August 2000 - openSUSE Security - openSUSE Mailing Lists

SuSE Security Announcement: suidperl (perl)
by Roman Drahtmueller 10 Aug '00

10 Aug '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: perl, all versions Date: Thursday, August 10th, 2000 Affected SuSE versions: 6.0-6.4, 7.0 Vulnerability Type: local root compromise Severity (1-10): 5 SuSE default package: yes, but not configured exploitable. Other affected systems: all linux systems using this package Content of this advisory: 1) security vulnerability resolved: suidperl (local root compromise) problem description, discussion, solution and upgrade information 2) pending vulnerabilities, temporary workarounds (Netscape) 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information suidperl is the perl interpreter for suid perl scripts, a part of the perl package. A maliciously implemented feature causes the interpreter to spawn the /bin/mail program to inform the superuser of its usage, thereby passing on untrusted environment that causes /bin/mail to execute arbitrary commands as user root. SuSE distributions are not susceptible to this problem because /usr/bin/suidperl is mode 755 (not suid) by default. Administrators must explicitly have enabled suidperl by changing the permission modes of the interpreter to 4755 root.root (suid root) for the exploit mechanism to work. In SuSE-Linux, activating suidperl is done by changing one of the files /etc/permissions.(easy|secure) and running SuSEconfig or `chkstat -set /etc/permissions.(easy|secure)', alternatively, depending on the setting of PERMISSION_SECURITY in /etc/rc.config. If SuSEconfig is turned off completely, the administrator of the system is obliged to change the permission modes by hand. The decision to not activate suidperl has been made because security problems were expected in the wild. O/S vendors have provided updated packages for both suidperl and mailx, the package containing /bin/mail. Basically, /bin/mail's fetures are not the origin of the security hole because the hostile environment is passed on by the suidperl interpreter, despite the fact that the interpreter runs suid root. Note: The upcoming SuSE-7.0 distribution _is_ vulnerable to the problem of this advisory if /usr/bin/suidperl is setuid root. However, suidperl is installed with mode 755 after the installation like in older SuSE Linux distributions and therefore can't be exploited without prior manual activation of suidperl by the system administrator. SuSE provides an updated package for the vulnerable software. It is strongly recommended to upgrade to the latest version found on our ftp server as described below. The package removes the mail notification and uses the syslog facility (priority warning) instead. Chose one of the following paths to download the package from our ftp server and install the package with the command `rpm -Fhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/perl.rpm 01c855f752b835536403c7bcc74d8114 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/perl.spm 16c850efed03cc5bd5b9bff3910dd6e4 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/perl.rpm 0640e11ba0b87f0d8a01b4b5dedbb8eb source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/perl.spm a68ade45a65e73805b2276ad35266d46 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/perl.rpm 7a3c2adae0c556a7ccb647eaca34e6c7 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/perl.spm 6bc207d360a1349f8f8067a83061f848 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/perl.rpm 6403b21d3795def485ad4a577a38c3be source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/perl.spm 47760a9798dc1489ca9fd2ee3a1756f6 SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/perl.rpm ac14b4fccfb10e5465f377b095621730 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/perl.spm 7d3aec7879fabcac3d2b7e4996340c31 AXP Alpha Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/perl.rpm 47853649c4683748558dbb72f759d739 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/perl.spm 5949a68b6126afdca98224cd6ed4be74 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/perl.rpm 994804e426adf718df64162c92a1ce84 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/perl.spm 879238a9e443bbe32cc4d421ed9a5d28 SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/perl.rpm cf2d763fb562a75395c5e613704cbd10 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/perl.spm e0aa5d0c91f474592e56eed2a8b3fae0 PPC Power PC Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/perl.rpm 828a210ef2b3aa462161010d4d19416a source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/perl.spm 9253498d7c474ad2e9f8dabe576d2c96 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds This section addresses currently known vulnerabilities in Linux/Unix systems that have not been resolved up to the release date of this advisory. - Netscape, versions from 3.0 to 4.73: The latest version of Netscape is currently being tested. SuSE Netscape rpms contain efficient workarounds against some "morbid" properties of Netscape in order to provide stable packages. These additions are being reworked right now. Also, cryprographical software export regulations require us to wait for the permission to redistribute the netscape package from our US-American ftp server. There are currently two known vulnerabilities in Netscape versions from 3.0 to 4.73: a) a buffer overflow in the jpeg image handling code b) a security flaw in Netscape's Java implementation a) has been fixed in Netscape version 4.74. Updated packages from SuSE will follow very soon. Temporary fix/workaround: problem a) Turn off automatic image loading and do not click on images to trigger the download. This may be a fairly unsatisfying solution. problem b) Turn off Java and JavaScript. - ntop ntop is a network statistics visualization utility which offers graphical analysis of network traffic and other statistics with a web browser. By default, ntop listens on port 3000 and requires no or a commonly known authentication password to view the data. ntop is only installed in network server selections and is not activated by default in SuSE Linux installations. The ntop packages shipped with SuSE Linux did not exhibit the unsafe behaviour when a file like /../../etc/passwd is referenced. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOZKEsXey5gA9JdPZAQFC7QgAlEgNyaJD76ACM/at0kHGPwNTby2P3gr4 Z8eQwoQ6N4CCh6BaJV+3AWRx0EELOu+vJ4mD6HMwTZDYS5GKxsvquz3ZD7ygLYDS RZnj9INehSp+LRdznqzE8LO0lHY3hy7budshTT4tLBrL90Ic6K3r76NokSH8Td6W AJVXtDyzxfCUx5h8grrmalVAJVh9kqdwls8X0o+Vco3fGl1vYrQxz4tx9JQQ2Uuf G4NNuD5fxs5fvYzpM5cpUggvbugTVzUQ+4eecGoE2A2pZWkLEtX8Dcogh08LOW7B tydQ8ZCOEJP0mqLtX2tFjpuZZNjUHbqiVtufVstIGUW1vw/dccDAaw== =DQ80 -----END PGP SIGNATURE-----

