July 2000 - openSUSE Security - openSUSE Mailing Lists

SFTP without SSH
by bolo＠lupa.de 19 Jul '00

19 Jul '00

Hi, due to our security policy we can not provide our users with telnet/ftp but with ssh/sftp to do their stuff on our servers. Now the question arose wether it would be possible to only allow sftp-connections _without_ shell access. I tried to set the users' shells to /bin/noshell, where noshell is a tiny script echoing that shell access to the account is not allowed, but this does not work, possibly due to the fact that sftp connections are tunneled over ssh and therefore need some kind of shell to work properly... Thanks for any information. Boris Lorenz <bolo(a)lupa.de> ---

3 2

Fwd: [suse-security] password encryption?
by Matthias Krawen 19 Jul '00

19 Jul '00

>Still experimenting with Samba 2.0.7 Hi ! All these samba-/ipchains-problems are offtopic. Please subscribe to a userhelp-group or , for questions about samba, visit http://www.samba.org an subsribe to Samba NTDOM or similiar. thanks Matthias

1 0

Book on Linux security
by Roman Blöth 19 Jul '00

19 Jul '00

Dear readers, I asked for a recommended reading on Linux security. The result was the book "Maximum Linux Security", published by SAMs and Linux Administrator's Security Guide: (http://www.securityportal.com/lasg/), which is free. Hope this helps someone looking for the same stuff... Best regards, Roman Blöth. -- gosub communications GbR | Fredersdorferstr. 10 | 10243 Berlin | Germany phone: [+49] (-30) 29 66 88 81 | fax: [+49] (-30) 29 66 88 84 | http://www.gosub.de

6 6

Re: libauth.so.1 - nkitb-2000.7.11-0.i386.rpm fuer Suse6.1 (fwd)
by Thomas Biege 19 Jul '00

19 Jul '00

Hi, for all ppl, who have problems w/ libauth, try to download + install libauth from ftp://ftp.suse.com/pub/suse/i386/6.1/suse/a1/libauth.rpm first and then install nkitb. Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

11 14

new SuSEfirewall version (beta)
by marc＠suse.de 19 Jul '00

19 Jul '00

Hi folks, SuSEfirwall v2.6 with no known bugs will be on the SuSE Linux 7.0 - great! I'm already developing the tool further and implemented the following features into the 3.0 beta which is available from www.suse.de/~marc shortly: v3.0: * Added FW_FORWARD_IP and FW_SERVICES_*_IP to support VPN and Routing Prptocols (e.g. OSPf, or GRE for PPTP) * Filter Config filename is now printed to syslog * Enhanced the masquerading timeouts to a more clever value * Added lockfile support (idea by franz(a)knipp.org) to prevent filter rule corruption if several SuSEfirewall instances are running especially the *_IP options are important to be able to use IPSEC and other VPN protocols like CIPE and PPTP. This was heavily requested :) Please note that I see no way to implement the following feature: several people requested an option to allow free communication between interfaces of the same class (e.g. between two internal networks) but this is not possible without much work by the user, because there is no way to configure with with ipchains. You'd have to know all networks reachable behind that adapter, something which is not possible to do automatically. so my configure work so in my opinion the FW_FORWARD_* (especially the new _IP) are the easiest solution. Comments/Ideas welcome! Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

1 0

== problems with netcat
by Ruprecht Helms 19 Jul '00

19 Jul '00

Hello everybody, I have problems with netcat, possible a bug. When I enter the hostadress and the portrange I want to see, it seems that the programm will do something but I get no result. We have tested that on different suseversions. What can be the problem? Regards, Ruprecht ------------------------------------------------------------ INTERNOLIX AG Ruprecht Helms System-Engineer http://www.internolix.com mailto:helms@internolix.com Weiherstr. 20 Tel: +49-[0]7533-9945-71 78465 Konstanz Fax: +49-[0]7533-9945-79

