March 2000 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

multi-services server securing
by Gediminas Grigas 16 Aug '00

16 Aug '00

Hello there, I feel erroneusly (?) secure after .host.denyed in.telnetd and in.sshd from everywhere except one pc, which is denying all exept keyboard. I belive that if i can keep hosts.deny and hosts.allow files safe, and from time to time patch most actual security holes i`ll be conditionaly safe. Em i wrong? Probably I do. I just cant imaginate how system can be cracked in lower stage, so that is my problem. I heard that inetd is very insecure, and some peoples using tcpd (or soundlike). I run harden_suse, but was forced to answer 8/10 to no, as my server should provide a lot of public services, and have world writible directories as well. And thats right - this script was developed not for systems like mine one. However i`ll run SuSE-firewall-3.0 script, to make my system even stronger. But thats all. I dont know what can i do else. I should keep folowing services open: httpd; smptd; pop3d; ftpd; snmpd; named; inetd; sshd; nscd. So if you know how to keep them at minimal risk, or know some holes at those, i would be very gratefull for any info and/or tips. I dont ask to do work for me - link to good manual would be nice too. By the way i have SuSE 6.3 (2.2.13). Thanks in advice. Sincerely Yours, Gediminas Grigas mailto:gedas@kryptis.lt

5 5

possible security problem with weak perms on /dev/fd[01] in suse 6.3 distro
by techno＠crosslink.net 20 Apr '00

20 Apr '00

Hi. I thought I would notify you of my findings on a possible security problem within suse 6.3. Below is an excerpt about /dev/fd[01] permissions that I wrote a few days ago. I'm not sure if this has been noticed before. If not, I hope the information does you some good. I'd appreciate any responses on the matter that you can give, thanks :). [cut] Out of the box, SuSE 6.3 allows global rw access on the primary and secondary floppy drive (/dev/fd0 and /dev/fd1). Because devices can be written to directly, just like anything else, the floppy drives do not need to be mounted for any user to write data to a disk that has been left in the drive. Depending on the systems setup, this can be a very malicious tool. If the system boots SuSE directly from a floppy disk, chances are the disk is left in the drive while the system is up. If a user were to log on, and decide to use 'dd' (amongst a variety of other tools, or even just a 'cat FILE > /dev/fd0') the boot floppy would be ruined. A lazy sysadmin who didn't check the logs would not see that the bootdisk had been ruined, and upon reboot, may find himself with a dead box until the disk can be replaced. This is just one scenario where the weak perms on the devices can be dangerous. I just recently noticed this after installing SuSE 6.3 on one of my systems over a month ago. The permissions on /dev/fd[01] have been checked on several SuSE 6.3 systems and all check out as o+rw. If you are running SuSE 6.3 and have users other than yourself logging in, your best bet is to 'chmod o-rw /dev/fd0'. I cannot think of one good reason why SuSE would have set permissions on /dev/fd[01] so weak. If you can give any suggestions or feedback, an e-mail would be appreciated. -- Bryan Hughes init(a)crashdot.org

4 3

syslog doesn't log after rotation
by Michael Balzer 18 Apr '00

18 Apr '00

dear suse security team, on my standard suse 6.3 internet server, i have to do "/sbin/init.d/syslog reload" after any log rotation. if i don't restart it, syslog will not write to the new log files. this is a security issue, as i cannot track security problems without log entries. i already sent this as a bug report to suse a long time ago but never got any response. what can i do? regards, michael balzer -- b&b computersysteme * kämperheide 10 * 58285 gevelsberg * germany fon +49 2333 913924 * fax +49 2333 913925 * http://www.bbcomp.de

6 7

passwords limited 8 characters
by Ertan Sekmen 18 Apr '00

18 Apr '00

hello, is there any probram come with suse 6.3 to allow users have password more than 8 characters, or do i need to compile ? Is this called md5, ?

6 8

mouse permissions
by Peter Münster 18 Apr '00

18 Apr '00

Hello, on SuSE 5.3 /dev/psaux (PS2-mouse) was read and write for all users, now (with SuSE >= 6.2) it's read only (perms = 664). Is there any risk, to enable write permissions again on this device? (quake needs it! ;) Cheers, Peter -- Peter Münster **** Brittany **** France URL: http://gmv.spm.univ-rennes1.fr/~peter/

3 3

How to decrypt shell code of an exploit?
by Frank Derichsweiler 18 Apr '00

18 Apr '00

Hi list, the box of a friend was hacked: /bin/ps /bin/login /bin/ls were replaced / trojaned. The original files were placed in /bin/bincp (which is not shown by ls, but cd into that dir works fine) Luckyly I found some source within a log of another machine. Comments show that there is an unsigned char shellcode[] = with some rows of "\x ...\x" numbers. I assume that there is the coding of a shell command. Unfortunately I do not know how to "read" the command. Translating the hex numbers into decimal and using an ASCII table does not give a usefull result. Any idea? Tips who to detect which root kit was used are welcome, too. TIA Frank

7 9

login & password aging
by Schoeberle Daniel 04 Apr '00

04 Apr '00

Hi! I have a problem concerning password aging on SuSE 6.3. If a password expires the user is prompted for the new password at the login time. The problem is that he/she can enter an empty one just by hitting Enter twice. No checks for minimum password lenght, no cracklib checks - and these are enabled in etc/login.defs. Changing the password from the prompt works normally with all the checks in effect. So, is there a way to enable atleast the minimum password lenght check? Any comments and/or suggestions would be appreciated. Regards, Daniel.