1 0

SuSE Security Announcement: rpc.kstatd (knfsd)
by Roman Drahtmueller 10 Aug '00

10 Aug '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: perl, all versions Date: Thursday, August 10th, 2000 Affected SuSE versions: 6.0-6.4, 7.0 Vulnerability Type: local root compromise Severity (1-10): 5 SuSE default package: yes, but not configured exploitable. Other affected systems: all linux systems using this package Content of this advisory: 1) security vulnerability resolved: suidperl (local root compromise) problem description, discussion, solution and upgrade information 2) pending vulnerabilities, temporary workarounds (Netscape) 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information suidperl is the perl interpreter for suid perl scripts, a part of the perl package. A maliciously implemented feature causes the interpreter to spawn the /bin/mail program to inform the superuser of its usage, thereby passing on untrusted environment that causes /bin/mail to execute arbitrary commands as user root. SuSE distributions are not susceptible to this problem because /usr/bin/suidperl is mode 755 (not suid) by default. Administrators must explicitly have enabled suidperl by changing the permission modes of the interpreter to 4755 root.root (suid root) for the exploit mechanism to work. In SuSE-Linux, activating suidperl is done by changing one of the files /etc/permissions.(easy|secure) and running SuSEconfig or `chkstat -set /etc/permissions.(easy|secure)', alternatively, depending on the setting of PERMISSION_SECURITY in /etc/rc.config. If SuSEconfig is turned off completely, the administrator of the system is obliged to change the permission modes by hand. The decision to not activate suidperl has been made because security problems were expected in the wild. O/S vendors have provided updated packages for both suidperl and mailx, the package containing /bin/mail. Basically, /bin/mail's fetures are not the origin of the security hole because the hostile environment is passed on by the suidperl interpreter, despite the fact that the interpreter runs suid root. Note: The upcoming SuSE-7.0 distribution _is_ vulnerable to the problem of this advisory if /usr/bin/suidperl is setuid root. However, suidperl is installed with mode 755 after the installation like in older SuSE Linux distributions and therefore can't be exploited without prior manual activation of suidperl by the system administrator. SuSE provides an updated package for the vulnerable software. It is strongly recommended to upgrade to the latest version found on our ftp server as described below. The package removes the mail notification and uses the syslog facility (priority warning) instead. Chose one of the following paths to download the package from our ftp server and install the package with the command `rpm -Fhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/perl.rpm 01c855f752b835536403c7bcc74d8114 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/perl.spm 16c850efed03cc5bd5b9bff3910dd6e4 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/perl.rpm 0640e11ba0b87f0d8a01b4b5dedbb8eb source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/perl.spm a68ade45a65e73805b2276ad35266d46 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/perl.rpm 7a3c2adae0c556a7ccb647eaca34e6c7 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/perl.spm 6bc207d360a1349f8f8067a83061f848 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/perl.rpm 6403b21d3795def485ad4a577a38c3be source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/perl.spm 47760a9798dc1489ca9fd2ee3a1756f6 SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/perl.rpm ac14b4fccfb10e5465f377b095621730 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/perl.spm 7d3aec7879fabcac3d2b7e4996340c31 AXP Alpha Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/perl.rpm 47853649c4683748558dbb72f759d739 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/perl.spm 5949a68b6126afdca98224cd6ed4be74 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/perl.rpm 994804e426adf718df64162c92a1ce84 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/perl.spm 879238a9e443bbe32cc4d421ed9a5d28 SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/perl.rpm cf2d763fb562a75395c5e613704cbd10 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/perl.spm e0aa5d0c91f474592e56eed2a8b3fae0 PPC Power PC Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/perl.rpm 828a210ef2b3aa462161010d4d19416a source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/perl.spm 9253498d7c474ad2e9f8dabe576d2c96 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds This section addresses currently known vulnerabilities in Linux/Unix systems that have not been resolved up to the release date of this advisory. - Netscape, versions from 3.0 to 4.73: The latest version of Netscape is currently being tested. SuSE Netscape rpms contain efficient workarounds against some "morbid" properties of Netscape in order to provide stable packages. These additions are being reworked right now. Also, cryprographical software export regulations require us to wait for the permission to redistribute the netscape package from our US-American ftp server. There are currently two known vulnerabilities in Netscape versions from 3.0 to 4.73: a) a buffer overflow in the jpeg image handling code b) a security flaw in Netscape's Java implementation a) has been fixed in Netscape version 4.74. Updated packages from SuSE will follow very soon. Temporary fix/workaround: problem a) Turn off automatic image loading and do not click on images to trigger the download. This may be a fairly unsatisfying solution. problem b) Turn off Java and JavaScript. - ntop ntop is a network statistics visualization utility which offers graphical analysis of network traffic and other statistics with a web browser. By default, ntop listens on port 3000 and requires no or a commonly known authentication password to view the data. ntop is only installed in network server selections and is not activated by default in SuSE Linux installations. The ntop packages shipped with SuSE Linux did not exhibit the unsafe behaviour when a file like /../../etc/passwd is referenced. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOZKEsXey5gA9JdPZAQFC7QgAlEgNyaJD76ACM/at0kHGPwNTby2P3gr4 Z8eQwoQ6N4CCh6BaJV+3AWRx0EELOu+vJ4mD6HMwTZDYS5GKxsvquz3ZD7ygLYDS RZnj9INehSp+LRdznqzE8LO0lHY3hy7budshTT4tLBrL90Ic6K3r76NokSH8Td6W AJVXtDyzxfCUx5h8grrmalVAJVh9kqdwls8X0o+Vco3fGl1vYrQxz4tx9JQQ2Uuf G4NNuD5fxs5fvYzpM5cpUggvbugTVzUQ+4eecGoE2A2pZWkLEtX8Dcogh08LOW7B tydQ8ZCOEJP0mqLtX2tFjpuZZNjUHbqiVtufVstIGUW1vw/dccDAaw== =DQ80 -----END PGP SIGNATURE-----