2 1

RE: [suse-security] ssh for SuSE 6.4
by Peter Nixon 19 Jul '00

19 Jul '00

Erm, If you have the full 6cd set, it's in the sec section (pick it from Yast) else you can grab the rpm from ftp://ftp.jigsaw.net.au/pub/suse/stuff/ The question is, do you trust me, enough to install a non-verified rpm? :) Cheers _______________________________________________________________ Peter Nixon Systems Engineer Jigsaw Technology Pty Ltd URL: http://www.jigsaw.com.au Address: 21 Boomerang Place Seven Hills NSW 2147 Australia Phone: 02 9672 4222 Fax: 02 9672 4211 Email: peter(a)jigsaw.com.au _______________________________________________________________ > -----Original Message----- > From: Tristan Burton [mailto:tburton@snarf.stanford.edu] > Sent: Wednesday, 19 July 2000 10:16 > To: suse-security(a)suse.com > Subject: [suse-security] ssh for SuSE 6.4 > > > Can someone tell me where to find ssh either on my disks or on the > SuSE website. One place on the website says that it is part of > series sec but it's not one of the listed packages for sec. > > Thanks > -- > Tristan Burton > Mechanical Engineering Department > Stanford University > tburton(a)snarf.stanford.edu > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

3 2

YP passwd - SuSE 6.3 and Solaris x86
by Adrian Bellini 18 Jul '00

18 Jul '00

Hi I have in SuSE 6.3 a fully functional yp system (users can log in 'a la NIS') on both Suse and Redhat (sorry !) but when they try it from Solaris 2.6/7/8 only root can log in (console of course !). As root I can su - into the user and $HOME and the shell is correct, but this is needless to say - not quite what I would like !. Has anyone any idea why it works in LINUX but not (correctly) in Solaris ?? Any help in this matter is greatly appriciated..... Thanks Ade

2 1

Re: [suse-security] Portsentry and logcheck
by Per R Laursen 18 Jul '00

18 Jul '00

Hi Togan. Try to read inside the logcheck.sh file. I dont know where you have this file on your system, but i have made my own SuSE adapted installation of logcheck. In logcheck.sh there you'll find a description of all the files logcheck uses when 'looking' inside log files. Kind regards Per R Laursen http://www.websecure.dk http://www.prl.dk -----Original Message----- From: Togan Muftuoglu <toganm(a)turk.net> To: suse-security(a)suse.com <suse-security(a)suse.com> Date: 14. juli 2000 12:03 Subject: [suse-security] Portsentry and logcheck >Hi everyone, > >I was getting lots of ftp finger pcanywhere probes and I thought >applying some security for my pc. Here is what I have done >Closed everything at /etc/inetd.conf >I am using the Suse firewall script for the dialup connection to the >internet. Basically I have closed everything I could think of. >Also portsentry is starting with audp and atcp options. > >I have installed the logcheck also and this is the part I need to tweak >a little bit. > >I only want to get informed when there is a Deny, Reject or Accept >situation. If this is possible I need some direction to figure it out > >Thanks in advance >-- >Togan Muftuoglu >toganm(a)turk.net > > >100% MS FREE >Absolutely no component of Microsoft was used >in the generation or posting of this e-mail. So it is virus free > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

5 6

Upgrade
by Diogo Bacelar Quintela 18 Jul '00

18 Jul '00

Hello list I have a tiny question. I've read that "rpm -U" could be used to upgrade (not installing if not installed already) packages. Now I would like to know if there is any simple way to Upgrade all the packages within the tree ftp.suse.com/pub/suse/i386/update/6.4 in my system, but of course, only the installed ones ... Thanks for the time .. #################################################################### ## Diogo Bacelar Quintela #################################################################### ## diogo.quintela(a)netcabo.pt ## dbq(a)rnl.ist.utl.pt #################################################################### ## PGP Public Key ## http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x2099755D ####################################################################

3 2