August 2000 - openSUSE Security - openSUSE Mailing Lists

AHA! ITS ALIVE oops no it isn't ;(
by Stuart Hodgkinson 14 Aug '00

14 Aug '00

hello again everyone. right ive been having a tinker and i've managed to get part of the masqurading working!!!! however the name server bit is shafted still. I can ping anything anywhere (as long as i leave the DNS flag mentioned in example 2 on!). However if i try to ping by using the DNS name it fails. So i tried this on the server and low and behold it too failed ?!?!?! when i turn the firewall of I can ping by name but i have no masqing (obviously). My question to the clever out there is what flag do i need to tweak, change , turn on turn off or hit with a 20 tonn lump hammer to get it to work. I had hair once.................. -- Stuart Hodgkinson Software Engineer "When bashing the keyboard into your forehead just isn't enough."

2 1

Help! any other examples (gimme examples please ;) )?
by Stuart Hodgkinson 14 Aug '00

14 Aug '00

I have tried to set up the firewal package on s.u.s.e 6.4 and use example 2 from the EXAMPLES file as a template for my system. However the masqurading doesn't work? has anyone got a working config file that may help me ? im trying to get all machines on my network to be ipmasq'd for pinging telnet etc etc but i require all http access to go through squid. Please help............... im losing my mind!!!! StOo

2 2

SSH capable version of dump
by Thomas Forbriger 14 Aug '00

14 Aug '00

Hi list, we are using dump to do remote backups in our local network. root of the dumping host uses a user account on another machine that is connected to a tape device. In the last months we did close a lot of network services and advice our users to switch to SSH and SCP for obvious reasons. We would be very happy to close the traditional r-services completely too. However dump uses rmt which relies on rexec or rcmd which again need rshd or rexecd running. I looked for a way to make dump use SHH but found none. I know tar offers the --rsh-command option but I would prefer to stay with dump and use our hand-tailored scripts around it. So there are two questions: - Does anybody know about a version of dump that is able to cooperate with SSH? - Another solution would be to keep r-services open and restrict them to local hosts via /etc/hosts.deny, /etc/hosts.allow and the tcpd. Are there any security implications with this solution that I missed? Thanks, Thomas -- |--------------------------------------------------------------------------| | Thomas Forbriger email: Thomas.Forbriger(a)geophys.uni-stuttgart.de | | Universitaet Stuttgart - Institut fuer Geophysik | | Richard-Wagner-Str. 44 D-70184 Stuttgart Germany | | Tel ++49 (711) 121-3593 or 3422 or 3424 or 3590 | Fax ++49 (711) 2361218 | | http://www.geophys.uni-stuttgart.de/thof | | "... there's nothing more bizarre than reality..." (M. Kindermann) |

3 3

Re: [suse-security] password generator - Doh!
by rhoerbe＠netpromote.co.at 14 Aug '00

