August 2000 - openSUSE Security - openSUSE Mailing Lists

netscape 4.74
by H. Engelmann 07 Aug '00

07 Aug '00

Hi, everybody does upgrade to netscape 4.74. I did not see any announcements on this list. Did I miss something? regards H. Engelmann -- H. Engelmann, 089-289-28836, engelmann(a)lrz.de

2 1

FYI: Mozilla Crypto FAQ
by Steven T. Hatton 07 Aug '00

07 Aug '00

This was written by the guy who sold NSS to the DOD when he worked at Netscape. He is also one of the great champions of opening Mozilla source. Steve http://www.mozilla.org/crypto-faq.html

1 0

AW: AW: [suse-security] SuSE security reputation, etc..
by OKDesign oHG Security Webmaster 07 Aug '00

07 Aug '00

> Someone might install some scripts to USER account and for example copy > all input/output to a file, including su passwords. Good idea. But how should he manage to get this script started ? And even if the script IS started and running, I should see it when doing a ps, shouldn't I ? And I always do ps axf before doing any su-like thing. Any other holes ? --- Stephan

5 4

Re: [suse-security] kdesu -c kvt
by Roman Drahtmueller 07 Aug '00

07 Aug '00

Russell, > When invoking a root console via kdesu, root's path is inherited from the > user's path. > > PATH=/usr/local/bin:/usr/bin:/usr/X11R6/bin:/bin:/usr/games/bin:/usr/games:/opt > /gnome/bin:/opt/kde/bin:. > > I believe, it is considered bad security to have . in root's path. > > Thank you > Russell You are right. But the problem here is that the environment is inherited in the first place. This is inevitable since some env vars are needed for X authentication (if you don't want to work around this problem...). It is _your_ environment that is being passed to the application you run. If you do not want "." to show up in the path, then change your path, or do sth like kdesu -c "kvt -ls" # still, it depends on where you are when you # call it. You might also want to use konsole instead of kvt (bugs...). If you want to be sure that your root-environment is sane, then use su - to get a root shell. Omitting the "-" will pass on the environment. Basically, this is the same as what kdesu does. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

Re: [suse-security] SuSE security reputation, etc..
by Volker Kuhlmann 06 Aug '00

06 Aug '00

Kurt Seifried's article http://www.securityportal.com/cover/coverstory20000724.html is extremely good. To make SuSE's security better, I would like the relevant people at SuSE to pay attention to Kurt's suggestions. These points I find particularly noteworthy (some of my own): * Organise the ftp server better. Some rpms get put up without notice. * Distinguish between security (= important) and maintanance (= I care if I need to) updates * Use the mailing lists properly. Like RH, you could mark advisories as important (RHSA) or unimportant (RHBA). Any scheme will do. Although much improved, I am still not comfortable in trusting suse-sec-announce. Sorry, but redhat-watch inspires much more confidence. The not uncommon bugginess of SuSE's alerts doesn't help. * Use long file names in all advisories and web pages to make life easier ("which version do I have / need to get?). That mentally deficient 8.3 is very annoying. I have used personnal computers of varying types since 1983, and was *never* forced to use 8.3, and now I switch to SuSE... * Checking md5 sums of updated packages is tedious. The advisory's f87a61fe... ftp://suse/.../package-version.rpm is good to feed into wget, but that lines doesn't go into md5sum. As the sum in the advisory appears to be handpasted, or how can the large number of incorrect sums be explained?, the whole procedure is probably a waste of time anyway. USE GPG-SIGNING - NOW! On the positive - I am still using SuSE :-) Volker

3 2

Help needed for configuring firewall with YAST
by Franky GOETHALS 06 Aug '00

06 Aug '00

Hello all, Since i while i've remarked the following lines in my firewall-log : Jul 18 21:40:11 penguin dhcpcd[109]: sending DHCP_REQUEST for 213.224.69.28 to 195.130.132.18 Jul 18 21:40:11 penguin kernel: Packet log: input DENY eth0 PROTO=17 195.130.132.18:67 213.224.69.28:68 L=330 S=0x00 I=60193 F=0x4000 T=252 (#127) Jul 18 21:40:11 penguin dhcpcd[109]: DHCP_ACK received from (195.130.132.18) Does anyone can help me ? I appears to be in the 'critical' messages for the firewall. I would like to allow these requests through my firewall, but i didn't succeed. I'm trying to configure it with YAST & FW_- variables in the configuration-file. Thanks in advance, Franky. -- =================================== GOETHALS Franky Driegaaienstraat 104 B-9100 SINT-NIKLAAS B E L G I E Systeemingenieur Mainframe Tel./Fax : 32 - (0)3 / 776.10.09 GSM : 32 - (0)478 / 21.40.94 franky.goethals(a)pandora.be ===================================

2 4

Re: [suse-security] How do Europeans build against BSAFE?
by Steven T. Hatton 06 Aug '00

06 Aug '00

Kurt Seifried wrote: > If you have to ask what it costs, you can't afford it. RSA is far from > checp. Depending on what you do with it it can cost a lot, especially > including it in products. I know of several companies (some pretty medium > sized to large) that would love to buy an RSA license for free products, if > you're open source it's damn unlikely (BTW when I mean a lot I'm talking > like 7 figures). > > > Steve > > -Kurt Kurt, My project uses BSAFE. Then I contract under the US DoD, so we have a few nickels throw at the project. The problem is the Bureaucracy is so messed up, they will waste a thousand man-hours to save a hundred bucks. And that is unfortunately a drastic understatement. When I need tools to do my job, I don't even bother asking procurement, it took over three yeast to get tape backup in place! NO LIE! Other distributions of Linux which go for about $200 come with some form of an RSA license. I believe at least one comes with a full developers version of BSAFE. I don't want another Linux distribution! I just want to be able to compile and use NSS and related tools. I don't want to distribute the stuff right now, and if I did, I'd work that out when it happened. First our Government says we can't export our cryptographic technology, so the rest of the world reproduces it for free, and now our Government makes it impossible to use it domestically! Hey, anybody in Germany or the UK hiring? Steve

2 4

sendmail
by Randy Suess 06 Aug '00

06 Aug '00

Is there are reason 6.4's sendmail/procmail creates the user mail files mode 600? I have a number of programs that expects it to be 640 group-id mail. I am pretty sure earlier 6.x's did it the old way.

5 6

How do Europeans build against BSAFE?
by Steven T. Hatton 06 Aug '00

06 Aug '00

Here in the states we are not leagally able to build http://www.mozilla.org/projects/security/pki/nss/buildnss.html without paying royalites to RSA. I can't seem to get RSA to take my money. In other words they don't return my calls and they don't respond to my emails. Come next month their pattem runs out and the opensource community can start distributin BSAFE emulations in the states. I'm wondering what you folks on the other side of the big pond do vis-a-vis RSA BSAFE when you want to build something like NSS. Has anybody done this? Prehaps with BSAFEeay? Steve

1 0

kdesu -c kvt
by Russell Evans 05 Aug '00

05 Aug '00

When invoking a root console via kdesu, root's path is inherited from the user's path. PATH=/usr/local/bin:/usr/bin:/usr/X11R6/bin:/bin:/usr/games/bin:/usr/games:/opt /gnome/bin:/opt/kde/bin:. I believe, it is considered bad security to have . in root's path. Thank you Russell

1 0