April 2002 - openSUSE Security - openSUSE Mailing Lists

kernel update 2.4
by Roman Drahtmueller 16 Apr '02

16 Apr '02

Hi together, we've been busy with the kernel updates for the 2.4 series kernel on 7.1, 7.2 and 7.3. The preliminary result could be found in the kernel/2.4.16-20020325 directory of each distribution, but it has turned out that one of the fixes was wrong and could crash the kernel in some not so rare situations. Anyway: The new candidates can be found in kernel/2.4.16-20020416/. These kernels have survived our stress testing and will be officially announced soon. If you want to test them, please feel free to do so, and please report oddities to security(a)suse.de. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -

1 0

pptpd and suse firewall
by webmaster＠hackenschmiede.com 16 Apr '02

16 Apr '02

hello all, does anyone have experience with pptpd and suse firewall (ipchains)? i can connect to the pptpd server but i can not reach the networks behind. config looks like: 192.168.1.0 -----|router|------|pptpd|-------internet | | | -----192.168.2.0------ | | | -----192.168.3.0------ i connect to the pptpd, get a ip, dns entry and so on.. works fine.. but i dont know how to configure the suse firewall for masq the networks behind. when i dont load the suse firewall (fw_start="no") i masq the networks like this: cerberus:~ # echo "1" > /proc/sys/net/ipv4/ip_forward cerberus:~ # ipchains -A forward -s 192.168.1.0/24 -d 192.168.1.0/24 -j MASQ cerberus:~ # ipchains -A forward -s 192.168.2.0/24 -d 192.168.1.0/24 -j MASQ cerberus:~ # ipchains -A forward -s 192.168.1.0/24 -d 192.168.2.0/24 -j MASQ cerberus:~ # ipchains -A forward -s 192.168.3.0/24 -d 192.168.1.0/24 -j MASQ cerberus:~ # ipchains -A forward -s 192.168.1.0/24 -d 192.168.3.0/24 -j MASQ how can i do this with suse firewall? thanx for your tips and best regards wr

1 0

Re: [suse-security] openssh client configuration files
by Kevin Ivory 15 Apr '02

15 Apr '02

Joerg Ruhe wrote: > I have a problem with the order in which openssh reads and applys the client > configuration files (openssh 2.9.9p2 SuSE 7.3 ). You are right. This is a bug since at least half a year in all SuSE's OpenSSH update versions. I have filed it as a bug in SuSE's bugzilla in January and have been keeping it open since. (For anyone with read access it is bug #12846) It is very easy to check. Take two minimal configuration files: ivory:~ > cat /etc/ssh/ssh_config Host * Port 222 ivory:~ > cat .ssh/config Host www.suse.de Port 999 And now connect to www.suse.de. You will see that the wrong port is used. ivory:~ > ssh -v www.suse.de OpenSSH_2.9.9p2, SSH protocols 1.5/2.0, OpenSSL 0x0090602f debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Reading configuration data /home/kivory/.ssh/config debug1: Applying options for www.suse.de debug1: Seeding random number generator debug1: Rhosts Authentication disabled, originating port will not be trusted. debug1: restore_uid debug1: ssh_connect: getuid 500 geteuid 0 anon 1 debug1: Connecting to www.suse.de [213.95.15.200] port 222. This is definitely not what the documentation says (which makes it a bug). The first few lines of a default /etc/ssh/sshd_config say: *** begin part of /etc/ssh/ssh_config # Configuration data is parsed as follows: # 1. command line options # 2. user-specific file # 3. system-wide file # Any configuration value is only changed the first time it is set. # Thus, host-specific definitions should be at the beginning of the # configuration file, and defaults at the end. *** end part of /etc/ssh/ssh_config I noticed this behavior with the parameters Port and Protocol. Possibly others are affected. I have not checked with the original OpenSSH Linux port from openssh.org but I know this behavior was different (= as documented) before SuSE's version 2.9.1. Kevin -- _ | Kevin Ivory | Tel: +49-551-37000041 |_ |\ | | Service Network GmbH | Fax: +49-551-3700009 ._|ER | \|ET | Bahnhofsallee 1b | mailto:Ivory@SerNet.de Service Network | 37081 Goettingen | http://www.SerNet.de/

1 0

why does SuSE once in a while offer unsigned RPMs ?
by malte_gell＠t-online.de 15 Apr '02

15 Apr '02

hi there, just downloaded the KDE3 update for SuSE 7.3 when I saw that (at least) kdelibs3-3.0-35.rpm is not signed with the Package Signing Key. It makes me feel a bit nervous when I should install unsigned packages even if obtained directly from ftp.suse.com or ftp.gwdg.de, it was the same with some KDE 2.2.2 packages for SuSE 7.3, I have informed security(a)suse.de about this with KDE2 packages. It would be nice if you would take signing more seriously and if you would check each package whether it is actually signed before offering it, no matter if it's just a KDE update or "official stuff" below .../i386/update/x.xx/ Malte

2 1

RE: [suse-security] Logging Packets with ipchains
by Peer Stefan 15 Apr '02

15 Apr '02

> From: Wilfried Philippi [mailto:philippi@madex.com] > Hello to all readers, Hi Wilfried, > i want to log all incoming and outgoing Packets from a individual Workstation > of the local Network. How can i do this? We have ipchains as Packetfilter. > Thanks for Answer. try the -l option, e.g.: ipchains -A input -d <ip-address> -y -j ACCEPT -l regards, Stefan ps: man ipchains <snip> -l, --log Turn on kernel logging of matching packets. When this option is set for a rule, the Linux kernel will print some information of all matching packets (like most IP header fields) via printk(). </snip>

2 1

Logging Packets with ipchains
by Wilfried Philippi 15 Apr '02

15 Apr '02

Hello to all readers, i want to log all incoming and outgoing Packets from a individual Workstation of the local Network. How can i do this? We have ipchains as Packetfilter. Thanks for Answer. Hallo Leser dieser Mailingliste, ich möchte alle ein und ausgehende Pakete einer workstation in unserem lokalen Netzwerk mitloggen. Wie kann ich das mit Ipchains machen? Vielen Dank für die Hilfe Wilfried

1 0

Strange seccheck result
by Bjoern Engels 15 Apr '02

15 Apr '02

Hi I'm having a strange result in seccheck here - what could cause this: SuSE weekly security check v2.0 by Marc Heuse <marc(a)suse.de> [...] The following files are suid/sgid: - drwx------ 16 root root 4096 Mon Apr 01 13:21:49 2002 . + drwx------ 16 root root 4096 Sat Apr 13 11:43:40 2002 . The following program executables are group/world writeable: - drwx------ 16 root root 4096 Mon Apr 01 13:21:49 2002 . + drwx------ 16 root root 4096 Sat Apr 13 11:43:40 2002 . bj@www:~ > ls -la / [...] drwx------ 16 root root 4096 Apr 13 11:43 root [...] Looks as if seccheck misinterprets something ? Cheers Bjoern

1 0

netcat
by ian＠golding.u-net.com 15 Apr '02

15 Apr '02

I have been considering using netcat with the minus z option as an enterprise monitoring solution to test the availability of smtp, http, lotusnotes SAP etc. but read in http://rr.sans.org/audit/netcat.php that it was not recommended for use in production systems. Does anyone know why ? Also does anyone know of a safer alternative? Warm Regards

