January 2001 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

Re: is SuSE going to implement libsafe?
by marc＠suse.de 18 Feb '01

18 Feb '01

Hi, >I have just read an Bell Labs anouncement, that they are going to release >libsafe under GNU licence, and that some major Linux distros are going to >be using it. SuSE was not amongst them, why is that? I think that libsafe would >be a good echnacement against buffer overflow. > >Anouncement is on: >http://www.bell-labs.com/news/2000/april/20/1.html just because something new pops up please be careful with questions like "when will you implement it?" ;-) There are several questions to ask: a) is it STABLE and does it NOT affect the stability of other programs? b) does it bring additional security problems into the system? c) is the security protection effective? Well, of course the SuSE Security Team already reviewed libsafe. Here are the answers: a) unsure. it would have to be tested very intensive. this was not done yet. b) the code might have vulnerabilities, however the protection gained is higher even if a vulnerability would be present c) okay, now the tough part: libsafe is a dynamic library which is set in the environment which checks several dangerous functions, which can be a security problem. Because it is a dynamic library, it is NO protection against local attackers, just against remote attackers on network services. (if an attacker wants to attack a local suid file, he would just reset his library path environment). Next thing: it does not check for all known vulnerabilites. It even doesn't protect against all buffer overflows, It just protects against *some* overflows. those which happen because of insecure use of strcat/strcpy etc. summary: I can not remember a vulnerability in a network service for the last year which this tool would have prevented. Therefore: as long as this tool is not enhanced to also protect open/fopen calls against symlink/hardlink/pipe attacks, several more buffer overflow types, system/exec* function protection etc. it is not useful to use this tool. I would rather propose to use the secumod module which comes with SuSE Linux since 6.3 and maybe the secure-linux kernel patch from www.openwall.com - these two tools enhance your security. (and btw, install seccheck, hardensuse and firewals and use them - then your security is very high) Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

5 4

Web Based e-mail servers
by Chosen1 08 Feb '01

08 Feb '01

I am running SuSe 7.0, and I have a couple of questions... 1.) I have been asked by one of my customers to setup a logging function to log all inbound and outbound e-mails that are being sent through their server. What program would be good for this? 2.) I would like to setup a web based e-mail server for my customers so they can get their mail off the web. What is a good program to use and how secure is this? --Brian --Chosen1 Network Operations Administrator (COO) Postmaster and Routing lead Admin of beer.wa.us.ircsol.net /server beer.ircsol.net and Admin of unix.az.us.ircsol.net /server unix.ircsol.net http://www.ircsol.net

6 5

ICMP filter in SuSEfirewall? (again)
by Rick Green 03 Feb '01

03 Feb '01

I posed this questin a few days ago. I got no response, so I've been digging, and maybe I can ask a slightly different question. System: SuSE 6.4 running SuSEfirewall 4.2 Symptom: Output DENY messages when sending mail. I've also sometimes seen these directed at my ISP's DNS servers. When sending mail, I get four repetitions of the following, but the mail goes thru: output DENY ppp0 PROTO=1 my.ip.ad.dr:3 isp.smtp.ip.addr:3 L=108 S=0xC0 I=5893 F=0x0000 T= After reading thru SuSEfirewall, I discovered that the messages disappear when I set FW_ALLOW_FW_TRACEROUTE = "yes" , although my reading of the script looks like they're still being denied by the '# deny all other type 3' rule, which isn't logged. So it's transparent, with the same effect. I tried hacking the script, moving the $DENY port-unreachable $LDC just outside the bracket, and changing it to $ACCEPT port-unreachable $LAC. Now I can turn off FW_ALLOW_FW_TRACEROUTE again. I'm still invisible to traceroute, and sending mail gives me just one message in the log: output ACCEPT ppp0 PROTO=1 64.79.87.98:3 64.79.64.32:3 L=108 S=0xC0 I=26218 F=0x0000 T=255 (#3) The destination address is my ISP's mail relay host. So now my mail is going out without the delay of waiting for four timeouts. But I still have the question of what is going on here? I have not been able to find any documentation of the various parameters displayed with the log message. What port is my ISP's mail host trying to connect to, and why? Is this normal smtp behaviour? Can someone point me to the RFC that defines all the ICMP sub-types? -- Rick Green

7 7

Porn/Xrate-Filter
by Matthias Jaenichen 02 Feb '01

02 Feb '01

Hi, is there any tool to filter pron and other rated sites and/or contents? We want to provide a S.u.S.E-based firewall for a school and think we must at least make it difficult to access any rated content. Reg. Matthias Jänichen

7 7

Re: [suse-security] Porn/Xrate-Filter
by Volker Kuhlmann 02 Feb '01

02 Feb '01

Or what to do with a home networking setup and the kids... > >we use "squid" as proxy with stopword list's. Our list is about 350 line > >long. One approach. The bad news is, they all don't work. It is impossible to automatically do a linguistic analysis and decide which sites are junk. People can get very irate when good discussions about sexuality are blocked! This is just one example. You will find more than your software will ever be able to handle. Filtering by URL doesn't work either. For detecting URLs to blacklist see above. There is commercial software about, but it all sucks. See the example of cyberpatrol: it was proven(!) that they generate their blacklists automatically, badly, and black out a large amount of valid sites as well as missing junk ones. Waste of money. Btw filtering by URL is easily circumvented: use a URL-anomymiser/redirector. There goes that idea. > Problem: how to keep that list updated? Precisely. Forget it. > reffering to that, a teacher I know keeps a very pragmatical and > practical method of doing this: With the help of his pupils. > Checking squid's logfiles, new sites are frequently added to the black > list. *laugh* do the pupils know about their help? :-) > Any other ideas around? None which are practical, except for this, but that isn't going to be easy: > But never forget to solve the problem of pornsite surfing in school at > the roots. An the roots are the pupils, and not the net. Can't fix a social problem with blacklists... My EUR0.02 Volker

2 1

SuSEFirewall slows down connection
by Christian Bohn 01 Feb '01

01 Feb '01

Hi! I encountered the following problem with the SuSEfirewall-skript: First of all, my configuration: I've got a Linux Box (SuSE 6.4) running as a DSL-Router (incl. Masquerading) for an internal Network. The firewall-skript (which Version doesn't really matter, I've tried out several versions, including the newest form Marc's Website) is installed on that Linux-Box. The Problem: HTTP & SSH are working well but when I try to connect to a Internet-Server via FTP, POP(sometimes) or SMTP it takes a long time (ca. 20sec) until data is transferred although the connection itself is established immediately. I do not think that it is a DNS problem, reverse&forward lookups are working well. Although I think that it has nothing to do with masquerading because if I work on the server console, the problem also occurs. If I shut down the firewall, everything is working fine! I hope somebody can help me an that this is not a FAQ ;-) bye Christian Bohn

4 4

Re: [suse-security] Porn/Xrate-Filter
by Daniele Frijia 01 Feb '01

01 Feb '01

I saw, that other people are interested too. So here's the mail I wrote to Matthias. But never forget to solve the problem of pornsite surfing in school at the roots. An the roots are the pupils, and not the net. Try to get a good supervision and everything works fine. I know that most of you are 'just' freaks and so it's naturally that you try to solve this problem on a technical level, buit it has to be solved on a social level. Ok, here's the rest of the mail: On Wed, Jan 31, 2001 at 01:40:35PM +0100, Daniele Frijia wrote: > On Wed, Jan 31, 2001 at 12:36:52PM +0100, Matthias Jaenichen wrote: > > is there any tool to filter pron and other rated sites and/or contents? We > > want to provide a S.u.S.E-based firewall for a school and think we must at > > least make it difficult to access any rated content. > > www.smartfilter.com > But check out: http://ifix.cx/squid/ (german only). > There is a little Script, that gets Porn-Domains from the net. > > If the school is connceted via belwue, the German provider for schools > in BaWue, then you can use their proxy. They installed smartfilter on > it. > > Regards, Daniele

2 1

cryptographic filesystem
by Christian Haufe 31 Jan '01

31 Jan '01

Hi list members, I'd like to setup a cryptographic filesystem using the loopback device in combination with ext2 fs. Which of the crypto codecs supplied by the international kernel patch should I choose to get a secure but still fast fs ? Are there other crypto fs implementations for linux ? Many thanks in advance. Christian

2 1

SuSE Firewall
by Alexander Kühn 31 Jan '01

31 Jan '01

Hi all, I have a little LAN with a SuSE 6.4 Server as gateway, within my LAN I have a NT box with IIS, I want to be able to access the the httpd on the NT box from the internet by specifying some port on my gateway. I have firewals-2.1-5 installed and all clients in my LAN have unlimited access to the internet and to the gateway. I tried configuring the redirection, but seems to me like this only works when the NT box has an public IP, but it has not not, an will never have. So is it possible to do it with the firewall or do I have to fiddle with ipchains ? Thanks & regards, Nagilum. -- ======================================================================== # _ __ _ __ http://home.htwm.de/akuehn/ \n icq://69646724 # # / |/ /__ ____ _(_) /_ ____ _ nagilum(a)chillout.org \n +01776461165 # # / / _ `/ _ `/ / / // / ' \ Amiga (68k/PPC): AOS/NetBSD/Linux # # /_/|_/\_,_/\_, /_/_/\_,_/_/_/_/ Mac (PPC): MacOS9 / Linux / MacOS-X # # /___/ x86: Linux/FreeBSD/OpenBSD/QNX/Win98SE # ========================================================================

4 3

Suse firewal
by ceccs＠keysoft.pt 31 Jan '01

31 Jan '01

Hi. Some problems/features/questions: System: SuSEfirewall v2.6, eth0 to the internet (cable modem), eth1 to internal network (192.168.x.x/24). 1. FW_SERVICE_DHCLIENT= yes fw rule:$IPCHAINS -A input -j "$ACCEPT" -p udp -s 0/0 67 -d 255.255.255.255/32 68 $LAA packets denied from my cable provider: input DENY eth0 PROTO=17 gateway.cable:67 eth0-ip:68 my rule:$IPCHAINS -A input -j "$ACCEPT" -p udp -s 0/0 67 -d 0/0 68 $LAA Is the cable provider sending invalid packets: having my interface ip specified when it should be 255.255.255.255 ? Or should the rule be as I modified? 2. I have dhcpd to the internal network, but not to the internet: FW_SERVICE_DHCPD=no and START_DHCPD=yes If START_DHCPD = yes, dhcp is allowed for BOTH the internal and internet interfaces. There should be a different setting for internal/external dhcpd and START_DHCPD should be ignored. As I have FW_PROTECT_FROM_INTERNAL="no", I removed the test for START_DHCPD 3. Why this rules with ippp0 hard coded ? $IPCHAINS -A forward -j "$DENY" -d 10.0.0.0/8 -i ippp0 $IPCHAINS -A forward -j "$DENY" -d 192.0.0.0/8 -i ippp0 I removed them from from the script, as there is already in place a rule denying packets from the net to 192/8. Carlos ---- Carlos Costa e Silva <ceccs(a)keysoft.pt> Keysoft Lda Lisboa - Portugal

1 0

Help with secumod
by Matthew 31 Jan '01

31 Jan '01

First of all thanks to Mark and MArc for making secumod, looks like a nifty little security module. However, it seems like a powerful little module. Actually, had a few (for me) nasty problems. I was following Marc's secure webserver guide. All was going fine until I installed the secumod module. At first I was able to conitnue administrating, then I noticed weird things happening...First it suddenly closed my ssh session, then pop3 and smtp shutdown. Then actually attached a keyboard and monitor, then tried logging in there. I got a libc data file read error message and then a failure to allocate memory. Login was not possible and ctrl-alt-F10 showed me few "non-essential" service shutting down. I managed to save the day by rescue mode... Anyway, after the docs I am kind of worried about repeating it....What did I do wrong? But I like its features.... With many thanks, Matthew

6 7

Re: [suse-security] SuSEFirewall slows down connection
by Christian Bohn 31 Jan '01

31 Jan '01

Hi! thank you, that's it! Perhaps this one should be added to the FAQ! bye Christian "now surfing fast" Bohn ----- Original Message ----- From: "Christoph Wegener" <cwe(a)bph.ruhr-uni-bochum.de> To: "Christian Bohn" <cbohn(a)uni-mannheim.de> Sent: Wednesday, January 31, 2001 3:06 PM Subject: Re: [suse-security] SuSEFirewall slows down connection > Hallo Christian, > ich würde sagen - Du hast den ident (Port113) gesperrt, dann warten Verbindungen > wie SMTP, Telnet, SSH unter Umständen auf einen TimeOut und der liegt im bereich > von einigen (10) Sekunden... > > Christoph > > Christian Bohn wrote: > > > Hi! > > > > I encountered the following problem with the SuSEfirewall-skript: > > > > First of all, my configuration: > > I've got a Linux Box (SuSE 6.4) running as a DSL-Router (incl. Masquerading) > > for an internal Network. > > The firewall-skript (which Version doesn't really matter, I've tried out > > several versions, including the newest form Marc's Website) is installed on > > that Linux-Box. > > > > The Problem: > > HTTP & SSH are working well but when I try to connect to a Internet-Server > > via FTP, POP(sometimes) or SMTP it takes a long time (ca. 20sec) until data > > is transferred although the connection itself is established immediately. > > I do not think that it is a DNS problem, reverse&forward lookups are working > > well. > > Although I think that it has nothing to do with masquerading because if I > > work on the server console, the problem also occurs. > > If I shut down the firewall, everything is working fine! > > > > I hope somebody can help me an that this is not a FAQ ;-) > > > > bye > > > > Christian Bohn > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > -- > Ruhr-Universitaet Bochum > Lehrstuhl für Biophysik > c/o Christoph Wegener > Gebaeude ND 04/Nord > D-44780 Bochum, GERMANY > > Tel: +49(234)32-25754, Fax: +49(234)32-14626 > > mailto://cwe@bph.ruhr-uni-bochum.de > http://www.bph.ruhr-uni-bochum.de > > __ _ > / / (_)__ __ ____ __ > / /__/ / _ \/ // /\ \/ / . . . t h e c h o i c e o f a > /____/_/_//_/\_,_/ /_/\_\ G N U g e n e r a t i o n . . . > >

2 1

Re: [suse-security] Porn/Xrate-Filter
by Matthias Jaenichen 31 Jan '01

31 Jan '01

At 12:44 31.01.01 +0100, Carsten_Ellermann(a)sskbo.de wrote: >Hi, > > >is there any tool to filter pron and other rated sites and/or contents? We > >want to provide a S.u.S.E-based firewall for a school and think we must at > >least make it difficult to access any rated content. > >we use "squid" as proxy with stopword list's. Our list is about 350 line >long. Yes, that is one solution. could you send your stopword list to my private e-mail? Problem: how to keep that list updated? Any other ideas around? Reg. Matthias Jänichen

4 3

Re: [suse-security] SuSEFirewall slows down connection
by Christian Bohn 31 Jan '01

