March 2002 - openSUSE Security - openSUSE Mailing Lists

FTP server setup
by Derik Whittaker 12 Mar '02

12 Mar '02

Hello All, I have a SuSE 7.3 box that I did not have WU-FTPD installed during setup. does anyone know of any good docs on setting WU-FTPD up on SuSE. I have it installed, but I am unable to login. Thanks. Derik

3 2

mod_ssl and Apache buffer overflow
by Mitchel-Martin Timm 12 Mar '02

12 Mar '02

Hello *, Are the suse-rpms of apache and mod_ssl vulnerable too? Debian, Redhat, Mandrake and others have released new packages? If they are vulnerable, where and when can I get can the new releases? Thanks in advance ---snip--- > - -------------------------------------------------------------------------- > Debian Security Advisory DSA 120-1 security(a)debian.org > http://www.debian.org/security/ Martin Schulze > March 10th, 2002 > - -------------------------------------------------------------------------- > > Package : libapache-mod-ssl, apache-ssl > Vulnerability : buffer overflow > Problem-Type : remote > Debian-specific: no > > Ed Moyle recently found a buffer overflow in Apache-SSL and mod_ssl. > With session caching enabled, mod_ssl will serialize SSL session > variables to store them for later use. These variables were stored in > a buffer of a fixed size without proper boundary checks. > > To exploit the overflow, the server must be configured to require client > certificates, and an attacker must obtain a carefully crafted client > certificate that has been signed by a Certificate Authority which is > trusted by the server. If these conditions are met, it would be possible > for an attacker to execute arbitrary code on the server. ---snip---

1 0

What's with the Apache update in YOU?
by JW 12 Mar '02

12 Mar '02

Ok, what did I miss? I just started YOU on a 7.2 box and I see Apache-259 in there, saying: "Security update: fixing a remotely exploitable overflow in the session handling code." Were's the sec-announcement for this, or did I miss it? After a search in my suse-sec-annouce folder, the only thing I can find that hints at this is: -- ------------------------------------------------- Jonathan Wilson System Administrator Central Texas IT Clickpatrol.com Cedar Creek Software http://www.cedarcreeksoftware.com

2 2

AW: [suse-security] SuSEfirewall?
by Peer Stefan 12 Mar '02

12 Mar '02

hi, in order to provide ftp, ssh and telnet within your lan you have to set FW_TRUSTED_NETS="192.168.0.0/16" FW_SERVICES_TRUSTED_TCP="ftp ssh telnet" accessing your private linux box from within your office lan may become a bit tricky, since you only provided a private ip address for your linux box and requests to that address will not be routed. do you have a gateway or firewall or proxy within your lan, with at least one official ip address? if so, you may be lucky and there is a possibility to connect to your linux box from your office. you could use port-forwarding or something similar on your gateway. cheers, stefan -----Ursprüngliche Nachricht----- Von: Alberto Santana [mailto:santana@qtp.ufl.edu] Gesendet: Montag, 11. März 2002 21:41 An: suse-security(a)suse.com Betreff: [suse-security] SuSEfirewall? Hi all, About SuSEFirewall. My Linux box (192.168.0.3) is in a small (trusted) LAN. I want everybody in the LAN to have ftp, telnet and ssh access to my box and vice versa. I also want to access my box from my office (128.227.x.y) using (only) ssh. Will this firewall.rc.config do the trick? Suggestions are welcome. thanks. FW_DEV_WORLD="eth0" FW_DEV_INT="" FW_DEV_DMZ="" FW_ROUTE="no" FW_MASQUERADE="no" FW_MASQ_NETS="" FW_MASQ_DEV="$FW_DEV_WORLD" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_GLOBAL_SERVICES="yes" FW_SERVICES_EXTERNAL_TCP="ssh 22" FW_SERVICES_EXTERNAL_UDP="" FW_SERVICES_EXTERNAL_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INTERNAL_TCP="21:23 " FW_SERVICES_INTERNAL_UDP="" FW_SERVICES_INTERNAL_IP="" FW_TRUSTED_NETS="128.227.x.y" FW_SERVICES_TRUSTED_TCP="ssh" FW_SERVICES_TRUSTED_UDP="" FW_SERVICES_TRUSTED_IP="" FW_SERVICES_TRUSTED_ACL="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SAMBA="no" FW_FORWARD_TCP="" FW_FORWARD_UDP="" FW_FORWARD_IP="" FW_FORWARD_MASQ_TCP="" FW_FORWARD_MASQ_UDP="" FW_REDIRECT_TCP="" FW_REDIRECT_UDP="" FW_KERNEL_SECURITY="no" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" ## # END of firewall.rc.config ## -- BEST WISHES, Alberto MMM \|/ www __^__ (o o) @ @ (O-O) /(o o)\ +-----ooO-(_)-Ooo---oOO-(_)-OOo---oOO--(_)--OOo---oOO==(_)==OOo-----+ | Alberto Santana | | Ph.D. Student Email: santana(a)qtp.ufl.edu | | University of Florida Phone: (352) 392-3010 | | Quantum Theory Project Home: (352) 379-9938 | | 2301 NPB # 92, P.O. Box 118435 Fax: (352) 392-8722 | | Gainesville, Fl 32611-8435 http://www.qtp.ufl.edu/~santana | +-------------------------------------------------------------------+ Powered by SuSE Linux 7.1 (http://www.suse.com) -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

VPn Woes...
by Michael Garabedian 12 Mar '02

12 Mar '02

Ok all how are you doing, I am doing fine, thanks. I have a little problem. I am trying to get a VPN to work. This is what I have right now. This runs in my boot.local file. echo 1 > /proc/sys/net/ipv4/ip_forward modprobe iptable_nat iptables -A POSTROUTING -t nat -j MASQUERADE -o eth0 iptables -A POSTROUTING -t nat -j MASQUERADE -o eth1 iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 1723 -j DNAT --to 10.0.0.4 iptables -t nat -A PREROUTING -i eth0 -p 47 -j DNAT --to 10.0.0.4 Now I can connect to the internet and from an address directly outside my firewall I can connect to the vpn on the inside. The address here is a.b.c.x and the only successful connection has been through a.b.c.y But from another internet location no one can connect Any ideas? I have a firewall with a ms vpn on 10.0.0.0 network and a dsl line past the firewall hooking me up to the internet. Any help is greatly appreciated.

