March 2000 - openSUSE Security - openSUSE Mailing Lists

named can't write to named.pid
by Jurjen Oskam 06 Mar '00

06 Mar '00

Hello everyone here, I'm posting this in this mailinglist since my problem showed up when I updated BIND to the latest version provided by SuSE. Since then (presumably because it doesn't run under root privileges anymore?) named complains: Mar 6 00:25:02 calvin named[5129]: couldn't create pid file '/var/run/named.pid' I already tried to make named.pid owned by user named. What to do here? -- Jurjen Oskam * ICQ 11573303 * http://www.stupendous.org/ for PGP key assassinate nuclear iraq clinton kill bomb USA eta ira cia fbi nsa kill president wall street ruin economy disrupt phonenetwork atomic bomb sarin nerve gas bin laden military -*- DVD Decryption at www.stupendous.org -*-

1 0

RE: [suse-security] Security announcements
by Paxton, Michael 06 Mar '00

06 Mar '00

> On Mon, 6 Mar 2000, Jussi Laako wrote: > > > I'm viewing it from statistical point of view. Let's say that 10 > crackers > > know about the vulnerability (if we don't announce it to whole world), > it's > > not very likely that YOUR system gets hacked. But if we announce it, > then > > about 1000 or 10000 crackers will know about it. Now it's much more > likely > > that YOUR system gets hacked? > Just an observation, but if 10 crackers know of a vulnerability then pretty soon it will be on a web site somewhere and the 1000, 10000 or 100000 will be just around the corner. They certainly wont feel any need to be discrete about it. It is certainly something that needs to be kept in mind when formulating a bug alert policy..

1 0

Kevin Mitnik
by Master9116＠aol.com 05 Mar '00

05 Mar '00

I thought that everyone would be interested in this. For those of you who don't know this particular person, his name is Kevin Mitnik, and he is/was one of the most notorious hackers ever. In 1995, he was arrested and brought up on federal charges for unauthorized computer access. He now seems to be reformed and has provided testinomy in person to a United States Congressional Commitee for Computer Security. Below is the link for the transcript of his testimony. http://www.senate.gov/~gov_affairs/030200_mitnick.htm Dan.

1 0

Forget
by Peter Hiltz 04 Mar '00

04 Mar '00

Since I ran the harden-suse script, I've begun to get many error messages indicating a command called "forget" has not been found. I can't find a reference to it anywhere obvious to me. Can anyone point me in the right direction? TIA. Peter

1 0

apache ssl with suse6.1
by alex medvedev 04 Mar '00

04 Mar '00

hallo, did anybody try to configure ssl with apache? i installed apassl and ssleay. followed the instructions in README.SuSE. genereated the key and edited the httpd.conf file. now when i try to connect on the secure port, first time it asks to accept certificates (i do so), then it says that "Netscape has encountered bad data from server". i also read the apache+ssl+php howto --> looks like my config is ok, but still get the error. help is greatly appreciated. -alexm the bandwidthwaister

1 0

SSH or SRP
by Victor Sturgeon 04 Mar '00

04 Mar '00

Ive a question, and need some advice. I need to secure a linux development box. It is on the web, and requires to offer telnet, ftp, http and possibly vnc. I have been looking at Stanfords SRP package and open ssh. Which will suit my needs better or should I use both, or or there alternatives. -- Victor Sturgeon Software Engineer & Computer Systems Consultant victors(a)enteract.com

1 0

ssh with chroot ?
by DEMERRE DIETER 03 Mar '00

03 Mar '00

-----BEGIN PGP SIGNED MESSAGE----- Hi, Some months ago, as I seem to remember, there was a thread about creating ssh-logins with limited file-system access (even a proper file-system). I then noticed it, and thought it could be interesting, but apparently I didn't save these files. Is there anybody in the neighbourhood that could dish up these messages ? or a conclusion, a direction to follow so I can offer people access to a (very limited) portion of my filesystem. I would like them to have e.g. chroot /tmp/unsecure_root /bin/sh as shell, but I keep getting an error-answer /usr/sbin/chroot: cannot execute sh: No such file or directory What am I doing wrong ? ******* Groetjes vanwege ***** Greetings From ******* Dieter Demerre - http://www.angelfire.com/de/ddemerre ddemerre(a)acm.org - ext.dieter.demerre(a)siemens.be - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com> mQENAzhXiLAAqQEIAMsoaNcCZFHswGBK1J4dRJvjUA7XwIICCKIKwU1HZIz5meGk rbSgfK3SwJaqQOTRveKjPYtiZ7D6H19bjsO+P9bvdvEZHLC4dCQIvJfSMlcvSvLN 2S/wpfqaDZBsFDk2WnBmah9wilrm3QE4ATbWgGDeRd/XvPuRNc10FiZjRnEp5h+1 PcBppgljLhlJuBFEKxEXxjUsyBTl1zM3Gex8u+vNvg80DtlnlUB7Kc++JkJOSa3e 7FZAN7WEXztH9rKQmeCc/a1S00zHoPBeJnsfhjaX/nUhL2MH0AfTn0fX2W7LxgEQ J9MJhxr8Ejlsj+a5wQD2OFGk4Ttn4ftB++EuukMABRG0IURpZXRlciBEZW1lcnJl IDxkZGVtZXJyZUBhY20ub3JnPokBFQMFEDhXiLDh+0H74S66QwEBr2MIAJyuK5vb 4gMBZNelDedU53df23VfyrychlEH5E2fudaqpt3pspCQgX78KK4vLWsFr9ycUUYF 0FdTQBCUuhvj8BShexU9VocxjuoSaNuNwMqNZCWIAWx3OksvkTiNmXUC8rswxYKu Z81O8LQifpjSe4tifAoZvdSBjrvKNyx6UfAWLrYlaUOmzxzRtulIIW8L429aU//a ivhdBmBs4TKR9/NTCwI1Z/OY8Kc46keOI4cmdTNDGDYjlZHNi7UG8kj4XxajL40o 6yLY7m2TfXBbRB2aK10CjinpPhi+Vk6fA3KJ9/a4am4o2Oe8Tvqm8DPp0BM4VuyW dT7wQMNZk5WW0Ho= =kTdL - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com> iQEVAwUBOL+bKeH7QfvhLrpDAQG71wgAx/PqCxap9wz5eyhIG7bSLqcZj9Vecuoq 2DUxOrOnEvpyt1lU+8tblxc4ltJd4VNNLFwSfAZR2JC2ns4/mrYNr82dJfT2qJvM F4RoTcaGAcvRao94BfeYR8gEM3vADk03cebA0HkoL/De2rLmFvsSM9ec7FMZNfVt /sdCo3Qn91emdFiakmmfQXekW1TnWZAlJZP2dZg0pEDeJwfceeK0S5bBZj8WEW7q ffnKSdx8t5Gvs57MHOxBzTKRE1f0nJRvMblYurkmjY/kom9WHDUlddRWmv0jFEDl fcdsvIVdxrHFg9srrB0o1ghVi0K7wd47MXZe+/ZzY0GPNe+1+mUJ/A== =Ghi/ -----END PGP SIGNATURE-----

