August 2000 - openSUSE Security - openSUSE Mailing Lists

Problem compiling qmail/portsentry under SuSE 6.4
by jan 15 Aug '00

15 Aug '00

Hi list, maybe a little off topic? but I have problems compiling qmail under SuSE 6.4, the command "setup check" brings the following output: -------------------------------------------------------------------------- ( cat warn-auto.sh; \ echo CC=\'`head -1 conf-cc`\'; \ echo LD=\'`head -1 conf-ld`\' \ ) > auto-ccld.sh cat auto-ccld.sh make-load.sh > make-load chmod 755 make-load cat auto-ccld.sh find-systype.sh > find-systype chmod 755 find-systype ./find-systype > systype ( cat warn-auto.sh; ./make-load "`cat systype`" ) > load chmod 755 load cat auto-ccld.sh make-compile.sh > make-compile chmod 755 make-compile ( cat warn-auto.sh; ./make-compile "`cat systype`" ) > \ compile chmod 755 compile ( ( ./compile tryvfork.c && ./load tryvfork ) >/dev/null \ 2>&1 \ && cat fork.h2 || cat fork.h1 ) > fork.h rm -f tryvfork.o tryvfork ./compile qmail-local.c qmail-local.c: In function `main': qmail-local.c:448: warning: return type of `main' is not `int' ./compile qmail.c ./compile quote.c ./compile now.c ./compile gfrom.c ./compile myctime.c ./compile slurpclose.c cat auto-ccld.sh make-makelib.sh > make-makelib chmod 755 make-makelib ( cat warn-auto.sh; ./make-makelib "`cat systype`" ) > \ makelib chmod 755 makelib ./compile case_diffb.c ./compile case_diffs.c ./compile case_lowerb.c ./compile case_lowers.c ./compile case_starts.c ./makelib case.a case_diffb.o case_diffs.o case_lowerb.o \ case_lowers.o case_starts.o ./compile getln.c ./compile getln2.c ./makelib getln.a getln.o getln2.o ./compile subgetopt.c ./compile sgetopt.c ./makelib getopt.a subgetopt.o sgetopt.o ./compile sig_alarm.c In file included from /usr/include/signal.h:300, from sig_alarm.c:1: /usr/include/bits/sigcontext.h:28: asm/sigcontext.h: No such file or directory make: *** [sig_alarm.o] Error 1 ------------------------------------------------------------------------------ I assume it's due to the SuSE Kernel Includes ? (I've installed the latest SuSE-Kernel 2.2.14, which is a modified 2.2.16 as rpm-update from SuSE) BTW. I get the same error on compiling portsentry Any help would be appreciated. jan.meyer

3 3

Re: [suse-security] autorpm and latest secure files
by Volker Kuhlmann 15 Aug '00

15 Aug '00

> I used autorpm to update all flies it could come up with for my 6.2 > installation. As pointed out this thread is off-topic, but there is one security-related aspect to it. For the autorpm-user to think about: How do you ensure what you update on your system is genuine, and not trojaned? Whether the update actually works is of secondary importance. Volker

15 19

[suse-security] NT-ftp through linux machine suggestions
by De Loe, Maurits 15 Aug '00

15 Aug '00

Dear all, At one of the projects I'm working on I have the following configuration problem. I have a NT-box connected with a linux-box which server as a http-proxy. I'm running squid, SuSE64 and SuSE firewall. I'm using dreamweaver (web-dev program) on NT to create web-sites. The problem I have is that I can't get my ftp-forwarding to work. If I use ftp through the browser it works but if I try to use ftp directly it doesn't, not from the NT-machine or from an other linux-box hooked up to my server. It is probably "just" a squid problem but I'm not very familiar with squid and need to get this to work. I'm aware that allowing ftp-forwarding is a potential security risk but there is no other way to do this...I think. Please help me out with this. Cheers, Maurits de Loë linux-administrator Zürich Switzerland ps: If someone has a better way of getting this setup to work I'm also VERY interested.

