February 2000 - openSUSE Security - openSUSE Mailing Lists

sendmail - mail access
by F. Spitzer, GEOSYSTEMS 02 Feb '00

02 Feb '00

Hi there once again, I'm back with another question. I am using sendmail out off SuSE-Linux 6.3. Is there a way to restrict the access to a local user's mailbox (e.g. john.doe(a)domain.edu)? The user should still be able to receive local mail (form everyone in domain.edu) but not mail from outside the whole net. As far as I have read in the sendmail documentation you only can deny all mail to the user (within /etc/mail/access). Any help is welcome! Thanks Fritz

5 4

Re: [suse-security] Marc Heuse's firewall package and SAMBA
by marc＠suse.de 02 Feb '00

02 Feb '00

>Samba and firewall: >>The problem is in the SMB and NMB services it runs. It deny's packetes that >>were broadcasted from itself from these ports (137:138) and IP 192.168.0.1 >>an coming back to 192.168.0.255 yes. thats because it thinks there´s someone IP spoofing it´s address ... in 2.0, which will be out by begin of next week (as an official rpm), these logmessages will only be seen by people who set "FW_LOG_DENY_ALL" ... >I got another problem with this stuff: > the samba server 2.05a (this is also the SUSE 6.3 firewall with update) > takes sometimes a deep breath and does not respond to one ore more >clients > for seconds or even minutes. I haven´t found the reason jet, but my log >shows > 'martians' and 'denied packets' too. how can anybody help you if you don´t post the deny log entries? Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

RE: [suse-security] language barriers
by Paxton, Michael 02 Feb '00

02 Feb '00

Would it be feasible to have a formal "header" that would be part of all original posts that should include succinct information (along the lines of Kernel version, Product version, brief vulnerability type(s) (eg Buffer Overflow, root compromise ) etc) to keep some key information as unambiguous as possible and a policy that all translations should be identified as either automatically or manually produced and should ALWAYS have the original message attached - hopefully you can limit the chance of a translation error to discussion or debate sections of messages making it more likely an error will be embarassing rather than fatal and including original text means a poster is less likely to feel misrepresented. I submit my entry as the longest sentence of 2000 .. any challengers? Michael Paxton Australian Institute of Health & Welfare > -----Original Message----- > From: John F. Eldredge [SMTP:eldredge@poboxes.com] > Sent: Monday, January 31, 2000 3:14 PM > To: 'Steffen Dettmer' > Cc: SuSE Security MailList (E-mail) > Subject: RE: [suse-security] language barriers > > > -----Original Message----- > > From: Steffen Dettmer [mailto:steffen@dett.de] > > Sent: Saturday, January 29, 2000 9:17 PM > > To: suse-security(a)suse.com > > Subject: Re: [suse-security] language barriers > > > > * cogNiTioN wrote on Sun, Jan 30, 2000 at 00:38 +0000: > > > On 30 Jan 2000 brian-suse(a)stech.cx wrote: > > > > > > > I've had enough of this "talk in english or be flamed" > > stuff. We need to > > > > have a system of translation set up. > > > > Well, of course, since this it's an english list, german (or > > other) language is off-topic. Flames are off-topic too. So far. > > Do you think it's a big problem to have native languages in a > > security list? Most of the stuff we have to read is english > > anyway, most postings concerning security issues are written in > > english, and need to be very actual, so translations are a little > > bit late usually... > > Someone suggested running non-English posts through the Babelfish > automatic-translation site. While this is better than no translation > at > all, I hope that someone familiar with both languages would > double-check > such a message before it was posted to the mailing list. Given the > current > state of the art for computer-aided translation, I wouldn't want to > reconfigure my computer solely on the basis of a computer-translated > document. Subtle translation errors can have major consequences. > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com

2 1

IP_Chains and Email Question
by Peter Burns 02 Feb '00

02 Feb '00

Hope anyone can help me with this. I have set up Suse 6.2 to act as our gateway to the internet for email and web access. I have enable IP_Masq and I have also closed of most ports (only 515 & 22 are currenlty open) any way if no other services are running on any other ports is it necessary to enable IP Chains. >From reading IP_Chains, IP_Masq and Firewall howto's there is usually only mention (that I can recall) of using IP_Chains to restrict access to certain ports. Now if I don't have any ports open is it necessary to run IP_Chains, as from my understanding (or maybe lack of) if the service isn't running then you can't connect to it anyway. Is my thinking correct? Also on another note will I encounter any problems retrieving email using Exchange 5.5 (on NT 4.0) through the gateway. As what I understand is that SMTP works by 'forwarding' email to the recipient - how will the gateway be able to determine where to send it. (ATM using Sendmail or other derivative is not possible) I apologise if I haven't made a lot of sense or omitted anything, just trying to implement a better system as well as learn different (if not better) ways of doing things. Thanks, Mark

