September 2001 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

VPN masquerading
by Joost van der Lugt 06 May '02

06 May '02

Hi all, I am trying to set up VPN masquerading, for a Windows box, and just wondered if there was an easy way to do this, using just the firewall.rc.config script, or do both that plus the custom config script have to be used? I have seen the VPN how-to, however just wondered about a how to aply this with SuSE's scripts. Thanks for any suggestions, (PS if there is someone familiar with setting upo VPN on the SuSe box itself, I would be very interested as well..., of course) - Cheers, Joost

4 4

SuSEfirewall2 and DHCP relay
by Pablo A. Maurin 01 Nov '01

01 Nov '01

Hello everyone. I am currently using SuSEfirewall2 with the following configuration. FW_DEV_EXT="eth0" FW_DEV_INT="eth1 eth2" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24 192.168.254.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="ssh" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_INT_TCP="ssh" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" I have a firewall with 3 interfaces. eth0 is outside,public. eth1 is one local subnet (192.168.0/24), private. eth2 is a second internal private subnet(192.168.254/24). I have routing setup beween both subnets and I am able to ping across the firewall/router from one subnet to the other. Currently I have a DHCP server installed in the 192.168.0/24 subnet. Address 192.168.0.2. On the firewall I installed the DHCP realy package from the suse 7.2 CD It listenes on eth2 and forwards all request to 192.168.0.2 (the DHCP server). when I check the dhcp server logs I see that it is creating a lease for the new host on eth2 of the firewall. However the host is not receiving the address. I sure that it is a small misconfiguration on the firewall, but I cannot figure out what it is. Any help is greatly appreciated. If you need more information just e-mail me and I will try to get it. Thanks is advance, Pablo A. Maurin

2 1

patching SuSE
by Matthew Dalton 01 Oct '01

01 Oct '01

Please forgive the newbie question -- is there an easy way to patch Suse (7.1) all at once? The only way that I can see from the web-site is to download each patch individually. Thanks for helping! -- Matthew Dalton

4 4

IRC DCC stuff from behind a susefirewall2 NAT router
by Admin 01 Oct '01

01 Oct '01

Hi, see subject, any hints? neither inbound nor outbound dcc works... And as I am botmaster on some IRC bots I REALLY need DCC Chat :( bye M.Homann -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstіпt gegen §1 UWG und §823 I BGB (Beschluп des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der ќbermittelten persіnlichen Daten sowie deren Weitergabe an Dritte ist ausdrќcklich untersagt!

4 4

squid: timeout in SENT_PASV state
by Philipp Snizek 29 Sep '01

29 Sep '01

Hi all, please can somebody tell me what to do against this. Is this a ftp server that is not accepting pasv ftp? Or is it a misconfigured squid? Sep 29 21:23:54 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Sep 29 21:24:18 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Sep 29 21:24:41 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Sep 29 21:29:03 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Thank you all, Philipp

1 0

still battlecom with linuxserver
by Johannes Schäffner 28 Sep '01

28 Sep '01

ok, i have typed this: ipmasqadm autofw -A -v -r udp 2300 2400 -h 192.168.0.2 (client-ip) ipmasqadm autofw -A -v -r tcp 2300 2400 -h 192.168.0.2 ipmasqadm autofw -A -v -r tcp 47624 47624 -h 192.168.0.2 ipmasqadm autofw -A -v -r udp 47624 47624 -h 192.168.0.2 ipmasqadm autofw -A -v -r udp 28800 28900 -h 192.168.0.2 but it still don´t work. he always prints this at hte screen: Adding autofwd udp ports 2300 - 2400 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd tcp ports 2300 - 2400 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd tcp ports 47624 - 47624 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd udp ports 47624 - 47624 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd udp ports 28800 - 28900 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available what do i have to change?? -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

2 1

Virus scanner to detect macintosh viruses?
by Thorsten Marquardt 28 Sep '01

28 Sep '01

Hello, I like to know wether there is a linux virusscanner which detects virus for (better against) apple macintosh. Yours sincerly Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

2 1

Re: [suse-security] qmail.rpm ... -> courier imap -> virus scanners
by Martin Schichl 28 Sep '01