14 Aug '00

*not on Linux!* The kernel provides real randomness (see urandom (4)). OK, it is pretty slow, but you can increase the data volume by using /dev/random as seed to a pseudo-random generator. Or, do cat /dev/random > myrandoms over night. BTW, this is a good argument, why to use a Linux box in banking etc. enviornments running various hosts, because that is a quite unique feature of this O/S. Rainer Steffen Dettmer <steffen(a)dett.de> Sent by: suse-security-return-2595-rhoerbe=netpromote.co.at(a)suse.com 14.08.00 09:55 Please respond to "Steffen Dettmer" To: suse-security(a)suse.de cc: Subject: Re: [suse-security] password generator - Doh! * John Pinder wrote on Fri, Aug 11, 2000 at 02:03 -0700: > srand; > sub randselect { > $_[0]->[rand @{ $_[0] } ] > } #Thank you O'Reilly! mmm... If I see it right then you use rand as source of randomness only, ain't? This isn't always a nice idea, since the entrophy of rand may be low, and you have to note that i.e. a pid has usually only 16 bit (under some circumstances predictable) entrophy, and time() has a very few bits randomness only and should be predictable usually. It seems better for me, to use the tv.usec field returnd by gettimeofday() and/or collect some entrophy directly from the user. I made some programm that reads in keystrokes and uses the timeings between the keystrokes too. I used the following functions to collect entrophy. It's not really strong but obviously better than useing some time() get getpid() only. The value of "ps axww|gzip" should be a nice non-predictable thing too. I would be glad to get some comment about the following code, maybe I missed some important things? Here are the functions: sub keyboard_seed() { return 0 if ($NO_KEY_TYPEING); #do nothing if set #C would be better... ;-) my $time_sum=0; #"rotated" value for keystroke timings my $key_sum=0; #"rotated" value for keycodes my $rin=''; #select() bit vector vec($rin,fileno(STDIN),1) = 1; #construct STDIN select vector $r=$rin; #select-vector system "stty", '-icanon', '-echo', 'eol', "\001"; #set line discipline: non canonical mode no echo select(STDOUT); $|=1; #set STDOUT unbuffered print "I have to collect some enthropy. ", "I'll analyze you keyboard hits.\n"; print "Please hit 32 keys now: [", " " x 32, "]\n"; print " ---> "; for ($n=0; $n<32; $n++) { #32 keys my $one_time=0; #time between two keystrokes my $c=''; #1 byte input buffer while (($rin=$r,$nfound = select($rin, undef, undef, 0.01)) == 0) { #wait until data on STDIN $one_time++; #a time tick without data $one_time %= 2**8; #we take 4 bit only... } sysread(STDIN, $c, 1); #read char from STDIN print "*"; #just a mark #add some bits to sum: my $b4 = ((4 ** $n)%(2**16)); #max 2 bytes (factor) my $b6 = ((6 ** $n)%(2**16)); #max 2 bytes (factor) $time_sum = $time_sum + $one_time * $b4; #4 bits (a "shift" in) $key_sum = $key_sum + ( ord($c)-ord('0')) * $b6;#6 bits } print "\nENOUGH, Thank you!\n\n"; sleep 2; #now we have to flush input (for such users that type 33 chars :-) while (($rin=$r,$nfound = select($rin, undef, undef, 0)) != 0) { sysread(STDIN, $rin, 1); #trash input } #restore line discipline mode system "stty", 'icanon', 'echo', 'eol', '^@'; # ASCII null select(STDOUT); $|=0; #set line buffered mode my $seed = $time_sum ^ $key_sum ; #XOR timer and key longs printf " (Keyboard seed value: 0x%X [T:0x%X K:0x%X])\n", $seed, $time_sum, $key_sum unless($QUIET_MODE); return $seed; #pass seed to caller } sub rnd_init() { #calling srand with entrophy... #we "hash" some "ps" process info and collect enthropy from user open(OLDERR, ">&STDERR") or die "STDERR->OLDERR $!\n"; open(STDERR, ">/dev/null") or die "STDERR->/dev/null $!\n"; close(STDERR); #"redirect" STDERR; it seems that IT DOES NOT WORK CORRECTLY!! #$seed1 = (unpack "%L*", `find /proc -print | xargs cat gzip`); $seed1 = keyboard_seed(); $seed2 = (time ^ $$ ^ unpack "%L*", `ps axww | gzip`); $seed = $seed1 ^ $seed2; #next line DOES NOT WORK correctly at least under Solaris!!! open(STDERR, ">&OLDERR") or print OLDERR "OLDERR->STDERR $!\n"; close (OLDERR); printf " --> 32 bits enthropy: 0x%X <--\n", $seed unless ($QUIET_MODE); srand($seed); #set calculated seed } oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel. --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

password generator
by jan 14 Aug '00

14 Aug '00

Hi list, passwords again... I'm searching for a tool that generates many many passwords in a list, so that i can automatically assign them to users. thanx for your help... -- jan meyer sysadmin FH-Potsdam

6 7

Small holidays ahead, see you on return
by Eduardo Carriles 13 Aug '00

13 Aug '00

Hi friends all, As of today I am having my Small piece of Holidays. Too small for my desires, but.... See you on my return at [SLE] mainly or at [suse-security] some times. Be well. -- Best regards, Eduardo Carriles [-- Better a smile than a flame --] (Long time SuSE-Linux [preferred distro] user). [-- Se me nota mucho? -- Notices me much?] [-- Have a lot of fun...]

