August 2000 - openSUSE Security - openSUSE Mailing Lists

administrativa: dupes
by Roman Drahtmueller 16 Aug '00

16 Aug '00

Hi together, some people have reported that they get some older messages from this list again for the second time (mails from my address were among them). There is no way for me to tell how this happens because the mails aren't being delivered through our list engine. There is a chance that this phenomenon is connected to the mail (quoted below) that came through bugtraq on Tuesday, sent by an individual named Matthias Kaempf. It's a mail from Thomas Biege with headers cut off, hopelessly outdated because the original was sent a few months ago. My reply to it (forwarded without quotes below) on bugtraq hasn't been approved (yet) by Elias Levy, bugtraq's moderator - I've made some assumptions on the origin of the maverick mail. If you have received such a dupe and read this mail before 1200MET on Thursday (I'll have enough of them by then...), please forward it to me, including _all_ header lines. I hope this helps to pin down the culprit. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ---------- Forwarded message ---------- From: Roman Drahtmueller <draht(a)suse.de> To: BUGTRAQ(a)securityfocus.com Date: Tue, 15 Aug 2000 20:00:49 +0200 (MEST) Subject: Re: [suse-security-announce] makewhatis bug This is indeed messy. Thomas' comment on makewhatis is some months old, and this mail is a result of either * poor scripting or * MTAs that still can't distinguish btw header and envelope. * error btw kbd and chair We've seen several mails like this on our contact address lately, but we didn't expect them to show up in a public forum. Aleph, it was sent after my reply. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - On Mon, 14 Aug 2000, Matthias Kaempf wrote: > From: Matthias Kaempf <Matthias.Kaempf(a)DREI-H.DE> > To: BUGTRAQ(a)securityfocus.com > Date: Mon, 14 Aug 2000 20:02:08 +0200 > Subject: [suse-security-announce] makewhatis bug > > Hi, > a few days ago a /tmp race condition bug in the makewhatis program was > posted on bugtraq. > We are NOT vulnerable by this bug, because we use different code, which > doesn't touch /tmp in a unsecure way. > > Bye, > Thomas > -- > Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg > E@mail: thomas(a)suse.de Function: Security Support & Auditing > "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" > Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47 > > > -- > To unsubscribe, e-mail: suse-security-announce-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-announce-help(a)suse.com >

1 0

Re: [suse-security] crypt()
by emm＠eggler.ch 16 Aug '00

16 Aug '00

>> It's not a matter of a 10th of a second versus several days. If you use >> MD5, or an even better algorithm, it's the difference between a 10th of a >> second or a couple of years at the very least (or even centuries, if we >> ignore technological advances). A 10th of a second is a big problem, and a >> couple of days is not significantly better of course. But after a couple >> of years any sensible person would have changed their password, and after >> a couple of centuries most people would be dead anyway. >I don't understand that. If someone has your password file he can start a >dictionary attack. Is there any difference encrypting words in crypt or >MD5 and comparing the result to passwd? In my eyes, Robert is right and the initial statement (10th of second vs. centuries) is wrong (in the case of dictionary attacks). The only speed difference can be found in the speed difference of the crypt() vs. the MD5 algorithm. So the above statement implies that the MD5 algorithm is 10^n (n >> 1000000) slower than crypt's, which I don't belive. Anyway, if you have somebody on your system that can steal the /etc/shadow file (which is only accessible by root) than your system is already lost. my cent Emmerich

