February 2001 - openSUSE Security - openSUSE Mailing Lists

Root logins with ssh
by RoMaN SoFt / LLFB!! 05 Feb '01

05 Feb '01

Hi. I've been using root logins with ssh. Since ssh goes encrypted I don't know why this could be a security problem (question 1: please confirm that). Anyway I've decided to change into the more (supposed) secure way: no root logins. I've done it. This is my current config: roman@goliat:~ > rpm -qa |grep ssh openssh-1.2.2-30 (yep, it's buggy, but I don't use scp & similiar) roman@goliat:~ > cat /etc/SuSE-release SuSE Linux 6.4 (i386) VERSION = 6.4 root@goliat:/etc/ssh > grep PermitRoot sshd_config PermitRootLogin no Nevertheless I've noted the following behaviour when trying to login as root: 1) If supplied passwd is incorrect, sshd tell so. 2) If supplied passwd is right, you get: ROOT LOGIN REFUSED FROM roman So you could try to guest root passwd by brute force attack. I don't like that. Is this corrected on newer versions? Please, any comments are welcome. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 2

ISDNlog
by Richard 03 Feb '01

03 Feb '01

Dear All Myself and a friend have been trying to work out how to close port 20011 which is the ISDN log port on my machine. Can't get any ideas from the SuSE manual or or from YaST. Can anyone give me a clue about this ? Thanks Richard

2 4

ICMP filter in SuSEfirewall? (again)
by Rick Green 03 Feb '01

03 Feb '01

I posed this questin a few days ago. I got no response, so I've been digging, and maybe I can ask a slightly different question. System: SuSE 6.4 running SuSEfirewall 4.2 Symptom: Output DENY messages when sending mail. I've also sometimes seen these directed at my ISP's DNS servers. When sending mail, I get four repetitions of the following, but the mail goes thru: output DENY ppp0 PROTO=1 my.ip.ad.dr:3 isp.smtp.ip.addr:3 L=108 S=0xC0 I=5893 F=0x0000 T= After reading thru SuSEfirewall, I discovered that the messages disappear when I set FW_ALLOW_FW_TRACEROUTE = "yes" , although my reading of the script looks like they're still being denied by the '# deny all other type 3' rule, which isn't logged. So it's transparent, with the same effect. I tried hacking the script, moving the $DENY port-unreachable $LDC just outside the bracket, and changing it to $ACCEPT port-unreachable $LAC. Now I can turn off FW_ALLOW_FW_TRACEROUTE again. I'm still invisible to traceroute, and sending mail gives me just one message in the log: output ACCEPT ppp0 PROTO=1 64.79.87.98:3 64.79.64.32:3 L=108 S=0xC0 I=26218 F=0x0000 T=255 (#3) The destination address is my ISP's mail relay host. So now my mail is going out without the delay of waiting for four timeouts. But I still have the question of what is going on here? I have not been able to find any documentation of the various parameters displayed with the log message. What port is my ISP's mail host trying to connect to, and why? Is this normal smtp behaviour? Can someone point me to the RFC that defines all the ICMP sub-types? -- Rick Green

7 7

Bingo! <cross-posted> Re: my apsfilter environment messed up
by dproc＠dol.net 02 Feb '01

02 Feb '01

On Fri, 02 Feb 2001, Peter wrote off-list: > dproc(a)dol.net: > > My permission checks follow: > > > chmod g+ -v /usr > > mode of /usr retained as 0765 (rwxrw-r-x) > > > These look ok to me. > > /usr looks odd. why not 755? or 775 if needed. but a directory should have > execution permission set. > Thank you for your eagle eyes Peter, that was exactly it. I will leave until some day I am surfing the kernel sources to ask why unsetting the group execute permission on /usr only affected 'lp' and then only as a daemon child. Others may want to ask if it was dproc's carelessness that caused the problem, or something in harden_suse. Me - I am deliriously happy to be printing. Bye.

1 0

Porn/Xrate-Filter
by Matthias Jaenichen 02 Feb '01

02 Feb '01

Hi, is there any tool to filter pron and other rated sites and/or contents? We want to provide a S.u.S.E-based firewall for a school and think we must at least make it difficult to access any rated content. Reg. Matthias Jänichen

