March 2002 - openSUSE Security - openSUSE Mailing Lists

downing a masqueraded link
by elfed lewis 14 Mar '02

14 Mar '02

Hi all. I need to drop a dial-on-demand pppd link between 6pm and 8pm every night for security reasons (eg deny users from accesing the net between those times). I cant find a good way of doing this in smpppd, only using diald, which i dont want to use. What i'd like to do is set up a cron job to disable masquerading at 6pm, and bring it back up at 8am, thereby disabling the isdn link at those times. How would i do this? Or is there a better way of doing this? Thanks all, Elf.

2 1

FTP security...
by Michael Garabedian 14 Mar '02

14 Mar '02

...I am setting up a linux machine to do ftp and was wondering if there was a secure way to set this up so it is not hacked. I used a Windows machine and it took someone two days to hack it. Any ideas... Thanks. Mike

12 16

RE: [suse-security] FTP security...
by Reckhard, Tobias 14 Mar '02

14 Mar '02

> I converted the key by using ssh-keygen -e -f id_rsa > > id_rsa.p. That takes > no effect. I can't connect to my server with putty only the > shell works. Have you tried generating keys with puttygen.exe and transferring those to the server? Tobias

2 1

RE: [suse-security] FTP security...
by Reckhard, Tobias 14 Mar '02

14 Mar '02

> I created the key on the server and put the private key to my > local machine. > It is a openssh key (rsa, V2) and i using Putty version 0.52. You probably need to convert the key from OpenSSH format to the one PuTTY uses. Try ssh-keygen's '-e' option (see 'man ssh-keygen'). Cheers Tobias

2 1

Re: [suse-security] Dynamic ipchains?
by Linuxdom＠in-sight.de 14 Mar '02

14 Mar '02

I think this is, what you have to do. Just let it autodetect your dynIP. This is what I would have dion, since I wouldn´t have a static IP. Try it, it might work. Good luck FW_DEV_WORLD="eth1" # # You *may* configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_WORLD_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # #FW_DEV_WORLD_ippp0=" 255.255.255.0" # e.g. for exernal interface ippp0 FW_DEV_WORLD_eth1=" " maX Bauer

2 1

RE: [suse-security] FTP security...
by Reckhard, Tobias 14 Mar '02

14 Mar '02

> I using the current version and it dosen't work. If i using > the ssh.exe form > Openssh and that works. When i open a session the command box open and > closed immediatly. Make sure you're using PuTTY 0.52 or newer (dunno if a newer version exists). Call putty.exe and navigate to Connection->SSH->Auth and select the private key file in the window labelled "Private key file for authentication". You have to create a key with puttygen.exe first. You need to transport the public key to the SSH server, convert it to OpenSSH format if it's an SSHv2 key, and install it in the authorized_keys[2] file. I tested it just now myself here and it works (for me). Tobias

2 1

RE: [suse-security] FTP security...
by Reckhard, Tobias 14 Mar '02

14 Mar '02

> but i also want to use it for scp or sftp. > I spend a lot of time for searching, but i found no tool that works. > > I have tested the follow tools: > > - pscp > - psftp ... > I only accept pubkey authentication but putty, WinSCP, etc. > want always a > password for authentication. The current PuTTY can do public key authentication. That extends to pscp and psftp as well. They're command-line tools, though. Cheers Tobias

2 1

AW: [suse-security] Protecting against BufferOverflows
by Bitzer,Gerd 14 Mar '02

14 Mar '02

Hi maybe http://www.avayalabs.com/project/libsafe/index.html would be worth having a look at. -----Ursprüngliche Nachricht----- Von: Jan Luehr [mailto:jluehr@gmx.net] Gesendet am: Mittwoch, 13. März 2002 18:28 An: suse-security(a)suse.com Betreff: [suse-security] Protecting against BufferOverflows greetings are there any kernel patches or other things, defending suse linux against Bufferoverwflows? Do you have any expirences in defending suse Linux? Keep smiling yanosz -- GnuPG Key available at http://www.jluehr.de.vu/public_key.asc -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

Compiling for lids...
by Michael Garabedian 14 Mar '02

14 Mar '02

...I am compiling my kernel for linux so I can get lids to work. I got a lot of bad hunks...is that bad or normal for lids. Plus I need to know what commands to run To compile the kernel I did Make menuconfig Make dep Make clean Make bzImage Configured lilo through yast to boot floppy with bzImage under the profile new Am I close? Help Mike

2 1

Re: [suse-security] Dynamic ipchains?
by Hans Körber 14 Mar '02

14 Mar '02

Hallo Jan, Jan Bloemen wrote: > Hi! > > I've got a problem with ipchains. I have T-DSL, so I'm assigned a different > ip-address each time I connect to my provider. However, to block ports via > ipchains I need to enter my dynamic IP as source/destination, so for dynamic > IPs I got to have a dynamic script, doesnt I ?!? The PPP daemon calls a script, "/etc/ppp/ip-up" or so, after successful initiation of the connection. That script in turn calls "ip-up.local" in the same directory, with the the IP of both your host and the peer. You can place a call to your firewall script in that file. Greetings, Hans > I thought about picking my ip from ifconfig by a command similar to that: > > ifconfig | grep P-t-P | awk '{print $2}' > > (I haven't really worked it out yet!) > and then using this for a shell-script, that prints ipchains-commands > directly into the shell. > > Greets, Jan! > > > > > > > -- hans.koerber(a)web.de http://hans.hn.org

2 1