December 2000 - openSUSE Security - openSUSE Mailing Lists

imapd: restricted file access
by Volker Weinberg 20 Dec '00

20 Dec '00

Hi all! Does anybody know how to correctly restrict the directories users can acces via imap (Washington State)? I do not want users to download arbitrary world-readable files from our server via weinberg@genji:~ > telnet mailhost imap2 0 login weinberg passwdbla 0 select "/etc/passwd" 0 fetch 1 body[] 0 logout but allow access to /home/user and /var/spool/mail/user. The last thing I tried was creating a user-accessible /black directory, with links /black/var/spool/mail -> /var/spool/mail/ /black/home -> /home/ and set in the /etc/c-client.cf: I accept the risk for IMAP toolkit 4.1. set black-box-directory /black/ set black-box-default-home-directory /black/home/ Howerver, "{mailbox}/var/spool/mail/user" is selectable and gains access to the user-mailbox, while the widely used "{mailbox}inbox selects an inbox with 0 messages found. I am not at all happy with playing around with totally undocumented options like black-box-default-home-directory ... Regards, Volker Weinberg ---------------------------------------------------------------------------- Volker Weinberg email: volker.weinberg(a)physik.uni-muenchen.de Dept.of Physics phone: Univ. of Munich at home: (089) 14 56 09 (Germany) at CIP: (089) 21 80-24 05 address: Andernacher Str. 17 80993 Muenchen ----------------------------------------------------------------------------

2 1

Problems while stunneling POP3
by Boris Kantwerk 20 Dec '00

20 Dec '00

Hi *! This night I tried to enable SSL tunneling (stunnel-3.8-1) for my POP3 clients with the default stunnel.cnf. I get following in /var/log/messages: Dec 12 05:25:22 localserver xinetd[4218]: Started working: 4 available services ... Dec 12 05:25:34 localserver stunnel[4219]: stunnel started Dec 12 05:25:34 localserver stunnel[4219]: getpeerbyname: Transport endpoint is not connected (107) Dec 12 05:25:34 localserver stunnel[4219]: stunnel finished (0 left) My client is MS Outlook 2000 (SP1), I enabled encrypted password transmission and secure POP3-Server on port 995! Entry in xinetd.conf: service pop3s { flags = REUSE NAMEINARGS socket_type = stream protocol = tcp wait = no user = root server = /usr/sbin/stunnel server_args = stunnel -D 7 -p /etc/stunnel/stunnel.pem -l /usr/sbin/popper } Entry in /etc/services: pop3s 995/tcp # pop3 protocol over TLS/SSL (was spop3) Any ideas? Tired, Boris.

3 4

Re: [suse-security] Postfix & Squid Package updates
by Nix 19 Dec '00

19 Dec '00

As I know the SuSE boys are usually pretty busy, I'm going to answer this on their behalf. SuSE like to do their own code audit of packages before they are added to the distribution. This includes audits of new code additions to existing packages. This is a "very good thing" (tm) for _your_ security, and has saved SuSE from hurriedly releasing patches to security holes. That is one of the reasons why SuSE, while it is the larges linux distro available, has a relatively low number of major security holes. Now, code audits are VERY time consuming, as they don't just have to find ONE hole, (like the crackers) but ALL possible holes. Due to the large number of people poking at holes in packages, and the recent climate of vendor notification before publication on BugTraq, it's quite possible/probable that the code auditors at SuSE are feverishly trying to fix a (privately) know hole in something, which obviously has a lower priority than adding (possibly) unneeded features to perfectly functional packages. So, the answer to you question is that SuSE _may_ release the updates to these packages, _if_ they think the new features are worthwhile AND secure. There are still some packages in SuSE 7.0 that are a version or two behind, due to the messy code in the newer updates, and because the newer features were considered unnecessary. IMHO this is the reason that you pay to buy SuSE. That is to get a tried/tested/audited distribution. If you have looked at the newer versions of the packages you want and decided that there is some new feature that you _simply can't live without_ then by all means compile it yourself. After all, that is the reason SuSE ship gcc, and make ;-) HTH -Nix At 11:02 AM 18/12/2000 +0200, you wrote: >Hi All > >Will SuSE be releasing versions updates for Postfix and Squid. > >The default versions released SuSE 6.4 is Postfix Version: 19991231pl05 and >Squid Version: 2.3.STABLE2 > >Thanks in advance > >Steven > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking

6 6

new version of scslog
by Thomas Biege 19 Dec '00

19 Dec '00

Hi, a new version of scslog (and secproglib) is available on http://www.suse.de/~thomas I fixed the 'use counter' bug in scslog and added some more syscalls to monitor... ... enjoy! Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

THIS belongs in the SuSE support DB !!!
by Barry Hill 19 Dec '00

19 Dec '00

Hi folks, It may be slightly off topic but I believe this problem belongs in the SuSE support DB: After adding a user with useradd (or YaST) I tried to set a password with passwd, only to receive the reply "unknown user". Searching in my usual source of answers, the suse.de support database, gave me no answers, instead a google search (built into opera) pointed me towards this article, which mentions nscd as the source of evil: http://archives.neohapsis.com/archives/linux/suse/2000-q1/0328.html Would the Suse Team (cheers to them!) be so good as to add this to the SDB? Although I've found the answer there are most likely others who are having the same problem!! Regards, Barry

10 21

Login Display
by Orlando Ortiz 19 Dec '00

19 Dec '00

Hello, In version 6.1, there was a setting in /etc/Login.defs, # # Enable logging of successful logins # LOG_OK_LOGINS yes What would be the equivalent of this in Pam on version 7.0? Many Thanks...

