June 2000 - openSUSE Security - openSUSE Mailing Lists

[suse-security]: scanlogd
by Timo Schulz 26 Jun '00

26 Jun '00

Hi list, a few days ago, I portscan from a windoze client "MY" linux-box. But when I look for a scanlogd message, I can't find someone. So I take a look at the /var/log/messages file. There I found out, that the firewall blocks all unused ports ( of course ). But the scanner try also the open ports, like mail, ssh, ftp or www. Why scanlogd don't remember this and add a portscan to the logfile ? Thanks in advance. -- Two-a-Day at joesixpack.net www.freenet.de/joesixpack keyid BF3DF9B4

2 1

Re: [suse-security] permissions question
by Kurt Seifried 25 Jun '00

25 Jun '00

> There seems to be no way around using the immutable attribute. Yup. Anyways, one simpler method is to just remove r services, they are EVIL. Use the OpenSSH replacements. Also using PAM you could restrict which users have access to R services (gotta love PAM). Read Sysadmin in september to find out all about it =). > Eilert -Kurt

1 0

Firewall 1 version 4.1 on Suse, IT WORKS!! :-)))
by Joop Boonen 25 Jun '00

25 Jun '00

Dear all, I've just install firewall 1 version 4.1 on Suse 6.4. it works perfectly. THe only thing is that you need to have kernel 2.2.12 installed. may be Check point also delivers newer modules. According their web site it would work up to and including kernel 2.2.13. By the way the rpm packages are originally made for Red Hat. But it still works perfectly on Suse. the only down side is that the is now Linux client for Firewall one. Only a windows client that is free of charge and a Motif client for Solaris that costs and US$ 2000,-. I hope that suse will work together with Checkpoint so that there also will be a officially supported client for Suse Linux. By the way, you need to install kernel 2.2.12 from ftp.xx.kernel.com because 2.2.12 of Suse (rpm package) doesn't compile on Suse 6.4 . Regards, Joop Boonen. www.checkpoint.com

3 4

Firewall 1 version 4.1 on Suse, IT WORKS!! :-)))
by Joop Boonen 25 Jun '00

25 Jun '00

Dear all, I've just install firewall 1 version 4.1 on Suse 6.4. it works perfectly. THe only thing is that you need to have kernel 2.2.12 installed. may be Check point also delivers newer modules. According their web site it would work up to and including kernel 2.2.13. By the way the rpm packages are originally made for Red Hat. But it still works perfectly on Suse. the only down side is that the is now Linux client for Firewall one. Only a windows client that is free of charge and a Motif client for Solaris that costs and US$ 2000,-. I hope that suse will work together with Checkpoint so that there also will be a officially supported client for Suse Linux. By the way, you need to install kernel 2.2.12 from ftp.xx.kernel.com because 2.2.12 of Suse (rpm package) doesn't compile on Suse 6.4 . Regards, Joop Boonen. www.checkpoint.com

2 2

Firewall 1 version 4.1 on Suse
by Joop Boonen 25 Jun '00

25 Jun '00

Dear all, I've just install firewall 1 version 4.1 on Suse 6.4. it works perfectly. THe only thing is that you need to have kernel 2.2.12 installed. may be Check point also delivers newer modules. According their web site it would work up to and including kernel 2.2.13. By the way the rpm packages are originally made for Red Hat. But it still works perfectly on Suse. the only down side is that the is now Linux client for Firewall one. Only a windows client that is free of charge and a Motif client for Solaris that costs and US$ 2000,-. I hope that suse will work together with Checkpoint so that there also will be a officially supported client for Suse Linux. By the way, you need to install kernel 2.2.12 from ftp.xx.kernel.com because 2.2.12 of Suse (rpm package) doesn't compile on Suse 6.4 . Regards, Joop Boonen. www.checkpoint.com

1 0

Firewall 1 version 4.1 on Suse, IT WORKS!! :-)))
by Joop Boonen 24 Jun '00

24 Jun '00

Dear all, I've just install firewall 1 version 4.1 on Suse 6.4. it works perfectly. THe only thing is that you need to have kernel 2.2.12 installed. may be Check point also delivers newer modules. According their web site it would work up to and including kernel 2.2.13. By the way the rpm packages are originally made for Red Hat. But it still works perfectly on Suse. the only down side is that the is now Linux client for Firewall one. Only a windows client that is free of charge and a Motif client for Solaris that costs and US$ 2000,-. I hope that suse will work together with Checkpoint so that there also will be a officially supported client for Suse Linux. By the way, you need to install kernel 2.2.12 from ftp.xx.kernel.com because 2.2.12 of Suse (rpm package) doesn't compile on Suse 6.4 . Regards, Joop Boonen. www.checkpoint.com

1 0

Firewall 1 version 4.1 on Suse, IT WORKS!! :-)))
by Joop Boonen 24 Jun '00

24 Jun '00

Dear all, I've just install firewall 1 version 4.1 on Suse 6.4. it works perfectly. THe only thing is that you need to have kernel 2.2.12 installed. may be Check point also delivers newer modules. According their web site it would work up to and including kernel 2.2.13. By the way the rpm packages are originally made for Red Hat. But it still works perfectly on Suse. the only down side is that the is now Linux client for Firewall one. Only a windows client that is free of charge and a Motif client for Solaris that costs and US$ 2000,-. I hope that suse will work together with Checkpoint so that there also will be a officially supported client for Suse Linux. By the way, you need to install kernel 2.2.12 from ftp.xx.kernel.com because 2.2.12 of Suse (rpm package) doesn't compile on Suse 6.4 . Regards, Joop Boonen. www.checkpoint.com