3 3

SuSE personal Firewall 1.1-4 / ppp*
by Klaus Wiese 15 Apr '02

15 Apr '02

I may have found a security problem in SuSE personal firewall 1.1-4. Other versions might be affected as well. Description: condition: REJECT_ALL_INCOMING_CONNECTIONS=modem in /etc/rc.config.d/security.rc.config affected file: /sbin/SuSEpersonal-firewall In line 310 RAIC is set to "ppp*". This is later passed to iptables (or ipchains) as interface parameter leading to the warning "Warning: wierd character in interface `ppp*' (No aliases, :, ! or *)." in the log. fix: Set RAIC to "ppp+" instead. the "+" is the proper wildcard for the iptables and ipchains commands. Questions: Is this in fact a bug or did I miss something? Was a proper rule for the ppp* (ppp0, ppp1, ...) interface created? I did not check. Klaus _________________________________________________________________ Send and receive Hotmail on your mobile device: http://mobile.msn.com

2 1

SuSE-FW-DROP-ANTI-SPOOFING message
by Bob Berman 14 Apr '02

14 Apr '02

I am getting the following message roughly once a minute: Apr 13 13:45:10 telluride kernel: SuSE-FW-DROP-ANTI-SPOOFINGIN=eth1 OUT= MAC= SRC=192.168.0.1 DST=192.168.0.255 LEN=76 TOS=0x10 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=123 DPT=123 LEN=56 My logs are filling up. I have searched Google and other places, but all I have found are some emails in German which I don't speak. Can anyone help me with this? What is going on and what should I do about it? Thanks!

2 1

SuSE 7.2 and zlib vulnerability
by Roland Moriz 14 Apr '02

14 Apr '02

Hi Folks, I'm not a linux library geek but I found something courious: I've scanned my SuSE 7.2 prof. system after updating the packages as described in http://www.suse.de/de/support/security/2002_010_libz_txt.html and http://www.suse.de/de/support/security/2002_011_libz_packages_txt.html for libz and I found the following: ==== Short == Name : shlibs5 Relocations: (not relocateable) Version : 2001.7.30 Vendor: SuSE GmbH, Nuernberg, Germany Release : 21 Build Date: Mon Sep 17 00:13:19 2001 Install date: Fri Oct 5 22:22:29 2001 Build Host: D45.suse.de seems still to have a vulnerable zlib: /usr/i486-linux-libc5/lib/libz.so /usr/i486-linux-libc5/lib/libz.so.1 /usr/i486-linux-libc5/lib/libz.so.1.1.3 Maybe someone can have a closer look into that? regards, Roland ==== LONG === s1:/usr/i486-linux-libc5/lib # locate libz /lib/libz.so.1 /lib/libz.so.1.1.3 ... /usr/i486-linux-libc5/lib/libz.so /usr/i486-linux-libc5/lib/libz.so.1 /usr/i486-linux-libc5/lib/libz.so.1.1.3 ... /usr/lib/libz.a /usr/lib/libz.so ... Then I checked the update zlib package: s1:/usr/i486-linux-libc5/lib # rpm --query -a |grep libz libz-1.1.3-573 s1:/usr/i486-linux-libc5/lib # rpm --query libz-1.1.3-573 -l /lib/libz.so.1 /lib/libz.so.1.1.3 ... /usr/include/zlib.h ... /usr/lib/libz.a /usr/lib/libz.so ... So I'm suprised of that because the zlib in /usr/i486-linux-libc5/lib/ seems to be old an vulnerable! I found that the zlib there belongs to "shlibs5": s1:/usr/i486-linux-libc5/lib # rpm --query -f /usr/i486-linux-libc5/lib/libz.so shlibs5-2001.7.30-21 s1:/usr/i486-linux-libc5/lib # rpm -qi shlibs5 Name : shlibs5 Relocations: (not relocateable) Version : 2001.7.30 Vendor: SuSE GmbH, Nuernberg, Germany Release : 21 Build Date: Mon Sep 17 00:13:19 2001 Install date: Fri Oct 5 22:22:29 2001 Build Host: D45.suse.de It looks like this is the latest version (ftp://ftp.gwdg.de/pub/linux/suse/ftp.suse.com/suse/i386/update/7.2/a2) regards, Roland

1 0

SuSE-FW-DROP-ANTI-SPOOFING message
by Bob Berman 14 Apr '02

14 Apr '02

I am getting the following message roughly once a minute: Apr 13 13:45:10 telluride kernel: SuSE-FW-DROP-ANTI-SPOOFINGIN=eth1 OUT= MAC= SRC=192.168.0.1 DST=192.168.0.255 LEN=76 TOS=0x10 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=123 DPT=123 LEN=56 My logs are filling up. I have searched Google and other places, but all I have found are some emails in German which I don't speak. Can anyone help me with this? What is going on and what should I do about it? Thanks!

1 0

SuSE-FW-DROP-ANTI-SPOOFING messages
by Bob Berman 13 Apr '02

13 Apr '02

I am getting the following message roughly once a minute: Apr 13 13:45:10 telluride kernel: SuSE-FW-DROP-ANTI-SPOOFINGIN=eth1 OUT= MAC= SRC=192.168.0.1 DST=192.168.0.255 LEN=76 TOS=0x10 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=123 DPT=123 LEN=56 My logs are filling up. I have searched Google and other places, but all I have found are some emails in German which I don't speak. Can anyone help me with this? What is going on and what should I do about it? Thanks!

1 0

Re: [suse-security] openssh client configuration files
by Steffen Dettmer 13 Apr '02

13 Apr '02

Hi, I reply to this old message, since at least it gives hints about a problem. Are more concrete problem or question would be nice, anyway. * Joerg Ruhe wrote on Wed, Apr 10, 2002 at 17:17 +0200: > 1. command line options, > 2. user's configuration file ($HOME/.ssh/config) > 3. system-wide configuration file (/etc/ssh/ssh_config) > > and for each parameter the first obtained value will be used. For me that > means, that if I set an parameter in my $HOME/.ssh/config > and agin in /etc/ssh/ssh_config the value from the $HOME/.ssh/config will be > used. According to the man page, this is correct. > My trouble is, I'm observing a differnt behaviour ( as you can see in the > log below ): > OpenSSH_2.9.9p2, SSH protocols 1.5/2.0, OpenSSL 0x0090602f > debug1: Reading configuration data /etc/ssh/ssh_config > debug1: Applying options for * > debug1: Reading configuration data /home/ruhej/.ssh/config > debug1: Applying options for * > > Here the options in the system-wide configuration file are applied first. Well, it looks so. But this output is a debug output, and it may mean that the options are just read and parsed. Internally the later options may overwrite the first; who knows (oki, the sources know :)). > I have seen this on several differnt computers, all with SuSE > 7.3 and openssh 2.9.9p2 . Well, is this your onliest problem? Is the effect correct, anyway? I wouldn't take it as a serious problem to have non-precises debug output... > I would be glad, if somebody could help me with this problem ( or tell me > what I did wrong ). I didn't even understood the problem, I assume. oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.

