October 2001 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] is it OK to disable newgrp
by Bitzer,Gerd 22 Oct '01

22 Oct '01

Hello Bob, removing the suid from newgrp was the first thing I did after reading about this weakness. I have not noticed anything negative since doing this (but I have also not generated new groups meanwhile ;-). Hello, I was wondering: while SuSE are working on the fixes to these latest kernel problems is it sensible to remove suid privilege from newgrp? What functionality would be lost? I realise that newgrp is not the culprit and that disabling it would not properly fix the problem, but it should be a useful protection against script kiddies. Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691 -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

My SuSE-Email-Server-II works as an open relay server
by Klaus Mahling 22 Oct '01

22 Oct '01

Hello all, my SuSE-Email-Server-II works as an open relay server and i'm not able to solve the problem. Here is the output from postconf -n : ____________________ gw0324:~ # postconf -n alias_database = hash:/etc/aliases, hash:/home/mailman/bin/aliases alias_maps = hash:/etc/aliases, ldap:ldapaliases, ldap:ldapml, hash:/home/mailman/bin/aliases canonical_maps = hash:/etc/postfix/canonical command_directory = /usr/sbin daemon_directory = /usr/lib/postfix debug_peer_level = 2 default_destination_concurrency_limit = 1 default_privs = cyrus defer_transports = disable_dns_lookups = no local_destination_concurrency_limit = 2 mail_name = Postfix on SuSE eMail Server 2.0 mailbox_transport = procmail maps_rbl_domains = relays.ordb.org masquerade_domains = $domain masquerade_exceptions = root maximal_queue_lifetime = 1 maximal_queue_lifetime = 1 mydestination = $mydomain, $myhostname, localhost.$mydomain, pame.org, ginni.de, hotel-tsapakis.de, mahling.net, projekt-pame.de, adv-nrw.de, lebens-werkstatt.net, sfe-kevelaer.de myhostname = gw0324.klaus-mahling.de mynetworks = 212.185.26.71/255.255.255.0 myorigin = $mydomain program_directory = /usr/lib/postfix recipient_delimiter = + relayhost = relocated_maps = hash:/etc/postfix/relocated sender_canonical_maps = ldap:ldapcanonical smtpd_recipient_restrictions = reject_maps_rbl, ldap:ldapmailenab, check_relay_ccerts, permit_mynetworks, check_ relay_domains, ldap:ldapmlgrp smtpd_sender_restrictions = hash:/etc/postfix/access transport_maps = hash:/etc/postfix/transport virtual_maps = hash:/etc/postfix/virtual _____________________ Any ideas ? -- THX Klaus Mahling mailto:admin@klaus-mahling.de