1 0

Antwort: [suse-security] Postfix Message Size limit Setting for Receiving Mail
by Holger-Schmidt＠arcor.net 10 Aug '00

10 Aug '00

>Hi >Does Postfix support message size limit on the Receiving end and if not what >is the best method of setting Receive message limits. (e.g. 2048K) >Thanks in Advance >Steven Thompson Use message_size_limit (default: 1024K) in main.cf. See addintional information in postfix manual: Configuration -> Resource Controls -> Obeject size limits Bye Holger

1 0

short introduction to myself + a (simple) problem
by Michael Schoenwiese 09 Aug '00

09 Aug '00

Hello ! I've been subscribed here approx a half year and I now introduce to myself because its the first time I raise a question. I'm running suse linux 6.3 on a pentium 233 with scsi hard disks and a raid compliant controller (too bad that it doesn't run under linux, its an adaptec AAA131U2) But this is not my problem, Since some days, my /var/log/messages shows every 20 minutes following lines, then sometimes it stops a few days doing so and sometimes it start doing it. There is no cronjob except the one which runs a tar command to zip all user homes to a tape drive and also all configuration files and databases. here is what it looks like : Aug 8 00:12:30 mail -- MARK -- Aug 8 00:32:30 mail -- MARK -- Aug 8 00:52:30 mail -- MARK -- Aug 8 01:12:30 mail -- MARK -- Aug 8 01:32:30 mail -- MARK -- Aug 8 01:52:30 mail -- MARK -- Aug 8 02:12:30 mail -- MARK -- mail is the name of the host does anyone have an idea what it could be ? I have this message since I set up this server. I dont think there is something wrong with the system either I don't believe it's service affecting, but I am really interested what this is. Sorry if I posted to the wrong list regards Michael

5 4

SuSEfirewall and MSN Gaming Zone
by Lars Sagen 09 Aug '00

09 Aug '00

Can anybody tell me what too do. I wont to access MSN Gaming Zone with DirectX SuSE 6.4 and SuSEfirewall 2.1 How to config this in SuSEfirewall Microsoft spec. to play games on MSN Gaming Zone TCP ports open 6667 28800-29000 DirectX ports Connection Client Host TCP 47624 Outbound 47624 Innbound TCP Innb. 2300-2400 2300-2400 TCP Outb. 2300-2400 2300-2400 UDP Innb. 2300-2400 2300-2400 UDP Outb. 2300-2400 2300-2400 My firewall.rc.config are like this: I now that this script are litle too open, but i am new on this and try too learn. FW_DEV_WORLD="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.0.0/24" FW_MASQ_DEV="$FW_DEV_WORLD" # e.g. "ippp0" or "$FW_DEV_WORLD" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_GLOBAL_SERVICES="no" # "yes" is a good choice FW_SERVICES_EXTERNAL_TCP="www ssh 10000" # Common: smtp domain FW_SERVICES_EXTERNAL_UDP="" # Common: domain FW_SERVICES_DMZ_TCP="" # Common: smtp domain FW_SERVICES_DMZ_UDP="" # Common: domain syslog FW_SERVICES_INTERNAL_TCP="ssh" # Common: ssh smtp domain FW_SERVICES_INTERNAL_UDP="" # Common: domain FW_TRUSTED_NETS="192.168.0.0/24" FW_SERVICES_TRUSTED_TCP="1:65535" # Common: ssh FW_SERVICES_TRUSTED_UDP="1:65535" # Common: syslog time ntp FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" # Common: "ftp-data" (sadly!) FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # Common: "dns" FW_SERVICE_DNS="no" # if yes, FW_TCP_SERVICES_* needs to have port 53 # (or "domain") set to allow incoming queries. # also FW_ALLOW_INCOMING_HIGHPORTS_UDP needs to be "yes" FW_SERVICE_DHCLIENT="yes" # if you use dhclient to get an ip address # you have to set this to "yes" ! FW_SERVICE_DHCPD="yes" # set to yes, if this server is a DHCP server FW_FORWARD_TCP="" # Beware to use this! FW_FORWARD_UDP="" # Beware to use this! FW_REDIRECT_TCP="" FW_REDIRECT_UDP="" FW_LOG_DENY_CRIT="yes" FW_LOG_DENY_ALL="yes" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" # END of rc.firewall Lars Sagen LS Data mob 95121400 e-post lars.sagen(a)lsdata.no e-mob ls.mob(a)lsdata.no