1 0

Re: [suse-security] autorpm and latest secure files
by Volker Kuhlmann 13 Aug '00

13 Aug '00

> What are the recomended steps to do security updates from FTP when there is no > PGP signature in the files? You know there was this incident with tripwire on > the dutch server that was hacked and trojaned as far as I remember. Is there a > reason to worry about somebody being able to hack and trojan the security > updates supplied via ftp AND to hack an change the md5 sums provided by SuSE > at the same time? Or is this coincidence too far from being probable? The bottom line is that the usefulness of those md5 sums is seriously impaired. As I pointed that out while 6.3 was current I am a little disappointed that 7.0 still does not have signed packages. There may be organisational problems, but Red Hat manages since 4.2 and 1996. My question of long ago about how to use those md5 sums easily never got an answer. Here is what I figure: 1) get the md5 sum: a) copy out of advisory (after checking the advisory's signature) and paste into a texteditor. Given the number of bugs and incorrectly placed (by SuSE) sums in the advisory, I would not assign a very high relibility factor to this source. b) download that file with the sums from the ftp server. One would have to use ftp.suse.com directly, mirrors could have been hacked. What about encryption-related packages? As has been pointed out (by Gerhard?), doing both and cross-checking might be a good idea. 2) paste sums into a text editor. Then paste the filename in there too, with 2 spaces separation. The lines in the advisory are useless, because they are of the form 72b3eb67t36f ftp://.../package.rpm md5sum -c does not take complete URLs, and anyway I download packages including the version or things would become very messy at my end. That the advisory does not contain full package names is a pain. 3) run md5sum -c Perhaps I am lazy, but I find that a PITA. Disregarding laziness, the usefulness of the whole procedure is doubtful as well, as the chain breaks in the weakest point, and the weakest point is that md5sums can not be obtained securely. Even ftp://ftp.suse.com/ is not as secure as the machine SuSE would be using to sign packages. Or am I missing something? I have hopes for 7.1... Volker

1 0

Ident Service dependencies
by Steven Thompson 11 Aug '00

11 Aug '00

Hi I would like to know which services are dependent on the "Ident service". As I'm configuring a firewall server and would like to if I can shut the service down. Thanks in Advance Steven Thompson

2 1

SuSE security reputation, etc..
by Len Rose 11 Aug '00

11 Aug '00

It would be really great if SuSE could gain a reputation as being the most secure Linux implementation that exists today. Something like OpenBSD's reputation would be excellent, and from what I've seen SuSE could achieve this if they tried. I saw this on the mysql mailing list, and I'm sure others will see it there first, but just in case: http://www.abcnews.go.com/sections/tech/FredMoody/moody.html It really sucks that SuSE wasn't even mentioned. Len

15 23

Security implications of SMB through masquerading firewall?
by Andreas Gruenbacher 11 Aug '00

11 Aug '00

Hi, I would like to allow users behind a masquerading firewall access to SMB shares outside. For that, I have configured SuSE firewall as follows: FW_SERVICES_INTERNAL_TCP="netbios-ssn" FW_SERVICES_INTERNAL_UDP="netbios-ns netbios-dgm" (netbios-ns = 137, netbios-dgm = 138, netbios-ssn = 139) Is this reasonably safe? Are there any better ways to do that? Thanks, Andreas. ------------------------------------------------------------------------ Andreas Gruenbacher, a.gruenbacher(a)computer.org Contact information: http://www.bestbits.at/~ag/

1 0