August 2000 - openSUSE Security - openSUSE Mailing Lists

Dialin/VPN/Firewall
by Erwin Zierler - Stubainet 29 Aug '00

29 Aug '00

Hi, I recently have installed a firewall machine (SuSE 6.4, kernel 2.2.14) for a company connected to the internet via a 64K permanent leased line. Initially I was told there were no requirements to offer any services from inside the company to the outside (www, mail, etc.) so I went with a fairly simple setup (no DMZ) which would also fit their budget. Setup: Internet - Cisco Router - Linux Firewall - LAN While setting up the machine on site the IT department found out, that their new provider had taken over the domain name (as requested) and provided IP addresses for firewall.company.com, mail.company.com and also www.company.com all routed to the same network. Soon I was confronted with the wish to make their NT based mail server - residing on the internal LAN and formerly sending and recieving mail via a dialup-link (to the old provider) - talking to the outside world. Setting up a second firewall and a DMZ (which for me would have been the best solution security wise) was not an option. So I went with the ipmasqadm tool and now I am portforwarding mail to and from mail.company.com over the firewall machine. I am not very happy with this as it just opens more potential vulnerabilities. First question: does anyone have a better solution for this (given the setup and restrictions I described above)? Now, after connecting those guys to the internet they contacted me again with the next wish: certain employees are supposed to be able to connect from home/hotel/anyplace (of course outside the LAN) via firewall (or what they suggested first - a dialin server INSIDE the LAN *sigh*) to certain services inside their LAN (mainly fileservices). Doh! Second question: What would be a good/the best solution to give them access? I am extremly reluctant to let netbios and similar protocols cross the firewall, I also dont really want to provide dialup access on the firewall box and even less on a machine inside the LAN. Anything that will be transferred would have to be encrypted since I can't imagine they would want to transmit confidential material without some sort of protection. Ok, I started reading up on VPNs and related material. To be short, I am not familiar with this topic yet so I thought I try and get some advice from this mailinglist first before I waste hours of investigating useless material. All hints and/or links to material discussing this topic are very much appreciated. Thanks, Erwin Erwin Zierler | Web-/Hostmaster - Stubainet | Email: Erwin.Zierler(a)stubainet.at / webmaster(a)stubainet.at | Mobil: 0664 - 130 67 91 Tel.: 05225 - 64325 Fax 99

5 5

Secure By Default - PLEASE!
by Nix 28 Aug '00

28 Aug '00

How bout it SuSE? I have bought every version of SuSE since 5.0, I have Installed >30 SuSE servers for various clients and given away 200 copies of the SuSE 6.4 demo CD at a Govt Expo (in Australia) (Thanks to Michaela Geuthner [mailto:mg@suse.de] for the promo material he shiped me at short notice from Germany) I love SuSE, and thinks it's the best Distro available, yet, a disabled by default policy would IMHO be the best thing SuSE could ever do. As far as I'm concerned the only thing that should be enabled by default is sshd and _thats's_ even debatable. Face it, it's not going to make it any harder for your average desktop flunkie who want's to setup a kde box and browse the web. If they want to run a personal web server or ftp server then that _should_ know how to enable it from inetd.conf etc, or they should NOT be running the thing. I think the harden SuSE script, and SuSE firewall is brilliant, but half of the things harden_suse does should be _default_ not options available in an optional package in the sec series.... PLEASE PLEASE make a few simple changes to the defaults to help make SuSE the most secure Mainstream linux distro out there in. Peter Nixon Senior Security Consultant IT Audit & Consulting (ITAC) Pty Ltd http://www.itaudit.com.au mailto:petern@itaudit.com.au --snip-- >To: BUGTRAQ(a)SECURITYFOCUS.COM > >Aleph One wrote: > > CERT Advisory CA-2000-17 Input Validation Problem in rpc.statd > > > > Original release date: August 18, 2000 > > Source: CERT/CC > > > > A complete revision history is at the end of this file. >.. > > RedHat > > > > http://www.redhat.com/support/errata/RHSA-2000-043-03.html > > > >It should be noted that Red Hat states: >"Although there is no known exploit for the flaw in rpc.statd, Red Hat urges >all users running rpc.statd to upgrade to the new nfs-utils package." > >This is wrong. > >Because of a message posted by "ron1n - <shellcode(a)HOTMAIL.COM>" on the 5th >of August to Bugtraq. > >I quote: >"Included below is an exploit for the recently exposed linux rpc.statd >format string vulnerability[0]. I have tailored it towards current Redhat >Linux 6.x installations. It can easily be incorporated into attacks against >the other vulnerable Linux distributions." > >I hope Red Hat updates this information. Although I really hope they'll >just disable rpc.* services, most things in inetd, and other daemons *BY >DEFAULT*. If a user can't figure out how to turn on a service, they >probably shouldn't be running the service in the first place. This alone >would stop most of the "remote root in default" problems that Red Hat (and >other Linuxes) seem to face. OpenBSD gets this correct, how hard can it be >for the various Linux distrubtions to insert some #s in inetd.conf, or have >things chmod -x by default? > >-- > www.kuro5hin.org -- technology and culture, from the trenches.

