January 2002 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Is bind 9.1.0 secure?
by Reckhard, Tobias 22 Jan '02

22 Jan '02

> We had a discussion about djbdns on a local maillinglist in > Berlin. It's not offering all features that bind offers. While this may well be true, many people probably don't need certain features at all. And there are workarounds or patches for quite a few of the 'problems' that a certain number of people have with the pure djbdns. Perhaps you could point out which specific features you miss? > I don't > know if zone transfers are supported currently, some time ago you > had to fiddle around with rsync or such things. Zone transfers are supported in the current version (djbdns 1.05), but you need the separate ucspi-tcp package to provide TCP client and server. DJB argues against zone transfers and urges people to use rsync (preferrably over SSH) instead, for several reasons outlined on his web page. However, tinydns (the DNS server) in combination with axfrdns (the TCP request and AXFR responder) servers zone transfers just fine. tinydns does not pull zones per zone transfer automatically, so you need to use cron jobs to pull from the clients on a regular basis to emulate AXFR behaviour. DJB favours a push approach (which BIND8, I believe, has introduced with NOTIFY as well) via rsync/ssh. You could also use SSH with automatic command execution (command='cd /etc/tinydns/root && tcpclient 1.2.3.4 53 axfr.get zone data data.tmp && && make') to achieve the same effect. > For non-trivial > setups (i.e. some hunderds zones and a handful secondaries) I > would not recommend such approach but use bind8 instead. IMHO, that depends on what you favour: a relatively bloated piece of software with a pretty poor security track that most organisations and documents expect, which therefore means that you'll find HowTos, etc. geared towards it, or a couple of small, highly secure tools that work differently than the former and may require some scripting around them to achieve the same features, however usually implemented with higher quality. > If you > need cryptography, I think there is no way around bind9 > currently. For a small private caching only server djbdns may be > a nice solution. Hmm, what do you mean with 'cryptography'? You may be right, if you mean that djbdns doesn't support 'SecDNS', which DJB doesn't believe in, BTW (this is meant merely as an explanation, my opinion doesn't necessarily converge with DJB here or elsewhere). It can be configured to support FreeS/WAN's opportunistic encryption by handing out KEY records, and the FreeS/WAN docs speak of SecDNS... so maybe djbdns does actually support 'cryptography'. I don't know enough about the so-called Secure DNS to be able to say. Cheers Tobias

6 5

Why MY ftp failed always
by sambit 22 Jan '02

22 Jan '02

Hi, Can any one help me, i am trying to do ftp to my Linux suse 7.2 server and i am always gettig 421 Service not available, remote server has closed connection i changed the file like Search for the following entries in /etc/inetd.conf : ftp stream tcp nowait root /usr/sbin/tcpd wu.ftpd -a # ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd but i did not get any luck , is there any command to find /see all packages installed in SUSE-7.2, or what is the bast way to install or remove package in SUSE, if i am not using rpm -i for install, but is there any option in rpm to display all packages ? Thanks Sambit

5 4

Why can't root login at xdm on one system?
by Reckhard, Tobias 22 Jan '02

22 Jan '02

Hi all Does anyone have an idea why xdm can't successfully verify root's password on one of my systems? This not only prevents root from logging in, but also forces me to login to be able to shut the system down, because I've set the system to allow only root to perform shutdown. This is the only one of my SuSE 7.3 systems with this problem. I've compared /etc/pam.d/xdm, /opt/kde2/share/config/kdm/kdmrc, /etc/passwd and /etc/shadow. I see nothing in /var/log/messages, /var/log/warn or /var/log[k|x]dm to indicate a problem when I attempt to login as root. I *can* su to root. The only thing I see in /var/log/messages that seems relevant to me are entries similar to the following: Jan 18 05:58:52 snsfr002 PAM-unix2[9802]: session started for user reckhard, service xdm Jan 18 06:31:22 snsfr002 PAM-unix2[9802]: session finished for user reckhard, service xdm I see those for user root on the working systems, but nothing on the one with the problem (snsfr002). Any hints? Cheers Tobias -- Tobias Reckhard secunet Security Networks AG Tel : +49(6196)95888-42 Mergenthalerallee 77 Fax : +49(6196)95888-88 D-65760 Eschborn E-Mail: tobias.reckhard(a)secunet.com

