February 2001 - openSUSE Security - openSUSE Mailing Lists

Supported Distributions
by Roman Drahtmueller 23 Feb '01

23 Feb '01

-----BEGIN PGP SIGNED MESSAGE----- Effective Monday, March 19 2001, five weeks after the release of the new SuSE-7.1 distribution, SuSE will discontinue support for the SuSE-linux distributions SuSE-6.0 SuSE-6.1 and SuSE-6.2. SuSE puts much effort into adding security improvements (patches) to the software instead of publishing a new version; the same program with a fix for a specific problem promises to work just as reliable as the original version from the distribution, whereas new versions introduce new functionality which changes the behaviour. In some cases however, especially if the security leak is based on problematic design decisions or when the fix(es) are fairly large, the only reasonable fix for a security problem is to update to a newer version of the software. These newer versions tend to become incompatible with our older distribution releases because of missing features in the operating system environment. This forces us to focus on the distributions of a newer release date. The remaining distributions SuSE-6.3, SuSE-6.4, SuSE-7.0 and SuSE-7.1 for the Intel i386, AXP Alpha, SPARC as well as PPC Power PC platforms will continue to be supported for a two-year period after the release of the respective distribution. Regards, SuSE Security. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOpZPwXey5gA9JdPZAQENnQf+NMuY2HQv85EWBujG3/40fktZTEKs+DDi Wkh2M+t8L40UaVZQn52P3UdaWi4KV3WbK0/GK6V3t4xyc8arrrOu+eR3Ipty37Wc GAcXG4Yk1xdIGmI0oUKj0tg1Dy7H7qPHvD+Gt4pLsgy8HPmr3I+Cnzw1fFDpTpt3 4hW0iAOPkHJR3tOJKgEgy3lnckPNQCYG3SyQUU9FR8sTa0/CSkEq+biXb4jPPWYm bQmOZ4oXzy8CM9r5NzqYy+wmI4J0EP9kwDF8Nxgeq7yLKKELCfAUoj8DMy5Zs0PE Gx8sO7tw3hIGy+ppBSjS9Vc+b/9HlWPFmQrmSWdehw1dOhM+i0gLlA== =ms46 -----END PGP SIGNATURE-----

1 0

Saint/pop
by Kurt Seifried 23 Feb '01

23 Feb '01

Lovely, dark grey background with black text. Plesse set your outgoing email to text. Saint is now a lame piece of crud. Go get Nessus. http://www.nessus.org/ Kurt Seifried, seifried(a)securityportal.com Securityportal - your focal point for security on the 'net

2 1

AW: AW: [suse-security] unknow message
by Carsten Blume 23 Feb '01

23 Feb '01

>Það var föstudagur 23 febrúar 2001 13:21 þegar þú skrifaðir: >> Hi, >> >> >Feb 23 13:41:56 upnlr3 kernel: martian destination 00000000 >> >from 1f011f0a, >> >dev eth1 >> >Feb 23 13:43:20 upnlr3 kernel: martian destination 00000000 >> >from 1f011f0a, >> >dev eth1 >> >> 1f011f0a >> 1f -> 31 >> 01 -> 1 >> 1f -> 31 >> 0a -> 10 >> -> IP 10.31.1.31 >> >> Greetings >> Carsten Blume >> > >Eh ? > >Since ? > >I think you got it backwards :-) > >It's IP 31.1.31.10 > >or: 31*256³ -> 0x1f000000 > 01*256² -> 0x00010000 > 31*256¹ -> 0x00001f00 > 10*256° -> 0x00000010 > > ----------------------- > 0x1f011f10 :-) sorry, but you are wrong ... another example from one of my logs Feb 16 04:00:15 fw1 kernel: martian destination 00000000 from ba0a0a0a, dev eth1 and this is 10.10.10.186 or Feb 13 14:50:05 fw1 kernel: martian source 13826d3e for ff826d3e, dev eth1 -> source 62.109.130.19 for 62.109.130.255 so i think backwards is the right way ;-) Carsten

2 1

AW: [suse-security] unknow message
by Carsten Blume 23 Feb '01

23 Feb '01

Hi, >Feb 23 13:41:56 upnlr3 kernel: martian destination 00000000 >from 1f011f0a, >dev eth1 >Feb 23 13:43:20 upnlr3 kernel: martian destination 00000000 >from 1f011f0a, >dev eth1 1f011f0a 1f -> 31 01 -> 1 1f -> 31 0a -> 10 -> IP 10.31.1.31 Greetings Carsten Blume