15 20

ssh
by semat＠wawa.eahd.or.ug 28 Aug '00

28 Aug '00

Hello, I have been running ssh for some time time now however I have been using password authentication. I would now like to use RSA too. I need help on how this is done. As well I would like to have my set up such thatboth RSA and password authentication have to work before someone can login. This is simply because I provide ftp and if such a password is sniffed then it can be used to start an ssh session. However if I use RSA authentication as well then there would be another line of defence against sniffed passwords.

3 2

AW: AW: [suse-security] Popper verbosity
by Klug, Boris 28 Aug '00

28 Aug '00

Hi! so how can I disable the popper logging of tcpd? Havent found something in "man tcpd". Maybe running popper in deamon mode is a good idea? -- i.A. Dipl.-Inf. Boris Klug, boris.klug(a)ibs-ag.de, http://www.ibs-ag.de/ IBS AG engineering consulting software, The Quality Company Rathausstraße 56, 56203 Höhr-Grenzhausen, Fon: 02624/9180-0, Fax: -200 > -----Ursprüngliche Nachricht----- > Von: Roman Drahtmueller [mailto:draht@suse.de] > Gesendet: Sonntag, 27. August 2000 08:50 > An: Jürgen Bloß > Cc: suse-security(a)suse.com > Betreff: Re: AW: [suse-security] Popper verbosity > > > > Hello again! > > > > Indeed, the suggested solution does not work! > > But there has to be a better way than rebuild the popper! > > Problem is: I couldn't find the output line in the popper > source. Could > > it be that inetd is doing this log, before calling popper??? > > But I surely son't want to rebuild the inetd! > > > > Doesn't anybody else experience this problem that popper is > cluttering > > the /var/log/messages file? > > > > There *must* be a way to stop this logging-call. Perhaps by > configuring > > syslogd??? > > > > Jürgen > > To clear this up: > > There are possibly two lines per connection in your syslogs: > > Aug 27 08:36:32 para popper[10193]: connect from 127.0.0.1 (127.0.0.1) > Aug 27 08:37:01 para popper[10193]: Stats: shotdead 1 415 0 0 > > > The first line is from /usr/sbin/tcpd (the tcp wrapper) in > /etc/inetd.conf. It's not the popper program's fault - in > fact, it doesn't > even know that tcpd wrote a log since it was started from him. > > The second line vanishes if you remove the "-s" from the > popper line in > /etc/inetd.conf. This works, you find the relevant code in > pop_updt.c:86 > and pop_log.c. > > Thanks, > Roman. > -- > - > - > | Roman Drahtmüller <draht(a)suse.de> // > "Caution: Cape does | > SuSE GmbH - Security Phone: // not enable > user to fly." > | Nürnberg, Germany +49-911-740530 // (Batman Costume > warning label) | > - > - > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

