August 2000 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Re: SSL with embedded http-image-references
by Tobias Gasser 08 Aug '00

08 Aug '00

Hi, > Why do you think this is a security problem? Because it's (maybe) about some SSL-configuration. My actual question is about the displayed <TD>-background images ! Shouldn't they be displayed either ? Is this a possible sec-hole ? thanks tobi > > > if i reference images from other servers than mine (with mod_ssl) > > via http (wich has to be done 'cause the paths are being rewritten by > > a script...) the images are not loaded and are substituted by a > > broken key in Netscape. > > So i read in the archives and is says that i have to reference > > all embedded content (like images) via https too. > > > > But the strange thing is, that all background images (referenced > > via http too!) are displayed !! > > > > Is there a chance to get the other images to work too or is it > > impossible ? > > > > Thanks for your help ! > > > > Tobi > > > > PS: This should just be a temporary solution till the scripts are > > rewritten... > -o) > Hubert Mantel Goodbye, dots... /\\ > _\_v > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ AiCOMM agentur fuer information und communication AiCOMM Brecherspitzstrasse 8 Tel: 089 - 6979 83 0 81541 Muenchen Fax: 089 - 6979 8320 mailto:gasser@aicomm.de http://www.aicomm.de ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ------------------------------------------------------- -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ AiCOMM agentur fuer information und communication AiCOMM Brecherspitzstrasse 8 Tel: 089 - 6979 83 0 81541 Muenchen Fax: 089 - 6979 8320 mailto:gasser@aicomm.de http://www.aicomm.de ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

SSL with embedded http-image-references
by Tobias Gasser 08 Aug '00

08 Aug '00

Hi, i got a strange problem: if i reference images from other servers than mine (with mod_ssl) via http (wich has to be done 'cause the paths are being rewritten by a script...) the images are not loaded and are substituted by a broken key in Netscape. So i read in the archives and is says that i have to reference all embedded content (like images) via https too. But the strange thing is, that all background images (referenced via http too!) are displayed !! Is there a chance to get the other images to work too or is it impossible ? Thanks for your help ! Tobi PS: This should just be a temporary solution till the scripts are rewritten...

2 1

*.enc and the crypt command
by Steven T. Hatton 08 Aug '00

08 Aug '00

Is anybody familiar with the `crypt` command, or script. I have a file in *.enc format and the instructions I get with it are as follows: crypt < filename.enc > filename.tar.Z Any words of advice on what "crypt" is? The distributor of the .enc file seems to expect me to have this file on either Solaris or *** *** Linux. I don't want to buy *** *** Linux!!!!!!!!!!!!!!!! Thanks, Steve

2 2

Re: AW: [suse-security] SuSE security reputation, etc..
by rhoerbe＠netpromote.co.at 07 Aug '00

07 Aug '00

The issue is, that the default setup uses /etc/shadow for ssh, ftp, samba & al. It is an extra effort to setup and maintain passwords in different files. Apache has a different file by default. Let this compare to Lotus Notes. When you define a user there, the system prompts you for two different passwords. One to be used for the ID-file that contains the private key (and is never transmitted anywhere from the local system) and another one, that is used for HTTP basic authentication. This is easy to understand for novice admins and little extra effort. So, my on my whishlist to Easter Bunny: 1. Suse will add an installation/config option to make a separate pw-db for samba and proftpd (and maybe others) 2. Suse will add a list of passwords for different packages into yast user management. Rainer "OKDesign oHG Security Webmaster" <security(a)okdesign.de> Sent by: suse-security-return-2442-rhoerbe=netpromote.co.at(a)suse.com 05.08.00 20:52 To: "SuSE-Security-List" <suse-security(a)suse.com> cc: Subject: AW: [suse-security] SuSE security reputation, etc.. > I just thought to myself: > > Why is this insecure? If you login by SSH to do remote > maintenance, then true, anyone who sniffs your in the clear ftp > and pop passwords can login as you. > > But they can only login as you the USER. They can never sniff the > root password, as your "su root" password is always encrypted. > > .... > > and then the penny dropped. > > If someone ever logs into your user account. And then you login after > they have done their mischief, and su, then you have just given away > the crown jewels. Oh well. Just one thought: On our system the only possibility to log in and work on the shell is SSH with RSA-authentification. So, if someone sniffs the "normal" password, okay, he can get access to the emails and for ftp-access. But NOT for any works on the system itself. Because to log in with SSH, there is a different password necessary. So, okay, this is not really secure, but at least no one can really harm the system. Or am I wrong ??? --- Stephan --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

4 3

SuSe autorpm
by Artemios G. Voyiatzis 07 Aug '00

07 Aug '00

Greetings, FYI, regarding the installation of autorpm on SuSe, there is an interesting article in http://securityportal.com/topnews/weekly/linux20000807.html, under the section AutoRPM. The author mentions that you should manually change the added line in rc.config from START_AUTORPM_CRON="yes" to "no", since it is a beta package at the moment. He also states that the "perl_net" dependency is not crucial, so it can be safely ignored, using the --nodeps option of rpm. Finally he mentions that if you remove the package with the "rpm -e" option, rc.config is not updated, thus the previously mentioned line will exist after de-installation. Artemios G. Voyiatzis "Think negative"

