May 2002 - openSUSE Security - openSUSE Mailing Lists

how to keep nimda and code red from filling apache logs
by Mathias Homann 25 Sep '03

25 Sep '03

Hi all, here's a bit of a step-by-step description on how to keep nimda and codered from filling your apache logs. Parts used: - SuSE 7.2 Professional - SuSEfirewall2 - iptables 1.2.3 - linux kernel 2.4.13-pre5 steps: 1. install kernel sources for a kernel >> 2.4.9, running 2.4.13- pre5 here, works fine so far 2. get the sources for iptables 1.2.3 from http://netfilter.samba.org 3. unpack sources somewhere 4. export KERNEL_DIR=$(where you put the kernel tree) 5. cd into unpacked iptables sources, there's a subdirectory named patch-o-matic there 6. apply wanted patches by running ./runme $(name.of.patch)patch for this here You'll want the string patch You can also apply other patches, like the irc-conntrack patch 7. now there's a little bug in this patch... here's a diff: --- linux/net/ipv4/netfilter/ipt_string.c~ Sun Oct 21 00:16:29 2001 +++ linux/net/ipv4/netfilter/ipt_string.c Sun Oct 21 16:54:45 2001 @@ -62,7 +62,7 @@ sk = skip[haystack[right_end - i]]; sh = shift[i]; - right_end = max(int, right_end - i + sk, right_end + sh); + right_end = max(right_end - i + sk, right_end + sh); } return NULL; 8. now, make config/menuconfig/xconfig... as usual. You can import your running kernel's config first. 9. enable the experimental stuff 10. go to networking options->netfilter, there's an option there to enable string matching; set that to M 11. compile and install kernel as usual; remember to uncomment the export INSTALL_PATH=/boot in the main makefile. 12. now build a rpm file for the new iptables stuff by installing the source rpm which comes with suse, then edit the spec file, put the iptables source in /usr/src/packages/SOURCE and rebuild. 13. now there are some small changes to the firewall config files. a) uncomment the last line in /etc/rc.config.d/firewall2.rc.config: FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" b) edit that file, I got the following stuff in mine: for forbidden_string in root.exe cmd.exe .ida; do iptables -I input_ext -p tcp --dport http -m string \ --string $forbidden_string -m state \ --state ESTABLISHED -j REJECT --reject-with tcp-reset done put that in the last supfunction defined in the custom rc file. c) change the FW_LOG setting in firewall2.rc.config from reading -log-level warning to -log-level kernel.warning 14. last: some small changes to /sbin/SuSEfirewall2 search in the script for the parts where the modules are loaded and unloaded; be sure to add ipt_string (and the other new modules you created by patching the kernel and enabling them in make config) to the modules loading/unloading code there. 15. reboot 16. if you try now to access (from outside, of course) one of the nimda or codered URLS, all you get is a 'connection reset by peer', and the request doesn't show in apache log files. btw, no guarantees, and the usual YMMV :) bye [L]

7 7

suse samba server
by jonathan 23 Jan '03

23 Jan '03

Hello I have basically a suse samba server setup. Eth0 is for the internet connection (cable). Eth1 is my internal network. I use eth1 for my samba server. When i have the shares/ drive letters mapped, whatever, Ill goto access them and that computer will just lockup or timeout for about 1 minute, then it will resume operation normally. I have approx. 5 comptuers on the suse server, and they all do this from windows xp to windows 98se. I am using set up addresses of 192.168.0.x, where is greater than 2. My question is have or is there something Ive setup wrong to cause this pause to occur. ? Its becomming very annoying..and frustrating. Im using kernel 2.4.18-64GB-SMP with a dual processor setup. If anyone has any ideas please let me know. Every package installed is orginal versions from the suse install cdroms. (no updates done). Anything come to mind. btw, ive replaced the switch, with a new netgear one, and all the networks at startech ST100 Realtek 8139 chipsets on 100Tx. Anyone... !

4 5

Urgggggg!!! SuSEFirewall2 is getting on my nerves!!!!!
by Chris Bek 08 Jan '03

08 Jan '03

Hi there SuSErs... Well I must be doing something really wrong because everything that I do with SuSEFirewall2 is just not working! I have a small network with 5 PCs (all Win9X) and a Linux box (Currently SuSE 7.3) acting as a server. The server is a DHCP server and a Samba server for the entire network. So far everything is working perfect!!! Users log on the network, logon script executes etc.... Then a new task came up: let's input the internet into the network. Configured a 56Kbps modem on the server with YAST. Manged to get my account setup and running. Made a test connection and netscape works great on the server as well as e-mail (pop3). I tried configuring SuSEfirewall to manage all incoming requests from the PCs of the network. The firewall warned me about masquerading etc. so I downloaded the latest version of SuSEfirewall2 from the internet and installed it. Since I only need direct masquerading to be done (no proxies are currently working on the net) I made all the necessary changes as outlined in the examples supplied with the software. Since I needed to have Samba to keep working on the network, I opened (among others) 139 port for samba to work. Double checked all the changes that I have made and run rcSuSEfirewall2 to see what happens. Strange enough when wvdial executes it tells me that DNS is not functioning properly since www.suse.com cannot be found (or something like that please forgive me I am away from the Linux station now). Further on, when I open mIRC or other like programs (winmx etc) from a station, I look at the activity of IPtraf (I check this to see what happens) and I see no connections being created whatsoever.... mIRC prompts me that there was an error trying to find the host.... I have made no changes to the Win9X PCs. Is there something that I am forgeting to do?? I undestand that it is impossible for all of you to react to this since I have no output of the SuSEfirewall.conf file being published to this message.... I understand. Can someone please send me their configuration file so I can see what you have done, on a system that currently is working fine?? In addition, is there something that I have to do regarding route or routing?? What about the Win9X PCs?? Is there something that I have to do there?? I thank you so very much for all your help is advance!!!! I am killing myself trying to figure this one out for about 2 weeks now and managed nothing more than thin air!!!!! Chris

11 10

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

Re: [SLE] Re: [suse-security] NSA SELinux
by JW 03 Jun '02

03 Jun '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 JM >JW writes: JM >I Hope this helps, it is hard to tell what this thread is about. It is about applying the SE Linux security patches to the the SuSE kernel 2.4.18 for 8.0. Currently, the NSA (the SE-Linux authors) work with RedHat. Some work has ben done before on patchign a SuSEsystem to work with SE-Linux, but no one has (yet) gotten very far. I dearly hope to change that... - -- - ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE89/3sQ5u80xXOLBcRAgksAJ4lLaPamFTUx/hkhZOJn+lqdv/2uQCfRQKE w5WGBDPonWHvtpiI++rKp00= =YSZC -----END PGP SIGNATURE-----

3 6

IPCHAINS -> IPTABLES on SuSE 7.2
by chemiegott＠gmx.net 01 Jun '02

01 Jun '02

Dear Mailinglist ! On our SuSE 7.2-Webserver has IPCHAINS and SuSEfirewall run. Today I've updated from Kernel 2.2 to 2.4 and replaced IPCHAINS with IPTABLES and SuSEfirewall with SuSEfirwall2. All run very well, but one problem remains. With the old configurations, the Users inside my LAN (IP: 192.168.0.x) were able to connect the server (IP: 192.168.0.100 internal, IP:196.123.22.100 external) directly without a proxy or anything else. With the upgrade this is not possible anymore, but i don't want to change anything on the workstations. Do you have any idea, how the Users inside can reach 196.123.22.100 directy. I've tried it with masquerading, but it doesn't work. Thanx in advance, Michael -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 3

template of a tripwire policy file for SuSE 7.3?
by William Bold 31 May '02

31 May '02

Hi, I have been searching on the net, but didn't succedd in finding a tripwire policy file for SuSE 7.3. Although it is recommended to create the policy file according to _your own_ configuration, a good starting point would be a template. Does anybody of you have created something like this or maybe even some scripts that help automate the process of creating a policy file? (The policy creation tool on wiretrip.com's website isn't really useful..) Any help is greatly appreciated. Regards, William B. __________________________________________________ Do You Yahoo!? Yahoo! - Official partner of 2002 FIFA World Cup http://fifaworldcup.yahoo.com

1 0

Re: [suse-security] NSA SELinux
by Matthias Jänichen 31 May '02

31 May '02

At 14:27 31.05.02 +0200, Mark Müller wrote: >We've looked at LIDS, RSBAC and SELinux and decided to give SELinux a >chance. RSBAC is easier to install, but it lacks LSM support and we don't >know where RSBAC is going after Amon has finished its master thesis. RSBAC is OpenSource, so you can continue yourself. There is already a small crew around him so I would not really worry about this. Personally I am sure Amon will keep RSBAC up. I am not exactly uptodate about his plans concerning LSM support. But that should be discussed on his list. You've probably seen the below annoncement. Please feel free to discuss future development on his list and follow the discusion announced below. All I want to do here, is to encourage you to give it a try.. I did and I trust it! Reg. Matthias ---------- Forwarded Message ---------- Subject: [rsbac] The "LIDS versus RSBAC versus MEDUSA DS9" discussion Date: Thu, 30 May 2002 21:31:33 +0200 From: Michal Medvecký <M.Medvecky(a)sh.cvut.cz> To: lids-user(a)lists.sourceforge.net, rsbac(a)rsbac.org, medusa(a)medusa.fornax.sk Hello, we are very proud to invite you to watch and participate the international academic conference OpenWeekend (http://en.openweekend.cz/) held on June 1st on the Czech Technical University (http://www.cvut.cz/) in Prague, Czech republic. The conference will mostly discuss the Linux kernel security. This discussion will include the meeting of the authors of three most significant kernel security patches - Medusa DS9, RSBAC and LIDS - Milan Pikula and Martin Ockajak of Medusa DS9, Amon Ott of RSBAC and Philippe Biondi of LIDS. These guys have never met before. Martin Ockajak and Milan Pikula from MEDUSA DS9 project How can you participate? Whole discussion will be streamed live in the RealMedia format on http://server1.streaming.cesnet.cz:8080/rams/ow2002.ram We will accept questions for tutors on the silcnet (http://silcnet.org) server silcnet.org, channel OW (not #OW!). The english part will start at about 3pm (GMT+2). More info in english at http://en.openweekend.cz/ and in czech - http://www.openweekend.cz/ If anyone would be interested in helping with re-distribution of the signal, please contact me at mailto: misko(a)openweekend.cz Regards, Michal Medvecky Czech technical university, Prague

1 0

System-wide Access Control: how to go about it
by JW 31 May '02

31 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ok, this isn't exactly SuSE specific but it's for a SuSE system, so please bear with me. The reason I'm interestd in SE Linux (Re my previous few posts) is because it was suggested to me that I could use it to control what ports users have access to. I'm a little confused. I've never dealt with this kind of severe security restrictions before and i feel out of my leauge. Here's what I'm trying to do. I have system users who are jailed in a chroot. They will all be running their own system -- i.e. there own software and daemons, but _not_ their own kernel (tit's not VMware or usermode or anything like that) They will each have their own IP address. I have recompiled my kernel to allow common usesr to open ports < 1024 (yes, it works, yes, I'm a little crazy) In my dreams at least, I'd like to be able to prevent all of the following: 1. They cannot access the host filesystem system It's my understanding that on lInux, processes will still be able to access the host system. At least, I got that impression from an article I was reading on FreeBSD jailing, where proccesses _can't_ access the host system. 2. They cannot acess any files anywhere except in their $HOME Basically, something more then just chroot to keep them jailed away. 3. I want to be able to allow/disallow the ports they have access to. 4. I'd like to be able to prevent them from using any IP address but the ones allocated to them. This is currently the worst problem. By default, everything they do (wrt the network) will attempt to use the base ip. Some services like Apache can be set to use only one IP, which helps, and maight be sufficient, but I wish really badly that I could set up somethign in the hosts system that would make it appear as if there's only 1 IP on the system (per user) 5. Processes should not be able to "see" or interact with the host's/other users processes and filesystems. It was suggested to me that SE Linux would allow fine grained controll over things like this, but I'm a little confused after reading some other things. Can anyone offer any other suggestions/advise as to how I should go about this? Have any of you done anything similar before? Would you recommend any other form of system-wide acess control besides SE Linux? All advice, ideas and pointers appreciated. Please don't hesitate to ask for clarification if I did a bad job explaining any particular point (I usually do :-/ ) TIA! - -- - ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE89rT6Q5u80xXOLBcRAioZAJ9jdYPbQVBFJVzcy82NwF/SzuXS/gCfWnsj GUYVWZQJUcTex1KoBsmbxx4= =uhLG -----END PGP SIGNATURE-----

5 5

Re: [suse-security] NSA SELinux
by Mark Müller 31 May '02

31 May '02

Matthias Jänichen wrote: > If you need something to use today you should look at www.rsbac.org. > > RSBAC (Role Set Based Access Controll) is _working_ on Suse, > running for over two years on productive systems. We've looked at LIDS, RSBAC and SELinux and decided to give SELinux a chance. RSBAC is easier to install, but it lacks LSM support and we don't know where RSBAC is going after Amon has finished its master thesis. Mark

1 0

NSA SELinux
by Mark Müller 31 May '02

31 May '02

Hello, is SuSE currently supporting NSA SELinux kernel module or does someone work with it? I'd like to know if there is a port to SuSE because the included tools were written under Redhat in the original SELinux release. Thanks in advance, Mark

5 7

Re: [suse-security] NSA SELinux
by Matthias Jänichen 30 May '02

30 May '02

Hi! If you need something to use today you should look at www.rsbac.org. RSBAC (Role Set Based Access Controll) is _working_ on Suse, running for over two years on productive systems. Further information on RSBAC.ORG. Reg. Matthias

1 0

Checking Firewall Log
by Sec 29 May '02

29 May '02

How can I check the personal firewall log in Suse 8.0 pro to see for the IP addresses been stopped? Thanks