5 4

R: [suse-security] Security on telnet
by Fiorenza Meini 22 Oct '01

22 Oct '01

Thanks for your suggestions! A good solution for my problem should be this one: - ssh instead of telnet, listening on the network card which has the local IP address - sendmail listening on the network card which has the public IP address; this is possible with this line DAEMON_OPTIONS(`Port=smtp, Name=MTA, Addr=1.2.3.4')in its configuration file Fiorenza -----Messaggio originale----- Da: Peter Nixon [mailto:nix@susesecurity.com] Inviato: venerdì 19 ottobre 2001 16.49 A: SuSE Security Oggetto: Re: [suse-security] Security on telnet On Fri, 19 Oct 2001 16:35:08 +0200 Christian Weickhmann <christian.weickhmann(a)web.de> wrote: > > Fiorenza Meini wrote: > > > Hi there, > > I installed Linux 7.2 on a machine where I want to have running only > > sendmail and telnet (I configured inetd). > > I have a network card with a public IP address, but for security reason I'd > > like to configure another network card with a local address on which I want > > telnetd listen to. > > So, what I'd like to to is this: > > - sendmail listening on the network card with public IP address > > - telnet listening on the network card with local IP addess. > > > > Is this possible? > > Any suggestion on how can I configure the system? > > > > Thanks > > > > Fiorenza > > > Hello Fiorenza! > > It's not a *real* solution: Have you set up a firewall? You could set > one up with telnet port closed to external network. It would be a bit at > least. > Do you really need telnet? Try to use ssh. I'm sorry, but I have to disagree with you on this. It all depends on how Fiorenza has his network configured. You can't tell him it's not a "real" solution when you don't know the details of his network. It is infact a _very_ good idea to only bind services to the interfaces you need them to be used on. I agree that he should use ssh instead of telnet, but this doesn't change the fact that he asked a very valid question about how to configure a machine to only bind certain services to certain interfaces. For all you know, his machine could _be_ the firewall.... Fiorenza: I'm sorry, I realised that I only answered your question in part last post. I am actually not sure how to force sendmail to bind to only one interface, (you have to do it inside sendmail as you rarely run sendmail from x/inetd) however if you want to take a look at postfic, you will find that it's very simply a matter of editing main.cf and telling it which interface to bind to. Maybe some sendmail jukies tell you the solution for sendmail, although I susspect that if you have sendmail listening to the _live_ interface, there will be no problem with it listening internally also.. HTH -- Viel Spaß Nix - nix(a)susesecurity.com http://www.susesecurity.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

File services in an university network
by Lars O. Grobe 21 Oct '01

21 Oct '01

Hi List! I would like to hear your opinion on our fileserver installation, as I see a big difference between the de facto installations and the ones described in security how-tos and lists. As far as I can see, most university networks constist on computers with valid ip's directly connected to the net. These are Suns, PCs and Macs, with their own fileservices. I understand that this is dangerous. On the other hand, howtos and lists talk about DMZs, firewalls and very few protocols on the internet. So, following the advises, every network seams to need a "secure" side for the clients, and a DMZ for every server visible to the outside, and a lot of filters... I have to install a fileserver in an university network. We have our own local net, with a lot of clients, and the existing server behind our firewall (most of the network machines have suse linux here, some are solaris-based). But as the university has a lot of networks, I have to allow access to the server from the outside now. And there are all those platforms and protocols which need access... Appleshare/IP, SMB, FTP (what do you think about these protocols and security?). So the fileserver, which usually should be kept secure, is jumping into what should be the DMZ... I am considering to open the ports for smb and appleshare on the firewall with destination server now. I only allow encrypted passwords on appleshare and smb. I close everything else. In fact, I know that a server in the DMZ would be better, but than I would have to install one more machine, mount the directories to export via nfs :-( etc...and keep an eye on a lot of firewalls. So in my opinion, it's the best solution to have a SIMPLE configuration (with less misconfigurated services). And as I told you, if I compare with other networks, we still take a lot of care on our security. Anyway, I would like to hear your opinion, as this seams to be a quite common problem - universities don't have the possibility to maintain too complex installations, and on the other hand, everybody is working over the net here. Thank You, CU, Lars.

2 1

Re: [suse-security] GV- or Battlecom-Server with SuSEfirewall2
by Freddy 21 Oct '01

21 Oct '01

Hi Rene, with ipchains/ipmasqadm battlecom worked fine. Even MS have Infos on there gamevoice site about GV with ipchains / iptables. I think it is a configuration-problem with the SuSEfirewall2-Script. It would be cool , if the Script would write the iptables-commandos to a file. Debugging would be easier. Greetings Freddy ----- Original Message ----- From: "René Marhold" <rene(a)marhold.net> To: <freddy.krueger(a)t-online.de> Sent: Sunday, October 21, 2001 3:56 PM Subject: Re: [suse-security] GV- or Battlecom-Server with SuSEfirewall2 > could not work, the masqeradet maschine must have an official ip, becaue > the protocolls are trying to connect to the ip adress from the server that > theiy get from the BC-Protocoll > > freddy.krueger(a)t-online.de wrote: > > Hi everybody, > > > > have someone running a GV- or Battlecom-Server behind a firewallbox > > with SuSEfirewall2 on SuSE 7.3? > > > > I have forward the packets to the server behind the fwbox , but no > packets > > reach this server an there are no entries in the firewall.log. > > > > any hints ? > > > > have a nice day > > > > kind regards > > freddy > > > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > > > >

