April 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Permissions rpm directories
by Roman Drahtmueller 03 Apr '01

03 Apr '01

> > > > mkdir -p usr/src/packages > > rpm -ihv schnick.spm > > > > That works. Uh, sorry, I meant rpm -r $HOME -ihv schnick.spm Otherwise, it uses the system paths, and the mkdir is useless. Thanks, Volker. Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

1 0

RE: [suse-security] SuSEfirewall2 / iptables
by Reckhard, Tobias 03 Apr '01

03 Apr '01

> Connection tracking doesn't use flags to determine > if a connection was startet from inside or outside - > and this is the big advantage over ipchains. If a > packet is sent out to initiate a new connection, > an entry is being written to the connection table > to keep track of the connection and possibly allow > the reply froom outside. UDP doesn't use flags, too, > and you can keep track of those sessions as well > as icmp's. > Actually, there is no such thing as a "UDP session." UDP is connectionless by definition and doesn't have any notion of sessions, in contrast to TCP. There are many application layer protocols that implement sessions and use UDP as their transport method, yes, but it's the applications that are session-aware, not the transport layer process. The same applies to ICMP. Stateful filters assume that UDP is used in session fashion by allowing return traffic that matches the inverse socket pair of an allowed packet. However, they are much more susceptible to e.g. IP spoofing attacks, as there is no sequence and acknowledgement number information in UDP to check (not that they are checked in stateful TCP filters either, but they could..). There also doesn't exist any form of connection teardown, since no connection is ever established, so UDP entries to the connection table can only be removed by having them time out (unless you boldly assume that a fixed number of response packets will be received for every 'request'). The ability to grant more security in handling UDP is one of the main advantages of stateful filters compared to basic packet filters. You need to be aware of the fact that their operation is based on assumptions that are not generally true. This shouldn't mean too much of a problem for the most commonly used application layer protocols, but those are only around a handful in number. More obscure protocols or those with TCP/IP information embedded in the data are inherently more difficult to support with statefuls. Just thought I'd throw in a couple of remarks, so people won't blindly think that stateless filters are crap and statefuls are great. The world isn't that simple. Cheers, Tobias

1 0

Permissions rpm directories
by Theo v. Werkhoven 02 Apr '01

02 Apr '01

Hi all, This is more or less one for Roman & Co. Is there a compelling reason why the directories under /usr/src/packages should be world writable and readable? theo:/home/theo $ sudo rpm -ql --dump rpm-3.0.4-0 [..] /usr/src/packages/BUILD 35 953918273 041777 root root 0 0 8772 X /usr/src/packages/RPMS 77 953918273 041777 root root 0 0 597 X /usr/src/packages/RPMS/i386 35 953918273 041777 root root 0 0 0 X /usr/src/packages/RPMS/noarch 35 953918273 041777 root root 0 0 18526 X /usr/src/packages/SOURCES 35 953918273 041777 root root 0 0 18707 X /usr/src/packages/SPECS 35 953918273 041777 root root 0 0 18508 X /usr/src/packages/SRPMS 35 953918273 041777 root root 0 0 18504 X What stops a local from messing with sources, (re)builds, specs etc? Theo

3 4

Sendmail SMTP AUTH / SSL
by Raffy 02 Apr '01

02 Apr '01

Hey list, On my box I have sendmail running. In order to use SMTP over SSL I run it with stunnel in inetd: smpts stream tcp nowait root /usr/local/sbin/stunnel stunnel -D 3 -p /usr/local/ssl/certs/stunnel.pem -r smtp Further I configured sendmail to use SMTP AUTH. Everything works perfect. But: smpts is on port 465. I configured my clients such that they use that port. So far so good. But now port 25 can still be used to send email. I could block it at the firewall but then I am not able to receive email any more, because other mailservers are talking with me on that port. (right?) Is there a solution that I can use SMTP over SSL and SMTP AUTH? Clients should not be able to connect without SSL or SMPT AUTH! Thanks Raffy

19 31

RE: [suse-security] Bind
by Reckhard, Tobias 02 Apr '01

02 Apr '01

> I have the same problem as described below. I´m running SuSE 6.4/bind8.2.2 > for about 1/2 year without any problems. In the last weeks named is going > down first about one time a week up to now every second day - and I can´t > find any hint in the logs...any idea? > Have you tried more extensive logging or perhaps execution in debug mode? That will give you many more hints than are available from the default logging. cya, Tobias

3 2

Bind
by Hipolito A. Gonzalez M. 02 Apr '01

02 Apr '01

I upgrade to the new 8-8.2.3 bind version, but, every morning the daemon "named" is stop. Is any trying to hack me? I have and real ip and I'm making hosting. Thank you. In log nothing appear. -- www.geekcode.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ h! r++ y++ ------END GEEK CODE BLOCK------ - A veces creo que hay vida en otros planetas, y a veces creo que no. En cualquiera de los dos casos, la conclusión es asombrosa (Carl Sagan) -----------------------------------------------------------------

3 3

firewalling
by Ralf Freisinger 02 Apr '01

02 Apr '01

Hello all, following i want to use for internet topology: Internet | eth0 62.153.xxx.190/255.255.255.192 Router outside eth1 (internal DMZ) 62.153.xxx.134/255.255.255.224 | Mailserver (all Server in the DMZ should have official IP's like above eth1 (internal DMZ interface) | DNS-Server | WWW-Server | eth0 62.153.xxx.133/255.255.255.224) to DMZ Router inside/Firewall eth0 (local Lan) 192.168.2.29 | | Local Network (official IPs) It's only an Idea from me, is it possible to set up the DMZ like this, I've an ip-range of 64 addresses ( network 62.153.xxx.128/255.255.255.192) Outside of the DMZ there are more WWW-Server, only one of these should be in the DMZ, because on this host are running some special software. If i try it like this, i've problems with the routing, the DMZ is pingable from the "Router outside" but i can't reach the Internet from this Router. Perhaps some people can help me set up the routing correctly and perhaps could tell (explain) me the mistakes i make! Thanxs a lot greetings Ralf

2 1

iptables
by office＠tride.net 02 Apr '01

02 Apr '01

Hello list, does the SuSEfirewall-script support iptables? cu

3 2

RE: [suse-security] Bind
by Reckhard, Tobias 02 Apr '01

02 Apr '01

Umm, yeah, that's debug mode, but there's a lot more to the logging statement in /etc/named.conf. I'd thought I'd mentioned how to start named in debug mode, but that wasn't to the list. Sorry, my bad. Tobias > -----Original Message----- > From: emm(a)eggler.ch [SMTP:emm@eggler.ch] > Sent: Monday, April 02, 2001 3:24 PM > To: Reckhard, Tobias > Cc: 'hgonzale(a)celularshow.com'; suse-security(a)suse.de > Subject: Re: [suse-security] Bind > > At Mon, 2 Apr 2001 15:19:38 +0200 , "Reckhard, Tobias" > <Reckhard(a)secunet.de> wrote: > > >Check out the contents of /usr/share/doc/packages/bind8. BIND's logging > >config is way beyond the scope of this list. > > sure. but it's no secret and trivial: named -d 9 starts bind the > noisy way. > > regards > emmerich

1 0

Re: [suse-security] Bind
by emm＠eggler.ch 02 Apr '01

02 Apr '01

At Mon, 2 Apr 2001 15:19:38 +0200 , "Reckhard, Tobias" <Reckhard(a)secunet.de> wrote: >Check out the contents of /usr/share/doc/packages/bind8. BIND's logging >config is way beyond the scope of this list. sure. but it's no secret and trivial: named -d 9 starts bind the noisy way. regards emmerich

1 0