3 2

autorpm and latest secure files
by Rhys Davies 09 Aug '00

09 Aug '00

I used autorpm to update all flies it could come up with for my 6.2 installation. It all worked fine - very nice indeed, though it has got some way to go in terms of usability for people who do not want to invest a lot of time in these things. If it could be made to function like "Windows Update" it would become a sure fire winner. Maybe I missed the readme file. It maybe needs a dumbo's mode of operation / advanced mode. splitting updates into "critical / nice to have" such that one does not have to research too much. It copied a few files to ".newrpm", (or something like that) which I had to undo to preserve my config settings. ... I do not think much of it doing that. Does it produce a report of files changed at the end or did I miss that ? but after a reboot I got the char-major-4 error which I fixed in conf.modules, by setting it's Alias from "serial" to "off" BUT my biggest problem is that I am still getting: modprobe: Can't locate module eth0 modprobe: Can't locate module eth1 and also there is no sign of ppp0 in the output of ifconfig KDM no longer works. I've read the mail sent to root about changes required to make it work, but with no luck There appear to be no other module load problems during a restart. My question's: 1) What has been changed for my network cards not to be found ? 2) What do I need to do to fix this ? 3) Is there anything else I need to do to get KDM going again ? loosing the network is a very big headache at the moment. Rhys.

2 1

Re: [suse-security] SuSE security reputation, etc..
by dproc＠dol.net 09 Aug '00

09 Aug '00

On Sat, 05 Aug 2000, JF wrote: > > But they can only login as you the USER. They can never sniff the > > root password, as your "su root" password is always encrypted. > > This is how I understand it. > Even though the root passwd is encrypted on the box it is still sent > accross the wire in plain text, therefore sniffable. > Maybe you cam to the thread ot of sequence? What I meant was, during an SSH session, the su root password is encrypted across the wire. Pretty much the only places it is plaintext are the keyboard driver and login/pam. But my point was that if your user password is sniffed from a POP session, then leet can sprinkle your path with trojans, which might sniff your su password and steal it. Thats all. dproc

6 8

new version of SCSLog
by Thomas Biege 09 Aug '00

09 Aug '00

Hi ppl, I released a new version (2.1) of SCSLog, my systemcall logging module. I just cut some parts from the README file to show you what's new. --- README --- SCSLog provides you with the ability to log security relevant system calls like: - socketcall() + connect() + accept() + shutdown() - chmod() + make a file setuid + make a file setgid + make a file world-writeable - open() + create world-writeable files + create file without O_EXCL - symlink() - setuid() - setgid() - setreuid() - setregid() This informations should help you to track down security violations. Some nice features of this tool =============================== If you want to make SCSLog unremoveable/invisible, then load SCSUnrmv/SCSHide with parameter module=<modulesname>. # insmod scsunrmv.o modules="scslog" # rmmod scsunrmv # insmod scshide.o modules="scslog" # rmmod scshide If you want to make it persistent _and_ invisible you should 1) insmod scsunrmv.o and 2) insmod scshide.o _not_ vice versa! USAGE ===== scslog.o: logsocket={0,1} -> log socketcall() logchown={0,1} -> log chown() logopenww={0,1} -> log open() - world-writeable files logopenexcl={0,1} -> log open() - open file w/o O_EXCL flag (could lead to sym link attacks) logsymlink={0,1} -> log symlink() logsetuid={0,1} -> log setuid() logsetgid={0,1} -> log setgid() logsetreuid={0,1} -> log setreuid() logsetregid={0,1} -> log setregid() scshide.o: module="<string>" -> module to hide messages={0,1} -> log just error and syscall messages scsunrmv.o: module="<string>" -> module to make persistent messages={0,1} -> log just error and syscall messages --- README --- You'll find SCSLog 2.1 at http://www.suse.de/~thomas I would be happy if you test it and send me your bugreports and improvements. TIA. Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

