August 2000 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Secure By Default - PLEASE!
by rhoerbe＠netpromote.co.at 25 Aug '00

25 Aug '00

>If people use the tools we deliver with SuSE + their brains (note: we >don't ship brains with SuSE), then they could get a very secure system >within a short time of work. > In some installations you might find IT-experts whith lots of brains, but a lack of security-related experience. Developers do not have time to listen to security advices. But they set up their test/development/something servers in their domain, holes wide open _not_ shut. Distributions could improve the situation by default. > >Hrhr... 'secure by default' nice buzzwords. AFAIK /usr/bin isn't audited >and neither all the ports are. It's 99% secure as long as you just use the >default install but then it's not a very productive system; third party >software is as buggy as the stuff on FreeBSD or Linux or whatever. > >I like, use and support OpenBSD, but it's not a modern unix. And will >never be, because the man power is missing. > >SuSE 7.0 hast a YaST2 module, that allows the not-so-experienced User to >modify /etc/inetd.conf in a easy way, to shut inetd off (even YaST1 ask >for this) or to use a default /etc/inetd.conf. >In future more security modules will be added to YaST2. > And it could be a forerunner by disabling various services by default. SMTP-relaying, IP-forwarding, .. already disabled by default. > Bye, > Thomas >-- Rainer

1 0

RE: [suse-security] OpenWall kernel 2.2.16 patch example
by Steven Thompson 24 Aug '00

24 Aug '00

Hi thanks for the help, but there 3 diff files in the latest patch. (linux-2.2.16-ow1.tar.gz) 1. linux-2.2.16-ow1.diff 2. procps-2.0.6-ow1.diff 3. glibc-2.1.3-dl-open.diff Do you have to apply to all 3 file or just "1. linux-2.2.16-ow1.diff"? This is where my doubt lies. Thanks in Advance Steven Thompson -----Original Message----- From: Bogdan Zapca [mailto:lupe@admin2.ecosoft.ro] Sent: 24 August 2000 01:21 To: Steven Thompson Cc: SuSE security mailing list (E-mail) Subject: Re: [suse-security] OpenWall kernel 2.2.16 patch example -----BEGIN PGP SIGNED MESSAGE----- I did that succesfully. Try to unpack the archive. From the archive take linux-2.2.16-ow1.diff and apply patch -p0 <linux-2.2.16-ow1.diff - --- Bogdan Zapca System Administrator SC EcoSoft SA Internet Service Provider 1-7 Deva st, Cluj-Napoca, Romania Tel: +40 64 199696 PGP: http://www.itotal.ro/lupe@admin2.ecosoft.ro.pgp http://www.ecosoft.ro On Thu, 24 Aug 2000, Steven Thompson wrote: > Hi has anyone got a small example of applying the openwall patch to kernel > 2.2.16. SuSE 6.4 > eg. do you apply the diff files individually. > > Thanks in advance > > Steven Thompson > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOaUFHdPv6ylvTc6pAQF+QgP+IXRMPY0HB/ucuQfUQDIHkP2qfd+u/gaH NQolyUAkeZik7tEvNC5LG/gl3s8B7e2Yd1Rry/RAYXGJwxPXjvjVh21Q+bjZsnrm a8CltK+IpdDBJ28svnoNU959XBp/8AMRPMDTOXaXohiPJoQE3MZF5GfhXnS3GH+k KsFgrTC90Ak= =1HRd -----END PGP SIGNATURE----- --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] Disableing Loging for Users
by tschweikle＠FIDUCIA.de 24 Aug '00

24 Aug '00

> I have a workstation were I've installed SuSE 6.4 > this workstation get it's /home from a NFS Server; > I want to prevent users to login when their home > directory is not avaliable (not mounted). Have a look at '/etc/login.defs'. The entry DEFAULT_HOME is your friend if set to 'yes', any user might log in, even if his home is not available. If set to 'no' his home has to be available. If your users use ssh to log in, there is a similar option in 'sshd_config'. Have a look at the man page to find it out (since I allow login in all cases)! -- Thomas

1 0

OpenWall kernel 2.2.16 patch example
by Steven Thompson 24 Aug '00

24 Aug '00

Hi has anyone got a small example of applying the openwall patch to kernel 2.2.16. SuSE 6.4 eg. do you apply the diff files individually. Thanks in advance Steven Thompson

4 3

Disableing Loging for Users
by Andres Tarallo 24 Aug '00

24 Aug '00

I have a workstation were I've installed SuSE 6.4 this workstation get it's /home from a NFS Server; I want to prevent users to login when their home directory is not avaliable (not mounted). Any guideline is welcome Andres Tarallo

4 3

how do i know the version & how to start https
by tk dev 24 Aug '00

24 Aug '00

hi all i've some ques re modssl,openssl & apache-would b glad to hear from u all. (i'm using suse6.4,kernel2.2.16 - also installed modssl/2.62 & openssl/0.95 together with suse6.4) 1. how do i know the version for openssl & modssl that's running on my system? 2.i've downloaded & installed openssl/0.95a,without any error message- yet when i open netscape communicator(for suse6.4 users = it'll show the apache version,openssl,modssl version etc) the version shown is still 0.95!! what should i do so that i'm using the latest openssl?btw, how do i know that's it's running the latest version i've installed ?- should i delete the old version, how? 3.as i know, modssl & apache-ssl is different. how should i start apache after i enabled ssl? should i stop the current apache? should i change/start/stop any daemon? pls advise & thanks in advance. thanks also to all u've been so helpful & answered many of the ques in this list...one reason why i love linux/open system so much. cheers tk ===== 0Oo~~:o) Smile! You'r Alive!!! Q:What's peacefulness? A:What's confusion? Peacefulness is the end of confusion. o.0.Oo.o May there be peace in every step we take :o):tk __________________________________________________ Do You Yahoo!? Yahoo! Mail - Free email you can access from anywhere! http://mail.yahoo.com/