31 Jan '01

Hi! no, thats not the problem, icmp echo replys are allowed and I can ping myself from another host in the internet. bye CB ----- Original Message ----- From: "Alexander Bien" <abien(a)gmx.net> To: "Christian Bohn" <cbohn(a)uni-mannheim.de> Sent: Wednesday, January 31, 2001 3:10 PM Subject: RE: [suse-security] SuSEFirewall slows down connection > > Are u sure u allow icmp echo replys? > So the other host can ping you ? > Check that please.. then try again .. and maybe it will work faster this > time. > > Many hosts (specilly smtp servers) first ping the other host to see if its > still alive.. > > > -- > > Mit freundlichen Grüßen > > Alexander Bien > > -- > PIRONET NDH > Alexander Bien - Technical Assistant - SBU Services > Josef-Lammerting-Allee 14-18, 50933 Cologne - Germany > Tel.: +49 (0)172 7760569 - Fax: +49 (0)221 770 2815 > mailto:abien@pironet.com - http://www.pironet.com > > > > -----Original Message----- > > From: Christian Bohn [mailto:cbohn@uni-mannheim.de] > > Sent: Wednesday, January 31, 2001 3:04 PM > > To: suse-security(a)suse.de > > Subject: [suse-security] SuSEFirewall slows down connection > > > > > > Hi! > > > > I encountered the following problem with the SuSEfirewall-skript: > > > > First of all, my configuration: > > I've got a Linux Box (SuSE 6.4) running as a DSL-Router (incl. > > Masquerading) > > for an internal Network. > > The firewall-skript (which Version doesn't really matter, I've tried out > > several versions, including the newest form Marc's Website) is > > installed on > > that Linux-Box. > > > > The Problem: > > HTTP & SSH are working well but when I try to connect to a Internet-Server > > via FTP, POP(sometimes) or SMTP it takes a long time (ca. 20sec) > > until data > > is transferred although the connection itself is established immediately. > > I do not think that it is a DNS problem, reverse&forward lookups > > are working > > well. > > Although I think that it has nothing to do with masquerading because if I > > work on the server console, the problem also occurs. > > If I shut down the firewall, everything is working fine! > > > > > > I hope somebody can help me an that this is not a FAQ ;-) > > > > bye > > > > Christian Bohn > > > > > > > > > > > > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > >

1 0

AW: [suse-security] Porn/Xrate-Filter
by Thomas Lamy 31 Jan '01

31 Jan '01

You should give squidguard (http://www.squidguard.org/) a try. It comes with SuSE Professional since 7.0. They also maintain certain blacklists which can be easily updated via internet. Regards Thomas Lamy > -----Ursprüngliche Nachricht----- > Von: Matthias Jaenichen [mailto:mj@percomp.de] > Gesendet: Mittwoch, 31. Januar 2001 12:37 > An: suse-security(a)suse.de > Betreff: [suse-security] Porn/Xrate-Filter > > > Hi, > > is there any tool to filter pron and other rated sites and/or > contents? We > want to provide a S.u.S.E-based firewall for a school and > think we must at > least make it difficult to access any rated content. > > Reg. > > Matthias Jänichen > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

bind8
by Hans Vokal 31 Jan '01

31 Jan '01

> Hi, > > just a short heads-up: The bind8 packages for the distributions 6.1-7.1 > are being built as I write this email. The packages should be available > two or three hours. > > Roman. Hi Will there be an updated Version for SuSE 6.0 as well? Or some hints, how i get it to work securly? thanks in advance Marco __________________________________________________________________ Do You Yahoo!? Gesendet von Yahoo! Mail - http://mail.yahoo.de Yahoo! Mail auf Ihrem Handy? - http://mobil.yahoo.de

6 10

(cross-posted) [SLE] my apsfilter environment messed up
by dproc 31 Jan '01

31 Jan '01

I am cross-posting this as printing broke around the time I first ran harden_suse. I can't see permissions or ownerships the harden script could have done which hurt apsfilter (maybe something in /etc/passwd ??), but perhaps wiser minds can direct me towards my error. ("rpm --verify" doesn't suggest anything wrong either) dproc ----------- I can't print anything, because my apsfilter script (Version: S.u.S.E.-1.6) starts choking as soon as it starts. It reports a stream of errors as soon as it is called by the lpd. The first error in its log is always head: command not found (This is the first time a binary is called by the bash script /var/lib/apsfilter .) Errors continue until the filter hands an error code back to lpd without printing anything. Any clues? dproc

2 1

SuSE Security Announcement: bind8 (SuSE-SA:2001:03)
by Roman Drahtmueller 31 Jan '01

31 Jan '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: bind8 Announcement-ID: SuSE-SA:2001:03 Date: Tuesday, January 30th, 2000 23:40 MEST Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1 Vulnerability Type: remote root compromise Severity (1-10): 9 SuSE default package: no Other affected systems: all systems using bind, versions before 8.2.3-REL Content of this advisory: 1) security vulnerability resolved: bind8 problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information bind-8.x in all versions of the SuSE distributions contain a bug in the transaction signature handling code that can allow to remotely over- flow a buffer and thereby execute arbitrary code as the user running the nameserver (this is user named by default on SuSE systems). In addition to this bug, another problem allows for a remote attacker to collect information about the running bind process (this has been found by Claudio Musmarra <a9605121(a)unet.univie.ac.at>). For more information on these bugs, please visit the CERT webpage at http://www.cert.org/advisories/CA-2001-02.html and the bind bugs webpage at http://www.isc.org/products/BIND/bind-security.html . The problem is existent in the upcoming SuSE distribution 7.1 that will be available by February 10th in the CD/DVD version. There exists no reasonable method to circumvent the problems other than to update the package as described below. Please choose the update package for your distribution from the URLs listed below and download the necessary rpm files. Then, install the package using the command `rpm -Uhv file.rpm´. rpm packages have an internal md5 checksum that protects against file corruption. You can verify this checksum using the command (independently from the md5 signatures below) `rpm --checksig --nogpg file.rpm', The md5 sums under each package are to prove the package authenticity, independently from the md5 checksums in the rpm package format. SPECIAL INSTALL INSTRUCTIONS: ============================== If you run a bind8 nameserver on your system, please update the package immediately. In order for the updated package to become active, the nameserver process "named" needs to be restarted. Do this using the command `rcnamed restart´ as root after performing the rpm command as shown above. Afterwards, check for the running daemon using the ps command as `ps aux´. The named process should show a new starting time. Repeat the `rcnamed restart´ command if the nameserver shut down too slowly to release the socket for the new server. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/bind8-8.2.3-92.i386.rpm e9b354dbd96f6216b9da01f2b3a0a166 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/bind8-8.2.3-92.src.rpm f77200a6c476b58980f68b5db3fd7c4b SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/bind8-8.2.3-61.i386.rpm 4fdee7483fce85f2a31a1a53d2b01b76 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/bind8-8.2.3-61.src.rpm e53896d1ddfb405774a492469621af02 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/bind8-8.2.3-0.i386.rpm bb25cb6ba2e54bf929f61c14b3663b3e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/bind8-8.2.3-0.src.rpm 1033f0df4b747f1d2758fdae69a5fa17 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/bind8-8.2.3-0.i386.rpm 73fe798d4afb87beecb2546ecf076f64 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/bind8-8.2.3-0.src.rpm dfe4e452d8d0a0a8ff0994e514353b3f SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/bind8-8.2.3-0.i386.rpm 48b45d14724e852810de130864ab8281 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/bind8-8.2.3-0.src.rpm 22ca23ed06739effc887370bfef2d83e SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/bind8-8.2.3-0.i386.rpm fc9cd0970c15246599f90ce1f5955f29 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/bind8-8.2.3-0.src.rpm 6cdf2e5c3a9a25ca98f8916de677cb70 SuSE-6.0 Please use the SuSE-6.1 packages for the SuSE-6.0 distribution on the i386 Intel Platform. AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/bind8-8.2.3-39.alpha.rpm 84014e0f19e52a09b90897e18d8eb774 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/bind8-8.2.3-39.src.rpm 99df556319e0c232d78cdb69d5d28ac0 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/bind8-8.2.3-0.alpha.rpm 2e2a8f6c3c6838a7fd49bd7926fc3de3 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/bind8-8.2.3-0.src.rpm 9b0c2e8469f597f43010a125af8f54fe SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/bind8-8.2.3-0.alpha.rpm 0194fc4461ef902c46b75f28fa8f2ef6 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/bind8-8.2.3-0.src.rpm dffa2d911f6dae9092301bd8ad4f026f SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/bind8-8.2.3-0.alpha.rpm ebd233233829eef3d73db7d0a828c35a source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/bind8-8.2.3-0.src.rpm 582e7985719d3f7da86a77349aa1611d PPC Power PC Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/bind8-8.2.3-39.ppc.rpm b9354106b0b89edf8f1883b2ea50e656 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/bind8-8.2.3-39.src.rpm 534d84e900c6edf3fa8f2ef546d08c0a SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/bind8-8.2.3-0.ppc.rpm 5c3a00ebd3ddb0388e460673bfec88d0 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/bind8-8.2.3-0.src.rpm 418ae09b44885199f4a4403748b6ab2b Sparc Platform: Due to build bottlenecks, the update package for the sparc platform (SuSE-7.0 distribution) is delayed. ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: SuSE distributions contain the bind nameserver in Version 4 as well. bind-4.x in the currently used version has security-related bugs, some of which are similar to the ones in the 8.x versions. We will provide update packages as well as an announcement for the bind (not bind8) package shortly, along with an own announcement. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOndmjXey5gA9JdPZAQGwCwf/U0uWMe9nA8sQmu9C2scFsK5MYpNT0rgu uEUnChBznoc7FzeeWt2I1sube0DiVx5qcZDY4M7u0/BK4VJCacZIHFgWpye1GseP RU8bKhsUiujoplyiWb0Fm39AoKa5HGvAAdRFDNuMC7vt8FtKZic6JGm76MOlqVoD a0hXd6E0Jr55juGxZ5eQqpKWPAR+EjUjEE+R79LQMG8K5FWKHqfwgO2tMNUASaj9 VDkdSTkZS2DX8JIoII6s4g9ksYS0gJds1zivfFdj0fVYcHzwPEvn/ZUv/Mukf2/b MMDFIaTSGM/G751wRD7sYUhcJ5hxJ8qulsdMvLO8nBorh7IjMZSJrw== =zKPn -----END PGP SIGNATURE-----

1 0

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Volker Kuhlmann 31 Jan '01

31 Jan '01

> use bind 9 with --disable-threads. Design decisions of the ext2 > filesystem prohibit the use of Linux on systems that need some level > of integrity. Hm. Could you elaborate please? > Some time ago a couple of lawyers I would call friends put together > a 200 page document about the BSD vs. GPL vs. DJB licences, > probably I could dig it out. Yes please!! Volker

2 1

Re: [suse-security] SuSE Firewall
by jan.meyer 30 Jan '01

30 Jan '01

> What you need to do is "reverse" Masquerading. This can be accomplished > with the IPMASQADM tool included on your SuSE CD. Two questions: Do I have to patch my 2.2.17 (not SuSE)Kernel to get IPMASQADM to work ? Does it work with the SuSE Kernel ? thanks... jan meyer

3 2

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Nix 30 Jan '01

30 Jan '01

No. AFAIK (I'm sure someone will correct me if I'm wrong) djbdns does the same thing as bind in that it will hand you an ip that is on the same subnet as one of it's interfaces if that's the interface the request came in on. Neither djbdns or BIND can possibly do BGP based handout of IP's because it requires special code running on each of your servers in the BGP mesh.. NOT just on the DNS server. That's why I said dents ALONG WITH supersparrow!!!! -Nix At 05:45 AM 31/01/2001, you wrote: >You mean like "pickdns is a load-balancing DNS server." and >"pickdns can return results that depend on the location of the >client." functionality? > > > BIND (or DJBDNS) does not have the flexibility to do this sort > > of thing. > >Sorry, the above citation is from the dnscache doc as of half a >year ago (dnscache is the former name of djbdns) ... --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Stefan Suurmeijer 30 Jan '01

30 Jan '01

Hi all, I haven't seen this on SuSE yet, so I thought I'd forward it. It seems almost every nameserver we have running is vulnerable. See: http://www.cert.org/advisories/CA-2001-02.html have fun upgrading :-( Stefan

11 14

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Kurt Seifried 30 Jan '01

30 Jan '01

>>That's real useful for end users :P. Wietse (postfix guy) was smart, 100% >>compatible sendmail replacement, both in functionality and license. Qmail is >>NOT. Neither is djbdns a drop in replacement for Bind. Hence only a minor >>percentage of people will make the effort to use it. > >Why is "drop-in-replacement"==GOOD and "no drop-in-replacement"==BAD? >I don't agree there. It's not that the programs are hard to install or >something. On the contrary, IMHO. Sendmail, ok, cleaned up a lot in the last two years, BUT if there is a hack it's usually root, for example the kernel capabilities bug. To get users to switch to a more secure mailer you have a few realistic options: make it the default - Mandrake now does this with Postfix. They do not ship Qmail. Vince (mandrake security packager goombah guy who writes their advisories and whatnot, who I drink with sometimes) tried valiantly to legally package qmail and ship it and gave up. Buy him a drink sometime and ask him about it if you want to hear a painful story. if it's hard to do people will not switch to it. Hell people won't even patch software or apply vendor security updates in a lot of cases, so what are the chances of them switching from say sendmail to qmail, if it requires a lot of effort? This is why compatibility (function wise, license wise, etc.) is so important. >Again, I don't agree. There are boatloads of enhancements and >modifications for qmail (and less so for djbdns, but that doesn't >exist as long). If you want a specific feature that isn't in standard >qmail/djbdns, there most probably is a patch that you can apply in >seconds. Again, very easy. Ohh, so if I go out of my way to fix qmail, it can do function X, whereas that is standard in Postfix for example (and then there are things postfix does that qmail can't, even with available patches, like regex filtering). That's like saying "Windows isn't insecure, if you get these security products and apply them it's secure". No, Qmail, as it ships from DJB, is a pain in the ass :P. I've tried to move to it several times (long ago), and tested it more recently, and I've never liked the results (and I get paid to spend my time on things like this). -Kurt

3 2

Firewall + Dial-in
by Mark Robinson 30 Jan '01

30 Jan '01

Hi all, I have a slight problem with the SuSE Firewall package. I have set up a server that has ippp0 as the internet i/f, and eth0 as the lan. Everything works fine with the setup. But (there's always a but) I have now added a modem to the box to allow remote user/admin. I've used mgetty and pppd to successfully set up the dial-in, and everything works ok to get connected. The problems are as follows: Once connected to the dial-in modem I can access mail (smtp and pop3) on the server. Samba lets me log in and maps drives as expected, and I can browse the internet. However I cannot ssh to the server, VNC won't connect and I can't ping any box on eth0. If I stop the firewall everything starts working! I can't work out why the firewall should have this effect. Please help before I lose all my hair :-) Mark

1 0

bind8
by Roman Drahtmueller 30 Jan '01

30 Jan '01

Hi, just a short heads-up: The bind8 packages for the distributions 6.1-7.1 are being built as I write this email. The packages should be available two or three hours. Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