1 0

kernel log "martian destination"
by Tim 02 Feb '00

02 Feb '00

Hi ! I'd like to ask you a little question about the kernel log "martian destination" I found this in my logs today : "hostname kernel: martian destination ae8b0000 from 71f7ae8b", dev eth0 can somebody tell me what the meaning of this is ?! Regards, Tim

2 1

language barriers
by brian-suse＠stech.cx 02 Feb '00

02 Feb '00

4 3

Re: AW: [suse-security] POP3 with Outlook SSL
by Walter Krohe 01 Feb '00

01 Feb '00

Hi Bastian, > So, what do they look like? My keys have 3 sections: > -----BEGIN RSA PRIVATE KEY----- > [....] > -----END RSA PRIVATE KEY----- > -----BEGIN CERTIFICATE----- > [....] > -----END CERTIFICATE----- > -----BEGIN DH PARAMETERS----- > [....] > -----END DH PARAMETERS----- My key has only 2 sections -----BEGIN RSA PRIVATE KEY----- [....] -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- [....] -----END CERTIFICATE----- made by this command: openssl req -config /usr/ssl/openssl.cnf -nodes -new -x509 -keyout my_cert.pem -out my_cert.pem -days 365 > > - changed /etc/inetd.conf as described > > maybe you want to post these lines? pop3s stream tcp nowait root /usr/sbin/tcpd /usr/sbin/sslwrap -cert /usr/ssl/certs/my_cert.pem -port 110 > > - added secure ports to /etc/services > > That is > imaps 993/tcp # imap4 protocol over TLS/SSL > pop3s 995/tcp # pop3 protocol over TLS/SSL (was spop3) > for me, right? Right. > > Forcing my Netscape to use TSL/SSL returns a lapidar message "Mailserver > > seems not to work bla bla bla" instead of sending mail. > > AFAIK, Netscape just talks SSL with IMAP4 servers, SSL with POP servers is > not yet implemented - at least in the linux versions. mhh - I use the Win version 4.5. If so - I would not expect with the pop3 setting in Netscape-cfg that SMTP is not working. But I dont't know... A little, little bug must there be ;-) ... -- Walter Krohe, wk(a)u2me.de Schwabstrasse 20, D-73760 Ostfildern voice +49 711 3428 926, fax +49 711 3428 928

1 0

Re: [suse-security] POP3 with Outlook SSL
by Bastian Friedrich 01 Feb '00

01 Feb '00

(Walter, after the rejection from majordomo(a)suse.com because of a different sender adress, I added two lines here :)) On Tue, 1 Feb 2000, Walter Krohe wrote: > - Paket sslwrap installed IIRC we were talking about stunnel, not sslwrap. stunnel works fine for me (although I just tested imap/SSL due to the lack of a SSL-enabled POP3-MUA). > - Key created as described in /usr/doc/packages/sslwrap/README.SuSE So, what do they look like? My keys have 3 sections: -----BEGIN RSA PRIVATE KEY----- [....] -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- [....] -----END CERTIFICATE----- -----BEGIN DH PARAMETERS----- [....] -----END DH PARAMETERS----- > - changed /etc/inetd.conf as described maybe you want to post these lines? For stunnel, I use imaps stream tcp nowait root /usr/local/sbin/stunnel stunnel -l /usr/sbin/imapd imapd pop3s stream tcp nowait root /usr/local/sbin/stunnel stunnel -l /usr/sbin/popper popper -s (pop3 is untested) > - added secure ports to /etc/services That is imaps 993/tcp # imap4 protocol over TLS/SSL pop3s 995/tcp # pop3 protocol over TLS/SSL (was spop3) for me, right? > Forcing my Netscape to use TSL/SSL returns a lapidar message "Mailserver > seems not to work bla bla bla" instead of sending mail. AFAIK, Netscape just talks SSL with IMAP4 servers, SSL with POP servers is not yet implemented - at least in the linux versions. Bastian -- Bastian Friedrich bastian(a)bastian-friedrich.de Adress & Fon available on my HP http://www.bastian-friedrich.de/