3 2

telnet to fixed port
by omicron＠symonds.net 15 Aug '00

15 Aug '00

hi how can i restrict remote users to telnet,rlogin,ssh only to the specified port. i mean, i dont want anyone to telnet to #25 or #80. is it possible ? regards cheedu -- ***** cogito cogito ergo cogito sum: i think that i think, therefore i think that i am. --Devils Dictionary --

3 2

RE: [suse-security] Secure Mail Server suggestions
by Matthias Pigulla 15 Aug '00

15 Aug '00

I can really really recommend qmail. http://www.qmail.org Although it might take some time to get familiar with it, you will find it very easy to configure. It performs very well, we managed lists with 100K+ deliveries a day on a simple Pentium/singe HDD box. Concerning security, qmail is my first choice. As someone said on this list, the qmail author (Dan Bernstein) "is so paranoid that he even avoids linking against the standard C libraries" :-). You will also like its modular architecture, which allows a lot of setups. For example, you can use "lightweight" qmail setups on several machines in order to tunnel all kind of mail to a central mail server. POP3: Check out the vmailmgr package; it is designed to work with qmail's maildirs. I have to admit that I am not actively reading the mailing list, but vmailmgr seems to be actively supported and extended. I think there were some postings on the list concerning IMAP with vmailmgr/qmail/?. http://www.vmailmgr.org/ Also don't miss to check ezmlm for mailing list management. Web based mail: Hm, forgot about that... I think I saw some stuff at freshmeat, but I don't have any experience with it. Hope this helps, Matthias -- w e b f a c t o r y G m b H Matthias Pigulla <mp(a)webfactory.de> - Geschaeftsfuehrer Lessingstr. 60 - D-53113 Bonn - Germany - www.webfactory.de Fon +49(0)228-9114455 - Fax +49(0)228-9114499 - ICQ 49185492

1 0

Logging
by Gerd Bitzer 15 Aug '00

15 Aug '00

Hi all, a question to all of you regarding system logging. I have a server with Suse 6.2 which should serve as a logging host. It's behind a firewall and is publically reachable, the logs are delivered from devices which are in the Internet. The standard syslogd seems to have security issues, according to http://www.securityportal.com/lasg/logging/index.html#General log security There are some suggestions of alternative syslogd's on Kurt's site, but what are the experiences with the listed alternative syslogd's, which one can you recommend (under security and stability viewpoints of course ;-). Which one could be used as secure dropin replacement for the standard syslogd ? TIA for your replies

2 1

ITS ALIVE! however theres one missing limb!
by Stuart Hodgkinson 15 Aug '00

15 Aug '00

hello again ;), Ok thanks to all you guys who have help as i've got the masqurading working now with the DNS resolution. What I need now is to be able to force the local network users to use the squid proxy and not access the net directly. I tried adding this:- FW_REDIRECT_TCP="192.168.0.0/24,0/0,80,3128" but when i restarted the script i got:- ipchains: No target by that name (Maybe this kernel doesn't support transparent proxying?) the script doesn't return any error when restarted but if I try accessing the net i have no problems but it doesn't go through the proxy (which i need for extra secuirty). im using 6.4 with a 2.2.14 kernel staright outta the box do i need to recompile the kernel or is it another setting i've missed, screwed up or not prayed to properly ;) -- Stuart Hodgkinson Software Engineer "When bashing the keyboard into your forehead just isn't enough."

