July 2001 - openSUSE Security - openSUSE Mailing Lists

ssh version and suse 6.4 i386
by berthaa＠mac.com 19 Jul '01

19 Jul '01

can anyone advise me on what version of ssh or openssh to install on a i386 running suse 6.4 system, the rpm application on suse 6.4 is rpm 3.0.4. what happens is, i cant get downloaded ssh & openssh rpms to install on system. the error message is as follows: only versions <=3 can be installed "pre install error" ssh doesn,t figure on cds of suse 6.4 so i am referring to various ftp downloaded rpms of ssh and openssh, same error message. other rpm packed applications seem to install problemless thanks mike

2 1

Re: [suse-security] ssh version and suse 6.4 i386
by Stefan_Walther＠gehag-dsk.de 19 Jul '01

19 Jul '01

Hi, 1st: where did you get ssh/openssh? 2nd: did you update your rpm at your 6.4 from SuSE? 3rd: is RPM, that you have downloaded a RPM version 4 or version 3x? 4th: did you try to install the ssh/openssh package from your SuSE-CD? MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 berthaa(a)mac.c om An: suse-security(a)suse.com Kopie: 19.07.2001 Thema: [suse-security] ssh version and suse 6.4 i386 17:44 can anyone advise me on what version of ssh or openssh to install on a i386 running suse 6.4 system, the rpm application on suse 6.4 is rpm 3.0.4. what happens is, i cant get downloaded ssh & openssh rpms to install on system. the error message is as follows: only versions <=3 can be installed "pre install error" ssh doesn,t figure on cds of suse 6.4 so i am referring to various ftp downloaded rpms of ssh and openssh, same error message. other rpm packed applications seem to install problemless thanks mike -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

RE: [suse-security] VPN Question
by Wilhelm Tesnaar 19 Jul '01

19 Jul '01

Then what is the concensus ? is it a possibility or not? Regards Willie Tesnaar Change your way of thinking, it might ease the process of self discovery ! (Willie Tesnaar 06/06/2001) -----Original Message----- From: Reckhard, Tobias [mailto:Reckhard@secunet.de] Sent: Thursday, July 19, 2001 7:18 AM To: Security List Subject: RE: [suse-security] VPN Question > Anyone knows the ports used by MS VPN server. I need to generate rulez to > nat them ! > > I have a linux Firewall and I have a MS VPN server on the internal network > ! > Depends what VPN technology the MS VPN server is using. Most probably PPTP, which communicates via server port UDP 1723, AFAIK, and uses the GRE protocol for the actual tunneling. IPSec uses UDP 500, I think, for IKE (Internet Key Exchange) and protocols 50 and 51 for ESP and AH. Note that IPSec doesn't like to be NATted. When using IPSec you should generally NAT before IPSec. Regards, Tobias -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

RE: [suse-security] VPN Question
by Reckhard, Tobias 19 Jul '01

19 Jul '01

> Anyone knows the ports used by MS VPN server. I need to generate rulez to > nat them ! > > I have a linux Firewall and I have a MS VPN server on the internal network > ! > Depends what VPN technology the MS VPN server is using. Most probably PPTP, which communicates via server port UDP 1723, AFAIK, and uses the GRE protocol for the actual tunneling. IPSec uses UDP 500, I think, for IKE (Internet Key Exchange) and protocols 50 and 51 for ESP and AH. Note that IPSec doesn't like to be NATted. When using IPSec you should generally NAT before IPSec. Regards, Tobias

1 0

PGP keyserv
by jochen mader 18 Jul '01

18 Jul '01

Hey, I've been playing around with GPG for some time now and I'd like to install a keyserver on our server to allow people to exchange their keys easily. Which servers would you suggest to use?

2 1

32770/tcp open sometimes-rpc3 solution
by Timon Schroeter 18 Jul '01

18 Jul '01

Hi, thanks Sven & Martin, using lsof -i tcp:32770 and netstat -anpt | grep 32770 i found out that kxmlrpcd binds to port 32770. Knowing the actual name of the process I found what I was looking for: http://bugs.kde.org/db/24/24992-b.html Since kxmlrpcd accepts connections from anywhere, some believe this to be a potential security hole, here are two solutions proposed by one of the posters on the site mentioned above: 1. Delete the line X-KDE-Init=xmlrpcd from /usr/share/services/kxmlrpcd.desktop 2. Create the file /usr/share/config/kxmlrpcdrc (if not already there) and add the lines [General] StartServer=false I tried umber one and it worked for me. Timon -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net GMX Tipp: Machen Sie Ihr Hobby zu Geld bei unserem Partner 1&1! http://profiseller.de/info/index.php3?ac=OM.PS.PS003K00596T0409a

1 0

unwanted virus infected email spam
by michael.ryan＠storm.ie 18 Jul '01

18 Jul '01

(kind of off topic) Has anyone been receiving periodic emails with virus infected attachments from an address proporting to be hahaha(a)sexyfun.net? It is really annoying me at this point because this w**ker seems to be sequentially trying all combinations ********(a)storm.ie and I am getting a couple of quarantine notifications every week from the antivirus software on our mail server. I did try adding a REJECT rule for hahaha(a)sexyfun.net to /etc/mail/access - this seemed to work for a week or two but the problem has since returned. Any ideas as to what I might try next as this kind of mindless activity really does my head in ... Thanks, Michael

5 4

32770/tcp open sometimes-rpc3
by Timon Schroeter 18 Jul '01

18 Jul '01

Hi, System: SuSE7.2, Default, KDE2, Developer packages. I will shortly connect my desktop machine to a lan with aproximatly 200 Machines on it, each with a public IP and router connecting the lan with the internet. All machines are completely accessible from the outside (no firewall) at all times. Under these conditions, is "32770/tcp open sometimes-rpc3" something to worry about? How can I disable it? I tried (among other things) deinstalling the package n portmapper, but this made no difference. Timon -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net GMX Tipp: Machen Sie Ihr Hobby zu Geld bei unserem Partner 1&1! http://profiseller.de/info/index.php3?ac=OM.PS.PS003K00596T0409a

2 1

Re: [suse-security] 32770/tcp open sometimes-rpc3
by Sven Michels 18 Jul '01

18 Jul '01

Hi, > Under these conditions, is "32770/tcp open sometimes-rpc3" something to > worry about? open ports you don't need a everytime a thing to worry about if you're connected to a lan/wan :) > How can I disable it? > > I tried (among other things) deinstalling the package n portmapper, but this > made no > difference. try lsof -i tcp:32770 to find out whats opening the port and disable that or install a local firewall (you should do that anyways) Regards, Sven

1 0

Re: [suse-security] unwanted virus infected email spam
by Sven Michels 18 Jul '01

18 Jul '01

> On Wed, 18 Jul 2001, Sven Michels wrote: > > > > I'd allow > > > *.JPG,*.JPEG,*.PNG,*.GIF,*.ICO,*.WMF,*.EMF,*.VCF,*.EML,*.MSG > > afaik allowing .eml is not a good idea, outlook forwards a mail > > as an eml attachment, including all content of the mail, also > > the attachments... > > Blocking mails on a per file name/extension basis has it's limitations. thats true, but it has blocked many email viruses like happy99. i use the combination from blocking some type of attachments and if a mail passes all my normal restrictions, it's scanned by a viruschecker. it's not 100%, but better than nothing :) > May I suggest to read > http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0005&L=ntbugtraq&F=… > by Nick, former VIRUS-L moderator, very carefully. yeah, i read it some time ago, it's pretty good to show the ppl whats possible in this world :) Welcome to the world of 'just point and click' ;) Regards, Sven

1 0