August 2000 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] SuSE security reputation, etc..
by rhoerbe＠netpromote.co.at 05 Aug '00

05 Aug '00

>% - by default, no shell user should be allowed to log in to ftp/telnet/pop >% using the same password or at all > >Here's what throws me. I understand you to say that the default should >be for a console-only system. Is that what you meant?? I also don't >know what you mean by "same password"... A very common setup for a system with remote maintenance is to use SSH for shell access. However, this is insecure, if you keep using ftp and pop for the same account with the same password. My setup is, to use separate accounts for different services. Quite inconvenient, unless you configure different password-dbs for ftp/pop/samba. Again, this is considerably more effort, and I doubt that many admins do this. Obviously, local access should not be limited. Rainer

4 3

reiserfs & quota
by Alexander Kühn 05 Aug '00

05 Aug '00

Hi folks, is there a way to enable quotas on reiserfs partitions ? When trying to mount /dev/md0 /home reiserfs usrquota 1 2 i get the bad option error, (i have a working ext2 with quota and ofcourse the /home is normal reiserfs already holding files). regards, Alexader. -- ======================================================================== # _ __ _ __http://home.htwm.de/akuehn/MPeople/MPeople.html# # / |/ /__ ____ _(_) /_ ____ _ dedicated to one of the best.. # # / / _ `/ _ `/ / / // / ' \ nagilum(a)chillout.org or +01776461165 # # /_/|_/\_,_/\_, /_/_/\_,_/_/_/_/ 68k/PPC: Amiga OS / NetBSD / Linux # # /___/ x86: Linux / FreeBSD / OpenBSD / Win 98 # ========================================================================

2 1

Re: [suse-security] SuSE security reputation, etc..
by rhoerbe＠netpromote.co.at 05 Aug '00

05 Aug '00

To add to that, it would be interesting to compare OS by "vulnerabilites by architectural flaws". At the top of my head, I know a few for NT and related products (display driver run on kernel ring, PPTP-security, ..). I assume, that MS would win this "market share execise" easily. anyway, Moody seems to be on the MS payroll. On the other side, Linux distributors could do even better. My wishlist for Suse: - configure security level (like harden_suse questions) with yast, and make it more granular. - by default, no shell user should be allowed to log in to ftp/telnet/pop using the same password or at all - have an installation option, that compares installed packages versus ftp.suse.com and lists known vulnerabilites and available fixes, and does updates on request I think, that a lot of security can be gained my making defaults more secure, or easy, selectable installation options. Few systems get the attention, that they should .. Rainer Frank Hart <frhart(a)home.nl> Sent by: hart(a)pingala.netpromote.co.at 02.08.00 20:31 To: cc: suse-security(a)suse.com Subject: Re: [suse-security] SuSE security reputation, etc.. Len Rose wrote: > http://www.abcnews.go.com/sections/tech/FredMoody/moody.html > It really sucks that SuSE wasn't even mentioned. What really sucked was that this article is a total piece of crap. Based on the number of vulnerability's mr. Moody qualified a total OS. Also he adds the vulnerabilities of every linux distro but that is nonsence, cause there's a big chance a vulnerablility found in eg RedHat also affects SuSE. -- SuSE Linux 6.4 -o) | Like the ski resort of girls looking for Kernel 2.2.16 /\ | husbands and husbands looking for girls, the on a i686 _\_v | situation is not as symmetrical as it might mailto:frhart@home.nl | seem. -- Alan McKay --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

12 13

dual boot
by ksemat＠wawa.eahd.or.ug 05 Aug '00

05 Aug '00

hi everyone, I am having a problem configuring lilo to dual boot SuSE and freebsd can anyone give me pointers. I have already done it successfully with windows and OS/2 but freebsd seems to be a problem. Or is there another boot loader I could use? Noah ksemat(a)eahd.or.ug

2 3

Firewall problem
by wil van der wee 04 Aug '00

04 Aug '00

Hi All, I' am using SuSe 6.2, and try to get firewall to work. There is a script in /sbin/init.d/firewall When I fill out FW_START etc. in /etc/rc.config I get a error when the system boots like this: --------------------------------------------------------- Starting firewall v2.2 Open SMTP access to: 192.168.1.99 Open DNS access to: 192.168.1.99 Load transparent proxy (incoming traffic) /sbin/ipchains: host/network `-j' not found Try `/sbin/ipchains -h' or '/sbin/ipchains --help' for more information. /sbin/ipchains: host/network `-j' not found Try `/sbin/ipchains -h' or '/sbin/ipchains --help' for more information. Locked UDP ports: 1:1023 Locked TCP ports: 1:1023 Filters for incoming traffic loaded Load transparent proxy (outgoing traffic) /sbin/ipchains: host/network `-j' not found Try `/sbin/ipchains -h' or '/sbin/ipchains --help' for more information. /sbin/ipchains: host/network `-j' not found Try `/sbin/ipchains -h' or '/sbin/ipchains --help' for more information. No restrictions for outbound traffic Filters for outgoing traffic loaded ---------------------------------------------------------------------- 192.168.1.99 is my local eth0 card. Can somebody help me with this. Any help suggestions welcome. BiBi Wil