RE: [suse-security] SuSE firewall and VPN
by Ulrich Breckel 09 Aug '00

09 Aug '00

Hi Rudi, > I try to set up my firewall to forward a PPTP-Client to my internal > PPTP-Server. I use SuSEfirewall-3.0 with the following settings in > firewall.rc.config: > > FW_Route=yes > FW_Masquerade=yes > FW_Masq_Nets="internal_net" > FW_Forward_IP="external_net,pptp-host,47" > FW_Forward_Masq_TCP="external_net,pptp-host,1723" > > and > ipfwd for masq ip-protocol 47 > > In syslog I get an accept message on the external interface, > but there is > nothing else happening (pptp client says "no answer"). > > Any help is appreciated. perhaps the following link will help http://www.wolfenet.com/~jhardin/ip_masq_vpn.html bye Uli

1 0

SuSE firewall and VPN
by CompuTel Technik 09 Aug '00

09 Aug '00

Hi everyone, I try to set up my firewall to forward a PPTP-Client to my internal PPTP-Server. I use SuSEfirewall-3.0 with the following settings in firewall.rc.config: FW_Route=yes FW_Masquerade=yes FW_Masq_Nets="internal_net" FW_Forward_IP="external_net,pptp-host,47" FW_Forward_Masq_TCP="external_net,pptp-host,1723" and ipfwd for masq ip-protocol 47 In syslog I get an accept message on the external interface, but there is nothing else happening (pptp client says "no answer"). Any help is appreciated. Rudi

1 0

rpc.statd exploit
by Volker Kuhlmann 09 Aug '00

09 Aug '00

Is SuSE (6.3) vulnerable to the recently published rpc.statd exploit? If so, how can I secure my system short-term? I kind of need NFS... Volker

3 2

SuSE 6.4 and mod_ssl
by Frank O'Yanco 09 Aug '00

09 Aug '00

Hi! Where can I find it? I not found it in ftp.suse.com neither SuSE 6.4 CDs. -- Frank O'Yanco Age of The Penguin -=- SuSE Linux 6.2 -=- http://andromeda.pmmf.hu

2 1

Re: [SLE] FYI- Netscape 4.4 -4.7 [Serious Java Security BUG]
by Eduardo Carriles 09 Aug '00

09 Aug '00

Hi (un- named) "sds07", Thanks a lot for the tip!! =`:) Hi friends All: ____________________________________________ [++ JAVA related exploit ahead ++] If you got a Netscape browser running you better disable/close Java till further notice... [Or trust sites that you frequent] (All platforms, thought??) (does no affect _winie_??) (does not affect _moz5/nscp6-pre2_??) [WARN] Just: Edit/Preferences/Advanced and disable: "Enable Java" Act ASAP. You are Warned!! ---- On Tue, 8 Aug 2000 10:06:07 -0400 sds07(a)health.state.ny.us wrote: > No flames, please. Just an FYI! > Netscape bug... > http://dailynews.yahoo.com/h/ap/20000807/tc/netscape_bug_2.html ---- No need to, just more (a lot more indeed): ____________________________________________ [INFO/TRACE of search documentation procedure performed] ** From using bottom Search box = "netscape" on "Slashdot: News for nerds, stuff that matters" URL: http://www.slashdot.org/ ** gives: "Slashdot: Search netscape" URL: http://slashdot.org/search.pl?query=netscape ** And then clicking on link: "Java Security Hole Makes Netscape Into Web Server by Hemos on Saturday August 05, @10:22PM EDT" URL: http://slashdot.org/article.pl?sid=00/08/06/0222241&mode=thread ** gives: "Slashdot | Java Security Hole Makes Netscape Into Web Server" URL: http://slashdot.org/article.pl?sid=00/08/06/0222241&mode=thread ** which notes: [Posted by Hemos (1) on Saturday August 05, @10:22PM from the big-and-bad dept. Baldrson (2) and other folks as well write: "Dan Brumleve is at it again with Brown Orifice (3). In this episode, our fearless grey hat (4) opens a security hole in the Web's foundation that makes Napster (5) look positively tame by comparison. Be careful with this, kids. It turns your Netscape Web browser into a Web server that can serve up your entire file system to any other Web browser."] [clicks] (1) "Hemos" URL: http://hemos.net (2) "Baldrson" URL: mailto:jabowery@netcom.com (3) "Brown Orifice" URL: http://www.brumleve.com/BrownOrifice/ (4) "grey hat" URL: http://slashdot.org/comments.pl?sid=00/07/27/1343236&cid=310 (5) "Napster" URL: http://www.napster.com/ [clicks expanded] (3) "Brown Orifice HTTPD Homepage" URL: http://www.brumleve.com/BrownOrifice/ ## ---- On a nutshell ---- ** Test Orifice On-Line URL: (same) http://www.brumleve.com/BrownOrifice/ ** Test BOHTTPD Spy ("see a list of links to browsers currently running BOHTTPD") URL: http://www.brumleve.com/BrownOrifice/BOHTTPD_spy.cgi ** Download ("get a copy of the Brown Orifice site and source code"): URL: http://www.brumleve.com/BrownOrifice/BOHTTPD_download.cgi ## ---- ------------- ---- (4) "Articles: Security Through Obscurity A GOOD Thing?" URL: http://slashdot.org/comments.pl?sid=00/07/27/1343236&cid=310 ** which key notes: "Give Grey Hats the Right Incentives" [end clicks] ____________________________________________ [COMMENTS] I have not got time / intentions to test "Brown Orifice", hope some body will do and post results. Note the (4) key on: //Dan Brumleve, the developer of DBarter (a) (which won the Hackers Conference prize for "best work in progress" last year (b)) was quite young when he discovered his first Netscape exploit Tracker (c). Netscape subsequently gave credit for finding the "Tracker" hole to a guy from Bell Labs."//, and consequences... URL (again): http://slashdot.org/comments.pl?sid=00/07/27/1343236&cid=310 (a) See [DBarter - Financial Infrastructure for the Internet] URL: http://www.dbarter.com/ (b) See Dan showing won price on hand (JPG), at his page: URL: http://www.dbarter.com/images/dan.jpg (c) See The Tracker Bug / Security Update on Netscape as of AUGUST 4, 1997: URL: http://home.netscape.com/security/notes/previous/tracker.html [INMHO] It is a matter of who tries harder. [SALT ] Or a "grain of it", as Lenz wrote on one of his numerous posts, He helping as ever: "Yes, I totally agree. Automated updating should be taken with a grain of Salt :)" See Lenz's post on "Re: [suse-security] SuSE security reputation, etc.." at: URL: http://lists.suse.com/archives/suse-security/2000-Aug/0088.html [HEAVY SALT] Fiuuu, it is available (BOHTTPD) to general public, source included, just waiting for some idiot to borrow it, enhance it, spread gargage on the Net, maybe learn some Java on the process, and who knows... Java performing. A Saga on it's own. ____________________________________________ [GRINS, GRRR's and more] Although i'm a Netscape® Communicator 4.74 128bits user, as you can see on: Headers/All: [X-Mailer: Mozilla 4.74 [en] (Win95; U)] (procedure if you use Netscape also). Through which i usually post. (3Com ADSL HomeConnect PCI 3CP3617, lack to support Linux, problem related!! GRRRR...) Cannot use my SuSE Linux to post directly to Net through ADSL, again GRRRR...... [XzFrSk¿?)¿)?$$!$·Arrrrgghhhsh...rumble rumble] ____________________________________________ Too much for one post... (beg your pardon!!) =`8) The War continues... No more for now. -- HTH Best regards, Eduardo Carriles [-- Better a smile than a flame --] (Long time SuSE-Linux [preferred distro] user). [-- Se me nota mucho? -- Notices me much?] [-- Have a lot of fun...]