3 2

mailing list
by nic 15 Aug '00

15 Aug '00

unsubscribe

1 0

Re: [suse-security] Secure Mail Server suggestions
by Jason Warr 14 Aug '00

14 Aug '00

In order to use courier you need to convert to maildirs(here is the man page http://www.qmail.org/man/man5/maildir.html ). Migrating can be quite interesting if you have a large user base. I would imagine Mailbox-Maildir could be done fairly easily with some good scripts and proper planning/testing. If you want to stay with Mailbox files you can use UW-IMAP. TWIG only depends on having an IMAP server present. Infact the install documentation for TWIG references UW-IMAP, but says that you can use any IMAP server. I personally am not a big fan of the UW-IMAP server. I have never gotten it to work right. If you follow instructions Courier-IMAP is very easy to get working correctly. I am not that familiar with the security history of UW-IMAP, but I have not had or heard of any problems Courier-IMAP. Keep in mind also that the web server dose not have to be the same machine as the mail server. This is because most webmail programs use the same connection the the IMAP server as any other client program would. There are endless possibilities when you use qmail with Maildirs. Jason max wrote: > Hi, I am currently using qmail as well, and myself was wondering about > posibilities for imap and web mail retrieval. My qmail currently works > with Mailbox file, where all the mail gets stored. Maildir is not > used. Will I have to migrate to Maildir to use Courier and TWIG or can it > all still run with Mailbox? Or do I sound as confused as I feel? > > Max Gribov > System Administrator > > On Mon, 14 Aug 2000, Jason Warr wrote: > > > I use qmail in combination with Courier-IMAP. Qmail is extremly easy to > > > > configure and has been very reliable for me. Your first install may > > take > > a couple of hours, but once you have done it and know better how qmail > > works it is a breeze. If you look on the qmail site (www.qmail.org) > > under user documentation you will find a HOW-TO written by Adam Mckenna. > > > > If you follow it you will quickly have qmail up and running. For POP3 I > > > > just use the qmail-pop3d that is part of qmail. You will find > > instructions for using it in the qmail FAQ found at the top of the main > > page on the qmail site. For IMAP I use Courier-IMAP. It can run over > > SSL if you want. You can find it at http://www.inter7.com/courierimap/ > > > > > > > > Fro web mail you can find a variety of different packages based on PHP > > at > > www.php.net under projects. I personally like TWIG, but it is a bit > > combersome to set up with all of the features. > > > > > > If you are going to use qmail and courier you need to use Maildirs. > > There is documentation included with qmail on how to do this. I would > > also look over the qmail site well because there is aditional software > > and doc's that you may find usefull. > > > > Good luck. > > > > Jason > > > > > > Selcuk Ozturk wrote: > > > > > I want to replace our ailing mail server with a new one. It should > > > have an smtp server (of course), pop and imap servers and also > > > a webmail solution. Can you suggest a combination of programs > > > for all of the above that are scalable and most importantly secure? > > > > > > For smtp server, I have only used sendmail until now but I like what > > > I have read about qmail and would prefer to use it if I can find > > > secure and stable imap and webmail solutions that would work with it. > > > > > > Thanks, > > > Selcuk > > > > > > <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=> > > > < Selcuk Ozturk <+> Email: > > > > < MIS Deputy Director <+> sozturk(a)eMediaMillWorks.com > > > > <=============================<#>===================================> > > > < <+> eMediaMillWorks > > > > < Fax : (301)883-2482 x121 <+> 1100 Mercantile Lane, Ste 119 > > > > < Fax : (301)883-9754 <+> Largo, MD 20774 > > > > <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=> > > > > > > --------------------------------------------------------------------- > > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > > For additional commands, e-mail: suse-security-help(a)suse.com > > > > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > >

1 1

Re: [suse-security] Secure Mail Server suggestions
by Jason Warr 14 Aug '00

14 Aug '00

I use qmail in combination with Courier-IMAP. Qmail is extremly easy to configure and has been very reliable for me. Your first install may take a couple of hours, but once you have done it and know better how qmail works it is a breeze. If you look on the qmail site (www.qmail.org) under user documentation you will find a HOW-TO written by Adam Mckenna. If you follow it you will quickly have qmail up and running. For POP3 I just use the qmail-pop3d that is part of qmail. You will find instructions for using it in the qmail FAQ found at the top of the main page on the qmail site. For IMAP I use Courier-IMAP. It can run over SSL if you want. You can find it at http://www.inter7.com/courierimap/ Fro web mail you can find a variety of different packages based on PHP at www.php.net under projects. I personally like TWIG, but it is a bit combersome to set up with all of the features. If you are going to use qmail and courier you need to use Maildirs. There is documentation included with qmail on how to do this. I would also look over the qmail site well because there is aditional software and doc's that you may find usefull. Good luck. Jason Selcuk Ozturk wrote: > I want to replace our ailing mail server with a new one. It should > have an smtp server (of course), pop and imap servers and also > a webmail solution. Can you suggest a combination of programs > for all of the above that are scalable and most importantly secure? > > For smtp server, I have only used sendmail until now but I like what > I have read about qmail and would prefer to use it if I can find > secure and stable imap and webmail solutions that would work with it. > > Thanks, > Selcuk > > <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=> > < Selcuk Ozturk <+> Email: > > < MIS Deputy Director <+> sozturk(a)eMediaMillWorks.com > > <=============================<#>===================================> > < <+> eMediaMillWorks > > < Fax : (301)883-2482 x121 <+> 1100 Mercantile Lane, Ste 119 > > < Fax : (301)883-9754 <+> Largo, MD 20774 > > <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=> > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com