1 0

Proxy Problems
by Andreas.Novak＠student.fh-nuernberg.de 13 Apr '02

13 Apr '02

Dear list, I got problems with a proxy server for a small LAN. The server crashes very often, I've read the logs, but can't find a hint about how to change the server configuration. The following services are running on the machine: -sshd ( PublicKeyAuthentication ) -apache -tomcat J2EE Engine -pdnsd ( DNS Daemon ) -socks4 -socks5 Can anyone tell me which logs to check? Here's an excerpt from messages: Apr 12 20:13:00 linux pppd[3435]: sent [LCP EchoReq id=0x99 magic=0x133d167d] Apr 12 20:13:00 linux pppd[3435]: rcvd [LCP EchoRep id=0x99 magic=0x73cb21e2] Apr 12 20:21:48 linux syslogd 1.4.1: restart. Apr 12 20:21:53 linux ddclient[352]: SUCCESS: updating XXX.XXXXXX.xom: good: IP address set to 217.235.77.3 Apr 12 20:21:53 linux kernel: klogd 1.4.1, log source = /proc/kmsg started. Apr 12 20:21:53 linux kernel: Inspecting /boot/System.map-2.4.10-4GB Apr 12 20:21:55 linux /usr/sbin/cron[461]: (CRON) STARTUP (fork ok) Apr 12 20:21:55 linux kernel: Loaded 11713 symbols from /boot/System.map-2.4.10-4GB. Apr 12 20:21:55 linux kernel: Symbols match kernel version 2.4.10. Apr 12 20:21:55 linux kernel: Loaded 270 symbols from 9 modules. Apr 12 20:21:55 linux kernel: ne2k-pci.c:v1.02 10/19/2000 D. Becker/P. Gortmaker Apr 12 20:21:55 linux kernel: http://www.scyld.com/network/ne2k-pci.html Apr 12 20:21:55 linux kernel: eth0: RealTek RTL-8029 found at 0xef80, IRQ 12, 00:40:95:41:61:EB. Apr 12 20:21:55 linux kernel: 8139too Fast Ethernet driver 0.9.18a Apr 12 20:21:55 linux kernel: eth1: RealTek RTL8139 Fast Ethernet at 0xc4814f00, 00:30:84:3d:7d:f8, IRQ 5 Apr 12 20:21:55 linux kernel: eth1: Identified 8139 chip type 'RTL-8139C' Apr 12 20:21:55 linux kernel: eth1: Setting half-duplex based on auto-negotiated partner ability 0000. Apr 12 20:21:55 linux kernel: CSLIP: code copyright 1989 Regents of the University of California Apr 12 20:21:55 linux kernel: PPP generic driver version 2.4.1 Apr 12 20:21:55 linux kernel: IPv6 v0.8 for NET4.0 Apr 12 20:21:55 linux kernel: IPv6 over IPv4 tunneling driver Apr 12 20:22:02 linux pppd[214]: sent [LCP EchoReq id=0x1 magic=0xba891d2] Apr 12 20:22:02 linux pppd[214]: rcvd [LCP EchoRep id=0x1 magic=0x6e7cdfb8] Apr 12 20:22:05 linux kernel: eth0: no IPv6 routers present Apr 12 20:22:05 linux kernel: eth1: no IPv6 routers present Apr 12 20:22:22 linux pppd[214]: sent [LCP EchoReq id=0x2 magic=0xba891d2] Apr 12 20:22:22 linux pppd[214]: rcvd [LCP EchoRep id=0x2 magic=0x6e7cdfb8] Apr 12 20:22:42 linux pppd[214]: sent [LCP EchoReq id=0x3 magic=0xba891d2] Apr 12 20:22:42 linux pppd[214]: rcvd [LCP EchoRep id=0x3 magic=0x6e7cdfb8] Apr 12 20:22:42 linux pdnsd[572]: pdnsd-1.1.7a starting. Apr 12 20:22:46 linux ssockd[588]: starting... Apr 12 20:22:47 linux ssockd[589]: bound to iface 192.168.1.1, port 1080 In the warn file, I got a number of kernel asserts like these Apr 8 12:20:10 linux kernel: KERNEL: assertion (flags&MSG_PEEK) failed at tcp.c(1463):tcp_recvmsg Apr 8 12:20:10 linux kernel: KERNEL: assertion (tp->copied_seq == tp->rcv_nxt || (flags&(MSG_PEEK|MSG_TRUNC))) failed at tcp.c(1520):tcp_recvmsg Apr 9 01:55:06 linux pppd[4317]: tcflush failed: Input/output error Apr 9 01:55:12 linux pppd[4337]: PAP authentication failed the last time it crashed, I found the following entries in the warn log: Apr 12 20:13:07 linux pppd[3435]: Child process /usr/sbin/pppoe -p /var/run/pppoe.conf-adsl.pid.pppoe -I eth1 -T 80 -U -m 1412 (pid 3436) terminated with signal 11 Apr 12 20:13:07 linux kernel: Unable to handle kernel paging request at virtual address d2bb0318 Apr 12 20:13:07 linux kernel: printing eip: Apr 12 20:13:07 linux kernel: c012cc0a Apr 12 20:13:07 linux kernel: *pde = 00000000 Apr 12 20:21:55 linux kernel: eth0: RealTek RTL-8029 found at 0xef80, IRQ 12, 00:40:95:41:61:EB. last log thing is: Apr 13 00:15:29 linux su: (to nobody) root on none Apr 13 00:15:29 linux PAM-unix2[1215]: session started for user nobody, service su Apr 13 00:15:49 linux pppd[214]: sent [LCP EchoReq id=0xbe magic=0xba891d2] Apr 13 00:15:49 linux pppd[214]: rcvd [LCP EchoRep id=0xbe magic=0x6e7cdfb8] Apr 13 00:16:09 linux pppd[214]: sent [LCP EchoReq id=0xbf magic=0xba891d2] Apr 13 00:16:09 linux pppd[214]: rcvd [LCP EchoRep id=0xbf magic=0x6e7cdfb8] Apr 13 00:16:21 linux PAM-unix2[1215]: session finished for user nobody, service su in messages. what does this mean? Nobody was working at this time! thanks in advance Andreas --_OPERAB__-x0s3yvauQ3lmYTFVC3nEYO--

3 2

Proxy
by Andreas.Novak＠student.fh-nuernberg.de 13 Apr '02

13 Apr '02

the log file entries included are the entries, when the server last crashed. are there any other log files except /var/log/messages and var/log/warn?

1 0

Post YOU problem with mtr
by Jim Westbrook 13 Apr '02

13 Apr '02

For months I have run a cron/script that calls mtr in report mode. Here's one of the lines: mtr -rc 5 www.io.com >>testrpt Prior to a YOU update earlier this week, this had always produced the output described in the man page. Now, all it does is write the header portion of the "report" and no data. I am unsure exactly what was updated by YOU on my 7.3 "everything" installation, but something seems to have broken mtr's output redirection. I have tried several things attempting to restore the previous functionality. rpm -e mtr, then ftp the most recent version from SuSE.com (mtr-0.44-132.rpm) and install it (rpm -i mtr-0.44-132.rpm). The installation worked as expected, but mtr still didn't output the "report" data. rpm -e mtr-0.44-132, the use the 7.3 Pro CD's to re-install the original version in the hope that the upgrade was broken. Not the problem because the mtr-0.44-36 on the CD's still has the output problem. Admittedly, this is not a major security issue, but if the YOU process broke mtr, what else got broken that I have not discovered yet? Is there a way to find what was changed during that YOU session? Is there a way to get mtr working again? The LinkSys cable/router that I'm using kills traceroute, and mtr was the only thing I had found to give me some form of trace info. JimW