7 7

LDAP/Active Directory
by Alexander Seitz 02 Feb '01

02 Feb '01

Hi Folks, i am wondering if anyone has ever tried to authenticate user logins on a unix box against Microsofts Active Directory. Microsofts Active Dir is somewhat simmilar to open LDAP, at least it can be accessd over LDAP from let's say Outlook but using some obscure authentication/encryption mechanism. (probably Kerberos). But I didn't have luck to access ist from a linux box, probably i am missing kerberos encryption in my openldap libraries. Has anyone had any luck in doing something like that ? Or is it impossible or probably do i have to wait for ServicePack II for Win2000, i heard they will be fixing some Ldap compatibility problems in this release. Thanks in advance Ing. Alexander Seitz (Alexander.Seitz(a)fhs-hagenberg.ac.at) System Administrator (sysadmin(a)fhs-hagenberg.ac.at) FHS Hagenberg (www.fhs-hagenberg.ac.at) Hauptstrasse 117 4232 Hagenberg AUSTRIA

1 0

Re: [suse-security] Transparent proxy ...
by Richard Ems 02 Feb '01

02 Feb '01

Hi Frank! Mi idea was to build a Firewall where PC1 would ONLY do packet filtering (masq, forw, redir, etc.) and PC2 would do the rest (snmp server, pop server, proxy server, dns server, etc.) Also the hardware is very different on both PC's: PC1: 1 x 700 Mhz, 64 MB RAM, IDE PC2: 2 x 700 Mhz, 512 MB RAM, SCSI, more disk space than PC1 mmmm, now I'm not so sure ... What do you think? Richard Frank Stuehmer wrote: > Hi Richard, > why you don't install squid at PC1 ? > There are good reasons in the howtos why installing proxies on firewalls. > With your configuration you should allow routing between Internet an local > LAN for http, https and ftp. > Squid in transparent mode is nice only for http neither ftp nor https. > Frank > > ----- Original Message ----- > From: "Richard Ems" <r.ems.mtg(a)gmx.net> > To: <suse-security(a)suse.com> > Sent: Friday, February 02, 2001 3:01 PM > Subject: [suse-security] Transparent proxy ... > > > Hi all! > > > > Here my scenario: > > > > > > Internet > > | > > | > > | > > PC1: Packet Filtering ---------+ > > > > SWITCH------- Internal LAN > > PC2: SQUID Proxy Server ------+ > > Mail Server > > DNS caching only server > > > > What I'm trying to configure is a kind of port forwarding from PC1 to > > PC2. Is this possible? > > HTTP, HTTPS, and FTP should be redirected from PC1 to PC2 (e.g. PC1:80 > > to PC2:3128) > > > > I've searched in the archives, read the HOWTO's but didn't find any > > answer? > > > > Any help would be VERY appreciated ! > > > > Thanks, Richard > > > > -- > > Richard Ems > > ... e-mail: r.ems(a)gmx.net > > ... Fachbereich Informatik, Universität Hamburg > > > > Unix IS user friendly. It's just selective about who its friends are. > > > > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > -- Richard Ems ... e-mail: r.ems(a)gmx.net ... Fachbereich Informatik, Universität Hamburg Unix IS user friendly. It's just selective about who its friends are.

3 2

All in one box ! Is it a good solution ?
by Pascal MiQUET 02 Feb '01

02 Feb '01

Hello, One of my friend ask me several questions concerning the security of a small company. He'll get in few days an ADSL connection. For some costs purposes (I think) this connection will shared with another company. The goal is to get a Mail server, Web access, ...and share all this with his LAN I've suggested to set a Firewall like ipchains, first to be realy separated from the network of the other compagny; Does it make sense to set the Mail server on the same machine ? How does this will be setted because I think all Mail clients will be Macs ? Thanks for your help Bests Pascal MiQUET

1 0

Re: [suse-security] strange file in /usr/bin
by Jan Räther 02 Feb '01

02 Feb '01

> > > i think i found the answer myself.... 5n0r7 is a snort log analyzer..... and > > right, but > > > port 20011 is because of netatalk..... > > root@sonnie:/home/abre > fuser -v 20011/tcp > > USER PID ACCESS COMMAND > 20011/tcp root 156 f.... isdnlog > > You see isdnlog is listening on 20011 (default). yes you are right, i was just playing around with netatalk and i think i saw Port 20011 there.... but after issuing your command above i got almost the same output.... Jan

1 0

Transparent proxy ...
by Richard Ems 02 Feb '01

02 Feb '01

Hi all! Here my scenario: Internet | | | PC1: Packet Filtering ---------+ SWITCH------- Internal LAN PC2: SQUID Proxy Server ------+ Mail Server DNS caching only server What I'm trying to configure is a kind of port forwarding from PC1 to PC2. Is this possible? HTTP, HTTPS, and FTP should be redirected from PC1 to PC2 (e.g. PC1:80 to PC2:3128) I've searched in the archives, read the HOWTO's but didn't find any answer? Any help would be VERY appreciated ! Thanks, Richard -- Richard Ems ... e-mail: r.ems(a)gmx.net ... Fachbereich Informatik, Universität Hamburg Unix IS user friendly. It's just selective about who its friends are.

4 3