1 0

AHA! ITS ALIVE oops no it isn't ;(
by Stuart Hodgkinson 14 Aug '00

14 Aug '00

hello again everyone. right ive been having a tinker and i've managed to get part of the masqurading working!!!! however the name server bit is shafted still. I can ping anything anywhere (as long as i leave the DNS flag mentioned in example 2 on!). However if i try to ping by using the DNS name it fails. So i tried this on the server and low and behold it too failed ?!?!?! when i turn the firewall of I can ping by name but i have no masqing (obviously). My question to the clever out there is what flag do i need to tweak, change , turn on turn off or hit with a 20 tonn lump hammer to get it to work. I had hair once.................. -- Stuart Hodgkinson Software Engineer "When bashing the keyboard into your forehead just isn't enough."

2 1

Help! any other examples (gimme examples please ;) )?
by Stuart Hodgkinson 14 Aug '00

14 Aug '00

I have tried to set up the firewal package on s.u.s.e 6.4 and use example 2 from the EXAMPLES file as a template for my system. However the masqurading doesn't work? has anyone got a working config file that may help me ? im trying to get all machines on my network to be ipmasq'd for pinging telnet etc etc but i require all http access to go through squid. Please help............... im losing my mind!!!! StOo

2 2

SSH capable version of dump
by Thomas Forbriger 14 Aug '00

14 Aug '00

Hi list, we are using dump to do remote backups in our local network. root of the dumping host uses a user account on another machine that is connected to a tape device. In the last months we did close a lot of network services and advice our users to switch to SSH and SCP for obvious reasons. We would be very happy to close the traditional r-services completely too. However dump uses rmt which relies on rexec or rcmd which again need rshd or rexecd running. I looked for a way to make dump use SHH but found none. I know tar offers the --rsh-command option but I would prefer to stay with dump and use our hand-tailored scripts around it. So there are two questions: - Does anybody know about a version of dump that is able to cooperate with SSH? - Another solution would be to keep r-services open and restrict them to local hosts via /etc/hosts.deny, /etc/hosts.allow and the tcpd. Are there any security implications with this solution that I missed? Thanks, Thomas -- |--------------------------------------------------------------------------| | Thomas Forbriger email: Thomas.Forbriger(a)geophys.uni-stuttgart.de | | Universitaet Stuttgart - Institut fuer Geophysik | | Richard-Wagner-Str. 44 D-70184 Stuttgart Germany | | Tel ++49 (711) 121-3593 or 3422 or 3424 or 3590 | Fax ++49 (711) 2361218 | | http://www.geophys.uni-stuttgart.de/thof | | "... there's nothing more bizarre than reality..." (M. Kindermann) |

3 3

Re: [suse-security] password generator - Doh!
by rhoerbe＠netpromote.co.at 14 Aug '00