1 0

Re: [suse-security] openssh client configuration files
by Roland Kuhn 12 Apr '02

12 Apr '02

On Thu, 11 Apr 2002, Joerg Ruhe wrote: > [...] > > > Thats exactly what happend. A setting in /etc/ssh/ssh_config overrides an > > > user setting ( I tried this with several options ). > > > > > > Does it work that way on your system ? > > > > These are from my system: > > > > debug1: Reading configuration data /home/rkuhn/.ssh/config > > debug1: Applying options for * > > debug1: Reading configuration data /etc/ssh/ssh_config > > debug1: Applying options for * > > > > I just verified that the settings from /home/rkuhn/.ssh/config override > > the ones from /etc/ssh/ssh_config. > > Thanks for your very fast answer. > > Could you tell me your suse and openssh version ? (mine is 7.3 and 2.9.9p2 ) > Sorry, but the fast answer was wrong :-( It works as expected with OpenSSH 3.0.2p1 (RedHat 7.2.1beta2 from CERN), but I can reproduce your problem of /etc/ssh/ssh_config overriding user values with OpenSSH 2.9.9p2 (SuSE 7.3, unpatched). I know this version has this "off-by-one-bug", but I did not yet have the time to recompile... > I'm thinking the effekt Im observing has perhaps something to do with the > last openssh patch from suse, but I can't verify it. > Maybe. Ciao, Roland +---------------------------+-------------------------+ | TU Muenchen | | | Physik-Department E18 | Raum 3558 | | James-Franck-Str. | Telefon 089/289-12592 | | 85747 Garching | | +---------------------------+-------------------------+

2 1

Re: [suse-security] openssh client configuration files
by Gerhard Sittig 12 Apr '02

12 Apr '02

On Wed, Apr 10, 2002 at 17:17 +0200, Joerg Ruhe wrote: > > The man page and the o'reily book state the order in which configuration data > is obtained as : > 1. command line options, > 2. user's configuration file ($HOME/.ssh/config) > 3. system-wide configuration file (/etc/ssh/ssh_config) > > and for each parameter the first obtained value will be used. For me that ^^^^^ ^^^^ > means, that if I set an parameter in my $HOME/.ssh/config > and agin in /etc/ssh/ssh_config the value from the $HOME/.ssh/config will be > used. Right. That's a regular philosophy which generally applies in UNIX systems: The software author suggests some compiled in defaults, the admin may provide a system wide default config for a site, the user is free to customize things for everyday use while still being able to overide settings on the command line for a single invocation. That's accepted and most of all expected behaviour. > My trouble is, I'm observing a differnt behaviour ( as you can see in the > log below ): > OpenSSH_2.9.9p2, SSH protocols 1.5/2.0, OpenSSL 0x0090602f > debug1: Reading configuration data /etc/ssh/ssh_config > debug1: Applying options for * > debug1: Reading configuration data /home/ruhej/.ssh/config > debug1: Applying options for * I cannot see a deviation from the doc here, it's just a different POV: Reading configuration files in the "from general to more specific" order and applying parameters from the command line last will result in the very effect the doc states -- the most specific settings will "win". So where's the problem? Should you not get what you expected from reading the doc please show the /etc and the $HOME config sections and the logs (ssh -v) which prove that the program does otherwise. The cite above doesn't qualify as "behaviour differs from design" but is quite the opposite. :) No matter how it's implemented, you get the promised functionality. virtually yours 82D1 9B9C 01DC 4FB4 D7B4 61BE 3F49 4F77 72DE DA76 Gerhard Sittig true | mail -s "get gpg key" Gerhard.Sittig(a)gmx.net -- If you don't understand or are scared by any of the above ask your parents or an adult to help you.

2 1

Re: [suse-security] netcat
by ts 12 Apr '02

12 Apr '02

> Hi Ian, > > > I have been considering using netcat with the minus z > option as an > > enterprise monitoring solution to test the availability > of smtp, http, > > lotusnotes SAP etc. but read in > http://rr.sans.org/audit/netcat.php that it > > was not recommended for use in production systems. Does > anyone know why ? > > Also does anyone know of a safer alternative? > > > > I guess that they recommend to install netcat only if you > need it. By > consequence, you have to install it if you want to use it. > They argue in > that website that it's safer to not have programs > installed that you don't > need. To me, this seems to be the only argument against > installing (and > thereby also using) it. Security breaches in netcat seem > rather unlikely. > > > Warm Regards > > Thanks, > Roman. > -- I read this also with some disbelief and was motivated to reply to the sender originally. netcat is a smaller hole (in potential at least) than any of the scripting languages that offer socket API's IMO.

1 0

Re: [suse-security] ifconfig and promiscuos mode
by Michael Stern 12 Apr '02

12 Apr '02

> What other ways can I be sure that my box has not been > compromised? I have run adorefind, negative, chkrootkit, all negative. well md5 signatures would be okay if you can put the hard disk into another computer and have the signatures of the original files ... i guess. cheers!

2 1

Re: [suse-security] openssh client configuration files
by Joerg Ruhe 11 Apr '02

11 Apr '02

Hello Christopher, thanks for your answer > Make things easy for yourself. First return your ssh config file located > in your home directory back to the default settings. The default on my system was no ssh ssh config file in my home directory. When I delete this file naturly I don't have this problem, since ssh only reads the system-wide configuration file, but I need this file to apply special settings for an user. > Next ensure that the > "ListenAddress" in /etc/ssh/sshd_config is set to your correct IP. Also > set "PermitRootLogin" to no. > Give "rcsshd reload" and then "rcsshd restart" ago and let me know what > happens. Okay, "ListenAddress" was not set in my sshd_config and "PermitRootLogin" was set to without-password. I changed the settings to your sugestions, but nothing changed. Ssh still reads and applys the /etc/ssh/ssh_config before the file in my home/.ssh directory. Excuse me if made myself not totally clear in my first message ( or if I have a wrong understanding of your sugestions ). I don't have any problems with incoming ssh connections to that system, but with connections originating on that system. Joerg Ruhe Joerg.Ruhe(a)epost.de

1 0

Re: [suse-security] openssh client configuration files
by Roland Kuhn 11 Apr '02

11 Apr '02

On Thu, 11 Apr 2002, Joerg Ruhe wrote: > Hello Roland, > > [...] > > > > > > Here the options in the system-wide configuration file are applied first. > > > I have seen this on several differnt computers, all > > > with SuSE 7.3 and openssh 2.9.9p2 . > > > > From an algorithmic standpoint it would make sense to read the > > configuration files in reverse order, but this doesn't mean anything. Did > > you experience a setting in /etc/ssh/ssh_config overriding a user setting? > > Thanks for your answer. > > Thats exactly what happend. A setting in /etc/ssh/ssh_config overrides an > user setting ( I tried this with several options ). > > Does it work that way on your system ? > These are from my system: debug1: Reading configuration data /home/rkuhn/.ssh/config debug1: Applying options for * debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * I just verified that the settings from /home/rkuhn/.ssh/config override the ones from /etc/ssh/ssh_config. Ciao, Roland +---------------------------+-------------------------+ | TU Muenchen | | | Physik-Department E18 | Raum 3558 | | James-Franck-Str. | Telefon 089/289-12592 | | 85747 Garching | | +---------------------------+-------------------------+