1 0

telnet at 6.4
by alex medvedev 07 Aug '00

07 Aug '00

hallo, when i telnet to a port and a connection is refused, for some reason telnet tries to connect twice. i have never seen a telnet to display "Trying hostname..." before... this only happens when telnetting to localhost --> remote telnet is refused only once as it supposed to be. any ideas? alexm@quake:~ > telnet localhost 13 Trying 127.0.0.1... telnet: connect to address 127.0.0.1: Connection refused Trying localhost... telnet: connect to address localhost: Connection refused alexm@quake:~ > telnet localhost 19 Trying 127.0.0.1... telnet: connect to address 127.0.0.1: Connection refused Trying localhost... telnet: connect to address localhost: Connection refused

2 1

Re: AW: [suse-security] SuSE security reputation, etc..
by rhoerbe＠netpromote.co.at 07 Aug '00

07 Aug '00

>> The issue is, that the default setup uses /etc/shadow for ssh, ftp, samba >> & al. It is an extra effort to setup and maintain passwords in different >> files. Apache has a different file by default. >> >> Let this compare to Lotus Notes. When you define a user there, the system >> prompts you for two different passwords. One to be used for the ID-file >> that contains the private key (and is never transmitted anywhere from the >> local system) and another one, that is used for HTTP basic authentication. >> This is easy to understand for novice admins and little extra effort. >> >> So, my on my whishlist to Easter Bunny: >> 1. Suse will add an installation/config option to make a separate pw-db >> for samba and proftpd (and maybe others) >> 2. Suse will add a list of passwords for different packages into yast user >> management. > >Hmmm. I agree that these two points are desirable to implement, but it is >also too complex to do. One of the side effects will be that people >complain that authentication doesn't work (because the wrong file is >active) and people comlain that SuSE doesn't keep to the standards. If separated password files are a (recommended) option, accompanied with some comment about the impact, but not the default, then there should nothing be left to complain about. And a single /etc/shadow file is default, not a standard anyway. I disagree with your assessment, that people will complain about authentication that does not work. Under the assumption, that we have to sacrify some convenience to achieve some security (we could go with MS otherwise), separated password files fix (or at least isolate) the problem that ftp & al cause with clear text passwords. But, if you have to run passwd & sbmpasswd & httppasswd & xyzpasswd, even hard core command line junkies might find it annoying. Integrating different passwords into yast's user management would solve exactly this problem. > >We can't afford these two points in the long run. Also, modifying the >daemons/packages takes time and manpower... The package to make the installation for separated password files seems reasonable for me, but yast does not offer any plug-ins or interfaces for the user management. Complexity is also a question of architecture. I would recommend Suse to take a close look at IBM's Smit (the full-screen interface for AIX to administrate almost _everything_). I think that Smit has a nice architecture. - The text-interface differs from the graphical only in the presentation, the underlying code is obviously the same. Suse maintains two sets of code with yast1 and yast2. Which is a waste on the long term. - All actions are mapped to shell commands (although some are proprietary or complex) and can be viewed before and after execution. This makes the tool more a kind of editor .. Yast is a key component of the Suse distribution, and I think that Suse, to gain market share, should aim for convenience and well structured functionality in installation and use. I know, it is a long way to go .. > >It's nice project, though. Would you want to hack and maintain a set >of patches that resolve these problems in a few packages? Hmm. For an initial setup, I will look into this. But for yast, I think it is Suse's business. Rainer

1 0

SuSE Firewall & FreeS/WAN
by Andreas Gruenbacher 07 Aug '00

07 Aug '00

Dear Marc, I'm trying to set up a secure Internet gateway using SuSE Firewall and the FreeS/WAN package. For masquerading firewalls, FreeS/WAN tries to use ipfwadm, which doesn't exist on that system anymore. ipfwadm-wrapper also complains: You cannot mix the `ipfwadm' wrapper with ipchains. You must delete all user chains and flush all built-in chains if you want to use the `ipfwadm' wrapper. Are there any patches for FreeSWAN (perhaps a new _updown script) that work with SuSE firewall? Otherwise, what can I do to get FreeS/WAN running on my gateway? Thanks, Andreas. ------------------------------------------------------------------------ Andreas Gruenbacher, a.gruenbacher(a)computer.org Contact information: http://www.bestbits.at/~ag/

2 1

Re: [suse-security] POP to APOP converter
by rhoerbe＠netpromote.co.at 07 Aug '00

07 Aug '00

I thought, that a user would do POP authenication to the firewall, and the proxy on the firewall would do APOP authentication to the ISP's POP server. Just in case the ISP does not support POP/SSL. Rainer "Kurt Seifried" <listuser(a)seifried.org> 07.08.00 09:36 Please respond to "Kurt Seifried" To: <rhoerbe(a)netpromote.co.at> cc: Subject: Re: [suse-security] POP to APOP converter > Some ISPs do not support POP over SSL, but APOP. And one would not rely on > the user to configure SSL support. In outlook it's one checkbox. Just "as hard" as APOP =). I'm still unsure of exactly what your question is. The ISP uses POP, or APOP? you want to build a POP to APOP proxy or vice versa? > Rainer -Kurt

1 0

POP to APOP converter
by rhoerbe＠netpromote.co.at 07 Aug '00

07 Aug '00

Does somebody know if there exists a POP3 proxy, that can convert POP authenication to APOP? The reasoning behind it is, that I like (for smallish installations with dial-up internet connectivity) to have POP accounts on an external mail server, e.g. with the ISP. No user accounts on the firewall, no fetchmail, just a plain TCP-proxy. Users control when to retrieve mail. But they transmit their passwords, if they use outlook or netscape email clients. Rainer

2 1