2 1

Real bad log entry
by Chrissy 01 Apr '00

01 Apr '00

This looks terrible.. anyone have any ideas? Mar 30 20:45:00 rox /USR/SBIN/CRON[16114]: (root) CMD ( test -x /usr/lib/cron/run-crons && /usr/lib/cron/run-crons ) Mar 30 20:46:14 rox ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P Mar 30 20:46:55 rox named[380]: Cleaned cache of 57 RRsets I've got sendmail, web, named, and identd open to the world.. and pop3, ftp, ssh open to accepted ip ranges (via IPCHAINS) Please help..this sucks. Chrissy

4 5

SuSE Security Announcement - ircii
by marc＠suse.de 30 Mar '00

30 Mar '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: ircii < 4.4M Date: Thu, 23 Mar 2000 11:04:19 GMT Affected SuSE versions: all Vulnerability Type: remote user compromise SuSE default package: no Other affected systems: all unix systems using ircii < 4.4M ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The package ircii is an irc client which is used to connect to irc servers and chat with other users. A buffer overflow in the dcc chat feature was found which is exploitable by remote users. 2. Impact Remote users may execute commands as the user running ircii. 3. Solution Update the package from our FTP server. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: (For SuSE 6.0, please use the 6.1 updates) 0d928f56148aaa86c0015bbce49d3561 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/ircii-4.4M-0.alpha.rpm e06dfc1254128cb1683e0487f168bf76 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/irciihlp-4.4M-0.alpha.rpm 56e00c8e2260b2949ce0536035af479f ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/ircii-4.4M-0.i386.rpm 29d123a6ac148827c3b2de2a552f4fa8 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/irciihlp-4.4M-0.i386.rpm 10411aceecd18fc7ff7e6e5445e705ec ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/ircii-4.4M-0.i386.rpm e8d430af732bd22f8e460f1ff9f45a77 ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/irciihlp-4.4M-0.i386.rpm 773184cd39e5bffd72f8432a5efdd24f ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/ircii-4.4M-0.i386.rpm 32738de26730d7442fa1adf992bf37fc ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/ircii-4.4M-1.i386.rpm 49373ad8be6b9ef1c1c4a1c21481a639 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/irciihlp-4.4M-1.alpha.rpm 80505bfa6f08330f5a129d59ae58b51a ftp://ftp.suse.com/pub/suse/ppc/update/6.3/n1/ircii-4.4M-0.ppc.rpm 4a72afe3f807cf1da2c8859c2a3fb743 ftp://ftp.suse.com/pub/suse/ppc/update/6.3/n1/irciihlp-4.4M-0.ppc.rpm 6c2c3e7773760a9da2d2fa67b07f564a ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/irciihlp-4.4M-1.i386.rpm ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update for Intel processors ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/patches/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are sent to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOOPDCXey5gA9JdPZAQFzAgf+MbyvaBAZ3OfE2p7jZYMkvKjt3IcV0IFB hUaAGR7Ias/qxynGes6b4dJ5V5ixwynnuhwOIcuDpdGuTmuL1tk2dNGwfJ/XEp82 VK+WvWUL46/6sj0k5bnRE/7PQc1FLdu2AzR38dLJWL8cE2dp0dhr2+iZKRzvI6WV 3Y+MARye6d2ttMNSqDDc8Nk9a05XaPUKyTxlrRhdZw6ToGDh3AMRL7+maOTKQ7Hx 3IT7fPKS8RKKaKuMLd0FxDGfM48bYPjIqBQ/wcgsrpqcxoXhPMJscjNdhMzzFWUK hlO21sraQ50N7y4BJcDyshi/6XVmwjyYoet8L3QVqUHRB95t5dRZ7w== =wvxg -----END PGP SIGNATURE-----

1 0

proxy for firewall
by Rupert Koenig 29 Mar '00

29 Mar '00

hi! i'm searching for proxies for a application-level firewall - unfortunatly suse released only the ftp-proxy, the TIS toolkit isn't free for commercial use. anybody out there who knows a http-proxy to be used for firewalls? AFIK squid only does caching while proxies on a firewall should do quite more. ciao Rupert

4 4

adding users
by Jae 28 Mar '00

28 Mar '00

hey all - i appologize b/c this probably isn't the best place to post this message, but it does have a little to do w/ security. :) i need to write an application to create users on a system. basically their info is stored in a mysql database and their username, etc is generated based on a letter and their ip address (i work for a web hosting company and we assign usernames based on the last two octets of the ip they get) i was planning on running this as a daemon that accepted the domain name to be created. so - basically i was looking for info on what would be the securest way to do this and where i could find information about using functions, etc that have laready been provided to do this. thanks -Jae ** "I'm very drunk and I intend on getting drunker before it's over." -Clark Gable, Gone with the Wind

1 0

Antwort: Re: [suse-security] firewall-script doesn't start
by kai.krebber＠syseca.de 28 Mar '00

28 Mar '00

>>Does the SuSE-fw need a modular kernel? >Yes, you may want to rebuild your kernel >to load the appropriate modules, unless >you want to modify the firewall script in init.d. O.K. - Then I will completely renounce the SuSE-firewall-script. The literature says that it's not a good idea, having a module-enabled kernel on a firewall and this attitude makes sense to me. Thank you anyway, Kai

2 2

NFS on SuSE6.3
by Der Meister!! 27 Mar '00

27 Mar '00

I know it is a bit off the topic of this list but I simply don't know where to ask. I'm trying to use my linux-machine as a YP and NFS server. With SuSE 6.2 it was no problem to make my users mount the /home share on their workstations and to use YP. Now I tried to install a new server (got a new, stronger machine :-))))) using SuSE 6.3. YP works fine but when I mount the /home share I get all of the users directories, but they are empty. I simply don`t know what to do as it worked the same way on SuSE 6.2. Has anything changed in SuSE 6.3 or is it a bug? A desperate admin searching for help P.S.: At the moment I only got one entry in my exports file it is /home (works with 6.2)

3 2

../dev/gpmctl
by Ertan Sekmen 27 Mar '00

27 Mar '00

my server has no mouse, so i didn'T install gpm, in addition i have disabled them in /etc/rc.conf. But my logs still complain about /dev/gpmctl connection. Is this a critical failure that i don't know, or can be ignored?