SuSE Security Announcement: kdesu
by Sebastian Krahmer 30 Jan '01

30 Jan '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: kdesu Announcement-ID: SuSE-SA:2001:02 Date: Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0 Vulnerability Type: local root compromise Severity (1-10): 3 SuSE default package: yes Other affected systems: All KDE 1 & KDE 2 systems Content of this advisory: 1) security vulnerability resolved: kdesu problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information kdesu is a KDE frontend for su(1). When invoked it prompts for the root password and runs su(1). kdesu itself does not run setuid/setgid. However when enabling the 'keep password' option it tries to send the password across process boundaries to kdesud via a UNIX socket. During this it does not verify the identity of the listener on the other end. This allows attackers to obtain the root password. This bug has been fixed in the update packages by checking the ownership of the socket on the listener side. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-6.1: ftp://ftp.suse.com/pub/suse/i386/update/6.1/kpa1/kdesu-0.98-187.i386.rpm 3d51f84f2dc87916bc937f3afe507c1a SuSE-6.1: ftp://ftp.suse.com/pub/suse/i386/update/6.1/kpa1/kdesu.rpm 3d51f84f2dc87916bc937f3afe507c1a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/kdesu-0.98-187.src.rpm f8764afd475fa7a41c18603d15ce48ab SuSE-6.2: ftp://ftp.suse.com/pub/suse/i386/update/6.2/kpa1/kdesu-0.98-187.i386.rpm 027617e19c957b1ed5f42f140b62521b SuSE-6.2: ftp://ftp.suse.com/pub/suse/i386/update/6.2/kpa1/kdesu.rpm 027617e19c957b1ed5f42f140b62521b source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/kdesu-0.98-187.src.rpm 9cf3d4b0c00db4598968dd5c7e07eef7 SuSE-6.3: ftp://ftp.suse.com/pub/suse/i386/update/6.3/kpa1/kdesu-0.98-187.i386.rpm d2b6c6f3330a20c2eb7d5500de2f9df6 SuSE-6.3: ftp://ftp.suse.com/pub/suse/i386/update/6.3/kpa1/kdesu.rpm d2b6c6f3330a20c2eb7d5500de2f9df6 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/kdesu-0.98-187.src.rpm a50cc8ba1a793f9151559454fdad0a14 SuSE-6.4: ftp://ftp.suse.com/pub/suse/i386/update/6.4/kpa1/kdesu-0.98-187.i386.rpm 8f06dd49bdc00dca25eff33a3754ddee SuSE-6.4: ftp://ftp.suse.com/pub/suse/i386/update/6.4/kpa1/kdesu.rpm 8f06dd49bdc00dca25eff33a3754ddee source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/kdesu-0.98-187.src.rpm 0ca2d30cf51d1307f88581d4e240bbf0 SuSE-7.0: ftp://ftp.suse.com/pub/suse/i386/update/7.0/kpa1/kdesu-0.98-187.i386.rpm c7238ea5775939239b3857b550ca9f1b SuSE-7.0: ftp://ftp.suse.com/pub/suse/i386/update/7.0/kpa1/kdesu.rpm c7238ea5775939239b3857b550ca9f1b source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/kdesu-0.98-187.src.rpm bc74c75ba0b514f7df4f0250ccc7454a Sparc Platform: AXP Alpha Platform: SuSE-6.1: ftp://ftp.suse.com/pub/suse/axp/update/6.1/kpa1/kdesu-0.98-187.alpha.rpm 8017cd7fed463cae4bef3fa471e7e1d8 SuSE-6.1: ftp://ftp.suse.com/pub/suse/axp/update/6.1/kpa1/kdesu.rpm 8017cd7fed463cae4bef3fa471e7e1d8 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/kdesu-0.98-187.src.rpm 78846e4ae3f50e9264e8840da1a628a8 SuSE-6.3: ftp://ftp.suse.com/pub/suse/axp/update/6.3/kpa1/kdesu-0.98-187.alpha.rpm cf1629ba236c0c84e0f2b33101b5f1aa SuSE-6.3: ftp://ftp.suse.com/pub/suse/axp/update/6.3/kpa1/kdesu.rpm cf1629ba236c0c84e0f2b33101b5f1aa source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/kdesu-0.98-187.src.rpm da851ebaee36cb91cb1e1fca0c8bfda2 SuSE-6.4: ftp://ftp.suse.com/pub/suse/axp/update/6.4/kpa1/kdesu-0.98-187.alpha.rpm d1904cc9db320ea2c576b73633ee6bd5 SuSE-6.4: ftp://ftp.suse.com/pub/suse/axp/update/6.4/kpa1/kdesu.rpm d1904cc9db320ea2c576b73633ee6bd5 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/kdesu-0.98-187.src.rpm 27261cf8ff0ea66a597520260b832f7d SuSE-7.0: ftp://ftp.suse.com/pub/suse/axp/update/7.0/kpa1/kdesu-0.98-187.alpha.rpm be3b258eeeb3c56351b93ec8a32826db SuSE-7.0: ftp://ftp.suse.com/pub/suse/axp/update/7.0/kpa1/kdesu.rpm be3b258eeeb3c56351b93ec8a32826db source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/kdesu-0.98-187.src.rpm b7e3139377784c5cbbc4f14a5061d124 PPC Power PC Platform: SuSE-6.4: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/kpa1/kdesu-0.98-187.ppc.rpm 705afa4defc64c48f89dd94b2d52c296 SuSE-6.4: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/kpa1/kdesu.rpm 705afa4defc64c48f89dd94b2d52c296 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/kdesu-0.98-187.src.rpm 32e626fa7e8206d6803957c77062185b SuSE-7.0: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/kpa1/kdesu-0.98-187.ppc.rpm e9b4a8a26844af0bc8cb37c8d2d26530 SuSE-7.0: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/kpa1/kdesu.rpm e9b4a8a26844af0bc8cb37c8d2d26530 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/kdesu-0.98-187.src.rpm aaa092ffafe149ef8ba3acf570966e09 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - Kmail remote code execution. This issue will be adressed in following advisories. - pgp4pine bufferoverflow. Very unlikely to be exploited, but next advisories will contain information on this as well as URL's for patches. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Sebastian Krahmer ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOnLxI3ey5gA9JdPZAQGh/Qf+MoBq8Ys7ANMtnSg9mKVLxA7HXSM5DPVP lM4zFFJwyU8b/DBNfEHYPwDwNeAxeHtjMbpYbWt2zos2dVsz9caFOZznBRjM9hlF AhGMzXjTus+qfVoothlsMfVGvV3xOqbbIjdiUZChiULe8/Bm+YDmD2y9fkquxD+Z dmoY9yOaQ2bSjT8a1Gyin04Jew/uFyAroNmaAn1XDPGqXPq9EIXJz8gWigqDLwe+ Qfcizp9picMLnfEipGtCARP2/my53hp+2JwGy78E+lf7EZrhq0wlJ5nELQUdvYyA Y6aOEVq349q6Q5QeMF9ABfpyKPbmUXwkzzXTtMwdmYKoKtu6cUEThQ== =YAhD -----END PGP SIGNATURE-----

1 0

Fw: [COVERT-2001-01] Multiple Vulnerabilities in BIND
by Kurt Seifried 30 Jan '01

30 Jan '01

Someone mentioned suse shipped 8.2.3-T5 >From the advisory: > o Vulnerable Systems > > BIND 8 versions: 8.2, 8.2.1 > 8.2.2 through to 8.2.2-P7 > 8.2.3-T1A through to 8.2.3-T9B > > BIND 4 versions: buffer overflow - 4.9.5 through to 4.9.7 > format string - 4.9.3 through to 4.9.5-P1 As for suse being a bit slow they aren't as bad as some, not as good as other, but do tend to get it right more often the first time then quite a few. Also I believe they are gearing up for a new release. -Kurt - who spent the morning upgrading servers to 8.2.3. wheeep.

3 2

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Kurt Seifried 30 Jan '01

30 Jan '01

>>DNSSEC. > >Vapour. Doesn't exist at this time. (for use on the Internet) >Will be implemented in djbdns when the infrastructure to support it is >set up. That's odd... since .mil is rolling it out, and I know other people using it. >>Plus DJB's license sucks ass, it's almost impossible for vendors to ship his >>software, and for developers to work on it, > >This is something I can understand. For distributors, it *is* nearly >impossible to ship, and modifying and redistributing isn't allowed. >Distributing patches however, is. >This means you'll (as a sysadmin) will have to download and install >djb-ware yourself. I don't have a problem with that, personally. That's real useful for end users :P. Wietse (postfix guy) was smart, 100% compatible sendmail replacement, both in functionality and license. Qmail is NOT. Neither is djbdns a drop in replacement for Bind. Hence only a minor percentage of people will make the effort to use it. >qmail might indeed be getting a bit old, but there are many >improvements available. (but I thought we were discussing BIND here >:-) ) The same thing will happen to djbdns ultimatwly, since the only person that really does any work on DJB's software is DJB. -Kurt

4 3

Ramen Virus
by Paul Carruthers 30 Jan '01

30 Jan '01

has anyone heard anything about this ? What should I watch out for ? Paul Carruthers Systems Administrator Avellino Technologies Voice +44 (0) 118 940 7600 Fax +44 (0) 118 940 7699 Http://www.avellino.com/

3 2

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Oliver Teuber 29 Jan '01

29 Jan '01

hello i have created bind 8.2.3 rpms for 6.4 ... seems to work fine on our server ... use it on your own risk. http://www.teuber.com/bind/ cu, oliver On Mon, Jan 29, 2001 at 04:16:53PM +0100, Stefan Suurmeijer wrote: > Hi all, > > I haven't seen this on SuSE yet, so I thought I'd forward it. It seems > almost every nameserver we have running is vulnerable. See: > > http://www.cert.org/advisories/CA-2001-02.html > > have fun upgrading :-( > > Stefan > >

1 0

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Franco Galian 29 Jan '01

29 Jan '01

just thinking the same as you ;-) tinydns works just fine and it doesn't have those problems.../// > ----- Original Message ----- > From: "Jurjen Oskam" <jurjen(a)quadpro.stupendous.org> > To: "Stefan Suurmeijer" <stefan(a)symbolica.nl> > Cc: "Suse-security list" <suse-security(a)suse.com> > Sent: Monday, January 29, 2001 2:55 PM > Subject: Re: [suse-security] CERT Advisory CA-2001-02 Multiple > Vulnerabilities in BIND (fwd) > > > On Mon, 29 Jan 2001 16:16:53 +0100 (CET), Stefan Suurmeijer > <stefan(a)symbolica.nl> wrote: > > >I haven't seen this on SuSE yet, so I thought I'd forward it. It seems > >almost every nameserver we have running is vulnerable. See: > > > >http://www.cert.org/advisories/CA-2001-02.html > > > >have fun upgrading :-( > > You might want to take a look at http://cr.yp.to/djbdns.html . > > > end > -- > Jurjen Oskam * carnivore! * http://www.stupendous.org/ for PGP key > assassinate nuclear iraq clinton kill bomb USA eta ira cia fbi nsa kill > president wall street ruin economy disrupt phonenetwork atomic bomb sarin > nerve gas bin laden military -*- DVD Decryption at www.stupendous.org -*- > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > >

1 0

Re: [suse-security] Mysterious Mail with uknown Attachment
by AndriusD＠labas.com 29 Jan '01

29 Jan '01

once received, the similar e-mail attachement was detected by antivirus program as "hybris" virus you can find more info on this at: http://www.europe.f-secure.com/v-descs/hybris.shtml "...The worm can also send itself with a random, 8-letter name, for example UKSJHHKW.EXE. " "...Hybris is an Internet worm that spreads itself as an attachment to email messages. The worm works under Win32 systems only. The worm contains components (plugins) in its code that are executed depending on what worm needs, and these components can be upgraded from an Internet Web site. The major worm versions are encrypted with semi-polymorphic encryption loop. " regards, ------------------ andriusd(a)labas.com Max Lindner <ml(a)lofl.de> To: <suse-security(a)suse.com> cc: 2001.01.28 Subject: [suse-security] Mysterious Mail with 14:25 uknown Attachment Please respond to Max Lindner Hi! I got a mail with the following header: >From MAILER-DAEMON Sat Jan 27 17:17:40 2001 Return-Path: <> Delivered-To: mlindner(a)agentur-lindner.de Received: from webserver.hlg-fuerth.de (unknown [212.204.100.206]) by www1.agentur-lindner.de (Postfix) with ESMTP id 19EDA111E84 for <ml(a)agentur-lindner.de>; Sat, 27 Jan 2001 17:17:35 +0100 (CET) Received: by webserver.hlg-fuerth.de (Postfix) id 9EC366695B; Sat, 27 Jan 2001 17:18:42 +0100 (CET) Delivered-To: webmaster(a)hlg-fuerth.de Received: from mout02.kundenserver.de (mout02.kundenserver.de [195.20.224.133]) by webserver.hlg-fuerth.de (Postfix) with ESMTP id 57F7766959 for <webmaster(a)hlg-fuerth.de>; Sat, 27 Jan 2001 17:18:36 +0100 (CET) Received: from [195.20.224.151] (helo=mrelay01.kundenserver.de) by mout02.kundenserver.de with esmtp (Exim 2.12 #2) id 14MY2y-0003ix-00 for webmaster(a)hlg-fuerth.de; Sat, 27 Jan 2001 17:17:52 +0100 Received: from p3ee386f8.dip0.t-ipconnect.de ([62.227.134.248] helo=ayla) by mrelay01.kundenserver.de with smtp (Exim 2.12 #2) id 14MY2c-0001ga-00 for webmaster(a)hlg-fuerth.de; Sat, 27 Jan 2001 17:17:30 +0100 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="--VE96FW1QV0X2J49MBGHIF0T" Message-Id: <E14MY2c-0001ga-00(a)mrelay01.kundenserver.de> From: Remote Mail Delivery System <> Date: Sat, 27 Jan 2001 17:17:30 +0100 Status: RO X-Status: X-Keywords: X-UID: 737 There was no message in it and has had a quite strong attachment named: 'PKCBLMPK.EXE' Is this malware? Anyone knows this file? I didn't execute it yet... Is it possible that relay01.kundenserver.de is an open relay? Thanks for help and suggestions... Max --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Message frozen
by Carlos Manuel Duclos Vergara 29 Jan '01

29 Jan '01

Hi, seeing the last talk about weird mails i remember this, do you think that this maybe a misconfigured mail server or is some kind of attack ? bye ---------- Forwarded Message ---------- Subject: Message frozen Date: Sun, 28 Jan 2001 23:25:52 -0300 From: Mail Delivery System <Mailer-Daemon(a)embedded.cl> To: postmaster(a)embedded.cl Message 14N40q-00047m-00 has been frozen (delivery error message). The sender is <>. The following address(es) have yet to be delivered: aulap1(a)ee.cl: unknown local-part "aulap1" in domain "ee.cl" ------------------------------------------------------- -- Carlos Manuel Duclos Vergara carlos(a)embedded.cl http://www.embedded.cl/~carlos

1 0

Re: [suse-security] Re: Getting weird FETCHMAIL-DAEMON messages...
by Nix 29 Jan '01