1 0

SuSEfirewall question
by Jason McDonald 09 Aug '00

09 Aug '00

Hello Everyone, I have recently setup a firewall box using SuSE 6.4, where the interface to the internet (eth0) gets its IP address from a DHCP server and while perusing /var/log/messages I came upon the following entries, which seem to repeat at intervals of between 20 and 90 seconds. Aug 9 13:09:43 wallaby dhclient: DHCPREQUEST on eth0 to 202.12.113.74 port 67 Aug 9 13:09:43 wallaby kernel: Packet log: input DENY eth0 PROTO=17 202.12.113.74:67 202.12.113.21:68 L=339 S=0x00 I=15633 F=0x0000 T=128 (#81) Am I correct in thinking that this means that responses from the DHCP server are being blocked by the firewall? And if so, how do I fix the problem? I already have FW_SERVICE_DHCLIENT="yes" in my /etc/rc.config.d/firewall.rc.config file and cannot think of anywhere else that I need to do anything to permit DHCP to work properly. Any help would be much appreciated, Jason McDonald -- Random Signature #117: Maths and alcohol don't mix -- never drink and derive.

1 0

break-in
by ksemat＠wawa.eahd.or.ug 08 Aug '00

08 Aug '00

Could someone help me out with this I have responded by knocking out imap but there may be other avenues or it may be an innocent thing. This is what I have in my log. Aug 6 15:45:04 alpha imapd[27638]: System break-in attempt, host=infon819.jet.es [195.55.159.51] what other measures should I take? Noah ksemat(a)eahd.or.ug

3 2

Re: [suse-security] Re: SSL with embedded http-image-references
by Tobias Gasser 08 Aug '00