2 1

Re: DNS Concept for DMZ
by Michael Hamm 25 Mar '00

25 Mar '00

>>>why don't you use two (ore three) DNS-servers on your application gateway: >>>the (primary and secondary) DNS-server of your Provider for internet adresses >>>and your internal DNS-server for the internal adresses? I think that should solve the problem. >>>If you're using SuSE Linux, you can change the nameservers using yast or you can edit /etc/resolve. >> >>But how did the gateway know, that for example MY-PC-NAME is an >>internal Name, and it has to be resolved by the internal DNS-Server. >> >>If I resolve Names by my Provider, the Gateway try to resolve MY-PC-NAME ><by the Provider. Yet I see no way to told the Gateway: >>"For this name try the Internal- for an other name try the Provider- DNS-Server" >> >>Michael >> >> >Ok, I see. >Your application gateway should use the internal name server(s) first; if that one doesn't know the answer it has to be configured in that >way that it will ask the nameserver of the provider (the nameservers of your internal nameserver should be the ones of your provider). >If your internal server(s) are down, then the application gateway can still resolve external names - using the second or third configured >nameserver. Okay, so I try this: 1. The Gateway try to resolve every Name by the Internal DNS-Server. 2. Internal names will be found. 3. If nothing is found, the Internal DNS-Server will forward the question to a DNS-Server running on the Gateway. 4. The DNS-Server running on the Gateway forward every question to the Providers DNS-Server. It seems to be a long way. What about the performance??? Michael

2 1

Re: Re: DNS Concept for DMZ
by Michael Hamm 24 Mar '00

24 Mar '00

> >why don't you use two (ore three) DNS-servers on your application gateway: >the (primary and secondary) DNS-server of your Provider for internet adresses >and your internal DNS-server for the internal adresses? I think that should solve the problem. >If you're using SuSE Linux, you can change the nameservers using yast or you can edit /etc/resolve. But how did the gateway know, that for example MY-PC-NAME is an internal Name, and it has to be resolved by the internal DNS-Server. If I resolve Names by my Provider, the Gateway try to resolve MY-PC-NAME by the Provider. Yet I see no way to told the Gateway: "For this name try the Internal- for an other name try the Provider- DNS-Server" Michael

3 2

DNS Concept for DMZ
by Michael Hamm 24 Mar '00

24 Mar '00

If you use an Interneal Router, an Applikation-Gateway and an External Router to build up a DMZ. What is the best way to resolve IP-Names for the Applikation-Gateway. If you resolve Names by using the Providers DNS-Server, the Gateway can not resolve Internal Adresses. If you use the Internal DNS-Server, the Gateway can not resolve Internet Adresses. Thanx Michael

1 0

Understanding IP-Forwarding with ipfwadm
by Jens Leilich 23 Mar '00

23 Mar '00

Hi, I want to forbid single Computers connection to internet. Therefore I did the following: Computer E00, wegerich www-proxy E01... 192.168.8.240--+ 192.168.8.241--+---192.168.8.8<-->192.168.254.1----192.168.254.2<-->Internet ... We use internal IP-Adresses 192.168.x.y; Router wegerich is necessary, because 2 other schools are connect via this router. www-proxy is NOT administered by us. squid is running on www-proxy, masquerading is activated on all ports, so that surfing is possible withot proxy. Now I want to disable Internet-Connection via http for a single computer by using forwarding-rules on wegerich. # disable proxy, works! /sbin/ipfwadm -F -a reject -P tcp -S e00 -D 192.168.251.2 81 # enable web-server, works /sbin/ipfwadm -F -a accept -S e00 -D 192.168.251.2 # disable rest of the world, doesn't work /sbin/ipfwadm -F -a reject -P tcp -S e00 -D 0.0.0.0 why does the last rule not work and connection (http) is possible via masquerading? Jens Leilich --- jens.leilich(a)bbst1.lu.rp.schule.de, http://bbst1.lu.rp.schule.de BBS Technik I Ludwigshafen, Franz-Zang-Str. 3-7, 67059 Ludwigshafen Telefon +49 621 504-4110 (Anrufbeantworter) (Answering Machine) +49 621 504-4101 (Sekretariat) Telefax +49 621 504-3789

1 1

firewall-script doesn't start
by kai.krebber＠syseca.de 22 Mar '00

22 Mar '00

Howdy! I just installed the Suse-firewall-pakage from german 6.3 on my PC. Unfortunately it doesn't start during boot, although I set the START_FW in /etc/rc.config to YES. A look in my /etc/rc.d/rc2.d and /etc/rc.d/rc3.d - directories revealed that there are K??firewall - links to ../firewall but none with S??firewall. >From where is the script usually started? Or should there be S?? - scripts for the fw and my installation just went wrong? One more question: It is usually recomendet to build a monolithic kernel for a firewall, which I did. Booting with this, I get a logfileentry: " No module symbols loaded - kernel modules not enabled", when I try to start the firewall manually. Does the SuSE-fw need a modular kernel? Greetings, Kai