3 4

Re: [suse-security] Secure Mail Server suggestions
by Jason Warr 16 Aug '00

16 Aug '00

I think you are getting a bit carried away here. The fact is that this is a SECURITY related list and this thread has go way beyond that. I would like to add one last thing, however. Qmail mail goal in life is as a secure, easy to configure mail RELAY daemon built to replace SENDMAIL, and that can as an added bonus be used to actually deliver mail into mailboxes. Dan has also included a POP3 daemon also, but I would not use it in a large scale envronment. For that matter I would not use POP3, only IMAP. Intermail-Kx is a total package mail envronment. You cannot compaire the two. I do not know the details of criticalpath's setup because I do not work for them. All I know for sure is that they use qmail as the mail relay daemon. Mohsenruddin Moonshi wrote: > Care to share how this is implemented? What kind of storage it sits on > and how they did it? > > 1. File system (ReiserFS?) > 2. Disk storage for mail drop (SAN/NAS?) > 3. Network storage via NFS? > 4. I know qMail is great, free, opensource, GNU/GPL and etc > but in a world of eBusiness and eService where downtime > of 1 min will costs you US$13,000 and possible loss of > 10 customers every minute, will you rely on a failed > implementation from the support professional themselves? > > Goto http://www.software.com and read about Intermail-Kx and > Intermail-Mx. Until qMail is built with that design as stated in their > website whitepaper Url at; > > http://www.software.com/downloads/whitepapersdl/EvaluatingMsgServers.pdf > > I will not move towards qMail for large scale sites where scalability, > high availability and auto-failover is a must but then again, if your > business risk factor is low and the service is not generating business > revenue, why not? It's a free service after all :P > > --Moonshi > moonshi(a)linux.com.sg > http://www.linux.com.sg > > Jason Warr wrote: > > > > criticalpath.net handles over 100 million mail boxes on qmail. I am on there > > mailing list for trouble notification and I don't see very many issues from > > them. Granted they are spread throught the world. If you plan the envronment > > right, you should not have very many problems. > > > > Mohsenruddin Moonshi wrote: > > > > > Guys, a word of caution... I run qMail in an environment with about > > > 250,000 mail accounts and we have serious downtime and etc. Even inter7, > > > the commercial support team supporting qMail screws up our system while > > > upgrading the version. > > > > > > Enuff said. > > > > > > --Moonshi > > > moonshi(a)linux.com.sg > > > > > > Jason Warr wrote: > > > > > > > > I use qmail in combination with Courier-IMAP. Qmail is extremly easy to > > > > > > > > configure and has been very reliable for me. Your first install may > > > > take > > > > a couple of hours, but once you have done it and know better how qmail > > > > works it is a breeze. If you look on the qmail site (www.qmail.org) > > > > under user documentation you will find a HOW-TO written by Adam Mckenna. > > > > > > > > If you follow it you will quickly have qmail up and running. For POP3 I > > > > > > > > just use the qmail-pop3d that is part of qmail. You will find > > > > instructions for using it in the qmail FAQ found at the top of the main > > > > page on the qmail site. For IMAP I use Courier-IMAP. It can run over > > > > SSL if you want. You can find it at http://www.inter7.com/courierimap/ > > > > > > > > Fro web mail you can find a variety of different packages based on PHP > > > > at > > > > www.php.net under projects. I personally like TWIG, but it is a bit > > > > combersome to set up with all of the features. > > > > > > > > If you are going to use qmail and courier you need to use Maildirs. > > > > There is documentation included with qmail on how to do this. I would > > > > also look over the qmail site well because there is aditional software > > > > and doc's that you may find usefull. > > > > > > > > Good luck. > > > > > > > > Jason > > > > > > > > Selcuk Ozturk wrote: > > > > > > > > > I want to replace our ailing mail server with a new one. It should > > > > > have an smtp server (of course), pop and imap servers and also > > > > > a webmail solution. Can you suggest a combination of programs > > > > > for all of the above that are scalable and most importantly secure? > > > > > > > > > > For smtp server, I have only used sendmail until now but I like what > > > > > I have read about qmail and would prefer to use it if I can find > > > > > secure and stable imap and webmail solutions that would work with it. > > > > > > > > > > Thanks, > > > > > Selcuk > > > > > > > > > > <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=> > > > > > < Selcuk Ozturk <+> Email: > > > > > > < MIS Deputy Director <+> sozturk(a)eMediaMillWorks.com > > > > > > <=============================<#>===================================> > > > > > < <+> eMediaMillWorks > > > > > > < Fax : (301)883-2482 x121 <+> 1100 Mercantile Lane, Ste 119 > > > > > > < Fax : (301)883-9754 <+> Largo, MD 20774 > > > > > > <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=> > > > > > > > > > > --------------------------------------------------------------------- > > > > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > > > > For additional commands, e-mail: suse-security-help(a)suse.com > > > > > > > > --------------------------------------------------------------------- > > > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > > > For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: Re: [suse-security] crypt()
by emm＠eggler.ch 16 Aug '00