1 0

Re: [suse-security] Application Firewall. (fwd)
by Volker Wiegand 01 Feb '00

01 Feb '00

Hi all, sorry, I was not able to follow this list for a few days. The TIS FWTK is a good starting point, but I see one difficulty: you are not allowed to provide support for it (we went through it with NAI before) which is the reason why I wrote the FTP-Proxy. Apart from that, the FWTK lacks some concepts I wanted to have: LDAP-config, RegEx for FTP-Cmds, GNU AutoConf, and several others. Anyone can use the FWTK, but they have to do all changes on their own. The SuSE Proxy-Suite is an ongoing project with new components right now being worked on. Next to release are a Virus-Scanner for SMTP and FTP, plus proxies for Telnet (incl. S/Key), SSH, LDAP, and a Generic-Proxy (a la Plug-GW). All of those are nearly finished. If I only had more time to spend on it, there would be way more components available by now. I am also thinking about an HTTP proxy with a config interface (LDAP) what to allow/forbid, based upon URL+Client+Protocol (like JavaScript, ActiveX, ...). Dunno if this would be regarded as useful? I am wide open for suggestions what to do additionally (best would be more contributors of course :-) or any changes in priority. Just let me know. Please include my address directly, as I might not always be reading each and every posting on the list [Sorry]. Maik Außendorf <Maik.Aussendorf(a)suse.de> is our expert for virus scanners. If not done already, anybody interested in the topic might want to contact him. Volker -- Volker Wiegand Phone: +49 (0) 6196 / 50951-24 SuSE Rhein/Main AG Fax: +49 (0) 6196 / 40 96 07 Mergenthalerallee 45-47 Mobile: +49 (0) 179 / 292 66 76 D-65760 Eschborn E-Mail: Volker.Wiegand(a)suse.de ++ Only users lose drugs. Or was it the other way round? ++ ---------- Forwarded message ---------- Date: Mon, 10 Jan 2000 11:15:18 +0100 From: Rainer Link <link(a)foo.fh-furtwangen.de> To: suse-security(a)suse.com Subject: Re: [suse-security] Application Firewall. Stephan Gerling wrote: Hi! > Is the SuSE Proxy Suite it too ???? Well, the SuSE Proxy Suite contains yet only an FTP Proxy, see http://proxy-suite.suse.de > What is about NNTP, SMTP, Netmeeting, Telnet.... Are there Proxy´s too ???? Hmm, what about the TIS FWTK (www.fwtk.org) or the Juniper Firewall from Obtuse (www.obtuse.com/open_source/). Imho there's a lack of (good) Application Gateways for Linux - but maybe this changes with the SuSE Proxy Suite?! :-) > What´s about Virus/Trojan or ActiveX and Script Scanning on an Firewall Gateway under Linux. > Are there any tools avaible for free or only commercial Produkts ??? Commercial: Trend Micro's InterScan VirusWall (www.antivirus.com), but it does not work with SuSE 6.2 (I have reports, that it does not work with 6.3, too), because it was developed for RedHat 6.x (I hate it, if software does only run with a specific Linux distro). Well, limited to eMail Gateway, either AMaViS (GPL), IspMailGate, Scan4Virus (GPL) or H+B EDV AvGuard (commercial, imho). AMaViS can be found at http://amavis.org - but please have a look at http://www.ce.is.fh-furtwangen.de/~link/security/amavis-patch.php3 and especially http://www.unixzone.com/virus/ IspMailGate is a Perl Module, see (your local) CPAN-Archive. Scan4Virus (works only with qmail), see http://www.geocities.com/jhaar/scan4virus/ AvGate is still beta (currently 0.7, IIRC), see ftp.antivir.de/linux/ I would recommend AMaViS, but, well, I'm biased :-) You may also have a look at: http://www.ce.is.fh-furtwangen.de/~link/security/av-linux.php3 http://www.ce.is.fh-furtwangen.de/~link/security/hotlist.php3#Linux HTH best regards, Rainer Link Maintainer Mini-FAQ "Antivirus software for Linux" Member of the AMaViS Development Group -- Rainer Link, eMail: linkra(a)fh-furtwangen.de, WWW: http://rainer.w3.to/ Student of Communication Engineering/Computer Networking, University of Applied Sciences,Furtwangen,Germany,http://www.ce.is.fh-furtwangen.de/ --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0