2 1

Re: [suse-security] openssh client configuration files
by Roland Kuhn 11 Apr '02

11 Apr '02

Hello Joerg! On Wed, 10 Apr 2002, Joerg Ruhe wrote: > The man page and the o'reily book state the order in which configuration data > is obtained as : > 1. command line options, > 2. user's configuration file ($HOME/.ssh/config) > 3. system-wide configuration file (/etc/ssh/ssh_config) > > My trouble is, I'm observing a differnt behaviour ( as you can see in the > log below ): > OpenSSH_2.9.9p2, SSH protocols 1.5/2.0, OpenSSL 0x0090602f > debug1: Reading configuration data /etc/ssh/ssh_config > debug1: Applying options for * > debug1: Reading configuration data /home/ruhej/.ssh/config > debug1: Applying options for * > > Here the options in the system-wide configuration file are applied first. I > have seen this on several differnt computers, all > with SuSE 7.3 and openssh 2.9.9p2 . > >From an algorithmic standpoint it would make sense to read the configuration files in reverse order, but this doesn't mean anything. Did you experience a setting in /etc/ssh/ssh_config overriding a user setting? Ciao, Roland +---------------------------+-------------------------+ | TU Muenchen | | | Physik-Department E18 | Raum 3558 | | James-Franck-Str. | Telefon 089/289-12592 | | 85747 Garching | | +---------------------------+-------------------------+

3 3

SuSE 8.0
by Richard Ibbotson 11 Apr '02

11 Apr '02

Hi Will harden_suse.rpm be available for the next release of SuSE 8.0 or shall I have to download it as source code from the appropriate web page ? As far as I can see each new release of SuSE software requires that a new version of harden_suse.rpm is used. Is this correct ? Thanks -- Richard www.sheflug.co.uk

1 0

Openssh - how do you disable "PasswordAuthentication" for a speci fic user
by Steven Thompson 11 Apr '02

11 Apr '02

Hi All Q1. How do you disable "PasswordAuthentication" for a specific user, as I only want to allow PublicKeyAuthentication. Q2. Is it possible to user1@host1 user1@host2 as config setting for the "AllowUsers". (ie one account, but 2 valid hosts to login from). Q3. What options are available to limit a user to their home directory with out having to apply the chroot patch to Openssh. (i.e. they can't "cd .." backwards into the directory tree, but they can "cd .." forward in their home directory" Thanks in advance Steven

2 1

ifconfig and promiscuos mode
by Oswaldo Castro 11 Apr '02

11 Apr '02

Hi List, I started a tcpdump session and ran the ifconfig command to see if it returns the string "PROMISC" in the command's output. There's nothing there showing me this mode of operation. I know that tcpdump puts the interface to promiscuos mode (by default) and I am almost sure that the tcpdump was not hacked (this is a very fresh installation). Is there a problem with ifconfig from the SuSE distro ? Which are the other ways ? I will be glad for any kind of information Oswaldo Castro

4 5

ssh lock out
by Alexander Pacheco 10 Apr '02

10 Apr '02

Hi, I had the following message to the suse-security mailing list. Is there anybody who can help me? I do not want to remotely log into my home system as root. It locks if I login with my use name. Thanks for the help Alex Hi, I have a Suse 7.3 with Susefirewall activated at home which I can access from workplace using ssh. My problem is my home PC locks up if I connect using my user name and try to change directory but not when I login as root. I get the same problem when I do ssh localhost on my PC. Could anybody give me a solution to this. Thanks for your help Alex -- ************************************************************* * Alexander Pacheco * * 2323, NPB, Tel: Office (352)-392-3010 * * P.O. box 118435 Home (352)-336-4036 * * University of Florida, * * Gainesville, Fl 32611-8435. * * pacheco(a)qtp.ufl.edu alexp(a)ufl.edu * * http://www.qtp.ufl.edu/~pacheco * *************************************************************

6 6

IMP 2.2.8
by Martin Sckopke 10 Apr '02

10 Apr '02

Hi all, this was on bugtraq on Saturday: > The Horde team announces the availability of IMP 2.2.8, which prevents > some potential cross-site scripting (CSS) attacks. Site administrators > should consider upgrading to IMP 3 (our first recommendation), but if this > is not possible, IMP 2.2.8 should be used to prevent these potential > attacks. Will there be an IMP 2.2.8 for SuSE-EMail-Server II ? Will there be an IMP 3.x.x for SuSE-EMail-Server II ? Will IMP 3.x.x run with SuSE-EMail-Server II? Thanks for your help, Martin

1 0

openssh client configuration files
by Joerg Ruhe 10 Apr '02

10 Apr '02

Hello list, I'm new to ssh and I'm trying to set up an openssh server and some clients. I have a problem with the order in which openssh reads and applys the client configuration files (openssh 2.9.9p2 SuSE 7.3 ). The man page and the o'reily book state the order in which configuration data is obtained as : 1. command line options, 2. user's configuration file ($HOME/.ssh/config) 3. system-wide configuration file (/etc/ssh/ssh_config) and for each parameter the first obtained value will be used. For me that means, that if I set an parameter in my $HOME/.ssh/config and agin in /etc/ssh/ssh_config the value from the $HOME/.ssh/config will be used. My trouble is, I'm observing a differnt behaviour ( as you can see in the log below ): OpenSSH_2.9.9p2, SSH protocols 1.5/2.0, OpenSSL 0x0090602f debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Reading configuration data /home/ruhej/.ssh/config debug1: Applying options for * Here the options in the system-wide configuration file are applied first. I have seen this on several differnt computers, all with SuSE 7.3 and openssh 2.9.9p2 . Unfortuanly I'm not able to compare this behavior with an earlier version of openssh and suse. If I do an ssh -F config-file everything works, as in my understanding it should work, the given config-file is read an nothing else. I would be glad, if somebody could help me with this problem ( or tell me what I did wrong ). Thanks Joerg Ruhe Joerg.Ruhe(a)epost.de

1 0

External interface not accessible from inside problem
by Avi Schwartz 10 Apr '02

10 Apr '02

I currently have a problem where an I cannot access my external network interface from inside my NATed home lan. For example, I have an email account pointing to my external IP address. It is only accessible from outside the network (i.e. from work). If I try to use the same email account from inside my network, I fail to connect. I ended up creating a second account in my email program pointing this time to my non-public IP of the same server in order to access mail from inside my network. I know that the firewall2 script is blocking it (I can see it in the logs), but I am not sure what do I have to change in firewall2.rc.config in order to fix this. Thanks, Avi -- Avi Schwartz avi(a)CFFtechnologies.com

1 0

Re: [suse-security] ucdsnmp update and ethereal - update problem
by Markus Gaugusch 09 Apr '02

09 Apr '02

On Tue, 9 Apr 2002, Richard Ems wrote: > You really didn't read the security announcement, did you? ;-) Ooooops, I'm really sorry! Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

1 0

ucdsnmp update and ethereal - update problem
by Markus Gaugusch 09 Apr '02

09 Apr '02

# rpm -Fvh ucdsnmp.rpm mod_php4* error: failed dependencies: libsnmp-0.4.2.1.so is needed by ethereal-0.8.19-36 This is on SuSE 7.3. I have not seen an ethereal update file. regards, Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