29 Jan '01

At 12:40 PM 29/01/2001, you wrote: >Dear All > > > > Here is the contents of that e-mail: > > > > From: FETCHMAIL-DAEMON(a)josswinn.org > > To: matthew(a)psychohorse.com > > Date: Mon, 29 Jan 2001 07:04:08 +0900 > >I've been getting these for a few days. Not sure where from ? > >On Thursday night at midnight my net facing box was broken into and >someone replaced sendmail.cf with another one. What this meant was >that when my box downloaded mail it then forwarded ti to many people >on the internet. I discovered this and replaced sendmail.cf before >any damage was done. > >Tonight I was about to reply to this e-mail at about midnight and >someone broke in and destroyed my Pine 4.32 mail app. That meant that >I couldn't send this mail either. > >So, what's going on ? I don't know either. Mate, Unplug the box from the net. If it has been broken into you don't know what has been compromised Please email me back privately if you need help. I will be contactable for the next 8hrs or so by email. (I am ducking out to grab some lunch now, but will be back in 20min..) Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

4 7

Re: Getting weird FETCHMAIL-DAEMON messages...
by Richard 29 Jan '01

29 Jan '01

Dear All > Here is the contents of that e-mail: > > From: FETCHMAIL-DAEMON(a)josswinn.org > To: matthew(a)psychohorse.com > Date: Mon, 29 Jan 2001 07:04:08 +0900 I got a load of these after my own net facing box was attacked at midnight on Thursday night. I'm still getting some of them now. Bit difficult to do it on a dialup box which is only connected for a few minutes. But, someone did just that. Myself and a friend couldn't work out what the purpose of the attack was. We re-installed sendmail.cf and that sorted out the problem. As far as we could see someone was using my box to forward mail. That is very difficult on a dialup box. Specially when I sit in front of it and watch /var/log/messages all the time. So, whoever did it didn't seem to know too much at all. Tonight as I was about to reply to this mail someone broke in again and destroyed sendmail.cf on another machine. So, whoever he or she is they have a thing about sendmail.cf files on SuSE home user's machines. Thanks Richard

1 0

Getting weird FETCHMAIL-DAEMON messages...
by Matthew 29 Jan '01

29 Jan '01

Here is the contents of that e-mail: From: FETCHMAIL-DAEMON(a)josswinn.org To: matthew(a)psychohorse.com Date: Mon, 29 Jan 2001 07:04:08 +0900 Some addresses were rejected by the MDA fetchmail forwards to. Attachment: 1 Attachment: 2 I have opened up attachment 1 and this is the contents: From: To: Date: Final-Recipient: rfc822; josswinn Last-Attempt-Date: Mon, 29 Jan 2001 07:04:08 +0900 (JST) Action: failed Status: j.0.0 Diagnostic-Code: josswinn: 550 5.1.1 <josswinn@localhost>... User unknown I have not opened attachment 2 as it comes with an icon that is a big black T and I get warning that opening it might compromise system security. Its happened 5 times now, all from josswin.org. Is this a cracker attempt, or most likely his fetchmail daemon is not working? I have looked under www.josswinn.org and he has a web page (Flash heavily enabled). There is nothing in my log files.....Maybe this poor guy has been attacked himself? How should I proceed? Many thanks, Matt

2 1

openssh && hardensuse problem
by Br�ulio Gergull 28 Jan '01

28 Jan '01

Hi, I'm using SuSE 7.0 Professional to build a firewall. I've installed the necessary packages, upgraded to latest release and after running "harden_suse yes" opensshd just refuses to accept connections, the following message appears on the logs: Jan 27 15:53:32 maestro sshd[887]: refused connect from 192.168.0.100 (192.168.0.100) sshd is running, of course. Last week the same problem occurred on another machine and it was "solved" (?) uninstalling openssh-2.3.0p1-0 and installing openssh-2.1.1p1-43 (vulnerable) :( Versions: SuSE 7.0 openssh-2.3.0p1-0 hardensuse-2.6-1 rgrds, Bráulio Gergull

2 2

Re: [suse-security]about: was Fwd: Do I have a virus on my MBR?
by Aaron Matas 28 Jan '01

28 Jan '01

About is an internal browser command. You can check the source code for Mozilla. Netscape has some information also. Different browsers or versions of browsers give different results. The Willis message is probably in a Netscape .dll file as are the logo's. about:document shows information about current document - same as edit/view info about:cache about:memory-cache about:image-cache can use this to find images in cache about:security about:authors removed in some browser versions about:fonts about:logo WARNING: about:xxxLOGO may cause multiple about:rsalogo windows to open depending on your browers, about:javalogo if so keep hitting the Esc key till it stops about:license about:editfilenew title about:mozilla or about:moz ..got curious one day and started looking :>) Aaron Matas IBM xSeries Performance Analyst Phone: 919-254-2508 LAB: 919-486-0306 Fax: 919-254-9267 LAB-Fax: 919-547-0083 juergen.braukmann@ruhr-west.de@ruhr-west.de on 01/27/2001 11:44:24 AM To: ghamblin(a)btinternet.com cc: suse-security(a)suse.com Subject: Re: [suse-security] Fwd: Do I have a virus on my MBR? Graham Hamblin wrote: > > Hi > This is a copy of a message I have sent to Support at S.u.S.E. and put on here > for the information of all. Hope it is of help. > > I am using S.u.S.E. 7.0 Professional on a PC at home with a modem connection to > the internet. If I invoke security in Netscape whatever is showing in the > window and invoke Open Page Information there are two windows. In the top one > is the page information but in the bottom one is the following text, "Whatchew > talkin' 'bout, Willis?" and try as I may I cannot find it or get rid of it. > ... First don't Panic. Try to type something like "about:lxdkrjgklxdgjghklxd" in the address field and watch the browser window. Juergen -- =========================================== __ _ Juergen Braukmann juergen.braukmann(a)gmx.de| -o)/ / (_)__ __ ____ __ Tel: 0201-743648 dk4jb(a)db0qs.#nrw.deu.eu | /\\ /__/ / _ \/ // /\ \/ / ===========================================_\_v __/_/_//_/\_,_/ /_/\_\ --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Mysterious Mail with uknown Attachment
by Max Lindner 28 Jan '01

28 Jan '01

Hi! I got a mail with the following header: >From MAILER-DAEMON Sat Jan 27 17:17:40 2001 Return-Path: <> Delivered-To: mlindner(a)agentur-lindner.de Received: from webserver.hlg-fuerth.de (unknown [212.204.100.206]) by www1.agentur-lindner.de (Postfix) with ESMTP id 19EDA111E84 for <ml(a)agentur-lindner.de>; Sat, 27 Jan 2001 17:17:35 +0100 (CET) Received: by webserver.hlg-fuerth.de (Postfix) id 9EC366695B; Sat, 27 Jan 2001 17:18:42 +0100 (CET) Delivered-To: webmaster(a)hlg-fuerth.de Received: from mout02.kundenserver.de (mout02.kundenserver.de [195.20.224.133]) by webserver.hlg-fuerth.de (Postfix) with ESMTP id 57F7766959 for <webmaster(a)hlg-fuerth.de>; Sat, 27 Jan 2001 17:18:36 +0100 (CET) Received: from [195.20.224.151] (helo=mrelay01.kundenserver.de) by mout02.kundenserver.de with esmtp (Exim 2.12 #2) id 14MY2y-0003ix-00 for webmaster(a)hlg-fuerth.de; Sat, 27 Jan 2001 17:17:52 +0100 Received: from p3ee386f8.dip0.t-ipconnect.de ([62.227.134.248] helo=ayla) by mrelay01.kundenserver.de with smtp (Exim 2.12 #2) id 14MY2c-0001ga-00 for webmaster(a)hlg-fuerth.de; Sat, 27 Jan 2001 17:17:30 +0100 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="--VE96FW1QV0X2J49MBGHIF0T" Message-Id: <E14MY2c-0001ga-00(a)mrelay01.kundenserver.de> From: Remote Mail Delivery System <> Date: Sat, 27 Jan 2001 17:17:30 +0100 Status: RO X-Status: X-Keywords: X-UID: 737 There was no message in it and has had a quite strong attachment named: 'PKCBLMPK.EXE' Is this malware? Anyone knows this file? I didn't execute it yet... Is it possible that relay01.kundenserver.de is an open relay? Thanks for help and suggestions... Max

3 2

Re: [suse-security] openssh && hardensuse problem
by Armin Schöch 28 Jan '01

28 Jan '01

> I'm using SuSE 7.0 Professional to build a firewall. I've installed the > necessary packages, upgraded to latest release and after running > "harden_suse yes" opensshd just refuses to accept connections, the > following message appears on the logs: > > Jan 27 15:53:32 maestro sshd[887]: refused connect from 192.168.0.100 > (192.168.0.100) Hello Bràulio ! The point with the updated ssh package is, that it is now linked against the tcpwrapper library. This means you have to allow the ssh connection explicitely in /etc/hosts.allow It should work if you put in a line like sshd: 192.168.0.100 There is also an option AllowHosts in /etc/sshd_conf. Look up the syntax with "man sshd". Good luck ! Armin ------------------------------------------------------------------------ Armin Schöch at the office: Institut für Atmosphärenphysik Ziolkowskistr. 10 / 63 Schlossstraße 6 D-18059 Rostock D-18225 Kühlungsborn Tel. +49-(0)381-4005781 Tel. +49-(0)38293-68-102

1 0

Fwd: Do I have a virus on my MBR?
by Graham Hamblin 27 Jan '01

27 Jan '01

Hi This is a copy of a message I have sent to Support at S.u.S.E. and put on here for the information of all. Hope it is of help. I am using S.u.S.E. 7.0 Professional on a PC at home with a modem connection to the internet. If I invoke security in Netscape whatever is showing in the window and invoke Open Page Information there are two windows. In the top one is the page information but in the bottom one is the following text, "Whatchew talkin' 'bout, Willis?" and try as I may I cannot find it or get rid of it. I have re installed over 20 times, used lilo -u and fdisk /MBR in dos, reset my bios to its defaults and even installed Netscape 4.76 but all to no avail.. If I boot and instal direct from the CD without rebooting and initialise Netscape the text is there. I am sorry I only know a little German. Antivir when executed without arguement on a new installation returns "Verzeichnisse 1" so I suspect I have a virus on my master boot sector and I have no idea how to deal with it effectively. I really have been at this problem for nearly three weeks and am absolutely at my wits end and will be absolutely delighted if you can help me. This is only the second time I have asked for help, Roman was kind enough to put me right on the last occasion. Thanking you in anticipation. Graham Hamblin. -- ghamblin(a)btinternet.com S.u.S.E. Linux 7.0 ================== ------------------------------------------------------- -- ghamblin(a)btinternet.com S.u.S.E. Linux 7.0 ==================

5 5

Port 81 - what is it and who uses it?
by suse＠diplan.de 27 Jan '01

27 Jan '01

Hi. Simple question: I wonder what port 81 is for and what service on my DMZ is trying to connect to it. I looked into several firewall books but the problem is they don't have a port number index. Of course I can read from /etc/services: hosts2-ns 81/tcp # HOSTS2 Name Server hosts2-ns 81/udp # HOSTS2 Name Server So what is HOSTS2 and to avoid future simple questions like this one, where can I look for a reference? thanks in advance, Rainer

3 2

Re: Re: man package / SuSe format string vulnerabilities
by bacano 26 Jan '01

26 Jan '01

Hi2all In SuSe 7.0 is the same ... # man -l %x%x%x%x man: 4001ee6cbffff8d40bffff8d0: No such file or directory [ ]'s bacano ----- Original Message ----- From: "syzop" <syz(a)DDS.NL> To: <VULN-DEV(a)SECURITYFOCUS.COM> Sent: Friday, January 26, 2001 3:16 PM Subject: Re: man package / SuSe format string vulnerabilities > confirmed on debian 2.2r2... > tracing in source of man-db-2.3.16 (man-db-2.3.17 [latest I guess] same problem)...: > > -- [src/man.c:752]: > if (!display ((cwd[0]?cwd:NULL), argv, NULL, basename(argv))) { > if ( local_mf ) > error (0, errno, argv); <----- HERE > exit_status = NOT_FOUND; > } > > -- [lib/error.c:80] > error (int status, int errnum, const char *message, ...) > -- [lib/error.c:102 (editted)] > VA_START (args, message); > vfprintf (stderr, message, args); > -- > > Auch :) > > Cya > > Syzop. > > > Joao Gouveia wrote: > > > Hi there, > > > > I'm sorry if this is a known issue, but i didn't find nothing related to > > format strings in this man package. > > Example follows: > > <quote> > > jroberto@spike:~ > cat /etc/issue > > > > Welcome to SuSE Linux 6.3 (i386) - Kernel \r (\l). > > > > jroberto@spike:~ > man -l %x%x%x%x > > man: 0bffff8600bffff85c: No such file or directory > > jroberto@spike:~ > man -V > > man, version 2.3.10, db 2.3.1, July 12th, 1995 (G.Wilford(a)ee.surrey.ac.uk) > > </quote> > > > > AFAIK, suse 7.0 also ships with this 'man'. Can anyone confirm this? > > > > Best regards, > > > > Joao Gouveia > > -------------- > > tharbad(a)kaotik.org >

1 0

pam_opie and ssh
by Diegmann Björn 26 Jan '01

26 Jan '01

Hi, I have set up sshd to authenticate via pam_opie. When logging in with a secure shell the challenge is only displayed AFTER authentication. any ideas?? thanks bjoern some details: SuSE 7.0/OpenSSH_2.3.0 # This is ssh server systemwide configuration file. Port 22 #Protocol 2,1 ListenAddress 0.0.0.0 #ListenAddress :: HostKey /etc/ssh/ssh_host_key ServerKeyBits 768 LoginGraceTime 600 KeyRegenerationInterval 3600 PermitRootLogin no # # Don't read ~/.rhosts and ~/.shosts files IgnoreRhosts yes # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication #IgnoreUserKnownHosts yes StrictModes yes X11Forwarding yes X11DisplayOffset 10 PrintMotd yes KeepAlive yes # Logging SyslogFacility AUTH LogLevel INFO #obsoletes QuietMode and FascistLogging RhostsAuthentication no # # For this to work you will also need host keys in /etc/ssh_known_hosts RhostsRSAAuthentication no # RSAAuthentication yes # To disable tunneled clear text passwords, change to no here! PasswordAuthentication yes PermitEmptyPasswords no # Uncomment to disable s/key passwords #SkeyAuthentication no KbdInteractiveAuthentication yes # To change Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #AFSTokenPassing no #KerberosTicketCleanup no # Kerberos TGT Passing does only work with the AFS kaserver #KerberosTgtPassing yes CheckMail no UseLogin no

1 0

AW: [suse-security] Password Authentication
by Stiefenhofer, Marek ECOFIS 26 Jan '01

26 Jan '01

Use pam_ldap. I don't know whether it is included in the suse 7.0 distribution. http://www.padl.com/pam_ldap.html kind regards, Marek

2 1

Password Authentication
by Phillip D. Beal 26 Jan '01

26 Jan '01

Hey, How can I make a SuSE 7.0 Professional System authenticate a user with an ldap server that is running on a remote system? I have a small secure system running an ldap server from an internal network, and I want all the systems to authenticate the users with the ldap database. I know the ldap database can be used for this, but how can I make a SuSE 7.0 system use the database? Thanks, -- Phillip Beal ___ _ _ Electrical and Computer Engineering | _ ) ___ __ _| |___ _ _ ___| |_ pdbeal(a)louisville.edu | _ \/ -_) _` | |_ /_| ' \/ -_) _| http://www.bealz.net/ |___/\___\__,_|_/__(_)_||_\___|\__|