16 Aug '00

> > > > Anyway, if you have somebody on your system that can steal the > > /etc/shadow file (which is only accessible by root) than your > > system is already lost. > > > > my cent > > > > Emmerich > > > not exactly, IHMO. > Some people use NIS, for various reasons. > > In this case, you do not have shadow protection, so choosing > good passwords is crucial. To make this point clear: I don't propose using weak passwords. I am also afraid of somebody entering one of my machines with guessable passwords. But I am not particularly afraid of him getting more access after he's already been able to do something on my machines (like stealing /etc/shadow). I consider systems (and therefor also networks) where an attacker has been able to do something (especially getting access to the /etc/shadow file) as cracked. The next tools the administrator on such a system should use are fdisk and mkfs. --emmerich

2 1

Re: [suse-security] Secure Mail Server suggestions
by Jason Warr 16 Aug '00

16 Aug '00

criticalpath.net handles over 100 million mail boxes on qmail. I am on there mailing list for trouble notification and I don't see very many issues from them. Granted they are spread throught the world. If you plan the envronment right, you should not have very many problems. Mohsenruddin Moonshi wrote: > Guys, a word of caution... I run qMail in an environment with about > 250,000 mail accounts and we have serious downtime and etc. Even inter7, > the commercial support team supporting qMail screws up our system while > upgrading the version. > > Enuff said. > > --Moonshi > moonshi(a)linux.com.sg > > Jason Warr wrote: > > > > I use qmail in combination with Courier-IMAP. Qmail is extremly easy to > > > > configure and has been very reliable for me. Your first install may > > take > > a couple of hours, but once you have done it and know better how qmail > > works it is a breeze. If you look on the qmail site (www.qmail.org) > > under user documentation you will find a HOW-TO written by Adam Mckenna. > > > > If you follow it you will quickly have qmail up and running. For POP3 I > > > > just use the qmail-pop3d that is part of qmail. You will find > > instructions for using it in the qmail FAQ found at the top of the main > > page on the qmail site. For IMAP I use Courier-IMAP. It can run over > > SSL if you want. You can find it at http://www.inter7.com/courierimap/ > > > > Fro web mail you can find a variety of different packages based on PHP > > at > > www.php.net under projects. I personally like TWIG, but it is a bit > > combersome to set up with all of the features. > > > > If you are going to use qmail and courier you need to use Maildirs. > > There is documentation included with qmail on how to do this. I would > > also look over the qmail site well because there is aditional software > > and doc's that you may find usefull. > > > > Good luck. > > > > Jason > > > > Selcuk Ozturk wrote: > > > > > I want to replace our ailing mail server with a new one. It should > > > have an smtp server (of course), pop and imap servers and also > > > a webmail solution. Can you suggest a combination of programs > > > for all of the above that are scalable and most importantly secure? > > > > > > For smtp server, I have only used sendmail until now but I like what > > > I have read about qmail and would prefer to use it if I can find > > > secure and stable imap and webmail solutions that would work with it. > > > > > > Thanks, > > > Selcuk > > > > > > <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=> > > > < Selcuk Ozturk <+> Email: > > > > < MIS Deputy Director <+> sozturk(a)eMediaMillWorks.com > > > > <=============================<#>===================================> > > > < <+> eMediaMillWorks > > > > < Fax : (301)883-2482 x121 <+> 1100 Mercantile Lane, Ste 119 > > > > < Fax : (301)883-9754 <+> Largo, MD 20774 > > > > <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=> > > > > > > --------------------------------------------------------------------- > > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > > For additional commands, e-mail: suse-security-help(a)suse.com > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Using 6.4 rpm packages on a 6.3 installation...
by Geert-Jan.Laat-de＠dsm-group.com 16 Aug '00

16 Aug '00

Hi guys, A question with respect to using 6.4 rpm packages on a 6.3 installation: Is it save to install a 6.4 rpm on a 6.3 system ?? Best regards, Geert-Jan de Laat