28 Sep '01

Hi! I've followed the discussion about qmail ... We are running qmail now for a couple of years without any problems (about 250 Mailclients in 50 different virtual domains) But let me get the discussion into a little bit other direction ... >There is no problem. I ran qmail-pop3d off Maildirs for several months, >until I dropped it and switched to courier-imap. On 6.3, procmail is >probably not yet aware of Maildir. 1.) I think of switching some of my users from pop3 to imap ... Matthias you wrote about courier-imap ... My questions: - any experience with imap on qmail? - do I have to switch the whole thing to imap, or can I run pop3 and imap parallel? - what's about security with imap? (ok ... I know pop3 does not have any either) - are there different distributions of imap servers? (which one fits into qmail with vchkpw) 2.) Another theme is about virus scanners in mailer daemons. I've read an article about virus scanners which can be implemented directly into the postfix system ... Any experience with virus scanners for qmail? OK, I think this is enough for today ... Martin ----------------------------------------------------------------- Dipl.-Ing. Martin Schichl SC&C Software, Communication & Consulting GmbH & Co KEG Grottenhofstr. 3, A-8053 Graz Tel. +43/(0)316/265-205, Fax +43/(0)316/265-234 mschichl(a)scc.co.at, http://scc.co.at

8 8

Re: [suse-security] Bastille and other Linux distros
by michael.ryan＠storm.ie 28 Sep '01

28 Sep '01

IMHO any tool/script which offers SuSE users another choice when armouring their system would naturally be welcome :) Regards, Michael "Niki Rahimi" <narahimi@us. To: suse-security(a)suse.com ibm.com> cc: Subject: [suse-security] Bastille and other Linux distros 09/27/2001 05:57 PM Hi Everyone, I work with a security group in IBM's Linux Technology Center and have recently been working on a project to get the Bastille security hardening script to run on SuSE. I would like to get feedback from the discussion list on this project. Would this be something the SuSE community would be receptive to? In case you're not familiar with Bastille, their web site is at www.bastille-linux.org. If you have any further questions about this, please let me know. Thanks, Niki A. Rahimi narahimi(a)us.ibm.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

3 2

AW: [suse-security] Can't seem to get .htpasswd to work =(
by Battisti Markus 28 Sep '01

28 Sep '01

> > Bah! For the life of me, I can not get .htpasswd/.htaccess > to work on my > SuSE7.2 ( Apache/1.3.19 (Unix) (SuSE/Linux) mod_layout/1.0 > mod_throttle/3.0 > mod_fastcgi/2.2.2 mod_ssl/2.8.3 OpenSSL/0.9.6a mod_perl/1.25 mod_dtcl > PHP/4.0.5 ). > > I have everything (that I know to set up, anyway) set up as: > you tried this one ? http://sdb.suse.de/en/sdb/html/htaccess72.html that could help maybe ,,, /'^'\ ( o o ) oOOO--(_)--OOOo---------------------- Mit Freundlichen Grüssen/Best Regards Battisti Markus

2 1

Can't seem to get .htpasswd to work =(
by Fluffy Bananachunks 28 Sep '01

28 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bah! For the life of me, I can not get .htpasswd/.htaccess to work on my SuSE7.2 ( Apache/1.3.19 (Unix) (SuSE/Linux) mod_layout/1.0 mod_throttle/3.0 mod_fastcgi/2.2.2 mod_ssl/2.8.3 OpenSSL/0.9.6a mod_perl/1.25 mod_dtcl PHP/4.0.5 ). I have everything (that I know to set up, anyway) set up as: ########################################################### me@me:~/public_html - -rw-r--r-- 1 me me 209 Sep 27 21:27 .htaccess - -rw-r--r-- 1 me me 13 Sep 27 21:28 /home/me/.htgroup - -rw-r--r-- 1 me me 20 Sep 27 21:32 /home/me/.htpasswd /home/me/public_html/.htaccess: AuthName "Restricted" AuthType Basic AuthUserFile /home/me/.htpasswd AuthGroupFile /home/me/.htgroup <Limit GET POST> Require group chunks </Limit> /home/me/.htpasswd: test:VJdx0yi1Y3LKc {blank line as suggested on one site; also tried without} /home/me/.htgroup: chunks: test ############################################################ I've tried by group, user, "valid-user", with and without "Limit" in .htaccess, with and without a group (left off and /dev/null) .... The 'password box' always comes up, but no matter what, does not authorize me. Anyone have any insight as to what I'm skipping or missing here? TIA Geo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7s9t5o2oOGEnz8fYRAkFeAJ9eP/osgicxUvmQ3TxgUzDA2QeSVgCcC8yU voBtQ9LRKLAqPF17kJeskrA= =dGgz -----END PGP SIGNATURE-----