14 Aug '00

*not on Linux!* The kernel provides real randomness (see urandom (4)). OK, it is pretty slow, but you can increase the data volume by using /dev/random as seed to a pseudo-random generator. Or, do cat /dev/random > myrandoms over night. BTW, this is a good argument, why to use a Linux box in banking etc. enviornments running various hosts, because that is a quite unique feature of this O/S. Rainer Steffen Dettmer <steffen(a)dett.de> Sent by: suse-security-return-2595-rhoerbe=netpromote.co.at(a)suse.com 14.08.00 09:55 Please respond to "Steffen Dettmer" To: suse-security(a)suse.de cc: Subject: Re: [suse-security] password generator - Doh! * John Pinder wrote on Fri, Aug 11, 2000 at 02:03 -0700: > srand; > sub randselect { > $_[0]->[rand @{ $_[0] } ] > } #Thank you O'Reilly! mmm... If I see it right then you use rand as source of randomness only, ain't? This isn't always a nice idea, since the entrophy of rand may be low, and you have to note that i.e. a pid has usually only 16 bit (under some circumstances predictable) entrophy, and time() has a very few bits randomness only and should be predictable usually. It seems better for me, to use the tv.usec field returnd by gettimeofday() and/or collect some entrophy directly from the user. I made some programm that reads in keystrokes and uses the timeings between the keystrokes too. I used the following functions to collect entrophy. It's not really strong but obviously better than useing some time() get getpid() only. The value of "ps axww|gzip" should be a nice non-predictable thing too. I would be glad to get some comment about the following code, maybe I missed some important things? Here are the functions: sub keyboard_seed() { return 0 if ($NO_KEY_TYPEING); #do nothing if set #C would be better... ;-) my $time_sum=0; #"rotated" value for keystroke timings my $key_sum=0; #"rotated" value for keycodes my $rin=''; #select() bit vector vec($rin,fileno(STDIN),1) = 1; #construct STDIN select vector $r=$rin; #select-vector system "stty", '-icanon', '-echo', 'eol', "\001"; #set line discipline: non canonical mode no echo select(STDOUT); $|=1; #set STDOUT unbuffered print "I have to collect some enthropy. ", "I'll analyze you keyboard hits.\n"; print "Please hit 32 keys now: [", " " x 32, "]\n"; print " ---> "; for ($n=0; $n<32; $n++) { #32 keys my $one_time=0; #time between two keystrokes my $c=''; #1 byte input buffer while (($rin=$r,$nfound = select($rin, undef, undef, 0.01)) == 0) { #wait until data on STDIN $one_time++; #a time tick without data $one_time %= 2**8; #we take 4 bit only... } sysread(STDIN, $c, 1); #read char from STDIN print "*"; #just a mark #add some bits to sum: my $b4 = ((4 ** $n)%(2**16)); #max 2 bytes (factor) my $b6 = ((6 ** $n)%(2**16)); #max 2 bytes (factor) $time_sum = $time_sum + $one_time * $b4; #4 bits (a "shift" in) $key_sum = $key_sum + ( ord($c)-ord('0')) * $b6;#6 bits } print "\nENOUGH, Thank you!\n\n"; sleep 2; #now we have to flush input (for such users that type 33 chars :-) while (($rin=$r,$nfound = select($rin, undef, undef, 0)) != 0) { sysread(STDIN, $rin, 1); #trash input } #restore line discipline mode system "stty", 'icanon', 'echo', 'eol', '^@'; # ASCII null select(STDOUT); $|=0; #set line buffered mode my $seed = $time_sum ^ $key_sum ; #XOR timer and key longs printf " (Keyboard seed value: 0x%X [T:0x%X K:0x%X])\n", $seed, $time_sum, $key_sum unless($QUIET_MODE); return $seed; #pass seed to caller } sub rnd_init() { #calling srand with entrophy... #we "hash" some "ps" process info and collect enthropy from user open(OLDERR, ">&STDERR") or die "STDERR->OLDERR $!\n"; open(STDERR, ">/dev/null") or die "STDERR->/dev/null $!\n"; close(STDERR); #"redirect" STDERR; it seems that IT DOES NOT WORK CORRECTLY!! #$seed1 = (unpack "%L*", `find /proc -print | xargs cat gzip`); $seed1 = keyboard_seed(); $seed2 = (time ^ $$ ^ unpack "%L*", `ps axww | gzip`); $seed = $seed1 ^ $seed2; #next line DOES NOT WORK correctly at least under Solaris!!! open(STDERR, ">&OLDERR") or print OLDERR "OLDERR->STDERR $!\n"; close (OLDERR); printf " --> 32 bits enthropy: 0x%X <--\n", $seed unless ($QUIET_MODE); srand($seed); #set calculated seed } oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel. --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

password generator
by jan 14 Aug '00

14 Aug '00

Hi list, passwords again... I'm searching for a tool that generates many many passwords in a list, so that i can automatically assign them to users. thanx for your help... -- jan meyer sysadmin FH-Potsdam

