April 2001 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

Re: AW: [suse-security] What are these services?
by Marko Kaening 02 May '01

02 May '01

Thanks for all the replies up to now! > i don't know any service on port 1024 I should look closely at this port next time I meet it and detect the owner of the process using that port. Thanks to advice! > this is what i found about port 1987 > > tr-rsrb-p1 1987/tcp #cisco RSRB Priority 1 port > tr-rsrb-p1 1987/udp #cisco RSRB Priority 1 port > > maybe one of the cisco guys know what this service > is exactly for. Well, that would be great to know what hides behind this... Funny, I have SuSE 6.3 with Firewall4.4 and I don't think that such ports should be usable... Marko

2 3

What are these services?
by Marko Kaening 30 Apr '01

30 Apr '01

Hi, running nmap lately on my host revealed some open ports which I couldn't really identify: 1) port 1987 with service named something like "trsrb-p1" (don't remember the name exactly, since the open port vanished after a while) 2) port 1024 with service "unknown" What are those ports used for? Especially the first one with that strange name I have never seen so far... I coudln't find any hints in /etc/inetd.conf nor in /etc/services. Regards, Marko

4 3

Netsaint Network monitoring
by Steffen Dettmer 30 Apr '01

30 Apr '01

Hi, I just looked to netsaint and I like it :) I set it up a little, first some PING and other network-based tests only. Now I want to collect remote informations (i.e. load). The onliest possibility are SSH connects. It's not practicable to install some "sensors" or so remotly, at least not manually or as deamon. I would like to ssh connect a single (!) script which gaters the informations. I think such a script (perl or shell) should exists, but I haven't found one. I have not found informations how to collect such informations remotly in a secure manner. Could somebody point me to some informations? oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.

2 1

Recursive Shellscript
by Peer-Christoph Mettelem 29 Apr '01

29 Apr '01

Hi, I just wrote a shell script which looks like this: while true do $0 done I executed it as normal user and then the following happened: As you can imagine, very many shells were started (i wasnt able to count them because the system wasnt responding any more). And then the system started killing system processes like X and smbd. I got the following output on console 10: Apr 23 09:11:54 AlBundy kernel: VM: killing process kmail Apr 23 09:12:52 AlBundy kernel: VM: killing process smbd Apr 23 09:13:03 AlBundy kernel: VM: killing process smbd Apr 23 09:13:05 AlBundy kernel: VM: killing process xconsole Apr 23 09:13:13 AlBundy kernel: VM: killing process X The system recovered itself by killing X. That worked because i started the script from a shell in KDE. But if the script would be started within a telnet session, it could be more dangerous. I dont know if this is a security hole, but it might be. My system: SuSE 7.0 (kernel 2.2.18) Lots of updates and patches installed PII 350 MHz 320 MB RAM Peer-Christoph Mettelem BezRegMS (NRW, Germany) Software developer (trainee) PS.: This is my first mail to the mailing list. Sorry if its OT or something...

12 21

Kerberos...
by omicron 28 Apr '01

28 Apr '01

hello all, i have a single linux workstation and i want to learn kerberos. Is it enough (and safe) to atleast know the basics ? regards omicron -- ****** omicron Mail:omicron@omicron.dyndns.org (Sridhar N) www:omicron.symonds.net pubkeys:omicron.symonds.net/pubkeys C O G I T O E R G O S U M ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Cybercrimeact
by jochen mader 28 Apr '01

28 Apr '01

Has anybody here read about the european cybercrime act? It distrubs me quite much to not have seen anything on slashdot and in this list about it. Do you no what impact this thing will have on our work? It will make our work nearly impossible by making it illegal to use tools like nmap, nessus, statan under ANY circumstances. This thing will become a LAW within the next few weeks (probably months). It has got that far that there is only one voting left to make it a law, and there is nobody there who knows a thing about security and privacy and they will harm ALL of us. Regards Jochen P.S.: The draft is located here http://stars.coe.int/doc/doc01/EDOC9031.htm