2 1

Are firewalls necessary?
by Ray Dillinger 28 Sep '01

28 Sep '01

I have a machine, which serves several purposes. It is my main development platform, and it is also my main webserver. I've gone through the system and shut down all network services I'm not using -- for example squid came down, because I am not using proxy service at all, and ftpd came down because I don't want to provide ftp services. Rlogin, fingerd, telnetd, hylafax, etc, are also gone. No trusted hosts are defined for rlogin and friends to use anyway; the other boxes on my network are not considered "safe". I'm using an apache server which I've been through extensive configuration on -- removing most of the modules because I wasn't using them. CGI is still there, but it's not activated on any host except the "default" host (which is only accessible from 127.0.0.1) and there are only two CGI scripts; These are the english-language "search" scripts that hunt through the documentation for keywords and topics, used by the SuSE help system, which I've kept onboard -- both of which I've audited for security. There were similar scripts to search in other languages, but since I'm not using other languages, they are gone now. Finally, the 'su' binary is moved to sbin, and not available to any user except root. I keep copies of my websites offline, on floppy disks. Ditto my inetd.conf, httpd.conf, and a few other configuration files. and, finally, my source code -- so if the machine ever gets subverted, I can restore them easily. Now, here is my question: Do I get material additional security from my firewall, or does over-the-top paranoia on the other aspects of the config obviate the need for it? Bear

9 13

AW: [suse-security] Can't seem to get .htpasswd to work =(
by Thomas Lamy 28 Sep '01

28 Sep '01

Make sure you have something like <Directory /home/*/public_html> AllowOverride AuthConfig ..... </Directory> in your httpd.conf, otherwise .htaccess files get ignored. Thomas -----Ursprüngliche Nachricht----- Von: Fluffy Bananachunks [mailto:suse.announce@bananachunks.org] Gesendet: Freitag, 28. September 2001 04:08 An: suse-security(a)suse.com Betreff: [suse-security] Can't seem to get .htpasswd to work =( -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bah! For the life of me, I can not get .htpasswd/.htaccess to work on my SuSE7.2 ( Apache/1.3.19 (Unix) (SuSE/Linux) mod_layout/1.0 mod_throttle/3.0 mod_fastcgi/2.2.2 mod_ssl/2.8.3 OpenSSL/0.9.6a mod_perl/1.25 mod_dtcl PHP/4.0.5 ). I have everything (that I know to set up, anyway) set up as: ########################################################### me@me:~/public_html - -rw-r--r-- 1 me me 209 Sep 27 21:27 .htaccess - -rw-r--r-- 1 me me 13 Sep 27 21:28 /home/me/.htgroup - -rw-r--r-- 1 me me 20 Sep 27 21:32 /home/me/.htpasswd /home/me/public_html/.htaccess: AuthName "Restricted" AuthType Basic AuthUserFile /home/me/.htpasswd AuthGroupFile /home/me/.htgroup <Limit GET POST> Require group chunks </Limit> /home/me/.htpasswd: test:VJdx0yi1Y3LKc {blank line as suggested on one site; also tried without} /home/me/.htgroup: chunks: test ############################################################ I've tried by group, user, "valid-user", with and without "Limit" in .htaccess, with and without a group (left off and /dev/null) .... The 'password box' always comes up, but no matter what, does not authorize me. Anyone have any insight as to what I'm skipping or missing here? TIA Geo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7s9t5o2oOGEnz8fYRAkFeAJ9eP/osgicxUvmQ3TxgUzDA2QeSVgCcC8yU voBtQ9LRKLAqPF17kJeskrA= =dGgz -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Re: [suse-security] iptables update ?
by Stefan_Walther＠gehag-dsk.de 28 Sep '01