3 3

sendmail -- sender domain must resolve
by Chrissy LeMaire 22 Mar '00

22 Mar '00

Hey All, I'm running sendmail 8.9.3 and pretty much left everything default. The spam stoppers are in full effect.. I have a question about the following: Mar 20 14:39:25 xxx sendmail[18726]: OAA18726: ruleset=check_mail, arg1=<xxx(a)bebe.com>, relay=[111.111.111.111], reject=451 <xxx(a)bebe.com>... Sender domain must resolve So i do a bit of digging: # nslookup > bebe.com Server: ns.server.com Address: ip.addy.here *** ns.server.com can't find bebe.com: Non-existent host/domain > set type=mx > bebe.com Server: ns.server.com Address: ipaddyhere Non-authoritative answer: bebe.com preference = 0, mail exchanger = bebe-mail.bebe.com Authoritative answers can be found from: bebe.com nameserver = AUTH02.NS.UU.NET bebe.com nameserver = bebe-ns.bebe.com bebe.com nameserver = BEBE-NS2.bebe.com bebe-mail.bebe.com internet address = 208.240.224.197 AUTH02.NS.UU.NET internet address = 198.6.1.82 bebe-ns.bebe.com internet address = 208.240.224.225 BEBE-NS2.bebe.com internet address = 208.240.224.210 By looking at this.. I concluded that MX records aren't looked at when deciding if a domain resolves or not. So.. I do the some testing with hospitalforms.com (which doesnt resolve but has an MX record) and it worked.. So. Am I right when I assume that bebe.com's ns servers were most likely down for a period of time? Auth02.ns.uu.net is huge.. and 3 nameservers all go down at the same time? This doesnt seem right. Any suggestions?

3 2

RE: [suse-security] sendmail -- sender domain must resolve
by Wood, Alan 22 Mar '00

22 Mar '00

Chrissy, I expect that you will always get this response, it is common for the domain not to have an IP address, after all, which machine should it tell you about? If you tried www.bebe.com, you will probably get an IP address as that will translate to an actual machine. Sendmail will always assume MX records as these are all that is relevant to it. Why should sendmail worry about the web or FTP address ;-) Alan > ---------- > From: Chrissy LeMaire[SMTP:chrissy@netnerds.net] > Sent: 21 March 2000 18:06 > To: suse-security(a)suse.com > Subject: [suse-security] sendmail -- sender domain must resolve > > Hey All, > I'm running sendmail 8.9.3 and pretty much left everything default. The > spam stoppers are in full effect.. > > I have a question about the following: > > Mar 20 14:39:25 xxx sendmail[18726]: OAA18726: ruleset=check_mail, > arg1=<xxx(a)bebe.com>, relay=[111.111.111.111], reject=451 <xxx(a)bebe.com>... > > Sender domain must resolve > > So i do a bit of digging: > > # nslookup > > > bebe.com > Server: ns.server.com > Address: ip.addy.here > > *** ns.server.com can't find bebe.com: Non-existent host/domain > > > set type=mx > > bebe.com > Server: ns.server.com > Address: ipaddyhere > > Non-authoritative answer: > bebe.com preference = 0, mail exchanger = bebe-mail.bebe.com > > Authoritative answers can be found from: > bebe.com nameserver = AUTH02.NS.UU.NET > bebe.com nameserver = bebe-ns.bebe.com > bebe.com nameserver = BEBE-NS2.bebe.com > bebe-mail.bebe.com internet address = 208.240.224.197 > AUTH02.NS.UU.NET internet address = 198.6.1.82 > bebe-ns.bebe.com internet address = 208.240.224.225 > BEBE-NS2.bebe.com internet address = 208.240.224.210 > > > By looking at this.. I concluded that MX records aren't looked at when > deciding if a domain resolves or not. So.. I do the some testing with > hospitalforms.com (which doesnt resolve but has an MX record) and it > worked.. > > So. Am I right when I assume that bebe.com's ns servers were most likely > down for a period of time? > Auth02.ns.uu.net is huge.. and 3 nameservers all go down at the same time? > > This doesnt seem right. > > Any suggestions? > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

RE: [suse-security] SSH2 pointers
by Mr. M 19 Mar '00

19 Mar '00

L. Sassaman wrote: > SSH2 is free for non-commercial use. > This is not exactly true. It would depend on your definition of commercial use. If you read the licensing of SSH2 you'll discover that they redefined what they consider to be commercial use. The license states: "NON-COMMERCIAL USE shall mean the following uses of the SOFTWARE: a) any use done outside and without connection to a commercial organization and commercial activity, b) use related to leisure time activities by private individuals, including hobbies, games, etc. provided however that such use is not commenced with commercial companies. Uses not considered as NON-COMMERCIAL USE include, but are not limited to: a) any use where commercial activity is involved and where the use in any way, directly or indirectly, aims at monetary or other commercial benefit, b) any use that takes place in commercial, governmental, military, or similar organizations and where a salary or similar monetary compensation is paid, unless the use can be considered to be EDUCATIONAL USE or is purely for charity." jonathan stated they he wished to use SSH2 to get files from work. This activity would violate the SSH2 agreement. Mario

1 0

ssh w/ chroot
by Security Webmaster OKDesign oHG 19 Mar '00

19 Mar '00

Hi, I know, this topic was already discussed several times. Can anyone point me to an URL from where I can get infos about how to use chroot for ssh-connections ? TIA --- Stephan

