September 2001 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] Can't seem to get .htpasswd to work =(
by Battisti Markus 28 Sep '01

28 Sep '01

> > Bah! For the life of me, I can not get .htpasswd/.htaccess > to work on my > SuSE7.2 ( Apache/1.3.19 (Unix) (SuSE/Linux) mod_layout/1.0 > mod_throttle/3.0 > mod_fastcgi/2.2.2 mod_ssl/2.8.3 OpenSSL/0.9.6a mod_perl/1.25 mod_dtcl > PHP/4.0.5 ). > > I have everything (that I know to set up, anyway) set up as: > you tried this one ? http://sdb.suse.de/en/sdb/html/htaccess72.html that could help maybe ,,, /'^'\ ( o o ) oOOO--(_)--OOOo---------------------- Mit Freundlichen Grüssen/Best Regards Battisti Markus

2 1

Can't seem to get .htpasswd to work =(
by Fluffy Bananachunks 28 Sep '01

28 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bah! For the life of me, I can not get .htpasswd/.htaccess to work on my SuSE7.2 ( Apache/1.3.19 (Unix) (SuSE/Linux) mod_layout/1.0 mod_throttle/3.0 mod_fastcgi/2.2.2 mod_ssl/2.8.3 OpenSSL/0.9.6a mod_perl/1.25 mod_dtcl PHP/4.0.5 ). I have everything (that I know to set up, anyway) set up as: ########################################################### me@me:~/public_html - -rw-r--r-- 1 me me 209 Sep 27 21:27 .htaccess - -rw-r--r-- 1 me me 13 Sep 27 21:28 /home/me/.htgroup - -rw-r--r-- 1 me me 20 Sep 27 21:32 /home/me/.htpasswd /home/me/public_html/.htaccess: AuthName "Restricted" AuthType Basic AuthUserFile /home/me/.htpasswd AuthGroupFile /home/me/.htgroup <Limit GET POST> Require group chunks </Limit> /home/me/.htpasswd: test:VJdx0yi1Y3LKc {blank line as suggested on one site; also tried without} /home/me/.htgroup: chunks: test ############################################################ I've tried by group, user, "valid-user", with and without "Limit" in .htaccess, with and without a group (left off and /dev/null) .... The 'password box' always comes up, but no matter what, does not authorize me. Anyone have any insight as to what I'm skipping or missing here? TIA Geo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7s9t5o2oOGEnz8fYRAkFeAJ9eP/osgicxUvmQ3TxgUzDA2QeSVgCcC8yU voBtQ9LRKLAqPF17kJeskrA= =dGgz -----END PGP SIGNATURE-----

2 1

Are firewalls necessary?
by Ray Dillinger 28 Sep '01

28 Sep '01

I have a machine, which serves several purposes. It is my main development platform, and it is also my main webserver. I've gone through the system and shut down all network services I'm not using -- for example squid came down, because I am not using proxy service at all, and ftpd came down because I don't want to provide ftp services. Rlogin, fingerd, telnetd, hylafax, etc, are also gone. No trusted hosts are defined for rlogin and friends to use anyway; the other boxes on my network are not considered "safe". I'm using an apache server which I've been through extensive configuration on -- removing most of the modules because I wasn't using them. CGI is still there, but it's not activated on any host except the "default" host (which is only accessible from 127.0.0.1) and there are only two CGI scripts; These are the english-language "search" scripts that hunt through the documentation for keywords and topics, used by the SuSE help system, which I've kept onboard -- both of which I've audited for security. There were similar scripts to search in other languages, but since I'm not using other languages, they are gone now. Finally, the 'su' binary is moved to sbin, and not available to any user except root. I keep copies of my websites offline, on floppy disks. Ditto my inetd.conf, httpd.conf, and a few other configuration files. and, finally, my source code -- so if the machine ever gets subverted, I can restore them easily. Now, here is my question: Do I get material additional security from my firewall, or does over-the-top paranoia on the other aspects of the config obviate the need for it? Bear

9 13

AW: [suse-security] Can't seem to get .htpasswd to work =(
by Thomas Lamy 28 Sep '01

28 Sep '01

Make sure you have something like <Directory /home/*/public_html> AllowOverride AuthConfig ..... </Directory> in your httpd.conf, otherwise .htaccess files get ignored. Thomas -----Ursprüngliche Nachricht----- Von: Fluffy Bananachunks [mailto:suse.announce@bananachunks.org] Gesendet: Freitag, 28. September 2001 04:08 An: suse-security(a)suse.com Betreff: [suse-security] Can't seem to get .htpasswd to work =( -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bah! For the life of me, I can not get .htpasswd/.htaccess to work on my SuSE7.2 ( Apache/1.3.19 (Unix) (SuSE/Linux) mod_layout/1.0 mod_throttle/3.0 mod_fastcgi/2.2.2 mod_ssl/2.8.3 OpenSSL/0.9.6a mod_perl/1.25 mod_dtcl PHP/4.0.5 ). I have everything (that I know to set up, anyway) set up as: ########################################################### me@me:~/public_html - -rw-r--r-- 1 me me 209 Sep 27 21:27 .htaccess - -rw-r--r-- 1 me me 13 Sep 27 21:28 /home/me/.htgroup - -rw-r--r-- 1 me me 20 Sep 27 21:32 /home/me/.htpasswd /home/me/public_html/.htaccess: AuthName "Restricted" AuthType Basic AuthUserFile /home/me/.htpasswd AuthGroupFile /home/me/.htgroup <Limit GET POST> Require group chunks </Limit> /home/me/.htpasswd: test:VJdx0yi1Y3LKc {blank line as suggested on one site; also tried without} /home/me/.htgroup: chunks: test ############################################################ I've tried by group, user, "valid-user", with and without "Limit" in .htaccess, with and without a group (left off and /dev/null) .... The 'password box' always comes up, but no matter what, does not authorize me. Anyone have any insight as to what I'm skipping or missing here? TIA Geo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7s9t5o2oOGEnz8fYRAkFeAJ9eP/osgicxUvmQ3TxgUzDA2QeSVgCcC8yU voBtQ9LRKLAqPF17kJeskrA= =dGgz -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Re: [suse-security] iptables update ?
by Stefan_Walther＠gehag-dsk.de 28 Sep '01