28 Sep '01

Hi, it not only the rpm-archive. Sometimes I think the poeple are to lazy (I also don't want to point at anybody) to compile the packets. If they want the newest packets and dists they have o compile it or have to wait. I know it, because I am sometimes the same. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Roman Drahtmüller wrote: > [Some very good points about code maturity and Linux distributions] Hear, hear. I think it is important that many people who cry out loudly for the latest updates to be integrated in their favourite Linux distribution ASAP (or even go for "c'mon, the fix has been out for two days already, where's the RPM archive?") keep in mind that: - Newer ist not better by default. - Being up-to-date can also be defined as using a stable, if older, version of a product, so that the servers just do their job. - Everybody is free to invest her/his own time and resources on having installed the newest software. It is available for free on the Internet, as Roman pointed out. I have no intention to appear aggressive, and I don't point my finger at anybody. Besides, my colleagues know me for chasing the newest, hottest stuff myself, so I understand the motivation. I only want to express my thanks for the great work the people at SuSE, RedHat and other companies accomplish together with the Open Source community, and I ask all users for some patience on behalf of software developers everywhere... ;-) Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Recommended cookie suppression extension for Squid?
by Ralph Seichter 28 Sep '01

28 Sep '01

[This is a repost] I have used WebWasher for cookie suppression for quite some time now, and I think it is a great product. Alas, I want to try Squid as a combined filter/cache, so I am looking for a similar feature to handle cookies based on flexible rules. Internet searches returned Squid extensions like "adzap" ( http://www.zip.com.au/~cs/adzap/ ). What tool do *you* prefer for Squid cookie suppression? BTW, I consider this security related because I don't like the idea of being watched and measured by a trail of cookies, but if there's a different mailing list you suggest for this kind of topic, please point me to it. Thank you. Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

Re: [suse-security] iptables update ?
by Ralph Seichter 28 Sep '01

28 Sep '01

Roman Drahtmüller wrote: > [Some very good points about code maturity and Linux distributions] Hear, hear. I think it is important that many people who cry out loudly for the latest updates to be integrated in their favourite Linux distribution ASAP (or even go for "c'mon, the fix has been out for two days already, where's the RPM archive?") keep in mind that: - Newer ist not better by default. - Being up-to-date can also be defined as using a stable, if older, version of a product, so that the servers just do their job. - Everybody is free to invest her/his own time and resources on having installed the newest software. It is available for free on the Internet, as Roman pointed out. I have no intention to appear aggressive, and I don't point my finger at anybody. Besides, my colleagues know me for chasing the newest, hottest stuff myself, so I understand the motivation. I only want to express my thanks for the great work the people at SuSE, RedHat and other companies accomplish together with the Open Source community, and I ask all users for some patience on behalf of software developers everywhere... ;-) Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

battlecom with linuxserver
by Johannes Schäffner 28 Sep '01

28 Sep '01

i have counterstrike and battlecom installed on my win98 client.at the linux-server i have ipchains installed, so at the client counterstrike (and also icq,mirc etc.) works without any problems. but i can´t join or host any battlecom sessions. what do i have to change that battlecom works ( every port is open at ipchains) please help me!!! -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

SuSEfirewall2 question regarding FW_FORWARD_MASQ
by Magnus Hagebris 28 Sep '01

28 Sep '01

I have a setup that requires external machines to access an application on an internal machine (masqueraded) when using a specific protocol. A packet sent to the firewall (IP and protocol 200) should be redirected to the internal machine 192.168.0.40. Using tcp or udp instead of protocol 200 would work, but why does not other protocols work??? I'm using... FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.0.0/24" FW_FORWARD_MASQ="0/0,192.168.0.40,200" If I can't forward other protocols than udp/tcp can I solve this setup in a different way??? I mean instead of installing Solaris, since that OS allows you to forward other protocols (I heard...). Thanks, Magnus

1 0

Swappartition max size
by Thomas Michael Wanka 28 Sep '01

28 Sep '01

Hi, sorry if this is not strictly security related, but it resulted from a (possible) security problem (server was trashed by an intruder or at least from the outside - that has to be investigated). The current max. swap partition can be 2GB. What is recommended to do when more ram is installed to hold the core dump? Enough partitions to meet the actual ram size? A link to where to search is enough. TIA mike

2 2

Re: [suse-security] battlecom with linuxserver
by James Bliss 27 Sep '01

27 Sep '01

Do you have any entries in your firewall log which would possibly help in diagnosing this problem? Also, could you possibly post your ipchains rules (over write any personal IP info with something like <my box> or <my internal network>). This would really help everyone on the list help you. 09/27/01 04:49:25 PM, Johannes Schäffner <34773(a)gmx.de> wrote: >i have counterstrike and battlecom installed on my win98 client.at the >linux-server i have ipchains installed, so at the client counterstrike (and also >icq,mirc etc.) works without any problems. but i can´t join or host any >battlecom sessions. >what do i have to change that battlecom works ( every port is open at >ipchains) >please help me!!! > >-- >GMX - Die Kommunikationsplattform im Internet. >http://www.gmx.net > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