2 1

unknow message
by Markus Malina 23 Feb '01

23 Feb '01

hi all, does any one know this ? >snip Feb 23 13:41:56 upnlr3 kernel: martian destination 00000000 from 1f011f0a, dev eth1 Feb 23 13:43:20 upnlr3 kernel: martian destination 00000000 from 1f011f0a, dev eth1 > arp ? IPv6? thankx Markus

2 1

Making Backup with SuSE-Linux
by RoMaN SoFt / LLFB!! 23 Feb '01

23 Feb '01

Sorry if this issue has been discused here (may be a FAQ). I've been given a HP Colorado IDE tape and I want to set a backup system in my Linux using it. I'd like to know if SuSE ships any kind of backup software and which is your prefered one. I'd also like to hear about any other backup software for Linux you recommend to me. Thanks in advance. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

6 7

TLS or SMTP AUTH?
by Nix 23 Feb '01

23 Feb '01

Has anyone implemented TLS on SuSE? Failing that I need to be able to do SMTP after POP to auth the connection. From http://www.suse.de/en/produkte/solutions/imap2/features.html it looks like the SuSE email server II supports it, but I can't seem to find any info about it on normal SuSE Pro. Has anyone done this? I have found some sites like http://mail.cc.umanitoba.ca/drac/pop.html http://www.sendmail.org/~ca/email/starttls.html But, I would prefer not to recompile lots of stuff if I don't have to.. Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

3 6

RE: new e-mail accounts (group 500 users)
by Rolf Angerbauer 23 Feb '01

23 Feb '01

Hi Philipp, you can set the shell for the mail-only users from i.e. /bin/bash to /bin/false or any other not existent program. Have a look at your /etc/passwd and edit as mentioned. This user cant't login without having a valid shell. POP3 and SMTP still works fine for those users. If you like users only to not use your sshd, go to your sshd config file (/etc/ssh/sshd_config) You can use the "DenyUsers" sshd directive. entries are separated by spaces, like this: DenyUsers user1 user2 user3 OK? Rolf -----Original Message----- From: Philipp Snizek [mailto:mailinglists@belfin.ch] Sent: Friday, February 23, 2001 8:02 AM To: suse-security(a)suse.com Subject: new e-mail accounts (group 500 users) Dear list-users, If I make a new e-mail account for my sendmail it's the same as if I made a new user account for the mail server. People could login e.g. through ssh. How can I restrict access to only just the corresponding e-mail account so users could not log on to the mail server by a terminal client? Thank you Philipp

1 0

iptables and conntrack
by Marco Ahrendt 23 Feb '01

23 Feb '01

Hi all, I want to set up a firewall to secure my private network. This network includes about 5-6 computers running linux and windows os. I decided to use netfilter (iptables) with the new 2.4.2 kernel which I compiled on my pentium today. Now I have a question about the new iptables and the connection tracking module: I want to set a default policy for all chains (at first INPUT,OUTPUT and FORWARD) to DENY. Now for example I want to allow a ssh connection from the internet to my firewall. (I want the firewall to be the gate to my local linux computers. I mean, if anyone wants to ssh to my private computers, he only can get a connection if he first connects to the firewall, and then connect to the target computer in my network.) Is this a good idea ? So I don't have to allow ssh to any of my computers in the local net. Only to the firewall! What do you think about this? Now the problem: If I use connection tracking for ssh. iptables -A INPUT -p tcp --dport 22 -s 0.0.0.0/0 -d $FIREWALLHOST -m state --state NEW,ESTABLISHED,RELATED -i eth0 -j ACCEPT In this rule I would accept all connections coming from internet to my firewall at port 22 and all packets in relation with this connect. Right?! Should I now add a rule to the OUTPUT chain too, or is any outgoing connection in relation with the ssh rule INPUT above accepted now? thanks for your help, Marco -- Marco Ahrendt phone : +49-341-98-474-0 adconsys AG fax : +49-341-98-474-59 Karl-Liebknecht-Str. 19 email : marco.ahrendt(a)adconsys.de 04107 Leipzig/Germany gnupg key at www.aktex.net/marco_work.asc

2 1

Missing From (was: Re: [suse-security] Firewall Konfiguration)
by Jan.Trippler＠t-online.de 22 Feb '01

22 Feb '01

On Mit, Feb 21, 2001 at 06:11:59 +0100, suse-security-return-5777-Jan.Trippler=t-online.de(a)lists.suse.com wrote: [...] You see the problem? What's wrong with it? The sender's name was Bjoern I think. Why can't I see a From: and why can't I see any hint in the mail header to the poster? Is it a mistake in my mail config? If not I'd like to send such mails to my /dev/null :-( Jan

2 3