1 0

SE Linux and SuSE: has anyone tried it?
by JW 29 May '02

29 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just wondering if anyone has installed SE Linux on SuSE. I'd love to hear anyone's experiences. Esp. how hard/easy it was to install/configure, anything special you had to do to get it working, and what you like/dislike about it now that you have it working. Wouldn't mind hearing people's opinions about it too, but please send opinions directly to me and not the list (to keep traffic down). Thanks. - -- - ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE88t0UQ5u80xXOLBcRAnQlAKCN9YOAyGBS4nWFEzNpTz2s5+68MwCdF7k1 3MSBpHoyEL9y6/9ngoeK7gs= =w5Zw -----END PGP SIGNATURE-----

3 2

SuSE Security Announcement: tcpdump/libpcap (SuSE-SA:2002:020)
by Sebastian Krahmer 29 May '02

29 May '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: tcpdump/libpcap Announcement-ID: SuSE-SA:2002:020 Date: Wed May 29 14:00:00 MEST 2002 Affected products: 6.4, 7.0, 7.1, 7.2, 7.3, 8.0, SuSE Linux Database Server, SuSE eMail Server III, SuSE Firewall Adminhost VPN, SuSE Linux Admin-CD for Firewall, SuSE Linux Live-CD for Firewall, SuSE Linux Enterprise Server for S/390, SuSE Linux Connectivity Server, SuSE Linux Enterprise Server 7 Vulnerability Type: remote command execution Severity (1-10): 6 SuSE default package: yes Other affected systems: All systems with vulnerable tcpdump. Content of this advisory: 1) security vulnerability resolved: Buffer overflow in tcpdump. problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The tcpdump program may be used to capture and decode network traffic. Tcpdump decodes certain packets such as AFS requests in a wrong way resulting in a buffer overflow. Since running tcpdump requires root privileges this may lead to a root compromise of the system running tcpdump. We strongly recommend an update for administrators using tcpdump to monitor their networks since the only safe workaround is to not use it at all. Additionally to the fixed tcpdump packages we provide new libpcap packages. Libpcap on which most network monitoring programs rely also contained overflows which however are only exploitable by local attackers if you installed programs using libpcap setuid. This is not found in a default install. More information about tcpdump and libpcap may be found at http://www.tcpdump.org Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. i386 Intel Platform: SuSE-8.0 ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/tcpdump-3.6.2-300.i386.rpm f6b5499e4857575fa162ae24cde181c8 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/tcpdump-3.6.2-300.src.rpm 2dd114976f858d0a66c83f409dbf25a0 SuSE-7.3 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n1/tcpdump-3.6.2-300.i386.rpm dc7fba8709f74476ee463e3b7d3d9042 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/tcpdump-3.6.2-300.src.rpm d2d6a940df5c40e54a6b30e3698458ef SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n1/tcpdump-3.4a6-376.i386.rpm 601bc08d351e8100767bbfd502efd44b source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/tcpdump-3.4a6-376.src.rpm af87a4ad56fc853800c6af5982899f18 SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/tcpdump-3.4a6-375.i386.rpm a3251d65bfa05948ce3796ac9e5fdf5b source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/tcpdump-3.4a6-375.src.rpm 84ba69db15e1ff569cf674f7d61428f1 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/tcpdump-3.4a6-374.i386.rpm 63d57b2062a91d5fabeb43a5543d245e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/tcpdump-3.4a6-374.src.rpm 204195b01bc25f84209029bed0eb00cd SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/tcpdump-3.4a6-372.i386.rpm ebb48c115355dc4ba1f45b1f8c36f9aa source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/tcpdump-3.4a6-372.src.rpm d2087aea083c4f6b93a518eee00c979e Sparc Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n1/tcpdump-3.6.2-58.sparc.rpm bb422a4c2d025d3b8a805345a200576a source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/tcpdump-3.6.2-58.src.rpm e0f85bd701865ca1f3d0923d1b9eb24c SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n1/tcpdump-3.4a6-318.sparc.rpm eaf6237823690fe4cb72df39b2b75a5f source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/tcpdump-3.4a6-318.src.rpm 458f7aaa2ed33606007d345d371bf8c4 SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/tcpdump-3.4a6-318.sparc.rpm 6137a3ecadd2bfd95b51039fef52187b source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/tcpdump-3.4a6-318.src.rpm 0227535bdc5f7bd6980e77737cc6182c AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n1/tcpdump-3.4a6-329.alpha.rpm 614dfa16b71456692bc1d92b9db0998b source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/tcpdump-3.4a6-329.src.rpm e5a05bdbe3d5a29f0840c488e703268b SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/tcpdump-3.4a6-330.alpha.rpm 0f1fbdfdcf8f4e1a90424df1b3ad05bc source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/tcpdump-3.4a6-330.src.rpm d48289b8926c3fa7602b6ad026ae4130 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/tcpdump-3.4a6-330.alpha.rpm bf9ef22920ff73802e3b02005476527b source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/tcpdump-3.4a6-330.src.rpm 1fa595c3febfc97f45642faffdd1dfb1 PPC Power PC Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n1/tcpdump-3.6.2-189.ppc.rpm 303f6a00defddc3b8a3be1ab386021cf source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/tcpdump-3.6.2-189.src.rpm 552355e0f15582d47d64fd3a97542cf3 SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n1/tcpdump-3.4a6-317.ppc.rpm 4dd468ba517be7c7f52a8b2ac7c2beb0 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/tcpdump-3.4a6-317.src.rpm 69be109e360246794c66ed55e199ee95 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/tcpdump-3.4a6-316.ppc.rpm 1b51e5529fa559d8453588f09d9b8585 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/tcpdump-3.4a6-316.src.rpm 20d1da2b898a483df771809747851967 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/tcpdump-3.4a6-315.ppc.rpm 97cd7574108f3fcb9f52a7213d626481 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/tcpdump-3.4a6-315.src.rpm 67c63c89e26c2a17df6fef3585f41481 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - Perl-Digest-MD5 The Perl Digest-MD5 module fails to handle utf8 characters properly and thus calculates wrong hash sums for certain input. New packages are already available on our ftp servers. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBPPS7U3ey5gA9JdPZAQGGzQgAluto4ljBhn1o2NZUAQeyX57dCXBwF7X+ d3Y+R7EkUG9jktmIuRqpUBIRz21ckTLGbZkXblNZYKl/EPYTZDGYaG3/GfYJ8NKN 5X/VL1LY+WqPYzEMQtkIBGIBIltD6jTQAJ4TSnKqvYAFajW2lN4ZahDQET1Xr9ma Vw5DnmPVsW1kYCbgL8qz+q0u4d7IUqF07A2iTUeGpfy4cyD8KbYFoZM3UeKe1T6g 73TlkbeP1ifZDOetGGQBc/wVpKUUUrp6srDJc1rUh2sEB0u5+c3o0zawP1ltPqZV KyVuofDRLs+BwRHm10eMbjbTsm9d1Wv8TZwSRU27Zh8SDZxqMiF0LQ== =7hKT -----END PGP SIGNATURE----- -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~

1 0

Antw: [suse-security] Ping doesn't work
by Annette Meriste 29 May '02

29 May '02

Hi again, To ping to the firewall, check first if the kernel parameter icmp_echo_ignore_all is set to "0" And then the same thing with incoming pakets: $iptables -A INPUT -i $IFACE -p icmp \ --icmp-type echo-request -j ACCEPT $iptables -A OUTPUT -o $IFACE -p icmp \ --icmp-type echo-reply -j ACCEPT Icmp type 8 is the echo-request and the 0 is the echo-reply Cheers, Annette >>> "Annette Meriste" <annette.meriste(a)cablecom.ch> 29.05.02 12:19:11 >>> Hi Wilfired, A ping needs echo request and the echo reply. Try something like this: $iptables -A OUTPUT -o $IFAE -p icmp \ --icmp-type echo-request -j ACCEPT $iptables -A INPUT -i $IFACE -p icmp \ --icmp-type echo-reply -j ACCEPT You could specify the state too. Ex. ESTABLISHED, RELEATED Cheers, Annette ------------------------------------------------------------------------------------------------------------------------------- Cablecom GmbH Security Team Zollstrasse 42 CH-8021 Zürich Voice: +41 1 277 99 21 Fax: +41 1 277 93 22 E-Mail: annette.meriste(a)cablecom.ch >>> "Wilfried Philippi" <philippi(a)madex.com> 29.05.02 12:10:14 >>> Hello List, i have a Problem with our Firewall. We use Iptables and the Gateway works normaly, all wanted Connections are accepted and the unwanted are dropped. So it seems the System works. But i can't send a Ping to the System. when I send a Ping from one of the Windows Workstation's i get a Time Overflow ( in German for People who can undestand that : Zeitueberschreitung). I think i have a Port closed who is needed for Ping. What must i change in the Sccript that Ping works? SSH Connections to the Machine works. Any Suggestins? Thanks for Help. Wilfried -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Antw: [suse-security] Ping doesn't work
by Annette Meriste 29 May '02

29 May '02

Hi Wilfired, A ping needs echo request and the echo reply. Try something like this: $iptables -A OUTPUT -o $IFAE -p icmp \ --icmp-type echo-request -j ACCEPT $iptables -A INPUT -i $IFACE -p icmp \ --icmp-type echo-reply -j ACCEPT You could specify the state too. Ex. ESTABLISHED, RELEATED Cheers, Annette ------------------------------------------------------------------------------------------------------------------------------- Cablecom GmbH Security Team Zollstrasse 42 CH-8021 Zürich Voice: +41 1 277 99 21 Fax: +41 1 277 93 22 E-Mail: annette.meriste(a)cablecom.ch >>> "Wilfried Philippi" <philippi(a)madex.com> 29.05.02 12:10:14 >>> Hello List, i have a Problem with our Firewall. We use Iptables and the Gateway works normaly, all wanted Connections are accepted and the unwanted are dropped. So it seems the System works. But i can't send a Ping to the System. when I send a Ping from one of the Windows Workstation's i get a Time Overflow ( in German for People who can undestand that : Zeitueberschreitung). I think i have a Port closed who is needed for Ping. What must i change in the Sccript that Ping works? SSH Connections to the Machine works. Any Suggestins? Thanks for Help. Wilfried -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Using Netcat
by Majid Leo 29 May '02

29 May '02

How can I start using netcat on my Suse 8.0 pro.? Thanks

4 3

SuSEfirewall2 and http,ftp and ssh
by michael.blinzinger＠t-online.de 28 May '02

28 May '02

> Hello > > I`m running a SuSEfirewall2 on SuSE 8.0 Pro and want to connect to > ftp,http,ssh on my Server. How do I have to configure it? I`ve tried it > with several setups but it doesn`t work. > > Thank You > > Michael Blinzinger

1 0

which Anti-Virus Program could you recommend ??
by sc＠optomed.de 27 May '02

27 May '02

Hi list, i want to scan a Samba-File Server for Viruses. At this time i am testing F-Secure AV for Linux an it runs fine, but a Server licence costs 300 Euro. (Workstation 90 Euro - but i think i need Server-Licence ?) For me its important to have good update - support to always get the newest signatures (ok, what is newest) It would be nice if you could tell me your choises and experiences, thx a lot - Andreas (box: Suse 7.3 / Samba / mostly Win9x clients)

7 8

Virtual IP adress on the firewall, the dmz and DNAT / MASQUERADE
by Kai-H. Weutzing 27 May '02

27 May '02

Hi, my problem was that I have a box with three interfaces (ext, dmz, int) and many IPs on the ext-interface and one (or more) server in the dmz. In the moment the SuSEfirewall2 (v2.1) on my SuSE 8.0 installation can't do that (look in the TODO file). So I spend some time in patching the SuSEfirewall2 script and it works well for me. The patch is very small: 1310c1310,1311 < ERROR=`echo $NETS | $AWK -F, '{print $6}'` --- > DEST=`echo $NETS | $AWK -F, '{print $6}'` > ERROR=`echo $NETS | $AWK -F, '{print $7}'` 1337a1339 > test -z "$DEST" || DEST="-d $DEST" 1339c1341 < $IPTABLES -A PREROUTING -j DNAT -t nat $PROTO $NET1 $PORT1 --to-destination ${NET2}${PORT2} -i $DEV --- > $IPTABLES -A PREROUTING -j DNAT -t nat $PROTO $NET1 $PORT1 $DEST --to-destination ${NET2}${PORT2} -i $DEV Short description: - edit the test of the arguments of FW_FORWARD_MASQ and add the variable DEST for the IP adress on the firewall - add line for test the variable DEST, if set add '-d ' for later use in the iptables command - edit the iptables command for PREROUTING; added the DEST variable And the point 14 in /etc/sysconfig/SuSEfirewall2 gets a fifth argument: The IP adress on that the firewall listen on the ext-interface, e.g. a www-server: FW_FORWARD_MASQ="0/0,192.168.13.130,tcp,80,80,<public IP adress on ext-interface>" Warning: With that parameter file u can't start the unpachted SuSEfirewall2 script because it controlls how many arguments are given. btw. of cource you must configure the public IP adress on the firewall-box (/etc/sysconfig/network ...)! I test this config but maybe there are some points I can't see with my config... Comments are welcome... Greetings Kai

1 0

sendmail with SMTP-Authentication for roaming users...
by Info 27 May '02

27 May '02

Hi! I´ve Suse 8.0, installed sendmail with TLS and Auth... this works fine... but my problem: I want to allow smtp-relaying only for authenticated users... (that have dynamic ip). I can´t find the right configuration or documentation to do this.... Can someone help me? another question: I where nice to have TLS on POP3 also... any suggestions about? greetings from vienna... André