2 1

Re: [suse-security] passwd/smbpasswd-entrys
by da_bug＠gmx.net 09 Apr '02

09 Apr '02

Hi all! Thanks for your help now I have a nice solution... It is a combination of the ideas of Dirk Jansen and Ralf Ronneburger - I added the c-source below. Maybe the security could be improved - I do a lot of plaintext-password-stuff in memory...Any suggestions? It would also be good the read the stdout/stderr of useradd and smbpasswd so that I could deal with errors and so on, but I am not yet sure how to realize that... --- /* Little c-tool that creates a */ /* linux- and a samba-user "bar" (username) with using */ /* the 'useradd' and 'smbpasswd' command. */ /* For both users the password is set to "foo" (key). */ #define _XOPEN_SOURCE #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/wait.h> #include <crypt.h> #include <string.h> #include <time.h> #define SAMBA_USER 1 /* also want samba-user? */ #define bin_to_ascii(c) ((c)>=38?((c)-38+'a'):(c)>=12?((c)-12+'A'):(c)+'.') int main() { time_t tm; char key[13]="foo"; char salt[2]; char username[64]="bar"; char useraddstr[256]="useradd -m -p "; //-p gives encrypted pass to useradd char popenstr[256]="smbpasswd -a -s "; //-s enables stdin FILE *fhd_w; time(&tm); salt[0] = bin_to_ascii (tm & 0x3f); salt[1] = bin_to_ascii ((tm >> 6) & 0x3f); strcat(useraddstr,crypt(key,salt)); if(!SAMBA_USER) strcpy(key, "010101010101010"); //erase key :) strcpy(salt,"010101010101010"); //erase salt :) strcat(useraddstr," "); strcat(useraddstr,username); if(system(useraddstr) == 0 ) printf("Linux-User %s created.\n",username); else { printf("Error. No user created.\n"); exit(EXIT_FAILURE); } if(SAMBA_USER) { strcat(popenstr,username); printf("Creating Samba-User...\n"); if( (fhd_w = popen(popenstr,"w")) ==NULL ) printf("popen-error\n"); fprintf(fhd_w,"%s\n",key); //"enter" password :) fprintf(fhd_w,"%s\n",key); //confirm it pclose(fhd_w); strcpy(key, "010101010101010"); //erase key :) } exit(EXIT_SUCCESS); }

2 2

passwd/smbpasswd-entrys
by da_bug＠gmx.net 09 Apr '02

09 Apr '02

Hi! Does anybody know how I can use "passwd" and "smbpasswd" to set user-passwords in a c-program? I cannot write to these tools via stdin because of security reasons... Libexpect could be a solution but I didn't find any good example source that helped me..(anyone knows one?) Every possible way would be good, I just want to make /etc/passwd and /etc/smbpasswd-entrys out of my two c-strings for username & password. Thanks for any help. <da_bug(a)gmx.net>

6 6

problem installing apache 1.3.19-114
by Bob Vickers 09 Apr '02

09 Apr '02

I asked a question a couple of weeks ago, but nobody came up with the answer so I thought I would have another go. It seems I'm still running an insecure version of Apache because the SuSE security update is incompatible with jserv. Is there anyone else out there running Apache with jserv on SuSE 7.2? Did you manage to apply the 1.3.19-114 update? Is it OK to force the update? Here is the original message, I don't think anything has changed. On 5th March an Apache security update appeared on SuSE's web site (e.g. the 7.2 version in http://www.suse.de/en/support/download/updates/72_i386.html ). But this seems to be impossible to install if you also have jserv installed: # rpm -q -p apache.rpm apache-1.3.19-114 # rpm -Fhv apache.rpm error: failed dependencies: apache = 1.3.19-66 is needed by jserv-1.1.2-156 I can't find a newer version of jserv. Regards, Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

1 0

Re SuSE Security Announcement: ucdsnmp (SuSE-SA:2002:012)
by Webmaster 09 Apr '02

09 Apr '02

Hi List Trying to update ucdsnmp, the ' rpm -q ucdsnmp' gives 'ucdsnmp-4.1.1-111' and for "rpm -Fhv file.rpm" the following conflicts appear: file /usr/share/snmp/mibs/IF-MIB.txt from install of ucdsnmp-4.2.3-79 conflicts with file from package ucd-snmp-4.0.1-3 file /usr/share/snmp/mibs/IP-MIB.txt from install of ucdsnmp-4.2.3-79 conflicts with file from package ucd-snmp-4.0.1-3 file /usr/share/snmp/mibs/RFC1155-SMI.txt from install of ucdsnmp-4.2.3-79 conflicts with file from package ucd-snmp-4.0.1-3 file /usr/share/snmp/mibs/RFC1213-MIB.txt from install of ucdsnmp-4.2.3-79 conflicts with file from package ucd-snmp-4.0.1-3 file /usr/share/snmp/mibs/SNMPv2-MIB.txt from install of ucdsnmp-4.2.3-79 conflicts with file from package ucd-snmp-4.0.1-3 file /usr/share/snmp/mibs/SNMPv2-TM.txt from install of ucdsnmp-4.2.3-79 conflicts with file from package ucd-snmp-4.0.1-3 file /usr/share/snmp/mibs/TCP-MIB.txt from install of ucdsnmp-4.2.3-79 conflicts with file from package ucd-snmp-4.0.1-3 file /usr/share/snmp/mibs/UDP-MIB.txt from install of ucdsnmp-4.2.3-79 conflicts with file from package ucd-snmp-4.0.1-3 Please, let me know how to get on with it. - ethereal - gxsnmp - mod_php4 - snmp - tngfw packages are not installed on the system suse. 7.1 Thanks: Antal ++++++++++++++++++ Kreorg Oktatóközpont http://www.kreorg.hu kreorg(a)kreorg.hu Tel:+36-1-321-00-31

3 2

Re: [suse-security] Fast Online Update for SuSE - fou4s 0.0.3 - bug?
by Markus Gaugusch 09 Apr '02

09 Apr '02

On Mon, 8 Apr 2002, Stefan Nilsen wrote: > I tried the fou4s rpm, did not change any settings in config file. > I ran fou4s -u and then fou4s -i, se output below for fou4s -i > wale:~ # fou4s -i --interactive > New openssh: 2.91.9p2-98 (old: 2.9.9p2-98) [security, 1763kB] > Perform download+update ("yes"/no)? yes > Getting sec1/openssh.rpm > Error: Downloaded RPM has version 2.9.9p2-98, but package description > says 2.91.9p2-98! > Not installing openssh.rpm. This is a problem with the update description for openssh on SuSE 7.3. Since YOU manages its own update list, it doesn't matter if you use YOU. Fou4s uses the RPM database to check for updates and handles wrong update versions this way. The next version will contain a killfile function to stop such updates from beeing remarked. This will also help to preserve self-built RPMs (for example mod_php4 with oracle support). Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

1 0

SuSE Security Announcement: ucdsnmp (SuSE-SA:2002:012)
by Thomas Biege 08 Apr '02