3 2

Damn multi-spam (was: Re: [suse-security] EICAR2000)
by Hans v. Sommerfeld 03 Mar '00

03 Mar '00

Hi all, although I did the initial posting I'm just a victim of the mail-loop like you. Anyway I'm very sorry for unintentionally causing all this spamming mail-loop. Hopefully aleph1(a)SECURITYFOCUS.COM, firewalls-owner(a)lists.gnac.net, suse-security-owner(a)suse.com were/are able to stop this soon. I did inform them as soon as possible. That in no way says that one of them or gmx.net caused the problem. Maybe no list-sever or server listed and/or posted is/was the solely cause. But I didn't cause it solely myself. There has to be some inability in between. My system is disconnected most times of the day from internet. I did post once. Also I checked my sendmail-logs and they show not any bouncing or looping. If you please check the _full_ mail-headers you will recognize that the bouncing host is out of my sphere of responsibilities. B.T.W. I do have to tolerate impatient or flaming replies. That's ok. I do not tolerate racist, fascist or dumb 'german-nazi' replies. HvS

1 0

funny popper-entry
by Webdirekt Sysop 03 Mar '00

03 Mar '00

ps x | grep sendmail: 4837 ? S 0:00 sendmail: accepting connections on port 25 5719 ? S 0:00 sendmail: QAA05358 blackmail \ .fth.sbs.de.: user open along with a "connect from unknown" and a "fromless" mail in the maillog. That a problem ? thanks dan -- ----------------------------------------------------------- ~ WEBDIREKT INTERNET SERVICE GMBH ~ ~ the e-business intelligence company ~ ----------------------------------------------------------- ~ Dieselstr. 5 Fon: (+49) 6173 / 9359-88 ~ ~ D-61476 Kronberg Fax: (+49) 6173 / 9359-59 ~ ~ http://www.webdirekt.de mailto:sysop@webdirekt.de ~ -----------------------------------------------------------

2 1

EICAR2000 Conference in Brussels, Belgium, EU. March 4th-7th, 2000
by Hans v. Sommerfeld 02 Mar '00

02 Mar '00

*** 9th EICAR Annual Conference Brussels, Belgium, EU. March 4th-7th, 2000 *** -------------------------------------------------------------------------------- ** Saturday, March 4th and Sunday, March 5th two workshops in parallel: Workshop 1: Inforsec 2000 by Mich Kabay Workshop 2: CIRT (Computer Incident Response Team) by Peter Stephenson ** Monday, March 6th, plenaries: "When Worlds Collide, Information Sharing" Sarah Gordon, Richard Ford, USA "We Have to Destroy Privacy in Order to Protect Privacy" T. Schlickmann, European Commission, DG Enterprise, Directorate D, Unit 4 ** Monday, March 6th and Tuesday 7th three tracks in parallel: Track 1: Virus and Malware Track 2: Security Trust and E-commerce Track 3: Securing the Internet ** Tuesday, March 7th, plenaries: - `Gate Expectations' : Groupware Anti-Virus Scanners - Panel: European Privacy Directive, Echelon, How should Internet be changed *** You may visit the open EICAR meetings and ad-hoc workgroups as well! -------------------------------------------------------------------------------- ===> Make a last minute registration at <http://www.eicar.dk/registration> -- 9th EICAR Annual Conference Brussels, Belgium, EU. March 4th-7th, 2000 --- <http://www.eicar.dk/> eicar-online: <http://www.eicar.org/> --- H. von Sommerfeld <mailto:snoopy@redbaron.bir.uunet.de>

1 0