May 2001 - openSUSE Security - openSUSE Mailing Lists

Upgrades via mirror and yast2
by Martin Sckopke 23 May '01

23 May '01

Hi all, since version 7.1 YAST2 enables me to automatically update via Internet. I tried to use this feature with a mirror of ftp.suse.com, but YAST2 would not work. What has to be in the mirror directories for YAST2 to work? Thanks for your great support, Martin -- The three golden rules to ensure computer security are: Do not own a computer; do not power it on; and do not use it (Robert (Bob) T.Morris) GiS - Gesellschaft fuer integrierte Systemplanung mbH Martin Sckopke Tel. +49-6201-503-74 Junkersstr. 2 Fax +49-6201-503-66 D-69469 Weinheim m.sckopke(a)gis-systemhaus.de

1 0

RE: [suse-security] Re: OT(?): Apache segfaults after update to 7 .1
by Pini Remo 23 May '01

23 May '01

Updating everything (apache, ssl, mod_php) to the newest version available through ftp (funnily enough NOT through YOU -> why not!?), the problem disappeared... seems to have been a version mismatch. greets and thanx for the help, remo > > After the long due update from 6.4 to 7.1, apache (child-procs only) > > segfaults upon page requests. > > I would say you should try the updated apache 1.3.19

1 0

AW: [suse-security] SuSEFirewall fails on system startup
by Ragucci＠t-online.de 23 May '01

23 May '01

Hi Guys, I had the same problems... But there's no problem, 'cause the Script will produce the ipchain rules! The only thing you've to do ist downloading the newest version of the ipchain script at marcs homepage (www.suse.de/~marc). With that one, there'll be no more failure messages at bootup! Bye, Mario -----Ursprüngliche Nachricht----- Von: Ulrich Schneider [mailto:ulrich_schneider@uni.de] Gesendet: Dienstag, 22. Mai 2001 08:39 An: suse-security(a)suse.com Betreff: [suse-security] SuSEFirewall fails on system startup When switching to runlevel 3 the firewall is going to be initialized. Normally I get the green done message when a service is startet or the red failed message. But the firewall-initalisation-steps 1-3 produce neither the green nor the red message. At the end of system startup the system tells me: Failure services in runlevel 3: SuSEfirewall_init, SuSEfirewall_setup, SuSEfirewall_final. But the file /etc/rc.config.d/firewall.rc.config is cinfigured in the right way ! --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Rinetd
by Sp0oKeR 23 May '01

23 May '01

Hi all... I'm using rinetd to bind de port 80, and redirect to my NT Servers. But the problem é o seguinte: my rinetd is going down. I'm using SuSE 7.0 and I have been instaled rinetd from my cd's. I'using ipchains and masquerading too. Can somebody help-me? Sp0oKeR - NsC spooker(a)bol.com.br Powered By Linux - SuSe __________________________________________________________________________ Acesso pelo menor preço do mercado! R$ 14,90 nos 3 primeiros meses! ASSINE AGORA! http://www.bol.com.br/acessobol/

2 1

ftp
by nicemice＠gmx.de 22 May '01

22 May '01

Hi there, Does anybody know how to configure ProFTP to access an internal server = inside a firewall?? The server should be accessible from outside only = with one user ('ftpuser'), but I'd like to use all other user accounts = intern. For this reason at the moment the server is using a different = user and group file. Maybe the problem can also be found in the SUSEfirewall configuration. = Any hints ? Thanx a lot in advance :-)

