August 2000 - openSUSE Security - openSUSE Mailing Lists

Would like more Security Packages : sendmail 8.11, INN 2.3.0, snort 1.6.3, nessus 1.0.4
by maillist.suse-security＠news.alcatel.fr 21 Aug '00

21 Aug '00

Hi, I like SuSe as a Network linux distribution but I really think that network and security packages should be updated more often : I would like to find RPM (or at least .spec files) for sendmail 8.11, INN 2.3.0, snort 1.6.3, nessus 1.0. and also for programs such as saint, netsaint, maildrop. I'm sure I'm not the only one who needs all that stuff. SL/

1 0

Command history
by Sridhar 21 Aug '00

21 Aug '00

hi i've written a script that logs all the commands execurited by a user, his terminal, the time, the direcotry... i dont use the bash_history but the history itself. now the question is will the history be reliable, will it be moreuseful than .bash_history , will it be legal. also because the script is execurted as the user itself, i'm forced to append the command history to a file which has chattr +a attribute set. so the user can put anything in the file. any ideas to make it stealthy ?, btw, i'm using prompt_command varialble. here's the script.. #!/bin/sh COMM=`history 1| awk '{ for(i=2;i<=NF;i++) { printf "%s ",$i } }'` echo "`date`:`tty`:$USER:$PWD:$COMM" >> /tmp/comlog should i make /etc/profile.local exec only ? cheers cheedu

6 6

sending and receiving secure smtp mail (encryption)
by Steven Thompson 21 Aug '00

21 Aug '00

Hi I would like to know what is the best method of sending and receiving encrypted smtp mail using Postfix, as the mail server. Thanks in advance Steven Thompson

2 1

LIDS & OPENWALL Combo kernel patch
by Steven Thompson 21 Aug '00

21 Aug '00

Hi SuSE recommends recompiling your kernel with the OpenWall Patch for firewall servers. Which is better LIDS or OpenWall or a Combination of both patches. Will the LIDS or OpenWall break any Apps in SuSE 6.4 PS Is there a good Linux Networking Mailing list with support for Advanced IP routing. Thanks in advance Steven Thompson

2 1

RE: [suse-security] LIDS & OPENWALL Combo kernel patch
by Steven Thompson 21 Aug '00

21 Aug '00

-----Original Message----- From: Roman Drahtmueller [mailto:draht@suse.de] Sent: 21 August 2000 05:05 To: Steven Thompson Cc: security(a)suse.de Subject: Re: [suse-security] LIDS & OPENWALL Combo kernel patch > > Hi > > SuSE recommends recompiling your kernel with the OpenWall Patch for firewall > servers. Who said that? # Copyright (c) 1999,2000 SuSE GmbH Nuernberg, Germany. All rights reserved. # # Author: Marc Heuse <marc(a)suse.de>, 1999,2000 # Please contact me directly if you find bugs. # # If you have problems getting this tool configures, please read this file # carefuly and take also a look into /usr/doc/packages/firewals/EXAMPLES ! # # /etc/rc.config.d/firewall.rc.config # # for use with /sbin/SuSEfirewall version 2.1 # # ------------------------------------------------------------------------ # # PLEASE NOTE THE FOLLOWING: # # Just by configuring these settings and using the SuSEfirewall you are # not secure per se! There is *not* such a thing you install and hence you # are safed from all (security) hazards. # # To ensure your security, you must also: # # * Secure all services you are offering to untrusted networks (internet) # You can do this by using software which has been designed with # security in mind (like postfix, apop3d, ssh), setting these up without # misconfiguration and praying, that they have got really no holes. # SuSEcompartment can help in most circumstances to reduce the risk. # * Do not run untrusted software. (philosophical question, can you trust # SuSE or any other software distributor?) # * Harden your server(s) with the harden_suse package/script # * Recompile your kernel with the openwall-linux kernel patch # (former secure-linux patch, from Solar Designer) www.openwall.com # * Check the security of your server(s) regulary # * If you are using this server as a firewall/bastion host to the internet # for an internal network, try to run proxy services for everything and # disable routing on this machine. # * If you run DNS on the firewall: disable untrusted zone transfers and # either don't allow access to it from the internet or run it split-brained. # # Good luck! # # Yours, # SuSE Security Team > Which is better LIDS or OpenWall or a Combination of both patches. > Will the LIDS or OpenWall break any Apps in SuSE 6.4 > > PS Is there a good Linux Networking Mailing list with support for Advanced > IP routing. > > Thanks in advance > > Steven Thompson > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

