July 2000 - openSUSE Security - openSUSE Mailing Lists

Portsentry and logcheck
by Togan Muftuoglu 14 Jul '00

14 Jul '00

Hi everyone, I was getting lots of ftp finger pcanywhere probes and I thought applying some security for my pc. Here is what I have done Closed everything at /etc/inetd.conf I am using the Suse firewall script for the dialup connection to the internet. Basically I have closed everything I could think of. Also portsentry is starting with audp and atcp options. I have installed the logcheck also and this is the part I need to tweak a little bit. I only want to get informed when there is a Deny, Reject or Accept situation. If this is possible I need some direction to figure it out Thanks in advance -- Togan Muftuoglu toganm(a)turk.net 100% MS FREE Absolutely no component of Microsoft was used in the generation or posting of this e-mail. So it is virus free

3 2

SendMail (SMTP_AUTH) POP (POP_AUTH)
by Br�ulio Gergull 14 Jul '00

14 Jul '00

Hi, I'm having bad times configuring SMTP relay under 8.9.3, I need to relay e-mail to roaming users and it's being hard to enable relay to these users while keeping the system closed to spammers. I wonder if anybody have generated RPM's for Sendmail 8.10 with SMTP_AUTH support, or Qpop with POP_AUTH (POP before SMTP) support. Also, we suspect that a user is sending unauthorized msgs outside the company. Is there a way to send a copy of all the outgoing msgs from a user to the administrator's account (transparently)? I'm using SuSE Linux 6.4. Any help will be appreciated. []s, Bráulio Gergull

6 8

Re: [suse-security] samba207
by Eduardo Carriles 14 Jul '00

14 Jul '00

Hi Mariann, Fred, Jason and all others, This is what i posted on any other threads at [SLE] regarding HTML: ---- "Talking about _Microsoft Outlook Express_, did you noticed such a lot of flames regarding the use of HTML (people talk about it as garbage, and instantly bury it on the _Trash_, what a pain!!). I personally prefer using Netscape Mail, because it gives much better control over what you send and in wich format. Many times our SLE friends tend to forget the difficulty, on the issue that not seeing visual difference they would not throw HTML, but also using any True Type Font do fire it. Not to talk about sending both formats as text and HTML simultaneously." ---- Can you see the meaning Mariann?? Beg your pardon Fred, some times people, as me, tend to not look further and reply insanely instant, but did you understand what i meant? Those described above where the reasons wich fired your flames. Good try Jason, but i got some deep knowledge about the issues, just a bit quick. =:`) One more thing Jason, post _publicly_ and not direct to the original poster, or include also [suse-security] on your replys, and let others know what are we talking about, thanks. HTH, Eduardo Carriles ---- Jason Fruge' wrote: > > Hi Fred, > > > > What are you talking about HTML, i can't see any on thread. > > your email client is configured to format email messages in HTML, not > plain text. > most console mail clients can't parse HTML so they can't read it.

4 4

sendmail 8.10.2, SMTP_AUTH
by Andre Breiler 14 Jul '00

14 Jul '00

Hi, someone asked for sendmail 8.10.2 with smtp auth. So I've put my (s)rpms on http://www.tu-chemnitz.de/~abre/rpms/ Possible it helps someone. Note: sasl is needed for smtp auth Bye Andre' -- permanet eMail: A.Breiler(a)gmx.net

1 0

[suse-security] postfix
by Schorr, Michael 14 Jul '00

14 Jul '00

Hi, I just set up a postfix-mail system on a new gateway. Now I want to configure postfix in the following way: - mails from the inside-network should only be relayed to the outside-network, if the sender matches name@mydomain, otherwise the mail should be rejected - the gateway should not relay spam-mail etc. from the outside-network coming e.g. in the form name%domain@mydomain I'd be glad if anyone could help me how to configure postfix for this purposes. Thanks Michi mailto:michael.schorr@topmail.de

2 1

Re: [suse-security] samba207
by Eduardo Carriles 14 Jul '00

14 Jul '00

Hi Thomas, Only because Mariann ended talking to thread (and she feels satisfied), i feel free to continue to chat about the curious matter, and is not "Fed" it's "Fred". =:`) This is the tipical extraneous thread spawned by somebody from a completely different subject, thought (See following posts on thread order, not time received). Saludos, Eduardo Carriles [-- Better a smile than a flame --] (Long time SuSE-Linux [prefered distro] user). [Have a lot of fun...] ---- Thomas Michael Wanka wrote: > Hi, > > Fed must referr to the first message: > > --- Schnipp --- > --- Schnapp --- > > My mailreader can handle HTML messages, but I do not like them too, I just > do not dislike it enough to complain:). It's amusing to complain..... =:`) > mike > > --- Schnipp --- > --- Schnapp ---