2 1

Executables in /tmp necessary?
by Simon Lodal 16 Aug '00

16 Aug '00

Hello all, I am setting up a server where users will have shell access (ssh). I want to prevent anyone from uploading and running their own binaries. The idea is simply to make sure that all partitions where users have write access will be mounted with the noexec flag. My only problem is /tmp (which is also a separate partition), where the users will have write access since they have a shell. Is it safe to mount /tmp with noexec too? Or will it break any programs - if so which? The server runs lots of stuff; apache/php, samba, cvs, qmail + courier-imap + fetchmail + procmail for mail system, named, dhcp, sshd, (i may have forgotten some). Any experience and comments are welcome Thanks, Simon

3 5

multi-services server securing
by Gediminas Grigas 16 Aug '00

16 Aug '00

Hello there, I feel erroneusly (?) secure after .host.denyed in.telnetd and in.sshd from everywhere except one pc, which is denying all exept keyboard. I belive that if i can keep hosts.deny and hosts.allow files safe, and from time to time patch most actual security holes i`ll be conditionaly safe. Em i wrong? Probably I do. I just cant imaginate how system can be cracked in lower stage, so that is my problem. I heard that inetd is very insecure, and some peoples using tcpd (or soundlike). I run harden_suse, but was forced to answer 8/10 to no, as my server should provide a lot of public services, and have world writible directories as well. And thats right - this script was developed not for systems like mine one. However i`ll run SuSE-firewall-3.0 script, to make my system even stronger. But thats all. I dont know what can i do else. I should keep folowing services open: httpd; smptd; pop3d; ftpd; snmpd; named; inetd; sshd; nscd. So if you know how to keep them at minimal risk, or know some holes at those, i would be very gratefull for any info and/or tips. I dont ask to do work for me - link to good manual would be nice too. By the way i have SuSE 6.3 (2.2.13). Thanks in advice. Sincerely Yours, Gediminas Grigas mailto:gedas@kryptis.lt

5 5

RE: [suse-security] NT-ftp through linux machine suggestions
by De Loe, Maurits 16 Aug '00

16 Aug '00

Kurt, First of all thanks for the advice/help you gave so far. But I still have some issues... >>The problem I have is that I can't get my ftp-forwarding to work. If I use >>ftp through the browser >>it works but if I try to use ftp directly it doesn't, not from the >>NT-machine or from an other linux-box hooked up to my server. >Welcome to the wonderful wacky world of ftp. Passive and active FTP, sounds >like the firewalling breaks one, >>It is probably "just" a squid problem but I'm not very familiar with squid >>and need to get this to work. >>I'm aware that allowing ftp-forwarding is a potential security risk but >>there is no other way to do this...I think. >I have this exact same setup, I have an NT server with frontpage, I use >frontpage to edit my web docs (I'm a truly lazy bastard), but i need to get >those docs out to web sites on a regular basis. My solution is to enable ftp >on the NT box and have the Linux box synchronize all the ftp files once an >hour (you could easily do it more often). From the Linux box I can grab the >files via ftp, rsync, etc. If you want "realtime" updates simple install >Samba on the Linux box, mount the NT drive with the web docs and then make >that available via ftp. This way the NT box is not exposed at all to the >outside world, def. a good thing. I've already using samba, so there I'm o.k. And I guess enabling ftp on the NT-WORKSTATION means getting the passive/active ftp problem fixed. Do you or anyone elso no a "safe" configuration to get squid/SuSE firewall to allow both ftp's. I'm sort of new to linux networking and don't want to open it all up... Dreamweaver uses the ftp that's using port 21. A ftp-proxy can be specified but I don't know if I really need one. I don't allow ftp access to my machine. I only want to allow outgoing ftp. >>Please help me out with this. >>Maurits de Loë Kurt Seifried SecurityPortal, your focal point for security on the net http://www.securityportal.com/

2 1

plug-gw & tcpd
by Peter ten Have 15 Aug '00

15 Aug '00

Hi All, In order to let the clients use NNTP and because I don't want to run a NNTP server I have set up plug-gw from the TIS toolkit so I don't have to use masquerading on the SuSEfirewall. Question is: Can plug-gw safeley be run as a daemon or should it be invoked by tcpd? I don't want to compromise any security set by the firewall. Thanx, Peter

3 2