1 0

SSH2 pointers
by jonathan 19 Mar '00

19 Mar '00

I just downloaded ssh2 and installed it, and I am looking for some pointers from folks who have set it up in the past. I did not use the rpm from the suse, I got it from ssh.org and compiled local. I would rather learn from someone else getting cracked than learn the hard way. I am using SuSE6.3, kernel 2.2.13. I want to be able to have it running on the firewall and file server (2 separate machines), so I can get to my files from work via the internet. Any and all suggestions welcomed. TIA

2 1

[suse-security] chroot
by Timo Schulz 18 Mar '00

18 Mar '00

The harden_suse script says the following: "put every daemon in chroot and try to run them unpriviliged" Does anybody know where I can get more infos about the chroot program and running daemons unprivilged? ( I looked at the manpage and the info text, but they werent't really informations about this ) Thanks. -- Two-a-Day at joesixpack.net www.freenet.de/joesixpack keyid BF3DF9B4

1 0

Opening the firewall for playing games
by Frank Hart 17 Mar '00

17 Mar '00

Hi all, What is the most secure way to open the firewall for playing games on Heat.net? They request access to several ports, so I've added the IP adresses of Heat.net to FW_TRUSTED_NETS="194.176.220.0/24 208.213.56.0/24" and they have access to all UDP ports. Is there a way to limit this access? -- Frank Hart - mailto:frhart@home.nl SuSE Linux - Kernel 2.2.14 on a i586 100 Mhz with 24 Mb RAM -- "What is wanted is not the will to believe, but the will to find out, which is the exact opposite." -- Bertrand Russell, "Skeptical_Essays", 1928

1 0

Re: [suse-security] Understanding IP-Forwarding with ipfwadm
by Grant DuVall 17 Mar '00

17 Mar '00

Your problem may be the order in which your place the rules. Try putting the last line in first. Deny everyone first then poke holes in it. Most firewalls have some sort of precedence. Thanks, Grant DuVall medibuy.com Network Administrator

1 0

Firewall and Proxy Server HOWTO
by Sloate, Arthur 16 Mar '00

16 Mar '00

I am attempting to follow the 'Firewall and Proxy Server HOWTO' written by Mark Grennan, but have been running into a problem in section 6.4. When pinging the outside address of the firewall from a computer on the LAN, it works. At this point of the test process, it shouldn't. IP Forwarding is turned off, and I have turned off IP Masquerading. Can anyone provide me with some guidance? Cheers, Art Sloate

1 0

RE: [suse-security] *WANTED: ipchains guru*
by KULISHdotCOM 16 Mar '00

16 Mar '00

Guess I should have made that a little clearer ;). I am wanting to figure this out from scratch. I am trying to break out of the *Windows Only* frame that I am in concerning security that I recommend to clients. Right now, I recommend Raptor, Firewall-1, or MS Proxy depending upon the situation. Being able to configure ipchains from scratch would be a great solution for clients on a limited budget. Thanks for the reply though! CK -----Original Message----- From: robert(a)texas.net [mailto:robert@texas.net]On Behalf Of Robert C. Paulsen, Jr. Sent: Tuesday, March 14, 2000 8:04 PM To: KULISHdotCOM Subject: Re: [suse-security] *WANTED: ipchains guru* KULISHdotCOM wrote: > > Looking for someone to take a look at my ipchains script. I don't want to > post it on the list as it is kind of long. A little background is in order. > > I want to setup an ipchains firewall to do the following: > > Deny everythind that is not explicitly allowed. > > I have a server sitting behind it that will host pop3, smtp, www, and ftp so > I will need to forward all these ports. > > I want to allow everyone on the local network to ANYTHING out on the > internet. > > I want to log any denials and protect against IP spoofing (and anything else > that might be dangerous). > > If anyone is willing to help, I will send them my annotated script to take a > look at. I do realize that some things are missing (probably the stuff I > need help on). > > I have read all the HOW-TOs that I can find but something isn't clicking. > I would start here: ftp://ftp.suse.com/pub/suse/i386/update/6.3/sec1/firewals.rpm It will take a little thought and work to get it set up, but not as much as trying to do the whole thing yourself. -- ____________________________________________________________________ Robert Paulsen If my return address contains "ZAP." please remove it. Sorry for the inconvenience but the unsolicited email is getting out of control.

3 2

Re: [suse-security] *WANTED: ipchains guru*
by Chrissy LeMaire 16 Mar '00

16 Mar '00

> > I think you mean forwarding ports to other machines (as opposed to >just redirecting them on a particular interface/machine). Oui :) > As for ipchains, i think it can do port forwarding itself-- this >is from /sbin/ipchains --help: > > --destination -d [!] address[/mask] [!] [port[:port]] > destination specification The destination, as far as I know is where the packet is headed. For instance, one of my chains says /sbin/ipchains -A input -p tcp -s 0/0 -d 192.168.0.1/32 80 -j ACCEPT "if the source of the packet is coming from any ip (0/0) and its destination is port 80 my own ip (192.168.0.1) ..accept it." I fiddled with getting ipchains to do what redir does a few months ago..and did not get anywhere. ipchains can be used to redirect (-j REDIRECT) one port to another (ex. 192.168.0.1:80 -> 192.168.0.1:21), on the same IP address..but not to another IP address.. Chrissy

1 0

*WANTED: ipchains guru*
by KULISHdotCOM 16 Mar '00

16 Mar '00

Looking for someone to take a look at my ipchains script. I don't want to post it on the list as it is kind of long. A little background is in order. I want to setup an ipchains firewall to do the following: Deny everythind that is not explicitly allowed. I have a server sitting behind it that will host pop3, smtp, www, and ftp so I will need to forward all these ports. I want to allow everyone on the local network to ANYTHING out on the internet. I want to log any denials and protect against IP spoofing (and anything else that might be dangerous). If anyone is willing to help, I will send them my annotated script to take a look at. I do realize that some things are missing (probably the stuff I need help on). I have read all the HOW-TOs that I can find but something isn't clicking. Thanks for any HELP! CK

