openSUSE Security February 2001

security@lists.opensuse.org

188 participants
202 discussions

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

Personal Firwall vs. SuSEfirewall
by Ernst Koch 12 Mar '01

12 Mar '01

Do I need both Personal Firewall and SuSEfirewall or is Personal Firewall enough for a single box only connected to the internet? Regards Ernst -- Sent through GMX FreeMail - http://www.gmx.net

2 1

Suggstion on security
by John Murphy 05 Mar '01

05 Mar '01

I have a cable Internet connection and run it through a Linksys router. This has NAT built in for protection. Of course through this I run DHCP to three other machines in a home network, 1 linux and 2 wins. Is this good enough or do I need to setup a personal firewall besides. I have Suse 7.1 and don't have the personal firewall on as this is the way the auto setup did it through Yast. If I do turn it on will this throw a monkey wrench into the something that is running fine now. I'm a newbie at firewalls and the option of just having it done automatically seemed appealing. But I figured Yast has to be much brighter then me and it had to be a reason. I'm thinking because of the DHCP? John......... -- Contentment is not the fulfillment of what you want, but the realization of how much you already have.

2 1

Re: Version of firewals.rpm for 2.4.x
by marc＠suse.de 02 Mar '01

02 Mar '01

Hi, > Do you have a version of firewals.rpm for the 2.4.x kernels? I'm > currently running suse 7.0, but until I upgrade to 7.1 I'd like to use > the latest kernel. Are there also user space tools that I need to get? 1) it is not recommended to use the 2.4 kernel for security purposes yet. 2) the 2.4 kernel supports old ipchains-based scripts like susefirewall if they are kernel-2.4 aware (get susefirewall v4.3 from www.suse.de/~marc) 3) susefirewall2 will be for the 2.4 kernel. first alpha end of this week Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

3 2

unidentified processes in netstat
by maarten van den Berg 28 Feb '01

28 Feb '01

Hi all, While running netstat on a longtime unpatched machine I see several UDP ports that otherwise aren't traceable to a process (with fuser or lsof). How can I find out what is listening / active here ? Should I be worried ? [ netstat output edited for readability ] www:/root 303# netstat -tupan tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 143/named udp 0 0 0.0.0.0:1151 0.0.0.0:* - udp 0 0 0.0.0.0:1141 0.0.0.0:* - udp 0 0 0.0.0.0:1080 0.0.0.0:* - udp 0 0 0.0.0.0:1064 0.0.0.0:* - udp 0 0 0.0.0.0:123 0.0.0.0:* 217/xntpd TIA, Maarten -- Instead, only try to realize the truth. There ís no blue pill. Maarten J H van den Berg van Boetzelaer van Bemmel, informatie- en netwerktechnologie http://vbvb.nl T 020-4233288 F 020-4233286 G 06-51994273

1 0

autofw or SuSEfirewall under 7.1 ?
by mathias rockel 28 Feb '01

28 Feb '01

Hi! I recently reinstalled my ISDN router which masquerades my private home network. I installed SuSE 7.1 (I know I know, much too new to use it already =) with kernel 2.2.18 and set up the SuSEfirewall accordingly. So far everything is fine. But with my old system I always forwarded some ports on the firewall directly to some PC on the network (e.g. for BattleCom) with ipmasqadm. For example, I did the following: "ipmasqadm autofw -A -v -r tcp 3389 3389 -h 192.168.0.9" which worked smoothly. Now I seem to have not installed ipmasqadm on the new system, and as Im not at home right now and 7.1 is not available on ftp yet, I cannot simply install it. So I read through the firewall.rc.config and found option 14, which sounded to me like what I need. I configured it accordingly, the SuSEfirewall also ACCEPTs those packages now, but it does not work. I get a "could not connect" error almost immediately when trying to connect. I entered the following: "0/0,192.168.0.9,3389" It did set some ipchains though, I checked with ipchains -L -n, but I must say that Im not savy enough yet to know why that is obviously not enough. I searched the archives and the net a bit and it seemed to me that what I wanted does not work with just ipchains but I need ipmasqadm and the autofw module. Is this true ? If this is true, can someone tell me if I can use the SuSE 7.0 ipmasqadm.rpm ? Are there any changes in the 7.1 version of this package ? I would like to get this working soon, as I need to access some services from home throughout the day. Hope I can get some help here for that issue. Thanks in advance! mathias rockel