1 0

Kernel version in the upcoming SuSE 7.0 release
by devel＠master.kparker.org 04 Aug '00

04 Aug '00

Hello, I just re-visited the SuSE web site and found the following (www.suse.com/products/susesoft/70news/70datapro.html) about the upcoming SuSE 7.0 release and was dismayed to find that 7.0 is to come with Kernel 2.2.14, which has almost enough holes in it to qualify it as Swiss Cheese. Why not 2.2.16, at least? (Yes, I realize 2.4.0 is still pre-release). Speaking of Kernel 2.4.0-test5, are there special SuSE patches I need to apply if I want to try it out with 6.4? Has anyone at SuSE packaged it as an RPM? Thanks in advance and best regards, Ken Parker (happy user of 6.4)

5 7

unsuscribe
by Martin Aicher 04 Aug '00

04 Aug '00

unsuscribe

2 1

Re: [suse-security] SuSE security reputation, etc..
by Simon 04 Aug '00

04 Aug '00

On Thu, 3 Aug 2000, you wrote: > One of our developers hacked autorpm to work with SuSE Linux as well. You > can get the RPM from here (within the nex few hours, mirroring to the > outside may take a while): > http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.noarch.rpm > http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.src.rpm > This package already includes a suse-update configuration. Enjoy! I checked the dependencies, and discovered that I don't have perl_net installed - nor can I find that package on the distribution CDs or on any SuSE site. Besides, I have to admit that enabling this feature on a production server seems somewhat scaring to me (especially since site-hijacking and other DNS troubles are not so uncommon in these days...). I'd probably try it for a while on a user's workstation. Greetings, Simon. ==================== Dr. Simone Grabstein listuser(a)egontek.net ====================

3 2

NFS vs. cronjobs
by Christian Mudra 04 Aug '00

04 Aug '00

Hi, I'm running kernel 2.2.16 on SuSE 6.4. As NFS-server I'm using the kernel-based nfsd. Every night at 0:00 o'clock, the cron-jobs of SuSE are running both on the nfs-clients and on the server. Every night, beginning at 0:15 a.m. I get every 15 min a mail from each client with the content (same like on console): YPBINDPROC_DOMAIN: Domain not bound I checked all the scripts that are running (/usr/lib/cron/run-crons, /usr/lib/secchk/*, /etc/cron.daily/aaa_base*),but there I see no influence to NFS. Logging in to a client takes a lot (5++ min) of time. After a short time or work (things that cause network traffic), everything is okay: 64 bytes from 131.246.*.*: icmp_seq=120 ttl=255 time=1000.802 ms 64 bytes from 131.246.*.*: icmp_seq=123 ttl=255 time=1307.996 ms 64 bytes from 131.246.*.*: icmp_seq=124 ttl=255 time=308.237 ms 64 bytes from 131.246.*.*: icmp_seq=125 ttl=255 time=2038.028 ms 64 bytes from 131.246.*.*: icmp_seq=126 ttl=255 time=1038.427 ms 64 bytes from 131.246.*.*: icmp_seq=127 ttl=255 time=38.693 ms 64 bytes from 131.246.*.*: icmp_seq=128 ttl=255 time=9317.865 ms 64 bytes from 131.246.*.*: icmp_seq=129 ttl=255 time=8318.299 ms 64 bytes from 131.246.*.*: icmp_seq=130 ttl=255 time=7318.521 ms 64 bytes from 131.246.*.*: icmp_seq=131 ttl=255 time=6318.699 ms 64 bytes from 131.246.*.*: icmp_seq=132 ttl=255 time=5318.947 ms 64 bytes from 131.246.*.*: icmp_seq=133 ttl=255 time=4319.162 ms 64 bytes from 131.246.*.*: icmp_seq=134 ttl=255 time=3319.374 ms 64 bytes from 131.246.*.*: icmp_seq=135 ttl=255 time=2319.922 ms 64 bytes from 131.246.*.*: icmp_seq=136 ttl=255 time=1320.099 ms 64 bytes from 131.246.*.*: icmp_seq=137 ttl=255 time=320.298 ms 64 bytes from 131.246.*.*: icmp_seq=138 ttl=255 time=0.270 ms 64 bytes from 131.246.*.*: icmp_seq=139 ttl=255 time=0.262 ms 64 bytes from 131.246.*.*: icmp_seq=140 ttl=255 time=0.254 ms This ping was started directly after such a login - so you see, after about 2 1/2 min of just being logged in the network is back to normal. Logging in to such a slowed down machine is only possible as root, not as user (user authentification uses NIS). But as security policy we wanted to allow root login only via su, not remote, not on console. As long as this problem exists, at least root login on console must be allowed ... Additionally sometimes there are messages like that in the syslog: Aug 4 11:44:47 mycomp kernel: nfs: task 1674 can't get a request slot Aug 4 11:44:49 mycomp kernel: nfs: task 1681 can't get a request slot Aug 4 11:44:59 mycomp kernel: nfs: server OK So, my question is: How can I avoid these nfs-problems? Has somebody also experienced problems like this? And why does that begin on every client just after the cronjobs finished? Ideas? Greetings, Christian. ---------------------------------------------------------------------------- Christian Mudra Just remember what your mother always told you: mudra(a)informatik.uni-kl.de "When you open windows you let in bugs". AG Wiehagen, Universität Kaiserslautern