2 1

RE: [suse-security] Is bind 9.1.0 secure?
by Reckhard, Tobias 22 Jan '02

22 Jan '02

> you forgot one reason to use bind, and this one is important > and security > relevant: The number of others using it and the resulting amount of > documentation and help available! The same is true für MS products. > > Customers use bind because if they have problems help is > available. There are > books they can buy. The DNS technicians of their ISP can > help. This is an > important reason to use bind. This would be a valid point. But it is my experience that an extremely high percentage of the people using MS software doesn't know how to use it properly. And regarding the server components, even very many 'experts' are too ignorant to deserve the title at all. Same goes for most BIND installations out there. The people in charge of them know the basics of DNS, but that's about it, most of the time. I have yet to come to a customer site and find the current version of BIND, i.e. one without known security issues, aka root exploits, running. Many of the configurations I see are wrong or highly insecure, reverse zones are missing, etc... IMHO, this is very much similar to the high proportion of vulnerable IIS servers on the 'Net. Cheers Tobias

1 0

RE: [suse-security] Is bind 9.1.0 secure?
by Reckhard, Tobias 22 Jan '02

22 Jan '02

Re Kurt > > Have you read DJB's comments? > > Yes. And? His comments with regard to Postfix are incorrect > (i.e. wrong) and > seriously out of date. True. And I agree that his social skills leave to be desired.. > Have you read this: > > http://www.sigmasoft.com/~openbsd/archive/openbsd-ports/200108/msg00461.html > > It got bad enough that OpenBSD dropped his software from _ports_. Ah yes, the eternal DJB license debate. I don't like it either and it prohibits distribution vendors from distributing his software, but it's not the software or its quality that's the problem (though I agree that Dan is rather unorthodox in his use of directories and he invents new root-level subdirectories every now and then, which I don't really much like - OTOH, lots of programs use very different directories for similar tasks..), it's Dan's urge to remain totally in control and his crusade for his beliefs. > Plus most of his software stagnates quite quickly, and he doesn't officially > accept contributions, so you end up missing basic functionality that is > addressed by third party (unaudited typically) patches. Well, if features you need are missing, you shouldn't use the software and go find something else instead. I don't feel that each and every mail server needs or should even have all the bells and whistles of MS Exchange. When the product is done and the task its coder wanted it to perform is completed by it, why shouldn't he call it a final? Note that I don't use Qmail, but rather Postfix, and I prefer Wietse's attitude to Dan's any day (and this is my personal opinion). But regarding DNS servers, there is no choice corresponding to the one between Postfix and Qmail. It's BIND or djbdns, which is more like a Qmail to Sendmail comparison. And I don't really trust 'complete rewrites' a lot, honestly, it takes time to produce a certain number of lines of code and the BIND folks were pretty fast with BIND9 if it's from scratch.. It probably also retains a lot of the not-so-good ideas of former BIND versions with regard to handling glue, etc.. Cheers Tobias

1 0

syslog on 72 version question
by Thomas Michael Wanka 22 Jan '02

22 Jan '02

Hi, I am chasing bugs and am looking for following information: The SuSE homepage lists for SuSE 7.1 an update package with syslogd 1.3.33 from may 2001 that should correct some problems. I have SuSE 7.2 and "syslogd -v" reports "syslogd 1.3-3". To me this looks like the 7.2 version is older than the suggested update for 7.1, could this be correct? TIA mike

2 3

probs with ftp-masquerading
by OKDesign oHG Security Administrator 22 Jan '02

22 Jan '02

Hi folks, this question is not really directly security-related, but I'm gonna post it here, because I got the problem due to my intention to be as secure as possible :) As I read that the "older" kernel 2.2 is not as secure as the newer one 2.4 is, I installed my linux-machine complete from the crab with SuSE 7.3. This box acts as a Router/Gateway for the LAN. On the first sight everything works fine, but I found that its not possible to connect to ftp-servers from the clients. Well, the connection itself works, but I can't get the dirlist. I tried out several servers, all with the same effort: Connection works, but when the client wants to get the dir, connection hangs. I know I had the same problem with 2.2 and could solve it with "insmod ftp_masq" (or similar) but now this module can't be found on the whole HDD. Maybe there is a special iptables-command necessary ? Can someone please point me to the right direction and/or tell me how to get this to work ? Routing/MAsquerading is actually done with: iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE echo 1 > /proc/sys/net/ipv4/ip_forward Is something missing ? Thanks in advance for your help. Stephan

4 4

VPN, Part II - Right Side BEHIND a Cisco PIX NAT/Masq.
by Argentium G. Tiger 21 Jan '02

