March 2002 - openSUSE Security - openSUSE Mailing Lists

Lids...
by Michael Garabedian 14 Mar '02

14 Mar '02

...okay any lids users I would love some help here. I added the lids patch To the linux source I do the following Make menuconfig Go through and add some things that I need. Make dep Make clean Make modules Make bzImage Then run lilo from the bzImage When I start I get a lot of errors referring to modules.dep not found. Now am I not doing something in the commands right, or am I not picking the right modules through menuconfig. The last thing I find is that the route program does not run Any help would be great. Mike

2 2

Re: [suse-security] Dynamic ipchains?
by Michael Stern 13 Mar '02

13 Mar '02

Can't you just use the -i switch for the interface? > Hi! > > I've got a problem with ipchains. I have T-DSL, so I'm assigned a different > ip-address each time I connect to my provider. However, to block ports via > ipchains I need to enter my dynamic IP as source/destination, so for dynamic > IPs I got to have a dynamic script, [don't] I ?!? > I thought about picking my ip from ifconfig by a command similar to that: > > ifconfig | grep P-t-P | awk '{print $2}' you can always do something like variable = `ifconfig|grep ... ` and use the variable in your script. cheers, michael

1 0

Dynamic ipchains?
by Jan Bloemen 13 Mar '02

13 Mar '02

Hi! I've got a problem with ipchains. I have T-DSL, so I'm assigned a different ip-address each time I connect to my provider. However, to block ports via ipchains I need to enter my dynamic IP as source/destination, so for dynamic IPs I got to have a dynamic script, doesnt I ?!? I thought about picking my ip from ifconfig by a command similar to that: ifconfig | grep P-t-P | awk '{print $2}' (I haven't really worked it out yet!) and then using this for a shell-script, that prints ipchains-commands directly into the shell. Greets, Jan!

2 1

Re: [suse-security] FTP security...
by Sven Michels 13 Mar '02

13 Mar '02

> You dont want ssh1 dsa its readable by tools as ettercap nah, you're mixing rsa with dsa. Password Authentication with SSH1 is readable by ettercap etc., ssh2 dsa key authentification is not.

1 0

zlib vuln. affected packages
by Togan Muftuoglu 13 Mar '02

13 Mar '02

Hi, After the SuSE tandem announcement regarding zlib vuln. I have noticed that some other distros are also providing updates for ppp, XFree86 . I do not think I have seen these in the announcement. Does that mean those SuSE rpm's are not vulnerable for the zlib vul or yet more to come in the coming days is what I should read ? -- Togan Muftuoglu Unofficial SuSE FAQ Maintainer http://dinamizm.ath.cx

3 3

ftp.suse.de down?
by Erwin Zierler - stubainet.at 13 Mar '02

13 Mar '02

Hi all, just tried to download the latest security updates (mainly openssh) for some old 6.4 box and first I got 'service not available' and then after a few minutes I was able tp connect, cd to the proper directories, but everytime I issued a dir or ls command all I got is: 150 Opening ASCII mode data connection for file list. and nothing else happens anymore. Is it just overloaded or (hopefully not!) something worse? TIA, Erwin

2 1

Re: [suse-security] FTP security...
by Chad Whitten 13 Mar '02

13 Mar '02

there is a free scp/sftp/ssh client for windows called putty ftp://mirror.nexband.com/pub/windows/putty/putty.exe (ssh client) ftp://mirror.nexband.com/pub/windows/putty/psftp.exe (sftp client) ftp://mirror.nexband.com/pub/windows/putty/pscp.exe (scp client) all are command line based and are just an executable, no install required. On Wednesday 13 March 2002 11:39 am, you wrote: > Brian Topping wrote: > > ----- Original Message ----- > > From: "Sven Michels" <smichels(a)intradat.com> > > To: <suse-security(a)suse.com> > > Sent: Wednesday, March 13, 2002 12:32 PM > > Subject: Re: [suse-security] FTP security... > > > > > Michael Garabedian wrote: > > > > ...I am setting up a linux machine to do ftp and was wondering if > > > > there was a secure way to set this up so it is not hacked. I used a > > > > Windows machine and it took someone two days to hack it. Any > > > > ideas... > > > > > > FTP is mostly insecure ... ftp sucks at all ;) > > > > Use SCP. I just learned it. It rocks! > > i don't want any user as real systemuser on my boxes, so > scp doesn't work cause it needs real accounts (or you try > to hack a pam module for auth against a db like mysql etc.). > And you've still the problem with windows users, or do you > know any free implementation of ssh2 for scp under windows? -- Chad Whitten Network/Systems Administrator neXband Communications cwhitten(a)nexband.com ------------------------------------------------------- -- Chad Whitten Network/Systems Administrator neXband Communications cwhitten(a)nexband.com