2 1

MFilter Announce (was - weird seccheck-0.9-35 behaviour)
by nix＠cotse.com 04 Aug '00

04 Aug '00

OK guys, it's been over a month since I was asked to submit info about this script, but I have been a little busy, anyways, better late than never! There is now a homepage (sorta..) up at http://sourceforge.net/project/?group_id=5609 and a mailing list at mfilter-devel(a)lists.sourceforge.net Note: This program is stable and running in production at several sites, however there are several "possible" buffer overflows in the source atm. I have not had a chance to fix them since they were pointed out to me a few days ago by the programmer at the desk behind me :) Here is a bit of a description on how it works: The gateway has a deamon program running called SMTPD that accepts all incoming email, whether its from inside our network (Exchange Server) or from outside sources. The STMPD program dumps this email into a folder on the linux server called INCOMING (/usr/spool/smtpd/incoming). A different program background job SMTP-VIRUS (usr/sbin/smtp-virus) periodically checks the INCOMING folder and runs anything it finds in there through the Linux AVP Virus checker. AVP on Linux is installed in the /usr/local/avp folder. If the message is virus free, it is then moved to the SCANNED folder (/usr/spool/smtpd/scanned) The main SENDMAIL program periodically checks the SCANNED folder, works out who the messages are destined for, and sends them on to their destination. This whole process looks to take only 30 seconds or so (depending on the size of the emails). If a message in the INCOMING folder is found to be virus infected, it is instead moved to the BAD folder (/usr/spool/smtpd/bad). Anything in the BAD folder is scanned again by the program SMTP-BADMAIL (/usr/sbin/smtp-badmail) to find out exactly what it is infected with. The same program generates a warning email which goes to the original sender of the email and also gets copied to the admin account on our exchange box. The original recipient of the file is not notified. At this point, the infected email is moved to the BAD_ARCHIVE folder (/usr/spool/smtpd/bad_archive) where it stays until we delete it. The basic diagram below gives a good idea of the flow of the process. ALL EMAILS -> SMTPD -> INCOMING FOLDER -> SMTP-VIRUS (VIRUS CHECKER) -> VIRUS FREE -> SCANNED FOLDER -> DELIVERED TO RECIPIENT VIA SENDMAIL | --> INFECTED -> BAD FOLDER -> SMTP-BADMAIL sends warning emails -> BAD_ARCHIVE The SMTP-VIRUS and SMTP-BADMAIL programs are perl scripts (equivalent to a dos batch file), and these can be edited with PICO to make adjustments. If you wish to change the warning message, it can be found in the smtp-badmail file (pico /usr/sbin/smtp-badmail). AVP is set to automatically update itself every 4 hours via the CRON job /usr/local/avp/update.sh. This file connects to a local AVP FTP site and grabs any files newer than its own, so we are essentially only a few hours away from the latest update all the time. The update.sh file gets its settings from the /usr/local/avp/avp.pkg text file, which tells it what site to connect to etc. Have alot of Fun!!!!! Peter Nixon nix(a)cotse.com (Note: this is a new address) > -----Original Message----- > From: Rainer Link [mailto:link@foo.fh-furtwangen.de] > Sent: Friday, 7 July 2000 9:48 > To: Peter Nixon > Subject: Re: [suse-security] weird seccheck-0.9-35 behaviour > > > Peter Nixon wrote: > > Hi! > > Sorry, no answer to your question :-) > > > I am using seccheck-0.9-35 on SuSE 6.4 with all available > security options > > and updates. > > This machine also runs squid,sendmail,smtpd,AVP and BIND > > > 178 ? S 0:00 /bin/su - mail -c /usr/sbin/smtp-virus > > 191 ? S 0:48 \_ perl /usr/sbin/smtp-virus > > 5689 ? S 0:00 \_ sh -c /usr/local/avp/AvpLinux > > /var/spool/smtpd/incoming/smtpdvI0vSs >> > /var/tmp/smtpdvI0vSs.191/scanlog > > 5690 ? R 0:00 \_ /usr/local/avp/AvpLinux > > /var/spool/smtpd/incoming/smtpdvI0vSs > > 183 ? S 0:02 /usr/sbin/smtpfwdd -u mail -g daemon -d > > /var/spool/smtpd/scanned > > What's smtp-virus? Is it your own solutions (maybe GPL'ed)? Thanks for > your information. > (P.S. If it's GPL I would like to add it to lavp.sourceforge.net) > > best regards, > Rainer Link > -- > Rainer Link | Student of Computer Networking > > rainer(a)w3.to | University of Applied Sciences, Furtwangen, > Germany > rainer.w3.to | http://www.computer-networking.de/ >

2 1