21 Jan '02

Okay, I've got leg one of the IPSEC VPN up with SuSE 7.3. Public and many thanks to Nadeem Hasan. :-) What was stopping me at the last was that SuSEfirewall2's config file (/etc/rc.config.d/firewall2.rc.config) had two external interfaces defined (eth0 and ipsec0). Specifically: FW_DEV_EXT="eth0 ipsec0" A bit later on in the config, I declared the interface to masquerade on as the variable $FW_DEV_EXT, which meant both eth0 and ipsec0 were being masqueraded. ipsec0 can NOT be masqueraded! It confuses the heck out of IPSEC. :-) Specifically, what I had was: FW_MASQ_DEV="$FW_DEV_EXT" What it should have been and now is: FW_MASQ_DEV="eth0" Okay, on to my current dilemma. Everything up to now has been a testbed between two SuSEfirewall 7.3 machines running SuSEfirewall2 version 2.1, and Free S/WAN 1.91. Both the left and right machines had an external address that actually lived on the internet. Now I need to connect in a 'right side' that lives masqueraded behind a Cisco Pix firewall, but it is 1:1 bound with a live internet IP. Specifically: Address a.b.c.d is bound to internal address 10.100.0.26. Or in more detail, eth0 on this new machine is: IP: 10.100.0.26 Mask: 255.255.255.0 GW: 10.100.0.1 So on the right side of the ipsec.conf, what I'm thinking of using is: rightid=@rightid right=10.100.0.26 rightsubnet=10.100.0.0/24 rightupdown=/usr/lib/ipsec/_updown_custom rightrsasigkey=[snipped] auto=start On the left machine is when this becomes problematic... Now I need to define the right stuff differently I'll bet by using the external address instead of 10.100.0.26, since that's meaningless to the outside world. Something like: rightid=@rightid right=a.b.c.d rightsubnet=10.100.0.0/24 rightupdown=/usr/lib/ipsec/_updown_custom rightrsakey=[snipped] auto=start Have I understood this correctly? Comments? Thoughts? Am I in for a world of hurt here? :-) (Okay, that one's a given) Argentium

1 0

RE: [suse-security] probs with ftp-masquerading
by OKDesign oHG Security Administrator 21 Jan '02

21 Jan '02

Hi GertJan, hi list, actually I have no firewall installed yet, because this will be done step-by-step when everything works. Anyway, I took a first look, but couldn't find anything helpful there. If I missed something, please tell. Thanks. Stephan -----Original Message----- From: GertJan Spoelman [mailto:rs2000@xs4all.nl] Sent: Monday, January 21, 2002 9:35 PM To: 'OKDesign oHG Security Administrator' Subject: RE: [suse-security] probs with ftp-masquerading > -----Original Message----- > From: OKDesign oHG Security Administrator > [mailto:security@okdesign.de] > Sent: Monday, January 21, 2002 9:14 PM > To: suse-security(a)suse.com > Subject: [suse-security] probs with ftp-masquerading > Hi Stephan, > Can someone please point me to the right direction and/or > tell me how to get > this to work ? You also could take a look at SuSEfirewall2, you can find it here: http://www.suse.de/~marc Even if you want to built your own firewall you can use it as an example. GertJan > Routing/MAsquerading is actually done with: > iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE > echo 1 > /proc/sys/net/ipv4/ip_forward > > Is something missing ? > > Thanks in advance for your help. > > Stephan

1 0

Squid 2.4 and Squid 2.5; Security or what!!
by Mark Tinka 21 Jan '02

21 Jan '02

hi list.. i was wondering why SuSE is always shipping stable Squid versions in its distro releases, that are over a year old.. for instance, SuSE 7.2 Pro ships with Squid-2.3 STABLE3, by default.. while this is the stable version, Squid-2.4, which is on the CDs as well, is not stable, and is still in beta stages... i am sure SuSE 7.3 Pro has somewhat the same problem, correct me if am wrong.. is it a security issue that SuSE doesn't release it's distros with the latest Squid versions, or something else... the rest of the world is currently working with Squid-2.5, which is soon being released as stable.. what is SuSE up to..?.. any ideas at least when Squid-2.4 will become mainstream..?.. thanks.. AKNIT __________________________________________________ Do You Yahoo!? Everything you'll ever need on one web page from News and Sport to Email and Music Charts http://uk.my.yahoo.com

4 4