5 5

squid behind SuSEfirewall using an ADSL connection
by Volker Widlok 28 Apr '01

28 Apr '01

Hi, I was running in the following trouble. At first a systemdescription: SuSE 7.1 Kernel 2.2.18 (not recompiled), squid 2.3STABLE4, Ethernet to DSL-Modem using pppoed, Network Devices: eth0 Intranet, eth1 - ppp0 Internet. Everything works fine after startup the system and connecting to my provider using the "Internet Dial-In" . Firewall and squid are comming up automatically at boottime (controlled by rc.config) but the dialup itself is done manually (using the icon down right in KDE2 after configuring ADSL with yast2). My provider (Verizon) have no Proxy, but two DNS-Servers. All entries are done properly after dialin (/etc/resolv.conf etc.). So, when I disconnect, using this icon down right (or stopping the pppoe service on commandline) and reconnecting I have no response from the internet and I receive the following in my "/var/log/messages": Apr 27 16:56:37 l7boston kernel: Packet log: input DENY ppp0 PROTO=17 151.202.0.84:53 151.203.123.246:1077 L=246 S=0x00 I=48363 F=0x4000 T=248 (#112) repeat interval is about 5 seconds. Seems to be fine because my firewall works pretty good - too good. So, I tried the following: 1. restarting squid -> everything works fine 2. When I cut the connection (without doing '1.') and edit my "/etc/rc.config.d/firewall.rc.config" making the follwoing adjustment: FW_SERVICES_EXTERNAL_UDP="1077" (the port rejected from firewall in the messages file) and reconnect, everithing works fine. 3. restarting squid after doing '2.' results in the following message Apr 27 16:56:37 l7boston kernel: Packet log: input DENY ppp0 PROTO=17 151.202.0.84:53 151.203.123.246:1078 L=246 S=0x00 I=48363 F=0x4000 T=248 (#112) Look at the port. At this time it is 1078. When I try commandline tools like nslookup it works. I can change the browser settings (netscape or konqueror) to direct internet connection and everything works fine. Who knows a solution or is that a feature ? best regards (oder auch viele Gruesse) Volker -- volker.widlok(a)verizon.net Peabody, MA 01960

2 1

Syslog parser
by Alexander Bien 28 Apr '01

28 Apr '01

Hi Folks, Lets say u have one machine that is a log server for several others. Can anyone recommend a good script / tool / whatever to parse the logfile and extract relevant information out of it? I have tried several allready, but id like to hear opinions of ppl who allready used remote loggin for a while .. im pretty new to this. -- Mit freundlichen Grüßen Alexander Bien -- PIRONET NDH Alexander Bien - Technical Assistant - SBU Services Josef-Lammerting-Allee 14-18, 50933 Cologne - Germany Tel.: +49 (0)172 7760569 - Fax: +49 (0)221 770 2815 mailto:abien@pironet.com - http://www.pironet-ndh.com

5 4

upgrade??
by Jesse yep 27 Apr '01

27 Apr '01

Hello everyone, Ok, I have just installed SuSE 6.4 and have been updating it for the past 2 days. I have every new programs/file/doc you can probably think of. Of course I wouldn't have every new programing from the new version of SuSE 7.1. I was wondering if it would be a good idea to upgrade? (I want to upgrade kernels too, that I will do in time). __________________________________________________ Do You Yahoo!? Yahoo! Auctions - buy the things you want at great prices http://auctions.yahoo.com/

1 0

[suse-security] SuSEfirewall 4.5 and pptp
by Cameron Mulliner 27 Apr '01

27 Apr '01

Has anyone managed to enable pptp to work whilst using SuSEfirewall? I've managed to get it to work with PMfirewall but keep getting "input DENY ppp0 PROTO=1 192.168.x.x:8 192.168.x.x:0" messages when I use SuSEfirewall which is what i'd prefer to be using. Any ideas or tips would be greatly appreciated. Rgds Cameron

1 0

Security updates.
by Nohez 27 Apr '01

27 Apr '01

Has SuSE released kernel 2.2.19 and samba 2.0.8 ? Most of the other linux distributions have released the kernel. They have some security fixes. Nohez.

3 2

sonicwall firewalls
by Philipp Snizek 27 Apr '01

27 Apr '01

Hi all, did anybody gather some experience with sonicwall firewalls in the past? If yes, what were the results of your evaluations? Thanks in advance Philipp

1 0

SuSEfirewall2 upgrade problem
by Philip Warner 27 Apr '01

27 Apr '01

I have a firwall machine that is also my name server, connected to the internet by semi-permanent PPP links. I have fixed addresses for each end of the PPP link (defined by the ISP), and my own C-class address space for the network: {World}---ISP_ADDR_1:ppp:ISP_ADDR_2---My_Machine(DNS)---MY_ADDR:eth0:---masq network (I hope that makes sense). The masqueraded network is in the same C-class address space as MY_ADDR. This works fine with SuSEfirewall 4.x, but when I try to use SuSEfirewall2, packets sent from the ourside world to my server at MY_ADDR get dropped. The tables seem require that all INPUT traffic be addressed to ISP_ADDR_2. Is there any simple way to allow the server address to be treated in the same way as the ppp link address? ie. allow telnet/www/smtp connections to www.MY_HOST_NAME.com, where www.MY_HOST_NAME.com resolves to MY_ADDR? ---------------------------------------------------------------- Philip Warner | __---_____ Albatross Consulting Pty. Ltd. |----/ - \ (A.B.N. 75 008 659 498) | /(@) ______---_ Tel: (+61) 0500 83 82 81 | _________ \ Fax: (+61) 0500 83 82 82 | ___________ | Http://www.rhyme.com.au | / \| | --________-- PGP key available upon request, | / and from pgp5.ai.mit.edu:11371 |/