08 Aug '00

Hi, > Why do you think this is a security problem? Because it's (maybe) about some SSL-configuration. My actual question is about the displayed <TD>-background images ! Shouldn't they be displayed either ? Is this a possible sec-hole ? thanks tobi > > > if i reference images from other servers than mine (with mod_ssl) > > via http (wich has to be done 'cause the paths are being rewritten by > > a script...) the images are not loaded and are substituted by a > > broken key in Netscape. > > So i read in the archives and is says that i have to reference > > all embedded content (like images) via https too. > > > > But the strange thing is, that all background images (referenced > > via http too!) are displayed !! > > > > Is there a chance to get the other images to work too or is it > > impossible ? > > > > Thanks for your help ! > > > > Tobi > > > > PS: This should just be a temporary solution till the scripts are > > rewritten... > -o) > Hubert Mantel Goodbye, dots... /\\ > _\_v > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ AiCOMM agentur fuer information und communication AiCOMM Brecherspitzstrasse 8 Tel: 089 - 6979 83 0 81541 Muenchen Fax: 089 - 6979 8320 mailto:gasser@aicomm.de http://www.aicomm.de ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ------------------------------------------------------- -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ AiCOMM agentur fuer information und communication AiCOMM Brecherspitzstrasse 8 Tel: 089 - 6979 83 0 81541 Muenchen Fax: 089 - 6979 8320 mailto:gasser@aicomm.de http://www.aicomm.de ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

SSL with embedded http-image-references
by Tobias Gasser 08 Aug '00

08 Aug '00

Hi, i got a strange problem: if i reference images from other servers than mine (with mod_ssl) via http (wich has to be done 'cause the paths are being rewritten by a script...) the images are not loaded and are substituted by a broken key in Netscape. So i read in the archives and is says that i have to reference all embedded content (like images) via https too. But the strange thing is, that all background images (referenced via http too!) are displayed !! Is there a chance to get the other images to work too or is it impossible ? Thanks for your help ! Tobi PS: This should just be a temporary solution till the scripts are rewritten...

2 1

*.enc and the crypt command
by Steven T. Hatton 08 Aug '00

08 Aug '00

Is anybody familiar with the `crypt` command, or script. I have a file in *.enc format and the instructions I get with it are as follows: crypt < filename.enc > filename.tar.Z Any words of advice on what "crypt" is? The distributor of the .enc file seems to expect me to have this file on either Solaris or *** *** Linux. I don't want to buy *** *** Linux!!!!!!!!!!!!!!!! Thanks, Steve

2 2

Re: AW: [suse-security] SuSE security reputation, etc..
by rhoerbe＠netpromote.co.at 07 Aug '00

07 Aug '00

The issue is, that the default setup uses /etc/shadow for ssh, ftp, samba & al. It is an extra effort to setup and maintain passwords in different files. Apache has a different file by default. Let this compare to Lotus Notes. When you define a user there, the system prompts you for two different passwords. One to be used for the ID-file that contains the private key (and is never transmitted anywhere from the local system) and another one, that is used for HTTP basic authentication. This is easy to understand for novice admins and little extra effort. So, my on my whishlist to Easter Bunny: 1. Suse will add an installation/config option to make a separate pw-db for samba and proftpd (and maybe others) 2. Suse will add a list of passwords for different packages into yast user management. Rainer "OKDesign oHG Security Webmaster" <security(a)okdesign.de> Sent by: suse-security-return-2442-rhoerbe=netpromote.co.at(a)suse.com 05.08.00 20:52 To: "SuSE-Security-List" <suse-security(a)suse.com> cc: Subject: AW: [suse-security] SuSE security reputation, etc.. > I just thought to myself: > > Why is this insecure? If you login by SSH to do remote > maintenance, then true, anyone who sniffs your in the clear ftp > and pop passwords can login as you. > > But they can only login as you the USER. They can never sniff the > root password, as your "su root" password is always encrypted. > > .... > > and then the penny dropped. > > If someone ever logs into your user account. And then you login after > they have done their mischief, and su, then you have just given away > the crown jewels. Oh well. Just one thought: On our system the only possibility to log in and work on the shell is SSH with RSA-authentification. So, if someone sniffs the "normal" password, okay, he can get access to the emails and for ftp-access. But NOT for any works on the system itself. Because to log in with SSH, there is a different password necessary. So, okay, this is not really secure, but at least no one can really harm the system. Or am I wrong ??? --- Stephan --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

4 3

SuSe autorpm
by Artemios G. Voyiatzis 07 Aug '00

07 Aug '00

Greetings, FYI, regarding the installation of autorpm on SuSe, there is an interesting article in http://securityportal.com/topnews/weekly/linux20000807.html, under the section AutoRPM. The author mentions that you should manually change the added line in rc.config from START_AUTORPM_CRON="yes" to "no", since it is a beta package at the moment. He also states that the "perl_net" dependency is not crucial, so it can be safely ignored, using the --nodeps option of rpm. Finally he mentions that if you remove the package with the "rpm -e" option, rc.config is not updated, thus the previously mentioned line will exist after de-installation. Artemios G. Voyiatzis "Think negative"

1 0

telnet at 6.4
by alex medvedev 07 Aug '00

07 Aug '00

hallo, when i telnet to a port and a connection is refused, for some reason telnet tries to connect twice. i have never seen a telnet to display "Trying hostname..." before... this only happens when telnetting to localhost --> remote telnet is refused only once as it supposed to be. any ideas? alexm@quake:~ > telnet localhost 13 Trying 127.0.0.1... telnet: connect to address 127.0.0.1: Connection refused Trying localhost... telnet: connect to address localhost: Connection refused alexm@quake:~ > telnet localhost 19 Trying 127.0.0.1... telnet: connect to address 127.0.0.1: Connection refused Trying localhost... telnet: connect to address localhost: Connection refused

