May 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Kernel RPMs
by Nix 13 May '01

13 May '01

I just like to congratulate Roman, Hubert and SuSE for a job well done. I have just applied the kernel update rpms to a couple of my machines including my Toshiba Notebook, which if anything was going to have problems, it would have, and everything went perfectly smoothly. I didn't even have to do a --force etc Note: I am actually running self compiled 2.4.4 kernels on all boxes, so I would not have been surprised to have something complain. As some of you may have noticed, Roman's email had a timestamp of "Date: Sat, 12 May 2001 06:32:57 +0200 (MEST)" It is this level of dedication that SuSE should be praised for, and is the reason why I recommend SuSE Linux to anyone I meet. Roman, (unlike some previous announcements) your email had a step by step installation procedure taking into account several different possibilities. This i great, and it's exactly this level of attention to detail that puts SuSE linux above any other OS that I had the misfortune to have to use. (Including some "other" Linux distros that exhibit almost as many unexplainable quirks as the Microsoft world.) Many Thanks --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

2 1

2.2.19 kernels out - apparently - md5sum please
by dproc 12 May '01

12 May '01

I see that a set of 2.2.19 kernel (and module) rpms and source rpms just arrived in the update/6.3/kernel of ftp.suse.com (Although I guess it will be 24h wait to see it on the sourceforge mirror, and ftp.suse.com is VERY busy tonight.) I wait for a signed md5sum to be posted so I can verify I am not a victim of dns poisoning and a fake site+binary. When will this be posted? (I think the rpms are themselves now signed , but I can't figure out how to use rpm --checksig with my pgp keyring, so I want to verify the old way.) HALOF, dproc

2 2

FTP Server and Updates, a little bit OT
by Torsten Mueller 12 May '01

12 May '01

Hey, i have only a little point which i can't understand. In my local LAN i provide a FTP Server with the the Suse install dirs to easily install other clients with Suse. To always have the most up to date binaries i mirror the changes from a mirror-Server of ftp.suse.com (the update dir) Are there problems, if i copy the update rpm's directly into the "ftp install hierarchy" ? And if there are no problems, wouldn't it be better to handle it also on the public ftp servers ? I know it's a little bit OT, but everyone want the newest and more secure software as simple as possible. Sorry for my english. Greetings Torsten

1 0

Re: [suse-security] Kernel security
by Martin Peikert 11 May '01

11 May '01

Martin Fahlgren <martin(a)as3-1-1.hn.g.bonet.se> wrote: > > > On 8 May 2001, Martin Peikert wrote: > >> Martin Fahlgren <martin(a)as3-1-1.hn.g.bonet.se> wrote: > >> > This is probably the "worst" exploit up to now and a big problem >> > for all networks with many login accounts (web sites, schools, >> > universities etc). >> > >> > So the options I have are >> > 1) Compile and install my own kernel >> > 2) Disable logins until SuSE comes with a new kernel >> > 3) Switch to a distribution which provides the necessary updates >> >> You are kidding, aren't you? > > Why do you think that I'm kidding? We are talking about a very nasty > exploit which I already has been used in practice, and measures > must be taken to stop it. > > Do you have other options better than "my" 3 alternatives. I can > see another alternative: Kernel 2.4. It has also problems, but > should not be directly vulnerable to the eploit we are discussing now. As H D Moore wrote: It's your own fault if you get rooted. If you are not able to compile a kernel by yourself with the patches you need, go and read the Kernel-HOWTO, the files in /usr/src/linux/Documentation and some man pages instead of moaning in public. Martin -- martin.peikert(a)innominate.com innominate AG project manager the linux architects dipl. math. http://www.innominate.com tel: +49-30-308806-0 fax: -77 gpg: http://innominate.org/gpg/mpe.gpg