4 4

which ssh vs. to use?
by Jan Kr�ger 16 Mar '00

16 Mar '00

-----BEGIN PGP SIGNED MESSAGE----- Hi, has anyone suggestions about which ssh version is "better" (e.g. more secure) to use: the last open source (is it?) version 1.2.27 or the proprietary 2.0.xx, except that open source code is more transparent? - -- The fjutscha is unwritten! - - PGP- or GnuPG-Key on request - -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOM+0sEjWXFgvINoZAQGm8AgAiwCpvUbQnaOqCwacclWL6oTquqkkNcPy H9OcYVxuMN7qDNt34nocJCgmM8kElzny/dEbM8PcD/3yFTuy95jEpglMHr9VajnV 8MCOshoYtPlAlzq8T5jiY4+Lu50B8m9akrJIV5XQFjKcaF7ywPjLUoHfeklmOHzR JHmZ1XY6Q+2IvVhNp5wQa7ixCL83YGcylzfQeMezRnI+4glPpWbxa0siP7UDOzt7 XO6CvVW1uuHxiOjYy3QdugrpodBvoyJvc/eFCvzSNftjCIkeRfoXKq4sms9X7DMv 5GuVyBvB+YpqZlTwvo2Q/ymz2CyUpIzlZcvYxtW8Wcg9WpWss8Um5Q== =ajf2 -----END PGP SIGNATURE-----

4 3

SuSE Security Announcement - SuSE Linux IMAP Server
by marc＠suse.de 15 Mar '00

15 Mar '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: SuSE Linux IMAP Server Date: Wed Mar 15 20:41:42 CET 2000 Affected SuSE versions: SuSE Linux IMAP Server Vulnerability Type: remote unauthorized access SuSE default package: not a SuSE Linux Distribution package Other affected systems: no ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Please note that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description A vulnerability in the SuSE Linux IMAP Server - which is unrelated to the SuSE Linux Distribution (which is unaffected) - was found which allows remote users to circumvented the imap authentication. 2. Impact An attacker can receive imap administrator privilige which can be used e.g. to create or delete folders. 3. Solution Install the security fix from our FTP server. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: bf746792686246b631996af8144f45d2 http://www.suse.de/de/produkte/susesoft/imas/imasupd/secfix.tgz ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update for Intel processors ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors or this special update at: http://www.suse.de/de/produkte/susesoft/imas/imasupd/secfix.tgz or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/patches/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are sent to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOM/tAney5gA9JdPZAQGcGgf+MLJKh9b/0INnZNAEJqHhtcJa4BI48iaE zrK6gDpGp85ZP2vvWieueXcPnUgN+GmgmI1TNynEMf2vJqojz28i8VsDxdHHKY81 rr/eIAyMkS3IXaXi9ROqfH0oVMD1rtRHtbce4akyJAKNHKo3pLM1ZNIhVygb8xkK LBM9QgsOq1VGB17A8ySXLuAJfVmOioVPkoE8JbCokJHnWk4nMZElVzuJyqSVvRvl b4T8wL5Qf/Ys8QoW0y4/eXe/7akuUIxw4ue9AcZIRBgRM1PbO8neUzE8EE/e4zoJ SKpA25AVWmTw4SAUdvd4tfBRetCXQOZq2VkcyEGjxm/rhC58/456VQ== =J/mX -----END PGP SIGNATURE-----

1 0

Why did SuSE pass this one up?!!
by Fred A. Miller 14 Mar '00

14 Mar '00

Linux Platforms to Add Tripwire Three suppliers of Linux operating systems plan to add Tripwire intrusion detection and prevention software to boost security. http://www.techweb.com/wire/story/TWB20000302S0022 http://www.zdnet.com/zdnn/stories/news/0,4586,2453339,00.html -- ----/ / _ Fred A. Miller ---/ / (_)__ __ ____ __ Systems Administrator --/ /__/ / _ \/ // /\ \/ / Cornell Univ. Press Services -/____/_/_//_/\_,_/ /_/\_\ fm(a)cupserv.org

5 5

Firewall 2.0: Samba services
by Daniel Mehrmann 13 Mar '00

13 Mar '00

Hello, With Firewall 1.4 and 2.0 i have a problem: The SuSE Firewall blocking all SAMBA pakets from my internal network :-(( My system has 5 Networkcards. All pakets from my local networks, e.g. 192.168.1.0:138 -> 192.168.2.0:138, will be blocked :-(( When comes a bugfix ? greetings daniel

3 5

Re: [suse-security] Strange kernel message
by Jan Hildebrandt 13 Mar '00

13 Mar '00

> Hello Jan, > > Jan Hildebrandt writes: > > This is probably not directly security related and might be > > off-topic - but today I discovered a strenge kernel message in > > /var/log/messages of our central file server running SuSE Linux 6.2: > > > > Mar 10 12:01:23 xxx kernel: eth0: Something Wicked happened! 000a. [...] > > I had the same effect with several ethernet cards with VIA VT3043 > Rhine chips. I think it is a driver problem. > After this Kernel-Message there goes nothing over that interface. Thanks for the info - uhm, we would have noticed if the NIC had been down after that kernel message - it's our central server as I said ;-) We have no problem with the network traffic itself - no packet loss at all (thank goodness...). So it seems to be a problem with the driver module, no security issue - and as long as the server continues to serve our data I won't have to worry. Jan -- jan.hildebrandt(a)mathema.de MATHEMA Software GmbH (http://www.mathema.de) Nägelsbachstraße 25a D-91052 Erlangen, Germany Tel: (+49)9131/8903-0 Fax: (+49)9131/8903-55

