March 2002 - openSUSE Security - openSUSE Mailing Lists

SuSeFirewall2 and Squid, Transparent Proxy
by tacchino801＠libero.it 06 Mar '02

06 Mar '02

HI, It is a long time that I read suse security mailing-list. I figured my SuseFirewall1 v 5.0 and squid 2.3 for transparent proxy, all works well! I used Manuals of my "Suse 7.2 Pro" box. Now I installed "Suse 7.3 Pro" I configured SuseFirewall2 script but I have a problem with SuseFirewall2 v2.0 and Squid 2.3. Transparent proxy does not work, and I can not understand why? I used iptraf to see the connections...clients access directly to network and not through squid ip address!! Networks Manuals of "Suse 7.3 Pro" are the same of "Suse 7.2" but the Suse Firewall is updated from 1 to 2! There are no specific mention to this! I have configued the SuseFirewall2 script with this lines: FW_SERVICE_SQUID="yes" FW_REDIRECT="192.168.1.0/24,0/0,tcp,80,3128 192.168.1.0/24,0/0,udp,80,3128" The squid.conf file is so configured: httpd_accel_host virtual httpd_accel_port 80 httpd_accel_with_proxy on httpd_accel_uses_host_header on Many thanks Lorenzo Rossi

6 5

Update mod_php4 4.0.6 --with-xml=no
by Hans van Mourik 06 Mar '02

06 Mar '02

Hello, There's a slight problem with the security update mod_php4 4.0.6: it is compiled with the option "--with-xml=no" whereas the original mod_php4 in the SuSE 7.2 distribution had XML-support. I'm glad to see SuSE responded so quickly on this vulnerability. But now it seems the update breaks existing applications based on the SuSE distribution. Does this mean I have to make my own rpm's from srpm's? Regards, Hans Hans van Mourik <mourik(a)pobox.com>

3 2

Sendmail Problems
by Shonne Beavers 06 Mar '02

06 Mar '02

I am receiving the messages: sendmail[14612]: NOQUEUE: [65.112.230.34] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Should I be alarmed? How do I deny such traffic?

3 2

SSL errors
by Togan Muftuoglu 06 Mar '02

06 Mar '02

Hi, I have the following errrors. Since I am not sure if mod_ssl is vulnerable for the rumors going around I have disabled access to 443 but is this related to the exploit where the attacker tried to upload his keys to the server ? Thx -- Togan Muftuoglu [06/Mar/2002 12:03:07 01109] [info] Connection to child 1 established (server sun.dinamizm.ath.cx:443, client 195.92.95.23) [06/Mar/2002 12:03:07 01109] [info] Seeding PRNG with 1160 bytes of entropy [06/Mar/2002 12:03:07 01109] [error] SSL handshake failed (server sun.dinamizm.ath.cx:443, client 195.92.95.23) (OpenSSL library error follows) [06/Mar/2002 12:03:07 01109] [error] OpenSSL: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher [Hint: Too restrictive SSLCipherSuite or using DSA server certificate?] [06/Mar/2002 12:03:20 00870] [info] Connection to child 0 established (server sun.dinamizm.ath.cx:443, client 195.92.95.23) [06/Mar/2002 12:03:20 00870] [info] Seeding PRNG with 1160 bytes of entropy [06/Mar/2002 12:03:20 00870] [error] SSL handshake failed (server sun.dinamizm.ath.cx:443, client 195.92.95.23) (OpenSSL library error follows) [06/Mar/2002 12:03:20 00870] [error] OpenSSL: error:1406B0C9:SSL routines:GET_CLIENT_MASTER_KEY:peer error certificate

1 0

Not sure to be in the good mailing list but perhaps ...
by Sainson Véronique / NormaSys 06 Mar '02

06 Mar '02

I see that this list is a very reactive one I am searching differents proxies anonymous to use and need them with particular caracters for the nslookup command I wonder either if you could help me with soviets proxies or if you could maybe give me clues in order to make my onw proxy sorry if it was not the best place to ask Cheers