1 0

gpg says it's a development version in SuSE 6.4
by Jurjen Oskam 24 Jun '00

24 Jun '00

Hi, I'm using SuSE 6.4, all patched up to the latest version. I'd like to use gpg, but it tells me this: joskam@calvin:~ > gpg -kv gpg: NOTE: THIS IS A DEVELOPMENT VERSION! gpg: It is only intended for test purposes and should NOT be gpg: used in a production environment or with production keys! gpg: Warning: using insecure memory! /home/joskam/.gnupg/pubring.gpg ------------------------------- pub 1024D/712ED616 2000-01-30 Jurjen Oskam <jurjen(a)stupendous.org> sub 1024g/245C5E07 2000-01-30 ... a stable version is out for quite some time now. Could that be fixed by somebody please? Thanks. -- Jurjen Oskam * ICQ 11573303 * http://www.stupendous.org/ for PGP key assassinate nuclear iraq clinton kill bomb USA eta ira cia fbi nsa kill president wall street ruin economy disrupt phonenetwork atomic bomb sarin nerve gas bin laden military -*- DVD Decryption at www.stupendous.org -*-

1 0

Re: [suse-security] permissions question
by Eilert Brinkmann 23 Jun '00

23 Jun '00

Jens Kuehnel <king(a)kuehnel.org> wrote: > > > > can a root user create a file in a regular user's home > > > > directory so that the regular user can not remove it? > > Have a look at the directory-Mode. > Writing a directory means deleting and creating files. > Normaly the best thing is a t-bit like at /tmp. That won't work in this case. The owner of the directory (i.e., the regular user who should be the owner of his home directory) will still be able to delete files he doesn't own. And because he is able to change his home directory's permissions he even could simply clear the t-bit. Setting the immutable flag with chattr is the only possible solution. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

9 9

SuSE Security Announcement: inn
by thomas＠suse.de 21 Jun '00

21 Jun '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: inn 2.2.2 (and earlier) Date: Wed Jun 7 12:24:25 MEST 2000 Affected SuSE versions: 6.1-6.4 Vulnerability Type: remote news compromise SuSE default package: no Other affected systems: all unix systems using innd 2.x (x < 4) ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update it as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The Usenet News server innd does not check the size of a stack buffer, when verifying 'cancel requests'. This verification is not enabled by default (s. innd.conf, 'verifycancels' is set to 'fasle'). 2. Impact If the 'verifycancels' option in innd.conf is set to 'true', it will enable an attacker to remotely execute arbitrary code with the privileges of user news on the INN server. 3. Solution Update the package from our FTP server if you use 'verifycancels' option. (Pease note, that this option is not recommended by the innd maintainer and will also be removed in innd 2.4). ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: The i386 RPM for 6.1 will be released next week. (For SuSE 6.0, please use the 6.1 updates) AXP: 259a0ad4e170a4e2576b463603549fd5 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/inn-2.2.2-86.alpha.rpm 1a5ce9202c8be84034b1b29231a6def8 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/inn-2.2.2-86.alpha.rpm eb9126f54ce84976b3a70e1ba6d0ec33 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/inn-2.2.2-86.alpha.rpm i386: de109ff3db535715c16bf43554d480ce ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/inn-2.2.2-86.i386.rpm 9a74e82f9e8911372029aec87bde7692 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/inn-2.2.2-86.i386.rpm caac7436f8e4373880d369a640f52e5f ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/inn-2.2.2-86.i386.rpm PPC: a588c1b72a868a28d96f283163511451 ftp://ftp.suse.com/pub/suse/ppc/update/6.3/n1/inn-2.2.2-86.ppc.rpm 4a0e636a05c79e5810d7660af5be41bd ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/inn-2.2.2-86.ppc.rpm ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update for Intel processors ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors ftp://ftp.suse.com/pub/suse/ppc/update for PPC processors or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/patches/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are sent to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOVDbBney5gA9JdPZAQGJlAf+KW4mZYRjb2jJq+Qn530tg5hY7qMwRGBK oaD/o/ncJGiDqX4RyYB6V55esUpDs2VCfKMGLCX3NH9s9S0iKknMJpEZZh1PKcv6 DFa+aOSx9KMqMI0xmIbYL+nBHqbeMNE9jPkMSs4ubz0IRwjUm8G8AOe49UI21Aa3 RDfnbsX2GwneGIZ6E9NzN4GoSeemlBRh+7zlHyCOXDqbzJLmpBOMy8RuS9Q3uzsI KrLu1NI6pb/r17CPtU9N2JYzxb7UZdPdq4sz26yOw+WuZ/uLNy5tdQBPbmbPzzpN 4YJS3DHXvPI8+4PHnC0YIMTLo5PZQfbkWyJQNRAeUryv11x1P2yduQ== =rdvQ -----END PGP SIGNATURE-----

1 0