May 2001 - openSUSE Security - openSUSE Mailing Lists

apache prob
by OKDesign oHG Security Webmaster 03 May '01

03 May '01

Hi folks, just installed new system (7.0) and ran into little difficulties :) Okay, when starting apache the normal way (when entering runlevel2 or by /sbin/init.d/apache start) apache starts and seems to work normally, but I can't access directories secured with .htaccess. When stopping apache and restarting it the conventional way by /usr/sbin/httpd -f /etc/httpd/httpd.conf it works. So it seems as if the modules (backhand, ldap, susehelp and so on) are the problem. First question: Any idea what exactly is the problem ? Am I right with my theory ? Or is the problem anwhere else ? Second question: How do I disable single modules ? I couldn't find any entry in the httpd.conf for this. Third question: Is there a known problem with .htaccess and one of the mods ? If not, I think I'll have to diable the mods one after each other to find out the guilty one Forth (and last :) ) question: Are there any known vulnerabilities within the .htaccess-method ? I was on holiday the last time and am a little "out of date" due to this. Thanks in advance. ---Stephan -------------------------------------------- Stephan M. Ott // OKDesign oHG ............. Internet-Providing und Netzwerkmanagement .. smo(a)okdesign.de ..... http://www.okdesign.de fon. +49 961 3814139 .. fax. +49 961 3814140 in dringenden faellen: mobil. 0171-7858064 . --------------------------------------------

2 1

Re: [suse-security] Update for mod_ssl on Suse FTP Server
by Roman Drahtmueller 03 May '01

03 May '01

> Hi Roman, > > What did you mean with it? What has changed in 7.1 regarding crypto software? There are two problems with crypto software in the US: * The export regulations * Licensing/patent issues We only package algorythms that are free to use. This way it is possible to offer the packages for download to non-US countries. Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

3 2

tool
by Philipp Snizek 03 May '01

03 May '01

Hi all, I'd like to ask for your help once more. I'm in a hurry and I need a tool to crack sonicwall firewalls. If you know about the existence of such a tool, please let me know where to download it. Thank you Philipp

3 2

Re: [suse-security] OpenSSH versus SSH
by Martin Brecher 03 May '01

03 May '01

Hi, - [snip] >b) Provided a) holds, they do offer a graphical file transfer tool for which > no freeware replacement is available (yet). > (This applies to Windows clients, only) Try WinSCP, it's freeware: http://winscp.vse.cz/ [snip] Regards, Martin Brecher --- And you all know, security Is mortals' chiefest enemy. (Shakespeare, Macbeth) --- The Internet was invented as a highly dependable, high-speed, distributed, secure, and powerful network so that in the event of a nuclear crisis, military officials would always have access to pornography.

5 5

Re: [suse-security] OpenSSH versus SSH
by Nix 03 May '01

03 May '01

At 07:47 PM 2/05/2001, you wrote: > > looks like I didn't notice that SSH seems to be really commercial now. Is > > this right? Do I need to pay for it if I am still using it? > >There are some exceptions however these are not in the actual license as far >as I know, they are PR releases on the ssh.com website. I wouldn't completely >trust it. In any event future usage is in question (remember, ssh used to be >"free", Tatu sure has changed). > > > Is OpenSSH a full-featured substitute for SSH? Are there major problems in > > configuration to expect if I try to deinstall SSH and go for OpenSSH? > >Yes, actually many (myself included) would say that OpenSSH is better then >SSH. OpenSSH for example has incorporated various security fixes in the older >protocols that Commercial SSH has not, the reason for this is SSH >communications wants to kill off the old protocols to sell more software. > >Something else to note: OpenSSH has grabbed a huge amount of market share and >is growing. I know many many people using OpenSSH. Most SSH related articles I >have read (and written =) use OpenSSH as the example and typically only >mention commercial ssh as a footnote. I do not actually know of any >company/etc using commercial ssh (if you are I'd like to know so I can claim I >know at least one =). OK, I'm going to have to chime it here Kurt (Yup, I know I've been quiet for a while.. Lots of international flights tend to eat into your spare time) SSH does not have ALOT of extra features compared to Open SSH, but it does have a few. Especially for people who run Windows desktops. Things like seemless SFTP from windows is a big advantage for the more clueless users who are not likely to be happy using pscp from a command line for instance. Infact, the ability the SSH service to run "properly" on WinNT/W2K also is obviously a big advantage. (I would never recommend someone put OpenSSH+Cygwin on a prod NT box) It also looks like SSH 3.0 is about to be released with full PKI support, which will be very nice, and mean that it will go from being a usefull/secure replacement for telnet/rcp/ftp to a VERY USEFUL tool that can be integrated into a companies PKI policy. (I personally can't wait for this!!) So to answer you question, Yes, I know MANY sites that run commercial SSH on both windows and any possible version of Unix you can name. Unfortunately I can't name names, but they don't get any bigger. (Stock Exchanges, Banks, Insurance Companies, Government Departments, etc) Personally however, I use OpenSSH on all my Unix boxes :-) Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

