January 2001 - openSUSE Security - openSUSE Mailing Lists

is it a spam relay?
by webmaster 19 Jan '01

19 Jan '01

Please, help me understand this log: Jan 19 06:51:06 mand sendmail[2353]: GAA02353: ruleset=check_mail, arg1=<nobody(a)server1.ssdcn.net>, relay=[12.110.33.133], reject=501 <nobody(a)server1.ssdcn.net>... Sender domain must exist Jan 19 06:53:36 mand sendmail[2355]: GAA02355: ruleset=check_mail, arg1=<nobody(a)server1.ssdcn.net>, relay=[12.110.33.133], reject=501 <nobody(a)server1.ssdcn.net>... Sender domain must exist Antal webmaster(a)kreorg.hu

2 1

Re: [suse-security] kdm - shows all user on login screen
by andreas.baetz＠herma.de 19 Jan '01

19 Jan '01

Andreas Tirok wrote > > The initial idea was to hide the other users > to any non authorized person, which has no > account. (...) They may notice the accounts > and try to break in from home or somewhere > else. In fact there is a firewall, but > I want to prevent this scenario. Try setting UserView=false in kdmrc Andreas Baetz ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

1 0

Incoming SMTP port filtering options with IPCHAINS
by Steven Thompson 19 Jan '01

19 Jan '01

Hi All What are the best options for filtering incoming Packets on the SMTP port with IPCHAINS (I know they are limited) , but still allowing the service to receive mail. Postfix is my MTA. Thanks in advance Steven

1 0

kdm - shows all user on login screen
by Andreas Tirok 19 Jan '01

19 Jan '01

Hi List, is there any thing I can do to suppress the listing of all system known users on the logon screen of kdm. I think it is not a good idea to give the people a clue as wich users they might login. thx andy -- ------------------------------- mailto:Andreas.Tirok@beusen.de fon: +49 30 549932-37 fax: +49 30 549932-21

6 5

Re: [suse-security] IANA address space updates
by Boris Lorenz 19 Jan '01

19 Jan '01

Hi, On 19-Jan-01 Richard wrote: > Boris > > On Friday 19 January 2001 10:57, you wrote: > rvers... >> >> You will find the revised list on >> www.isi.edu/iana/assignments/ipv4-address-space, or here: >> >> INTERNET PROTOCOL ADDRESS SPACE >> >> The allocation of Internet Protocol version 4 (IPv4) address space >> to various registries is listed here. Originally, all the IPv4 >> address spaces was managed directly by the IANA. Later parts of >> the address space were allocated to various other registries to >> manage for particular purposes or regional areas of the world. RFC >> 1466 documents most of these allocations. > > > Now all I have to do is try to understand what to do with it :)) IANA used to assign any netblock on the internet, from 000/8 to 255/8. After a while they decided to transfer the authority for certain address space ranges to other registrars like RIPE, APNIC, DENIC, ARIN and so forth. There are still a number of netblocks assigned to IANA, so if you build firewalls you may want to exclude these from normal traffic because there are no users or hosts in these reserved ranges who may contact you. Connection attempts from these address ranges are most certainly spoofed and should be treated seriously. If you use ipchains, all you have to do is to block these ranges. Like this: ipchains -A input -i eth0 -s 1.0.0.0/8 -j DENY -l This command line denies access for any host in the range 1.0.0.0/8 and logs connection attempts to your syslog. 1.0.0.0/8 (as you can see from my list posted earlier) still is reserved by IANA and should be blocked. Dito with other ranges which are marked "IANA - Reserved". You should check back to IANAs website from time to time for updates. Just don't block any ranges currently managed by other registrars than IANA because some of these netblocks may have been given to ISPs. If you block them, some users of these ISPs would not be able to contact you anymore. Hope this helps. Boris > Thanks > > -- > Richard --- Boris Lorenz <bolo(a)lupa.de> System Security Admin *nix - *nux ---