2 1

Help with SUSEfirewall
by Lars Christiansen 11 Mar '02

11 Mar '02

I have solved the problem with internal conn. to ftp by : FW_FORWARD : 192.168.2.0/24,10.0.2.1/24,tcp,1:65000 and running passiv ftp. I don't know if it's the best solution ? Thank you to every body who was helping High regards Lars Christiansen

1 0

SuSEfirewall?
by Alberto Santana 11 Mar '02

11 Mar '02

Hi all, About SuSEFirewall. My Linux box (192.168.0.3) is in a small (trusted) LAN. I want everybody in the LAN to have ftp, telnet and ssh access to my box and vice versa. I also want to access my box from my office (128.227.x.y) using (only) ssh. Will this firewall.rc.config do the trick? Suggestions are welcome. thanks. FW_DEV_WORLD="eth0" FW_DEV_INT="" FW_DEV_DMZ="" FW_ROUTE="no" FW_MASQUERADE="no" FW_MASQ_NETS="" FW_MASQ_DEV="$FW_DEV_WORLD" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_GLOBAL_SERVICES="yes" FW_SERVICES_EXTERNAL_TCP="ssh 22" FW_SERVICES_EXTERNAL_UDP="" FW_SERVICES_EXTERNAL_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INTERNAL_TCP="21:23 " FW_SERVICES_INTERNAL_UDP="" FW_SERVICES_INTERNAL_IP="" FW_TRUSTED_NETS="128.227.x.y" FW_SERVICES_TRUSTED_TCP="ssh" FW_SERVICES_TRUSTED_UDP="" FW_SERVICES_TRUSTED_IP="" FW_SERVICES_TRUSTED_ACL="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SAMBA="no" FW_FORWARD_TCP="" FW_FORWARD_UDP="" FW_FORWARD_IP="" FW_FORWARD_MASQ_TCP="" FW_FORWARD_MASQ_UDP="" FW_REDIRECT_TCP="" FW_REDIRECT_UDP="" FW_KERNEL_SECURITY="no" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" ## # END of firewall.rc.config ## -- BEST WISHES, Alberto MMM \|/ www __^__ (o o) @ @ (O-O) /(o o)\ +-----ooO-(_)-Ooo---oOO-(_)-OOo---oOO--(_)--OOo---oOO==(_)==OOo-----+ | Alberto Santana | | Ph.D. Student Email: santana(a)qtp.ufl.edu | | University of Florida Phone: (352) 392-3010 | | Quantum Theory Project Home: (352) 379-9938 | | 2301 NPB # 92, P.O. Box 118435 Fax: (352) 392-8722 | | Gainesville, Fl 32611-8435 http://www.qtp.ufl.edu/~santana | +-------------------------------------------------------------------+ Powered by SuSE Linux 7.1 (http://www.suse.com)

3 3

help with SUSEFirewall2 and FTP
by Lars Christiansen 11 Mar '02

11 Mar '02

I am still working on setting up an FTP-server in DMZ. I did what Robert Klein suggested, and it helped. External access is working, but the access from internal is only working halfway. I can connect from internal to ftp and i can login ok, but when the dataconnection is being established the firewall is dropping the conn. from FTP-server to internal. I know that it is the conn. to port 20 thats is the problem. Is there anyone who can tell me what's wrong and come up with a solution Thanks in advance Lars Christiansen

4 3

SCP from Server to Server without Password ??
by Jens.Dinstuehler＠is-ag.com 11 Mar '02

11 Mar '02

Hi we have two servers running Suse Linux 7.1. Now we need to write a script that copies all files in a directory from one server to the other server. We do that with "scp". I´ve read that i can switch of the ugly password-questions by generating ssh keys at both servers and copying the public keys to each other server. I did so, but the password-questions are still there. Does anyone know how to install the keys at the right position and what to do to get this running ? Is there a tutorial or a description how to make an automated copying from one server to another without password (via ssh?) ? Best Regards Jens Dinstuehler Tel.: +49 (0)911 9355330, Fax: +49 (0)911 935533 35 http://www.is-sw.com mailto:Jens.Dinstuehler@is-sw.com is Industrie Software GmbH Bremen, Hamburg, Koeln, Gummersbach, Mannheim Stuttgart, Nuernberg, Donauwoerth, Muenchen Salzburg (A), Wien (A), Atlanta (USA) This email contains confidential information. If you have received this email in error, please delete it immediately, and inform us of the mistake by return email. Any form of reproduction, or further dissemination of this email is strictly prohibited.

2 1

BIND 8.2.4
by Mark Tinka 11 Mar '02

11 Mar '02

hi list... i was wondering SuSE whether has got some update RPMs for BIND-8.2 .. ISC currently has released 8.3, but before that had 8.2.4 and 8.2.5... does SuSE have these updates on the FTP server, or anywhere.. thanks.. AKNIT __________________________________________________ Do You Yahoo!? Everything you'll ever need on one web page from News and Sport to Email and Music Charts http://uk.my.yahoo.com

1 0