and smtp. This makes it very easy to control the > chains. yes i know. i don't find my scripts particularly hard for i broke them up into subchains quite nicely... > I know, it's not what you wanted to hear. I'm not a cacker. But I still hope > that it helps in making your systems more secure and easier to monitor. thanks though. i appreciate any input... martin [greetings from the heart of the sun]# echo madduck@!#:1:s@\@@@.net -- the young lady had an unusual list, linked in part to a structural weakness. she set no preconditions.

2 10