2 1

Re: AW: [suse-security] SuSE security reputation, etc..
by rhoerbe＠netpromote.co.at 07 Aug '00

07 Aug '00

>> The issue is, that the default setup uses /etc/shadow for ssh, ftp, samba >> & al. It is an extra effort to setup and maintain passwords in different >> files. Apache has a different file by default. >> >> Let this compare to Lotus Notes. When you define a user there, the system >> prompts you for two different passwords. One to be used for the ID-file >> that contains the private key (and is never transmitted anywhere from the >> local system) and another one, that is used for HTTP basic authentication. >> This is easy to understand for novice admins and little extra effort. >> >> So, my on my whishlist to Easter Bunny: >> 1. Suse will add an installation/config option to make a separate pw-db >> for samba and proftpd (and maybe others) >> 2. Suse will add a list of passwords for different packages into yast user >> management. > >Hmmm. I agree that these two points are desirable to implement, but it is >also too complex to do. One of the side effects will be that people >complain that authentication doesn't work (because the wrong file is >active) and people comlain that SuSE doesn't keep to the standards. If separated password files are a (recommended) option, accompanied with some comment about the impact, but not the default, then there should nothing be left to complain about. And a single /etc/shadow file is default, not a standard anyway. I disagree with your assessment, that people will complain about authentication that does not work. Under the assumption, that we have to sacrify some convenience to achieve some security (we could go with MS otherwise), separated password files fix (or at least isolate) the problem that ftp & al cause with clear text passwords. But, if you have to run passwd & sbmpasswd & httppasswd & xyzpasswd, even hard core command line junkies might find it annoying. Integrating different passwords into yast's user management would solve exactly this problem. > >We can't afford these two points in the long run. Also, modifying the >daemons/packages takes time and manpower... The package to make the installation for separated password files seems reasonable for me, but yast does not offer any plug-ins or interfaces for the user management. Complexity is also a question of architecture. I would recommend Suse to take a close look at IBM's Smit (the full-screen interface for AIX to administrate almost _everything_). I think that Smit has a nice architecture. - The text-interface differs from the graphical only in the presentation, the underlying code is obviously the same. Suse maintains two sets of code with yast1 and yast2. Which is a waste on the long term. - All actions are mapped to shell commands (although some are proprietary or complex) and can be viewed before and after execution. This makes the tool more a kind of editor .. Yast is a key component of the Suse distribution, and I think that Suse, to gain market share, should aim for convenience and well structured functionality in installation and use. I know, it is a long way to go .. > >It's nice project, though. Would you want to hack and maintain a set >of patches that resolve these problems in a few packages? Hmm. For an initial setup, I will look into this. But for yast, I think it is Suse's business. Rainer

1 0

SuSE Firewall & FreeS/WAN
by Andreas Gruenbacher 07 Aug '00

07 Aug '00

Dear Marc, I'm trying to set up a secure Internet gateway using SuSE Firewall and the FreeS/WAN package. For masquerading firewalls, FreeS/WAN tries to use ipfwadm, which doesn't exist on that system anymore. ipfwadm-wrapper also complains: You cannot mix the `ipfwadm' wrapper with ipchains. You must delete all user chains and flush all built-in chains if you want to use the `ipfwadm' wrapper. Are there any patches for FreeSWAN (perhaps a new _updown script) that work with SuSE firewall? Otherwise, what can I do to get FreeS/WAN running on my gateway? Thanks, Andreas. ------------------------------------------------------------------------ Andreas Gruenbacher, a.gruenbacher(a)computer.org Contact information: http://www.bestbits.at/~ag/

2 1

Re: [suse-security] POP to APOP converter
by rhoerbe＠netpromote.co.at 07 Aug '00

07 Aug '00

I thought, that a user would do POP authenication to the firewall, and the proxy on the firewall would do APOP authentication to the ISP's POP server. Just in case the ISP does not support POP/SSL. Rainer "Kurt Seifried" <listuser(a)seifried.org> 07.08.00 09:36 Please respond to "Kurt Seifried" To: <rhoerbe(a)netpromote.co.at> cc: Subject: Re: [suse-security] POP to APOP converter > Some ISPs do not support POP over SSL, but APOP. And one would not rely on > the user to configure SSL support. In outlook it's one checkbox. Just "as hard" as APOP =). I'm still unsure of exactly what your question is. The ISP uses POP, or APOP? you want to build a POP to APOP proxy or vice versa? > Rainer -Kurt

1 0

POP to APOP converter
by rhoerbe＠netpromote.co.at 07 Aug '00

07 Aug '00

Does somebody know if there exists a POP3 proxy, that can convert POP authenication to APOP? The reasoning behind it is, that I like (for smallish installations with dial-up internet connectivity) to have POP accounts on an external mail server, e.g. with the ISP. No user accounts on the firewall, no fetchmail, just a plain TCP-proxy. Users control when to retrieve mail. But they transmit their passwords, if they use outlook or netscape email clients. Rainer

2 1