November 2001 - openSUSE Security - openSUSE Mailing Lists

Did SuSE hack ls or which?
by John Andersen 30 Nov '01

30 Nov '01

Noticed that Turbolinux promptly reports where ls is located in response to "which ls", as will Mandrake and RedHat, but SuSE 7.3 won't. Is this intentional? Please don't tell me I've been hacked already, the box has only been running 12 hours, and its only got a ssh open. -- _________________________________ John Andersen / Juneau Alaska

5 9

SuSe Future Plans
by Rajiv Malik 30 Nov '01

30 Nov '01

hi all! i was doing an indepandant study on SuSE security. i found a lot of material on SuSE existing security feture. But my study scope also includes SuSE future plans for extending security. can u guys know of some link where SuSE keeps this information or if one has some idea plz oblige me by sending that to me. Thanx! Best Regards, Rajiv Malik PS: to SuSE team, I know as per company's policy it may not be possible to deatil all of them, but can i be obliged by sending some comments on- SuSE future plans for security.

1 0

AW: [suse-security] Open Relay - qmail
by Bitzer,Gerd 30 Nov '01

30 Nov '01

ok, and now let's start a broad discussion which one is the best: qmail, sendmail, postfix, whichever, and pleeze all pro's and con's in the highest details sorry, couldn't resist ---- Run the newest version of Sendmail. The default for it is a closed relay. ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.12.1.tar.gz If you want to read up on it: http://www.sendmail.org/8.12.1.html --Brian Owner Gryphon Technical At 08:40 AM 11/28/2001, you wrote: >Hi all, > >I have a problem with our qmail-server. It´s a open relay. >I have run some bugfixes but it doesn´t fix this. >Have anybody a idear? >thanks > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

6 7

UDP 4665
by Ralf Koch 29 Nov '01

29 Nov '01

Hi list, quick question: In the last days, my firewall logs filling up with messages like the following: Nov 29 22:02:57 acme kernel: Packet log: input DENY ppp0 PROTO=17 217.216.153.114:3058 217.0.156.224:4665 L=34 S=0x00 I=29563 F=0x0000 T=113 (#48) 15 - 50 hits per second. Does anybody know what they try to connect to? A quick scan gave me something like eDonkey, but I don't think eDonkey is widely spread to give my firewall so many hits. Any guesses? Thanks Ralf * * Ralf 'coko' Koch * mailto:info@formel4.de * --- Hiroshima 45, Tchernobyl 86, Windows 2000

1 0

Re: [suse-security] proftpd disparaged
by Mauricio Latorre 29 Nov '01

29 Nov '01

Just rad this http://www.seifried.org/security/network/20010926-ftp-protocol.html <hub4sc0 ----- Original Message ----- From: John Andersen <jsa(a)pen.homeip.net> Date: Thursday, November 29, 2001 2:26 pm Subject: [suse-security] proftpd disparaged > Somewhere on this list in the last few days someone said proftpd > was "a mess" but never said why, or wether this "mess" was security > related. > > Could the poster elaborate please?? > > And VSFTPD?? Any opinions on that one? > -- > _________________________________ > John Andersen / Juneau Alaska > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

2 1

Possible OpenSSH Exploit?
by Ben Rosenberg 29 Nov '01

29 Nov '01

This is part of an email that went out at work this morning and I am wondering if there is any truth to it. If so will we see an update Roman? :) "For those running openssh on a unix system, I've heard of a report of an exploit for all opensshes < version 3.0.1. It's unclear if it's a client-side local root vulnerability or if it's a server-side remote root vulnerability...or whether there's a problem at all." -----=====-----=====-----=====-----=====----- Ben Rosenberg mailto:ben@whack.org -----=====-----=====-----=====-----=====----- "Technological progress is like an axe in the hands of a pathological criminal" -AE

2 1

Re:[suse-security] secure web-serving with dynamic ip
by JOSHUA_TRUTWIN＠udlp.com 29 Nov '01