mail as root
by Roman Drahtmueller 27 Aug '00

27 Aug '00

Hi, After I made a brief comment on a mailinglist that said "don't mail as root". I got half a dozen replies asking for the reason, and I said I'll write it down for all: Unix/Linux are multi-user operating systems. The goal is to be able to seperate users from each other. There are only few categories of users, and seen from the kernel's perspective, there are only two: user and superuser. The superuser on the system (root) has no restriction wrt what he can do in the system, whereas other users must confirm to the (permission-) rules that the super user configured (when in doubt, that was the distributor) >From this perspective, it should be easy to see that using the least privilege possible and needed for a task is most secure. Especially in cases where a program uses data that comes from an untrusted source this is strongly advised. How do you know that a .jpg file that you received from your friend does indeed confirm to the JPEG image compression standards (netscape prior to version 4.74 had a bug in the jpeg handling code that could, if exploited by a specially crafted jpeg image, enable an attacker to execute arbitrary machine code on the machine the netscape browser runs on.) The majority of programs do have this property (since you wish to have them something done, of course). The most suitable for the purpose of this mail are * mail user agents (MUAs) * chat clients (such as IRC) * browsers (such as netscape) * multi media players (such as mp3 players and image viewers) If your mail program is written in poor style, it might contain a bug that allows an attacker to do nasty things with your machine. pine used to have such a bug a while ago, for example. If this happens as user root, the possible damage to your machine is not restricted in any way, if it happens as user foo, the attacker may still have to obtain root rights to gain complete access to the system. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

2 3

more on SSH
by Draven Loving 27 Aug '00

27 Aug '00

Hey All, just need some comments on the following: 1. I've checked the ftp.suse.de for SSH in sec1 dir and did not find it ..i however found updates for OpenSSH ..is there any difference b/w the two besides one being commercially free ..are they the similar functionality wise? ...and I'm assuming that i can install the updates even tho i dont have the previous version. 2. If i do decide to use the SSH source ...there's an option on the ./configure --disable-suid-ssh ..is this practical and does it have any security implications? 3. Finally, is there any other security considerations one should take in terms of configuration if one decide to use the source instead of a precompiled rpm? This is for a SuSE 6.4 system btw ...thanks for any input =) cheerios, Draven Loving

4 4

amavis
by semat＠wawa.eahd.or.ug 25 Aug '00

25 Aug '00

Hello, I installed amavis as per Rainer Link's advice however now after scanning the sendmail takes on the uid of the sender with a configuration file of sendmail.orig.cf whcih brings delivery problems since only root is allowed to write to the mailqueue I have had to make mqueue 777 in order for mail to go. Which is totally undesirable. Someone please help. I tried what it says in BUGS and changed the mlocal lines in both file to add an o and remove the S but things still do not work.

2 1

Non-root owner on system files
by Simon Lodal 25 Aug '00

25 Aug '00

Hello all, next question for the experts: Does root really need to own all important files and dirs? Does it make any (ANY) difference, if another user owns say /boot, /etc, /bin, /sbin, anything? My intent is to split administrative tasks between different users that only have a few more privileges than any normal user. One of these tasks is to update software. So I thought if I could create a "softupd" user and group, and set this owner and group to own all these files that root usually owns. More precisely, my questions are: - Does the system impose special treatment on files with uid/gid 0 than for other files? Is there anything the user can/can't do on a file with uid/gid 0 that is different from what he could/couldn't do with other files? - Should I assign normal uid's/gid's for the administrative accounts (above 500/100), or should I use some of the lower numbers? Is this distinction only a tradition, or does the system actually treat a lower uid/gid differently? Thanks for any input, Simon

2 1

Re: [suse-security] more on SSH
by Eilert Brinkmann 25 Aug '00

25 Aug '00

Draven Loving <greddy(a)gte.net> wrote: > 2. If i do decide to use the SSH source ...there's an option on the > ./configure --disable-suid-ssh ..is this practical and does it have > any security implications? If you are paranoid (e.g., if you suspect exploitable bugs in ssh) you might consider it more secure not to have ssh suid-root. OTOH this makes it impossible for the ssh client (when used by a normal user) to bind to a priviledged port and to use the private hostkey for authentication, so any host based authentication (RhostsAuthentication and RhostsRSAAuthentication) will not work. I.e., not installing the ssh client suid-root will restrict you to RSAAuthentication (per user RSA-Keys) or PasswordAuthentication when logging in to a remote host. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

2 1

mail generated from syslogd
by Peter Lange 25 Aug '00

25 Aug '00

Hi, we use snort as Intrusion detection. snort logs it's alerts to syslog or another file. We would like to configure the system that it sends in realtime an e-mail and/or a sms to the admin if an alert occurs. is there a way without the use of crontab? best wishes peter

3 2