3 2

Re: [suse-security] Securing SuSE Linux 7.3 (fwd)
by Markus Gaugusch 27 May '02

27 May '02

---------- Forwarded message ---------- Date: Thu, 23 May 2002 11:15:19 +0200 From: Albert Brandl <albert.brandl(a)lindeverlag.at> To: Markus Gaugusch <markus(a)gaugusch.at> Subject: Re: [suse-security] Securing SuSE Linux 7.3 On Tue, May 21, 2002 at 05:08:37PM +0200, Markus Gaugusch wrote: > > dd if=/dev/sda of=/dev/sdb bs=16M > You will have two problems with this: > Minor: Only data lost during the last week can be restored. If you delete > a file, go on holiday for two weeks and want to restore it later, > there is no chance. > Major: Changes in the filesystem during this "backup" will most likely > ruin your copy ... ! Another problem is that this setup does not protect you against most disasters. If e.g. your computer catches fire, chances are that your second harddisk does not survive this. If someone carries your computer away, he/she won't leave the second disk so that you can restore from it. It's thus a good idea to save backups offsite. It's also crucial to have more than one backup - "Unix Backup & Recovery" (W. Curtis Preston, O'Reilly 1999) gives a very good introduction to the subject. There are several open source products for backing up stuff. If you want to use cdroms, see e.g. http://mondo.soureforge.net. We are using AMANDA for backing up to DAT and DLT tapes. AMANDA is also included in the SuSE distribution, see http://www.amanda.org for an introduction (I've found the FAQ-o-matic quite helpful for configuring my system). Best regards, Albert

5 5

Spamming ...
by Martin Schichl 27 May '02

27 May '02

Morning! Since some days I get Returned Mails from unknown mail-users which seems that someone is spamming from our machine. But when i analyze the header of the original mail i fin a line: >> Received: from 210.97.42.1 (HELO scc.co.at) (210.97.42.1) << Although the IP of scc.co.at is 193.81.182.39 The IP 210.97.42.1 will change permanently when reading other similar mails. My questions: 1) Is it possible that someone beoke into our machine and sent this mail directly over scc.co.at 2) What can I do to stop those spammers ... ThanX Martin The header file of the original Message --------------------------------------------------------------- X-Track: 92154: 2 X-Rocket-Spam: 210.97.42.1 X-YahooFilteredBulk: 210.97.42.1 Return-Path: <rjnr3245i37(a)scc.co.at> Received: from 210.97.42.1 (HELO scc.co.at) (210.97.42.1) by mta514.mail.yahoo.com with SMTP; 28 Feb 2002 15:32:36 -0800 (PST) Reply-To: <rjnr3245i37(a)scc.co.at> Message-ID: <001a07e37abc$2777d8d5$6ce83be4@lplwmr> From: <rjnr3245i37(a)scc.co.at> To: <doctorbutcher(a)yahoo.com> --------------------------------------------------------------- ----------------------------------------------------------------- Dipl.-Ing. Martin Schichl SC&C Software, Communication & Consulting GmbH & Co KEG Grottenhofstr. 3, A-8053 Graz Tel. +43/(0)316/265-205, Fax +43/(0)316/265-234 mschichl(a)scc.co.at, http://scc.co.at

9 12

Install harden_suse
by oliver.z 27 May '02

27 May '02

Hey security team I am new in the Linux-world and would like to have some support in installing harden_suse. How I install it and with what switch-options? thnxs Oliver

2 1

Checking Firewall Log
by Majid Leo 26 May '02

26 May '02

How can I check the personal firewall log to see for the IP addresses been stopped? Thanks

1 0

Fast OnlineUpdate for SuSE - fou4s 0.5.0
by Markus Gaugusch 26 May '02

26 May '02

Fou4s is a replacement for YaST OnlineUpdate, with cronjob support and many more features. The new version is available at http://fou4s.gaugusch.at/ >From the changelog: * Fixes for 0.4.1: + UseFullPath installation fixed + Cleanup of packagelist directory fixed (missed some package descriptions) * Config file /etc/fou4s has been renamed to fou4s.conf * New options: --proxy, --noproxy * New option --all downloads all available updates (no checking) for network installations of fou4s). * New option --auto: Automatic installation of packages specified in config file. All other packages are only downloaded, like fou4s -ue. * Fou4s GPG key download moved from rpm installation to fou4s itself. There is also an entry at freshmeat.net, where you can subscribe for notifications about new versions of fou4s. Only major new versions are announced here. Usually an update version is released a few days after a major release, because of the large number of people finding bugs. Bugs and workarounds (if possible) are announced on the fou4s webpage. regards, Markus Gaugusch -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

1 0

Re: [suse-security] RE: Why the firewall on Suse8.0 blocks internal packets on externel port?
by charly123 25 May '02

25 May '02

Hallo Michael, yes, so it is, but I can't change the options of the client-software, it is written for external users of the IRC-Server. I need the program for log all traffic on the IRC and to look for someone, who want to talk to me as operator. So I need the variable to deaktivate the option "SuSE-FW-NO_ACCESS_INT->FWEXT ". In which configuration-file or script is it activatet? Best regards, Jost Schöler ____________________________________________________________________________ ________________ Die IRC-Client-Software soll eigentlich auf eine Adresse im Deinem Netzwerk zugreifen, geht jetzt aba über Deinen Router/Firewall auf eine externe IP. Dann ist es wohl eher 'ne Einstellungsfrage der Client-Software. Ciao Michael ____________________________________________________________________________ _____

5 4

mtr bandwidth
by Ricardo Javier Aranibar León 25 May '02

25 May '02

Hi list, I hope that somebody can help me. I work in enterprise about telecomunications (VoIP) and I need monitor our networks and verify that packets aren't lost. I installed mtr and I create my own scripts for execute whit my crontab every two minutes IP's 64 and every three minutes IP 209. I using five scripts diferents for each site. my scripts its: 1)mtr -rc 100 209.xxx.xxx.xxx >>209.txt 2)mtr -rc 100 64.xxx.xxx.1xx >>64-1.txt 3)mtr -rc 100 64.xxx.xxx.2xx >>64-2.txt 4)mtr -rc 100 64.xxx.xxx.3xx >>64-3.txt 5)mtr -rc 100 64.xxx.xxx.4xx >>64-4.txt But I don't know why in my switch ocuppy quite bandwidth? I need reduce that my tool monitor netword (mtr) the use of bandwidth. If somebody can help me I will thankfull. PD:Sorry for my grammar enghish I talk spanish but I understand Enghis :-) _________________________________________________________________ Envíe y reciba su correo de Hotmail desde el móvil: http://mobile.msn.com

1 0

Treason uncloacked
by Cosimo Longo 24 May '02

24 May '02

In log /var/log/firewall when appear May 22 07:43:36 linux kernel:[]: UDP: bad checksum. From 213.45.9.26:137 to 193.111.78.10:137 ulen 58 May 22 11:43:44 linux kernel:[]: TCP: Treason uncloaked! Peer 217.159.42.26:2249/80 shrinks window 486804554:486805020. Repaired. May 22 12:12:39 linux kernel:[]: eth0: Media Link Off May 22 12:13:09 linux kernel:[]: eth0: Media Link On 100mbps full-duplex May 22 18:19:23 linux kernel:[]: TCP: Treason uncloaked! Peer 217.159.15.253:1443/80 shrinks window 4048139603:4048140058. Repaired. May 22 18:19:23 linux kernel:[]: TCP: Treason uncloaked! Peer 217.159.15.253:1443/80 shrinks window 4048139603:4048140058. Repaired. May 23 03:07:50 linux kernel:[]: TCP: Treason uncloaked! Peer 217.159.15.253:2707/80 shrinks window 3193903114:3193903815. Repaired. May 23 03:31:43 linux kernel:[]: TCP: Treason uncloaked! Peer 217.159.15.253:3420/80 shrinks window 420693197:420693833. Repaired. May 23 03:46:30 linux kernel:[]: TCP: Treason uncloaked! Peer 217.159.15.253:3624/80 shrinks window 1357152501:1357152829. Repaired. the system crash an reboot. I ave activated syn_flood_protection but d'ont work. Please help my.

1 0

suse security list - another heaven for spam bots
by PW 23 May '02

23 May '02

Dear all, We are all grinding today under loads of spam. I was not among the amused as I received the first spam directed to my private E-mail address which, until today, was also my subscription address to the SuSE security list (it has not been published anywhere else). Apparently, a grave mistake. This list with all its messages is archived with the complete headers, mirrored and searchable throughout the net. That of course also attracts the dirty spam bots. In my opinion there should be at least one BIG warning in the subscription confirmation message alerting the user that this list is archived and his E-mail address therefore open to the entire public. I was not aware of this fact as I subscribed. Just a hint. Best regards, Philippe Wiede Megapublic [r], Inc. Gemsberg 11, 4051 Basel, Switzerland www.megapublic.com

11 12

iptables against nmap
by Andreas Wahlert 23 May '02

23 May '02

Hi list, i've testet SuSE 8.0 with iptables and squid. When i start many (7) nmap scans, options -sF sX sN sS sU, sychronously from another maschine against the public interface of the Squid and iptables firewall, the scanlogd service crashes and the squid is very slow. The users behind the Firewall don't see any Homepage in their browsers. All sites are unreachable. If the scans are stopped, everything works fine. Any ideas, what could happen? regards Andreas Wahlert

2 1

Re: [suse-security] Securing SuSE Linux 7.3
by Albert Brandl 23 May '02

23 May '02

On Thu, May 23, 2002 at 11:24:23AM +0200, Markus Gaugusch wrote: > There are several open source products for backing up stuff. If you want > to use cdroms, see e.g. http://mondo.soureforge.net. We are using AMANDA ^^^^^^^^^^^^^^^^^^^^^^^^^^^ this of course should read sourceforge, not sou_re_forge... Sorry, Albert

1 0

SuSE Personal and Firewall2
by Fred A. Miller 22 May '02

22 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I found it interesting that 2 "outside" scans of this box gave the SAME results with both firewalls. NEITHER put ports in "stealth" or "blocked" mode when services are NOT allowed, which they SHOULD, IMHO. Most are "closed." Fred - -- Fred A. Miller Systems Administrator Cornell Univ. Press Services fm(a)cupserv.org, www.cupserv.org - --- SuSE Linux v8.0 Pro--- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iEYEARECAAYFAjzsBscACgkQB9vk4ichYXcN8gCaAyvj8TW7Q8hb+K1wF6COSIh1 u1oAn0QgDzBIM1nTCxF5sc9a/r1t/vyR =e659 -----END PGP SIGNATURE-----

2 1

SuSE Security Announcement: dhcp/dhcp-server (SuSE-SA:2002:019)
by Thomas Biege 22 May '02

22 May '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: dhcp/dhcp-server Announcement-ID: SuSE-SA:2002:019 Date: Wednesday, May 22th 2002 13:30 MEST Affected products: 7.2, 7.3, 8.0 SuSE Linux Database Server SuSE eMail Server III SuSE Linux Enterprise Server for S/390 SuSE Linux Connectivity Server SuSE Linux Enterprise Server 7 Vulnerability Type: remote command execution Severity (1-10): 4 SuSE default package: no Other affected systems: all systems using ISC DHCP server 3.x Content of this advisory: 1) security vulnerability resolved: format string bug in dynamic DNS code problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The "Dynamic Host Configuration Protocol" (DHCP) server from the Internet Software Consortium allows hosts on a TCP/IP network to request and be assigned IP addresses, and also to discover information about the network to which they are attached. A remote exploitable format string vulnerability was found in the logging routines of the dynamic DNS code of dhcpd. This vulnerability allows an attacker, usually within the LAN served by the DHCP server, to get remote root access to the host running dhcpd. The dhcp/dhcp-server package is not installed by default nor is the dynamic DNS feature enabled by default. As temporary workaround the dynamic DNS feature could be disabled via dhcpd's config file with the following lines: ddns-update-style none; ddns-updates off; After updating the package or modifying the config file you have to run: rcdhcpd restart as root to restart all instances of running dhcpd processes. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. i386 Intel Platform: SuSE-8.0 ftp://ftp.suse.com/pub/suse/i386/update/8.0/n2/dhcp-server-3.0.1rc6-8.i386.… 754569c059f5f2c4f71397f6c6498f53 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/dhcp-3.0.1rc6-8.src.rpm 82ab4455ae86a932a746778ca0cf06f1 SuSE-7.3 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/dhcp-3.0rc12-47.i386.rpm 58bdf5e4e0622ba280fad0d649a36bdd source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/dhcp-3.0rc12-47.src.rpm 20abdc3bad4810971aa4cc959c133a9e SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/dhcp-3.0rc4-27.i386.rpm 826ffc2524ad6a6b3b746e3c5e0e5413 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/dhcp-3.0rc4-27.src.rpm 7bfd527698beef5a83e60577e7e02cfb Sparc Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n2/dhcp-3.0rc12-22.sparc.rpm 15ec49d27e7f8b61ec22616484e43996 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/dhcp-3.0rc12-22.src.rpm 1e3f0ee6da5684a49b31908f0e6ac9dd PPC Power PC Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/dhcp-3.0rc12-32.ppc.rpm 76914c072100dff6fdf781ed81f7afeb source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/dhcp-3.0rc12-32.src.rpm 9ac78f35a529c24315f11184555c7f81 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - tcpdump/libpcap Various security and non-security related bugs were found in the code of tcpdump and libpcap. New RPMs are currently being build. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQEVAwUBPOvMjXey5gA9JdPZAQF70Qf9EovJ5FK0nGSa9uMVcoCiCvhRwdfFSCBe HNx1LgX9Q+bHEo9dPjqYxyNxN4HTGwWMbVyix/lQ2CDUOzxf0gxp+30R1E++RUdC sOCXwiPTkrcuMhOhwq3j7D2YUoxkpXpK17Eq+ZxHB6Z89mJEFPrkVuSriLdl07a4 6xAEH3koek3QFi18IX6JAzaQtG5A8qPfFRdE6mBrNk3a0zWH9mBzUUeYw+a4gaF3 497vfBdu/cffxVqyLBCqZlnUM6gs9YzBpbDNz3T3uNqQ1cjhl91b92x0MFatqiEj Nn3lTXXPklob6S9JoaONvvw3diQ31F2gor+sZNTRv/6q9zNUv3IUdA== =KL4d -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege <thomas(a)suse.de> SuSE Linux AG,Deutschherrnstr. 15-19,90429 Nuernberg Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/contact/thomas.asc | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 83 -- Trete durch die Form ein, und trete aus der Form heraus.

