September 2000 - openSUSE Security - openSUSE Mailing Lists

AW: AW: [suse-security] 2 LAN
by Toralf Kühn 25 Sep '00

25 Sep '00

sorry tnpfehler! -----Ursprüngliche Nachricht----- Von: Gerd Bitzer [mailto:Gerd.Bitzer@tesion.de] Gesendet: Montag, 25. September 2000 12:30 An: Toralf Khn Cc: 'Lars'; SuSE Security Betreff: Re: AW: [suse-security] 2 LAN gehts möglicherweise um VPN ;-) ?! Toralf Kühn wrote: > wie wärs mit vpi übers internet! > > regards toralf > > -----Ursprüngliche Nachricht----- > Von: Lars [mailto:webmaster@lars-witter.de] > Gesendet: Sonntag, 24. September 2000 21:37 > An: SuSE Security > Betreff: [suse-security] 2 LAN > > -- german -- > > hi, > > wie kann ich zwei LANs grundsätzlich über das Internet > miteinander,verbinden, > - Samba und Apache - und wie steht es dann mit der Sicherheit? > > bye lars > > -- english -- > > hi, > > how can i put 2 LANs together over the internet and 2 local > linux-server? > i want to use samba and apache. > how many security holes are known? > > bye lars > > sorry - my (writeing) english is terrible) > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com

2 1

AW: [suse-security] 2 LAN
by Toralf Kühn 25 Sep '00

25 Sep '00

wie wärs mit vpi übers internet! regards toralf -----Ursprüngliche Nachricht----- Von: Lars [mailto:webmaster@lars-witter.de] Gesendet: Sonntag, 24. September 2000 21:37 An: SuSE Security Betreff: [suse-security] 2 LAN -- german -- hi, wie kann ich zwei LANs grundsätzlich über das Internet miteinander,verbinden, - Samba und Apache - und wie steht es dann mit der Sicherheit? bye lars -- english -- hi, how can i put 2 LANs together over the internet and 2 local linux-server? i want to use samba and apache. how many security holes are known? bye lars sorry - my (writeing) english is terrible) --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Shell of system users
by Jose Tinoco 25 Sep '00

25 Sep '00

Hi people! I have SuSE Linux 6.4 running and wondered today as I saw that many of the system users in my /etc/passwd like bin, daemon, etc... have /bin/bash as shell. Shouldnt this be set to /bin/false for security? Sorry if the answer to my question is trivial... Thanks! JLT

2 1

Re: DMZ mit SuSEFirewall
by Uwe Guenther 24 Sep '00

24 Sep '00

On Wed, 13 Sep 2000, Uwe Guenther wrote: Hallo, I have the following Firewall : isdn -----> firewall ------> local net ippp0(dynIP) | eth0 192.168.1.40 | eth1 | 192.168.2.40 \ / DMZ Is there a way to route a connect on port 80(firewall) to the dmz port 80. I have Kernel 2.2.16 with some Patches from SuSE. The distribution is SuSE 6.4 with all updates from ftp.suse.com. I have running the SuSE Firewall Script. Do I need a public IP for the DMZ-Linux-Box or does it work with a 192.168.x.x ? > Ich habe irgendwann im Kaufhaus im Linuxmagazin mal gelesen, > das man eine Anfrage an einen bestimmten Port(ippp0) auf einen > Rechner in der DMZ forwarden kann. Jetzt weis ich aber nicht ob > das mit dem 2.2.16 von SuSE 6.4 geht. > In /etc/rc.config.d/firewall.rc.config ist zwar sowas vorgesehen, > aber da steht das man fuer den Rechner in der DMZ eine offizielle > IP braucht, die ich aber nicht habe. > > > ... may the Tux be with you! =Uwe= > ... may the Tux be with you! =Uwe= -- Uwe Günther \\:// mailto:uwe@cscc.de Haupstraße 88 (o -) http://www.cscc.de 98631 Behrungen ---ooO-(_)-Ooo--- tel.:+49.36944.54448 Germany Linux, enjoy the ride ...!

2 1

Rückkunft perfekt
by Peter Junker 23 Sep '00

23 Sep '00

Liebe Sibylle, lieber Raimund, seit gestern habe ich es verbindlich und schriftlich. Ab 01.11. bin ich bei Zott. Mit der Anstellung in der Tasche kann ich nun in aller Ruhe die letzten Vorbereitungen treffen und die statt eines hektischen Urlaubes Räumung des Feldes in Angriff nehmen. Carolyn hat immernoch die bleibenden Eindrücke unserer Münchener Hochzeit im Kopf und freut sich bereits schon darauf, mir in bald zu folgen und Euch wiederzusehen. Bis bald Peer