28 Sep '01

Hi, it not only the rpm-archive. Sometimes I think the poeple are to lazy (I also don't want to point at anybody) to compile the packets. If they want the newest packets and dists they have o compile it or have to wait. I know it, because I am sometimes the same. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Roman Drahtmüller wrote: > [Some very good points about code maturity and Linux distributions] Hear, hear. I think it is important that many people who cry out loudly for the latest updates to be integrated in their favourite Linux distribution ASAP (or even go for "c'mon, the fix has been out for two days already, where's the RPM archive?") keep in mind that: - Newer ist not better by default. - Being up-to-date can also be defined as using a stable, if older, version of a product, so that the servers just do their job. - Everybody is free to invest her/his own time and resources on having installed the newest software. It is available for free on the Internet, as Roman pointed out. I have no intention to appear aggressive, and I don't point my finger at anybody. Besides, my colleagues know me for chasing the newest, hottest stuff myself, so I understand the motivation. I only want to express my thanks for the great work the people at SuSE, RedHat and other companies accomplish together with the Open Source community, and I ask all users for some patience on behalf of software developers everywhere... ;-) Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Recommended cookie suppression extension for Squid?
by Ralph Seichter 28 Sep '01

28 Sep '01

[This is a repost] I have used WebWasher for cookie suppression for quite some time now, and I think it is a great product. Alas, I want to try Squid as a combined filter/cache, so I am looking for a similar feature to handle cookies based on flexible rules. Internet searches returned Squid extensions like "adzap" ( http://www.zip.com.au/~cs/adzap/ ). What tool do *you* prefer for Squid cookie suppression? BTW, I consider this security related because I don't like the idea of being watched and measured by a trail of cookies, but if there's a different mailing list you suggest for this kind of topic, please point me to it. Thank you. Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

Re: [suse-security] iptables update ?
by Ralph Seichter 28 Sep '01

28 Sep '01

Roman Drahtmüller wrote: > [Some very good points about code maturity and Linux distributions] Hear, hear. I think it is important that many people who cry out loudly for the latest updates to be integrated in their favourite Linux distribution ASAP (or even go for "c'mon, the fix has been out for two days already, where's the RPM archive?") keep in mind that: - Newer ist not better by default. - Being up-to-date can also be defined as using a stable, if older, version of a product, so that the servers just do their job. - Everybody is free to invest her/his own time and resources on having installed the newest software. It is available for free on the Internet, as Roman pointed out. I have no intention to appear aggressive, and I don't point my finger at anybody. Besides, my colleagues know me for chasing the newest, hottest stuff myself, so I understand the motivation. I only want to express my thanks for the great work the people at SuSE, RedHat and other companies accomplish together with the Open Source community, and I ask all users for some patience on behalf of software developers everywhere... ;-) Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

battlecom with linuxserver
by Johannes Schäffner 28 Sep '01

28 Sep '01

i have counterstrike and battlecom installed on my win98 client.at the linux-server i have ipchains installed, so at the client counterstrike (and also icq,mirc etc.) works without any problems. but i can´t join or host any battlecom sessions. what do i have to change that battlecom works ( every port is open at ipchains) please help me!!! -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

SuSEfirewall2 question regarding FW_FORWARD_MASQ
by Magnus Hagebris 28 Sep '01

28 Sep '01

I have a setup that requires external machines to access an application on an internal machine (masqueraded) when using a specific protocol. A packet sent to the firewall (IP and protocol 200) should be redirected to the internal machine 192.168.0.40. Using tcp or udp instead of protocol 200 would work, but why does not other protocols work??? I'm using... FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.0.0/24" FW_FORWARD_MASQ="0/0,192.168.0.40,200" If I can't forward other protocols than udp/tcp can I solve this setup in a different way??? I mean instead of installing Solaris, since that OS allows you to forward other protocols (I heard...). Thanks, Magnus

1 0

Swappartition max size
by Thomas Michael Wanka 28 Sep '01

28 Sep '01

Hi, sorry if this is not strictly security related, but it resulted from a (possible) security problem (server was trashed by an intruder or at least from the outside - that has to be investigated). The current max. swap partition can be 2GB. What is recommended to do when more ram is installed to hold the core dump? Enough partitions to meet the actual ram size? A link to where to search is enough. TIA mike

2 2