1 0

IANA address space updates
by Boris Lorenz 19 Jan '01

19 Jan '01

Hi, if you have excluded several address ranges reserved by IANA in your firewall scripts (particularly if you got it from Robert L. Ziegler's www.linux-firewall-tools.com) you should note that some ranges have been left over to other registrars. For instance, netblock 217/8 has been given to RIPE and they gave it to T-Online, that's why I got some "strange" log entries from people with their T-Online accounts desperately trying to fetch mail or use our web servers... You will find the revised list on www.isi.edu/iana/assignments/ipv4-address-space, or here: INTERNET PROTOCOL ADDRESS SPACE The allocation of Internet Protocol version 4 (IPv4) address space to various registries is listed here. Originally, all the IPv4 address spaces was managed directly by the IANA. Later parts of the address space were allocated to various other registries to manage for particular purposes or regional areas of the world. RFC 1466 documents most of these allocations. Address Block Registry - Purpose Date --------------- --------------------------------------- ------ 000/8 IANA - Reserved Sep 81 001/8 IANA - Reserved Sep 81 002/8 IANA - Reserved Sep 81 003/8 General Electric Company May 94 004/8 Bolt Beranek and Newman Inc. Dec 92 005/8 IANA - Reserved Jul 95 006/8 Army Information Systems Center Feb 94 007/8 IANA - Reserved Apr 95 008/8 Bolt Beranek and Newman Inc. Dec 92 009/8 IBM Aug 92 010/8 IANA - Private Use Jun 95 011/8 DoD Intel Information Systems May 93 012/8 AT&T Bell Laboratories Jun 95 013/8 Xerox Corporation Sep 91 014/8 IANA - Public Data Network Jun 91 015/8 Hewlett-Packard Company Jul 94 016/8 Digital Equipment Corporation Nov 94 017/8 Apple Computer Inc. Jul 92 018/8 MIT Jan 94 019/8 Ford Motor Company May 95 020/8 Computer Sciences Corporation Oct 94 021/8 DDN-RVN Jul 91 022/8 Defense Information Systems Agency May 93 023/8 IANA - Reserved Jul 95 024/8 IANA - Cable Block Jul 95 025/8 Royal Signals and Radar Establishment Jan 95 026/8 Defense Information Systems Agency May 95 027/8 IANA - Reserved Apr 95 028/8 DSI-North Jul 92 029/8 Defense Information Systems Agency Jul 91 030/8 Defense Information Systems Agency Jul 91 031/8 IANA - Reserved Apr 99 032/8 Norsk Informasjonsteknologi Jun 94 033/8 DLA Systems Automation Center Jan 91 034/8 Halliburton Company Mar 93 035/8 MERIT Computer Network Apr 94 036/8 IANA - Reserved Jul 00 (Formerly Stanford University) Apr 93 037/8 IANA - Reserved Apr 95 038/8 Performance Systems International Sep 94 039/8 IANA - Reserved Apr 95 040/8 Eli Lily and Company Jun 94 041/8 IANA - Reserved May 95 042/8 IANA - Reserved Jul 95 043/8 Japan Inet Jan 91 044/8 Amateur Radio Digital Communications Jul 92 045/8 Interop Show Network Jan 95 046/8 Bolt Beranek and Newman Inc. Dec 92 047/8 Bell-Northern Research Jan 91 048/8 Prudential Securities Inc. May 95 049/8 Joint Technical Command May 94 Returned to IANA Mar 98 050/8 Joint Technical Command May 94 Returned to IANA Mar 98 051/8 Deparment of Social Security of UK Aug 94 052/8 E.I. duPont de Nemours and Co., Inc. Dec 91 053/8 Cap Debis CCS Oct 93 054/8 Merck and Co., Inc. Mar 92 055/8 Boeing Computer Services Apr 95 056/8 U.S. Postal Service Jun 94 057/8 SITA May 95 058/8 IANA - Reserved Sep 81 059/8 IANA - Reserved Sep 81 060/8 IANA - Reserved Sep 81 061/8 APNIC - Pacific Rim Apr 97 062/8 RIPE NCC - Europe Apr 97 063/8 ARIN Apr 97 064/8 ARIN Jul 99 065/8 ARIN Jul 00 066/8 ARIN Jul 00 067-095/8 IANA - Reserved Sep 81 096-126/8 IANA - Reserved Sep 81 127/8 IANA - Reserved Sep 81 128-191/8 Various Registries May 93 192/8 Various Registries - MultiRegional May 93 193/8 RIPE NCC - Europe May 93 194/8 RIPE NCC - Europe May 93 195/8 RIPE NCC - Europe May 93 196/8 Various Registries May 93 197/8 IANA - Reserved May 93 198/8 Various Registries May 93 199/8 ARIN - North America May 93 200/8 ARIN - Central and South America May 93 201/8 Reserved - Central and South America May 93 202/8 APNIC - Pacific Rim May 93 203/8 APNIC - Pacific Rim May 93 204/8 ARIN - North America Mar 94 205/8 ARIN - North America Mar 94 206/8 ARIN - North America Apr 95 207/8 ARIN - North America Nov 95 208/8 ARIN - North America Apr 96 209/8 ARIN - North America Jun 96 210/8 APNIC - Pacific Rim Jun 96 211/8 APNIC - Pacific Rim Jun 96 212/8 RIPE NCC - Europe Oct 97 213/8 RIPE NCC - Europe Mar 99 214/8 US-DOD Mar 98 215/8 US-DOD Mar 98 216/8 ARIN - North America Apr 98 217/8 RIPE NCC - Europe Jun 00 218/8 APNIC - Pacific Rim Dec 00 219-223/8 IANA - Reserved Sep 81 224-239/8 IANA - Multicast Sep 81 240-255/8 IANA - Reserved Sep 81 --- Boris Lorenz <bolo(a)lupa.de> System Security Admin *nix - *nux ---