Re: AW: [suse-security] What are these services?
by Marko Kaening 02 May '01

02 May '01

Thanks for all the replies up to now! > i don't know any service on port 1024 I should look closely at this port next time I meet it and detect the owner of the process using that port. Thanks to advice! > this is what i found about port 1987 > > tr-rsrb-p1 1987/tcp #cisco RSRB Priority 1 port > tr-rsrb-p1 1987/udp #cisco RSRB Priority 1 port > > maybe one of the cisco guys know what this service > is exactly for. Well, that would be great to know what hides behind this... Funny, I have SuSE 6.3 with Firewall4.4 and I don't think that such ports should be usable... Marko

2 3

Update for mod_ssl on Suse FTP Server
by Martin Sckopke 02 May '01

02 May '01

I am not sure if this really is security related, but it might be: A few weeks ago I set up a mirror of ftp.suse.com (using ftp.gwdg.de, not the original site). While upgrading to Apache 1.3.19 I started to look for mod_ssl, which needs to be upgraded, too. I looked in /pub/suse/i386/update/7.0/n1 and in /pub/suse/i386/update/7.0/sec1 No mod_ssl. So - I tried the SuSE Web-Site. After looking for a while, I found a reference to mod_ssl in an article about upgrading Apache: http://sdb.suse.de/sdb/de/html/jsj_apache_update.html There is a reference to ftp.suse.de:/pub/suse/i386/update/7.0/sec1/mod_ssl.rpm ^^ Is this due to export restrictions with encryption-related software? Do I have to mirror the German Server to get encryption-related software? Thanks for your help, Martin -- GiS - Gesellschaft fuer integrierte Systemplanung mbH Martin Sckopke Tel. +49-6201-503-74 Junkersstr. 2 Fax +49-6201-503-66 D-69469 Weinheim m.sckopke(a)gis-systemhaus.de

2 1

Re: [suse-security] Where's hardsuse? Got it.
by KEVIN ZEMBOWER 02 May '01

02 May '01

Thank you very much, Roman and Ben. Got it. -Kevin Zembower >>> "Ben Peterson" <bptn(a)garlic.com> 05/02/01 10:30AM >>> harden_suse is a script it is available here: http://www.suse.de/~marc/SuSE.html ----- Original Message ----- From: "KEVIN ZEMBOWER" <KZEMBOWER(a)jhuccp.org> To: <suse-security(a)suse.com> Sent: Wednesday, May 02, 2001 7:13 AM Subject: [suse-security] Where's hardsuse? > I've followed the threads on harden_suse and decided to try it out. I went to the web page at http://members.cotse.com/nix/susesecurity/faq/index.html and from there, to the link ftp://ftp.suse.com/pub/suse/i386/current/suse/sec1/hardsuse.rpm but the file's not there. > > Has this system been removed for maintenance? Relocated? > > Thanks for your help. > > -Kevin Zembower > > ----- > E. Kevin Zembower > Unix Administrator > Johns Hopkins University/Center for Communications Programs > 111 Market Place, Suite 310 > Baltimore, MD 21202 > 410-659-6139 > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Where's hardsuse?
by KEVIN ZEMBOWER 02 May '01

02 May '01

I've followed the threads on harden_suse and decided to try it out. I went to the web page at http://members.cotse.com/nix/susesecurity/faq/index.html and from there, to the link ftp://ftp.suse.com/pub/suse/i386/current/suse/sec1/hardsuse.rpm but the file's not there. Has this system been removed for maintenance? Relocated? Thanks for your help. -Kevin Zembower ----- E. Kevin Zembower Unix Administrator Johns Hopkins University/Center for Communications Programs 111 Market Place, Suite 310 Baltimore, MD 21202 410-659-6139

3 2

Dos partition problem
by wmmvdwee 01 May '01

01 May '01

Hi all, I'am using SuSe linux 7.1 I have one (1) fat 32 partition on my HD (vfat) in my /etc/fstab is mentioned /dev/hda1 /dos_disk vfat umask=000. When I try to make a new folder on the dos_disk from one of the Win98 PC's it say: can not create map with same name, after refresh there is a new folder in this directory. I'am also running a multi user programm on the dos_disk which can be used by several Win95/98 PC's, however when I try to start this programm it say: you have no rights to create directories. Under SuSe linux 6.2 everything works fine. Can somebody tell me what could be the problem for this. Is this a Win95/98, or linux problem, and when it is a linux problem, could it be samba, umask? Any comments, suggestions are welcome Thanks Wil

1 0