1 0

Securing SuSE Linux 7.3
by Thomas Föcking 22 May '02

22 May '02

Hello! It's my duty to set up an internet server with SuSE Linux 7.3. I want to ensure that it is as secure as possible. First thing was of course thinking of not to use SuSE Linux but instead install a little Linux From Scratch system (www.linuxfromscratch.org) with only a few files really needed to run a webserver. But then I am be sure if ColdFusion and some other applications/programs/modules would run correctly. So the decision was SuSE Linux 7.3 for x86. Dual PIII 1,13GHz, 1GB ECC SD-RAM, 2x 17GB SCSI ... First I installed 7.3 minimal (but I took around 200MB space, a lot for a minimal installation I think) + ProFTP, Sendmail, MySQL, Apache, PHP, Perl, SuSE Firewall2, harden_suse. What I did to secure the system: 1. run harden_suse with all options enabled. 2. compiled new kernel 2.4.18 with LIDS (lids.org) support. 3. secured all directories readonly except /dev, /var, /tmp, /proc 4. denied files like /etc/shadow except for su, login, proftp, sshd readonly 5. secured .bash_history, /var/log/firewall, /var/log/messages as append only 6. disabled capabilities like mknod, rawio ... And to keep track of what is going on: 1. weekly mail with all important logfiles 2. lids provides a port scan detector and to send a mail to me, if something is goning wrong in the system. Is this enough to avoid crackers to change my system? I know, that nothing is nearly 100% secure, but I think if no one (root included) can change system files it should be quite secure also if some breaks into the system and gets root privileges. I think If I'll always install the newest SuSE security updates the system would be only a few days unsaved. If then someone would break into, s/he could not damage that much, I hope. Best regards, Thomas

3 3

Re: [suse-security] Securing SuSE Linux 7.3
by Markus Gaugusch 22 May '02

22 May '02

On May 21, Thomas Föcking <thomas(a)foecking.de> wrote: > Once a week this simply script is ran: > (only this script has cap_sys_rawio and write access on /dev/sdb) > dd if=/dev/sda of=/dev/sdb bs=16M You will have two problems with this: Minor: Only data lost during the last week can be restored. If you delete a file, go on holiday for two weeks and want to restore it later, there is no chance. Major: Changes in the filesystem during this "backup" will most likely ruin your copy ... ! > > You also didn't tell us, which services you are offering. Web only? User > > authentication? SMTP/POP/IMAP? ... > > Every service that is used to authenticate users should use encryption > > (SSL/TLS). > World: > ftp, ssh, http, https Anonymous ftp only, hopefully? Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

3 2

iptables firewall
by Patrik Breitenmoser 22 May '02

22 May '02

Hi all, I need a little help from you guys. Does someone have a dedicatet internetserver and is running a iptables based firewall? regars Patrik Breitenmoser

4 3

Hardensuse and Suse 8.0
by oliver.z 22 May '02

22 May '02

Hey there Has anybody installed hardensuse on suse 8.0? Has anybody seen problems/bugs with that? To the installation of hardensuse: When I unpacked the harden_suse-3.5.tar.gz, there was one file with ending pl. Means that this is a perl script and I have only the do "perl harden-suse-3.5.pl" ? Any other options? thanks in advance Oliver

1 0

Protecting my password in ftp perl module
by Francesc Dantí 21 May '02

21 May '02

Hi all! I've used ftp-module (Net::FTP) in a perl-script that permits me to do a ftp to a remote server automaticly. My idea is that when I starts my linux server, it modifies some remote pages (on other server...) and when I halt my server, it restore the original files on the remote server. (I use rc.d directories) It runs correctly :), but there is a problem: I've to write my login and password in plain text in the script (*as shown below). I know that i can read-protect the script, but i doesn't like to have my password in plain text. Is there any manner to encrypt it, as linux do in passwd files? Or any other module that permits me to do the same with encrypted password? Thanks in advance! p.s. I can't use ssh in the remote server, it only runs ftp! ____________________________________________________ *SOME SCRIPT LINES use Net::FTP $ftp = Net::FTP->new("remote_server", Debug => 0); $ftp->login("LOGIN",'PASSWORD); $ftp-> MY COMMANDS ____________________________________________________

3 2

Firewall2 question
by Geordon VanTassle 21 May '02

21 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hello , I'm trying to set up my firewall as my primary POP and SMTP box (VERY small LAN). On my internal server box (192.168.1.2) I have sent mail to my username@domain but got the following in my firewall log. Can someone help me figure out how to tell the firewall to allow this connection? In a similar vein, can someone suggest how to tell my firewall to redirect requests from inside to the masqueraded/port-forwarded location? Thanks May 20 16:09:50 gvantass kernel: SuSE-FW-NO_ACCESS_INT->FWEXT IN=eth1 OUT= MAC=00:a0:c9:1e:9d:73:00:60:08:93:a8:a1:08:00 SRC=192.168.1.2 DST=XXX.XXX.XXX.XXX LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=61923 DF PROTO=TCP SPT=41027 DPT=25 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A037C30320000000001030300) - -- Best regards, Geordon mailto:gvantass@interaccess.com PGP Key ID: 0xFCF06B79 Your Fortune ==> "He who can, does. He who cannot, teaches." (George Bernard Shaw) ��h�� -----BEGIN PGP SIGNATURE----- Version: PGP 6.5i iQEVAwUBPOlu0t77fDX88Gt5AQELGAf+MCairRjPsNGJM7n4LmoIaAA4SPB4tili l/hV6QtFU0tx7bPrFOShT3Dcg4I/wTv0QH0iCQMfdgkDlARRrzMFGWqZUw3cSGQp 5OWUHmJ+W4cG+cfZbySqRRZche6Kw0f5VJyJ2d2CjLdCvhn6R6iDrs0Cmu8bZbPN uIgQ8/UdVZ7hHxlLQSuHEPhzO45cHV48G+dp/HThuopqeJuKRvW62Aaib6DVZw79 SHHYbg2d9/WK/JxQq8yvdW5CoE52PFxG2NFZy5qKdZ5ZlV0p7dKRaAvXQK8rPE51 DImVEYKiiOdwZkADUrpHfKrUuqW9ZZw8ap25yX20yhWT/RfnMyz5EQ== =IQ0H -----END PGP SIGNATURE-----

3 2

AMaViS
by Fred A. Miller 21 May '02

21 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Anyone been using AMaViS (virus scanning)? If so, how well does it work? Thanks, Fred - -- Fred A. Miller Systems Administrator Cornell Univ. Press Services fm(a)cupserv.org, www.cupserv.org - --- SuSE Linux v8.0 Pro--- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAjzpCW4ACgkQB9vk4ichYXf8awCghDTRrlxr2+grnLW3+9PC8ktv 0IkAoKKbQ6ZeLmrBOVJyui+86CJPAFO7 =aY8e -----END PGP SIGNATURE-----

8 7

Re: [suse-security] striped binaries
by Bill.Light＠kp.org 21 May '02

21 May '02

Yeah - like I'm going to open the attachment. "Theo v. Werkhoven" <twe-suse-sec(a)ferrets4me.xs4all.nl> 05/20/02 02:22 PM To: suse-security(a)suse.com cc: Subject: Re: [suse-security] striped binaries ------ Attachment(s) have been removed ------

4 4

RE: [suse-security] suse security list - another heaven for spam bots
by VANTASSLE, GEORDON M (AIT) 21 May '02

21 May '02

Sounds like it's time to install Spam Assassin! -----Original Message----- From: PW [mailto:subscribed@megapublic.com] Sent: Tuesday, May 21, 2002 12:26 PM To: suse-security(a)suse.com Subject: [suse-security] suse security list - another heaven for spam bots Dear all, We are all grinding today under loads of spam. I was not among the amused as I received the first spam directed to my private E-mail address which, until today, was also my subscription address to the SuSE security list (it has not been published anywhere else). Apparently, a grave mistake. This list with all its messages is archived with the complete headers, mirrored and searchable throughout the net. That of course also attracts the dirty spam bots. In my opinion there should be at least one BIG warning in the subscription confirmation message alerting the user that this list is archived and his E-mail address therefore open to the entire public. I was not aware of this fact as I subscribed. Just a hint. Best regards, Philippe Wiede Megapublic [r], Inc. Gemsberg 11, 4051 Basel, Switzerland www.megapublic.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] Securing SuSE Linux 7.3
by Peer Stefan 21 May '02

21 May '02

hi, > From: Thomas Föcking [mailto:suse@thomas-foecking.de] > Hello! > <SNIP/> > Is this enough to avoid crackers to change my system? I know, > that nothing is > nearly 100% secure, but I think if no one (root included) can > change system > files it should be quite secure also if some breaks into the > system and gets root privileges. a very neat peace of software to keep track of the files is tripwire (md5-sums of all your files) to check which files have been changed since the last checksum. also netfilters like iptables should add to your security. > I think If I'll always install the newest SuSE security > updates the system > would be only a few days unsaved. If then someone would break > into, s/he > could not damage that much, I hope. if someone breaks into your system and adds an account with root-privileges or installs a backdoor or makes sure he/she will be able to enter the system anytime, there is much damage. regards, stefan

2 1

scp withput password
by Dirk Breuer 21 May '02

21 May '02

Hello, I want to use ssh (especially scp and sftp) without being asked for passwords. Can somebody give me a detailed configuration guide: ssh-agent,.. which files must be changed (authorized_keys, ssh_config, ...) . Can sftp and scp handle with x.509 certificates and how can I configure this? Thanks, Dirk Breuer -- Dirk Breuer Forschungszentrum Juelich GmbH e-mail: d.breuer(a)fz-juelich.de ZAM Tel.: +49-(0)2461-61-3628 D-52425 Juelich Germany

2 1

AMaViS
by Achim Lenz 21 May '02

21 May '02

""Anyone been using AMaViS (virus scanning)? If so, how well does it work?""" i don`t know about amavis. so i use "Trend Micro Interscan Virus Wall". and it works fine! the "Virus Wall" scan port-based "smtp-ftp-and http". look at the page from Trend Micro: http://www.antivirus.com/download/register.asp?product_id=36&product_from=is vw after install. you can test it, how it works. look at: http://www.antivirus.com/vinfo/testfiles/ mfg achimAchim Lenz L+L Lieferservice und Logistik GmbH Rheinstraße 10 53560 Vettelschoß Fon: 02645-942-776 Fax: 02645-942-766

2 1

striped binaries
by d_lord＠gmx.de 20 May '02

20 May '02

Hi @ all I' ve got a little question concerning the strip program. My server is not really fast and has very little RAM so I would like to strip some or all binaries. I tested it with ntop so far and it is working quite well as you can see. user@server /test# ll ntop ntop.orig -rwx------- 1 user nobody 18368 May 20 02:29 ntop <-- stripped -rwx------- 1 user nobody 140571 May 20 02:07 ntop.orig user@server /test# I would also like to do this with sshd and some other services my system provides. So now my question is: Does this (stripping a binary) affect security in any way? I think of bufferoverflows etc. Some important information may be lost if I have only 1/10 size. Right or wrong? Thanks for your time and opinion ;-) D. Lord PS.: What does this mailinglist check to verify the email? I can't use my own postfix server even if I specify the right From: adress in mutt. And it's really annoying to go to gmx just to post something to this list! Any hint? -- -- Life is too short to find the easiest way through. Just go straight forward! GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

4 3

Re: [suse-security] AMaViS
by Carlos Campos 20 May '02

20 May '02

Sorry, I have got confused. I thought I was on my spanish list. I said that I used amavis with Mcafee uvscan and It didn't work well. It stop a lot of viruses but when the infected mail traffic was to heavy it, let some viruses pass. Then I try with MailScanner it seems to work better than amavis, but It has just two days working. Good Luck! Carlos ----- Original Message ----- From: Carlos Campos To: suse-security Sent: Monday, May 20, 2002 2:04 PM Subject: Re: [suse-security] AMaViS Yo lo he probado con un sendmail usando McAfee comom antivirus, y no he tenido muy buenos resultados. Funciona, pero cuando el trafico de mails infectados es muy grande deja pasar algunos. Recientemente he probado el MailScanner tambien con McAfee y parece un poco mas robusto. Solo funciona con SendMail y la configuracion no es muy dificil. Suerte Carlos ----- Original Message ----- From: Chad Whitten To: Fred A. Miller ; suse-security Sent: Monday, May 20, 2002 9:59 AM Subject: Re: [suse-security] AMaViS I have just installed RAV antivirus software for sendmail. It is working great. I tried getting amavis working with antivir but just couldnt get enough documentation to get it working. rav antivirus was a snap though and using sendmail's libmilter interface there is almost zero performance loss. http://www.raeinternet.com On Monday 20 May 2002 09:34 am, Fred A. Miller wrote: > Anyone been using AMaViS (virus scanning)? If so, how well does it work? > > Thanks, > > Fred -- Chad Whitten Network/Systems Administrator neXband Communications cwhitten(a)nexband.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Connection from sourceforge after mailing to list
by GertJan Spoelman 20 May '02

