July 2001 - openSUSE Security - openSUSE Mailing Lists

12 Jul '01

Hi sorry but my english is no good When I start sendmail, i get the following messages in log file: Daemon could not open control socket /var/run/sendmail/control: Group writable directory Sendmail starts ok. I have AMaViS already installed, when i send a mail to a majordomo list, sendmail fail, normally run ok Anyone can help me? Thanks

3 2

FreeSwan
by Sp0oKeR 11 Jul '01

11 Jul '01

Hi All... Can I use Freeswan to do a VPN between ADSL(server linux ADSL) and ppp (server Linux with ppp conection). Can somebody help? Or give to me some URL about this? Regards ... -- #=============================# # Rodrigo Ribeiro Montoro # # Network Services Center # # rodrigo(a)nscenter.com.br # # http://www.nscenter.com.br # # Tel:(11)3965-2253 # # Cel:(11)9771-0133 # # Sao Paulo - SP # #=============================#

3 4

Sendmail Question
by Rainer Buesching 11 Jul '01

11 Jul '01

Hi, i know that is possible set max message size. How can i set individual message size for each user? Thanks Rainer

3 2

Block port 6000
by Passreality 11 Jul '01

11 Jul '01

Hi I have probs getting X to stop listening for connection on port 6000. I saw at the "SuSE Security FAQ (unofficial)" that to get it to stoping listening i should change /usr/X11R6/lib/X11/xdm/Xservers but this dont work for 7.1, anyone know how to disable it in 7.1 ? I do not want to block it using a firewall. Cheers /Chriss __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

8 13

extending my dmz
by elfed lewis 11 Jul '01

11 Jul '01

I work for a college with 3 sites, with wan links in between each, with 2 seperate networks per site, which means 6 networks over my wan. Im hoping to set up a DMZ over the summer, and putting my web server, dns and mail server in there. Thing is, i have another server on another site that i'd also like inside my DMZ. what i'd like to do is set up some sort of tunnel (i dont know if you can do this) from the external site to my DMZ. Sort of like this: box needs being in DMZ ---> tunnel box ---> WAN links ----> Box inside DMZ Then, any requests for the "box needs being in DMZ" can be directed to the "box inside DMZ", which then sends any data down over the tunnel directly to the "box needs being in DMZ". heres another diagram in case imnot being very clear: router ---------------------- wan router DMZ | | | box inside DMZ | ------------------ extsite1 extsite2 ext site3 ---- ---- ---- | Tunnel box | box needs being in DMZ

2 1

RE: [suse-security] IPSec system design questions (slightly OT)
by Ed 11 Jul '01

11 Jul '01

I would appreciate comments on some IPSec design issues. A transportation manufacture recently requested proposals for a Linux based system to put Internet and email services on their vehicles. This system would let passengers plug a laptop into the on board network. A number of protocols were specified including IPSec. They also specified Linux kernel 2.4.x. It seemed to me that they intended IPSec to be used from transportation vehicle to satellite to fixed server. The VP of Technology here has recently discussed using IPSec on board vehicle from web server, email server and file server to passenger seats - typically many hundreds of passengers. The transportation manufacture specified: "The file server will not preclude a user from initiating and completing a supported VPN connection from their user device through the transportation manufacturer network using the IPSec and PPTP protocol, as a minimum. The system should allow the user to switch between IPSec VPN and non-VPN without need of rebooting the laptop. The system will only pass IP based protocols between the laptop passenger interface and the file server. Passenger laptops will be assigned default gateway address via DHCP. The default gateway should reside in the server. The system will by default, route user outbound packets to a configurable gateway." Is it feasible to support IPSec from a passenger's laptop when implementations of IPSec vary and either ESP or AH modes might be used? If feasible what performance hit would be involved? I have heard estimates of 40% when encryption is used (mileage may vary I suppose based on CPU speed and resources). I assumed that a "default gateway at the server" implied that the IPSec pipe started or ended there. Since the transportation manufacturer called out other security requirements to the passenger seat, I assumed that IPSec to the seat was not required. Examples of requested security: "Multiple passengers will not be connected to shared physical media. Laptop users will not be permitted to view packets from another user's network session. Each passenger's laptop's user interface will be isolated to its own link layer subnetwork. The passenger laptop will not be able to access unauthorized IP address. The system will be immune to DoS attacks. The server will ensure that passenger laptop's can only pass packets with that user's assigned IP address." My main question are, 1) "Does the transportation manufacturer really want IPSec extended directly to the passenger's laptop?" 2) "Would it even be feasible to automate re configuration of IPSec software running on a passenger laptop to avoid compatibility issues?" 3) "What would the performance cost be of running ESP or AH IPSec on a laptop that might also be viewing an MPEG2 movie, web browsing or playing a game?" I would appreciate any opinions you care to offer. The job you save may be my own. <s> Thanks, Ed

