August 2001 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

automatic backups over ssh/scp
by Lukas Feiler 19 Sep '01

19 Sep '01

I want to do the following: backup all my sensitive date from my main server, pack it into one file and then get it transfered to my backup server. That's fine but my problem is that those two machines aren't in the same local network. So if I do not encrypt my data it would be (more or less) visible to everybody on the net (who has some hacking knowledge). But as I said this data is sensible (passwords, creditcards, ...)! So I thought of ssh or scp BUT how to automate this process of backing up? I would have to specify user AND password in my backup-script. How do specify a password for ssh / scp in a script?? Plese Help! Luke

14 30

SuSE Firewall 2 - Masq , IRC
by Michael Brandejsky 05 Sep '01

05 Sep '01

Dear List, i have Suse 7.2 Pro and the SuSE Firewall2 , ftp, www masquerade works fine but i have a problem to tranfer DCC Files in IRC , time ago there are some IRC Masq Modules, but they are not compatible to the 2.4.x Kernel. So , what should I do to use DCC Sends. I don't want to install an old kernel. greetings

2 1

RV: [suse-security] Resolution Apache virtual hosts in DMZ
by Julio Jaime 31 Aug '01

31 Aug '01

Hi Maf, In the DMZ not work the VirtualHosts directive, for this reason I ask in this list. That IP I write in the directive virtualhost? the public ( 200.47.xxx.xxx ) or the private ( 192.168.1.10)? thanks Qualify the resolution of DNS webserver, but it cannot solve the virtual dominion -----Mensaje original----- De: maf king [mailto:maf@cybereye.co.uk] Enviado el: jueves, 30 de agosto de 2001 16:08 Para: suse-security mailing list Asunto: Re: [suse-security] Resolution Apache virtual hosts in DMZ Hi Julio On 2001.08.30 18:54:22 +0100 Julio Jaime wrote: > Hello list, > > I have the following configuration : > > INTERNET > | > | DMZ > ------Suse FW(NAT)---WWW (192.168.1.10)( Two domains: domain.com and > domain.com.ar ) > | > | > LAN > > As I write virtual host directive in httpd.conf so that apache works with > both domains? > > Today only domain.com works, the DNS estan correctly formed. > This seems off-topic to me, but look at Apache docs, especially ServerAlias HTH Maf. > Thank a lot. > > -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Maf. King Standby Exhibition Services ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "It is easier to do a job right than to explain why you didn't." - Martin Van Buren ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

[suse-security] SuSEfirewall2 v1.6 question? FAQ?
by Tall0n 31 Aug '01

31 Aug '01

Ok...Maybe I'm not getting something. I have a SuSE 7.2 machine with 2 network cards. eth0 is world device (Real Static IP) and eth1 (Private Static IP) is internal device. Masquerading is happening for machines on the internal network. Everything is working fine. Masquerading works. Internal machines can get to the outside world. The outside world can only get to the services that are open on the firewall. All is good. BUT, The SuSE machine is a webserver, gameserver, etc... and there is a need for internal machines to access services on the world device (eth0), however, they can't. For example, if an internal machine tries to get a webpage from the webserver and uses the Internal address on the webserver, everything works fine. But if you try and get the same page using the external address, nothing works. In the firewall2.rc.config file, I have www listed in both the FW_SERVICES_EXT_TCP and FW_SERVICES_INT_TCP. However I always get a message in the /var/log/firewall log saying that it denied a request on eth1 for DPT=80. What am I missing? Losing hair...hehehe TIA, Tall0n -- GregWorld.com

3 2

IMAP/POP over SSL
by Bjoern Engels 31 Aug '01

31 Aug '01

Hi finally our mail server adminiatrator added SSL support for our *spit* Exchange 2000 server. Has somebody of you a hint how to configure my mail client (actually I'm using fetchmail to get the mails) so I don't need to put my password in plain text onto the wire anymore ? Thanks Bjoern Engels

3 3

Resolution Apache virtual hosts in DMZ
by Julio Jaime 30 Aug '01

30 Aug '01

Hello list, I have the following configuration : INTERNET | | DMZ ------Suse FW(NAT)---WWW (192.168.1.10)( Two domains: domain.com and domain.com.ar ) | | LAN As I write virtual host directive in httpd.conf so that apache works with both domains? Today only domain.com works, the DNS estan correctly formed. Thank a lot.

2 1

Re: [suse-security] sendmail
by Simon Kaggwa 30 Aug '01

30 Aug '01

The man page for which says: Which takes a series of program names(in your case sendmail), and prints out the full pathname of the program that the shell would call to execute it. The results you got do not necessarily mean sendmail is running on your system, if you want to find out whether sendamil is running type; ps ax | grep sendmail | grep -v grep > >On Sun, 26 Aug 2001, phil wrote: > > >I need to know something. > > > >I type which sendmail > >and I get /usr/sbin/sendmail > > > >BUT I use postfix > > > >so. do I need to upgrade sendmail ? I didn't think you can install >both at > >the same time. so why is there a sendmail? > > _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

1 0

Re: [suse-security] UDP and "-m state --state xxx"? (Re: [suse-security] Looking for a secure time service)
by Ralph Seichter 30 Aug '01

30 Aug '01

Andreas Baetz wrote: > according to the manual and to my tests it [stateful inspection] not only > works for tcp, but also for udp and icmp (for what else, I don't know) Thanks, Andreas. I shall overhaul my personal iptables script and add state checking to the rules dealing with UDP / ICMP based services. I thought that stateful inspection was available for TCP only, but it is good to know I made a mistake in assuming so. Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

FAI reject
by jdd 30 Aug '01

30 Aug '01

looking at the sure personal firewall (set as default, my server offers no service for outside) log, I found this: (isdn connection) Aug 28 23:19:54 phoenix kernel: OPEN: 192.168.0.1 -> 212.27.32.5 UDP, port: 61171 -> 53 my FAI DNS Aug 28 23:19:54 phoenix kernel: ippp0: dialing 1 0868929898... phone call Aug 28 23:19:55 phoenix kernel: isdn_net: ippp0 connected Aug 28 23:21:20 phoenix kernel: Packet log: rulchain REJECT ippp0 PROTO=6 213.228.8.211:2454 213.228.41.113:80 L=48 S=0x00 I=435 F=0x4000 T=123 SYN (#17) Aug 28 23:21:24 phoenix kernel: Packet log: rulchain REJECT ippp0 PROTO=6 213.228.8.211:2454 213.228.41.113:80 L=48 S=0x00 I=985 F=0x4000 T=123 SYN (#17) Aug 28 23:21:28 phoenix kernel: Packet log: rulchain REJECT ippp0 PROTO=6 213.228.8.211:2454 213.228.41.113:80 L=48 S=0x00 I=1892 F=0x4000 T=123 SYN (#17) what are these three rejected connections? nslookup show that 213.... machines are two of my isp's machine, so it seems legal. may I cause a problem with rejecting these things? port 80 is ftp???? such reject are found some time, just after connctions, but not always. thanks jdd -- <http://www.dodin.net> <mailto:jdanield@dodin.net> WHO'S THAT GUY ? Help me found it Russia & South america help needed http://www.dodin.net/serge/index.html

3 4