April 2001 - openSUSE Security - openSUSE Mailing Lists

[suse-security] SuSEfirewall 4.5 and pptp
by Cameron Mulliner 27 Apr '01

27 Apr '01

Has anyone managed to enable pptp to work whilst using SuSEfirewall? I've managed to get it to work with PMfirewall but keep getting "input DENY ppp0 PROTO=1 192.168.x.x:8 192.168.x.x:0" messages when I use SuSEfirewall which is what i'd prefer to be using. Any ideas or tips would be greatly appreciated. Rgds Cameron

1 0

Security updates.
by Nohez 27 Apr '01

27 Apr '01

Has SuSE released kernel 2.2.19 and samba 2.0.8 ? Most of the other linux distributions have released the kernel. They have some security fixes. Nohez.

3 2

sonicwall firewalls
by Philipp Snizek 27 Apr '01

27 Apr '01

Hi all, did anybody gather some experience with sonicwall firewalls in the past? If yes, what were the results of your evaluations? Thanks in advance Philipp

1 0

SuSEfirewall2 upgrade problem
by Philip Warner 27 Apr '01

27 Apr '01

I have a firwall machine that is also my name server, connected to the internet by semi-permanent PPP links. I have fixed addresses for each end of the PPP link (defined by the ISP), and my own C-class address space for the network: {World}---ISP_ADDR_1:ppp:ISP_ADDR_2---My_Machine(DNS)---MY_ADDR:eth0:---masq network (I hope that makes sense). The masqueraded network is in the same C-class address space as MY_ADDR. This works fine with SuSEfirewall 4.x, but when I try to use SuSEfirewall2, packets sent from the ourside world to my server at MY_ADDR get dropped. The tables seem require that all INPUT traffic be addressed to ISP_ADDR_2. Is there any simple way to allow the server address to be treated in the same way as the ppp link address? ie. allow telnet/www/smtp connections to www.MY_HOST_NAME.com, where www.MY_HOST_NAME.com resolves to MY_ADDR? ---------------------------------------------------------------- Philip Warner | __---_____ Albatross Consulting Pty. Ltd. |----/ - \ (A.B.N. 75 008 659 498) | /(@) ______---_ Tel: (+61) 0500 83 82 81 | _________ \ Fax: (+61) 0500 83 82 82 | ___________ | Http://www.rhyme.com.au | / \| | --________-- PGP key available upon request, | / and from pgp5.ai.mit.edu:11371 |/

1 0

duplicates
by semat 27 Apr '01

27 Apr '01

Is something wrong with the list. I have all of a sudden gotten two copies of all the mails. especially the thread about logging, cybercrimeact and recursive shell scripts. I haven't posted to any of these threads and I am not listed in the recipients. Only the list but I have gotten two copies. I am alone with this problem? regards, Noah.

