October 2001 - openSUSE Security - openSUSE Mailing Lists

ftp mirror in Turkey
by Peter Nixon 12 Oct '01

12 Oct '01

Hi Guys As I: a) have noticed that there is no suse ftp mirror in Turkey b) Happen to work for a company that owns one of the larger ISP's in Turkey I have put up a SuSE mirror at ftp://ftp.susesecurity.com/pub/suse/ This is for public ftp access for anyone in Turkey (and North Cyprus etc) We have approx 15MBit of total bandwidth to other Turkish ISP's, but bandwidth from Turkey to the rest of the world is more limited, so I ask that you use the normal mirrors if you are NOT in this part of the world... The mirror is still in the process of populating, but the 7.2 intel updates are now up to date, so I thought it was worth mentioning. Once the initial mirror has finished (probably another day at this speed..) it will be updated twice per day.. Happy Downloading -- Viel Spaß Nix - nix(a)susesecurity.com http://www.susesecurity.com

4 3

Amavis Error?
by Thorsten Marquardt 12 Oct '01

12 Oct '01

Hi, I have a problem with one off my emails scanned by amavis. This the error message: > > ----- Transcript of session follows ----- > Can't use an undefined value as an ARRAY reference at /usr/local/lib/perl5/site_perl/5.6.1/Archive/Tar.pm line 737. > 554 5.3.0 <exneto1(a)eoipso.com>,<thom(a)www.text-team.de>... unknown mailer error 255 > I don't know why amavis calls the Tar.pm because there is no tar-archive attached to the mail. The attachments are plain text files. Yours Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

2 3

SCP file transfer Question
by Steven Thompson 12 Oct '01

12 Oct '01

Hi All Is there an ftp style app for SCP on linux. I'm running SuSE 7.2 For either console or KDE that does recursive coping of files and directories. Example: --------------------------------- | Local System | Remote System | | /home/ | /opt/packages/| --------------------------------- |.. |.. | |some files |some files | --------------------------------- <---- ----> Thanks in Advance Steven

6 5

R: [suse-security] email wierdness.
by Fiorenza Meini 12 Oct '01

12 Oct '01

You mailing server is blacklisted. Fiorenza -----Messaggio originale----- Da: elfed lewis [mailto:e.lewis@meirion-dwyfor.ac.uk] Inviato: venerdì 12 ottobre 2001 10.43 A: suse-security(a)suse.de Oggetto: [suse-security] email wierdness. I got this message today (names have been changed to protect the innocent!). Is it saying i'm blacklisted, or the host i'm emailing to is blacklisted? ----------email------------------- from localhost ----- The following addresses had permanent fatal errors ----- (email i'm mailing to) (expanded from: (their local alias name)) ----- Transcript of session follows ----- ... while talking to mail-in.pol.net.uk.:(email i'm mailing to) >>> RCPT To: <<< 550- <<< 550 mail from (my emailer ip address) rejected: administrative prohibition (host is blacklisted) 550 (email i'm mailing to)... User unknown ----------email------------------- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

4 4

AW: [suse-security] Doubts about "SuSE-FW-on-CD"
by Hirsch Wolfgang 12 Oct '01

12 Oct '01

> -----Ursprüngliche Nachricht----- > Von: Christopher Mahmood [mailto:ckm@suse.com] > Gesendet: Freitag, 12. Oktober 2001 01:24 > An: Hirsch Wolfgang > Cc: suse-security(a)suse.de > Betreff: Re: [suse-security] Doubts about "SuSE-FW-on-CD" > > > * Hirsch Wolfgang (hirsch(a)fwf.ac.at) [011011 02:54]: > > I also want to know, if there any possibilities to scan for viruses. > > That's probably something that's better done on a mail server. > Sure, but my box is a http-proxy too and three weeks ago, we had the nimda-virus on internal workstations . Wolfgang > -- > > -ckm >

3 2

R: R: [suse-security] email wierdness.
by Fiorenza Meini 12 Oct '01

12 Oct '01

You can look at: www.orbz.org www.ordb.org -----Messaggio originale----- Da: elfed lewis [mailto:e.lewis@meirion-dwyfor.ac.uk] Inviato: venerdì 12 ottobre 2001 11.24 A: Fiorenza Meini; suse-security(a)suse.de Oggetto: Re: R: [suse-security] email wierdness. Ar Friday 12 October 2001 10:16 am, ysgrifenodd Fiorenza Meini: > You mailing server is blacklisted. hmmm. I wonder why? Is there a central list of blacklisted sites that i can check to see if i'm on it? I cant think of any good reason for this - we're an educational college. Maybe one of the staff has been playing silly buggers. thanks, Elf