6 7

Small holidays ahead, see you on return
by Eduardo Carriles 13 Aug '00

13 Aug '00

Hi friends all, As of today I am having my Small piece of Holidays. Too small for my desires, but.... See you on my return at [SLE] mainly or at [suse-security] some times. Be well. -- Best regards, Eduardo Carriles [-- Better a smile than a flame --] (Long time SuSE-Linux [preferred distro] user). [-- Se me nota mucho? -- Notices me much?] [-- Have a lot of fun...]

1 0

Re: [suse-security] autorpm and latest secure files
by Volker Kuhlmann 13 Aug '00

13 Aug '00

> What are the recomended steps to do security updates from FTP when there is no > PGP signature in the files? You know there was this incident with tripwire on > the dutch server that was hacked and trojaned as far as I remember. Is there a > reason to worry about somebody being able to hack and trojan the security > updates supplied via ftp AND to hack an change the md5 sums provided by SuSE > at the same time? Or is this coincidence too far from being probable? The bottom line is that the usefulness of those md5 sums is seriously impaired. As I pointed that out while 6.3 was current I am a little disappointed that 7.0 still does not have signed packages. There may be organisational problems, but Red Hat manages since 4.2 and 1996. My question of long ago about how to use those md5 sums easily never got an answer. Here is what I figure: 1) get the md5 sum: a) copy out of advisory (after checking the advisory's signature) and paste into a texteditor. Given the number of bugs and incorrectly placed (by SuSE) sums in the advisory, I would not assign a very high relibility factor to this source. b) download that file with the sums from the ftp server. One would have to use ftp.suse.com directly, mirrors could have been hacked. What about encryption-related packages? As has been pointed out (by Gerhard?), doing both and cross-checking might be a good idea. 2) paste sums into a text editor. Then paste the filename in there too, with 2 spaces separation. The lines in the advisory are useless, because they are of the form 72b3eb67t36f ftp://.../package.rpm md5sum -c does not take complete URLs, and anyway I download packages including the version or things would become very messy at my end. That the advisory does not contain full package names is a pain. 3) run md5sum -c Perhaps I am lazy, but I find that a PITA. Disregarding laziness, the usefulness of the whole procedure is doubtful as well, as the chain breaks in the weakest point, and the weakest point is that md5sums can not be obtained securely. Even ftp://ftp.suse.com/ is not as secure as the machine SuSE would be using to sign packages. Or am I missing something? I have hopes for 7.1... Volker

1 0

Ident Service dependencies
by Steven Thompson 11 Aug '00

11 Aug '00

Hi I would like to know which services are dependent on the "Ident service". As I'm configuring a firewall server and would like to if I can shut the service down. Thanks in Advance Steven Thompson

2 1

SuSE security reputation, etc..
by Len Rose 11 Aug '00

11 Aug '00

It would be really great if SuSE could gain a reputation as being the most secure Linux implementation that exists today. Something like OpenBSD's reputation would be excellent, and from what I've seen SuSE could achieve this if they tried. I saw this on the mysql mailing list, and I'm sure others will see it there first, but just in case: http://www.abcnews.go.com/sections/tech/FredMoody/moody.html It really sucks that SuSE wasn't even mentioned. Len

15 23

Security implications of SMB through masquerading firewall?
by Andreas Gruenbacher 11 Aug '00

11 Aug '00

Hi, I would like to allow users behind a masquerading firewall access to SMB shares outside. For that, I have configured SuSE firewall as follows: FW_SERVICES_INTERNAL_TCP="netbios-ssn" FW_SERVICES_INTERNAL_UDP="netbios-ns netbios-dgm" (netbios-ns = 137, netbios-dgm = 138, netbios-ssn = 139) Is this reasonably safe? Are there any better ways to do that? Thanks, Andreas. ------------------------------------------------------------------------ Andreas Gruenbacher, a.gruenbacher(a)computer.org Contact information: http://www.bestbits.at/~ag/