3 3

FW: [suse-security] sshd lets root login! Bug?
by Marco van Beek 27 Apr '01

27 Apr '01

I have found that using the PermitRootLogin setting in YaST2 doesn't seem to work. I have emailed support about it and am awaiting a reply. It seems to be happy to add in the line when the setting is "yes", but simply deletes the line when you change it, perhaps relying on a default setting that has changed. Or maybe I am just going quietly mad. I ended up having to downgrade the security settings from paranoid to secure because it became pretty much impossible to get into the box and do anything. Great, except all my admin is going to have to be remote, and it appears that the only person who can use sudo under the paranoid setting was root... Getting into the box via sshd is no problem, and using "sudo command" rather than "su root" means you don't have to disclose the root password to administrators, plus what they do is usually caught by the logs. You should also be able to use "sudo rxvt" over ssh to get a secure root X session as well, after logging in as a user. TTFN, Marco van Beek -----Original Message----- From: Geordon VanTassle [SMTP:gvantass@thecoventree.com] Sent: Tuesday, April 24, 2001 7:25 PM To: Robert Sweet; suse-security(a)suse.com Subject: Re: [suse-security] sshd lets root login! Bug? It's just a configuration thing. grep RootLogin /etc/ssh/sshd_config On my firewall, I have PermitRootLogin set to no and I cannot ssh to it as root. However, I *can* ssh as $USER and then su to root. HTH ----- Original Message ----- From: "Robert Sweet" <rsweet(a)socal.rr.com> To: <suse-security(a)suse.com> Sent: Monday, April 23, 2001 10:18 PM Subject: [suse-security] sshd lets root login! Bug? > How can we ssh into a box when root login is disabled. We > have Marc Heuses New Firewall script running on a 7.1 Suse box > using 2.4 kernel. Here are the open ports: > > Starting nmap V. 2.53 by fyodor(a)insecure.org ( > www.insecure.org/nmap/ ) > Interesting ports on YaddaYaddaYadda > (XXXXXXXXXXX): > (The 1516 ports scanned but not shown below are in state: > filtered) > Port State Service > 21/tcp open ftp > 22/tcp open ssh > 25/tcp closed smtp > 53/tcp open domain > 80/tcp open http > 113/tcp closed auth > 123/tcp closed ntp > > Here is root logged on my friend's box locally and me logged > in as root using ssh. > root tty1 Apr 21 11:34 > root tty2 Apr 21 11:38 > root pts/0 Apr 21 11:35 > (My.Box.At.Home) > root pts/1 Apr 21 11:54 > (My.Box.At.Home) > > Here is the output of /etc/securetty on the bad box: > > tty1 > tty2 > tty3 > tty4 > tty5 > tty6 > # for devfs: > vc/1 > vc/2 > vc/3 > vc/4 > vc/5 > vc/6 > > Any help on this one would be appreciated. We have shutdown > sshd for now. Thanks > -- > _ > _ __ _____ _____ ___| |_ > | '__| / __\ \ /\ / / _ \/ _ \ __| > | | _ \__ \\ V V / __/ __/ |_ > |_|(_) |___/ \_/\_/ \___|\___|\__| > rsweet(a)socal.rr.com > "unix soit qui mal y pense." > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

5 7

disk quotas and e-mail
by aavula gautam 27 Apr '01

27 Apr '01

Hi all , i have configured disk quotas. what i really want is that when the user exceeds his quota limit he should be informed about it through a mail....how to do this...? please help Gautam _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

2 1

secumod and harden_suse
by Togan Muftuoglu 27 Apr '01

27 Apr '01

Hi everyone, Just in the process of applying the secumod and harden_suse for my firewall. I have read the README files for secumod. I have decided to use the strict mode. I am bit confused in the order of applying the changes. Could sound silly but I do not want to fight latter on. Here is my action plan add a normal user with sudo rights install seccheck.rpm install harden_suse and run install secumod and configure secumod.rc.config reboot Anything I have to backup or pay attention so latter I will still be able to ssh and administer the box ? TIA -- Togan Muftuoglu

3 4

squid2 acl´s and dynamic IP
by Dirk Ertl 26 Apr '01

26 Apr '01

Hallo folks, for Internet we use squid2. Our clients have static IP-Addresses and access over acl´s in squid.conf. Now we change to dynamic IP -Adresses and we think about using client access by User Account. Maybe User Account form a NT-Server. Is this gonna getcha? Thank´s and greeting from sunny Berlin... and CU :-)) Dirk Ertl email: dirk(a)ertl-bln.de handy: +49 1794926359

3 3

OT?: strange posting
by Michael Blaesse 26 Apr '01

26 Apr '01

Hallo, I don't know if it is off topic, but I wonder how the following posting was generated? [Fwd: [suse-security] Web Based e-mail servers] and also: RE: [suse-security] Firewall Konfiguration I never wrote these posting (I have written the other postings, which you can find searching for messages with "sender contains blaesse". ) . The first posting contains different messages from different mailing lists I am subscribed to: o-info and linux-ug(a)leo.org, but how could I have mixed all these postings? Also I can't remember, that I wrote any mail from the IP number, which is mentioned in the source of the mail. It was an old computer, which I used as a terminal to the SGI workstations of the institute. Unfortunatly I can't look this up, because this computer is no longer working. Has anybody an explanation for this? Michael Blaesse

1 0