1 0

SuSE Security Announcement: shlibs/glibc (SuSE-SA:2001:01)
by Roman Drahtmueller 26 Jan '01

26 Jan '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: glibc (shlibs) Announcement-ID: SuSE-SA:2001:01 Date: Friday, January 26th, 2001 15:40 MET Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0 Vulnerability Type: local root compromise Severity (1-10): 6 SuSE default package: yes Other affected systems: most Linux/glibc based systems Content of this advisory: 1) security vulnerability resolved: glibc problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information ld-linux.so.2, the dynamical linker, adds shared libraries to the memoryspace of a program to be started. Its flexibility allows for some environment variables to influence the linking process such as preloading shared libraries as well as defining the path in which the linker will search for the shared libraries. Special care must be exercised when runtime-linking setuid- or setgid-binaries: The runtime-linker must not link against user-specified libraries since the code therein would then run with the elevated privileges of the suid binary. The runtime-linker as used in the SuSE distributions ignores the content of the critical environment variables if the specified path begins with a slash ("/"), or if the library file name is not cached (eg it is contained in a path from /etc/ld.so.conf). However, Solar Designer has found out that even preloading glibc- native shared libraries can be dangerous: The code in the user-linked library is not aware of the fact that the binary runs with suid or sgid privileges. Using debugging features of the glibc (and possibly other features) it is possible for a local attacker to overwrite arbitrary files with the elevated privileges of the suid/sgid binary executed. This may lead to a local root compromise. To eliminate these problems, we provide update packages that completely disregard the LD_* variables upon runtime-linking of a binary that has an effective uid different from the caller's userid. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. SPECIAL INSTALL INSTRUCTIONS: ============================== The glibc (the shlibs package) is an intrinsic part of the GNU/Linux operating system since most binary executables are dependent on the shared libraries from that package. For this reason, special care must be taken while updating the shlibs package. After downloading the binary rpm files, make sure that your system is idle by bringing it down to Single User Mode (`init 1´). If this is not applicable for operational reasons, then keep your machine as calm as possible while you perform the update. In particular, make sure that no shell scripts are running during the update. Install the package using the command rpm -Uhv package-rpm-file Do _NOT_ interrupt the operation of the rpm command! After the installation, execute the commands ldconfig # alternatively, use SuSEconfig /sbin/init u # will restart init At this point, the update is done. On low-memory machines a reboot is advisable to free the memory that is used by the old memory-mapped libraries. Note 1: The upcoming SuSE-7.1 distribution is based on glibc-2.2. This distribution is not affected by the security problems in glibc as discussed in security forums. Note 2: The source rpm for the shlibs package is called "libc*.rpm". Multiple binary rpm packages are being generated from this source rpm package. These include: localedb, nssv1, shlibs, timezone. To get a fix for the runtime-linker related security issue (topic of this announcement), it is only necessary to update the shlibs binary rpm package. SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/shlibs-2.1.3-190.i386.rpm 94ccbb80d2841f08f2b7322671d6e7f3 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/libc-2.1.3-190.src.rpm 3d15b6ffff534f0bf705882dbd8a2551 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/shlibs-2.1.3-155.i386.rpm bc03f1a6f32a66958128e9450e355698 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/libc-2.1.3-155.src.rpm e8f2aa8d32122edfbe3c436a52abb847 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/shlibs-2.1.2-48.i386.rpm 8d572332c67b488e5d64a8d4d3274e90 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/libc-2.1.2-48.src.rpm 8e1f861112f4a921ea4c7b5631304ee6 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/shlibs-2.1.1-30.i386.rpm b6b4cfe73e46c5b3bd5b626d68dfa584 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/libc-2.1.1-30.src.rpm 67fcd70b40f145b5f40b86f7254e35be SuSE-6.1 SuSE-6.0 The rpm packages are being produced as this announcement is written. The md5sums for these rpm packages will be provided on the ftp-server, signed with the security(a)suse.de pgp key below. Sparc Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/shlibs-2.1.3-155.sparc.rpm 6b000a6278366c6da4b719d2f62ad7a4 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/libc-2.1.3-155.src.rpm e845606be9c9aca72213e4c5f1f32290 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/a1/shlibs-2.1.3-155.alpha.rpm 2df813e3c08b52e3f914c591efc742d4 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/libc-2.1.3-155.src.rpm 9cb7a6e5981112da6d702916d453b419 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/shlibs-2.1.3-155.alpha.rpm 0636c2cddf131e76c19e154619a65bd8 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/libc-2.1.3-155.src.rpm 39fd3b8e7e4054bc7a333a831e99e6fd SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/shlibs-2.1.2-48.alpha.rpm f9713bc945bf7f98527d2fdfbe756dfb source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/libc-2.1.2-48.src.rpm af2eb3df9d83f8f8ca13526046a3a539 SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/shlibs-2001.1.17-0.alpha.rpm 4a0033c4ec32ef0e79fc1b7a83692738 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/libc-2000.9.5-0.src.rpm 11871baa8279f8c0c79f6c9d95ca531c PPC Power PC Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/shlibs-2.1.3-173.ppc.rpm 8d9d27a8fba22de4df5cd4700a541ad9 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/libc-2.1.3-173.src.rpm 89946b9a2bb7c545a1761a84ebd979ab SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/shlibs-2.1.3-190.ppc.rpm 383bb49a2f6a3e83a9c2ed3eea30dc99 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/libc-2.1.3-190.src.rpm 91ed7087165b74383cddb556abc07402 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: This announcement is followed by a sequence of more announcements to address the ongoing security problems as discussed in public security forums. In particular, there are temporary file races in multiple packages (we collect and address them in a single announcement to keep the noise low), format string bugs, as well as a man-in-the-middle attack in the kdesu program and a single-byte buffer overflow. The next announcenemts will contain more information on these topics. Please stay tuned. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller, SuSE Security. - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOnGNKney5gA9JdPZAQHwWAf+O/xaFgEnMGl1E3NqR/oC6zDB5TelVWil 7Ng4KVr1Ijwodi7CjXAOXdI1SfVt2v64IWKxjpppQdM1F9epNEFCHx2XdLCviBEo EMC8r+KmPICRvfZJUzhJQPszXuLm7SDPTf5fsrWBcQrLnaQ+1eCBqlyCciFqLb3s iZYaxP/NoQh18UuKUVo3lRAzwN7eZwKh4xuwRfmxdB1yBqHloquTKA+JV7kl8SV4 k3PaNO7yC1kkbltkUX/y95hKEhQazh5Il/vK0FyKMHzXYdj8y28kQJKL07Gmwaye Sx3U7QRe9AD1e+IcfPzE6G9n1beaNhKMu+hGfyYXg+5n8lGKp/FTxw== =bcEa -----END PGP SIGNATURE-----

1 0

logcheck
by semat 26 Jan '01

26 Jan '01

Hello everyone, I would like a little help with a problem. I installed logcheck and I have this message from it multiple times: Jan 25 16:15:38 alpha sshd[5838]: debug: Installing crc compesation attack detector I would like to know what this means and whether I have cause to be worried. thanks you.

2 1

Does autorpm for SuSE exist ???
by Marko Kaening 26 Jan '01

26 Jan '01

Hi, I saw that Redhat has a nice tool called autorpm which allows automated updates of the system (for instance in case of security updates). It looks like this tool is not part of SuSE distribution! I personally would like to have such a tool available. So one could run that every morning or so just to be informed which packages were updated on ftp.suse.de for whatever reason and to decide whether an update should be made. Perhaps I am just not well enough informed, in that case I shut up and listen to your advice what to do, otherwise I would be happy to find some support from other users who might have the same wish to make system security a little easier and time-robbing job. What does SuSE think about this? Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

6 8

RE: Hardening network by setting priorities
by Andreas Achtzehn 26 Jan '01

26 Jan '01

> From: Thomas Schuette [mailto:tgs@schuetteweb.de] > I think I can switch to Deutsch, ist ein wenig einfacher ;) > Meinst Du evtl. die TOS Bits? > > # Optimize your TCP/UDP connections by setting IP Options! > # -t 0x01 0x08 == best throughput > # -t 0x01 0x10 == fastest transmission > # -t 0x01 0x14 == most reliable trasmission > Hallo Thomas! Das ist ja schon die halbe Miete, danke erstmal, aber hast du eine Idee, wo ich eine gute Doku dazu herkriege? Andreas

3 4

pptp and ppp errors
by klg1＠gmx.de 26 Jan '01

26 Jan '01

Hello, I want to set up a VPN to connect from my mobile computer (Win98) via dialup (ISP) to my office (SuSe 6.4, FW). First I tried to set up a FreeSwan tunnel - which is no problem on the Linux Server side - but I could not find a free client for Win98. I downloaded FreePGP 6.51 from Computer Associates but a tunnel can only be established with the commercial versions. Does anybody know of a free client for Win98 which can be used for setting up a "road warrior"? Second thing i tried is to deal with the Linux PPtP Server. I set up things according to the man pages of PPtP (PPtPd is listening to the nic connected to the internet and is aware of incoming calls) but I am not able to finish connecting to the server. /var/log/messages reports my ppp establishing a connection to a serial port ppp0 <-> pts0 instead of eth0 and therefore all LCP pakets are gone. Another problem occurs if I enable Data encryption in /etc/ppp/options: if I enable mschap, mschap-v2, mppe40 or mppe128 pppd reports an error - unknown option - and dies although these options are mentioned in the man pages (pppd version 2.3.11) and in the HowTos. As the SuSE readme shows up those options and the docs (even at the LDP) does not mention about the above problems I don't know whats going wrong. Is there anybody who has a working setup, or knows what I am doing wrong? Thanks a million for any help Klaus -- Sent through GMX FreeMail - http://www.gmx.net -- Sent through GMX FreeMail - http://www.gmx.net

1 0

Why is this mail routed to me?
by Thorsten Marquardt 25 Jan '01

25 Jan '01

Hi, sometimes I get email which is addressed to different people. Here is a header of one of this mails: >From receipt(a)toushi-radar.co.jp Wed Jan 24 09:55:32 2001 Return-Path: <receipt(a)toushi-radar.co.jp> Received: from www.text-team.de ([212.6.91.187]) by mail.text-team.de (8.10.2/8.10.2/SuSE Linux 8.10.0-0.3) with ESMTP \ id f0O8tL330264 for <thom(a)proxy.text-team.de>; Wed, 24 Jan 2001 09:55:21 +0100 X-Authentication-Warning: mail.text-team.de: Host [212.6.91.187] claimed to be \ www.text-team.de Received: from www.amcc.com.cn ([202.102.193.110]) by www.text-team.de (8.10.2/8.10.2/SuSE Linux 8.10.0-0.3) with SMTP id \ f0O8sWl19488 for <thom(a)www.text-team.de>; Wed, 24 Jan 2001 09:54:33 +0100 X-Authentication-Warning: www.text-team.de: Host [202.102.193.110] claimed to \ be www.amcc.com.cn Received: (qmail 11375 invoked by uid 101); 19 Jan 2001 04:55:23 -0000 Received: from unknown (HELO toushi-radar.co.jp) (unknown) by unknown with SMTP; 19 Jan 2001 04:55:23 -0000 Message-ID: <00006e2e3a77$00006cd5$00007aa6(a)toushi-radar.co.jp> To: <admin(a)moreprofitinfo.or.kr> From: receipt(a)toushi-radar.co.jp Subject: Can You Ever Have enough Money? 31398 Date: Thu, 18 Jan 2001 19:32:01 -0800 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal and here is the associated part from /var/log/mail Jan 24 09:55:21 mail sendmail[30264]: f0O8tL330264: Authentication-Warning: \ mail.text-team.de: Host [212.6.91.187] claimed to be www.text-team.de Jan 24 09:55:32 mail sendmail[30264]: f0O8tL330264: from=<receipt@toushi-rad\ ar.co.jp>, size=6867, class=0, nrcpts=1, msgid=<00006e2e3a77$00006cd5$00007a\ a6(a)toushi-radar.co.jp>, proto=ESMTP, daemon=MTA, relay=[212.6.91.187] Jan 24 09:55:32 mail sendmail[30265]: f0O8tL330264: to=<thom(a)proxy.text-team.\ de>, delay=00:00:11, xdelay=00:00:00, mailer=local, pri=36020, dsn=2.0.0, \ stat=Sent Needless to say that I don't know neither the sender nor the receipent. Do I have an missconfiguerd sendmail? Yours sincerly Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

2 1

Re: [suse-security] Export
by Eilert Brinkmann 25 Jan '01

25 Jan '01

Jussi Jääskeläinen wrote: > I just upgrade from Suse 6.2 --> 7.0 > I have exported: > > /home 120.100.100.0/24 (rw,no_root_squash) ^^^ There should be no spaces between the hostname/address and the corresponding options in /etc/exports. > now when NFS-server is updated... Some how machines who mounts that > resource are NOT handeled as ROOT-users anymore... Remove the extraneous space in /etc/exports and execute `rcnfsserver reload` on the NFS server. Probably this will fix your problem. Eilert P.S. I assume you are aware that this configuration can be a security problem ;-) -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0

more problems: Masq'ing pptp
by Kevin Creason 25 Jan '01

25 Jan '01

I've patched my suSE 6.4 kernel (2.2.14), recompiled with the settings from the website at bottom. In YaST I've given the ip address of {SERVER-IP} to FW_TRUSTED_NETS, and ports 500, 1723 and 65535 to SERVICES_TRUSTED_TCP & UDP. I added the 65535 port after these errors, but still no go. I'm trying to use Microsoft's VPN (pptp) through my SuSE firewall to the server on the other end. The server on the other end is working for other non protected clients. I don't think I need masq_gre, but it it is going in for some reason. What did I do wrong? How do I enable proto 47? Jan 24 19:05:38 {MY-SRVR-HOSTNM} kernel: ip_masq_gre(): {INTERNAL-IP} -> {SERVER-IP} CID=C3E7 VER=1 PROTO=880B Jan 24 19:05:38 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-ip}:65535 {ISP-ASSIGNED-IP}:65535 L=57 S=0x00 I=18380 F=0x0000 T=105 (#142) Jan 24 19:05:38 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=89 S=0x00 I=18381 F=0x0000 T=105 (#142) Jan 24 19:05:42 {MY-SRVR-HOSTNM} kernel: ip_masq_gre(): {CLIENTHOST-IP} -> {SERVER-IP} CID=C3E7 VER=1 PROTO=880B Jan 24 19:05:42 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=89 S=0x00 I=18382 F=0x0000 T=105 (#142) Jan 24 19:05:42 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=57 S=0x00 I=18383 F=0x0000 T=105 (#142) Jan 24 19:05:46 {MY-SRVR-HOSTNM} kernel: ip_masq_gre(): {CLIENTHOST-IP} -> {SERVER-IP} CID=C3E7 VER=1 PROTO=880B Jan 24 19:05:46 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=57 S=0x00 I=18384 F=0x0000 T=105 (#142) Jan 24 19:05:46 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=89 S=0x00 I=18385 F=0x0000 T=105 (#142) Jan 24 19:05:50 {MY-SRVR-HOSTNM} kernel: ip_masq_gre(): {CLIENTHOST-IP} -> {SERVER-IP} CID=C3E7 VER=1 PROTO=880B Jan 24 19:05:51 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=89 S=0x00 I=18386 F=0x0000 T=105 (#142) Jan 24 19:05:51 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=57 S=0x00 I=18387 F=0x0000 T=105 (#142) Jan 24 19:05:54 {MY-SRVR-HOSTNM} kernel: ip_masq_gre(): {CLIENTHOST-IP} -> {SERVER-IP} CID=C3E7 VER=1 PROTO=880B Jan 24 19:05:54 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=57 S=0x00 I=18388 F=0x0000 T=105 (#142) Jan 24 19:05:54 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=89 S=0x00 I=18389 F=0x0000 T=105 (#142) Jan 24 19:05:58 {MY-SRVR-HOSTNM} kernel: ip_masq_pptp_tcp(): {ISP-ASSIGNED-IP} -> {SERVER-IP} LEN=16 TY=1 MC=1A2B3C4D CTL=CALL_DISCONNECT_NOTIFY Jan 24 19:05:58 {MY-SRVR-HOSTNM} kernel: ip_masq_pptp_tcp(): CALL_DISCONNECT_NOTIFY, CID=8000 > ftp://ftp.rubyriver.com/pub/jhardin/masquerade/ip_masq_vpn.html > ftp://ftp.rubyriver.com/pub/jhardin/masquerade/VPN-howto/VPN-Masquerade-2.ht > ml > http://members.home.net/ipmasq/ Trim replies as much as needed- natch. Thanks in advance.

