May 2000 - openSUSE Security - openSUSE Mailing Lists

Problem while updating to Kernel 2.2.14
by Holger-Schmidt＠arcor.net 25 May '00

25 May '00

Hey Guys, maybe somebody can help me. After the security announce of SuSE I updated the kernel sources for compiling to kernel 2.2.14. I only updated the package "lx_suse" because it was the only one which was installed before. While compiling I get following error message: --- snip --- time.c: In function 'do_gettimeofday' time.c: 259: fixed or forbidden register 0 (ax) was spilled for class AREG This may be due to a compiler bug or to impossible asm statements or clauses cpp: output pipe has been closed make[1]: *** [time.o] Error 1 make: leaving directory ... make: *** [_dir_arch/i386/kernel] Error 2 --- snap --- The kernel was not finished. I found two differnt files "time.c": one in /usr/src/linux/kernel and one in /usr/src/linux/arch/i386/kernel Do you know what's wrong ? Bye Holger

8 9

IPCHAINS again (because first mail was digital signed)
by Gerling, Stephan 25 May '00

25 May '00

Hi list, I'am trying to set up an firewall with IPCHAINS. If the IPCHAINS-Script is not started, i kann do everything. (i use the same script on an other maschine and it works very fine and i want to change the maschines) But now wenn i start the script, the rules are loaded, but i cannot ping to the outside here the error messages ping wrote xxx.xxx.xxx.xxx 64 chars, ret=-1 ping sendto :Operating is not permitted ip-forwarding is enabled. Has anyone an idea. I'm going sick about this regards, Stephan Gerling

1 0

IPChains
by Gerling, Stephan 25 May '00

25 May '00

Hi list, I'am trying to set up an firewall with IPCHAINS. If the IPCHAINS-Script is not started, i kann do everything. (i use the same script on an other maschine and it works very fine and i want to change the maschines) But now wenn i start the script, the rules are loaded, but i cannot ping to the outside here the error messages ping wrote xxx.xxx.xxx.xxx 64 chars, ret=-1 ping sendto :Operating is not permitted ip-forwarding is enabled. Has anyone an idea. I'm going sick about this regards, Stephan Gerling

1 0

bad permissions in ftpdir
by Volker Kuhlmann 25 May '00

25 May '00

Hello, the following package has permissions 755 for directories and 644 for files. Much better would be to use 111 and 444 (except for /dev/null and /pub of course). Red Hat does that too. Also, the two ls should be hardlinked to save space. Volker Name : ftpdir Relocations: (not relocateable) Version : 99.11.9 Vendor: SuSE GmbH, Nuernberg, Ge rmany Release : 0 Build Date: Wed Nov 10 06:29:08 1999 Install date: (not installed) Build Host: sturm.suse.de Group : unsorted Source RPM: ftpdir-99.11.9-0.src.rpm Size : 1776739 License: 1999 - not specified Packager : feedback(a)suse.de Summary : A sample "FTP configuration" Description : This package contains a 'change-root'-configuration for anonymous ftp. drwxr-xr-x root root 1024 Nov 10 06:29 /usr/local/ftp/bin -rwxr-xr-x root root 235304 Nov 10 06:29 /usr/local/ftp/bin/compress -rwxr-xr-x root root 367936 Nov 10 06:29 /usr/local/ftp/bin/ls -rwxr-xr-x root root 429572 Nov 10 06:29 /usr/local/ftp/bin/tar drwxr-xr-x root root 1024 Nov 10 06:29 /usr/local/ftp/dev crw-rw-rw- root root 1, 3 Nov 10 06:29 /usr/local/ftp/dev/null drwxr-xr-x root root 1024 Apr 22 1998 /usr/local/ftp/etc -rw-r--r-- root root 31 Apr 22 1996 /usr/local/ftp/etc/group -rw-r--r-- root root 38 Apr 22 1996 /usr/local/ftp/etc/passwd drwxr-xr-x root root 1024 Nov 10 06:29 /usr/local/ftp/lib drwxr-xr-x root root 1024 Apr 21 1998 /usr/local/ftp/msgs -rw-r--r-- root root 61 May 08 1996 /usr/local/ftp/msgs/msg.dea d -rw-r--r-- root root 417 May 08 1996 /usr/local/ftp/msgs/welcome .msg drwxr-xr-x root root 1024 Nov 10 06:29 /usr/local/ftp/pub drwxr-xr-x root root 1024 Nov 10 06:29 /usr/local/ftp/usr drwxr-xr-x root root 1024 Nov 10 06:29 /usr/local/ftp/usr/bin -rwxr-xr-x root root 367252 Nov 10 06:29 /usr/local/ftp/usr/bin/gzip -rwxr-xr-x root root 367936 Nov 10 06:29 /usr/local/ftp/usr/bin/ls