20 May '02

Hello list, Does anyone know why sourceforge is doing this everytime I send something to this list? May 17 19:29:13 mail sendmail[576]: NOQUEUE: connect from usw-sf-fw2.sourceforge.net [216.136.171.252] May 17 19:29:13 mail sendmail[576]: g4HHTDY00576: --> 220 mail.gjs.cc ESMTP Sendmail 8.11.3/8.11.3/SuSE Linux 8.11.1-0.5; Fri, 17 May 2002 19:29:13 +0200 May 17 19:29:13 mail sendmail[576]: g4HHTDY00576: <-- HELO usw-sf-list1.sourceforge.net May 17 19:29:13 mail sendmail[576]: g4HHTDY00576: --> 250 mail.gjs.cc Hello usw-sf-fw2.sourceforge.net [216.136.171.252], pleased to meet you May 17 19:29:13 mail sendmail[576]: g4HHTDY00576: <-- MAIL FROM:<> May 17 19:29:13 mail sendmail[577]: g4HHTDY00577: --> 250 2.1.0 <>... Sender ok May 17 19:29:13 mail sendmail[577]: g4HHTDY00577: <-- RCPT TO:<sl(a)gjs.cc> May 17 19:29:13 mail sendmail[577]: g4HHTDY00577: --> 250 2.1.5 <sl(a)gjs.cc>... Recipient ok May 17 19:29:13 mail sendmail[577]: g4HHTDY00577: <-- RSET May 17 19:29:13 mail sendmail[577]: g4HHTDY00577: --> 250 2.0.0 Reset state May 17 19:29:13 mail sendmail[577]: g4HHTDY00577: from=<>, size=0, class=0, nrcpts=1, proto=SMTP, daemon=MTA, relay=usw-sf-fw2.sourceforge.net [216.136.171.252] May 17 19:29:14 mail sendmail[576]: g4HHTDY00576: <-- MAIL FROM:<> May 17 19:29:14 mail sendmail[578]: g4HHTEY00578: --> 250 2.1.0 <>... Sender ok May 17 19:29:14 mail sendmail[578]: g4HHTEY00578: <-- RCPT TO:<postmaster(a)gjs.cc> May 17 19:29:14 mail sendmail[578]: g4HHTEY00578: --> 250 2.1.5 <postmaster(a)gjs.cc>... Recipient ok May 17 19:29:14 mail sendmail[578]: g4HHTEY00578: <-- QUIT May 17 19:29:14 mail sendmail[578]: g4HHTEY00578: --> 221 2.0.0 mail.gjs.cc closing connection May 17 19:29:14 mail sendmail[578]: g4HHTEY00578: from=<>, size=0, class=0, nrcpts=1, proto=SMTP, daemon=MTA, relay=usw-sf-fw2.sourceforge.net [216.136.171.252] -- GertJan

7 10

fou4s - Fast OnlineUpdate for SuSE 0.4.0
by Markus Gaugusch 20 May '02

20 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The next version of fou4s is out! - From the changelog: * Fixes for 0.3.0: + Environment variable LANG is unset, because GPG sig check fails with non-english environment + Check if /etc/suseservers exists * New options: --buildtime, --force, --fullpath, --version * New config file options: CheckFou4s, UseFullPath, DefaultVerbosity, ProxyUser, ProxyPasswd, Interactive, PatchesCont, Benchmark, RemoveAfterInstall * Downloaded files can now be placed in subdirectories (a1, n1, ...) * The -f option supports more than one RPM now (if used as last option) * Less messages with verbosity level 1 (-v), to see update info from cronjobs * Update descriptions are formatted now for better readability * New option handling with getopt, supporting now "-ab" in addition to "-a -b" * Options -u and -e/-i are allowed together now (package list update and check/installation in one step) MD5sums: d6640f65a348ca3411fa9872075a2e47 fou4s-0.4.0.tar.bz2 6add4bc11149281074e00d01766f1063 fou4s-0.4.0-8.noarch.rpm Users of the --checkfou4s option will be notified about the new version automatically during the next run of fou4s. regards, Markus Gaugusch - -- _____________________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign fou4s(a)gaugusch.at X Against HTML Mail / \ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE86L89DqGTK6+2bXwRAoUlAKDP46vxTWBNEFxaFt8pQylHATqBGwCffLZX B/UuYxGbVMaN1tExFNzV2Qg= =qyKH -----END PGP SIGNATURE-----

1 0

Sendmail out-of-box secure enough?
by Pep Serrano 20 May '02

20 May '02

Hello list, Here is a question perhaps a little naive :-) I am not sendmail expert at all and I do wonder... Is sendmail in SuSE Linux out-of-thebox secure enough for a with permanent connection to inet? I mean just setting the configuration "Host with permanent network connection" in Yast2... In case it is not (I guess) what minimal config do you propose to run a sendmail to just deliver emails from localhost to inet and to allow receiving only emails for its own domain? Any good recommendations? Cheers Pep Serrano.

13 19

Firewall2 config
by Luis Oliveira 19 May '02

19 May '02

Hi, I want to activate the firewall in Suse 8.0 Pro. I use my laptop at work and home. I have just one ethernet interface eth0. At home I have a ADSL connection (modem connected to a linksys router that functions also as a 4 port switch to my home network). IP address is given in both situations (home and office) by dhcp server. What should I configure as internal and external interface in yast2 - security - firewall ? I just want to enable ssh service on my machine. Thanks ./ luis oliveira

2 1

SuSE 7.3 on sparc and ip portforwarding
by Alexander Topolanek 19 May '02

19 May '02

Hi, Not shure to which list this question belongs, so I'm sending to both... I'm running a 7.3 on a sparc, which is used as an ADSL-router - I'm using a 2.2 Kernel and SuSEfirewall, and the I tried to setup some ip portforwarding. SuSEfirewall now tells me "I need /usr/sbin/ipmasqadm for running but can not find it, aborting." Did't find any rpm for that... Funny enough, on my intel box (with 7.3 & 2.4.x) it's there, but binary. Is that tool somewhere hidden in another rpm? Or should I get the sources and build it? Best regards Alexander

1 0

Re: ezmlm response
by Aaron Flores 17 May '02

17 May '02

--------------------------------- Do You Yahoo!? La emoción e intensidad del deporte enYahoo! Deportes.

1 0

RE: [suse-security] Ok, I Give...
by Peer Stefan 17 May '02

17 May '02

hi, > From: Gary Counsellor [mailto:sineigs@eskimo.com] > > I have been seeing this since I started SFW2 and conect via ppp. > Not sure why it's there, tried looking for clues as to why, > who but found nothing meaningful. Figured it might be me and my > isp (Well, I gotta think of something) this is most likely your isp, because 224.0.0.1 is the address for IGMP, a multicast routing protocol. have a look at /etc/rc.config.d/firewall2-custom.rc.config, line 26 onward: #example: allow incoming multicast packets for any routing protocol iptables -A INPUT -j ACCEPT -d 224.0.0.0/24 it's nothing to worry about, if you don't have routing protocols enabled. > Usually I just copy error messages into google and find what > I need to know but that didn't work this time. > Any suggestions? I'd be happy just to stop seeing it reported > but stopping it entirely, if feasible, would be cool also. > > SuSE-FW-UNAUTHORIZED-TARGET IN=ppp0 OUT= MAC= SRC=209.244.43.100 > DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=24643 PROTO=2 i asked google about DST=224.0.0.1 and got this link (first page): http://lists.debian.org/debian-firewall/2001/debian-firewall-200108/msg00056 .html > > Thanks for the help, you're welcome :) > -- > Gary Counsellor > http://www.musician2000.com > sineigs.all.attitudes(a)eskimo.com > Please remove .all.attitudes before replying regards, stefan

5 6

FTP-Proxy
by Michael Appeldorn 17 May '02

17 May '02

Hi list to increase to security i've installed suse-ftp-proxy to not directly contact the internet with the clients. but now all ftp-session ends up the ftp-server on the firewall and wont get transparent routed Thx for all proposals in advance Michael Appeldorn The config file [-Global-] User ftp ServerType standalone LogDestination daemon DestinationTransferMode passive PortResetsPasv yes Listen 192.168.11.11 # may be needed in NAT'ed/Masqueraded environments #TranslatedAddress 0.0.0.0 UseMagicChar % AllowMagicUser yes AllowTransProxy yes

2 1

RE: [suse-security] NTP über Firewall
by adkorte 17 May '02

17 May '02

>===== Original Message From "Reckhard, Tobias" >That's seems strange to me, ntpdate should fail, saying that it can't >find any suitable servers for synchronisation. It should not segfault. That was the behaviour in SuSE 7.3. After an upgrade to SuSE 8.0 I also see the reported behaviour. If ntpdate cannot connect to my (local) ntp server (because it is taken offline), it crashes on a segfault. Not a very nice way to terminate... Regards, Arjen

1 0

What can i do if someone tries to exploit me?
by Martin Gudel 17 May '02

17 May '02

Hi all, following almost all security relevant problems, one of my machines got exploited last week. After i fixed this hole, my firewall now repeated the same trials from the same source on other machines which are already protected against this attack. The person on the other side retries and retries. It's a uk-source, I'm in Germany. What can I do?- Is there any "global police department" for this? Thanks for help Martin

3 2

No FW
by Florian Winger 17 May '02

17 May '02

Hi everybody, I want a absolutly open system, cause it is not connected to the internet only in my LAN. I´m using SuSE 8.0 and have already removed SUSEfirewall2, personal-firewall, yast2-config-firewall and yast2-trans-firewall packages with yast2. Is there anything more to do? thank a lot!! Flo -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

Problem with harden_suse
by Ricardo Javier Aranibar León 17 May '02

17 May '02

Hi my friends, I read that if I like a server secure I need install harden_suse. Yesterday I installed harden_suse-3.5-0.noarch.rpm, in my server I have Apache, my database in Postgresql, my scripts cron and my OS is SuSE 7.3 and kernel 2.4.4-4GB but now I have two problems: 1.- I restarted my machine and my services apache and postgres didn't to initialize I have to write as a root:rcpostgres start and rcapache start this method it's slow my work, I need information about a command that initialize my services, chkconfig didn't function if someone can to provide me about a command equal chkconfig I will thankfull. 2.- Before, that I installed harden_suse I worded fine with PostgreSQL I connected as user postgres with: #su - postgres and execute #psql hb and I entered to my Data base, but after that I installed harden_suse I can't connect as user postgres when I writted: su - postgres in my pront didn't show me postgres:~# I don't know what happend,maybe I executed postmaster and I have this message: "root execution of PostgreSQL backend is not permitted. The backend must be started under its own userid to prevent a possible system security comprise. See the Install file for more information on how properly start the postmaster". I try to execute as root: #psql hb I have this message:"psql: FATAL 1 :SetUserId: user "root" is not in pg_shadow". Before, I dind't have this problems I think that harden_suse cause this errors if someone can help me I will be thankfull, because I didn't enter to my database and this is important for me. Please help me Thansks :-( _________________________________________________________________ Descargue GRATUITAMENTE MSN Explorer en http://explorer.yupimsn.com/intl.asp.

5 4

multiple NAT
by Omppu 17 May '02

17 May '02

Hello i am sick and tired of intervally changing operators and ip addresses for my production environment... ive known for a long time that i can do NAT but i am a little bit worried on the load it would cause on the firewall and then again how efficient and easy to maintain it would be. i have a half a C class of Public IP addresses of which about 70 are very active, at best the bandwidth continuous capacity consumption reaches up to 800kb/sec now i have SuSE 7.3 with the latest patches (kernel is the default that comes with the installation) and i intent to use SuSEFirewall 2 on a dual pentium 450mhz with 128mb ram now the question is how can i do so that i have about 40 servers with private addresses in the inside with all sorts of services starting from ftp, telnet, ssh, dns, pop, smtp, imap, stream, http, sms, terminal services, pptp, etc etc how can i configure about 128 IP addresses with NAT to private internal addresses to all ports and port restrictions and what is the most feasible setup regards O.

5 5

Re: [suse-security] NTP über Firewall
by Comptek informatik AG - R. Klippel 17 May '02

17 May '02

At 10:22 17.05.2002 +0200, Michael Seewald wrote: >On Fri, 17 May 2002, Wilfried Philippi wrote: > > ich möchte mit xntp über die Firewall auf meinem Server die Zeit updaten. > > > Kann mir jemand sagen wo mein Fehler liegt und ob ich evtl ausser Port > 37 noch > > einen anderen Port brauche. > >If I remember correctly, you need >FW_SERVICES_EXT_UDP="ntp" > >Regards, >Michael > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here Hi, probier mal folgendes in der Konsole oder auch in einem Xterm Fenster # ntpdate -s -u <timeserver.tld> Die beiden Parameter sind meines Wissens für das Überwinden der Firewall notwendig. Mit freundlichen Grüssen Comptek informatik AG Reinhardt Klippel ________________________________ Comptek informatik AG Poststrasse 9 CH-6300 Zug Tel. ++41 +41 720 20 90 Fax ++41 +41 720 20 99 http://www.comptek.ch ________________________________

1 0

RE: [suse-security] NTP über Firewall
by Reckhard, Tobias 17 May '02

17 May '02

Note that this is an english-speaking list. > ich möchte mit xntp über die Firewall auf meinem Server die > Zeit updaten. It's usually also a good idea to have firewalls synchronised to global time as well. > Wenn ich die Firewall abschalte ( alle chains geflusht ) > läuft nntpdate ganz > normal Mit eingeschalteter Firewall meldet mir ntpdate > Segmentation Errors und > bricht ab. That's seems strange to me, ntpdate should fail, saying that it can't find any suitable servers for synchronisation. It should not segfault. > Meine Firewall regeln sind: > /sbin/iptables -A OUTPUT -o eth1 -m tcp -p tcp -s $SELF > --dport 37 -j ACCEPT # > ntp > /sbin/iptables -A INPUT -i eth1 -m tcp -p tcp -d $SELF > --sport 37 -j ACCEPT # > ntp > Kann mir jemand sagen wo mein Fehler liegt und ob ich evtl > ausser Port 37 noch > einen anderen Port brauche. You definitely need further rules for NTP. NTP servers listen only on UDP port 123 (no TCP is used, further clarifying what Roman already said). (x)ntpd uses UDP 123 as its source port as well, while ntpdate allocates a high port (i.e. one above 1023) as its query source port. Tobias

1 0

SMTP and POP3 Proxy
by Fiorenza Meini 17 May '02

17 May '02

Hi there! Does anyone know about a SMTP proxy and a POP3 proxy? I'm configuring a firewall and I'd like to use proxy for WWW, FTP, SMTP and POP3; so I'm using squid, ftp proxy from SUSE proxy suite and....I can't find anything for SMTP and POP3. Thanks Fiorenza