Re: [suse-security] iptables update ?
by James Bliss 27 Sep '01

27 Sep '01

Thank you Roman, I believe that you make several good points in your email. I have only been on SuSE for 6 months now. Started with 7.0, went to 7.1 and then 7.2. Bought the CDs everytime because the cost was much less than the time it would take me to download the software. I think that SuSE is a much better distro than Redhat, and have recommended it to several of my friends. Keep up the good work. If someone thinks that a newer software release is valuable to be installed on their box before it is available through SuSE they should download it from the origination site and therefore be responsible for any quirks which may be caused by doing this. Keep up the good work SuSE. And thank you very much for these mailing lists, some of the best support available for free or money. Jim 09/27/01 04:38:27 PM, Roman Drahtmueller <draht(a)suse.de> wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >> Hi, >> >> Finally I decided to start learning iptables hence installed the 2.4.7 >> kernel along with the iptables. The version comes on 7.2 is 1.2.1a (yes >> the kernel is also 2.4.4) should not be there an offical update to >> iptables out of curiosity ? > > >(This mail has become somewhat lengthy, but I wanted to write down some >thoughts on closely related topics that arise when I give the answer for >this question. Everything that has nothing to do with the actual question >above on this thread is written below the line "########", and it does not >contribute to the half-technical question. I do not wish that there will >be a discussion about the issues below on this list because it would >generate an off-topic lengthy thread. It's just that some of the things >below need to be said every once in a while in order to prevent >misunderstandings from distorting the aspects and benefits of open source >software.) > >The answer: >Not quite: The iptables utility is only the setup tool, it can't easily >be a security problem without messing up the rules during setup (You'd >easily notice! :-). The actual work of the packet filter engine happens >in the kernel, not in the ipchains utility. If your machine acts as a >packet filter only, you can easily kill all running processes and run >"rm -rf /" over it - it will continue to work until you try to reboot it. > >By consequence, the newer version fixes bugs that may be nasty in some >way, but there are none that were security-related. The version of >iptables that is on the CDs is installed on a few dozen thousand >installations, and in use one some thousands, I guess. A new version is >always different from the one before (this is why there is a new version >in the first place): different functionality and different bugs as well. >We cannot guarantee that the newer version works exatly like the one >before, which is why we don't provide a newer version of the package (with >iptables being just a simple example). > >Please look at the changelogs of single packages in the distribution, >especially the core packages and libraries, and look at the patches that >we include to fix bugs that we found during testing. In order to be taken >seriously in the operating systems market, you have to be able to maintain >a certain level of quality in your software. You make a tradeoff between >the up-to-dateness (and security) and the reliability (and security) of >your software. This implies that the functionality of a single package >must be guaranteed over the updates. By consequence, the version stays the >same: only those bugs are fixed that break the functionality of the >package or impose a security risk. If your favourite email program crashes >if you hit five keys together, then do not hit these five keys together. >If it crashes when a strange email arrives, it may be security related: >Write to security(a)suse.de, and use the pgp key to encrypt your text. New >versions in update packages can only happen if the new version number is >beneficial from the security standpoint, and if no other package >relies/depends on the package to be updated. >(Example: openssh. A user should be able to tell by the version number >that the recently discovered security bugs are fixed.) > > >################## > >There is a specific set of reasons why we make a new distribution every >once in a while (with a decreasing frequency): The opensource community >needs to have a new base to build on (a distribution sets standards that >are most important for the thing as a whole), and new features are desired >on behalf of the usership. Free software is for free: You can download it >from servers worldwide. But I wouldn't want someone else to do the job >that we've accomplished with each distribution (7.3 is out in a few days): >many thousands of hours of CPU-time have been used for compilation of code >and for stresstests, many hundreds of CDs have been burned, network >equipment and computer hardware has been bought just to test the software, >and many millions of keys have been hit, not to mention the thousands of >hours in long nights that developers at SuSE and the rest of the world >have sat down to track down crashes, add improvements to performance, >stability and security, provide a nicer, ergonomic interface and make it >what it is: A secure, powerful, flexible and stable operating system, >ready to use. It is what people expect from it (while everybody expects >something different). > > If you want to give yourself a nice lesson: Play distributor! Install a >SuSE-6.1, just a minimal package selection, then put away the CDs. Then, >get KDE-2.2.1 running on it, with a few dozen applications that do all >kinds of things from showing the time down to burning CDs and sending >mails. Compile from the source tarball, not SuSE source rpms. Modularize >the software that you have installed and keep an overview over it. Add >icons, G/X, eye candy, sounds so that you like it more. Check it for bugs, >identify crashes and find security problems. Deal with buggy hardware and >BIOSes. Ensure consistency of the ready-to-install packages that you >built. Make it possible to exchange parts of the system at full >consistency. Communicate the bugs that you've found to the maintainers and >authors of the software that you use (quite some people, many emails!). > After you have found out that you need to exchange basically everything >in your minimal system in order to be able to even compile the new stuff >(not to mention running or testing!), you can abbreviate to a minimal >SuSE-7.2 installation and restart from the beginning. After a few weeks >without much fun you will find out that kdm behaves strangely under some >obscure, but usual circumstances; watch out for race conditions and buffer >overflows while you nail down the reason why all of your processes get >nuked by SIGTERM sometimes. > If you're there, invest some time to sit down with others and argue the >technical reasons why you (lazily) added your docs to /opt/kde/docs >instead of /usr/share/doc. Be sure to have a comprehensive result >afterwards, so that your distribution follows the defined standards (SuSE >is leading in terms of that). Then you change what doesn't match the >standards, and recompile everything. Don't forget to write down how to use >it for your grandma and your kids. > >SuSE employs the best people that the world has for many of the subsystems >that a SuSE Linux distribution is built on. They are paid for doing their >job and for refining the software they wrote to a thing that you can use. >The software is still for free, the patches are for free (the distributors >even share their additions), but the fact that you can easily install and >use it is not! > Provided you earn only Euro 2.50 an hour, you couldn't make it in time to >be faster than 100 times the price of a Linux distribution (a SuSE in >particular). If you buy all the software that is on the (filled up to the >last byte) SuSE CDs from a commercial vendor, expect a bill of a few >hundred thousand Euro. I've never ever paid a single buck for software, >but if I didn't (proudly) work for SuSE, I'd pay significantly more. I >would want new versions of single software packages every few months, but >as you might know we're not forced to buy it either. It's just easier and >less expensive. > >The price of a Linux distribution does not compare to the price of >commercial software, but to the price your own time and your freedom. > >Thanks, >Roman. >- -- > - - >| Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | > SuSE GmbH - Security Phone: // you need vision!" >| Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | > - - >Feel free to pass on this text, provided that it is complete and unchanged! >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.0.6 (GNU/Linux) >Comment: http://www.suse.de/ > >iEYEARECAAYFAjuznF0ACgkQnkDjEAAKq6ThdQCgylOJsQtBgVLgHNSzayO2YIn3 >oIcAn2CM6fOoDfL2z3MmKYcU9Vxdbmci >=phZY >-----END PGP SIGNATURE----- > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

