August 2000 - openSUSE Security - openSUSE Mailing Lists

wvdial IPCHAINS Script
by Steven Thompson 23 Aug '00

23 Aug '00

Hi If you are using WVDIAL to dial up to your ISP. How do you get WVDIAL to call an IPCHAINS script to setup firewall rules. I have placed the path of the file in the IP-UP & IP-UP.LOCAL file it dose not seem to run. I'm running SuSE 6.4 Thanks in advance Steven

1 0

X and X-terminals
by Carlos Manuel Duclos Vergara 23 Aug '00

23 Aug '00

Hi, i'm trying to setup up a lab only with X terminals, but i can't allow them to open X from our server. I'm using SuSE-6.4 and ltsp for the terminals. I boot my terminals using bootp and they mount their rootfs through nfs. But that's not the problem, when they start they own copy of they cannot get kdm and the only thing that appears in the screen is just X (no kdm, no xdm, nothing). I hope somebody can give me some help because i read the whole xdm documentation and the X documentation, modify Xaccess, Xsetup, xdm-config, ... and nothing happens. tia bye -- Carlos Manuel Duclos Vergara carlos(a)embedded.cl

3 2

Re: [suse-security-announce] SuSE Security Announcement: Netscape
by Roman Drahtmueller 23 Aug '00

23 Aug '00

> > oops, > > I forgot to mention that the netscape rpm was the non 6.4_update_de > version that's missing. > > I assume that 6.4_update_de version is a german one and most people will > not use german software of course.. > This assumption is wrong. The _de suffix comes from the origin of the mirrored content (from ftp.suse.de). Anyway: We could finally resolve the legal issues with the US export regulations. The netscape packages will show up within the next hours on the respective directories on ftp.suse.com, the transfer is running. I'll write a brief notice with the paths when it's done. Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

1 0

AW: [suse-security] Security by mail...
by Bockermann, Christian 23 Aug '00

23 Aug '00

Hi ! Kurt Seifried [mailto:listuser@seifried.org] wrote: > Show me a root hack in sendmail recently (and no, the Linux kernel > capabilities bug doesn't count, you can use programs other > then sendmail to > exploit it). Sendmail has a nasty track record, but has made > a lot of effort > in the last 2 years to clean up (because they are selling it > commercially > now, heh). I would use it if I had to, but since Postfix is > out I don't =). It's not that I know any recent root hacks in sendmail. I just experienced that it's not that easy to set up. I have been using sendmail from SuSE 4.4 to 6.3 and was satisfied with it, but as I tried to do some setup without the use of YaST I found qmail much better to look over. Sendmail has all these m4-Script which you have to get deep into to be able to understand. I don't want to accuse sendmail of being not secure, I just thought that qmail was so easily to setup for me - I wondered why there was no possibility of installing qmail by SuSE. Just thought that such a complex configuration could easily get you a security-hole, just because you did not have an overview of all the options. > Qmail has a terrible license, basically you cannot distribute > binaries of it > to easily. I have talked ad nauseum about this with people > like Vincent > (Mandrake security guy who had to package it, it caused him a > huge amount of > grief). This means vendors prolly won't be backing it to strongly > (personally? I wouldn't back it at all). I'd put my money on > Postfix (which > BTW I haven been using for 2 years). The IBM license is MUCH saner and > postfix has many advantages over Qmail (regex filtering of > headers, database > as the back for config files, etc). I did not study the license of qmail. At least not from the distributor's point of view, I just wondered.. ;-) -- MfG, Christian

1 0

Security by mail...
by Bockermann, Christian 23 Aug '00

23 Aug '00

Good morning !! Security of a mail-system seems to be really important and I wonder why SuSE still keeps on using Sendmail as MTA. I walked through a lot of docs and howtos and thought it as VERY difficult setting up a Mail-System. YaST is doing a really great job in maintaining the system, setting up etc... BUT why does SuSE not provide the possibility of installing qmail. I switched from Sendmail to qmail and think it's great. It is easy to configure, works fast, is secure (I've been told the guy who wrote qmail even rewrote some of the libc-functions, because he didn't trust the common ones, also there is a reward of some money for security-bugs in qmail) Will there be use of qmail by SuSE sometime in the future ? (I think the mail-server of SuSE itself is qmail - right ?) -- MfG, Christian

3 2

sendmail etrn
by Sematimba Noah 23 Aug '00

23 Aug '00

I notiiced that on my redhat box etrn is turned off but to check on my suse box it is very much there. I would like to know how to tun it off I tried O PrivacyOptions=goaway,authwarnings,noetrn but that didn't work. Aslo does it have any security implications to leave it enabled? Noah ksemat(a)eahd.or.ug

4 3

relaying
by semat＠wawa.eahd.or.ug 23 Aug '00

23 Aug '00

I seem to have another problem.I had not allowed a certain domain to relay through me but I am its secondary MX but before I could sort ot out it appears that my machien forwarded the mail without question. This leaves me puzzled. I would love to have relaying denied by default but it doesn't seem to be I thought this was a default setting. the box was a suse 6.1 that I upgraded to 6.4 kernel 2.2.14.