5 6

Susefirewall & BIND 9
by Manfred Meerkoetter 11 Jul '01

11 Jul '01

Hi I use a box with suse linux 7.1 and kernel 2.2.x to connect a small network via DSL to the internet. I use the SuSEfirwall script in version 4.3 and it works fine. The problem is named when I install named as caching-only nameserver and have the option FW_AUTOPROTECT_GLOBAL_SERVICES = "yes" in my firewall.rc.config the script will generate a rule to block the high-port on which named is expecting the answer. I have set FW_ALLOW_INCOMING_HIGHPORTS_UTP = "yes", but the rule to block the port is generated before the ACCEPT 1024- 65355 rule. What's my mistake ? Greeting Manfred Meerkötter Gönnheimer Elektronic GmbH Dr. Julius Leber Str. 2 67433 Neustadt Tel. 06321/49919-13 Fax. 06321/49919-41

2 1

Re: [suse-security] password length is only 8 characters?!?!?
by phil 11 Jul '01

11 Jul '01

You have to be kidding. On Wednesday 11 July 2001 06:39 am, you wrote: > welcome to linux ! > > > Von: phil <phil(a)osbtown.com> > > Datum: Wed, 11 Jul 2001 06:36:02 -0700 > > An: suse-security(a)suse.com > > Betreff: [suse-security] password length is only 8 characters?!?!? > > > > I just noticed that the password length is being truncated to 8 > > characters. How can I up that to say 40 characters? I tried setting in > > YaST1 and YaST2 and when I set it to 40 it still truncates it back down > > to 8.

1 0

RE: [suse-security] password length is only 8 characters?!?!?
by Reckhard, Tobias 11 Jul '01

11 Jul '01

Assuming you're using PAM, do: cat /usr/share/doc/packages/pam/README.md5 Tobias > -----Original Message----- > From: phil [SMTP:phil@osbtown.com] > Sent: Wednesday, July 11, 2001 3:36 PM > To: suse-security(a)suse.com > Subject: [suse-security] password length is only 8 characters?!?!? > > I just noticed that the password length is being truncated to 8 > characters. > How can I up that to say 40 characters? I tried setting in YaST1 and > YaST2 > and when I set it to 40 it still truncates it back down to 8. > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com

1 0

RE: [suse-security] Block port 6000
by Reckhard, Tobias 11 Jul '01

11 Jul '01

> On SuSE 7.1 ( kernel 2.2.x ) I'd do: > > ipchains -A input -p tcp -s ! a.b.c.d/32 -d a.b.c.d 6000 -j REJECT > > dunno yet how to use ports in iptables tho... > > a.b.c.d would be your ip > For iptables, the above should translate to something similar to: iptables -A INPUT -p tcp -s ! a.b.c.d -d a.b.c.d --dport 6000 -j REJECT or iptables -A FORWARD -p tcp -s ! a.b.c.d -d a.b.c.d --dport 6000 -j REJECT depending on whether the iptables box is the X box (case 1) or if the latter is behind it (case 2). HTH Tobias

1 0