December 2000 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] AV for SuSE 6.4?
by Marco Antonio Blanco 21 Dec '00

21 Dec '00

I was so curious about the news that Panda has released a Linux version of their AV software that I've immediately have browsed their spanish pages and check if what Rainer had understood was right. I've found that they've only released a BETA version of their future AV software for Linux servers (they've put this product under the HOME USERS category (?)) and that it works with Red Hat and Mandrake (as Rainer said), while they're getting ready the proper versions for SuSE, Debian and FreeBSD. Anyway, I'm downloading the beta version right now and will test it in my SuSE Linux 7.0. I'll let you know about my findings. If it works ok, maybe it would be a candidate to be supported by Amavis, wouldn't it? Best regards. -- Marco Antonio Blanco Activa Sistemas, S.Coop.And. www.activasistemas.com

2 2

SSL2 vs. SSL3
by Jeremy Buchmann 20 Dec '00

20 Dec '00

Hello all, I'm updating my Web server (IBM HTTP Server 1.3.12.2 on SuSE 6.3) and was looking through the SSLCipherSpec lines and was wondering whether it was better to allow SSLv2 at 128 bit before SSLv3 at < 128 bit (SSLv3 at 128 bit is first obviously). Apparently, the order of the SSLCipherSpec lines determines which algorithm/keysize is used. -- Jeremy Buchmann System Admin/Database Programmer Wells Gaming Research

1 0

Updating packages
by RoMaN SoFt / LLFB!! 20 Dec '00

20 Dec '00

Hi. The following error msgs appear when trying to "freshen" (rpm -F) some packages: package libtiff-3.5.4-44 (which is newer than libtiff-3.4.final-0) is already installed package tiff-3.5.4-44 (which is newer than tiff-3.4-0) is already installed Reasons are obvious. Maybe a silly question but... is this downgrading intentional or are there any erroneus packages on SuSE updates section? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 3

hardening script again
by Mueller, Thomas 20 Dec '00

20 Dec '00

hi all, I solved the problem..sorry for bothering.... laters Tom Corporate Express Deutschland GmbH Bereich IT Thomas Müller Schulze-Delitzsch-Str. 24-26 70565 Stuttgart Tel.: 0711/90676-636 Fax: 0711/90676-313 Thomas.Mueller(a)cexp.de

1 0

[suse-security] FTP connection
by AndriusD＠labas.com 20 Dec '00

20 Dec '00

hi, how could I see from my logs if ftp connection was successful or not: in.ftpd[8546]: connect from xxx.xxx.xxx.xxx this line appears in logs regardless whether connection was established or not thank you, ------------------ andriusd(a)labas.com

3 2

AMaVis install on SuSe 6.3
by webmaster 20 Dec '00

20 Dec '00

Having followed the AV thread of today, I felt armed enough to have a go at installing AMaViS. However. while studying /etc/sendmail.cf modifications of www.amavis.org I compared it with mine existing /etc/sendmail.cf That is what I found: ################################################## ### Local and Program Mailer specification ### ################################################## ##### @(#)local.m4 8.30 (Berkeley) 6/30/1998 ##### Mlocal, P=/usr/bin/procmail, F=lsDFMAw5:/|@qSPfhn9, S=10/30, R=20/40, T=DNS/RFC822/X-Unix, A=procmail -a $h -d $u Mprog, P=/bin/sh, F=lsDFMoqeu9, S=10/30, R=20/40, D=$z:/, T=X-Unix, A=sh -c $u ///////////////////////////////////////////////// And that is on www.amavis.org: Mlocal, P=/usr/bin/procmail, F=lsDFMAw5:/|@SPfhn, S=10/30, R=20/40, T=DNS/RFC822/X-Unix, A=procmail -Y -a $h -d $u ////////////////////////// Could anyone explain me the difference? ///////////////////////////////// These are the suggested changes: Mlocal, P=/usr/sbin/scanmails, F=lsDFMAw5:/|@SPfhn, S=10/30, R=20/40, T=DNS/RFC822/X-Unix, A=scanmails -Y -a $h -d $u ///////////////////// How should I carry on with regard to the original? //////////////// /-------------------------/ Antal Leisen webmaster(a)kreorg.hu Kreorg Educational Center Budapest, Hungary