1 0

Hardening network by setting priorities
by Andreas Achtzehn 24 Jan '01

24 Jan '01

Hello security-list! I'd like to implement the following: To avoid DDoS-attacks I'd like to set priorities for certain network-services. I once read an article on securityfocus.com about how to for example set up that http-traffic is more important than DNS-traffic. It's possible using the ipchains. But unfortunately I can't find that article anymore where this is explained. So I hope for your assistance with this problem. Does anyone have a good description on how to set priorities? Thanks in advance, A. Achtzehn -- -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/CM/IT/P d@ s: !a C++(+) UL++++$ P++ L+++(++++)@ E---- W+++ N+ o? K? w O- M- V- PS PE- Y+ PGP++ t+ 5 X+ R* tv+ b++ DI? D-- G> e@> h!> ------END GEEK CODE BLOCK------ See http://www.ebb.org/ungeek/ on details.

2 1

Re: [suse-security] Update
by r.maurizzi＠gvs.it 24 Jan '01

24 Jan '01

> I have got a old box which was running suse 5.x and has ( last night ) been > upgraded to Suse7 All went very well despite a few silly things. However > something odd is now happening... if I telnet to the box it only asks for a > username at logon rather than username and a password ? > Any ideas ? Only a guess, but I had a similar problem upgrading and old RedHat, enabling shadow passwords in the process. Changing every user passwords by hand solved the problem (since a utility to do so was useful only to obtain a tight CPU loop ;_;). Chech to see if /etc/passwd and /etc/shadows contain "sane" values. Ciao, Roberto.

2 1

dhcpd with iptables
by Fritz Ganter 24 Jan '01

24 Jan '01

Hello! I have the problem that I can not access the dhcp server which is running on the firewall(yes I now). :-) I can send the configuration with email. The dhcp server listen on the internal interface, if I switch of the firewall all works fine. Remember, its iptables, it worked also with the ipchains based SuSEFirewall script. Fritz -- Fritz "der mit dem Linux tanzt" Ganter ganter(a)ganter.at Linux Consulting & Training http://www.linuxexperts.at Graz for you - der Grazer Stadtserver http://www.grazforyou.at A-8010 Graz, Liebiggasse 19/3/14 Tel. +43 (0)699 110 21 621

1 0

Re: [suse-security] Why is this mail routed to me?
by Thorsten Marquardt 24 Jan '01

24 Jan '01

Hi, Peter wrote: > > Thorsten Marquardt: > > Hi, > > sometimes I get email which is addressed to different people. Here is > > a header of one of this mails: > > >From receipt(a)toushi-radar.co.jp Wed Jan 24 09:55:32 2001 > > Received: from www.amcc.com.cn ([202.102.193.110]) > > by www.text-team.de (8.10.2/8.10.2/SuSE Linux 8.10.0-0.3) with SMTP > > id \ f0O8sWl19488 > > for <thom(a)www.text-team.de>; Wed, 24 Jan 2001 09:54:33 +0100 > > Looks like he has you in the BCC-field. Is there a chance to block such mail? There is na need to have me on on a Bcc list. Some of those mails apear to be commercials. > > I guess your account is <thom(a)www.text-team.de>? Upps Sorry. I forgott. That correct. Sendmail is working fine so far but I don't like this noise in my mailbox. Thanks Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

1 0

Update
by Paul Carruthers 24 Jan '01

24 Jan '01

I have got a old box which was running suse 5.x and has ( last night ) been upgraded to Suse7 All went very well despite a few silly things. However something odd is now happening... if I telnet to the box it only asks for a username at logon rather than username and a password ? Any ideas ? Paul Carruthers Systems Administrator Avellino Technologies Voice +44 (0) 118 940 7600 Fax +44 (0) 118 940 7699 Http://www.avellino.com/

2 1

SuSEfirewall logging
by Michael Long 24 Jan '01

24 Jan '01

Please excuse this dumb question but how do I get the SuSEfirewall script to log to /var/log/firewall? The last entry in the file is Nov 21 2000. Thanks, Mike

3 3

lprold or lprng ??
by dproc 24 Jan '01

24 Jan '01

Which print spooling mechanism do you prefer ... lprold or lprng ?? Or something else? Is lprold's suid bit more of a hazard than the complexity of lprng? Are there other issues I should think about when choosing what tools to use to print from a workstation? I could not find any opinions in the manuals or faqs, so I would be interested in yours. dproc

2 1

block traceroutes with iphains
by vladimir m. bondarev 24 Jan '01

24 Jan '01

Hello, suse-security. can i block traceroutes TO my host with ipchains? Monday, January 22, 2001 -- vladimir m. bondarev, icq uin: 62393277 paradox team web: http://scene.org.ru

11 13

Should I deny ICMP 3 packets?
by dproc 24 Jan '01

24 Jan '01

I noticed from my logs that my output chain had DENYed a "destination unreachable" packet from my workstation to my ISP's Domain Name Server. Does it do any harm to my ISP to deny this? (I don't need to waste their resources.) Why does SuSEfirewall deny the packet? Why would my kernel want to send it in the first place? dproc

1 0

Re: [suse-security] are unix domain sockets secure?
by Thomas Reitelbach -677 23 Jan '01

23 Jan '01

But is this although true for the door from the kitchen to the living room ? what i've read is that unix domain sockets are only local. as i can trust the users of my machines it is not important what is happening on local machines, but what is happening over the net. thomas reitelbach >>> Michael Chletsos <mpchlets(a)theotherone.org> Dienstag, 23. Januar 2001 16:31:39 >>> all open ports are a possible security risk. Think about it, if you close all the doors to your hours and bolt them, no one can come in, but if you leave some doors open, especially doors you don't use, people will be able to sneak in. michael On Tue, 23 Jan 2001, Thomas Reitelbach -677 wrote: > Hello listmembers, > > is it possible for a remote cracker to misuse unix domain sockets? > i know the dangers of open tcp or udp ports, but what about these > sockets? > can anyone tell me more about this topic? > > thank you in advance, > Thomas Reitelbach > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

are unix domain sockets secure?
by Thomas Reitelbach -677 23 Jan '01

23 Jan '01

Hello listmembers, is it possible for a remote cracker to misuse unix domain sockets? i know the dangers of open tcp or udp ports, but what about these sockets? can anyone tell me more about this topic? thank you in advance, Thomas Reitelbach

4 3

ftp/firewall security
by MaD dUCK 23 Jan '01

23 Jan '01

(cc'ing this mail to a couple of LUG mailing lists...) hey all, spawned from a recent discussion on this mailing list (suse-security), i would like to ask the following question: in a NAT'd LAN, how can one enable the use of genuine ftp clients (ncftp, wsftp) as well as netscape/ie that pretend to speak ftp, without allowing all connections to ports 1024+ on the firewall/masquerading host? 99% of all ftp traffic nowadays is passive, so the data transfer happens from port 21 of the server to port x {x | x >= 1024} of the client. our firewall is implemented with ipchains (subject to change sometime), so it's stateless. blocking all ports above 1024 disables not only ftp but a lot of services such as ssh that make use of the ports 1024+ for the client connection. philip snizek suggested closing ports 5000 and up, leaving only some 4000 ports for this usage, but that solution is not what i am looking for because it still leaves 4000 ports open for an attack, and what is more important in this situation, it is very possible that some client program tries to establish a connection to a server with the backward connect (server -> client) being something like x -> 5021. in that case then, the connect will mysteriously fail (i DENY packets rather than to REJECT them). so while it is perfectly understandable to me how and why and what ports under 1024 i have to block and open to secure the machine, the ports above 1024 are a mystery. a lot of networks i have worked in/with/for had firewall policies that allowed anything above 1024, but as philip pointed out, this is asking for trojans. so i am wondering if, besides the installation of a statefull firewall, there is a way to secure the machine without affecting the liberty of the users in the LAN. and do you guys know of free, open-source statefull firewalls for linux? thanks, martin [greetings from the heart of the sun]# echo madduck@!#:1:s@\@@@.net -- echo '[dO%O+38%O+PO/d0<0]Fi22os0CC4BA64E418CE7l0xAP'|dc

10 13

Export
by Jussi Jääskeläinen 23 Jan '01

23 Jan '01

Hi! I just upgrade from Suse 6.2 --> 7.0 I have exported: /home 120.100.100.0/24 (rw,no_root_squash) and I have there directory /home/root what is root's home... when NFS-server was on 6.2 other machines on network could mount home and /root was just link to /home/root now when NFS-server is updated... Some how machines who mounts that resource are NOT handeled as ROOT-users anymore... -- Jussi Jääskeläinen Email: jussi.jaaskelainen(a)audioriders.fi Audio Riders Oy Tel: +358-9-276 6820 direct: +358-9-276 68212 Järvihaantie 4 Mobile: +358-40-554 3689 FIN-01800 KLAUKKALA Fax: +358-9-879 8045 FINLAND WWW: http://www.audioriders.fi

1 0

Is this a security or configuration problem?
by Michael Long 23 Jan '01

23 Jan '01

I am running SuSE 7.0 w/ cable modem and SuSE firewall. This evening while working on the system the mouse and keyboard quit responding and the harddrive started working very hard. Performed ctrl+alt+<backspace> to exit kde2, was successful after a minute or two. next changed from tty2 to tty1 (logged in as root) performed 'ps aux' did ctrl+page up and the terminal became filled with line pattern. Harddrive working hard during this time. Rebooted machine, did 'tail -f /var/log/messages' and got the following: Jan 21 18:52:41 zues init: Switching to runlevel: 6 Jan 21 18:52:53 zues exportfs[32752]: could not open /proc/fs/nfs/exports for locking Jan 21 18:52:57 zues exiting on signal 15 Now when I 'su' it is not logged in the file (it was before this incident). I am a newbie to linux and firewall security so any comments or hints to get the answers to the following questions will be greatly appreciated. What does this exerpt from /var/log/messages mean? Why don't I have any entries in the log when I su to another user? Shouldn't I be getting some messages that relate to the firewall? Thanks in advance, Mike

2 1

pam_ldap+openLDAP on a SuSE 6.4 machine
by Andreas Achtzehn 23 Jan '01

23 Jan '01

Hello folks! I've been trying to implement a pam user authentification on a SuSE 6.4 machine using pam_ldap. Unfortunately I wasn't very successful. This is what a typical entry in my database looks like dn: o=linux-society o: linux-society objectclass: top objectclass: organization dn: ou=editors, o=linux-society ou: editors objectclass: organizationalUnit dn: uid=achtldap, ou=editors, o=linux-society objectclass: account objectclass: person objectclass: posixAccount objectclass: shadowAccount objectclass: inetOrgPerson fullname: Andreas Achtzehn givenname: Andreas uid: achtldap userpassword: test shadowlastchange: 10650 homedirectory:/home/achtzehn loginshell: /bin/bash cn: Andreas Achtzehn sn: Achtzehn uidnumber: 500 gidnumber: 100 ou: editors I've overwritten all files in /etc/pam.d by the appropiate files in /usr/doc/packages/pam_ldap/pam.d. This is what my logfile tells me when I try to login: Jan 21 19:26:19 laptop slapd[7093]: slapd starting I add the entry above to my LDAP... Jan 21 19:27:01 laptop slapd[7093]: conn=0 fd=7 connection from localhost (127.0.0.1) accepted. Jan 21 19:27:01 laptop slapd[7096]: conn=0 op=0 BIND dn="CN=MANAGER,O=LINUX-SOCIETY" method=128 Jan 21 19:27:01 laptop slapd[7096]: conn=0 op=0 RESULT err=0 tag=97 nentries=0 Jan 21 19:27:01 laptop slapd[7097]: conn=0 op=1 ADD dn="O=LINUX-SOCIETY" Jan 21 19:27:01 laptop slapd[7097]: next_id_read: could not open "/usr/tmp/NEXTID" Jan 21 19:27:01 laptop slapd[7097]: conn=0 op=1 RESULT err=0 tag=105 nentries=0 Jan 21 19:27:01 laptop slapd[7098]: conn=0 op=2 ADD dn="OU=EDITORS,O=LINUX-SOCIETY" Jan 21 19:27:01 laptop slapd[7098]: conn=0 op=2 RESULT err=0 tag=105 nentries=0 Jan 21 19:27:01 laptop slapd[7099]: conn=0 op=3 ADD dn="UID=ACHTLDAP,OU=EDITORS,O=LINUX-SOCIETY" Jan 21 19:27:01 laptop slapd[7093]: conn=0 op=-1 fd=7 closed errno=0 Jan 21 19:27:01 laptop slapd[7100]: conn=0 op=4 UNBIND I try to login using a normal console... Jan 21 19:27:01 laptop slapd[7099]: conn=0 op=3 RESULT err=0 tag=105 nentries=0 Jan 21 19:27:28 laptop slapd[7093]: conn=1 fd=7 connection from localhost (127.0.0.1) accepted. Jan 21 19:27:28 laptop slapd[7101]: conn=1 op=0 BIND dn="" method=128 Jan 21 19:27:28 laptop slapd[7101]: conn=1 op=0 RESULT err=0 tag=97 nentries=0 Jan 21 19:27:28 laptop slapd[7102]: conn=1 op=1 SRCH base="O=LINUX-SOCIETY" scope=2 filter="(uid=ACHTLDAP)" Jan 21 19:27:28 laptop slapd[7093]: conn=2 fd=13 connection from localhost (127.0.0.1) accepted. Jan 21 19:27:28 laptop slapd[7093]: conn=1 op=-1 fd=7 closed errno=0 Jan 21 19:27:28 laptop slapd[7102]: conn=1 op=1 RESULT err=0 tag=101 nentries=1 Jan 21 19:27:28 laptop slapd[7103]: conn=1 op=2 UNBIND Jan 21 19:27:28 laptop slapd[7104]: conn=2 op=0 BIND dn="UID=ACHTLDAP,OU=EDITORS,O=LINUX-SOCIETY" method=128 as it seems this was successful... Jan 21 19:27:28 laptop PAM_unix[7063]: (login) session opened for user achtldap by LOGIN(uid=0) Jan 21 19:27:28 laptop slapd[7093]: conn=2 op=-1 fd=13 closed errno=0 Jan 21 19:27:28 laptop slapd[7104]: conn=2 op=0 RESULT err=0 tag=97 nentries=0 What happens? Nothing... After login the console closes again immediately (without showing a prompt). I'm a bit confused about the entry "LOGIN(uid=0)", I don't want the user to log in as root! Has anyone had the same problem. I tried desperately to find a man-page, howto or anything comparable, but without any luck. There a good papers out there on setting up an OpenLDAP-server, but no papers on how to use pam_ldap (even their distributors, padl, do not provide a help-page) So long, Andreas -- -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/CM/IT/P d@ s: !a C++(+) UL++++$ P++ L+++(++++)@ E---- W+++ N+ o? K? w O- M- V- PS PE- Y+ PGP++ t+ 5 X+ R* tv+ b++ DI? D-- G> e@> h!> ------END GEEK CODE BLOCK------ See http://www.ebb.org/ungeek/ on details.