2 1

how do i generate CA/certs : esp with CA.pl
by tk dev 24 Aug '00

24 Aug '00

hi all i've been trying to generate certificates - following mod_ssl user manual. unfortunately i can't find sign.sh to sign my server.csr. p.s. i'm using suse6.4,kernel2.2.16;installed with mod_ssl/2.62 & openssl/0.95. anyway i've downloaded openssl/0.95a & install it. & i've found CA.pl: as i know this is one program to generate certificates. but when i tried CA.pl -newca it only come up with a dir (demoCA) with some .pem files inside. i want a real SSL cert with names which i specify. how do i go about doing that?...the man page of CA.pl is so massive & i don't know what to do to have -x509(just like the one used by openssl). pls advise me what to do with CA.pl/how to get other scripts that enable me to create cert. thanks a lot for your help. tk ===== 0Oo~~:o) Smile! You'r Alive!!! Q:What's peacefulness? A:What's confusion? Peacefulness is the end of confusion. o.0.Oo.o May there be peace in every step we take :o):tk __________________________________________________ Do You Yahoo!? Yahoo! Mail - Free email you can access from anywhere! http://mail.yahoo.com/

1 0

Re: [suse-security] Disableing Loging for Users
by Volker Kuhlmann 23 Aug '00

23 Aug '00

> > I want to prevent users to login when their home directory is not > > avaliable (not mounted). > Anyway, /etc/profile would be the best place to check ... Ooops, too bad I can still login just by changing my login shell to tcsh... :-) Then there was the case of ssh logins. Are there other possibilities? Changing login.defs DEFAULT_HOME yes should catch the tcsh case (though my SuSE 6.3 does not have this variable, must have been introduced later). Volker

1 0

Re: [suse-security] wvdial IPCHAINS Script
by Volker Kuhlmann 23 Aug '00

23 Aug '00

> If you are using WVDIAL to dial up to your ISP. How do you get WVDIAL to > call an IPCHAINS script to setup firewall rules. You create /etc/ppp/ip-up.local. There are plenty of comments in /etc/ppp/ip-up. Volker

1 0

Re:
by Emmerich Eggler 23 Aug '00

23 Aug '00

Hello postmaster, list-maintainer for some days/weeks I get this error-message which is completely unrelated to me. Please verify that these messages are "/dev/null"-ed (or better: not created ;-) Thanks --emmerich FETCHMAIL-DAEMON(a)lapra.rando wrote: > > Some addresses were rejected by the MDA fetchmail forwards to. > > ------------------------------------------------------------------ > Reporting-MTA: dns; localhost > > Final-Recipient: rfc822; hperraud > Last-Attempt-Date: Wed, 01 Jan 1997 01:36:39 +0100 (MET) > Action: failed > Status: h.0.0 > Diagnostic-Code: hperraud: 550 <hperraud@localhost>... User unknown > > ------------------------------------------------------------------ > Received: from tibre.ujf-grenoble.fr (tibre.ujf-grenoble.fr [193.54.238.31]) > by iut-src.ujf-grenoble.fr (8.8.5/8.8.5) with ESMTP id JAA07392 > for <hperraud(a)iut-src.ujf-grenoble.fr>; Wed, 23 Aug 2000 09:17:55 GMT > Received: from lists.suse.com (host1.SuSE.com [202.58.118.3]) > by tibre.ujf-grenoble.fr (Pro-8.9.3/8.9.3/Configured by AD & JE 25/10/1999) with SMTP id LAA24908 > for <Herve.Perraud(a)ujf-grenoble.fr>; Wed, 23 Aug 2000 11:21:13 +0200 (MET DST) > Received: (qmail 6924 invoked by alias); 23 Aug 2000 09:21:04 -0000 > Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm > Precedence: bulk > X-No-Archive: yes > list-help: <mailto:suse-security-help@suse.com> > list-unsubscribe: <mailto:suse-security-unsubscribe@suse.com> > list-post: <mailto:suse-security@suse.com> > X-Mailinglist: suse-security > Delivered-To: mailing list suse-security(a)suse.com > Received: (qmail 6916 invoked from network); 23 Aug 2000 09:21:04 -0000 > Delivered-To: suse-security(a)suse.com > Sender: emm(a)eggler.ch > Message-ID: <39A397D3.9C58B034(a)eggler.ch> > Date: Wed, 23 Aug 2000 11:22:27 +0200 > From: Emmerich Eggler <emm(a)eggler.ch> > Organization: Eggler Communications > X-Mailer: Mozilla 4.75 [en] (X11; U; Linux 2.2.13 i586) > X-Accept-Language: en > MIME-Version: 1.0 > CC: "'suse-security(a)suse.com'" <suse-security(a)suse.com> > References: <D5FFB0394AFED31193A100500443CF28038108(a)hermes.p01.prodv.loc> > Content-Type: text/plain; charset=us-ascii > Content-Transfer-Encoding: 7bit > Subject: Re: [suse-security] Security by mail... > X-UIDL: n$1"!9%,!!"h+!!a:X!! -- __________________________________________________________________ Emmerich Eggler emm(a)eggler.ch Eggler Communications +41 (0)79 438 75 11 Wannerstrasse 3/39 +41 (0) 1 463 43 73 CH-8045 Zuerich http://www.eggler.ch

1 0