November 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] attachment filtering
by James Bliss 03 Nov '01

03 Nov '01

Sorry for posting this, but this is getting rather absurd. 1) HTML email does not always work with all mail readers (even those supporting HTML mail). I use Opera and regularly get email which does not display because the sending email client does not properly format the HTML (usually a Microsoft client). 2) There is absolutely no need for any large attachments on this list. It is a security list and no one should be sending large attachments on this list. Lord knows I do not want to download a useless attachment when I am forced to connect using a dial up connection. 3) I believe that the decisions which were made are valid and have been reasonably thought out based on responses which Christopher received. In the past several weeks / months I had noticed an increase in garbage on this list due to various reasons which this filtering will hopefully diminish. 4) It is not possible to filter stupidity in an email server. This has to be done in the communication between the brain and the hands of the person sending the email. Sorry about this, but this was getting rather silly and is completely off topic for this list. Could we please return to TRUE security issues? Jim

3 3

attachment filtering
by Christopher Mahmood 03 Nov '01

03 Nov '01

Hi All, Thanks for all who took the time to respond to my request. As I'm sure you know, my concern isn't really with the subscribers on this list (which are generally considerate, sophisticated users) but with the madness on some of our larger lists like suse-linux and suse-linux-e. Suddenly implementing filtering without any notice would probably result in threats on my life and posting an RFC is pretty much out of the question there. So if everything goes well with this test case I'm planning on implementing similar policies on those lists after a suitable warning. I received about 20 responses and all except two were, to put it mildly, extremely enthusiastic about the proposal. The two arguments that were against were, in my opinion, both valid and the second convinced me that a complete ban on attachments is, sadly enough, a little too heavy handed. Here's the policy as it currently stands: o mail that consists only of a MIME attachment gets bounced o HTML mail gets bounced o all attachments that aren't text/plain get stripped o other than the bounces in the first two cases, no notification is sent to the sender that their attachments have been removed I think that this is reasonable compromise that allows people to attach log snippets or gpg keys while keeping HTML and "vcards" out, but you comments are of course welcome. Thanks again for the input, I really appreciate it. -- -ckm

6 9

Susefirewall and DMZ
by Marco Maier 03 Nov '01

03 Nov '01

Hello everybody. I'm using the suse-firewall for quite a long time to protect our internal Computers and to use masquerading. Now I had been asked to integrate a WEB-server who will be seen from the Internet. My actual config is the following: INET1 INET2 | | SUSEFIREWALL | Internal Network INET1 is a cheap flatrate used by us just to surf on Internet. This line does not have a dedicated IP. INET2 is an expensive line with 14 official IPs The default-route is set to INET1 Just some very specific routes are set to INET2 in order to pass some trusted firewalls. Now I have two possibilities to realize my plans: ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- ------- The first one is a cheap non secure solution, so I don't want to use this one: INET1 INET2 | | | |---------------- WEB-SERVER | | SUSEFIREWALL | Internal Network This would work, if I would set the default-route on the WEBsrv to the INET2-Router. ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- ------- The second one, which appears to be correct: INET1 INET2 | | SUSEFIREWALL--------------- WEB-SERVER (in a DMZ) | Internal Network But here I have some general problems to which I didn't found any solution yet. Which Network/Subnetmask must I use for the DMZ?? - Must I use the same as my official IP-Range given by my provider? - Or must I split the official Range in two different subnets, so that I can route all IP-Traffic? I can split the 255.255.255.240 into 2 * 255.255.255.248. - Or must I just use another privat IP-Range for my DMZ? In this case must I give my eth0 (on Inet2) severel official IPs? One for each server in the DMZ? What's about the route-settings? When the answer of the WEBsrv comes back to the firewall, it would go out to Internet by the default-route on INET1 and not on INET2! Has somebody allready realized a similar firewall? Thank you very much for all kind of advice. Marco Maier

2 1

FW crashed by gnutella
by Pep Serrano 03 Nov '01

03 Nov '01

I am trying to run gnutella behind a host running SuSEFirewall2 and everytime I do the FR gets crashed. I heard there is a bug around iptables and 2.4.* kenerls that makes SuSEFirewall2 crash, is that right? Good night list, Pep Serrano.

2 1

Re: [suse-security] I forgot my root password
by Guido Schiffer 03 Nov '01

03 Nov '01

Hi Kurt, Hi Folks, Kurt Seifried wrote: Friday, October 26, 2001 11:05 PM Subject: Re: [suse-security] I forgot my root password > Using init=/bin/sh is a LOT more simple if you don't have a cdrom for > example (most of my servers don't have cdrom drives). the init=/bin/sh will > work, no matter what unless someone has locked down lilo with restricted and > password. Ok, you won. But I still think that this "cryptic" way is more complicated than my suggestion. Using init=/bin/sh is more ultimative than my solution, but what do you do when the sh (I think it's only optional) is not installed (if want to avoid opening the box)? For that case, I guess you should have a rescue-boot-disk with all the tools you need, if you forgot the password or the system crashed. So you're independant from the installed system (and you should be). Greetings Guido

9 10

SuSEfirewall2 v1.9
by marc＠suse.de 03 Nov '01

03 Nov '01

Hi folks, SuSEfirewall v1.9 is now available - with correct version number and with all files ;-) background: I forgot to change the version number to 1.8 in the last release, after a user reminded me, I repacked it, however because the filesystem was full, SuSEfirewall was not in the package ... argh sorry for the inconvinience. Greets, Marc -- E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

1 0

Kernel Update (linuxsecurity.com)
by Jochen Kächelin 03 Nov '01

03 Nov '01

I just read the following article: http://www.linuxsecurity.com/advisories/suse_advisory-1680.html When I try to update my system (SuSE 7.3) with yast2 the patch is not offered to me! How can I check if this patch is already installed! The files on the ftp-Server are dated with 25.10.2001 - the article is from yesterday!! -- Jochen

2 1

Re: [suse-security] firewall-config: Allow external computers to access internal services
by Thomas_Janke＠prisma-edv.de 02 Nov '01

02 Nov '01

Well, I have a Sybase server running on an internal computer. A Zope-Server needs to have access to that computer. So a certain number of ports should be available. Is there a way to bypass the firewall for exactly one external computer? I heard something about /etc/fw_friends, but setting this didn't work. Thanks for your help Thomas

3 2

firewall-config: Allow external computers to access internal services
by Thomas_Janke＠prisma-edv.de 02 Nov '01

02 Nov '01

Yepp, that is the problem I have. I have a computer external to the firewall and want it to go through the firewall on an internal one. Unfortunately, I have no idea, how to do it. Hope, anybody can help me with that problem Yours Thomas

3 2

Information on rootkit
by Sven Michels 02 Nov '01

02 Nov '01

Hi there, i've a old suse box (6.2) which is hacked and rootkitt'ed. the rootkit seams to be a littlebit shitty .. but has a backdoor etc.. i dunno the name of it and found only warnings about the kit while searching the net. if somebody of you have/found more informations about this kit, would be nice to hear from you :) All informations i have is: it creates a directory: /usr/bin/duarawkz has a udp backdoor and uses scripts to hide himself. thanks PS: i don't administrate this box ;) i'll never have a old system like that... horrible.. -- intraDAT AG http://www.intradat.com Wilhelm-Leuschner-Strasse 7 Tel: +49 69-25629-0 D - 60329 Frankfurt am Main Fax: +49 69-25629-256 Junk mail is war. RFCs do not apply.

2 1