29 Nov '01

> hi there, > i have set-up an apache web-server with mod_ssl, and it all works fine > in the intranet.. but if i try to reach it from the outside, it seems to > be unreachable... now the ip of my server is a dynamic one of the isp => > might that be the problem, because in httpd.conf u have to add a server > name and because my server is on a dial up, i dont have a domain-name? > .. or would there be other possibilities for secure webserving with > dynamic ips? > > thanks remo Remo, I have a web server set up using dynamic IP's from a cable modem service. You might want to check out www.dyndns.org, a free service for those of us stuck with dynamic IP's. Josh

2 1

secure web-serving with dynamic ip
by remo suter 29 Nov '01

29 Nov '01

hi there, i have set-up an apache web-server with mod_ssl, and it all works fine in the intranet.. but if i try to reach it from the outside, it seems to be unreachable... now the ip of my server is a dynamic one of the isp => might that be the problem, because in httpd.conf u have to add a server name and because my server is on a dial up, i dont have a domain-name? .. or would there be other possibilities for secure webserving with dynamic ips? thanks remo

2 1

[suse-security] Problem with iptables
by Nils Wunsch 29 Nov '01

29 Nov '01

Rear municipality I have a problem I do not want to be able to close that first times all port openly am upd tcp ICMP at later everything only unfortunately go to anything ssh HTTP etc. Who can render to me fast help eth0 is the Web server eth1 is the internal INTERFACE to data base the computer of the railways computer is 192.168.0.4 eth2 is connect the IP for the Extenen the data base . I do not have socks servers Thanks you here mine is script #!/bin/sh ARG=$1 MAIL= NS= DB_serv=192.168.0.4 A_NET=195.143.193.66/32 D_NET=192.168.0.1/24 DB_NET=195.143.232.2/32 p_webm=10000:10100 m_port=0:65536 case $ARG in start) echo Firewall starting ... #### # Löschen aller Rules iptables -t filter -F iptables -t nat -F iptables -X iptables -t nat -P PREROUTING ACCEPT iptables -t nat -P POSTROUTING ACCEPT iptables -t nat -P OUTPUT REJECT #### # Lokale sytsem dürfen iptables -t filter -A OUTPUT -o lo -j ACCEPT iptables -t filter -A INPUT -i lo -j ACCEPT #### # erstmal einige freigeben iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source eth0 iptables -t filter -A INPUT -i eth0 -p udp -s 0/0 --sport $m_port -d $A_NET --dport $m_port -j ACCEPT iptables -t filter -A OUTPUT -o eth0 -p udp -s 0/0 --sport $m_port -d $A_NET --dport $m_port -j ACCEPT iptables -t filter -A FORWARD -i eth0 -o eth0 -p tcp -s $A_NET --sport $m_port -d ! $A_NET --dport $m_port -j ACCEPT iptables -t filter -A FORWARD -i eth0 -o eth0 -p udp -s $A_NET --sport $m_port -d ! $A_NET --dport $m_port -j ACCEPT # Debugging Regel iptables -t filter -A INPUT -j LOG iptables -t filter -A FORWARD -j LOG iptables -t filter -A OUTPUT -j LOG iptables -t filter -A INPUT -j REJECT iptables -t filter -A FORWARD -j REJECT iptables -t filter -A OUTPUT -j REJECT ;; stop) echo Firewall stopping ... iptables -t filter -F iptables -t filter -P INPUT ACCEPT iptables -t filter -P OUTPUT ACCEPT ;; esac

1 0

pgp > 2
by Dominik 29 Nov '01

29 Nov '01

Hi, ich verwnde momntan pgp 2.6.3i (aus der suse 7.2) und würde gerne auf 6 updaten. Ich habe leider keine Site gefunden, die Version 6 für Linux anbietet. Weiss jemand wo ich das bekomme? , am besten natürlich gleich als Suse kompatibeles RPM Paket? Veilen Dank, Dominik

4 3