February 2002 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] sendmail + cyrus-sasl
by Thomas Jöbstl 04 Feb '02

04 Feb '02

Tried the sendmail-tls package but it doesnt like my home-built certificates. Generated them with a slightly altered CA.pl script (-nodes options added) but it still bitches about a password. -----Ursprüngliche Nachricht----- Von: Evert Smit [mailto:admin@sidhe.net] Gesendet: Montag, 04. Februar 2002 12:58 An: mlistjoebstl(a)phorus.at Betreff: Re: AW: [suse-security] sendmail + cyrus-sasl there is a sendmail-tls package for your suse installation cheers

3 2

CVS checkouts trough Firewall
by Marcel Schmedes 04 Feb '02

04 Feb '02

Hello List, How can I perform CVS checkouts from a SUSE Linux 7.3 trough an 7.3 Firewall. On the Firewall Squid, apache and sendmail is installed. Is there any kind o proxy for this? Apologize my spelling. ;-) -- Mit freundlichen Grüßen Marcel Schmedes @ InnoSoft GmbH Registered Linux User: #258839 at http://counter.li.org/

2 1

T-DSL 'routing' through a network - is it unsafe ?!
by Michael Paarmann 04 Feb '02

04 Feb '02

Dear List members, Does anyone know, if it is a security risk when i connect a DSL modem by the TELEKOM with a switch and the computer with the pppoed demon is connected via a switch to the modem and not directly? At the moment the situation is, that the T-DSL-Modem is connected to a linux router pc with pppoed, squid, and iptables. With the second network device the pc is connected to the local network. Due different reasons it would be nice, if the modem is directly connected to a switch and the linux router is somewhere else. I'm not sure, if somebody can hack or modify different packets, so that they don't reach the pc with the pppoed demon but another local workstation. The T-DSL modem is not a real router (Modem by SIEMENS) and it can only be connected by one single pc, but is real safe ? Has anybody a hint ? Thanx a lot in advance. Michael

2 1

Online Update, automatic mirroring of relevant packages
by l.g.e＠web.de 03 Feb '02

03 Feb '02

Hi List, since YaST online update feature has been discusse recently, I thought this could be of interest. Because of an unstable modem dialup at home I once wrote a dirty hack to check which packages I would need and download them first. Couple of weeks ago Peter Nixon asked the list about howto build a lookup table of installed packages for a whole network using snmpwalk, which inspired me. So here is amorsu, automatic mirroring of relevant suse updates. It uses ssh with dedicated user 'rpmqa', key authorization and forced command (cat /etc/SuSE-release && rpm -qa) on all the machines to build a plain text db on the mirroring machine. This is reorganized package wise, so now I have a lookup table for each package, which version is on which host in my network. If the respective file does not exist, none of my hosts has the package. Then it mirrors for each of the identified architectures/releases only the patches (ok, patches.cont) dirs. These description files are parsed in a very simple manner, so far it works (-- keep the structure, SuSE!). For each available update package mentioned in the descriptions, lookup the package: do I have it installed somewhere? outdated version? yes? ok, mirror that package, too. And --checksig, of course. Generates a report of which packages have been donwloaded and which hosts have to be updated for which packages. for these hosts now I can point either rpm or yast2 online_update to the local mirror. has to be tested by someone else but me to verify that it actually works... any volunteers? I'd like to send the perl script and some setup instructions in private mail, 'tis ~450 lines. Thanks lars

3 2

SuSEfirewall, SuSE7.3; block domains and IPs?
by fluffy bananachunks 03 Feb '02

03 Feb '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm using SuSEfirewall-5.0-32 on SuSE7.3Pro, and I can't seem to figure out how to make it so that I can block a list of domains and/or IPs using SuSEfirewall. Could someone please be so kind as to point me in the right direction for this? TIA Geo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8XN73o2oOGEnz8fYRAtDUAJ0fZaEgJ9HBJ3R20MJsb6Iz+6tdEACfehnO sEk3/ZSUGRoGeqHskBXA7Dg= =GFgS -----END PGP SIGNATURE-----

1 0

PAM problems with MD5 passwords and software compiled from scratch?
by Michael Zimmermann 02 Feb '02

02 Feb '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, using the newest pam and pam-devel (both version 0.75-78) I am observing problems with software, which I compile from the newest source. Openssh 3.0.3p1 as well as qpopper 4.0.3 configured --with-pam cannot authenticate users with MD5-passwords, while authentication of users with older non-md5-passwords works fine. When I configure the software --without-pam everything works fine. This was solving my problem, but I thought it might be interesting to bring up this strange behaviour to your attention. Probably it's a pam problem? Has anybody experienced similiar problems or can give a pointer to what's incompatible here? Thanks for your help and attention. Michael - -- Michael Zimmermann (Vegaa Internet Services) <zim(a)vegaa.de> phone +49 89 6283 7632 hotline +49 163 823 1195 Key fingerprint = 1E47 7B99 A9D3 698D 7E35 9BB5 EF6B EEDB 696D 5811 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8XA+n72vu22ltWBERApyqAKCBIpKID6gfb99TyjvyOn3OAHBFfwCgg1bA YaIUvdWE/Sa13iKHHf8NqR8= =uwQy -----END PGP SIGNATURE-----