SSL, SSH and other Crypto stuff
by wilson＠claborn.net 21 Aug '00

21 Aug '00

Howdy, I'm needing a few things like ssh and mod_ssl for SuSE 6.4 - the things that are left out of the US version. I understand that they can't be included with the CD due to _export_ laws, but it's ok for me to download them into the US, for use in the US - right? So my question is, where's the proper place to get them from? I Can't find them on ftp.suse.com. (note: I'm looking specifically for the SuSE-made rpms, not just rpms in general Thanks, JW

8 8

Popper verbosity
by Jürgen Bloß 21 Aug '00

21 Aug '00

Hi. How can I stop the popper from logging every user access, even when the user did only check to see if there were any new mails. This seems hardly the kind of information that needs to be logged every time... Bye, Jürgen -- "Soap and education are not as sudden as a massacre, but they are more deadly in the long run." - Mark Twain

2 1

Netscape 4.75
by Stefan Suurmeijer 21 Aug '00

21 Aug '00

Hi all, has anybody seen/heard any confirmation from Netscape that the new release (4.75) has plugged the java security hole?? Through all this I have heard absolutely nothing from Netscape, either on Bugtraq or their web pages, no acknowledgement of the vulnerability, no news no nothing. In my book this makes them an early frontrunner for worst vulnerability handling of the year. Stefan

7 7

supplied firewall package robustness
by Jason P. Stanford 21 Aug '00

21 Aug '00

I have taken a recent and deep interest in network security since installing SuSE 6.4 and OpenBSD on some spare machines in my lab. Of late I have noticed a lot of (possibly) suspicious activity, which probably shouldn't be too suspicious in a university setting. However, I am wondering just how robust and "impervious" the firewal package supplied with SuSE is? I only have ssh listening (on default port 22) through the firewall and a test web server on port 8080 (under my regular user uid and gid with no scripting or cgi by default). All other running daemons/servers are blocked (assumedly) by the firewall. Also, everything is deactivated in /etc/inetd.conf. /etc/hosts.deny is set to ALL: ALL and /etc/hosts.allow is set to sshd: ALL. That's it. Am I pretty safe, or should I still be paranoid? BTW, the machine is not acting as a router or NATS box. It is standalone only. -Jason __________________________________________________ Do You Yahoo!? Send instant messages & get email alerts with Yahoo! Messenger. http://im.yahoo.com/

6 7

Re: [suse-security] problem to login by my isp
by Eilert Brinkmann 21 Aug '00

21 Aug '00

"Arndt Groll" <agroll(a)nsg.de> wrote: > Jul 31 14:47:44 Pingu4 kernel: Packet log: input DENY ppp0 PROTO=17 > 212.7.128.165:53 212.7.133.153:1028 L=169 S=0x00 I=2037 F=0x0000 T=61 (#129) [...] > my firewall deny port 53 pakets (domain) as i saw in the services file, in my > firewall itself i have insert the line (by the way: it was already insert by > Suse) > > FW_SERVICES_EXTERNAL_TCP="smtp domain" # Common: smtp domain > > but it do not work! The firewall deny the pakets like before! PROTO=17 means UDP, not TCP (that's protocol 6). So you have to permit incoming *UDP* packets from port 53. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0