2 1

SecurityPortal - Linux Gets Stateful Firewalling: Introducing Netfilter (iptables)
by Joop Boonen 23 Jan '01

23 Jan '01

http://securityportal.com/cover/coverstory20010122.html

1 0

Re: SuSEfirewall version for Linux 6.3
by webmaster 23 Jan '01

23 Jan '01

dproc, please let me know the exact url of the tarball you installed Antal

2 1

SuSE Firewall 4.2
by Richard 23 Jan '01

23 Jan '01

Dear All After much thought and hacking with a keyboard - kind of thing you'd normally associate with kernel coding - I've downloaded Marc's SuSEfirewall-4.2.tar.gz firewall and installed it into my SuSE 7.0 internet facing dialup box. Looks like this....... -------- -------- ----------- | network | --> | gateway | --> | internet | -------- --------- ----------- Marc's words make for interesting reading. I've read all the stuff that comes with it. After doing ./INSTALL from the /tmp directory I found that it installed in the way that it's supposed to. When I re-booted the machine (no real need for that) I found that the firewall started in the way that it should. However, I now find that when I connect to the net with the local ISDN system all things from my ISP are blocked. I have changed the options in /etc/rc.config.d/firewall.rc.config and tried several things. Still won't let me into the net for web pages or ftp or mail. Pinging my ISP from the gateway box just results in a frozen command line. In /var/log/messages I can see quite a few lines which say...... Packet log: input DENY ippp0 PROTO=17 194.247.47.47:53 194.247.44.222:1032 L=137 S=0x00 I=0 F=0x4000 T=62 (#100) Anyone know what to change here ? Now that I've installed firewall 4.2 I'd like to be able to use it. It would be a shame to throw it away. I need to use ftp, www, mail and ping out from the box to my ISP. Thanks -- Richard

3 2

Re: [suse-security] OpenSSH for sparc doesn't honour tcpwrappers
by Nix 22 Jan '01

22 Jan '01

At 06:32 PM 22/01/2001 +0100, you wrote: >Roman wrote: > >This is all most certainly correct. It is part of the reason why there is > >an update package > > > >ftp://ftp.suse.de/pub/sparc/update/7.0/sec1/openssh-2.3.0p1-0.sparc.rpm > >Nix wrote: > > Well, I was mistakenly using > > ftp://ftp.gwdg.de/linux/suse/sparc/update/7.0/sec1/ > > as my primary download location, as I was under the impression SuSE > preferred > > that people didn't download from their link. The website also states that > > ftp.gwdg.de is the "primary" mirror, so I expected it to be up to date.. > >Actually, it is there as well, but a little harder to find: >ftp://ftp.gwdg.de/linux/suse/ftp.suse.de/suse/sparc/update/7.0/sec1/ > >Kevin >P.S.: Eberhard, you might want to set an appropriate link like the > many others? (Well, figures those links are a neverending story) Yeah, but who is to know when to download from one location and when to get it from another? I would mirror the whole deal myself if I could figure out exactly _what_ to mirror... We need to make it easy for people to find the updates for their distro. Face it, 3/4 of the battle is getting users to actually check the ftp site for updates, once that battle has been overcome, we don't want them to end up with the wrong updates, or none at all, simply because they can't understand the convoluted structure that SuSE have spanning multiple directories AND servers.... Maybe SuSE should look at putting in something like UltraSparrow that will transparently redirect people to the correct server. ie. You keep a full file listing on one central server (outside the US) but when you actually click on a file, it transparently sends you to the geographically closest mirror of that file. (This is very similar to the proprietary system that Akami use, and they claim that they push 5% of all data on the internet) It uses some fancy BGP routing info to calculate the nearest node to you. You would simple have the crypto software as direct links on the server, but all the others balanced. That way US people would get their normal stuff from ftp.suse.com (or another mirror in the US) but their crypto stuff from ftp.suse.de all without them having to think or know about this stuff. Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

sendmail - relay
by webmaster 22 Jan '01

22 Jan '01

Hi list, I suppose the log below gives a true picture - relaying denied. Jan 22 09:42:22 mand sendmail[11439]: JAA11439: ruleset=check_rcpt, arg1=<PageTeamX(a)aol.com>, relay=1Cust99.tnt2.richmond.in.da.uu.net [63.26.248.99], reject=550 <PageTeamX(a)aol.com>... Relaying denied Jan 22 09:42:24 mand sendmail[11439]: JAA11439: ruleset=check_rcpt, arg1=<Webmaster(a)ztry.fsnet.co.uk>, relay=1Cust99.tnt2.richmond.in.da.uu.net [63.26.248.99], reject=550 <Webmaster(a)ztry.fsnet.co.uk>... Relaying denied Please, inform, how to secure and check sendmail port 25 agaist such abuses. Antal

5 4

SuSE Security FAQ Version 0.4
by Nix 22 Jan '01

22 Jan '01

Just a quick note to: a) Announce a new version of the list FAQ (Version 0.4) b) Let Newbies to the list know that we have an FAQ I have just updated it, as off about 10min ago, but the date on the server appears to be wrong, so Ignore the date stamp at the top. I have been fooling about with web redirects and the faq should be at http://www.susesecurity.com/faq/ if this does not work for you, the FAQ is still at it's original path of http://www.cotse.com/nix/suse-security-faq/ The FAQ is still a little inconsistent in places, and it needs an index among other things, but I have been pretty busy. It does have some more content however, and the existing content has been tidied a little.. Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

re sendmail -relay
by webmaster 22 Jan '01

22 Jan '01

Hi list, thanks for the ideas. Issue being fwded to the isp provider. Antal

1 0

AW: [suse-security] sendmail - relay
by Stiefenhofer, Marek ECOFIS 22 Jan '01

22 Jan '01

What about a funny banner for all uunet mailers (maybe frees some cpu too): /etc/hosts.deny: sendmail : .uu.net : twist /bin/cat /etc/spamnotwelcome /etc/spamnotwelcome: --- start --- .adAMMMb. .dAMMMAbn. .adAWWWWWWWWWAuAWWWWWWWWWWAbn. .adWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWbn. ..adMMMMMP^~".--"~^YWWWWWWWWWWHHMMMMMMMMbn.. "~^Y" / ..dMWMP".ammmmdMMMUP^~" | Y dMAbammdAMMMMMMP^~" | | MMMMMMMMMMMMU^" l : Y^YUWWWWUP^" \ j "-..,.^ Dear postmaster, due to heavy spamming we've decided to temporarily deny SMTP connections from uunet domains. SORRY --- end ---

1 0

SuSEfirewall 4.2 - FW_FORWARD_MASQ_TCP
by Wolfram Schlich 22 Jan '01

22 Jan '01

Hello! I don't understand the following: --snip-- # Hint: if FW_DEV_MASQ is set to the external \ interface you have to set # FW_FORWARD_* from internal to DMZ for the \ service as well! --snip-- (It _is_ the ext. i.f. ...) I want to use --snip-- FW_FORWARD_MASQ_TCP="0.0.0.0/0,192.168.0.20,80" --snip-- , but it doesn't work :( Can someone please reveal the secret of Marc's sentence? ;) Thanks in advance. Regards, Mit freundlichen Grüssen Wolfram Schlich * X-Media Consulting / Itabonn Adenauerallee 113 **** 53113 Bonn **** Germany Phone: +49.228.5388075 ** Fax: +49.228.5388031

3 2

Re: [suse-security] Incoming SMTP port filtering options with IPCHAINS
by Nix 21 Jan '01

21 Jan '01

At 01:49 PM 19/01/2001 +0200, you wrote: >Hi All > >What are the best options for filtering incoming Packets on the SMTP port >with IPCHAINS (I know they are limited) , but still allowing the service to >receive mail. Postfix is my MTA. IPCHAINS is NOT an application level firewall, and as such does not understand the SMTP protocol. You either allow port 25 or you don't, you can enable/disable certain commands like Gauntlet Firewall can for instance. I was talking to Rusty (the Ipchains/netfilter programer) about this yesterday, and he is thinking of writing for application level stuff for netfilter, but it has not been done yet... Hope that Helps --- Nix - nix(a)susesecurity.com SuSE-Security FAQ Maintainer http://www.susesecurity.com

1 1

SuSEfirewall version for Linux 6.3
by dproc 21 Jan '01

21 Jan '01

Which is the latest stable (non-beta) version of Marc's script that is compatible with SuSE 6.3 ? I ask because the latest in the updates directory for 6.3 is version 2.1. The 7.0 distro has version 2.6 and Volker K. has packaged version 3.2 for the contribs directory. So I am confused. dproc

1 1

re proc info
by webmaster 21 Jan '01

21 Jan '01

Ralf, try http://www.bb-zone.com/Proc/index.html Antal

1 0

Re: [SLE] Re: AW: [suse-security] Why does sendmail deny relaying?
by Garry Smith 21 Jan '01

21 Jan '01

Hi John, I tried the dot notation you mentioned. That's fixed it. Thanks very much. As for Postfix, I think you might be right :-) regards Garry john wrote: > > I've just had the same problem as you. Upgraded from 6.3 to 7.0 and mail > relaying broke, despite having an unchanged relay-domains. Having battled > with this for hours and out of a willingness to try ANYTHING I added my > internal domain to relay-domains in dot notation -- hey presto it worked. > > Oh, I also commented out the Privacy line you mentioned to get rid of those > messages too ... why is the default behaviour of sendmail now to DNS lookup > every bloody system that mail comes in on? > > This is the last straw .. I have disliked sendmail for some time now because > you have you reach sendmail-guru status before you can even start to fiddle > with anything that lives outside of rc.config ... time do dump [that] > garbage into the bit bucket and learn me some Postfix. > > John > > -----Original Message----- > From: garry(a)suse.com [mailto:garry@suse.com]On Behalf Of Garry Smith > Sent: 17 January 2001 14:19 > To: suse-linux-e(a)suse.com > Cc: suse-linux-security(a)suse.com; garry.smith(a)computer.org > Subject: [SLE] Re: AW: [suse-security] Why does sendmail deny relaying? > > Hi, > > uname -a : Linux homer 2.2.16-SMP #1 SMP Wed Aug 2 20:01:21 GMT 2000 > i686 unknown > sendmail version: starting daemon (8.10.2): SMTP+queueing@00:30:00 > (from mail log) > > I also have a problem with relaying in sendmail. > I would like machines from domain a, b and c to be able to use my mail > server (SuSE Linux 7.0 Pro) to send mails to any other domain. > > Initially I inserted domains a, b,and c into /etc/mail/relay-domains. > This allowed me to pass on mails from remote clients to one of the > listed domains. > > Sending a mail to a domain not listed causes the following error to > appear in the sender's mail client: > > An error occurred while sending mail > The mail server responded: > 5.7.1 <Garry.Smith(a)computer.org>... Relaying denied. IP name lookup > failed [x.x.x.x] Please check the message recipients and try again. > > My log mail log file shows: > Jan 17 12:40:08 homer sendmail[18328]: starting daemon (8.10.2): > SMTP+queueing@0 > 0:30:00 > Jan 17 12:40:08 homer sendmail[18328]: daemon could not open control > socket /var > /run/sendmail.control: Group writable directory > Jan 17 12:41:23 homer sendmail[18347]: f0HCfML18347: ruleset=check_rcpt, > arg1=<G > arry.Smith(a)computer.org>, relay=[x.x.x.x], reject=550 5.7.1 > <Garry.Smith@ > computer.org>... Relaying denied. IP name lookup failed [x.x.x.x] > Jan 17 12:41:23 homer sendmail[18347]: f0HCfML18347: > from=<Garry.Smith@computer. > org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, > relay=[x.x.x.x] > > I have since removed the entries for /etc/mail/relay-domains. > I have also commented out the sendmail.cf authentification warning entry > as described in one on the recent related mails on this. > # privacy flags > > > O PrivacyOptions=needmailhelo,novrfy,noexpn,noetrn,noverb > > > > and restarted sendmail > > I followed the instructions below and added domains A,B and C to > access.db ie: > a-sub-domain.a-domain ACCEPT > > I then ran the Makefile and restarted sendmail. > I still get the relay error listed above. The only way I can seem to > get round this is if I add domains A,B and C back into > /etc/mail/relay-domains file. > > However, while I can then use my mail server to relay mail to those > domains, I cannot relay to other un-listed domains. > > How can I specify that domains A,B and C are allowed to use my mail > server to relay messages to any other domain on the Internet? > I must be missing something fundamental here, but can't think what? > > Many thanks in advance > regards > > Garry > > Roman Drahtmueller wrote: > > > > > > > > If you put in access.db > > > 212.121.144.197 ACCEPT > > > > > > it will work. > > > > Yes, and don't forget to hash the plaintextfile. Use the Makefile that > > I've put in the attachment. Place it in /etc/mail, go there and type make. > > Little gift from the 7.1 sendmail package... > > > > > > > > Philipp > > > > Thanks, > > Roman. > > -- > > - - > > | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | > > SuSE GmbH - Security Phone: // not enable user to fly." > > | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | > > - - > > > > ------------------------------------------------------------------------ > > Name: Makefile > > Makefile Type: Plain Text (TEXT/PLAIN) > > Encoding: BASE64 > > Description: Makefile for /etc/mail > > > > ------------------------------------------------------------------------ > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > -- > To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com > For additional commands send e-mail to suse-linux-e-help(a)suse.com > Also check the FAQ at http://www.suse.com/support/faq

1 0

ICMP with Source Address 192.168.100.83 !
by uwe_kersten＠t-online.de 21 Jan '01

21 Jan '01

Hi all! My Snort tells me this evening about several ICMP packets with source address 192.168.100.83 (my net is 192.168.0.x and 192.168.1.x). They had the signature ICMP TTL Exceeded in Transit. Destination was the IP of my ippp0. This is a dynamic one, but these packets got to different IP numbers on my SuSE 7 Box. So what, I am quiet new in this business, do I have to worry, what is this all about? Any idea? Regards Uwe

2 1

Apache Log - rusftpsearch is back
by Ulrich Klenk 20 Jan '01

20 Jan '01

Hello all, found this one in an Apache access-log-file: "GET http://www.rusftpsearch.net/cgi-bin/pst.pl?pstmode=writeip&psthost=195.37.62 .127&pstport=80". Can someone please point me to some information for that probe? What were they doing? I found something about this in the list for December 1999, but there are only discussions about rusftpsearch.net.. Greetings, Uli

2 1

re spam relay? Thanks for all!
by webmaster 19 Jan '01

19 Jan '01

Thnaks Antal

1 0

Unauthorized entry?
by Luis José Fabbiani B. (SOPORTE) 19 Jan '01

19 Jan '01

Hi, my server had registry de following entry: Jan 11 06:02:36 cumana in.ftpd[23016]: connect from pedro(a)150.185.69.34 Jan 11 06:02:36 cumana ftpd[23016]: connection from complex.ciens.ucv.ve Jan 11 06:02:37 cumana ftpd[23016]: ANONYMOUS FTP LOGIN FROM complex.ciens.ucv.ve ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P1À1Û1É°FÍ~@1À1ÛC~IÙA°?Í~@ëk^1À1É~M^^A~HF^Df¹ÿ^A°'Í~@1À~M^^ A°=Í~@1À1Û~M^^H~IC^B1ÉþÉ1À~M^^H°^LÍ~@þÉuó1À~HF^I~M^^H°=Í~@þ^N°0þÈ~HF^D1À~HF^ G~Iv^H~IF^L~Ió~MN^H~MV^L°^KÍ~@1À1Û°^AÍ~@è~Pÿÿÿ0bin0sh1..11 Is this message a possible attack? Thanks. Luis.