1 0

login.access
by ksemat＠wawa.eahd.or.ug 11 Aug '00

11 Aug '00

hi, I have a feeling someone may have already asked this but can someone help me out. I hope this falls in the category of security. In slackware and freebsd I have a file called login.access which I use to control who can login on my console. Is there a similar package for SuSE I really badly need to do this. Noah ksemat(a)eahd.or.ug

2 2

Postfix Message Size limit Setting for Receiving Mail
by Steven Thompson 10 Aug '00

10 Aug '00

Hi Does Postfix support message size limit on the Receiving end and if not what is the best method of setting Receive message limits. (e.g. 2048K) Thanks in Advance Steven Thompson

2 1

RE: [suse-security] Problems with package smtpd - Y Store and Proxy mail forwarder
by Oliver Grube 10 Aug '00

10 Aug '00

Hello, >Oliver Grube wrote: >> after installing the smptd on an seperate System, it will not work >> correctly. Syslog meens: "No reverse mapping for adress".... >Did you check that /lib/libnss_dns.so.2 and /lib/libnss_files.so.2 >(and /etc/hosts, /etc/nsswitch.conf and /etc/resolv.conf) are present >in your chrooted environment ? >These are AFAIK needed for name resolution. Thanks! That's it. I'll write to SuSE, that they can change the README for the package. We've spend more than two hours on this problem yet. Thanks again, Oliver Grube --------------------------------------------- --IT-Secure - Mit Sicherheit gute Lösungen.-- --------------------------------------------- Security Support * oliver.grube(a)it-secure.de +49 2161 6897-180 * http://www.it-secure.de

1 0

Problems with package smtpd - Y Store and Proxy mail forwarder
by Oliver Grube 10 Aug '00

10 Aug '00

Hello, after installing the smptd on an seperate System, it will not work correctly. Syslog meens: "No reverse mapping for adress".... But: 1. We've tested the Bind configuration - it runs perfect 2. We've also copied the resolv.conf file to the chroot environment smtpd is running. 3. We've also checked the permissions and the user of the smtpd-Daemon. It's mentioned in "TrustedUsers" in sendmail.cf... Does anyone have an idea, why the resolution fails? Greetings, Oliver Grube --------------------------------------------- --IT-Secure - Mit Sicherheit gute Lösungen.-- --------------------------------------------- Security Support * oliver.grube(a)it-secure.de +49 2161 6897-180 * http://www.it-secure.de