1 0

duplicates
by semat 27 Apr '01

27 Apr '01

Is something wrong with the list. I have all of a sudden gotten two copies of all the mails. especially the thread about logging, cybercrimeact and recursive shell scripts. I haven't posted to any of these threads and I am not listed in the recipients. Only the list but I have gotten two copies. I am alone with this problem? regards, Noah.

3 3

FW: [suse-security] sshd lets root login! Bug?
by Marco van Beek 27 Apr '01

27 Apr '01

I have found that using the PermitRootLogin setting in YaST2 doesn't seem to work. I have emailed support about it and am awaiting a reply. It seems to be happy to add in the line when the setting is "yes", but simply deletes the line when you change it, perhaps relying on a default setting that has changed. Or maybe I am just going quietly mad. I ended up having to downgrade the security settings from paranoid to secure because it became pretty much impossible to get into the box and do anything. Great, except all my admin is going to have to be remote, and it appears that the only person who can use sudo under the paranoid setting was root... Getting into the box via sshd is no problem, and using "sudo command" rather than "su root" means you don't have to disclose the root password to administrators, plus what they do is usually caught by the logs. You should also be able to use "sudo rxvt" over ssh to get a secure root X session as well, after logging in as a user. TTFN, Marco van Beek -----Original Message----- From: Geordon VanTassle [SMTP:gvantass@thecoventree.com] Sent: Tuesday, April 24, 2001 7:25 PM To: Robert Sweet; suse-security(a)suse.com Subject: Re: [suse-security] sshd lets root login! Bug? It's just a configuration thing. grep RootLogin /etc/ssh/sshd_config On my firewall, I have PermitRootLogin set to no and I cannot ssh to it as root. However, I *can* ssh as $USER and then su to root. HTH ----- Original Message ----- From: "Robert Sweet" <rsweet(a)socal.rr.com> To: <suse-security(a)suse.com> Sent: Monday, April 23, 2001 10:18 PM Subject: [suse-security] sshd lets root login! Bug? > How can we ssh into a box when root login is disabled. We > have Marc Heuses New Firewall script running on a 7.1 Suse box > using 2.4 kernel. Here are the open ports: > > Starting nmap V. 2.53 by fyodor(a)insecure.org ( > www.insecure.org/nmap/ ) > Interesting ports on YaddaYaddaYadda > (XXXXXXXXXXX): > (The 1516 ports scanned but not shown below are in state: > filtered) > Port State Service > 21/tcp open ftp > 22/tcp open ssh > 25/tcp closed smtp > 53/tcp open domain > 80/tcp open http > 113/tcp closed auth > 123/tcp closed ntp > > Here is root logged on my friend's box locally and me logged > in as root using ssh. > root tty1 Apr 21 11:34 > root tty2 Apr 21 11:38 > root pts/0 Apr 21 11:35 > (My.Box.At.Home) > root pts/1 Apr 21 11:54 > (My.Box.At.Home) > > Here is the output of /etc/securetty on the bad box: > > tty1 > tty2 > tty3 > tty4 > tty5 > tty6 > # for devfs: > vc/1 > vc/2 > vc/3 > vc/4 > vc/5 > vc/6 > > Any help on this one would be appreciated. We have shutdown > sshd for now. Thanks > -- > _ > _ __ _____ _____ ___| |_ > | '__| / __\ \ /\ / / _ \/ _ \ __| > | | _ \__ \\ V V / __/ __/ |_ > |_|(_) |___/ \_/\_/ \___|\___|\__| > rsweet(a)socal.rr.com > "unix soit qui mal y pense." > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

5 7

disk quotas and e-mail
by aavula gautam 27 Apr '01

27 Apr '01

Hi all , i have configured disk quotas. what i really want is that when the user exceeds his quota limit he should be informed about it through a mail....how to do this...? please help Gautam _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

2 1

secumod and harden_suse
by Togan Muftuoglu 27 Apr '01

27 Apr '01

Hi everyone, Just in the process of applying the secumod and harden_suse for my firewall. I have read the README files for secumod. I have decided to use the strict mode. I am bit confused in the order of applying the changes. Could sound silly but I do not want to fight latter on. Here is my action plan add a normal user with sudo rights install seccheck.rpm install harden_suse and run install secumod and configure secumod.rc.config reboot Anything I have to backup or pay attention so latter I will still be able to ssh and administer the box ? TIA -- Togan Muftuoglu