1 0

FW: delivery failure
by Kevin Passey 05 Mar '02

05 Mar '02

Hi all again, Whenever I post to this list I always get this back. Am I doing something wrong or has this person got his rule wrong - I am assuming I am posting in plain text. Thanks for you help. Kevin Passey List-Post: <mailto:suse-security@suse.com> List-Help: <mailto:suse-security-help@suse.com> List-Unsubscribe: <mailto:suse-security-unsubscribe@suse.com> List-Subscribe: <mailto:suse-security-subscribe@suse.com> -----Original Message----- From: Bernhard R. Erdmann [mailto:be@berdmann.de] Sent: 05 March 2002 10:20 To: Kevin Passey Subject: delivery failure Your email Subject: [suse-security] FIREWALL2 - filtering 137-139 Date : Tue, 5 Mar 2002 10:16:15 -0000 containing HTML junk is not wanted here for security reasons. It has been bounced without human intervention. ------ This is a copy of the message, including all the headers. ------ Received: from james.berdmann.de ([192.168.1.1]) by ente.berdmann.de with esmtp (Exim 3.22 #1) id 16iC2q-0005au-00 for be(a)berdmann.de; Tue, 05 Mar 2002 11:19:44 +0100 Received: from mout02.kundenserver.de ([195.20.224.133]) by james.berdmann.de with esmtp (Exim 3.22 #1) id 16iC2q-00016G-00 for be(a)berdmann.de; Tue, 05 Mar 2002 11:19:44 +0100 Received: from [212.227.126.149] (helo=mxng06.kundenserver.de) by mout02.kundenserver.de with esmtp (Exim 2.12 #2) id 16iC2q-0003iZ-00 for be(a)berdmann.dyndns.org; Tue, 5 Mar 2002 11:19:44 +0100 Received: from [202.58.118.7] (helo=lists2.suse.com) by mxng06.kundenserver.de with smtp (Exim 3.22 #2) id 16iC2n-0001sk-00 for be(a)berdmann.de; Tue, 05 Mar 2002 11:19:41 +0100 Received: (qmail 18627 invoked by alias); 5 Mar 2002 10:18:10 -0000 Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm Precedence: bulk X-No-Archive: yes List-Post: <mailto:suse-security@suse.com> List-Help: <mailto:suse-security-help@suse.com> List-Unsubscribe: <mailto:suse-security-unsubscribe@suse.com> List-Subscribe: <mailto:suse-security-subscribe@suse.com> X-MIME-Notice: attachments may have been removed from this message X-Mailinglist: suse-security Delivered-To: mailing list suse-security(a)suse.com Received: (qmail 18613 invoked from network); 5 Mar 2002 10:18:09 -0000 Message-ID: <2128E8CB1302D311B30A0090276DCBE91557E2@DILBERT> From: Kevin Passey <kpassey(a)kdpsoftware.co.uk> To: suse-security(a)suse.com Date: Tue, 5 Mar 2002 10:16:15 -0000 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C1C42E.C87057F0" Subject: [suse-security] FIREWALL2 - filtering 137-139 ------_=_NextPart_001_01C1C42E.C87057F0 Content-Type: text/plain; charset="iso-8859-1" Hi everyone, I have just downloaded and compiled the NESSUS open source scanning software to check my system for Security holes. It is recommending that I filter ports 137-139 how do I do this - I've only allowed www on external services. Thanks Kevin Passey -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here ------_=_NextPart_001_01C1C42E.C87057F0--

2 1

Re: [suse-security] iptables and logs
by Michael Stern 05 Mar '02

05 Mar '02

edit your syslog.conf file. kind regards, michael stern ----- Original Message ----- From: "ic_admin" <admin(a)i-concept.de> To: "SuSE-Security_MailList" <suse-security(a)suse.com> Sent: Tuesday, March 05, 2002 3:52 PM Subject: [suse-security] iptables and logs > Hello, > > I've a question concerning iptables and logging: > In the default configuration of iptables the syslogs are sent to > /var/log/messages AND /var/log/warn and in both files with the same > entries! How can I change the settings for logs only in the messages? > > Regards > > Ruediger

1 0

iptables and logs
by ic_admin 05 Mar '02

05 Mar '02

Hello, I've a question concerning iptables and logging: In the default configuration of iptables the syslogs are sent to /var/log/messages AND /var/log/warn and in both files with the same entries! How can I change the settings for logs only in the messages? Regards Ruediger

1 0

[Repost: Re: [suse-security] CERT snmp advisory and SuSE]
by Olivier M. 05 Mar '02

05 Mar '02

hello... does Suse has *any* plans releasing fixed snmpd packages? It's probably my 3rd or 4th post with the same question in 3 weeks: it would be very nice if somebody could answer, thx... O. On Fri, Feb 22, 2002 at 11:23:37AM -0800, Christopher Mahmood wrote: > > I assume the SNMP packages are > > not yet finished, or did I miss something? > > They're almost finished. The security team did a full audit of > version 4.2.3 so we have to update all the SuSE versions to 4.2.3. well, already 2 weeks: usually SuSE is quicker in security fixes releasing... Are you all working on suse 8.0 or what ? :) Regards, Olivier -- _________________________________________________________________ Olivier Mueller - om(a)8304.ch - PGPkeyID: 0E84D2EA - Switzerland qmail projects: http://omail.omnis.ch - http://webmail.omnis.ch

9 12

Re: [suse-security] strange server / client prob. with samba using SuSEfirewall2 /etc/hosts
by Michael Stern 05 Mar '02

05 Mar '02

> If you grep /sbin/SuSEfirewall2 for samba you'll see, that udp 137/138 are involved too. > So open it to internal NIC. > > Further comments welcome what services that are. Think broadcast and browsing. 137-139 is what win9x/me uses for SMB -- win2k/xp both use 445, except for compatibility with win9x/me.

1 0