1 0

Apache & mod_SSL
by Eric CHAPMAN 14 Jul '00

14 Jul '00

Hi guys, I am running a SuSE 6.4 box with Apache1.3.12 / OpenSSL/0.9.5... I want to set up several virtual name based hosts, one with ssl and the others without. I've tried several different httpd.conf setups, but somehow this does not want to work out. Right now my httpd.conf goes somewhat like this: [...] <IfDefine SSL> Listen 80 Listen 443 </IfDefine> [...] NameVirtualHost 123.456.78.9:80 NameVirtualHost 123.456.78.9:443 <VirtualHost my1st.host.org:80> SSLDisable ServerName my1st.host.org ServerAdmin eric(a)host.org DocumentRoot /usr/local/httpd/htdocs1 </VirtualHost> <VirtualHost my2nd.host.org:443> SSLEnable ServerName my2nd.host.org ServerAdmin eric(a)host.org DocumentRoot /usr/local/httpd/htdocs2 SSLCertificateFile /etc/httpd/ssl.crt/host.org.cert SSLCertificateKeyFile /etc/httpd/ssl.key/host.org.key </VirtualHost> [...more VirtualHost:80...] and ssl_engine_log shows: [13/Jul/2000 23:38:24 28689] [info] Init: Reinitializing OpenSSL library [13/Jul/2000 23:38:24 28689] [info] Init: Seeding PRNG with 136 bytes of entropy [13/Jul/2000 23:38:24 28689] [info] Init: Configuring temporary RSA private keys (512/1024 bits) [13/Jul/2000 23:38:24 28689] [info] Init: Configuring temporary DH parameters (512/1024 bits) [13/Jul/2000 23:38:24 28689] [info] Init: Initializing (virtual) servers for SSL [13/Jul/2000 23:38:24 28689] [warn] Init: (my2nd.host.org:443) You configured HTTP(80) on the standard HTTPS(443) port! Before the Virtualhost entries all looked like this: <VirtualHost 123.456.78.9:80> then I got the 'You configured HTTP(80) on the standard HTTPS(443) port!' for every Virtualhost. The server will not load unless I comment out the 443 Host. The Apache and mod_ssl online documents have not been very conclusive so far... 1. What is the difference between <VirtualHost 123.456.78.9>, <VirtualHost 123.456.78.9:80> and <VirtualHost my.host.org:80>? 2. Ionly have one IP address on the box, but could add another. Could this resolve the port prblem? If anyone knows his way with mod_ssl and Virtualhost, I'd be glad for any help THX, eric

3 2

samba207
by Mariann 13 Jul '00

13 Jul '00

Hi, I'm using Samba 2.0.7 and I'm experimenting with shares at the moment. I created a share on my SuSE 6.4 box and accessed it from a Win2000 machine. Than I deleted this share entirely, and expected that I wouldn't be able to see it anymore from the win2000 box (after refreshing the view in windows explorer) but the opposite happened. What could be the explanation and the solution for this? advTHANKSance Bodri

4 3

Re: [suse-security] SendMail (SMTP_AUTH) POP (POP_AUTH)
by Br�ulio Gergull 13 Jul '00

13 Jul '00

Hi Lars, > Hallo Bráulio, > > I use a solution from www.lihas.de under Skriparchiv, it was not too > difficult to install and everything you need is in the package and > ...important... it works with suse 6.4! Thanks for the link, I've just downloaded and will give it a try. > BG> Also, we suspect that a user is sending unauthorized msgs outside the > BG> company. Is there a way to send a copy of all the outgoing msgs from a user > BG> to the administrator's account (transparently)? > > Why don't you look in var/log/mail We did it and found that one employee is sending msgs to an ex-employee who left the company some months ago not very "friendly". Now the problem is to know what kind of information (if any) is being sent. >instead of spying in your users > mails? In fact I don't like this idea either, but I was asked for a "technical" solution. Moreover, I was asked to tell if sending copies of the messages is possible without the sender taking notice. I've already warned the guys about possible legal implications. > BG> I'm using SuSE Linux 6.4. > Me too :) :) Thanks a lot. []s, Bráulio Weimann Gergull

1 0

ipchains
by ksemat＠wawa.eahd.or.ug 13 Jul '00

13 Jul '00

Hi, I have this ipchains firewall that denies everything by default and then allows only those I specifically allow it also masquerades my internal network so that we can connect to the net. However there is this host that has been disturbing which I put in my banned hosts section now what I would like to know is what these stats mean wawa kernel input deny eth1 proto=17 192.168.1.1 etc what I would like to know is what is proto=17 proto=1 etc stand for I would like to know the various protocols. Noah ksemat(a)eahd.or.ug

2 2