4 4

RE: [suse-security] multiple NAT
by Reckhard, Tobias 17 May '02

17 May '02

> now i have SuSE 7.3 with the latest patches (kernel is the > default that comes with the installation) Isn't that one susceptible to the SYN-Cookie vulnerability? If so, you might want to deactivate them. > and i intent to use SuSEFirewall 2 on a dual pentium 450mhz > with 128mb ram Does anyone know if the Linux kernel or, more specifically, netfilter actually benefits from a multi-processor box? I wouldn't expect it to, but I haven't looked at the code (nor am I a coder of any worth). > now the question is how can i do so that i have about 40 > servers with private addresses in the inside > > with all sorts of services starting from ftp, telnet, ssh, > dns, pop, smtp, imap, stream, http, sms, terminal services, > pptp, etc etc > > how can i configure about 128 IP addresses with NAT to > private internal addresses to all ports and port restrictions > > and what is the most feasible setup Well, you're out for opinions, so here's mine. I try to avoid NAT where I can. IMHO, it makes things easy in the short term when prior planning of IP layout was short-sighted and has failed and IP system administration is bad as well and the cost of modifications is high. It doesn't solve the problems but only reduces the impact of the symptoms. However, NAT is complicated and confusing, and thereby tends to turn into an administrative nightmare of its own after a while. Add to that the problems that numerous protocols have with NAT and which force you to use helper applications (the kernel nat modules) that I have rather bad feelings about in general concerning their security, and which quite often don't get the protocol working as (well as) it would without NAT. NAT is fine in small scenarios, where the cost of official IP addresses matters (this means all you home users), where you can't use proxies instead or where substantial cost can be avoided by introducing it (such as connecting a couple of networks of two administratively independent organisations, but that's quite a can of beans in and of itself, security-wise). Tobias

1 0

RE: [suse-security] proftpd and exe uploads
by Peer Stefan 17 May '02

17 May '02

hi > From: Carlos [mailto:linux@lpis.com] > For securiy reasons i want to deny, in my suse proftpd > server, the *.exe > files uploads. > is this posible? > can anybody says me how? PathDenyFilter "\.exe$" should do the trick. > thanks you're welcome ;) stefan

1 0

RE: [suse-security] SMTP and POP3 Proxy
by Peer Stefan 17 May '02

17 May '02

From: Hipolito A. Gonzalez M. [mailto:hgonzale@cantv.net] > Remember, the defintion of Proxy is only for HTTP, FTP and GOPHEr, if > you need access to other protocol, like POP, SMTP, DNS, etc > etc you must > have Ip Masq/NAT .... or an application gateway. for mail you can use fetchmail (pop) and any mta, which works as relay-agent. just be carefull in setting up relaying. regards, stefan

1 0

Auto Online Update!?!
by mario ohnewald 17 May '02

17 May '02

Hallo! Can suse do a Auto online update automatically, lets say every day or something? If yes, where is the option, or how do i do that then? ;) Cheers Mario

2 1

RE: [suse-security] SMTP and POP3 Proxy
by Reckhard, Tobias 17 May '02

17 May '02

> Remember, the defintion of Proxy is only for HTTP, FTP and GOPHEr, if > you need access to other protocol, like POP, SMTP, DNS, etc > etc you must > have Ip Masq/NAT Huh?! No way, dude, you're way out on this one. A proxy server is a broker between client and server, acting as a server towards the client and issuing its requests to the server, thereby acting as a client there. It's a concept and in no way restricted to certain application protocols based on TCP/IP. However, some protocols make it easier to use proxies than others. NAT is an entirely different concept. Tobias

1 0

RE: [suse-security] how to open ports
by Reckhard, Tobias 17 May '02

17 May '02

Re Flo, [snip] > conferences. I´m able to connect to this server, but there´s > no transmition > of sound and video. So I scan with nmap -p 1-65535 > [localhost] and look there > only the lisenport 1720 is open. All other ports which should > be open are > closed. Is there any possibilty to open the ports by hand? I [snip] It is perfectly normal for you to see only port 1720 open, since that's where the H.323 server is listening for incoming calls. The additional connections are only established later on, after they have been negotiated on the 'incoming call' connection. As such, you won't see any other ports as open, because there's no process listening on them. This is absolutely OK. See if you can increase the volume of output on your H.323 client and server and check what they say when you try to setup an H.323 session. And perhaps sniffing the network traffic will provide some insights as well. Tobias

1 0

Strange Web Behavior
by Austin Morgan 16 May '02

16 May '02

I am using an gateway on my network with NAT and firewall. Everything seems to work fine, but I am not able to connect to google.com. This is very strange because for the past 1 1/2 years I have been using this system I have not had a problem with it. I discovered that if I ssh into the firewall and use lynx that I can access google and run searches, but none of the computers behind the firewall can. There are no logs saying that the firewall is droping anything and the DNS reports an accurate ip address. Does anyone have any suggestions as to what might be happening? -- __ __ ____ ____ | \/ |/ ___/ ___| Austin Morgan | |\/| | | \___ \ Morgan Computer Services | | | | |___ ___) | 479-857-1189 |_| |_|\____|____/ www.morgancomputers.net

8 9

AW: AW: [suse-security] password not accepted
by mailinglists＠belfin.ch 16 May '02

16 May '02

Hi Andrés, +OK ready <21962.1021586037(a)pop.domain.ch> user test +OK Password required for test. pass Ct%I6+X -ERR [AUTH] Password supplied for "test" is incorrect. as you can see, it didn't work. Thanks, Philipp -----Originalnachricht----- Von: Andrés A. Nogueiras Meléndez An: 'suse-security(a)suse.com' Gesendet: 16.05.02 10:16 Betreff: Re: AW: [suse-security] password not accepted Raymond Leach wrote: > 02/05/16 9:37:20, mailinglists(a)belfin.ch wrote: > >>HI MIkkel >> >>there is NO spelling error. I tested it 10 times, even with direct use of >>pop3 commands and set local_echo on win2k telnet client. >>The UID of the users is 500+. So no mistake there either. >> > Maybe something is getting screwed up in the telnet translation of the % character ? > I bet too that this is happening. Some telnet/ftp/http conection use %20 as white space and %16 looks like an ASCII control char. In the other hand, I can tell that this kind of behaviour is strange, because I used to have a password with char "%" inside and nothing strange happened, maybe because the previously and next char where simple alphabetical characters, not numbers. Can you try with something like Ct%I6+X ( an uppercase i in place of the one digit ) and tell us in the list ? TIA -- [---------------------------------------------------------------] [ Prof. Andres Augusto Nogueiras Melendez ] [ Departamento de Tecnologia Electronica - Universidad de Vigo ] [ Campus Lagoas Marcosende, 9 http://www.dte.uvigo.es ] [ 36280 - Vigo, Pontevedra mailto:aaugusto@uvigo.es ] [ Spain tel: +34 986 812 091 fax: +34 986 469 547 ] [---------------------------------------------------------------] -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Linux Security theory/practice
by Ryan Swenson 16 May '02

16 May '02

> -----Original Message----- > From: Ryan Swenson > Sent: Wednesday, May 15, 2002 11:15 AM > To: 'suse-security(a)suse.com' > Subject: Linux Security theory/practice > > Hello, > > 1. Is it possible to take 2x kernel 2.4.18 systems with bridging, and = > the firewall bridge patch compiled in and setup transparent bridging = > along with iptable Forwarding permit or deny rules; Where we join both = > interfaces of the bridge and configure static addresses on the bridged = > ID interface, is it possible to now configure OSPF or BGP to provide = > failover among 2 Linux Bridge Peer devices? In short you take two = > switches and put in between them 2 transparent linux bridge firewalls = > which will both have unique bridge ip addresses: should 1 of these = > systems or interfaces fail, then the other will fail into a BGP = > secondary until the primary is reinstated? Any enhanced dynamic = > protocol should be fine and the only metric really concern is the weight = > of each peer and perhaps a few iptable rules to limit the size of tables = > for CPU/memory benefits as well.=20 > > If not with BGP or OSPF: with pirannha can serial/loadbalancing be = > applied to the situation or interfaces of this kind of setup where = > regardless of which device is up it must forward packets and extend the = > medium for which traffic is within the same broadcasts domains?=20 > > In theory or practice? > > > Regards/Gruesse, > > Ryan S.

3 2

Re: [suse-security] Suse Firewall Warranty
by Steve 16 May '02

16 May '02

On Thursday 16 May 2002 02:27 pm, you wrote: >* Steve (steve(a)videogroup.com) [020516 11:23]: >> What you might get is proof that it follows these standards: <list>. >> Gov's like to see some kind, ANY kind, of proof of SOMETHING. > >It's hard to imagine what <list> might be though. Oh, SSL version so and so RSA, blowfish etc. This many bits... >> I've always used my own F/W's so I don't know what they come with. But I >> doubt it's ever going to say you are never going to get hacked. Would be a >> dumb promise. >> >> But look on encryption. Something using one or another says that it's >> using this or that type of encryption. If you look at banking they have >> their standards, not always the best but if you have what they use you're >> OK with them. > >There's nothing magically on the SuSE firewall...if you build your >own using the SuSE forewall script it won't even be that different >probably. The features of the firewall on a cd product are that it >runs entirely from a cdrom and a read-only floppy disk. I guess you >could consider the gui configuration tool a feature but I find it >easier to just edit the configuration files on the floppy. -- Steve Szmidt V.P. Information Video Group Distributors, Inc.

1 1

how to open ports
by Florian Winger 16 May '02

16 May '02

Hi everybody, I´m using an openmcu server on Suse 8.0, because I want to hold multi video conferences. I´m able to connect to this server, but there´s no transmition of sound and video. So I scan with nmap -p 1-65535 [localhost] and look there only the lisenport 1720 is open. All other ports which should be open are closed. Is there any possibilty to open the ports by hand? I don´t care if all ports are open, cause I only use this Server in my LAN which is protected by a different firewall. By the way I already removed all firewall packages on the localhost with yast2. Regards Flo -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

2 1

Re: AW: [suse-security] SuSEFirewall2 - Primary Domain Controller[finally]
by mario ohnewald 16 May '02

16 May '02

Hallo! It finally works!! wooooooooohoooooooooo > Am 16.05.2002 16:16:56, schrieb "mario ohnewald" <mario.ohnewald(a)gmx.de>: > > >ups, did i mention that i have a samba PDC? > > > > Then its more important to servicepack your w2k > > check your /etc/smb.conf [suse] whether are restriction > like > > hosts allow = 192.168.1.0/255.255.255.0 > was fine! > or > > hosts deny = 192.168.2.0/255.255.255.0 > > or > > bind interfaces only > > and or in it or not > > Another issue is, that there were problems when the > length of the domainname gots an even/odd count > of characters. But thats not your game, you simply want > to > > \\servername at first > > wrote you that you can "ping servername" ????? yes > wrote you that you can "ping serverip" ???? yes > wrote you that "nmap serverip" gives the results you expected ????? yes > > what about > > \\the.server.ip.address ???????? > > I bloody hell forgot to add the line: wins server = yes ARGGHHH! now it works perfectly! Thanks a lot!!!!!!!!!!! I am really thankful that you tried to help me that much!!! Yours, Mario

1 0

AW: [suse-security] SuSEFirewall2 - Primary Domain Controller
by kreiter＠jic.at 16 May '02

16 May '02

I guess its the same Problem i have with W2K-Server and an NT4 PDC, when they are in the same subnet, all is ok. But when they are in different subnets, they get no securityinfo from the PDC. I can access the shares, ping it by name. When i try to join the Domain, it gives an Error. When i'm in the same subnet and join domain, everythings ok. When i then change the subnet back, then W2K only gets the S-Numbers instead of the names from Users. I haven't found a fix for this Problem yet. My solution was a second Network only for the Servers, to connect W2K with NT4 in the same subnet. Andreas Kreiter -----Ursprüngliche Nachricht----- Von: mario ohnewald [mailto:mario.ohnewald@gmx.de] Gesendet am: Donnerstag, 16. Mai 2002 09:59 An: suse-security(a)suse.com Betreff: Re: [suse-security] SuSEFirewall2 - Primary Domain Controller doooh! Well, not really solved yet ;( Working with names works now, but my w2k Client still cant find my PDC (when i wanna join my domain), but it can ping it "ping pdc". do i have to enable some ports for internal routing? Protect from Internal is off. Any Ideas? Cheers, Mario > Ahhh, now it works! > Thanks a LOT! > > Mario > > > >Yes, i did that. I can reach all the ips in each net, so the routing > seems > > >to work, i can just not work with Names. > > > > > >Mario > > > > So put the ip of the pdc as wins-server in the settings of your clients in > the > > other subnet :O) > > > > Yours Michael Appeldorn > -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

4 8

SuSE Security Announcement: lukemftp, nkitb, nkitserv (SuSE-SA:2002:018)
by Thomas Biege 16 May '02