08 Apr '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: ucdsnmp Announcement-ID: SuSE-SA:2002:012 Date: Monday, Apr 8th 2002 11:37 MEST Affected SuSE versions: 6.4, 7.0, 7.1, 7.2, 7.3 SuSE Linux Database Server SuSE eMail Server III SuSE Firewall SuSE Linux Connectivity Server SuSE Linux Enterprise Server 7 Vulnerability Type: - remote root access - remote denial-of-service Severity (1-10): 6 SuSE default package: no Other affected systems: all linux-like systems using ucdsnmp Content of this advisory: 1) security vulnerability resolved: serveral bugs in ucdsnmp problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The Secure Programming Group of the Oulu University, Sweden released a testing suite for SNMP implementations. Several bugs could be triggered in the ucd-snmpd code by using this testing suite. These bugs lead to remote denial-of-service attacks and may possibly exploited to break system security remotely. Additionally, the SuSE Security Team did a full audit of the ucd-snmpd code and we hope to avoid more problems caused by other bugs in the future. Generally SNMP access (UDP 161,162) and all UDP bouncing services like echo (UDP 7) should completely be blocked at your firewall. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. After updateing the RPM package run "ldconfig" and "rcsnmpd restart" as root to make the new library effective and to start the new daemon. Please note! We made a version upgrade of ucdsnmp, so other programs that rely on the ucdsnmpd library may become broken. We are aware of the following dependencies: - ethereal - gxsnmp - mod_php4 - snmp - tngfw New RPM packages for this programs will be released as soon as possible. The mod_php4 packages have been published and require the new ucdsnmp packages. i386 Intel Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/ucdsnmp-4.2.3-79.i386.rpm 1c2e1cb902a7bfd1235b72ab01ef8fb5 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/ucdsnmp-4.2.3-79.src.rpm 4690d8fdd02aeda1ecdfb823ee4e5c5b SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/ucdsnmp-4.2.3-79.i386.rpm 8d64235fb11291264a77df5dbcccc92d source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/ucdsnmp-4.2.3-79.src.rpm 64ea35f0f89fda979050e0276a9a1454 SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/ucdsnmp-4.2.3-79.i386.rpm 89d6afe19dde9d69269ba59941db9ed8 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/ucdsnmp-4.2.3-79.src.rpm 226cd20a4f287c3ed518443070ba5a1b SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/ucdsnmp-4.2.3-79.i386.rpm d83d0eacc2ee9aeb9d48106c5ccc5d86 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/ucdsnmp-4.2.3-79.src.rpm 7b39de0fa0632f845da6bc0868ae7a50 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/ucdsnmp-4.2.3-79.i386.rpm 0f07af8b74bff747d0a08158ebce13e0 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/ucdsnmp-4.2.3-79.src.rpm adc89756a09334dcb4a392079b40bc63 Sparc Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n2/ucdsnmp-4.2.3-30.sparc.rpm 2bf9c52997928890eb39e74ebd279a96 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/ucdsnmp-4.2.3-30.src.rpm ae8896d82ba79d65b7a9efdc681d61e2 SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/ucdsnmp-4.2.3-30.sparc.rpm 29b37eecda93c9c40eeafc7c6f2150b5 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/ucdsnmp-4.2.3-30.src.rpm 6510ed2805dc225dfe0f2576e082d518 SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/ucdsnmp-4.2.3-30.sparc.rpm 97ff495d2e5a25fbd403ac60d953fb67 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/ucdsnmp-4.2.3-30.src.rpm 2bf034b9ccfc8e18915c9ad043c3f031 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/ucdsnmp-4.2.3-39.alpha.rpm 1d1b6039a7ff00146395d9b47f79cd8a source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/ucdsnmp-4.2.3-39.src.rpm b9e13edaae7adc6325088d562687ae12 SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/ucdsnmp-4.2.3-39.alpha.rpm 1f3e6df23a387747f025916e42d56e4d source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/ucdsnmp-4.2.3-39.src.rpm d8b0005133f9a1129d1b5cd821999d20 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/ucdsnmp-4.2.3-39.alpha.rpm ee584501afdf1e3246d48ef0648e40f9 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/ucdsnmp-4.2.3-39.src.rpm 1ffda4dc5f0cd611de0c45305849b314 PPC PowerPC Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/ucdsnmp-4.2.3-63.ppc.rpm 43d3afe225546fac26d64b78439c2659 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/ucdsnmp-4.2.3-63.src.rpm 7859b62cc34b7bd6638beca85e6c72d6 SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/ucdsnmp-4.2.3-63.ppc.rpm 583bf560618c865daafb7219f230666d source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/ucdsnmp-4.2.3-63.src.rpm 528a0127706acd1586846d8c85dcee49 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/ucdsnmp-4.2.3-63.ppc.rpm 8bcb36e2ad94472564ee94449590a362 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/ucdsnmp-4.2.3-63.src.rpm e3f20e08881a22f73376cacf4f9a5606 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/ucdsnmp-4.2.3-63.ppc.rpm 4a9e00c6e07230f156b4382e97028b29 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/ucdsnmp-4.2.3-63.src.rpm 5464ea7488c5fd9e8f0617833a296fbf ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - inn update packages are available for the inn news server, as contained in all SuSE Linux products. The updates fix a problem where the inews program wouldn't properly check the moderator's email address that is supplied by the server. The user calling inews may gain elevated local privileges with this bug. In addition to the fix for this particular bug, minor directory permission adaptions have been made. We will not release an own security announcement for this bug. - gnokii for SuSE-7.2 and SuSE-7.3 The gnokii package for the SuSE Linux distributions contain a vulnerability that allows write access to any file on the system, allowing a local attacker to gain root privileges. Update packages for the SuSE Linux Distributions 7.2 and 7.3 are avbailable on our ftp server that fix this problem. We will not release an own security announcement for this bug. - mod_php4 for SuSE Linux 7.2 A packaging error caused the update packages for the mod_php4 package on SuSE Linux 7.2 to lack support for TTF, XML and IMAP. This has been corrected with new update packages on the ftp server. - fileutils A race condition while recursively removing directory structures from world-writeable directories cause the rm(1) command to be vulnerable to an attack that allows a local user to remove arbitrary directories (and files) from the system. The error has been corrected in the update packages that are available from the a1/ series update directrory of each distribution. Users of SuSE Linux Enterprise Server 7 based products receive their update packages through the SuSE maintenance web. We will not release an own security announcement for this bug. - nscd The name service cache daemon shipped with supported SuSE products (part of the glibc/shlibs package) is configured to run by default, but configured to not cache hosts entries (A- and PTR records from domain name servers). Therefore, a vulnerability that takes advantage of the fact that nscd uses an existing (cached) PTR record for resolving a request for an A-record is not applicable to SuSE products. The weakness will be fixed in future releases of SuSE products. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQEVAwUBPLG/h3ey5gA9JdPZAQFNfwf/Vgky6SZPlzyNG6vBr7y6uwaXoibikBQY dInH9KvPWnnEO+TJ6pBtX9SLViJugmIX+be6FOHcypeoyKpwku7glmyIFeLoLUii Rz0awcrE5th6hhHPyjMMuuv0rzz18sZ2UZwX9T4zgYW2s+CKHwaMWTWNjWF7p5dM +svGxT0lVnIx9HABFdJgItNIWdfvWQbKmwZwhlkachYspfpdHLgz78QiSZ6SHhd/ PTDdfBNxSZh7WBnIlnBic4lJ6k8OzLVQnYEYAn/Jnkg2qCKr33qDytYcFdtodTh4 pw80pxeNrlmE0r04h6MlMPOkocxdS7mjHiuDaAHQZI3xns7KKHLaeg== =2C22 -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege <thomas(a)suse.de> SuSE Linux AG,Deutschherrnstr. 15-19,90429 Nuernberg Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/contact/thomas.asc | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 83 -- Trete durch die Form ein, und trete aus der Form heraus.