1 0

Strange kernel message
by Jan Hildebrandt 13 Mar '00

13 Mar '00

This is probably not directly security related and might be off-topic - but today I discovered a strenge kernel message in /var/log/messages of our central file server running SuSE Linux 6.2: Mar 10 12:01:23 xxx kernel: eth0: Something Wicked happened! 000a. There have been logged several such messages (000a as well as 0009, 000b) during the last days. It's a 10/100 NIC running with the via-rhine module: Feb 27 17:03:19 xxx kernel: eth0: VIA VT3043 Rhine at 0xb800, 00:40:05:a5:2f:54, IRQ 10. Feb 27 17:03:19 xxx kernel: eth0: MII PHY found at address 8, status 0x782d advertising 05e1 Link 40a1. I'm a little worried now (maybe I'm just paranoid ;-)) - can someone of you tell me what this message means? Thanks in advance, Jan Hildebrandt -- jan.hildebrandt(a)mathema.de MATHEMA Software GmbH (http://www.mathema.de) Nägelsbachstraße 25a D-91052 Erlangen, Germany Tel: (+49)9131/8903-0 Fax: (+49)9131/8903-55

1 0

Sendmail
by Leon van Heerden 12 Mar '00

12 Mar '00

Is there any securtiy reasons why frontpage extentions for apache has not been released as SuSE packages? If so , what are they ? Leon.

2 1

firewall
by als 12 Mar '00

12 Mar '00

Hi , i installed Suse 6.3 with firewall 1.4. I want to permit the following access through the firewall: www, domain, ftp, smtp and ssh. Then i made some adjustments in "rc.firewall" like : FW_ROUTE="yes" FW_TCP_SERVICES_EXTERNAL="smtp www domain ftp" FW_UDP_SERVICES_EXTERNAL="domain smtp ftp" After starting of firewall i have full access from internal network to internet but there isn't any access from Internet and no mail.... Could someone tell me what should i do? Alireza

3 2

PPTP VPN Firewall Settings
by Drew A. Harris 12 Mar '00

12 Mar '00

I'm using the SuSE Firewall 2.0 script to set my firewall. However, I still need to manual add the following IPchains to be able to reach the VPN from my clients behind the firewall. ipchains -I input -j ACCEPT -p 17 -s [vpn server ip address] -d [my external IP] -i eth1 ipchains -I forward -j MASQ -p 47 -s 192.168.0.1/32 -d [vpn server IP] -i eth1 ipchains -I output -j ACCEPT -p 47 -s [my external IP] -d [vpn server IP] -i eth1 ipchains -I input -j ACCEPT -p 47 -s [vpn server IP] -d [my external IP] -i eth1 Is there a way to configure the firewall.rc.config file to take care of this from within the script? Thanks for your help. DREW.

1 0

SuSE Security Announcement - make-3.77
by Yasholomew Yashinski 10 Mar '00

10 Mar '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Mon, 14 Feb 2000, Thomas Biege wrote: > The reason is simple: > The bug wasn't known to the public and only the vendors got > notified by me right after I found it. To give other linux > ditributors the time to fix their stuff I wait some days > before releasing our announcement. > > Hope that explains everything. The respect of your competition is more important then the security of your users? - -- ..Yashy ".. I used to get in more fights with SCO than I did my girlfriend, but now, thanks to Linux, she has more than happily accepted her place back at number one antagonist in my life.. " (Jason Stiefel, krypto(a)s30.nmex.com) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.0 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE4uXDXFM22zL2gTQcRAqLAAJ9UmyzrWcRQ2L3Xy0SMEKf20qxcsgCeNtVJ TpB2I2qC/3yJUYX48W31y0Q= =4ek0 -----END PGP SIGNATURE-----

23 64

Cracker Gets 18 Month Sentence...
by Fred A. Miller 09 Mar '00

09 Mar '00

Cracker Gets 18 Month Sentence for Five Year Old Computer Break-Ins. A man who broke into several large computer systems more than five years ago will serve 18 months in prison and pay $10,000 in restitution. He had been employed as a computer consultant. http://www.foxnews.com/vtech/030500/hack.sml -- ----/ / _ Fred A. Miller ---/ / (_)__ __ ____ __ Systems Administrator --/ /__/ / _ \/ // /\ \/ / Cornell Univ. Press Services -/____/_/_//_/\_,_/ /_/\_\ fm(a)cupserv.org