1 0

SuSE Security Announcement: rpc.kstatd (knfsd)
by Roman Drahtmueller 10 Aug '00

10 Aug '00

I messed it up - sent the wrong advisory. Sorry. Here's the right one: -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: knfsd, all versions Date: Thursday, August 10th, 2000 Affected SuSE versions: 6.1-6.4 Vulnerability Type: remote root compromise Severity (1-10): 9 SuSE default package: yes Other affected systems: all linux systems using this package Content of this advisory: 1) security vulnerability resolved: knfsd (remote root compromise) problem description, discussion, solution and upgrade information 2) pending vulnerabilities, temporary workarounds (Netscape, suidperl) 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information Due to incorrect string parsing in the code, a remote attacker could gain root priviledges on the machine running the vulnerable rpc.kstatd. The rpc.kstatd daemon contained in the package linuxnfs (SuSE-6.1, 6.2) or knfsd (SuSE-6.3, 6.4) is used by the NFS file locking service to implement lock recovery when the NFS server crashes or reboots. The network status monitor as shipped with SuSE distributions including and following SuSE-6.1 is called `rpc.kstatd' in order not to confuse it with the `rpc.rstatd', the kernel statistics server that comes with SuSE, too (See manual pages for rpc.kstatd and rpc.rstatd). Other distributors might use the term `rpc.statd'. Note: The upcoming SuSE-7.0 distribution is _not_ vulnerable to the problem with rpc.kstatd. SuSE provides updated packages for the vulnerable software. It is strongly recommended to upgrade to the latest version found on our ftp server as described below. For the kernel-based NFS server to operate properly, it is strongly recommended to upgrade to the latest kernel version as announced in http://www.suse.de/de/support/security/suse_security_announce_54.txt . Chose one of the following paths to download the package from our ftp server and install the package with the command `rpm -Fhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-6.4 (package name is knfsd!): ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/knfsd.rpm 1a7214f921ebeea7bbcfce8187e7ba65 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/knfsd.spm fa4bb28382515648f1c667cbbc019695 SuSE-6.3 (package name is knfsd!): ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/knfsd.rpm 9425557d97676df139c3b3cfbcbfb686 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/knfsd.spm 1d4f69b00eedee3530cbd14ede55b985 SuSE-6.2 (package name is linuxnfs!): ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/linuxnfs.rpm c4fbbcbdac7c8640b8ff92643e666ea2 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/linuxnfs.spm 7a006bcc0a8132e8a35e43c087edd493 SuSE-6.1 (package name is linuxnfs!): ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/linuxnfs.rpm e4ae4db716613a94d7f5a2acc5f4ee05 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/linuxnfs.spm 879318dd2985fc29d879691044ccc982 AXP Alpha Platform: SuSE-6.4 (package name is knfsd!): ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/knfsd.rpm 6596ee4207f3f03b570a872af714a263 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/knfsd.spm 14d8c202a1d136e7d88ae02e428925a1 SuSE-6.3 (package name is knfsd!): ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/knfsd.rpm 728896064200e3fe2e303eba3246a295 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/knfsd.spm 6e755c651af95c4f8fd05138a373e8f3 SuSE-6.1 (package name is linuxnfs!): ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/linuxnfs.rpm 589a11bd867608cb00c93f4b91ba6dce source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/linuxnfs.spm 8196c617e9585a4906407bf666055508 PPC Power PC Platform: SuSE-6.4 (package name is knfsd!): ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/knfsd.rpm 52d64f1104530dac74ab03c508aa2ff4 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/knfsd.spm 5cdff95c21484fe01552a0ed80252adc ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds This section addresses currently known vulnerabilities in Linux/Unix systems that have not been resolved up to the release date of this advisory. - Netscape, versions from 3.0 to 4.73: The latest version of Netscape is currently being tested. SuSE Netscape rpms contain efficient workarounds against some "morbid" properties of Netscape in order to provide stable packages. These additions are being reworked right now. Also, cryprographical software export regulations require us to wait for the permission to redistribute the netscape package from our US-American ftp server. There are currently two known vulnerabilities in Netscape versions from 3.0 to 4.73: a) a buffer overflow in the jpeg image handling code b) a security flaw in Netscape's Java implementation a) has been fixed in Netscape version 4.74. Updated packages from SuSE will follow soon. Temporary fix/workaround: problem a) Turn off automatic image loading and do not click on images to trigger the download. problem b) Turn off Java and JavaScript. - suidperl The /usr/bin/suidperl perl interpreter in the SuSE Distributions has file permissions 755 by default. If the admin of a SuSE Linux system did not change the permission modes and/or the respective entry in /etc/permissions*, the SuSE Linux system is not vulnerable to the attack as published on bugtraq. An advisory announcing updated suidperl packages follows this announcement on the way to the mailing lists. Further details will be discussed therein. Temporary fix/workaround: chmod -s /usr/bin/suidperl # this is the default. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOZKEqHey5gA9JdPZAQF6qwf7Bg+FyrocbRBGDA1fpA48D29/jTbZhPDJ eVSZiYJvUdr1S3FfgqOVwe5TEjeazC3qdUoUdP4LS7SYJikZiYhKESuFjqgg8x1d 0OmX2+EH9v/ji6kKMOh9Ad8lpZ+b70UUe39/Hp1HGKxtTEPdWkaiulD5PCwo3FIf XiaXB00cFxGz997I3ttGXJp0VHJYubZFpy3atDk/bNd2SQzmol+GI9O2vwKZhraX dzf1bPZ4z488GmH/Y1KeJ0z4yHqN4Hn3xtXWF6VG6GC4IGjDGXKxLbXeZPlJzu4g Um25GSBedkwAYgRxqfJgJK1i9kUhS3E5zHzlwwJc8CfCjAPDG75Phg== =RH2l -----END PGP SIGNATURE-----

1 0