2 1

Configuration Problem
by Richard 19 Jan '01

19 Jan '01

Dear All I'm having some problems with my SuSE 7.0 gateway box which I use with my own small domestic LAN. I've written a short firewall script which works fine with Debian and Red Hat systems. For some reason it won't work with SuSE 7.0. After much investigation I find that it's something to do with the firewals.rpm. There would seem to be some part of the configuration of the firewals script that stops my own firewall from working. If I remove the firewals.rpm then I can't get the SuSE 7.0 box to allow me to send or receive any data to or from the net. So, it's not a good idea to remove it. To begin with I can see a message to root in my mailbox which explains that I must edit /etc/rc.config.d/firewall.rc.config before doing anything. Looked into this and I can't find any explanation of what to change there. My main problem is that at the top of my firewall script there are the words DENY, DENY and DENY. Because I can't find any way to get this part of the script to allow me to send or receive mail or download web pages I have to use ACCEPT instead. Does anyone know enough about configuration of firewals.rpm to explain to me how to get my own firewall script to work in the way that I want it to work ? I did ask Thomas Beige earlier this week but it looks as though he's busy just now :) Thank you -- Richard

1 0

Is NTP secure?
by Christian Schweingruber 19 Jan '01

19 Jan '01

hi is there a risk to open the firewall to the internet for port 123 (TCP and UDP) for synchronisation (NetworkTimeProtokol)? Greetings Chrigu Schweingruber -- Homepage: http://www.kolk.ch/chrigu http://www.catatec.ch PGP key: http://www.kolk.ch/chrigu/Pgp.txt phone: +41 31 330 26 33 priv. +41 31 330 26 30 büro +41 31 330 26 32 FAX icq#: 27628141

2 1

RE: [suse-security] kdm - shows all user on login screen
by Raffy 19 Jan '01

19 Jan '01

> > Use kdmconfig > > > On 18-Jan-01 Andreas Tirok wrote: > > > > I think it is not a good > > > idea to give the people > > > a clue as wich users they > > > might login. > > In general, this is not a secret. "cat /etc/passwd" or "ls /home" show > this information too. No, you are not right. I mean users which are logged in may do this, but not those which are about to log on. Those should not have a clue about the users which exist on a system. Or do I miss something here? Thanks Raffy

4 3

extended attributes in reiserfs
by Martin Schipany 18 Jan '01

18 Jan '01

Hello! Are there extended file attributes in reiserfs like there are in ext2 for giving additional security to the files/system? (like append only etc) kind regards M. ********************************************************************* * * * Martin Schipany email: elcondor(a)warum.net * * phone & fax: (+43) 1 - 810 27 67 * * mobil: (+43) 676 - 304 88 34 * * IRC : ElCondor on channel #diddl * * * *******************************************************************' Schopenhauer: "Das niedrig gewachsene, schmalschultrige, breithüftige und kurzbeinige Geschlecht das Schöne zu nennen - dies konnte nur der vom Geschlechtstrieb umnebelte männliche Intellekt fertigbringen.

1 0