1 0

NFSD in SuSE 7.3
by Christof Hanke 13 Mar '02

13 Mar '02

Dear list, I have a problem which I couldn't solve on my own yet. Following scenario (Beowulf-type cluster) : Masternode = NFS + NIS server. slave nodes either diskless or with own disk. Now, I've upgraded the masternode from SuSE 7.1 to 7.3 (heaven knows why). YP and that stuff all works fine both on the diskless and the diskowning slaves. the diskless slave mount their rootfs normally from the masternode, BUT: no user except root can execute something. I.e. nobody except root can login. e.g. "scandium" being diskless 15:58 phosphorus ~> ssh root@scandium root@scandium's password: Last login: Wed Mar 13 17:06:40 2002 Have a lot of fun... scandium:~ # su -c date christof su: cannot run /bin/tcsh: Permission denied The same error message gives me a direct ssh-login: 16:22 phosphorus ~> ssh christof@scandium christof@scandium's password: Last login: Wed Mar 13 16:53:17 2002 from gnasher.phy.qub.ac.uk Have a lot of fun... /bin/tcsh: Permission denied Connection to scandium closed. Direct login at the console fails, too. Phosphorus is a disk-owning slave and all works well. The OS (i.e. all the kernel and all the utilities) on phosphorus and scandium are exactly the same. Thus I think, it should be a NFSD related problem, anyway here the relevant parts of the config-files of the masternode: ~> more /etc/exports # See exports(5) for a description. # This file contains a list of all directories exported to other computers. # It is used by rpc.nfsd and rpc.mountd. /q 192.168.2.0/255.255.255.0(rw,no_root_squash) /dalton 192.168.2.0/255.255.255.0(rw,no_root_squash) /tftpboot 192.168.2.0/255.255.255.0(rw,no_root_squash) /usr/local/mpich-1.2.1 192.168.2.0/255.255.255.0(ro,root_squash) ~ # more /etc/hosts.allow # See tcpd(8) and hosts_access(5) for a description. YPSERV: 127.0.0.0/255.0.0.0 192.168.2.0/255.255.255.0 ALL : 192.168.2.0/255.255.255.0 PORTMAP: 192.168.2.0/255.255.255.0 rpc.mountd : 192.168.2.0/255.255.255.0 rpc.nfsd : 192.168.2.0/255.255.255.0 rpc.ugidd : 192.168.2.0/255.255.255.0 All the rootfs of the slaves are in /tftpboot, as you have already guessed. Any help would be much appreciated. My problem thus is not too little but too much security, but I hope you don't mind.... Thanks, Christof

2 1

Protecting against BufferOverflows
by Jan Luehr 13 Mar '02

13 Mar '02

greetings are there any kernel patches or other things, defending suse linux against Bufferoverwflows? Do you have any expirences in defending suse Linux? Keep smiling yanosz -- GnuPG Key available at http://www.jluehr.de.vu/public_key.asc

2 1

Problem forwarding port
by Brian Topping 13 Mar '02

13 Mar '02

Greetings, I'm having a problem forwarding port 443 to a box on my masquerade network. Everything else works fine, but I can't get this port forwarded. It's stumping me! I've worked on tons of firewalls, but this one is kicking my butt. Any ideas? Here is my firewall2.rc.config: START_FW2="yes" FW_DEV_EXT="eth0" FW_DEV_DMZ="eth1" FW_DEV_INT="eth2" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.0.0/24" FW_SERVICES_EXT_TCP="22 25 53" FW_SERVICES_EXT_UDP="53" FW_SERVICES_DMZ_TCP="22 53" FW_SERVICES_DMZ_UDP="53 514" FW_SERVICES_INT_TCP="22 53" FW_SERVICES_INT_UDP="53" FW_SERVICE_DNS="yes" FW_FORWARD_MASQ="0/0,192.168.0.2,tcp,443" FW_ALLOW_PING_DMZ="yes" Thanks a ton for any suggestions!!!!! Brian

3 14