1 0

Vulnerabilities in StarScheduler!
by Fred A. Miller 09 Mar '00

09 Mar '00

S.A.F.E.R. Security Bulletin 000309.EXP.1.4 __________________________________________________________ TITLE : Vulnerabilities in StarScheduler DATE : March 09, 2000 NATURE : Denial-of-Service, Remote Code Execution, Access to privileged files PLATFORMS : StarScheduler/StarOffice 5.1 DETAILS: StarOffice comes with a nice groupware server, called StarScheduler. It also includes a web server that is vulnerable to several security problems. PROBLEM: A buffer overflow exists in the StarScheduler web server (which listens on port 801), that can lead to remote execution of code and root access. Since the server dies, this is also a Denial-of-Service issue. The problem is in the way web server handles long requests. Sending a "GET /['A' x 933] HTTP/1.0" will crash the server. This web server is running as a root. Another silly problem exists in the server that allows any user to gain read access to files to which they normally don't have access to. Example: http://starscheduler_server:801/../../../../etc/shadow This will display the content of the /etc/shadow file. FIXES: No fixes are available yet. Sun has been contacted on 6th of February, but we have received no response from them. JOB OFFERS: The Relay Group is seeking security enthusiasts with a vast experience in intrusion testing, firewall/IDS configuration and other security-related fields. For more information, please visit: http://relaygroup.com/secjobs.html ___________________________________________________________ S.A.F.E.R. - Security Alert For Entreprise Resources Copyright (c) 2000 The Relay Group http://www.safermag.com ---- security(a)relaygroup.com -- ----/ / _ Fred A. Miller ---/ / (_)__ __ ____ __ Systems Administrator --/ /__/ / _ \/ // /\ \/ / Cornell Univ. Press Services -/____/_/_//_/\_,_/ /_/\_\ fm(a)cupserv.org

1 0

FW: [suse-security] MD5 Passwords.
by |[TDP]| 08 Mar '00

08 Mar '00

Sorry.... in suse 6.3 the MD5_CRYPT_ENAB doesn't appear in /etc/login.defs and if you enable it, suse doesn't seem to change passwords to MD5... I think this feature has been removed. (in suse 6.1 i obtained md5 passwd sucessfully) I think was removed for security, MD5 is an algorithm that has collisions, however DES does not undergo problems of collisions, although it is "in theory easy to crack" by brute force. ----- Mensaje original ----- De: "Normando Marcolongo" <normando(a)studenti.ing.uniroma1.it> Para: <suse-security(a)suse.com> Enviado: martes, 07 de marzo de 2000 12:38 Asunto: [suse-security] MD5 Passwords. > > How can I enable MD5 passwords on SuSE 6.3? > > Thanks in advance! > > Normando. > > -- > Normando [enemy] Marcolongo (iW6OWQ) [] normando(a)studenti.ing.uniroma1.it > LUG Roma - IEEE S.B. Roma - ALU [] (AX.25) IW6OWQ(a)IW7BNO.IPUG.ITA.EU > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

3 3

RE: [suse-security] MD5 Passwords.
by |[TDP]| 08 Mar '00

08 Mar '00

In /etc/login.defs ... set MD5_CRYPT_ENAB to yes (if the line is #commented, uncomment it) ----- Mensaje original ----- De: "Normando Marcolongo" <normando(a)studenti.ing.uniroma1.it> Para: <suse-security(a)suse.com> Enviado: martes, 07 de marzo de 2000 12:38 Asunto: [suse-security] MD5 Passwords. > > How can I enable MD5 passwords on SuSE 6.3? > > Thanks in advance! > > Normando. > > -- > Normando [enemy] Marcolongo (iW6OWQ) [] normando(a)studenti.ing.uniroma1.it > LUG Roma - IEEE S.B. Roma - ALU [] (AX.25) IW6OWQ(a)IW7BNO.IPUG.ITA.EU > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

4 4

Re: [suse-security] Firewall 2.0: Samba services
by Erwin Zierler 07 Mar '00

07 Mar '00

Samba usually uses ports 137-139 tcp and udp, should be easy to implement a rule that fixes your problem. --- At 21:24 07.03.00 +0100, you wrote: >Hello, > >With Firewall 1.4 and 2.0 i have a problem: > >The SuSE Firewall blocking all SAMBA pakets from my internal network >:-(( >My system has 5 Networkcards. All pakets from my local networks, e.g. 192.168.1.0:138 -> 192.168.2.0:138, will be blocked :-(( > >When comes a bugfix ? > >greetings >daniel > > > > > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > > Erwin Zierler | Web-/Hostmaster - Stubainet | Email: Erwin.Zierler(a)stubainet.at / webmaster(a)stubainet.at | Mobil: 0664 - 130 67 91 Tel.: 05225 - 64325 Fax 99

1 0

Re: [suse-security] named can't write to named.pid
by Markus Gaugusch 06 Mar '00

06 Mar '00

Jurjen Oskam wrote: > > Since then (presumably because it doesn't run under root privileges > anymore?) named complains: > > Mar 6 00:25:02 calvin named[5129]: couldn't create pid file > '/var/run/named.pid' > > I already tried to make named.pid owned by user named. since named.pid is re-created every time named is restarted, named must have write privileges in /var/run the default of this dir in suse 6.3 is drwxrwxr-x 3 root uucp 1024 Mar 6 12:18 run so named must run in group uucp ... hth Markus -- ________________________________________ Markus Gaugusch markus(a)gaugusch.dhs.org ICQ-ID: 11374583 [www.mirabilis.com]

1 0

FTP through SSH
by list 06 Mar '00

06 Mar '00

Hi! I would like to connect to my FTP Server wich is running on my Linux Server.. The Ftp server can only be reached via SSH Tunnel cause the firewall doesn't permit the packets through. The FTP server is ony for emergeny file access. I can connect to the FTP server if I do a port forward of port 21, but I the ftp server can't send me the file list cause I need an second port. How I can configure these ports? I use wu.ftpd and for example CuteFTP or FTP Voyager on Windows Machine. the FTP-server error message: 500 Illegal PORT Command 500 Can't build data connection: no PORT specified Please help me.. How I can define static ports for ftp ? thanks, chris

8 8

dump
by Oles Filonenko 06 Mar '00

06 Mar '00

Hi. What about "ctime" in glibc? Command was: ltrace -S -o /tmp/dump.out /sbin/dump -0 `perl -e 'print "a" x 1024'` SuSe 6.3

1 0