1 0

SuSE Firewall 3.3 Configuration Problem
by David Eyre 22 Sep '00

22 Sep '00

I've been struggling for several days trying to set up Firewall 3.3 despite having closely studied the provided scripts, examples and FAQ. The system configuration is: -- eth0 192.168.1.1 -- net 192.168.1.0/24 (internal) ppp0 --| -- eth1 192.168.2.1 -- webserver 192.168.2.3 (DMZ) [this is really only a reduced subset of example 5 in the documentation] Despite setting: FW_FORWARD_MASQ_TCP="0/0,192.168.2.3,80" packets from ppp0 and eth0 are being blocked from reaching 192.168.2.3 The only way I have been able to get the internal network to see the webserver is to open up a connection using FW_FORWARD_IP="192.168.1.0/24,192.168.2.3,tcp" and removing the entries for FW_FORWARD_MASQ_TCP (because if they are left in packets are blocked) and, of course, external connections are not possible. So the question is; is it possible to set up both external and internal connections to the webserver I'm sure that I'm missing something simple but sadly I haven't been able to see it! All help gratefully accepted. David

1 0

How to define specific address at specific port
by Togan Muftuoglu 22 Sep '00

22 Sep '00

Hi everyone, I am using SuSEFirewall version 2.1 while on dynamic ip. Everything is working fine no problem so far (That is what I believe could not be the reality) A website that I continously visit has changed their policy and now they need to have access thru the port 2002. I figured it as FW_SERVICES_TRUSTED_TCP="ssh 2002" so temporarily I can access the site. however I do not feel comfortable since I feel that this is an entry point to anyone. My question is how and where I can define this specific ip address and port together. Can I have some guiadance on this. Thanks -- Togan Muftuoglu toganm(a)turk.net 100% MS FREE Absolutely no component of Microsoft was used in the generation or posting of this e-mail. So it is virus free

2 1

Re: [RHSA-2000:062-03] glint symlink vulnerability
by Roman Drahtmueller 22 Sep '00

22 Sep '00

-----BEGIN PGP SIGNED MESSAGE----- > --------------------------------------------------------------------- > Red Hat, Inc. Security Advisory > > Synopsis: glint symlink vulnerability SuSE distributions do not contain the glint package. Please note that the "xglint" package that is on newer SuSE distributions is an accelerated X-server for GLINT/PERMEDIA/PERMEDIA-2 based graphics cards and has nothing to do with the glint package mentioned in the RedHat Security advisory. Regards, Roman Drahtmüller. - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOcumMHey5gA9JdPZAQGu9wf9FMC7NiE266UuPZmP2y+NEGoBvKDwFltH cYastPv18oWo3ImgtIepOE0PxFmHX3QVhikvyDNiOC/b/sGHtT2JE0SXdcgMpIIF QKjTdMwoHSCLNMwMz4Gux3J4r+3ZU88FjrRnNd9o66zsvVp5SmUD0oFbZoxTe1NJ x+do1GWYWfScEGcbwuCyDD871hWRIo6bGa/7WODndES/yLzz2v7+15zNojVMY2RS KhHsV5b6dR0Vjwdih77eleETrxifH2O2x8QURM0/bLtdAOjkLf0KO5119Q6OAj8X f3Zg8tf2nA+KPDmB6vEQAbxoWSDC5E2ockvTyJS645I7rQy2TqkJng== =HHbw -----END PGP SIGNATURE-----

1 0

Re: [suse-security] NFS over VPN
by mute 22 Sep '00

22 Sep '00

I appreciate all the feedback, it really made me reconsider a few things. But what about real-time updates though? As far as i know, rsync could be used from cron or something similar, in other words in timed bursts, so if one machine dies the other one (backup) is not guaranteed to have up-to-date information. That is why i was thinking nfs... On Thu, 21 Sep 2000, Volker Kuhlmann wrote: > > recently at the place where i work a collegue came up with an idea to use nfs > > over vpn to sync our webservers. i have not done much work with either, and i > > have two questions about it. first, is this a practical solution? and second, > > im a bit stumped about resources on the subject (i do have nfs documentation, > > but not much of vpn resources, and nothing on how to combine the two). > > Arrrg - you want rsync. What you suggest is an absolute waste of > time! rsync is one of the most useful tools around. You can as easily > have it use ssh instead of rsh. Problem solved. No need to set up VPNs. > > Volker

2 1

Sniffing other user's session
by Jose Luis Tinoco 21 Sep '00

21 Sep '00

Hi people! We have here a server and a couple of X-terminals connected to it (X over ip). Is it somehow possible for a regular user to set a sniffer or something similar (as user of the server on the server) so that he/she can "see" the whole X-session another ones who sits at a terminal? Should I consider tunneling all X-sessions through ssh, or is this unnecessary? Thanks a lot in advance! JLT

5 5