November 2001 - openSUSE Security - openSUSE Mailing Lists

Harden_suse in 7.3Pro?
by X-SoCiaL 01 Nov '01

01 Nov '01

Hi there... Ive just installed SuSE 7.3 Pro from scratch(no update) and trying to = run the harden_suse scripts installed from the original media. When I = run it it says that the script only support 7.2 and that the script is = guessing that Im using SuSE 7.3(smart one =3D)) It tells me to check for = an update with Yast2 or at marc's homepage(www.suse.de/~marc) but I cant = find anything there ... I sent a request to support after registering my = produkt but they only told me that my free installation support dont = cover this matter. Some help need here please. Can I run it anyway ... = Im asked if I want to continue. /Roger

1 0

SuSEfirewall and lockfile
by Leen de Braal 01 Nov '01

01 Nov '01

Hello list, SuSEfirewall reports there is a lock present. I know how it came in the system: it is there because I had a poweroutage while ippp0 was in use. Where can I find it and remove it?? (in /var/lock there is a LCK..ippp0, is this the thing?) TIA Leen de Braal

1 1

SuSEfirewall2 and DHCP relay
by Pablo A. Maurin 01 Nov '01

01 Nov '01

Hello everyone. I am currently using SuSEfirewall2 with the following configuration. FW_DEV_EXT="eth0" FW_DEV_INT="eth1 eth2" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24 192.168.254.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="ssh" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_INT_TCP="ssh" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" I have a firewall with 3 interfaces. eth0 is outside,public. eth1 is one local subnet (192.168.0/24), private. eth2 is a second internal private subnet(192.168.254/24). I have routing setup beween both subnets and I am able to ping across the firewall/router from one subnet to the other. Currently I have a DHCP server installed in the 192.168.0/24 subnet. Address 192.168.0.2. On the firewall I installed the DHCP realy package from the suse 7.2 CD It listenes on eth2 and forwards all request to 192.168.0.2 (the DHCP server). when I check the dhcp server logs I see that it is creating a lease for the new host on eth2 of the firewall. However the host is not receiving the address. I sure that it is a small misconfiguration on the firewall, but I cannot figure out what it is. Any help is greatly appreciated. If you need more information just e-mail me and I will try to get it. Thanks is advance, Pablo A. Maurin

2 1

Strange dates on files
by JW 01 Nov '01

01 Nov '01

Hello, I have a situation where I think someone has edited files they weren't supposed to. The first clue is the files are all renamed with a common pattern, the second thing is that running ls -l on the suspect files now shows a date from 2000, even though this computer has only existed for about 6 months. That makes me nervous. How would someone change the date on a file anyway - with what command? Is there any way for file dates to be changed by accident (the contents of the files look o.k.)? I tried lsattr on them but it appears that lsattr doesn't work on RieserFS. I ran md5sum against the ls, file and md5sum binaries -- it matches the sum of those binaries on another SuSE 7.1 system, but that's not exactly reliable if someone's been messing with stuff (think: root kit. I hope not). What do y'all think? ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

3 2

AW: AW: [suse-security] raid on what
by Pawelczyk, Heiko 01 Nov '01

01 Nov '01

>-----Ursprüngliche Nachricht----- >Von: John Andersen [mailto:jsa@pen.homeip.net] >Gesendet am: Dienstag, 30. Oktober 2001 11:04 >An: suse-security(a)suse.com >Betreff: Re: AW: [suse-security] raid on what >>On Monday 29 October 2001 11:45 pm, Pawelczyk, Heiko wrote: >> -----Ursprüngliche Nachricht----- >> >> >Using Suse 7.3, I'm planning a raid (5) server instalation >> >and was planing to use reiserfs partitions on three drives >> >connected each to a different ide controller. >> >Any problems with this? >> >> No if all of them are master without a slave device on the same cable. >Yes, one disk per controller channel was what I was planning. >this requires an additional controller card which hopefully will >be supported by Suse. We shall see. >> >Is reiserfs a suitable partition for raid? >> >any other suggestions? >> >> Reiserfs is fine, but you have first to partition the disks, then you >> define the raid-array and don´t format it, if you plan to use LVM! At this >> point you leave it as ext2. With LVM you can partition the raid-array. Use >> yast2 for installation. Yast1 can´t configure raid. >I'm running Reiserfs on one of my machines and am quite happy >with it, so I understand the basics, but I don't understand your comments >about LVM. >I'm expecting to use a seperate physical disk for each >element of the array, rather than chopping up a single >disk into volumes. >So I don't understand where LVM comes into it? So every Disk will have one Partition using all available space of the respective disk. That means all of them need to have the same size. The result of that operation is one raid volume of some size. I don´t know wether there are other disks in your system. Usually you would want to do some partioning, like putting /home on one device and the rest of the system somewhere else. Certainly you would want to have a swap device. All this is not mandatory but it is good common practice. There is no need to put a swap device on a raid-disk (a good reason not to integrate all diskspace in the raid-array). You could also consider, wether there is a need to put the parts of the system on a raid-array, which are easily recoverable by a reinstall. Anyway you will still have a need for a good back-up strategy, since the raid-array won´t help you when files get deletet for some reason. LVM gives you the flexibility to put partitions on the raid-array. -- __________________________________________ J.Andersen -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Alternative to NFS
by Andreas Achtzehn 01 Nov '01

01 Nov '01

Dear list readers, we have been extensively using NFS to export file systems to other computers. Since we are now in a phase of reauditing our network for security, be are searching for an alternative to that very insecure and part-time even instable protocol. Do you have any advice on which system to use? It should contain at least the same amount of features lacking all the possible security holes. Kind regards, A. Achtzehn

9 12

how to detect spoofing hosts
by spiekey 01 Nov '01

01 Nov '01

Hello! Let´s say i have a big LAN, with a few gateways and a firewall. As bigger your networks get´s the more you will be conflicted with pepole who want to "explore" your LAN. Thats why i was wondering how you can detect spoofing hosts. And why can spoofing be so dangerous, i couldn´t think of an good example. Thank you! Spiekey

9 13