3 2

Re: [suse-security] AV for SuSE 6.4?
by Ralf Vroomen 20 Dec '00

20 Dec '00

InoculateIT works fine on SuSE to. >I have never had any probs with AVP on SuSE 6.4 :-) At 10:07 AM 19/12/2000 +0100, you wrote: >Hi Roman, > >TrendMicro just released a version for SuSE 6.4 , I haven't had the chance >to check yet, but as I talked to TM, they stated, there arent't any know >probs. > >I do not know if they released it on their international server - try >www.trendmicro.de. The software was ported here in Munich, Germany AFAIK. > >Daniel Wirth > > >On Tue, 19 Dec 2000, RoMaN SoFt / LLFB!! wrote: > > > Date: Tue, 19 Dec 2000 09:57:22 +0100 > > From: RoMaN SoFt / LLFB!! <roman(a)madrid.com> > > To: suse-security(a)suse.com > > Subject: [suse-security] AV for SuSE 6.4? > > > > > > Hi. > > > > I'm having trouble looking for a SuSE-working antivirus solution. I > > need to set up an av solution on my smtp server (i.e. filtering > > inbound or outbound mail). I only have had time to try 2 AV by now: > > AVP for Linux and Trend Micro InterScan. Both failed to install/work: > > AVP gives "segmentation faults" (I think it is compiled against > > glibc2; I'm using SuSE 6.4 distro which comes with... glibc perhaps? > > Aren't they compatible?). InterScan directly refuse to install (it > > says it must be compiled on Red Hat 6.0; perhaps it could be faked > > because it checks for /etc/redhat-release file but I don't want to > > make these kind of "experiments"). They aren't opensource so I haven't > > got the sources for re-compiling. > > > > In summary, both are intended for Red Hat, which seems to be the more > > popular distro (indeed, it was, at least long time ago, and perhaps it > > is now). > > > > Isn't there a good AV soft which correctly compiles in SuSE 6.4??? I > > prefer hearing some fast responses from you than keeping wasting my > > time downloading &"try-installing" other non-SuSE AVs... > > > > Thx in advance. > > > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > ** RoMaN SoFt / LLFB ** > > roman(a)madrid.com > > http://pagina.de/romansoft > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > >-- > > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com -- eRVee Moskovic Broeders.

3 3

AV for SuSE 6.4?
by RoMaN SoFt / LLFB!! 20 Dec '00

20 Dec '00

Hi. I'm having trouble looking for a SuSE-working antivirus solution. I need to set up an av solution on my smtp server (i.e. filtering inbound or outbound mail). I only have had time to try 2 AV by now: AVP for Linux and Trend Micro InterScan. Both failed to install/work: AVP gives "segmentation faults" (I think it is compiled against glibc2; I'm using SuSE 6.4 distro which comes with... glibc perhaps? Aren't they compatible?). InterScan directly refuse to install (it says it must be compiled on Red Hat 6.0; perhaps it could be faked because it checks for /etc/redhat-release file but I don't want to make these kind of "experiments"). They aren't opensource so I haven't got the sources for re-compiling. In summary, both are intended for Red Hat, which seems to be the more popular distro (indeed, it was, at least long time ago, and perhaps it is now). Isn't there a good AV soft which correctly compiles in SuSE 6.4??? I prefer hearing some fast responses from you than keeping wasting my time downloading &"try-installing" other non-SuSE AVs... Thx in advance. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

8 10

squid and authentication with openldap
by Richard Hegewald 20 Dec '00

20 Dec '00

hello all, i am running squid 2 on a SuSe 6.3 and it works OK. Now I want to restrict my users' access logged on a Windows NT terminal server. So I cannot restrict them by IP numbers because there is only one. Now I have seen the parameter "authenticat_program" for an external authenticator. In squid.conf they tell about the program ncsa_auth, but Suse seems to use LDAP access. I started LDAP server and tried to enter a user, but I was not successful. I read the administrator guide from openldap.org but I think I need more basic understanding in this subject. Is there any easy introduction to administration of openldap, adding users, defining access rights... Thanks for any hint Richard Hegewald

4 5

Open ports
by Iain Gray 20 Dec '00

20 Dec '00

Hi there, I recently ran a scan on my Web Server (SuSE 6.4), and in addition to the expected TCP services (http, ssh, smtp et al.), it claimed that the UDP ports 135 (msrpc-epmap), 137 (netbios-ns) and 139 (netbios-dgram) were open. I can see no reason why they should be - they are not enabled in inetd.conf(I ran harden_suse when i first set up the machine), and I am not running Samba. The only "non-suse" thing that I am running on the machine is Chilisoft-ASP, but I cannot see why that would have MS specific ports open. Does anyone know what it might be that returns this result? Many thanks, Iain

4 3