3 7

/etc/MACHINE.SID
by Gerald Engl 23 Aug '00

23 Aug '00

Hello I hope my question is in the right list. I wonder which programm is generating the /etc/MACHINE.SID (or better the ID itself)? Thank you for Help Regards, Gerald -- Gerald Engl SICAD Geomatics GmbH &Co oHG Otto-Hahn-Ring 6 | 81739 München Tel.: 0049-89-636-51305

4 3

Re: [suse-security] Secure By Default - PLEASE!
by Jason P. Stanford 22 Aug '00

22 Aug '00

I like what OpenBSD does. It has most things turned off or *not* installed by default that are considered security risks. The install is set up for you. You add/delete packages later on, as needed but there is always enough man pages, caveats, documentation to make an educated decision to use or not use a package or service. In short, OpenBSD pretty much forces a newbie (such as myself) to educate themselves before they can enable something that may "un-secure" their machine. At first it was a little annoying. I just wanted to jump and play with a new OS. But after a week, I really started to appreciate the approach. Since I've started using Linux and now OpenBSD, my computer/networking/security knowledge has increased exponentially. Before all I knew were MacOS and Win95/NT which severly limited the knowledge I had. It hampered my understanding of how things _truly_ work. I understand SuSE wanting a positive experience from new users especially. But perhaps there's some middle ground? Education, though sometimes difficult is almost always worthwhile! My $0.02. --- Thomas Biege <thomas(a)suse.de> wrote: > Hi, > > > > If people use the tools we deliver with SuSE + their brains (note: we > > > don't ship brains with SuSE), then they could get a very secure system > > > within a short time of work. > > > > This is NOT a good idea. Either the default install (and the default > > install for most people is `ALL') enables all the services, which IS > > we don't sell a hyper-secure Linux, we sell a nearly complete and useable > Linux. we have to go the small path between security and useablity, and in > my opinion we do that very well. > > > crazy! No idea why identd, and similar have to run on a dialin machine? > > identd: for IRC > > > Even at the university where I have installed some susis, I alwyas have > > to maually shut down all the irrelevant and dangerous services. Services > > that's ok, because you know what's dangerous, but the unexperienced users > just sees a not working system if we disable all services and remove all > sbit's. > > > like telnet can be hacked or exploited very easy! > > i can't remember a serious exploit for telnet in the past 4 years, but i > remember some exploits for [Open-]SSH. > if users use unencrypted traffic it's their fault. we also ship SSH and > OpenSSH. we can't drop telnetd, because it's the standard program for > logging in over network. > > > > Hrhr... 'secure by default' nice buzzwords. AFAIK /usr/bin isn't audited > > > and neither all the ports are. It's 99% secure as long as you just use > the > > > > Nobody says if you turn of all unnecessary services the system is secure, > > but it is MORE secure than standard and at least a pc all the time linked > > up to the inet is not as vulnerable as before. > > right, but it's also more unusable. > > > > SuSE 7.0 hast a YaST2 module, that allows the not-so-experienced User to > > > modify /etc/inetd.conf in a easy way, to shut inetd off (even YaST1 ask > > > for this) or to use a default /etc/inetd.conf. > > > In future more security modules will be added to YaST2. > > > > Thats good news! > > *phew* nice to see, that I could make you happy. ;) > > > > The experienced-power-ueber User uses vi or sed to edit the config-files > > > and make their box secure. > > > > thats true, but there are not only power users! The other way round > > would be better: experienced-ueber-drueber-power users can turn on > > all the services they need easily and fast! > > we are not OpenBSD. (and that's good so) > > Bye, > Thomas > -- > Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg > E@mail: thomas(a)suse.de Function: Security Support & Auditing > "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" > Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47 > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > __________________________________________________ Do You Yahoo!? Yahoo! Mail � Free email you can access from anywhere! http://mail.yahoo.com/

3 3

TCP Wrappers vs. PAM
by Avi Schwartz 22 Aug '00

22 Aug '00

Hi, I was wondering. If I have a program (imap server) that was compiled with PAM support, do I still need to run it from inetd using the tcp wrappers or is it enough to set up PAM for this application? Thanks, Avi -- Avi Schwartz Get a Life avi(a)CFFtechnologies.com Get Linux

3 2