1 0

SuSEfirewall causes machine to hang...
by Thomas Hörndlein 21 Oct '01

21 Oct '01

Hello, I've set up an DSL-Router with Suse-Linux 7.2 (Kernel 2.4.4-4) and SuSEfirewall2. Almost everything works fine as long as I don't try to acces the gnutella network with my Limewire-Client. Doing this causes my router to stop working at all. In such a situation the machine seems to hang (no remote login possible, no routing done any longer etc). I have recently upgraded to SuSEfirewall2, before then, I was using SuSEfirewall with exactly the same strange behaviour. Is there anybody outside who recognized a similar problem and can give me an hint on what to do. I've got really no idea anymore. Thanks in advance, Thomas

2 2

Re: AW: [suse-security] SuSEfirewall causes machine to hang...
by Thomas Hörndlein 21 Oct '01

21 Oct '01

Great!!! I installed the Kernel 2.4.7 and it seems to work fine. Thanks a lot for your help!! Grüsse, Thomas Klaus Heske schrieb: > Das durfte die Probleme losen....;) > > http://sdb.suse.de/de/sdb/html/hvogel_tbraza_dsl72.html >

1 0

GV- or Battlecom-Server with SuSEfirewall2
by Freddy 21 Oct '01

21 Oct '01

Hi everybody, have someone running a GV- or Battlecom-Server behind a firewallbox with SuSEfirewall2 on SuSE 7.3? I have forward the packets to the server behind the fwbox , but no packets reach this server an there are no entries in the firewall.log. any hints ? have a nice day kind regards freddy

1 0

AW: [suse-security] Firewall 2 in Suse 7.3
by PHJ 21 Oct '01

21 Oct '01

Hi Freddy, thank you. It's right on the client machines i've configured the dns ! But the resolv.conf is configured correct and is modified by the ip-up script. That's not the problem. For example when i don't start the firewall everything works fine on the firewall computer. Thanks PHJ ---------------------------------------------------------------------------- ------ > Hello ! > > I have a problem with Firewall 2 in Suse: > > 1. When i start the Firewall 2, other computers in the network can connect > to the internet via ip masquerading, but the computer where the firewall > runs, has no access to the internet ! Check your "/etc/resolv.conf". If you don't run a DNS-Server with forwarders you have to put the dns from your ISP in the resolv.conf. Do you use isdn to connect to your ISP ? If so , try "MODIFY_RESOLV_CONF_DYNAMICALLY = yes" in the /etc/rc.config and the ms-get-dns in the "/etc/ppp/options". If you use the SuSE "/etc/ppp/ip-up" script , the script tries to get the dns from your ISP and put the dns in to your /etc/resolv.conf". After disconnect, the script restores the resolv.conf. That your clientmachines can connect to the inet , is that you have configured the dns on the clientmachines - i think so? > > 2. How is it possible to do not start personal-firewall at boot, because i > think when i use firewall 2, it is not necessary to run personal-firewall > ??? > remove the "personal-firewall package" or what i did , remove the links unter "/etc/init.d/rc.x.d/". > > Thank you for help ! > > PHJ > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > Hope it helps kind regards freddy

2 3

Firewall 2 in Suse 7.3
by PHJ 21 Oct '01

21 Oct '01

Hello ! I have a problem with Firewall 2 in Suse: 1. When i start the Firewall 2, other computers in the network can connect to the internet via ip masquerading, but the computer where the firewall runs, has no access to the internet ! 2. How is it possible to do not start personal-firewall at boot, because i think when i use firewall 2, it is not necessary to run personal-firewall ??? Thank you for help ! PHJ

2 2