February 2002 - openSUSE Security - openSUSE Mailing Lists

openssh
by Ralf Schoenian 26 Feb '02

26 Feb '02

Hello, I have tried to install a new openssh version on a SuSE Linux 6.4 The rpm expected the glibc 2.2 so I have installed this too. Now I am in trouble. A friend told me, that the server will not reboot. Is that true? Does anyone have an idea what I can do? Regards, Ralf Schoenian

11 14

iptables and mark
by Carlos 26 Feb '02

26 Feb '02

i am using iptables in my suse 7.3 i i make this: iptables -A INPUT -t mangle -p tcp --dport 80 -j MARK --set-mark 1 the suse says me: iptables: No chain/target/match by that name. what is the problem? how can i solve this problem? thanks

2 1

Changing Masq-Nets on the fly
by Boris Kantwerk 26 Feb '02

26 Feb '02

Hi List! I have a linux router for three subnets, with DSL on-demand, SuSEFirewall2 everything is working fine. In the firewall2.rc.config there is a line FW_MASQ_NETS which defines, which internal nets are allowed to acces the internet directly. How can I change this setting, without restarting the complete firewall. Some of the subnets may not connect the internet all the time, so I need a way to change this setting. I think, that a script with some 'iptables' commands can change this setting, but I don't know how. Greets, Boris Kantwerk.

1 0

Fw: [suse-security] iptables and mark
by Michael Stern 26 Feb '02

26 Feb '02

yes, you need to create the input chain for the "mangle" table. the mangle table exists, but you have no chains in the mangle table. iptables -t mangle -N INPUT are you sure you don't have to use another name? don't get me wrong, i never actually did use the mangle table, but usually the necessary chains are being created automatically as soon as you load the appropriate modules. cheers, michael

1 0

efficient values for traffic-limits?
by da_bug＠gmx.net 26 Feb '02

26 Feb '02

Hi, below I have two cases for limiting traffic / connections: # MAX HTTP-TRAFFIC (APACHE-WEBSERVER) iptables -A INPUT -p tcp --dport 80 --syn -m limit --limit 60 / minute -j ACCEPT iptables -A INPUT -p tcp --dport 80 --syn -j REJECT --reject-with port unreachable # SYN-FLOODING PROTECTION iptables -N syn-flood iptables -A INPUT -i eth0 -p tcp --syn -j syn-flood iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN iptables -A syn-flood -j DROP My question: Are this "realistic" values: 60 / min http & 1/s syn ?? I am not sure about how much traffic "normal" systems can handle without too big problems...(I think it must be more than in my examples..?) In my case I have one server with PI-200-CPU/64MB and isdn-dialup-connection and one server with K6-2-300-CPU/128MB and sdsl-connection (via ethernet), both linux-2.4.x with iptables. What values would be efficient for these systems? Bye. <da_bug(a)gmx.net>

1 0

Fw: [suse-security] iptables and mark
by Michael Stern 26 Feb '02

26 Feb '02

> iptables -A INPUT -t mangle -p tcp --dport 80 -j MARK --set-mark 1 - does the input chain exist? - did you load the iptable_mangle module (try: iptables -t mangle -L INPUT) ? - did you load the ipt_MARK module? cheers, michael

2 1

Re: [suse-security] Masq with an ISDN card ...how to ??
by Stefan_Walther＠gehag-dsk.de 26 Feb '02

26 Feb '02

Hi, just use YaST to enable isdn with dial-on-demand, the script for masquerding can run at everytim, you do not need to enter your ip or something like that, because you can limit it to the ippp+ interface, for using the second channel there is an howto in the internet. if i remember correctly it is also available at the support-database of SuSE. Best Regards, MfG. Stefan Walther stefan_walther(a)gehag-dsk.de stefan.walther(a)gmx.net dienst.: +4930/89786448 Funk: +49172/3943961 "Mirza" <mirzoni(a)gmx.net> 26.02.2002 16:52 To: <suse-security(a)suse.com> cc: <alice(a)suse.com>, <suse-isdn(a)suse.com> Subject: [suse-security] Masq with an ISDN card ...how to ?? Hello , this mail maybe is not for this group but as i have to see here is most discusion s about networking .. So i have running Suse LInux 7.1 and in that machine i have ISDN card which one i using to connect to internet . In same machine i have LAN adapter which one is connected on private LAN , now i want to enable users access to internet bye the LAN in which case my machine will be gateway .On internet i am find what I need to enable masquarading for clients on my private LAN , on every client i need to set relolv.conf , dns setting s , default gateway , but i have manualy to connect and run script which enables masq.. So the question is : does somebody know some software which one enables auto dialing , bandwidth on demand and disconecting if line is idle and no connection needed ? Thanks in advance -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Masq with an ISDN card ...how to ??
by Mirza 26 Feb '02

26 Feb '02

Hello , this mail maybe is not for this group but as i have to see here is most discusion s about networking .. So i have running Suse LInux 7.1 and in that machine i have ISDN card which one i using to connect to internet . In same machine i have LAN adapter which one is connected on private LAN , now i want to enable users access to internet bye the LAN in which case my machine will be gateway .On internet i am find what I need to enable masquarading for clients on my private LAN , on every client i need to set relolv.conf , dns setting s , default gateway , but i have manualy to connect and run script which enables masq.. So the question is : does somebody know some software which one enables auto dialing , bandwidth on demand and disconecting if line is idle and no connection needed ? Thanks in advance

1 0

passwords
by Daniel Gustavo Prez 26 Feb '02

26 Feb '02

I want to update a mail server but i don´t have the passwords of my users, anybody can tell me how i could to obtain this passwords ??? Daniel Gustavo Prez

3 2

Re: SuSE Security Announcement: cups (SuSE-SA:2002:005)
by Roman Drahtmueller 26 Feb '02

26 Feb '02

-----BEGIN PGP SIGNED MESSAGE----- Follow-up to SuSE Security announcement: cups (SuSE-SA:2002:005) - ---- We have retracted the security update packages for cups as announced by SuSE Security announcement SuSE-SA:2002:005 due to errors in the binary packages. Please note that the update packages indeed fix the security problem, but may disrupt printing service due to a malfunction in the package if installed and activated. The corrected packages are currently being built and will be published on the ftp server as soon as they are ready. Users of Yast Online Update (YOU) will get the fresh cups packages offered for installation as soon as the packages become available, regardless if the defective packages have been installed or not. We will re-release SuSE Security announcement SuSE-SA:2002:005 as soon as all packages have been built and are available. Regards, Roman Drahtmüller, SuSE Security - -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE GmbH - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iQEVAwUBPHuS0ney5gA9JdPZAQH0Cwf/R9WBJdZ/77L1znDs+jsTVhpGFVGg5Pu+ ClzIw7ibYL4Sm81UhnZTVfi1KtukliO41xPqyl3G9nGN9ZQ60dj92R0IlQqoeZ4E 1kWlhc8+5vLTaeytSmVNON1/uyyCeRvzISQkUwMCQ7kc2zQTG2boGmw8kwuE1ZkR YGskxnpDT3sFp/aAHB3OvlhmG36pbBbYvyRknjaAW8Ukl6g8DfqgaMEkYBVz64xX 0lSz155SOe58RY1LOr0OCybo+XuLYxu5HzRYEVGBzbhEBECvZ1+v68Wrd4g450Oh uSDXWkqRe8qrw6Iv6z9ESY84uXagAt4rrciKUL1cUXSPiHiZB7ipug== =XDBc -----END PGP SIGNATURE-----

1 0