1 0

Re: FW
by marc＠suse.de 28 Feb '01

28 Feb '01

Hi, > many thanks. > Is version 4.3 based on the IPtables?....and you mean SuSE 7.1? SuSEfirewall is solely based on ipchains (which also works with the 2.4 kernel). SuSEfirewall2 will solely be based on iptables (first alpha end of this week on my homepage [www.suse.de/~marc] > (As I understand then IPtables make an improvement in the > "memory" when compared with the stateless IPchains. Is this > a good reason for skipping IPchains and start IPtables.....?) you have the option to keep track of connection states. this is an improvement, yes, however not a big one in my opinion > Is the any more description for v.2.6 to learn aboat the possibilities? > Or should I dig into the script SuSEfirewall to discover the "variables"? if you want to learn about tcp/ip kernel functions and weird for() loops for ipchain rules generation, go for it (/sbin/SuSEfirwall) :-) but susefirewall2 will be nicer :) > How does SuSE react to the emerging security issues, namely > does there is a internal patch development, or do you rely on the > public resources? SuSE was the first linux vendor with an own security team for auditing and research, and still has got the biggest team. Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

3 2

tcpd vs. firewall
by Marko Kaening 28 Feb '01

28 Feb '01

Hi, at home I use a modem connection to my provider and up to now have tcpd installed to do basic access restrictions. So my /etc/hosts.deny forbids in principle everything to the outside world. Is it really necessary to use instead a firewall for such dial-up connections? Which arguments could you find from Security point of view??? Actually I'd prefer to stick with this simple solution, but maybe someone has convincing arguments against this approach... Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

4 4

qpop v. 2.53
by kleindoofi 27 Feb '01

27 Feb '01

hi all, thought i'd get into a bit of SAINT and all. 1. situation: host report of my newly installed 7.1 (!) shows vulnerable qpop. 2. situation: so i go and update. after update version still shows 2.53 and SAINT reports. anybody seen this? what gives ? tia dan

4 3

Real solution for incompatibility "ppp_ssl & passwordfd.so" ?
by Ingo.Grothues＠gmx.de 27 Feb '01

27 Feb '01

Hi everybody ! Maybe some of you experienced the incompatibility-problems between the packages "ppp_ssl" and the ppp-plugin "passwordfd.so". This problem is well known and one article found in the SDB says : > After dialup wvdial stops immediately. Error Message: > "A modem hung up the phone (exit code = 16)" > > In /var/log/messages you can read: > "Aug 7 22:24:42 erde pppd[3559]: unrecognized option 'passwordfd'" > or > "Aug 7 22:24:42 erde pppd[3559]: Couldn't load plugin /usr/lib/passwordfd.so" > > > Cause: > The package ppp_ssl from series sec was installed additionally and > doesn't work together with package ppp from series n. The suggested solution in this SDB-article is : > Deinstallation of package ppp_ssl from series sec. > Reinstallation of package ppp from series n Now - that is not a real solution, is it ? It sounds more like "it doesn't work - so don't use it..." Someone who needs the package "ppp_ssl" (it is necessary for encrypted PPTP-links) can't solve the problem with this solution. So here is my question : Is there a _real_ solution known for this problem ? (or maybe there is a way to establish a ppp-connection to an ISP without forcing pppd to use the plugin 'passwordfd.so' ?) greetings, Ingo

1 0

Jump to page:

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

1996

openSUSE Security February 2001