February 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] NFS - secure aternative
by Michael Roth 07 Feb '01

07 Feb '01

Hello Holger, Holger van Lengerich wrote: > > Hi, > > > This is good if you have some small files but I don't want to copy large > > data files (> 100 MB) to hold them twice. I search for a distributed file > > system with an authentification routine. > > What about kerberized NFS, are there any developments for Linux? I've tried > it on Solaris and it worked very well... > > cu. > Holger Kerberized NFS seems to be what I'm searching for. Have someone a hint for me, where I could find something like kerberized NFS for Linux. Thank you. Bye Michael

1 0

netscape buffer overflow
by Peter Münster 07 Feb '01

07 Feb '01

Hi, what about the netscape buffer overflow, which has been discussed in January? Is there an update anywhere, or is it sure that only a DoS is possible but no exploit? Did I miss an announcement? Regards, Peter -- Peter Münster http://notrix.net/pm-vcard

2 1

SuSE Security FAQ
by Nix 07 Feb '01

07 Feb '01

Just a reminder to everyone that we have a Frequently Asked Questions (FAQ) file at: http://www.susesecurity.com/faq/ Please check it occasionally (before you post a question) as there is some useful information there. If anyone has some extra sections for the FAQ, please forward them to me, and I will put them in at my earliest convenience. Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

ssh
by Mitja 06 Feb '01

06 Feb '01

I tried to connected to remote host with ssh without success. I received msg: Corrupted HMAC on input Please help me. Mitja

2 1

Firewalls, security scanning, etc.
by Jason P. Stanford 06 Feb '01

06 Feb '01

What are some sources to educate myself on firewall, and especially ways to test them? I've always been partial to O'Rielly books, but not all are the "best" to go with. Also, any good sites? I'm looking for some good low-level implementation advice, caveats, etc. I'm currently using the SuSE firwall software, and as far as I can tell it seems to be working just fine. But since I don't have a *really* good working knowledge of them I don't trust that I really have things battened down, so to speak. Also, I've heard that there are some online web sites that offer basic/trivial security scanning? Ie. Apparently some security consultancy sites can scan your box remotely to look for the more famous/obvious/common security holes. Who/what are they and are they worth using? -Jason __________________________________________________ Get personalized email addresses from Yahoo! Mail - only $35 a year! http://personal.mail.yahoo.com/

3 3

Open Port
by Markus Kohli 06 Feb '01

06 Feb '01

Hi! I just ran an "nmap -sT localhost" and saw the following port open: 1524/tcp open ingreslock Can somebody tell me, what this is? Up to now, the only Ports open were ssh@22 and X11@6000. Sorry for the stupid question, but I'm quite a newbie... Thanks, and have a nice evening. Greetings Markus

6 6

man issue
by Sebastian Krahmer 06 Feb '01

06 Feb '01

hi, the format issue of man seems harmless. the bug lies inhere /* XXX */ if (!display (NULL, argv[optind], NULL, basename(argv[optind]))) { error (0, errno, argv[optind]); exit_status = NOT_FOUND; } where error() is format-capable. However root privs are dropped before. So, you could gain a user-shell if you want. Please dont run man setgid, as man doesnt drop effective group ID. l8, Sebastian

1 0

dns hijack attack
by Philipp Snizek 06 Feb '01

06 Feb '01

Hi all, Does anybody know good links about dns hijack attack? Need to educate myself about it. Have been attacked. TIA Philipp

3 5

AW: AW: [suse-security] dns hijack attack
by Philipp Snizek 06 Feb '01

06 Feb '01

Hi Boris, Thanks for your answer. I read it with pleasure. > Eerm... 212.114.64.130 is our permanent line to the internet, > which is provided > by OSN, Online Service Nuernberg. Your ipchains log entries > show that, from our > permanent line, a DNS lookup has been initiated but could not be > completed due to your packet screening configuration. Which is ok the way it is. That means I won't change it. > The time of these log entries is 18:47 (CET I suppose) is > very interesting. At > this time the newly arrived suse-security postings arrived > and have been polled > by our internal mail server. Your domain belfin.ch has been > looked up and this > lookup lead to the ipchains log entries you mentioned. Don't worry because of time. This box is not yet ntp synchronised, I 've got a time error. > The log entries have been created because our internal name > server (which > connects to the internet via 212.114.64.130) tried to do a > lookup with a source > port below 1024, and I think you have an ipchains-rule like this: > > ipchains -A input -i eth1 -p udp -s 0.0.0.0/0.0.0.0 1024:65535 -d > your.dns.ip.address 53 -j ACCEPT Ok. That's right. > If so, the log entries have been caused due to your > restriction of the source > ports. exactly. > Our internal name server used and still uses > ports below 1024 and > therefore got > rejected. > I am very sorry if these events worried you, but I assure you > that there's no > black hat behind it, it's just some kind of > "misunderstanding" between our > internal and your external bind...! :-) Happy to hear that. > If you still feel uncomfortable I can provide you with some > log files to show > you the whole story. I'd like to. Just for learning purposes. > Again, we in Landwehr & Partner do apologise for this inconvenience. No Problem. Philipp

1 0

has anyone built a "stateful" firewall w/ the new kernel yet?
by jfweber＠eternal.net 06 Feb '01

06 Feb '01

casting my electrons to the solar winds .... I read somewhere that the newest kernel ( to be releases on Feb 12 w/ suse7.1?) ACn do stateful firewalling. This brings packet filtereing down to a really fine art. I have been waiting for the newest suse release to become available before getting into this bit of making a network work, *safely* ( well okay, it only seems a bit safer for folks who are not 110% knowledable , but this is what we have to work w/ , and for . If only to mitigate any potential liabilities lawyers can dream up <sigh>) since there is so much tweeking to do anyway, I doubt anyone has noticed whether the Suse 7.0 firewall is successful or not. Any guidence on the newest firewalling theory , w/ the newer capabilities, ANd general information will be appreciated. feel free to post to the list or proivately, however, recomendations to go boil my head , will be strictly and cheerfully ignored <G> Blonde j afterthought: Talk is cheap, because supply exceeds demand.

1 0