iptables update ?
by Togan Muftuoglu 27 Sep '01

27 Sep '01

Hi, Finally I decided to start learning iptables hence installed the 2.4.7 kernel along with the iptables. The version comes on 7.2 is 1.2.1a (yes the kernel is also 2.4.4) should not be there an offical update to iptables out of curiosity ? -- Togan Muftuoglu

4 3

Re: [suse-security] Bastille and other Linux distros
by Christopher Mahmood 27 Sep '01

27 Sep '01

* Niki Rahimi (narahimi(a)us.ibm.com) [010927 10:23]: > I work with a security group in IBM's Linux Technology Center and have > recently been working on a project to get the Bastille security hardening > script to run on SuSE. I would like to get feedback from the discussion > list on this project. Would this be something the SuSE community would be > receptive to? I haven't looked at Bastille in a while, but I don't remember it doing much more than what the tools our security team has developed. Specifically, the harden-suse script, the SuSEfirewall, and seccheck. I'm not flaming, I'm genuinely curious. -- -ckm

1 0

Re: Bastille and other Linux distros
by Richard Ibbotson 27 Sep '01

27 Sep '01

Niki > I work with a security group in IBM's Linux Technology Center > and have recently been working on a project to get the Bastille > security hardening script to run on SuSE. I would like to get > feedback from the discussion list on this project. Would this be > something the SuSE community would be receptive to? There's already a harden_suse.rpm that does something similar. If you want to know more write to the SuSE Security team. How about on Debian ? Thanks Richard www.sheflug.co.uk

1 0