1 0

gpg
by Roman Drahtmueller 22 May '01

22 May '01

Hi together, the gpg updates to 1.0.5 are available for testing on ftp.suse.de (for SuSE-6.3, 6.4 and 7.0) and ftp.suse.com (7.1 and up). Get the gpgaddon packages as well (for pgp compatibility). All packages are signed using the build(a)suse.de key. Here it is (I've signed it using security(a)suse.de): Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.5 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BuQIN BDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd9DYJ8UUTmIT2iQf07tRUKJJ9v0JX fx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Via5/gO7fJEpD2hd2f+pMnOWvH2rOO IbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13CNZZNZfDqnFDP6L12w3z3F7FFXkz 07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp271hhQBeRmmoGEKO2JRelGgUJ2CU zOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlEt5ucTXstZy7vYjL6vTP4l5xs+LIO kNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMGB/9g+9V3ORzw4LvO1pwRYJqfDKUq /EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZwrbSTM5LpC/U6sheLP+l0bLVoq0lm sCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6TtIJlGG6pqUN8QxGJYQnonl0uTJKHJ ENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFLrWn7mfoGx6INQjf3HGQpMXAWuSBQ hzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5HRKMWpO+M9bHp4d+puY0L1YwN1OMa tcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMag8zFbpeqPQUsDv9V7CAJ1dbriEwE GBECAAwFAjnu9JIFCQPCZwAACgkQqE7a6JyACspLIgCbBQd/++0pB9yZWDhqxHtT pdCXRsAAnik7bYHlTxQfohiXYsEJcWrDn7l8 =wtNS -----END PGP PUBLIC KEY BLOCK-----

3 4

NetMeeting
by Roland Hilkenbach 22 May '01

22 May '01

Hi list, a coworker of mine needs to work with NetMeeting including audio and video streams. Since we use a T-DSL connection this should be ok. Most of the setup is working fine but there's a catch: her streams are going out but she's not able to _receive_ the other streams. The manual states you have to open UDP transfer to and from the workstation for _every_ other participating computer _and_ port combination! That's since it is not known in advance what IP-adresses the communication partner uses and what ports will be chosen by that software. As far as I've understood the Real-time Transfer Protokol RTP there is an initial connection going to port 1503 and each subsequent datapacket includes the portnumber where to send the next packet. So I figure only stateful firewalls will be able to handle that correctly. My question: Is it possible to archive such a connection with a masquerading Linux-Gateway with a T-DSL connection? Thank you Roland Hilkenbach

1 0

SuSEFirewall2
by Christian Lox 22 May '01

22 May '01

Hi everyone, hope this is the right place (is it, Marc?). I just downloaded SuSEFirewall2 to give it a try. Seems to work great, no serious problems found. One thing annoys me: I did set ping_ext (dont konw the exact name right now) to yes. So ping to the internet should be allowed. But I dont get anything back, not even DENYs in the log. Christian -- we reject: kings, presidents, religions we accept: working code

2 1

SuSEFirewall fails on system startup
by Ulrich Schneider 22 May '01

22 May '01

When switching to runlevel 3 the firewall is going to be initialized. Normally I get the green done message when a service is startet or the red failed message. But the firewall-initalisation-steps 1-3 produce neither the green nor the red message. At the end of system startup the system tells me: Failure services in runlevel 3: SuSEfirewall_init, SuSEfirewall_setup, SuSEfirewall_final. But the file /etc/rc.config.d/firewall.rc.config is cinfigured in the right way !

2 1

closing ports (canna, squid and sendmail)
by Joss Winn 22 May '01

22 May '01

Hello, I am reviewing the security on my home desktop and have a question which I hope is simple to answer. I should say that I am on a 56k dial up PPP connection and offer no services to anyone. I am the only user and root. Simple. In fact, I think my security measures are probably over-the-top, but still it sems like good practice and makes interesting learning. I have hardened the system using Marc's hardening script and have set up Firewall2. Now, when I scan my ports with nmap, I have 'canna', 'smtp' and 'squid' showing open. Canna is my Japanese language server and I have squid running to cache pages for web browsing. I also opened up the smtp/sendmail service so I can use fetchmail to fetch my mail. My questions are: 1. Can I close the canna port and still use canna? I see no reason why it should be sitting open to external connections when I am the only person that needs to use it. How do I close it? 2. Is it necessary for squid to be sitting open, when I do not serve any web pages. Can I close the port and still have squid cache pages for my browsing? 3. I fetch mail with fetchmail which requires sendmail to send the mail to my account. Must I have sendmail running as a daemon or can I invoke sendmail when fetchmail needs it. If I shut down sendmail/smtp, I can sendmail, with sendmail -q but fetchmail fails. Basically, how do I close the smtp port but still use fetchmail? I'd be grateful for any help. And if I appear to be barking up the wrong tree, then please do let me know! :-) thanks Joss

3 4