October 2001 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] SMTP mail routing advice
by christian.burri＠synecta.ch 26 Oct '01

26 Oct '01

.-. /v\ L I N U X // \\ >I know KungFu!!< /( )\ ^^-^^ > 2. Port forwarding from the gateway of the SMTP port to the mailserver. If u do it with port forwarding, then u wont see the mail senders' real IP address in your logs, nor will it be contained within the message headers (xcept for the information which the sender put there, but that info can be faked). This can be very annoying, as I had to learn. So I recommend u dont use port forwarding but setup postfix instead of sendmail and have the MX record point to the FW. Cheers Chr. Burri

1 0

SuSE feeling vs Slackware
by spiekey 26 Oct '01

26 Oct '01

Hello! I might be wrong here, to ask if u can give me a tip for a Slackware box, but i don´t know where else to ask ;) I LOVE the handling of the suse shell, exspecially the PageUp one, And if u typed in ifconfig 100times and u press the arrow up key, it´ll just give u the "ifconfig" once. I have a slack box here and i don´t like it, i miss these features!! How can i put them onto the slackware box ( i wanna feel like home ;P)? Spiekey

2 1

ipv6
by xcomb xcomb 25 Oct '01

25 Oct '01

Thanks for help!

1 0

Harden SuSE on 7.3
by arthur 25 Oct '01

25 Oct '01

Are there any issues to look out for if I run Marc's hardern-suse v3.5 on 7.3? That's the current version on his site.

2 1

Re: [suse-security] can't get some internet-sites
by Peter Höhne 25 Oct '01

25 Oct '01

hmmmmm... Thanks to all people who tried... but dear Roman: I've tried eth1, ppp0 and modem! But nothing happens. The other tip with mtu/mru: Also i've changed the mru/mtu. The Protokol of Kinternet says: "pppd: Couldn't increase MTU to 1500" "pppd: Couldn't increase MRU to 1500" "pppd: send ...<mru 'my MRU size'>..." "pppd: rcvd ...<mru 1492>..." Therefor i have edit the lines 'mru' and 'mtu' in the file /etc/ppp/peers/pppoe. I've tried 1490 (SuSE had it writen), 1492 and 1452 (why 1452 Gregor?) Now i've change to 1492! Nothing happens... *heul* >> >> Hi all, >> could someone tell me, why i can't get some domains on my PC >> connected to the server? >> e. g. www.autoscout.de dont come to the PC - but the >> SuSE-Linux-Server itself can get it >> Other, e. g. ww.ebay.de come to PC and Server. >> >> I've a Linux 7.3 server and activated >> "SuSE-Personal-Firewall" = REJECT_ALL_INCOMING_CONNECTIONS with "eth1 >> masq". >> >> eth1 is my net-card for TDSL > You should have read the comments: If you use TDSL, use "modem masq" > for > REJECT_ALL_INCOMING_CONNECTIONS. eth1 carries ppp packets, which > contain > IP packets within, as with a bag in a bag. Therefore, eth1 is the > wrong > interface for the firewall rules. >> >> Thanks for all... > Thanks, > Roman. > -- > - > - > | Roman Drahtmueller <draht(a)suse.de> // "You don't need eyes to > see, | > SuSE GmbH - Security Phone: // you need > vision!" > | Nuernberg, Germany +49-911-740530 // Maxi Jazz, > Faithless | > - > -

3 2

can't get some internet-sites
by Peter Höhne 25 Oct '01

25 Oct '01

Hi all, could someone tell me, why i can't get some domains on my PC connected to the server? e. g. www.autoscout.de dont come to the PC - but the SuSE-Linux-Server itself can get it Other, e. g. ww.ebay.de come to PC and Server. I've a Linux 7.3 server and activated "SuSE-Personal-Firewall" = REJECT_ALL_INCOMING_CONNECTIONS with "eth1 masq". eth1 is my net-card for TDSL Thanks for all...

3 2

openssh 2.9.9
by Frank Steiner 25 Oct '01

25 Oct '01

Hi, will SuSE release rpms for openssh 2.9.9? cu, Frank -- Dipl.-Inform. Frank Steiner mailto:fst@informatik.uni-kiel.de Lehrstuhl f. Programmiersprachen mailto:fsteiner@web.de CAU Kiel, Olshausenstraße 40 Phone: +49 431 880-7265, Fax: -7613 D-24098 Kiel, Germany http://www.informatik.uni-kiel.de/~fst/

3 3

NSA 60-mins network security guide
by Philipp Snizek 25 Oct '01

25 Oct '01

Hi all, just for information: please find NSA's 60minutes network security guide on : http://www.sans.org/newlook/resources/NSA_guide.htm regards, Philipp