16 May '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: lukemftp, nkitb, nkitserv Announcement-ID: SuSE-SA:2002:018 Date: Wednesday, May 15th 2002 12:30 MEST Affected products: 6.4, 7.0, 7.1, 7.2, 7.3, 8.0 SuSE eMail Server III SuSE Linux Database Server SuSE Firewall Adminhost VPN SuSE Linux Live-CD for Firewall SuSE Linux Admin-CD for Firewall SuSE Linux Connectivity Server SuSE Linux Enterprise Server 7 SuSE Linux Enterprise Server for S/390 Vulnerability Type: remote command execution Severity (1-10): 3 SuSE default package: yes Other affected systems: all systems using lukemftp Content of this advisory: 1) security vulnerability resolved: buffer overflow while parsing PASV command problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information Lukemftp (ftp(1), /usr/bin/ftp, /usr/bin/pftp) is a compfortable ftp client from NetBSD. A buffer overflow could be triggered by an malicious ftp server while the client parses the PASV ftp command. An attacker who control an ftp server to which a client using lukemftp is connected can gain remote access to the clients machine with the privileges of the user running lukeftp. The lukemftp RPM package is installed by default. You need to update the package, as no temporary workaround is possbible. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. i386 Intel Platform: SuSE-8.0 ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/lukemftp-1.5-249.i386.rpm 0ae28f7ca49157bfa5783626d3e82cef source rpm: ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/lukemftp-1.5-249.src.rpm d9fc530c338ea2de122b6a4a1f89a627 SuSE-7.3 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n1/lukemftp-1.5-256.i386.rpm aeb64a5ba64b5b334dfcf244423a9809 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/lukemftp-1.5-256.src.rpm cc94b939696c76cda0fec683d12ff384 SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n1/lukemftp-1.5-256.i386.rpm 94812aeb3b164a67b0c85b0c9a61a450 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/lukemftp-1.5-256.src.rpm 5cd6642505a68be70ce9eac3ba5dd311 SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/lukemftp-1.5-251.i386.rpm 836df6046ce81fcc82e9939fde5003d1 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/lukemftp-1.5-251.src.rpm 788bc38fed7b486e857b5d780451b7a7 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/nkitb-2002.5.8-0.i386.rpm e6199c28c700461a7ae10c3f7fba73a8 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/nkitb-2002.5.8-0.src.rpm e1c6379846842ea62a5c484167102cae SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/nkitserv-2002.5.8-0.i386.rpm 50bb6a7ae3f450ad530ad92ae8dad3e1 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/nkitb-2002.5.9-0.i386.rpm 6950a272cf3a30a02860cf179387a9e8 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/nkitb-2002.5.9-0.src.rpm 09d7ac9ba5e1420eeddb016a6d812067 Sparc Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n1/lukemftp-1.5-77.sparc.rpm 295d90e7bfeb94f27f542616e016bd65 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/lukemftp-1.5-77.src.rpm 42e213cfc930e0a00aa871e9996d3cba SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n1/lukemftp-1.5-76.sparc.rpm 50fc0f99b42347aee746450624ed4817 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/lukemftp-1.5-76.src.rpm 01cdff7ff9f908466b8d3269fe4529c5 SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/nkitb-2002.5.8-0.sparc.rpm 210230a1a085af9f777f047a9edfa9f5 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/nkitb-2002.5.8-0.src.rpm b0e476e5ba4e9211cab20442f35b49d8 SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/nkitserv-2002.5.8-0.sparc.r… 70b063b1901c8655a23b008cc6ef4036 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n1/lukemftp-1.5-89.alpha.rpm 27c6ca255ef42c7e6851f309d6474fcd source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/lukemftp-1.5-89.src.rpm fdc27d3abae5bf6dfcd06907d2afc278 SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/a1/nkitb-2002.5.8-0.alpha.rpm 2c397f234a2326baba98a4da8dff601a source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/nkitb-2002.5.8-0.src.rpm 437a49653372205c4218e7283422fd6b SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/nkitserv-2002.5.8-0.alpha.rpm e2943d09b3bf82883bfd62aff74e500b SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/nkitb-2002.5.9-0.alpha.rpm 33b7a7b2f81dc78035450c0643786c83 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/nkitb-2002.5.9-0.src.rpm 60960a0129207b317fc22089f6203589 PPC Power PC Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n1/lukemftp-1.5-154.ppc.rpm fd6bc23e95cd7a19283dd4067f376bb3 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/lukemftp-1.5-154.src.rpm bb301c6487a09a2b3d82ce9b000b8f69 SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n1/lukemftp-1.5-150.ppc.rpm 023a43cba32d976d0a5665365242647b source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/lukemftp-1.5-150.src.rpm 53f38c8f4a3205b3bedbc76b209d177b SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/nkitb-2002.5.8-0.ppc.rpm 101d5af039c262f7b7e7d50598fa064c source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/nkitb-2002.5.8-0.src.rpm ed39244bcb57fad7b92287f5c9d26e3d SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/nkitserv-2002.5.8-0.ppc.rpm b6146585ab16d1d507e04f066f21f5d6 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/nkitb-2002.5.9-0.ppc.rpm 10b66b58b887a1899df7e16b15689bfb source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/nkitb-2002.5.9-0.src.rpm 954dcd26ef2eb777e737621927f98835 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - imap A bug report about a buffer overflow in the RFC1730 code of the wu-imap eMail server was published. SuSE Linux' imap packages were compiled without RFC1730 support, so SuSE Linux is not vulnerable to this bug per default. - dhcp A format string bug was found in the DynamicDNS (DDNS) code of ISC's DHCP server software. New RPMs are currently being build. - imlib Due to packaging failures we have to re-release the imlib packages which should be available within the next days. This update addresses missing dependencies and affects applications like xcdroast. - perl-Digest-MD5 A bug was found in the UTF8 interaction between perl and perl-Digest-MD5 which leads into failures while verifying the MD5 hash. New RPMs are currently being build. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQEVAwUBPOOaMney5gA9JdPZAQHhdggAmcDEmc+F15x5VI6LQhUyONMBQHr5HUAb Lb3iR3qAGEAxyyUL4VnSX18BNcTxMfTRVUqiwHhihTfAnDun70eObGEiJjPSEVwG jEACz3kFOz1HfGuowovn1O8VrK8kRcfBwhAUKSwgr2aXEgP+FbSKpdQbH6sDJVpR HUBa/YLhYGF9PiJ2ev+i5nt+1mYu4BMA22w1DVyHuSGzr3yPzo/wPUcak+J2VZHJ jgKm4hYpUHnRwU3CV/RPQOAgzV5OYp9aKE5wQU5bx35gvwl8U5RG00lcxltdjKAJ GGxKzvciEduusNPGWKEShjOGSMWiTwB3goDomv1KG6PwBmaxDSE4uA== =0IAE -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege <thomas(a)suse.de> SuSE Linux AG,Deutschherrnstr. 15-19,90429 Nuernberg Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/contact/thomas.asc | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 83 -- Trete durch die Form ein, und trete aus der Form heraus.

1 0

AW: AW: [suse-security] SuSEFirewall2 - Primary Domain Controller
by kreiter＠jic.at 16 May '02

16 May '02

The PDC and Domain is in lmhosts. Under NT4 it only works with this Entry on the clients in another subnet, but W2K does not. The only thing i could not try is to change the name of the Domain. Under W2K there is a strange behavior with underline "_", it didnt let create a computername with an _ in it. And the Domain contains an _ Maybe in my situation is this the Problem. Andreas Kreiter -----Ursprüngliche Nachricht----- Von: Michael Appeldorn [mailto:appeldorn@codixx.de] Gesendet am: Donnerstag, 16. Mai 2002 12:18 An: 'mario ohnewald'; Andreas Kreiter Cc: suse-security(a)suse.com Betreff: Re: AW: [suse-security] SuSEFirewall2 - Primary Domain Controller There is a file called lmhosts where you can define pdc and domains by ips Did it to call user-managment from y2k to a nt-pdc in another subnet Try this and call back wether suceed or not Michael Appeldorn >I guess its the same Problem i have with W2K-Server and an NT4 PDC, >when they are in the same subnet, all is ok. >But when they are in different subnets, they get no securityinfo from the >PDC. >I can access the shares, ping it by name. >When i try to join the Domain, it gives an Error. >When i'm in the same subnet and join domain, everythings ok. >When i then change the subnet back, then W2K only gets the S-Numbers instead >of the names from Users. >I haven't found a fix for this Problem yet. >My solution was a second Network only for the Servers, to connect W2K with >NT4 in the same subnet. > >Andreas Kreiter > >-----Ursprüngliche Nachricht----- >Von: mario ohnewald [mailto:mario.ohnewald@gmx.de] >Gesendet am: Donnerstag, 16. Mai 2002 09:59 >An: suse-security(a)suse.com >Betreff: Re: [suse-security] SuSEFirewall2 - Primary Domain Controller > >doooh! Well, not really solved yet ;( >Working with names works now, but my w2k Client still cant find my PDC (when >i wanna join my domain), but it can ping it "ping pdc". >do i have to enable some ports for internal routing? >Protect from Internal is off. > >Any Ideas? > >Cheers, Mario > >> Ahhh, now it works! >> Thanks a LOT! >> >> Mario >> >> > >Yes, i did that. I can reach all the ips in each net, so the routing >> seems >> > >to work, i can just not work with Names. >> > > >> > >Mario >> > >> > So put the ip of the pdc as wins-server in the settings of your clients >in >> the >> > other subnet :O) >> > >> > Yours Michael Appeldorn >> > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > > >

1 0

RE: [suse-security] SMTP and POP3 Proxy
by Reckhard, Tobias 16 May '02

16 May '02

> Does anyone know about a SMTP proxy and a POP3 proxy? I do, I do. > I'm configuring a firewall and I'd like to use proxy for WWW, > FTP, SMTP and > POP3; so I'm using squid, ftp proxy from SUSE proxy suite > and....I can't > find anything for SMTP and POP3. You're not seriously telling me you didn't find anything on Google, are you? Try http://www.google.com/search?q=pop3+proxy+linux&sourceid=opera&num=0&ie=utf- 8&oe=utf-8. As for SMTP, try postfix. Any MTA should do, actually. Tobias

1 0

SuSE Security Announcement: shadow (SuSE-SA:2002:017)
by Sebastian Krahmer 16 May '02

16 May '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: shadow/pam-modules Announcement-ID: SuSE-SA:2002:017 Date: Thu May 16 12:00:00 MEST 2002 Affected products: 8.0 Vulnerability Type: local privilege escalation Severity (1-10): 5 SuSE default package: yes Other affected systems: No. Content of this advisory: 1) security vulnerability resolved: write() disruption in shadow utils problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The shadow package contains several useful programs to maintain the entries in the /etc/passwd and /etc/shadow files. The SuSE Security Team discovered a vulnerability that allows local attackers to destroy the contents of these files or to extend the group privileges of certain users. This is possible by setting evil filesize limits before invoking one of the programs modifying the system files. Depening on the permissions of the system binaries this allows a local attacker to gain root privileges in the worst case. This however is not possible in a default installation. The bug has been fixed by ensuring the integrity of the data written to temporary files before moving them to the appropriate location of the system. There is no workaround so we recommend an update in any case. It is necessary to update the shadow package as well as the pam-modules package in order to prevent the truncation attacks. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. i386 Intel Platform: SuSE-8.0 ftp://ftp.suse.com/pub/suse/i386/update/8.0/a1/shadow-4.0.2-88.i386.rpm a4e0d03ecf7707eb7ca1f0422cae89f1 ftp://ftp.suse.com/pub/suse/i386/update/8.0/a1/pam-modules-2002.3.9-31.i386… 70322584f014ac3e2dc2dad0beecdefb source rpm: ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/shadow-4.0.2-88.src.rpm 33af2433d9a8822202e9f6ebdc6d3e2c ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/pam-modules-2002.3.9-31.src… 1bc5bbd169ffe5c35caa0a4ce681dcc0 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - leafnode The permissions of "/etc/leafnode" have been corrected. Please update to the newly available packages if you use leafnode. - xf86, xmodules, xloader Incorrect permission checks in certain X11 functions allow local attackers to read or write shared memory segments they should not have access to. Corrected packages will soon be available on our ftp-servers. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBPOOFNney5gA9JdPZAQFT0Af/T03nd1jO+3wcFLfs3Srq5Al9E2SXIdR4 gkEwTbP355ZFUA22ZElhZupX4gAAGxFduXX8s2n/kgfw4nkkY1gY6SG6aAbdvW99 AD6MY2X8HyrzRL3Ox0VO+kAOM1GCqNL0E6Rw5k3wTAErxOZeqgMA9IwjFoGFoRfX nBeloxZxQvFk8vG2yRPEDh6YVPvrDtAaWdZxAh4K81eOr5/jz+w53If0oY0or62w Zp5P0+CQbfj/ziJMoWVo9N4tK70il0kVrAvj/PWyobf0nfV6kIFf6F6nOWuge60J xqX5aM8F16iTYwhi6/AGAQckkCBqFpqxGJbNa05eGjOxerZ7M9tviQ== =usIl -----END PGP SIGNATURE----- -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~

1 0

Making Suse Harder to hack
by Patrik Breitenmoser 16 May '02

16 May '02

Hi all, since a couple of day i own a server (suse Linux 7.3) that is conected to the internet. bevor that i had only a lan server. I am worried about intruders makeing to mutch traffic -> high bills for me ;( I am running portsenty scanlogd and freeveracity for sec. Is there anything a security nubbie can do? Thanks a lot Patrik Breitenmoser

3 2

secumod+problem+2.4.18
by João Seabra 16 May '02

16 May '02

Hi all I installed secumod (compiled for 2.4.10-4GB). Im using kernel 2.4.18 (installed and compiled by me). When I do a insmod -f secumod.o (because I get a warning about kernel version mismatch 2.4.10-4GB!=2.4.18) profs=1 the module is inserted but nothing happens. Users are still able to see each other procs. I tryed to compile secumod for 2.4.18 but I get alot of warnings and errors about the includes. Any ideas? Thank you very much Best Regards, João Seabra

2 1

SuSEFirewall2 - Primary Domain Controller
by mario ohnewald 16 May '02

16 May '02

Hallo! I have SuSE7.3 and the SuSEFirewall2 with 3 Interfaces, ppp0/eth0 192.168.0.99 --> DSL/Internet eth1 192.168.1.254 --> Network1 ---> pdc, webserver, mailserver, Clients eth2 192.168.2.254 --> Network2 ---> Clients My PDC is in Network1. But i want to use my PDC for Network2, too! I can´t ping any Machine Names. (except of the M$ Machines in the same subnet) So what do i have to change in my firewall config except of Point22? Do i need a wins or DNS to get the name broadcasts working? Cheers, Mario Ohnewald p.s. I hope i have explained it well enought!