1 0

Does anyone else get these? (ezmlm warning)
by Nix 19 Dec '00

19 Dec '00

Guys, I was just wondering if anyone else gets these messages occasionally?? Now, this email address/domain is hosted at hispeed.com who are a pretty large hosting company. When I first got one of these messages, I raised a help desk ticket with them, but they could find anything wrong. Likewise the second time. This is now the 4th time I have received this message in as many months from the SuSE mailing list. Does anyone have any clue what is going on? I receive over a hundred messages a day to different accounts on this server (BugTraq, NTBugtraq, FW-1, HWG, 2600, Linux-aus, etc etc..) and the only one that seems to have any problems is SuSE.... I would really like to get to the bottom of this... -Nix >Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm >Date: 15 Dec 2000 17:36:33 -0000 >From: suse-security-help(a)ns2.SuSE.com >To: suse(a)nix.hispeed.com >Subject: ezmlm warning > >Hi! This is the ezmlm program. I'm managing the >suse-security(a)suse.com mailing list. > > >Messages to you from the suse-security mailing list seem to >have been bouncing. I've attached a copy of the first bounce >message I received. > >If this message bounces too, I will send you a probe. If the probe bounces, >I will remove your address from the suse-security mailing list, >without further notice. > > >I've kept a list of which messages from the suse-security mailing list have >bounced from your address. > >Copies of these messages may be in the archive. >To retrieve a set of messages 123-145 (a maximum of 100 per request), >send an empty message to: > <suse-security-get.123_145(a)suse.com> > >To receive a subject and author list for the last 100 or so messages, >send an empty message to: > <suse-security-index(a)suse.com> > >Here are the message numbers: > > 4286 > 4287 > 4284 > 4285 > >--- Enclosed is a copy of the bounce message I received. > >Return-Path: <> >Received: (qmail 32510 invoked for bounce); 3 Dec 2000 22:34:51 -0000 >Date: 3 Dec 2000 22:34:51 -0000 >From: MAILER-DAEMON(a)lists.suse.com >To: suse-security-return-4286-(a)lists.suse.com >Subject: failure notice > >Hi. This is the qmail-send program at lists.suse.com. >I'm afraid I wasn't able to deliver your message to the following addresses. >This is a permanent error; I've given up. Sorry it didn't work out. > ><suse(a)nix.hispeed.com>: >209.145.61.245 does not like recipient. >Remote host said: 550 5.1.1 <suse(a)nix.hispeed.com>... User unknown >Giving up on 209.145.61.245. -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking

5 4

RE: [suse-security] Attacks Against SSH 1 And SSL
by Raffy 19 Dec '00

19 Dec '00

>"SecurityPortal has a very interesting article by Kurt Seifried in which he >writes "dsniff 2.3 allows you to exploit several fundamental flaws in two [snip] Does anyone have dsniff 2.3 running on Suse 6.4? I just tried to compile it. First I had to install libnet which worked. Now I would need libnids. I found a version on the web, but it does not compile. gcc -c -g -O2 -D_BSD_SOURCE -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAV E_NET_ETHERNET_H -DLIBNET_LIL_ENDIAN -Wall -DHAVE_ICMPHDR=1 -DHAVE_TCP_STATE S=1 -DHAVE_BSD_UDPHDR=1 -I. libnids.c libnids.c:28: conflicting types for `pcap_open_live_new' /usr/include/pcap.h:119: previous declaration of `pcap_open_live_new' It's already weired, that it passes the -D_BSD_SOURCE. Do I have to change anything there, or do I have to compile dsniff with a special option? Thanks Raffy

8 8

Re: [suse-security] Providing secure external access to Internal Mail Server
by Nix 19 Dec '00

19 Dec '00

My suggestion would be to setup Exchange webmail over SSL (https) then port-forward port 443 from your linux box. Alternatively you could find a APOP to pop converter proxy like in Gauntlet Firewall and use APOP to the firewall. (I guess the TIS Firewall Toolkit can do this also as Gauntlet is based off it, but I have not verified this) Cheers Nix At 01:41 PM 19/12/2000 +0200, you wrote: >Hi All > >I would like to set-up secure external access to an internal mail server >(Exchange box). My options is either POP3, IMAP, HTTP. > >What is the best method of setting this up. Do you enable port forwarding on >the firewall or do you set-up proxies on the firewall to enable access to >the relavent ports. > >All tips wellcome > >Thanks in advance > >Steven > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking

1 0

Providing secure external access to Internal Mail Server
by Steven Thompson 19 Dec '00

19 Dec '00

Hi All I would like to set-up secure external access to an internal mail server (Exchange box). My options is either POP3, IMAP, HTTP. What is the best method of setting this up. Do you enable port forwarding on the firewall or do you set-up proxies on the firewall to enable access to the relavent ports. All tips wellcome Thanks in advance Steven

1 0