3 4

AW: [suse-security] passwd
by Stiefenhofer, Marek ECOFIS 19 Jan '01

19 Jan '01

> I don't see any kind of passwd database on SuSE 6.4. /etc/passwd /etc/shadow

11 24

passwd
by Egan 19 Jan '01

19 Jan '01

I don't see any kind of passwd database on SuSE 6.4. How many users can I get in the passwd file before things slow down?

2 1

syslog.conf question
by vladimir m. bondarev 19 Jan '01

19 Jan '01

Hello, suse-security. i have a 3com dialup pool in my network called "ras1500". it logs everything to linux server. all messages by default come to /var/log/messages. how can i make them to log into /var/log/ras. i've tryed to add: ras1500 -/var/log/ras, but received nothing. all messages still log to /var/log/messages another question: how can i log all services (like pop3 and others, except sendmail (it logs to /var/log/mail) to /var/log/services? and the last one: how can i make the logs unable to be edited? i've tryed chattr +a, but then logrotate can't delete old files. Friday, January 19, 2001 -- vladimir m. bondarev, icq uin: 62393277 paradox team web: http://scene.org.ru

1 0

is it a spam relay?
by webmaster 19 Jan '01

19 Jan '01

Please, help me understand this log: Jan 19 06:51:06 mand sendmail[2353]: GAA02353: ruleset=check_mail, arg1=<nobody(a)server1.ssdcn.net>, relay=[12.110.33.133], reject=501 <nobody(a)server1.ssdcn.net>... Sender domain must exist Jan 19 06:53:36 mand sendmail[2355]: GAA02355: ruleset=check_mail, arg1=<nobody(a)server1.ssdcn.net>, relay=[12.110.33.133], reject=501 <nobody(a)server1.ssdcn.net>... Sender domain must exist Antal webmaster(a)kreorg.hu

2 1

Re: [suse-security] kdm - shows all user on login screen
by andreas.baetz＠herma.de 19 Jan '01

19 Jan '01

Andreas Tirok wrote > > The initial idea was to hide the other users > to any non authorized person, which has no > account. (...) They may notice the accounts > and try to break in from home or somewhere > else. In fact there is a firewall, but > I want to prevent this scenario. Try setting UserView=false in kdmrc Andreas Baetz ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

1 0

Incoming SMTP port filtering options with IPCHAINS
by Steven Thompson 19 Jan '01

19 Jan '01

Hi All What are the best options for filtering incoming Packets on the SMTP port with IPCHAINS (I know they are limited) , but still allowing the service to receive mail. Postfix is my MTA. Thanks in advance Steven

1 0

kdm - shows all user on login screen
by Andreas Tirok 19 Jan '01

19 Jan '01

Hi List, is there any thing I can do to suppress the listing of all system known users on the logon screen of kdm. I think it is not a good idea to give the people a clue as wich users they might login. thx andy -- ------------------------------- mailto:Andreas.Tirok@beusen.de fon: +49 30 549932-37 fax: +49 30 549932-21

6 5

Re: [suse-security] IANA address space updates
by Boris Lorenz 19 Jan '01

19 Jan '01

Hi, On 19-Jan-01 Richard wrote: > Boris > > On Friday 19 January 2001 10:57, you wrote: > rvers... >> >> You will find the revised list on >> www.isi.edu/iana/assignments/ipv4-address-space, or here: >> >> INTERNET PROTOCOL ADDRESS SPACE >> >> The allocation of Internet Protocol version 4 (IPv4) address space >> to various registries is listed here. Originally, all the IPv4 >> address spaces was managed directly by the IANA. Later parts of >> the address space were allocated to various other registries to >> manage for particular purposes or regional areas of the world. RFC >> 1466 documents most of these allocations. > > > Now all I have to do is try to understand what to do with it :)) IANA used to assign any netblock on the internet, from 000/8 to 255/8. After a while they decided to transfer the authority for certain address space ranges to other registrars like RIPE, APNIC, DENIC, ARIN and so forth. There are still a number of netblocks assigned to IANA, so if you build firewalls you may want to exclude these from normal traffic because there are no users or hosts in these reserved ranges who may contact you. Connection attempts from these address ranges are most certainly spoofed and should be treated seriously. If you use ipchains, all you have to do is to block these ranges. Like this: ipchains -A input -i eth0 -s 1.0.0.0/8 -j DENY -l This command line denies access for any host in the range 1.0.0.0/8 and logs connection attempts to your syslog. 1.0.0.0/8 (as you can see from my list posted earlier) still is reserved by IANA and should be blocked. Dito with other ranges which are marked "IANA - Reserved". You should check back to IANAs website from time to time for updates. Just don't block any ranges currently managed by other registrars than IANA because some of these netblocks may have been given to ISPs. If you block them, some users of these ISPs would not be able to contact you anymore. Hope this helps. Boris > Thanks > > -- > Richard --- Boris Lorenz <bolo(a)lupa.de> System Security Admin *nix - *nux ---

1 0

IANA address space updates
by Boris Lorenz 19 Jan '01

19 Jan '01

Hi, if you have excluded several address ranges reserved by IANA in your firewall scripts (particularly if you got it from Robert L. Ziegler's www.linux-firewall-tools.com) you should note that some ranges have been left over to other registrars. For instance, netblock 217/8 has been given to RIPE and they gave it to T-Online, that's why I got some "strange" log entries from people with their T-Online accounts desperately trying to fetch mail or use our web servers... You will find the revised list on www.isi.edu/iana/assignments/ipv4-address-space, or here: INTERNET PROTOCOL ADDRESS SPACE The allocation of Internet Protocol version 4 (IPv4) address space to various registries is listed here. Originally, all the IPv4 address spaces was managed directly by the IANA. Later parts of the address space were allocated to various other registries to manage for particular purposes or regional areas of the world. RFC 1466 documents most of these allocations. Address Block Registry - Purpose Date --------------- --------------------------------------- ------ 000/8 IANA - Reserved Sep 81 001/8 IANA - Reserved Sep 81 002/8 IANA - Reserved Sep 81 003/8 General Electric Company May 94 004/8 Bolt Beranek and Newman Inc. Dec 92 005/8 IANA - Reserved Jul 95 006/8 Army Information Systems Center Feb 94 007/8 IANA - Reserved Apr 95 008/8 Bolt Beranek and Newman Inc. Dec 92 009/8 IBM Aug 92 010/8 IANA - Private Use Jun 95 011/8 DoD Intel Information Systems May 93 012/8 AT&T Bell Laboratories Jun 95 013/8 Xerox Corporation Sep 91 014/8 IANA - Public Data Network Jun 91 015/8 Hewlett-Packard Company Jul 94 016/8 Digital Equipment Corporation Nov 94 017/8 Apple Computer Inc. Jul 92 018/8 MIT Jan 94 019/8 Ford Motor Company May 95 020/8 Computer Sciences Corporation Oct 94 021/8 DDN-RVN Jul 91 022/8 Defense Information Systems Agency May 93 023/8 IANA - Reserved Jul 95 024/8 IANA - Cable Block Jul 95 025/8 Royal Signals and Radar Establishment Jan 95 026/8 Defense Information Systems Agency May 95 027/8 IANA - Reserved Apr 95 028/8 DSI-North Jul 92 029/8 Defense Information Systems Agency Jul 91 030/8 Defense Information Systems Agency Jul 91 031/8 IANA - Reserved Apr 99 032/8 Norsk Informasjonsteknologi Jun 94 033/8 DLA Systems Automation Center Jan 91 034/8 Halliburton Company Mar 93 035/8 MERIT Computer Network Apr 94 036/8 IANA - Reserved Jul 00 (Formerly Stanford University) Apr 93 037/8 IANA - Reserved Apr 95 038/8 Performance Systems International Sep 94 039/8 IANA - Reserved Apr 95 040/8 Eli Lily and Company Jun 94 041/8 IANA - Reserved May 95 042/8 IANA - Reserved Jul 95 043/8 Japan Inet Jan 91 044/8 Amateur Radio Digital Communications Jul 92 045/8 Interop Show Network Jan 95 046/8 Bolt Beranek and Newman Inc. Dec 92 047/8 Bell-Northern Research Jan 91 048/8 Prudential Securities Inc. May 95 049/8 Joint Technical Command May 94 Returned to IANA Mar 98 050/8 Joint Technical Command May 94 Returned to IANA Mar 98 051/8 Deparment of Social Security of UK Aug 94 052/8 E.I. duPont de Nemours and Co., Inc. Dec 91 053/8 Cap Debis CCS Oct 93 054/8 Merck and Co., Inc. Mar 92 055/8 Boeing Computer Services Apr 95 056/8 U.S. Postal Service Jun 94 057/8 SITA May 95 058/8 IANA - Reserved Sep 81 059/8 IANA - Reserved Sep 81 060/8 IANA - Reserved Sep 81 061/8 APNIC - Pacific Rim Apr 97 062/8 RIPE NCC - Europe Apr 97 063/8 ARIN Apr 97 064/8 ARIN Jul 99 065/8 ARIN Jul 00 066/8 ARIN Jul 00 067-095/8 IANA - Reserved Sep 81 096-126/8 IANA - Reserved Sep 81 127/8 IANA - Reserved Sep 81 128-191/8 Various Registries May 93 192/8 Various Registries - MultiRegional May 93 193/8 RIPE NCC - Europe May 93 194/8 RIPE NCC - Europe May 93 195/8 RIPE NCC - Europe May 93 196/8 Various Registries May 93 197/8 IANA - Reserved May 93 198/8 Various Registries May 93 199/8 ARIN - North America May 93 200/8 ARIN - Central and South America May 93 201/8 Reserved - Central and South America May 93 202/8 APNIC - Pacific Rim May 93 203/8 APNIC - Pacific Rim May 93 204/8 ARIN - North America Mar 94 205/8 ARIN - North America Mar 94 206/8 ARIN - North America Apr 95 207/8 ARIN - North America Nov 95 208/8 ARIN - North America Apr 96 209/8 ARIN - North America Jun 96 210/8 APNIC - Pacific Rim Jun 96 211/8 APNIC - Pacific Rim Jun 96 212/8 RIPE NCC - Europe Oct 97 213/8 RIPE NCC - Europe Mar 99 214/8 US-DOD Mar 98 215/8 US-DOD Mar 98 216/8 ARIN - North America Apr 98 217/8 RIPE NCC - Europe Jun 00 218/8 APNIC - Pacific Rim Dec 00 219-223/8 IANA - Reserved Sep 81 224-239/8 IANA - Multicast Sep 81 240-255/8 IANA - Reserved Sep 81 --- Boris Lorenz <bolo(a)lupa.de> System Security Admin *nix - *nux ---

2 1

Configuration Problem
by Richard 19 Jan '01

19 Jan '01

Dear All I'm having some problems with my SuSE 7.0 gateway box which I use with my own small domestic LAN. I've written a short firewall script which works fine with Debian and Red Hat systems. For some reason it won't work with SuSE 7.0. After much investigation I find that it's something to do with the firewals.rpm. There would seem to be some part of the configuration of the firewals script that stops my own firewall from working. If I remove the firewals.rpm then I can't get the SuSE 7.0 box to allow me to send or receive any data to or from the net. So, it's not a good idea to remove it. To begin with I can see a message to root in my mailbox which explains that I must edit /etc/rc.config.d/firewall.rc.config before doing anything. Looked into this and I can't find any explanation of what to change there. My main problem is that at the top of my firewall script there are the words DENY, DENY and DENY. Because I can't find any way to get this part of the script to allow me to send or receive mail or download web pages I have to use ACCEPT instead. Does anyone know enough about configuration of firewals.rpm to explain to me how to get my own firewall script to work in the way that I want it to work ? I did ask Thomas Beige earlier this week but it looks as though he's busy just now :) Thank you -- Richard

1 0

Is NTP secure?
by Christian Schweingruber 19 Jan '01

19 Jan '01

hi is there a risk to open the firewall to the internet for port 123 (TCP and UDP) for synchronisation (NetworkTimeProtokol)? Greetings Chrigu Schweingruber -- Homepage: http://www.kolk.ch/chrigu http://www.catatec.ch PGP key: http://www.kolk.ch/chrigu/Pgp.txt phone: +41 31 330 26 33 priv. +41 31 330 26 30 büro +41 31 330 26 32 FAX icq#: 27628141

2 1

RE: [suse-security] kdm - shows all user on login screen
by Raffy 19 Jan '01

19 Jan '01

> > Use kdmconfig > > > On 18-Jan-01 Andreas Tirok wrote: > > > > I think it is not a good > > > idea to give the people > > > a clue as wich users they > > > might login. > > In general, this is not a secret. "cat /etc/passwd" or "ls /home" show > this information too. No, you are not right. I mean users which are logged in may do this, but not those which are about to log on. Those should not have a clue about the users which exist on a system. Or do I miss something here? Thanks Raffy

4 3

extended attributes in reiserfs
by Martin Schipany 18 Jan '01

18 Jan '01

Hello! Are there extended file attributes in reiserfs like there are in ext2 for giving additional security to the files/system? (like append only etc) kind regards M. ********************************************************************* * * * Martin Schipany email: elcondor(a)warum.net * * phone & fax: (+43) 1 - 810 27 67 * * mobil: (+43) 676 - 304 88 34 * * IRC : ElCondor on channel #diddl * * * *******************************************************************' Schopenhauer: "Das niedrig gewachsene, schmalschultrige, breithüftige und kurzbeinige Geschlecht das Schöne zu nennen - dies konnte nur der vom Geschlechtstrieb umnebelte männliche Intellekt fertigbringen.

1 0