2 6

AW: [suse-security] password not accepted
by mailinglists＠belfin.ch 16 May '02

16 May '02

HI MIkkel there is NO spelling error. I tested it 10 times, even with direct use of pop3 commands and set local_echo on win2k telnet client. The UID of the users is 500+. So no mistake there either. Philipp > Hi all > > please tell me somebody why this passwrod Ct%16+X isn't accepted? Box is a > Suse-Linux 7.3 kernel 2.4.10. Qpopper sais password not accepted. But > according to man passwd it should be. > > Thanks, > Philipp > Hi; I'm not sure. But, I see 2 apparent reasons: 1. spelling error 2. UID of user is <100 (as I recall Qpopper wont allow acces for UIDs less than 100) Hope it helps Mikkel -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

password not accepted
by mailinglists＠belfin.ch 16 May '02

16 May '02

Hi all please tell me somebody why this passwrod Ct%16+X isn't accepted? Box is a Suse-Linux 7.3 kernel 2.4.10. Qpopper sais password not accepted. But according to man passwd it should be. Thanks, Philipp

2 1

ipsec and route
by ic_admin 15 May '02

15 May '02

Hi List, I have a problem with freeswan/ipsec and route since I installed SuSE 8.0 on my ISDN-Gateway: I added a new route before I start the software but this route didn't work when I start ipsec. And after I stop ipsec my route isn't available/visible anylonger. I have to restart the network to get back my old settings. This happens always I add a new route independent of the way I do this (with yast or the 'route add -net' command). Any ideas or has somebody the same problem? Thanks and regards Ruediger

3 2

very strange directorys (hacked???)
by Wahlert Andreas 15 May '02

15 May '02

Hi List, I use SuSE 8.0 and i 've found two strange directorys on my SuSE PC: \data1 and \data2 The directorys have the same time and date. Owner is root Is it normally?? Wherefrom is this? Regards from germany Andreas Wahlert

2 1

RE: [suse-security] Firewall deaktivieren
by Peer Stefan 15 May '02

15 May '02

hi florian, > From: Florian Winger [mailto:fwinger@gmx.de] > Hello list, > > I`m using SuSE 8.0 and want to use the rlogin or ftp command. > I have already removed the SuSEfirewall2 and the > personal-firewall pakages > with YAST2. > But I´m still not able to rlogin from a different PC. "IP > Adress: Connection refused" check /etc/hosts.allow and /etc/hosts.deny, are you allowed to rlogin from localhost? do you have SuSEfirewall2 installed? What does your syslog say (/var/log/messages)? can you ping that host? did you spell your password right? are you connecting as root or as any other user? check whether you can rlogin to localhost (on the machine you want to connect to) if that works: check the network: ping the host check /etc/hosts.allow and /etc/hosts.deny check /var/log/messages for any suspicious entry if rlogin to localhost did not work: check whether rlogin is enabled (/etc/inetd.conf & start inetd) check whether the user is allowed to rlogin (/etc/hosts.deny and /etc/hosts.allow) check for any other netfilter (iptables -Ln, ipchains -Ln) regards, stefan

3 2

Firewall deaktivieren
by Florian Winger 15 May '02

15 May '02

Hello list, I`m using SuSE 8.0 and want to use the rlogin or ftp command. I have already removed the SuSEfirewall2 and the personal-firewall pakages with YAST2. But I´m still not able to rlogin from a different PC. "IP Adress: Connection refused" I´m confused!!! Please help me..... Regards Flo -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

2 1

libpcap - SuSE 7.3 different versions...
by Marcin Gryszczuk 14 May '02

14 May '02

Hi All.... I have just found out (by total accident) that libpcap on SuSE 7.3 distribution differs from that which is on suse ftp server in 7.3 distro director. In CD distribution I have 0.6.2-86 and on suse ftp is 0.6.2-100. Is it some security update or something? But I can not found any announcement about it and there is no libpcap update in SuSE 7.3 update directory as well. Am I missing something or is it common situation? Best regards to all... Marcin Gryszczuk

2 1

RE: [suse-security] SuSE 8.0 SuSEFirewall2 logging question: help !
by Peer Stefan 14 May '02

14 May '02

> But his logs say his station was pinging the remote host, not > the otherway around. ok, i reread the original post by geordon vantassle. i'm sorry, i just scanned through it without reading the message carefully ... as far as i understand this post, there was a traceroute-attempt from 192.168.1.1. it reached 192.168.1.20 which then tried to ping 207.26.131.137. geordon also said, that a box wasn't alive at the time. i don't get which box wasn't alive - 192.168.1.20 or 207.26.131.137? geordon, if 192.168.1.20 wasn't alive and tried to ping 207.26.131.137, then don't panic but be carefull - maybe someone spoofed an ip-address and became part of your local net. if 207.26.131.137 wasn't alive, then there's just another box on the internet switched off ... do you know, who initiated the traceroute? regards, stefan

2 1

Unbalanced Mail...
by Phil Shrimpton 14 May '02

14 May '02

Hi, Is this somebody trying to (mis)use my mail server? ------- from sina35-183.sina.com.cn [202.108.35.183] (may be forged) with id g4DJFQA06051 ----- Transcript of session follows ----- 553 5.0.0 "H+O"<lKw9bEL3v0fO5M3... Unbalanced '"' 553 5.0.0 "H+O"<lKw9bEL3v0fO5M3... Unbalanced '"' 553 5.0.0 "H+O"<lKw9bEL3v0fO5M3... Unbalanced '"' Cheers Phil -- Linux 2.4.4-4GB 9:02pm up 10:30, 3 users, load average: 0.25, 0.07, 0.02

2 1

RE: [suse-security] SuSE 8.0 SuSEFirewall2 logging question: help !
by Peer Stefan 14 May '02

14 May '02

Hi > From: John Andersen [mailto:jsa@pen.homeip.net] > > On Monday 13 May 2002 11:59 am, Geordon VanTassle wrote: > > Can someone please point me to the right direction to look to stop > > logging this particular thing? I can't even figure out why the > > Windows computer at 192.168.1.20 is trying to ping 207.26.131.137, > > which isn't alive even, but that's a different story. > > Don't try to suppress the logging, try to suppress the pinging. > Its VERY unusual for a windows machine to ping something > all by itself, Find out WHY. i guess this box uses software like audiogalaxy, imesh or something similar. these programs try to ping hosts known to share multimedia files. if you were connected to an audiogalaxy-server once, you will be pinged for some time, before the ip-address is removed from the database. regards, stefan

2 1

SuSE 8.0 SuSEFirewall2 logging question: help!
by Geordon VanTassle 14 May '02

14 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hello , I am pulling my hair out trying to figure out how to stop logging the following: May 13 14:54:43 gvantass kernel: SuSE-FW-TRACEROUTE-ATTEMPT IN= OUT=eth1 SRC=192.168.1.1 DST=192.168.1.20 LEN=56 TOS=0x00 PREC=0xC0 TTL=255 ID=3878 PROTO=ICMP TYPE=11 CODE=0 [SRC=192.168.1.20 DST=207.26.131.137 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=12025 PROTO=ICMP TYPE=8 CODE=0 ID=1024 SEQ=5377 ] Can someone please point me to the right direction to look to stop logging this particular thing? I can't even figure out why the Windows computer at 192.168.1.20 is trying to ping 207.26.131.137, which isn't alive even, but that's a different story. I would really appreciate some assistance, as I've tried looking in /sbin/SuSEfirewall2 and /etc/sysconfig/SuSEfirewall2 but haven't been able to figure out how to stop this. TIA - -- Best regards, Geordon mailto:gvantass@interaccess.com PGP Key ID: 0xFCF06B79 Your Fortune ==> "Hegel was right when he said that we learn from history that man can never learn anything from history." (George Bernard Shaw) il\�J�J -----BEGIN PGP SIGNATURE----- Version: PGP 6.5i iQEVAwUBPOAbIN77fDX88Gt5AQGbZwgAg9igkJZP/dn8sIgq5B8PAsrGjK0aRBLu /WgSjaJzVabB/N45vPnbgVtu+RQWzDECZNHgk672HmUEFiNpOkvOzdTMNzdwXWqR IVscMQqw9fFsUTR6OSrqsfmrKo5RqELLzZHDowcYQcUGULZpRAW/ZykodC4yG/AI nX+3KQs82+JrjTaEr3xS0r1PCKXETxQqNsAzzT2G0594y2Fsj3yh4+WmzQ9AZSP4 Q6UPbhaTxmR5Yrhlq1gQPWSafuWG+52wL5nSJCzsRKcHcLhLjDe4/clhCEwlXSET A/7PMhwIGIWORjEHTl4+z1zI88M9teW9/vC0mQAY5aWZD6hHWRVRKQ== =ZdzE -----END PGP SIGNATURE-----

2 1

Ok, I Give...
by Gary Counsellor 13 May '02

13 May '02

I have been seeing this since I started SFW2 and conect via ppp. Not sure why it's there, tried looking for clues as to why, who but found nothing meaningful. Figured it might be me and my isp (Well, I gotta think of something) Even tried to see if it time sync'd with anything going on with my box ie; sendmail, autofetch, etc. Usually I just copy error messages into google and find what I need to know but that didn't work this time. Any suggestions? I'd be happy just to stop seeing it reported but stopping it entirely, if feasible, would be cool also. SuSE-FW-UNAUTHORIZED-TARGET IN=ppp0 OUT= MAC= SRC=209.244.43.100 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=24643 PROTO=2 Thanks for the help, -- Gary Counsellor http://www.musician2000.com sineigs.all.attitudes(a)eskimo.com Please remove .all.attitudes before replying

1 0

Re: [suse-security] SuSE 8.0 SuSEFirewall2 logging question: help!
by Alberto Butrico (linux) 13 May '02

13 May '02

Geordon, Extracted from /etc/rc.config.d/firewall2.rc.config # 16.) # Which logging level should be enforced? # You can define to log packets which were accepted or denied. # You can also the set log level, the critical stuff or everything. # Note that logging *_ALL is only for debugging purpose ... # Choice: "yes" or "no", FW_LOG_*_CRIT defaults to "yes", # FW_LOG_*_ALL defaults to "no" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" # only change/activate this if you know what you are doing! FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" I think that your you should play with those parameters... Saludos, Alberto mailto:linux@opc.com.uy Linux User #242064 UyLug Member #195 Con fecha Lunes, 13 de Mayo de 2002, 16:59:21, escribió: GV> -----BEGIN PGP SIGNED MESSAGE----- GV> Hello , GV> I am pulling my hair out trying to figure out how to stop logging the GV> following: GV> May 13 14:54:43 gvantass kernel: SuSE-FW-TRACEROUTE-ATTEMPT GV> IN= OUT=eth1 SRC=192.168.1.1 DST=192.168.1.20 LEN=56 TOS=0x00 GV> PREC=0xC0 TTL=255 ID=3878 PROTO=ICMP TYPE=11 CODE=0 [SRC=192.168.1.20 GV> DST=207.26.131.137 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=12025 GV> PROTO=ICMP GV> TYPE=8 CODE=0 ID=1024 SEQ=5377 ] GV> Can someone please point me to the right direction to look to stop GV> logging this particular thing? I can't even figure out why the GV> Windows computer at 192.168.1.20 is trying to ping 207.26.131.137, GV> which isn't alive even, but that's a different story. GV> I would really appreciate some assistance, as I've tried looking in GV> /sbin/SuSEfirewall2 and /etc/sysconfig/SuSEfirewall2 but haven't been GV> able to figure out how to stop this. GV> TIA GV> - -- GV> Best regards, GV> Geordon mailto:gvantass@interaccess.com GV> PGP Key ID: 0xFCF06B79 Your Fortune ==>> "Hegel was right when he said that we learn from GV> history that man can never learn anything from history." (George GV> Bernard Shaw) GV> il\JJ GV> -----BEGIN PGP SIGNATURE----- GV> Version: PGP 6.5i GV> iQEVAwUBPOAbIN77fDX88Gt5AQGbZwgAg9igkJZP/dn8sIgq5B8PAsrGjK0aRBLu GV> /WgSjaJzVabB/N45vPnbgVtu+RQWzDECZNHgk672HmUEFiNpOkvOzdTMNzdwXWqR GV> IVscMQqw9fFsUTR6OSrqsfmrKo5RqELLzZHDowcYQcUGULZpRAW/ZykodC4yG/AI GV> nX+3KQs82+JrjTaEr3xS0r1PCKXETxQqNsAzzT2G0594y2Fsj3yh4+WmzQ9AZSP4 GV> Q6UPbhaTxmR5Yrhlq1gQPWSafuWG+52wL5nSJCzsRKcHcLhLjDe4/clhCEwlXSET GV> A/7PMhwIGIWORjEHTl4+z1zI88M9teW9/vC0mQAY5aWZD6hHWRVRKQ== GV> =ZdzE GV> -----END PGP SIGNATURE-----

1 0

New autotooter autowu v1.0
by Marko.Muncan＠arxes.de 13 May '02

13 May '02

I just got a copy of that new autorooter which roots wuftpd up to 2.6.2(1). Now i tried to emanine it and didn´t came through. I tried it on my network and it exploited them but i dont know whut it does. Does anyone know what it does? Mit freundlichen Grüßen Marko Muncan __________________________________________ arxes Network Communication Consulting AG Schanzenstraße 36 Gebäude 197 D-51063 Köln Telefon: +49 (0) 221 96486 - 268 Telefax: +49 (0) 221 96486 - WEB: http://www.arxes.de MailTo: Marko.Muncan(a)arxes.de Informieren Sie sich über unsere Veranstaltungen zu den aktuellen IT-Themen unter http://www.arxes.de/de/events/index.html

1 0

AW: [suse-security] smpppd
by Bitzer, Gerd 13 May '02

13 May '02

Hi, if smpppd is triggered via inetd, then there may be the possibilty to use tcpd to log and control, which source IP adresses could trigger smpppd. Just as an idea. HtH -----Ursprüngliche Nachricht----- Von: tux the turtle [mailto:tu.th.tu@gmx.net] Gesendet am: Montag, 13. Mai 2002 13:29 An: suse-security(a)suse.com Betreff: [suse-security] smpppd Hi; is there any way to get informations about which app has triggered smpppd and how to xclude the one app from access but not the other? There's something that connects me to my ISP each time i log in and i don't want to follow the t-a-e-method. Besides that: it would be great for logging... Thanx... -- *** Tux IS a turtle isn't it? *** Sys soft / Sys hard: ====================== SuSE 7.3 prof, Kernel 2.4.10-4GB (SuSE std), KDE 2.2.2 src-tarball, alsa 0.5.11 Athlon 700MHz 640MB, MoBo: Epox EP-7KXA / VT82C686A more Sys soft/ more Sys hard: ====================== SuSE 8.0 pers, Kernel 2.4.18-4GB (SuSE std), KDE 3.0 src-tarball HP Omnibook XT1000 F3433HT -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0