2 1

Firewall + server on one machine?
by Ragnar Beer 24 May '00

24 May '00

Howdy everybody! To secure my machine as good as possible from the outside world I have closed all the ports that I don't need. So the only ports left open are ssh, http and https. Above that - does it make any sense to install a firewall on the _same_ machine (I can't afford another one at the moment)? --Ragnar

4 3

tripwire no longer saving database file
by europax＠home.com 24 May '00

24 May '00

Hello all, Tripwire used to save its database file in ./bin/databases. Now the only time it will save the file is when I use it in initialize mode. A search did not find the file in any other location. I did tighten the permissions in the /var/adm tree where tripwire is installed, but I assume that if permissions were the problem I wouldn't get a file in the initialize mode. Has any one else had such a problem, or know of a solution? Thanks, Rob.

2 1

Re: [suse-security] Firewall + server on one machine?
by Ragnar Beer 24 May '00

24 May '00

>Hi > >You can build Rules for paketfiltering with Ipchains. That`s okay on a >stand-alone-Machine. A real Firewall cannot save the same Machine where >it is install. I guess that's what I don't understand. If I can make separate rules for incoming and outgoing packets isn't then the firewalling something like a virtual machine in between? What would be the advantage of having another (physical) machine if I have only one machine to protect? --Ragnar

2 1

Re: [suse-security] Firewall + server on one machine?
by rhoerbe＠netpromote.co.at 24 May '00

24 May '00

You seem to imply, that firewall = ipchains + masquerading. The problem with this approach ist, that you still forward pacakges from the hostile net to the internal net. And vulnerable IP-stacks on internal system could be attacked. If you build an application level firewall (using squid, socks, plug-gw et. al), then ipchains is an add-on for improved security, but you can make the system pretty save without it. But you would have to turn off ip-forwarding, or have some rule in the forwar-chain of ipchains. To harden a firewall and a server is quite similar .. Rainer Ragnar Beer <rbeer(a)uni-goettingen.de> Sent by: suse-security-return-1812-rhoerbe=netpromote.co.at(a)suse.com 24.05.00 14:34 To: suse-security(a)suse.com cc: Subject: Re: [suse-security] Firewall + server on one machine? >Hi > >You can build Rules for paketfiltering with Ipchains. That`s okay on a >stand-alone-Machine. A real Firewall cannot save the same Machine where >it is install. I guess that's what I don't understand. If I can make separate rules for incoming and outgoing packets isn't then the firewalling something like a virtual machine in between? What would be the advantage of having another (physical) machine if I have only one machine to protect? --Ragnar --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] Firewall + server on one machine?
by Eilert Brinkmann 24 May '00

24 May '00

Ragnar Beer <rbeer(a)uni-goettingen.de> wrote: > To secure my machine as good as possible from the outside world I > have closed all the ports that I don't need. So the only ports left > open are ssh, http and https. Above that - does it make any sense to > install a firewall on the _same_ machine (I can't afford another one > at the moment)? With the configuration you describe a firewall will probably not give you much more protection against incoming connections. However, you have some more options with a firewall, e.g., - additional logging (e.g., to detect attempts to access disabled services on your machine), - blocking outgoing connections (e.g., to prevent programs on your machine from making unwanted transmissions), - blocking ICMP trafic. If such points (there may be some more) are of interest for you, it could make sense to install a firewall. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0

Re: [suse-security] Firewall + server on one machine?
by rhoerbe＠netpromote.co.at 24 May '00

24 May '00

Of course you can do this, and if you really care, security can be quite OK. BUT, there are a few issues, that are not wanted on a firewall .. .. users with shell access -> everybody except sysadmins have /bin/false as shell, .. too many packages and programs -> install only what you really need .. too many (particularly external) services, that makes it difficult to track all security-related issues Rainer Olivier Daigle <daio3003(a)ele.etsmtl.ca> Sent by: daigle(a)ele.etsmtl.ca 24.05.00 14:16 To: Ragnar Beer <rbeer(a)uni-goettingen.de> cc: suse-security(a)suse.com Subject: Re: [suse-security] Firewall + server on one machine? If by "Firewall" you hear "masquerading" or something like that, it may make sense. Masquerading only open oprts to the outside world when a machine from the inner world wants to communicate with the outside world. In that sense, it is quite safe. Read the security issue about masquerading and FTP for SuSE 6.4. Olivier Ragnar Beer wrote: Howdy everybody! To secure my machine as good as possible from the outside world I have closed all the ports that I don't need. So the only ports left open are ssh, http and https. Above that - does it make any sense to install a firewall on the _same_ machine (I can't afford another one at the moment)? --Ragnar --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com -- Olivier Daigle Projet Harfang (514) 396-8800 ext.7699

1 0