16 32

RE: [suse-security] tripwire
by Marco van Beek 11 May '01

11 May '01

Nothing, I suspect, other than you might have preset mount options set in fstab that conflict, and you might confuse everybody when they can't find the CD-ROM when mount tells them it is already mounted !!! I seem to remember that there was a wire you could cut/switch on older hard drive cables that would turn a disk into read-only. A friend of mine used it to turn an old PC into a sort of diskless set-up. If that still works, you could use an old HD on a spare IDE channel, with a key or hidden switch, mount it in the right place, and be able to update the tripwire database at will. BTW, running tripwire does involve a certain amount of upkeep if you try to cover too much, of have a lot of file (legitimate) changes, like users uploading to web space. Regards, Marco -----Original Message----- From: Gerhard Sittig [SMTP:Gerhard.Sittig@gmx.net] Sent: Friday, May 11, 2001 7:44 AM To: 'suse-security(a)suse.com' Subject: Re: [suse-security] tripwire On Thu, May 10, 2001 at 21:18 +0100, Marco van Beek wrote: > > I have installed Tripwire on a SuSE 7.1 server, and found that > tw-config needs to end up in /var/adm/tripwire, and after > initialising, the database needs to be moved from > /var/adm/tripwire/bin/databases to /var/adm/tripwire/db for the > command to work without any additional commands. You wouldn't > run a production machine like this, you would add a switch to > the command line after moving the db to some read only media. What keeps you from mounting the media with the tripwire database as well as the configuration under this very directory? :> virtually yours 82D1 9B9C 01DC 4FB4 D7B4 61BE 3F49 4F77 72DE DA76 Gerhard Sittig true | mail -s "get gpg key" Gerhard.Sittig(a)gmx.net -- If you don't understand or are scared by any of the above ask your parents or an adult to help you. --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Samba 2.0.9 für 7.1
by Sven Hansen 11 May '01

11 May '01

Hi, wo bleibt eigentlich das neue Samba für 7.1? Auf dem Server ist es nur für 7.0 und ältere Versionen. Soll wohl ein Security-Fix sein. -- _, Regards, (_ ,_)ven Hansen.

2 1

strange seccheck result
by Bjoern Engels 11 May '01

11 May '01

Hi this is a result of Marc's daily seccheck script (on a SuSE 7.0 / kernel 2.2.16): ... * Changes (+: new entries, -: removed entries): - ipchains root UDP *:3828 * Changes (+: new entries, -: removed entries): + squid root UDP *:4441 ... Why should ipchains be able to open a udp port ? Do you think this a sign of being cracked and the ipchains executable being tampered with evil code ? Bjoern Engels LANWORKS AG --------------------------------------------- E-Mail: Bjoern Engels <bengels(a)lanworks.de> www.lanworks.de ---------------------------------------------

1 0

RE: [suse-security] tripwire
by Marco van Beek 11 May '01

11 May '01

I have installed Tripwire on a SuSE 7.1 server, and found that tw-config needs to end up in /var/adm/tripwire, and after initialising, the database needs to be moved from /var/adm/tripwire/bin/databases to /var/adm/tripwire/db for the command to work without any additional commands. You wouldn't run a production machine like this, you would add a switch to the command line after moving the db to some read only media. Hope this helps, Regards, Marco van Beek -----Original Message----- From: root [SMTP:schoenborn-boehm@t-online.de] Sent: Thursday, May 10, 2001 7:24 PM To: 'suse-security(a)suse.com' Subject: [suse-security] tripwire Hello, can anyone help me, install tripwire_ASR_1.3.1-1 on SuSE 7.1? I just get on the point where to initialize tripwire. Than an error occurs??? like this: "couldn`t open /tripwire/config/tw-config no such file or directory. Permission is just set to 755. In graphical login (KDE2) I can see my files.What`s the matter with this? perhaps OSI 8 ???? schoenborn-boehm(a)t-online.de --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

user authentication on sendmail
by Philipp Snizek 11 May '01

11 May '01

Hi all, How can user authentication be set up on a sendmail server? Thank you Philipp

2 1

Re: [suse-security] Kernel security
by Harold ! 10 May '01

10 May '01

While were on this subject is there a Linux equiv of a MCSE for Linux? > > > Martin > P.S.: I like your car example. If you want to drive a car, you >need > a driving license ;-) > >Drivers Licenses only cover how to USE the car. Not how to fix it. > >-Kurt > > >--------------------------------------------------------------------- To >unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional >commands, e-mail: suse-security-help(a)suse.com > _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

2 1