1 0

netfilter with transparent squid
by Joelly Alexander 12 Oct '01

12 Oct '01

does anyone know how to setup a netfilter-firewall with transparent squid ? there is a document called "transparent proxy with linux and squid mini-howto"; sure it works, but only when the default policies are set to accept; for higher security my default policies are set to drop and the transparent answer my requests; does anyone have a similar szenario that works ? are there some samples or useful hints avaliable ? thx alex

4 6

Am I hacked???
by Praise 12 Oct '01

12 Oct '01

When I run the "last" command I find out this output: dbuffoni pts/0 62.98.75.83 Sun Sep 23 19:03 - 19:08 (00:05) leofire ftp ppp-4-10.27-151. Sun Sep 23 15:45 - 19:45 (04:00) leofire ftp ppp-4-10.27-151. Sun Sep 23 15:44 - 15:44 (00:00) fraghi pts/0 151.17.72.243 Sun Sep 23 15:43 - 15:50 (00:06) pB ************ Thu Jan 1 01:00 - 01:00 (00:00) leofire pts/0 ppp-4-10.27-151. Sun Sep 23 04:49 - 04:54 (00:04) fraghi pts/0 151.17.128.9 Sat Sep 22 15:37 - 15:50 (00:13) guybrush ftp flat-p01-m224.ar Sat Sep 22 14:53 still logged in fraghi pts/0 151.17.128.9 Sat Sep 22 14:51 - 15:37 (00:45) dbuffoni ftp 62.98.76.173 Sat Sep 22 12:43 - 12:57 (00:13) dbuffoni pts/0 62.98.76.173 Sat Sep 22 12:31 - 12:57 (00:25) 5 ************ Thu Jan 1 01:00 - 01:00 (00:00) praise pts/0 62.98.133.24 Sat Sep 22 01:53 - 03:12 (01:19) leofire ftp ppp-227-6.27-151 Sat Sep 22 00:30 still logged in leofire ftp ppp-227-6.27-151 Sat Sep 22 00:30 still logged in guybrush ftp flat-p07-m022.ar Sat Sep 22 00:17 - 00:27 (00:10) Everything is working fine on my system. At least it looks like that. But what does the "pB" and "5" strange users mean? And the dates are not so true. The /var/log/messages is regular, except for: Oct 8 05:10:03 main in.ftpd[16381]: connect from rg(a)217.128.174.129 (217.128.174.129) rg is not an user in my system! Just checked Oct 8 10:56:13 main in.ftpd[17131]: connect from root(a)203.90.83.203 (203.90.83.203) and root cant connect to ftp when I try it. What does these entries could mean? I have brought down my pc and I have checked passwd and log files with the suse rescue system. Everything looks as regular as when I did that with the compromised (?) system. My system is a Suse 7.1, the only open ports are the 22 (ssh) and the one with ftp (21). I use in.ftpd (the standard type in inetd.conf). last gives me the same problem with a laptop pc, which is not directly connected to the internet, but it is often in the same network as the other compromised system. Anybody can tell me that I am not hacked and there are only common bugs??? Praise

7 11

AW: [suse-security] Doubts about "SuSE-FW-on-CD"
by Hirsch Wolfgang 12 Oct '01

12 Oct '01

I also want to know, if there any possibilities to scan for viruses. Wolfgang > -----Ursprüngliche Nachricht----- > Von: Jacobo González Simón [mailto:jacobo@tyc.es] > Gesendet: Donnerstag, 11. Oktober 2001 11:44 > An: suse-security(a)suse.de > Betreff: [suse-security] Doubts about "SuSE-FW-on-CD" > > > Hi: > I'm reading the (poor) documentation about this (excelent) idea called > "SuSE FireWall on CD" but before my company buy it i need to > resolv some > doubts: > - With a single (or central) FAS can i configure rulesets for a lot of > firewalls? (I hope to install it over a lot of clients) > - Security are based on ipchains or iptables? > - Can firewall has three (or more) networks cards? > - Are there any HTML or PDF files with full explanation of > the software? > Where? > > I hope that you understand that prior to pay "1150 Eur" i > need to solve > this doubts. > > Thanks in advance. > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

3 2

NIS, /etc/passwd and '+::::::' question
by Tobias Burnus 12 Oct '01

12 Oct '01

Hi, YaST by default creates a '+::::::' entry for NIS in /etc/passwd. I read that the entry should have a '*' in the second field in order to prevent logins of the user '+' when NIS is down. Is this a security problem under (SuSE) Linux or is this note a remedy from an ancient ancestor? (I quick test didn't work, but I haven't tried the +user, -@group etc. syntax I found in the FreeBSD passwd(4) but neither in Linux passwd(4) nor in the yp*(*) of Thorsten Kukuk.) Tobias -- This above all: To thine own self be true / And it must follow as the night the day / Thou canst not then be false to any man.

1 0