3 2

OT: pam, md5, perl and passwords?
by Brian Clark 25 Oct '01

25 Oct '01

Greetings, OK, I'm clueless.. Clue Bats gleefully accepted. Can anyone enlighten me as to why either of these: #!/usr/bin/perl $salt = '$1$' . join '', ('.', '/', 0..9,'A'..'Z', 'a'..'z')[rand 64, rand 64]; # one.. print crypt('Foo',$salt) . "\n"; # two.. use Crypt::PasswdMD5; print unix_md5_crypt('Foo',$salt) . "\n"; __END__ Produce this: $1$Vv$Lqurj1.e0d9ZGHQPXeXpQ1 But the results aren't equivalent to the same password generated on a SuSE machine with pam md5 enabled for passwords: $1$AQlpW4Gt$MyR9lMWDoyjyRwP7n6r0C1 Is there a way to arrive at the equivalent in Perl? (I realize this isn't clp.misc but someone here is bound to know.. right? :-)) -- -Brian Clark | PGP is spoken here: 0xE4D0C7C8 Please, DO NOT carbon copy me on list replies.

1 1

partition filling up with untraceable data.
by Yuri Robbers 24 Oct '01

24 Oct '01

Hi list! I have a strange problem since earlier today on one of my machines, with /home filling up inexplicably. I couldn't write in my home directory anymore. There are three reasons that I assume this to be a security-related topic: 1) this is in fact a DoS, 2) the fact that there was no legitimate user- or system activity that could have caused the partition to fill up, and 3) the fact that whatever data are filling up the whole partition, I have been unable to locate them. With respect to the latter, the fact that df and du disagree about disk usage is exemplary and rather suprising to me: robbe273:~ # df /home Filesystem 1k-blocks Used Available Use% Mounted on /dev/sda7 1775076 1773080 1996 100% /home robbe273:~ # du -s /home 879188 /home robbe273:~ # See? du reports only about half the space being in use as compared to what df says. Given the fact that the partition is actually full, it would seem df is right. This is a SuSE 7.2 "all packages" install with a few manual changes, and all security patches applied with YOU. The machine is a dual pentium Celeron 533, with the standard SMP kernel from SuSE 7.2 running: robbe273:~ # uname -a Linux robbe273 2.4.4-64GB-SMP #1 SMP Fri May 18 14:54:08 GMT 2001 i686 unknown robbe273:~ # The harddisk is a Quantum Viking 4.5 WSE on an Adaptex AIC7880 UW-SCSI controller: <6>scsi0 : Adaptec AIC7XXX EISA/VLB/PCI SCSI HBA DRIVER, Rev 6.1.13 <4> <Adaptec aic7880 Ultra SCSI adapter> <4> aic7880: Ultra Wide Channel A, SCSI Id=7, 16/255 SCBs <4> <4> Vendor: QUANTUM Model: VIKING 4.5 WSE Rev: 8808 <4> Type: Direct-Access ANSI SCSI revision: 02 <4>Detected scsi disk sda at scsi0, channel 0, id 0, lun 0 <4>(scsi0:A:0): 20.000MB/s transfers (10.000MHz, offset 8, 16bit) And the relevant partition has been formatted with reiserfs: robbe273:~ # rpm -q reiserfs reiserfs-3.x.0j-17 There are, of course (this is reiser-fs) no quota installed. It has been up and running for almost 10 days robbe273:~ # w 10:20pm up 9 days, 21:52, 11 users, load average: 0.07, 0.13, 0.09 and has never had this problem so far. The only problem it ever had since installing SuSE 7.2 (almost certainly unrelated, but let's give all details that may be relevant, however irrelevant they may seem to me) is that X inexplicably crashes, ranging from, at best, once a week to, at worst, twice or thrice in 24 hours. On this system there are two legitimate users, one of them being me, and the other not using the machine at that time. The machine was, however, connected to the internet (the running daemons being sshd, sendmail and ircd). None of the legitimate users nor the system itself have done anything which could account for this partition filling up. It happened earlier today, and it surprised me, but didn;t seem suspicious, especially since there wasn;t much space free anyway. I did however back up some old data to CD< and erased it, leaving about 800 Mb free on this partition, which has filled up again in about 10 hours. Of this 800 MB less than a megabyte can be accounted for with legitimate user- and system-activity. The rest has "appeared" somehow, and I have been unable to even find it, exploring teh filesystem. Does anyone know this problem? Or have a clue how this could be caused? Misconfiguration? A bug? A hardware problem? A cracker? Any suggestions as to what may cause it, or how it can be fixed would be most appreciated. If I have forgotten to give any relevant info, please let me know also. Thanks and kind regards, Yuri. -------------------------------------------------------------------------- Yuri Robbers phone : +31-71-527-4966 Leiden University fax : +31-71-527-4900 Institute for Theoretical Biology email : robbers(a)rulsfb.leidenuniv.nl Kaiserstraat 63 2311 GP Leiden PGP 5.0 public key available: the Netherlands Check your favourite hkp server. --------------------------------------------------------------------------

4 4