1 0

MD5 passwords
by Boris Kimel 02 Feb '02

02 Feb '02

Hi All, Just another dummy question: how do I switch to using MD5 passwords on SuSE 7.3 provided there are plenty users' accounts already? Thanks, Boris.

3 4

Root access via ssh??
by Praise 01 Feb '02

01 Feb '02

Hi all, After a fresh install of Suse 7.1 I have noticed that ssh allows root remote access. I have tried to disable it via pam /etc/security/access.conf but it does not work. How do I do it? Praise

7 6

Re: [suse-security] CVS checkouts trough Firewall
by Thomas Lamy 01 Feb '02

01 Feb '02

> Hello List, > How can I perform CVS checkouts from a SUSE Linux 7.3 trough an 7.3 > Firewall. On the Firewall Squid, apache and sendmail is installed. > Is there any kind o proxy for this? > Apologize my spelling. ;-) > It's not clear to me from where you want to check out stuff, and how your fw is set up. CVS pserver checkouts (common for most open source packages) are no real problem from masqueraded clients. And if you want to provide your own cvs server for a team or public, you could set up ip forwarding on your firewall redirecting the cvs pserver port to your internal cvs server ip, or use cvs's rsh mode over ssh. > -- > Mit freundlichen Grüßen > Marcel Schmedes @ InnoSoft GmbH > Registered Linux User: #258839 at http://counter.li.org/ Thomas

1 0

Re: [suse-security] Security testing
by Thomas Lamy 01 Feb '02

01 Feb '02

> > Hi all, > > I use SuSE7.0 , SuSE6.4 , SuSE6.3.=20 > After setting up all the servers - mail , apache , squid, > firewall. > How can I know my server is in secur or not? First of all, get rid of SuSE 6.x - most (all?) of them are no longer supported (no more security updates). When installing new servers, you should a) use a stable, supported dist (IMHO SuSE 7.3 matches) b) apply any vendor patches (using YOU) c) scan the installed and configured servers (eg with nessus), re-check for unneeded services running d) test, test, test. Not in your home/office environment, but in a customer-like one (ok, not really security related, but neccessary) And in general: e) subscribe to one or more security related lists (and read the messages) f) keep an eye on security announcements, and for the SuSE ones, check the "pending vulnerabilities" section carefully > Of course, I want to test my server before launching officially. > > Any help will be apreciated. > Thanks you in advance > > Regards, > > lonh You're welcome. Thomas

1 0

Security Testing
by LTG 01 Feb '02

01 Feb '02

Hi all, I use SuSE7.0 , SuSE6.4 , SuSE6.3. After setting up all the servers - mail , apache , squid, firewall. How can I know my server is in secur or not? Of course, I want to test my server before launching officially. Any help will be apreciated. Thanks you in advance Regards, lonh

2 1

Users' WWW servers setup
by Boris Kimel 01 Feb '02

01 Feb '02

Hello suse-security List Members, Our SuSE box users want to have their own virtual www-servers. I've set up ProFTPD with chroot to user's home directory. The probable setup for the www will be using /home/<user>/www/ structure, where I intend to put a small config file (included into main apache config) and the log files will be there too. Will I face any security issues with such a setup? Are there any other approaches? -- Best regards, Boris mailto:kimel@1303.ru

3 4

Antwort: [suse-security] Security Testing
by BLeonhardt＠analytek.de 01 Feb '02

01 Feb '02

hi, try a portscanner :-) ... Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ________________________________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 "LTG" <012990918@mobit An: <suse-security(a)suse.com> el.com.kh> Kopie: Thema: [suse-security] Security Testing 01.02.02 03:34 Hi all, I use SuSE7.0 , SuSE6.4 , SuSE6.3. After setting up all the servers - mail , apache , squid, firewall. How can I know my server is in secur or not? Of course, I want to test my server before launching officially. Any help will be apreciated. Thanks you in advance Regards, lonh

1 0

Security testing
by LTG 01 Feb '02

01 Feb '02

Hi all, I use SuSE7.0 , SuSE6.4 , SuSE6.3.=20 After setting up all the servers - mail , apache , squid, firewall. How can I know my server is in secur or not? Of course, I want to test my server before launching officially. Any help will be apreciated. Thanks you in advance Regards, lonh

1 0