3 4

squid2 acl´s and dynamic IP
by Dirk Ertl 26 Apr '01

26 Apr '01

Hallo folks, for Internet we use squid2. Our clients have static IP-Addresses and access over acl´s in squid.conf. Now we change to dynamic IP -Adresses and we think about using client access by User Account. Maybe User Account form a NT-Server. Is this gonna getcha? Thank´s and greeting from sunny Berlin... and CU :-)) Dirk Ertl email: dirk(a)ertl-bln.de handy: +49 1794926359

3 3

OT?: strange posting
by Michael Blaesse 26 Apr '01

26 Apr '01

Hallo, I don't know if it is off topic, but I wonder how the following posting was generated? [Fwd: [suse-security] Web Based e-mail servers] and also: RE: [suse-security] Firewall Konfiguration I never wrote these posting (I have written the other postings, which you can find searching for messages with "sender contains blaesse". ) . The first posting contains different messages from different mailing lists I am subscribed to: o-info and linux-ug(a)leo.org, but how could I have mixed all these postings? Also I can't remember, that I wrote any mail from the IP number, which is mentioned in the source of the mail. It was an old computer, which I used as a terminal to the SGI workstations of the institute. Unfortunatly I can't look this up, because this computer is no longer working. Has anybody an explanation for this? Michael Blaesse

1 0

AW: [suse-security] squid2 acl´s and dynamic IP
by Dirk Ertl 26 Apr '01

26 Apr '01

Hy Peter, thanks for your TIP: It´s Rock and Roll.Work´s fantastico. I think that´s just the way for NT network. So have a good time CU :-)) -----Ursprüngliche Nachricht----- Von: Peter Wiersig [mailto:wiersig@glamus.de] Gesendet: Montag, 23. April 2001 19:39 An: Dirk Ertl Betreff: Re: [suse-security] squid2 acl´s and dynamic IP Hallo Dirk, in den Sourcen von squid (ich glaube 2.1) habe ich mal ein Auth-"Plugin" fuer WinNT-Benutzerauthentifizierung gesehen, es aber nie ausprobiert. Peter Wiersig --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Dirk Ertl email: dirk(a)ertl-bln.de handy: +49 1794926359

1 0

[suse-security] nis+
by da_bug 26 Apr '01

26 Apr '01

hi! I want to use a service like nis in my linux-network but I think this is not really secure... (or is it?) Is there a way to use nis+ or something like this with x86-linux-server and linux-clients (I heard there is only a sever-version for sun...) ? bye.

4 4

logins in messages
by Rolf Schmid 26 Apr '01

26 Apr '01

Hello, in erlier versions of SuSE I had all logins via telnet or by the console in /var/log/messages: Apr 25 11:54:22 linux in.telnetd[6815]: connect from r1.sp.de Apr 25 11:54:26 linux login[6816]: ROOT LOGIN on `ttyp0' from `r1.sp.de' Now in SuSE 7.1 I don't get these entries. Does anybody know how to setup this logging ? Best regards Rolf Schmid

2 1

Suse firewall prevents dhcp
by gabriel rivera 26 Apr '01

26 Apr '01

Hello all, I have an internal fileserver that times out when attempting to get an IP from the dhcp server on startup. >From the log of the dhcp server: warhead dhcpd: DHCPDISCOVER from 00:60:67:22:bf:2d via eth1 warhead dhcpd: DHCPOFFER on 192.168.1.4 to 00:60:67:22:bf:2d via eth1 warhead kernel: Packet log: input DENY eth1 PROTO=17 192.168.1.1:67 255.255.255.255:68 L=328 S=0x00 I=58791 F=0x0000 T=64 (#6) A Why is the client host sending a broadcast packet to the bootp port? (I think this is what is happening). It is not configured to use bootp. Even when the firewall is config'd to allow bootp, the problem persists due to the source address of the packet. Any Ideas?? Thanks, Gabriel Rivera

4 3

Cascade FTP Proxy -> FTP Proxy
by Dirk Ertl 25 Apr '01

25 Apr '01

Helo folks, in our network we have a FTP Proxy for outgoing traffic. Now we have to bind a new Subnet with FTP traffic to the Internet. Default is to bind this Subnet with an FTP Proxy SuSE Suite. I´am in trouble to cascade these FTP Proxy´s. How is the right way in /etc/proxy-suite/ftp-proxy.conf? I tried with transparent or with listen on 0.0.0.0. With MagicUser Yes @theotherproxy.com:21 Is someone use Proxy cascade like this? Thank´s for support... Dirk Ertl email: dirk(a)ertl-bln.de handy: +49 1794926359

1 0