3 4

Fast Online Update for SuSE - fou4s 0.0.3
by Markus Gaugusch 08 Apr '02

08 Apr '02

Hello List! The third release of fou4s has very big speed improvements and better dependency checking. It has become mature now, and I'm running it on all my servers (example crontab entry is included). Interactive mode was added and SuSEconfig is now called by default after an update has been performed. Old files that are still in use by processes are shown to the user together with an informational message. Fou4s works also very good from network directories. If you have several SuSE servers of the same version, just let them run off the same directory. See the fou4s homepage http://www.gaugusch.at/fou4s for more details. An RPM package is now available for download, which should be used by most users. It is pre-configured and will allow easy updating: http://www.gaugusch.at/linux/fou4s-0.0.3-2.i386.rpm regards Markus Gaugusch PS: I'm posting again here, because many people asked me to do so. Online Update is security related in their (and my) opinion, so I think it should be ok. -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

1 0

Network device
by Robert Rottscholl 08 Apr '02

08 Apr '02

Dear List, today I noticed that I have a network device sit0. It is not listed by ifconfig, but if I look at /proc/net/dev it is mentioned. Is ist SOmething security related or can I ignore it. Ciao ;-) Robert Rottscholl - DE

3 2

RE: [suse-security] pop3 proxy
by Reckhard, Tobias 08 Apr '02

08 Apr '02

> Please let me know whether such a linux based pop3 proxy > exists and if so, > where I can get it. I've used perdition successfully and have had reports that pop3proxy works fine, too. Consult Google for the corresponding Web links. Tobias

1 0

SuSEfirewall2 vs. DHCP
by Alan Hadsell 07 Apr '02

07 Apr '02

Hi -- My system specs: Small LAN, mixed Windows and SuSE Linux 7.1. One box is directly connected to the Internet via a cable modem, performing firewall and masquerading duty for the other machines on the system. This box is running the kernel from k_i386-2.4.16-34.i386.rpm. It also runs SuSEfirewall2 (2.1.0) and ICSA DHClient (from the 7.1 distribution CDRom). When it's working, it works very well. My problem: When the DHCP lease times out, the firewall box can't acquire a new one. It appears that the firewall's anti-spoofing rules are blocking the DHCP server's reply. At the time when this happens, I get numerous SuSE-FW-DROP-ANTI-SPOOFING messages with source port = 67 and destination port = 68. At this point, I lose all Internet connectivity until I reboot the firewall box. My configuration includes FW_SERVICE_DHCLIENT="yes". Although I have a reasonable theoretical understanding of iptables, I have to admit that the SuSEfirewall2 script, especially in the area of antispoofing, is well beyond me. If anyone can help with this, I'm all ears. Thanks, -- Alan Hadsell "Whatever does not kill me makes me stranger".

2 9

pop3 proxy
by mailinglists＠belfin.ch 07 Apr '02

07 Apr '02

Hi I have an Exchange server running in the internal LAN. Users must be able to get e-mails from outside the company, e.g. by cell phone. In order to prevent direct access to Exchange box, which could be done with some tasty port forwarding, I want to place a pop3 proxy in front of it. Users connect to the proxy and authenticate there, the proxy then connects to the Exchange and gets the mails. Please let me know whether such a linux based pop3 proxy exists and if so, where I can get it. Thanx a lot, Philipp

2 1

Re: [suse-security] SuSEfirewall2 vs. DHCP
by Michael Stern 07 Apr '02

07 Apr '02

,---- | Apr 6 07:50:33 wally kernel: SuSE-FW-DROP-ANTI-SPOOFING | IN=eth1 OUT= MAC= SRC=64.85.299.299 DST=255.255.255.255 | LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP | SPT=68 DPT=67 LEN=308 `---- I'm not an expert in DHCP at all, but to me it looks like the following happened: when requesting a new lease your system broadcasts and udp packet to discover any present DHCP server. because it is a broadcast, the packet is also received by your system - therefore it ends in the INPUT chain again. what would be interesting to know is whether the packet was also received by another system - did the ip renewal work? cheers, michael

1 0

connectivity failure
by Roman Drahtmueller 06 Apr '02

06 Apr '02

Hi together, I don't really know when this message will make it to the lists server and out again - our Oakland Internet provider is obviously not capable of maintaining the connectivity of our servers. By consequence, we're cut off the internet with two important servers: ftp.suse.com and lists.suse.com, which maintains most of the SuSE mailing lists. We're working on the problem, of course, but there's nothing we can do during the weekend since we don't have the bandwidth here in Nürnberg (yet). More later... Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -

2 1

OT: User accounts
by BLeonhardt＠analytek.de 06 Apr '02

06 Apr '02

Hello, does anybody have a idea, how to generate more than 100 Users without having to add them manually or with YaST ? Is there anything like a skript ? The users need the home-dir's too ... ! Thank's ! Best Regards / Mit freundlichen Grüßen Bruno Leonhardt

5 4

Kernel 2.4.16.SuSE-31 ?
by malte_gell＠t-online.de 05 Apr '02

05 Apr '02

Hi, for a few days there's a kernel update for 7.3 below /pub/suse/i386/update/7.3/kernel/2.4.16-20020325 on the ftp server. I guess 2.4.16.SuSE-31 contains the fixes for the zlib issue ? Would be nice if the kernel rpm's would contain a changelog within... Regards, Malte

7 8

SendMail 8.12
by Nikos Psarrakis 05 Apr '02

05 Apr '02

Has anyone tried SendMail 8.12? Is there a known security issue or something? What are the .config files we should be aware of, in order to have a good level of security? Thanks in advance, i remain...

2 1

AW: chroot with OpenSSH
by Kurt Minder 05 Apr '02

05 Apr '02

Hi Ulf thank you for the description works the patch you decribed also with the 2.9.9 openssh version. I can't use the 3.x.x version beacause my libraries aren't compatible with it Kurt > -----Ursprungliche Nachricht----- > Von: Ulf Stegemann [mailto:ulf@zeitform.de] > Gesendet: Freitag, 5. April 2002 09:38 > An: Kurt Minder > Betreff: Re: chroot with OpenSSH > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi Kurt, > > Kurt Minder <kurtminder(a)bluewin.ch> wrote: > > > does anybody know a good howto for configuring a chroot > environment with > > openssh on a linux 7.3 box > > I once wrote a little description on that topic (which I > recently updated for > OpenSSH 3.1). That config works for me for various Linux > 2.2.x installations > and I heard it was successfully used on Solaris, too. > > Maybe that helps: http://ulf.zeitform.de/sshchroot/index.html > > > Regards, > > Ulf Stegemann > > - -- > mailto:ulf@zeitform.de > GnuPG/PGP Key-ID: 0x8862250A > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.6 (GNU/Linux) > Comment: Public Key at http://ulf.zeitform.de/GnuPG/ > > iD8DBQE8rVQmENDn14hiJQoRAprhAKDshRZGdDZNVSeFLOGKWn6iSGwQdwCfRq9q > MUVtrniEsYMYA7rL5DaiDlI= > =wGBF > -----END PGP SIGNATURE----- >

1 0