May 2002 - openSUSE Security - openSUSE Mailing Lists

SuSEfirewall2 and nimda
by Ruud H. Koning 06 May '02

06 May '02

Hello, I have installed Suse linux 8 and activated SuSEfirewall2. I would like to black http requests from Nimda/Code Red etc. infected hosts. With iptables this is supposed to be possible with something like iptables -A block -p tcp --dport http -m state --state NEW,ESTABLISHED,RELATED \ -m string --string "root.exe" -j LOG --log-prefix "Nimda virus " iptables -A block -p tcp --dport http -m state --state NEW,ESTABLISHED,RELATED \ -m string --string "root.exe" -j DROP Where would I put these commands in the configuration of SuSEfirewall2? Thanks for any help, Ruud

1 0

Re: [suse-security] Re: User with dots ? Why not in yast2
by ts 06 May '02

06 May '02

> * Lars Vaessen <l.vaessen(a)vvmedien.com> [2002-05-05 16:49 > +0200]: > > > First one. Some implementations of chown expect user and > group > separated by a dot. If your username was "lars.vaessen", > how could > an admin of such a system chown you a file? It would go to > the > different user "lars" and the group "vaessen". That's simply not true. I just chowned bogus.guy /home/bogus.guy/*.x*, as an experiment and it works as expected. > If previous versions of yast didn't mind dots, they are > broken. This is something that needs to be conclusively proven by real world examples of system malfunction arising from this use rather than an aesthetic dislike of the dotted seps. Not to mention that a trivial c program or awk script could probably be used to insulate this problem on systems that do exhibit this behavior. Disclaimer: I don't like using "." seps in legitimate, system usernames, but for mailusers it is something that is sometimes desirable IMO.

3 2

Re: [suse-security] Re: Re: User with dots ? Why not in yast2
by ts 06 May '02

06 May '02

> If you had followed my explanation, you would have come to > this: > > $ touch somefile; ls -ld $_ > -rw-r--r-- 1 root root 0 May 5 21:25 > somefile > $ useradd lars > $ groupadd vaessen > $ chown lars.vaessen somefile && ls -ld somefile > -rw-r--r-- 1 lars vaessen 0 May 5 21:25 > somefile > > $ rm somefile; touch $_; ls -ld $_ > -rw-r--r-- 1 root root 0 May 5 21:25 > somefile > $ useradd lars.vaessen > $ chown lars.vaessen somefile && ls -ld somefile > -rw-r--r-- 1 lars.vae root 0 May 5 21:26 > somefile This is really not a telling example at all; it is more than a little contrived. If you have a situation like this then you are absolutely correct, if you do not it is a non-problem. You made a global statement of recommendation regarding: "a system chown you a file? It would go to the different user "lars" and the group "vaessen"." without an example like that you just gave. This is misleading and erroneous. > As you can see, the behaviour of chown depends on the > contents of your > /etc/passwd . So it's impossible to predict what would > happen by > deriving the commandline. And that's why you really do > *not* want to > use dots in usernames. Also this is easily avoided at user generation time using a simple wrap for useradd. It is incorrect to say that it is "impossible" to predict what would happen. A bare bones proof of concept: awk -v xx="bogus.users" ' { if (m = split(xx,arr,".")) { FS = ":" if ($1 == arr[2]) { printf "%s", "You cannot use this name.\n" exit } } }' /etc/groups > > > If previous versions of yast didn't mind dots, they > are broken. > > This is something that needs to be conclusively proven > by real world > > examples of system malfunction arising from this use > rather than an > > aesthetic dislike of the dotted seps. > I disagree in principle but you seem to be factually correct. > -- > Johannes Franken > > Professional unix/network development > mailto:jfranken@jfranken.de > http://www.jfranken.de/ > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: > suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not > here

1 0

DynDNS Clients
by Andreas.Novak＠student.fh-nuernberg.de 05 May '02

05 May '02

Dear List, I've recently downloaded the "dyndnsupdate client" for DynDns.org. I think it's much easier to use than the other clients. Anyway I got problems. After I execute the binary with the appropriate options, it says that the update was successful, afterwards my WebServer crashes. It refuses any input from the keyboard, and the Caps Lock und the Scroll Lock lights are on. I've similar problems with another client for dyndns ( the ddclient I think ). So most probably it's not a specific problem to this client. Perhaps I just configured something wrong?? Any ideas welcome Thanks in advance Andreas Novak --_OPERAB__-rV87oLfWE37ZzAm43+s4oR--

3 2

file creation with a different gid?
by Axel Zindler 05 May '02

05 May '02

Hi, was wondering how to create files with a different gid then the standard group. Suppose one wants to share files with a second (or third and so far) user. They create a common group different from (standard) users, ie. projectx. If both users are now members of projectx and keep the membership of users the files will be written always with the uid of users, ie: -rw-r--r-- 1 axel users 16 Mär 31 22:50 test.txt How is it possible to edit a file and save files in that way to achive the following without doing a chgrp after the file is saved? -rw-r--r-- 1 axel projectx 16 Mär 31 22:50 test.txt

4 3

User with dots ? Why not in yast2
by Lars Vaessen 05 May '02

05 May '02

Hi Perfect I Love Yast 2 . Really ? Why can't I use dots in my User-Name ? Is that a security problem or only a YAST2 Problem. It was possible in YAST . Why ????????? Lars Vaessen

3 2

Guarddog vs SuSEfirewall2?
by Wesley Skoczen 05 May '02

05 May '02

Hi list I am using SuSE 7.2 and would like to secure it. Is the latest Guarddog as secure as SuSEfirewall2? I would appriciate any comments. Thank You Wesley ______________________________________________________________________ Games, Movies, Music & Sports! http://entertainment.yahoo.ca

3 2

Netsaint
by Jonathan Fondow 05 May '02

05 May '02

Hellow all, I am trying to setup netsaint for network monitoring and am having a few problems. The netsaint documentation doesn't matchup with the RPM that came with 7.3, as far as setup. If anybody can shed some light on this or any other comments on netsaint, please. Thank you.

2 1

Kernel sources (not entirely OT)
by John Andersen 05 May '02

05 May '02

About april 15 the new kernels were announced here. I've installed this one: Linux pen 2.4.16-4GB-SMP #1 SMP Mon Apr 15 09:54:09 GMT 2002 i686 But the source rpm in the same directory on ftp.suse.com does not seem to match, and when I try to install vmware it refuses to configure saying: -----------paste What is the location of the directory of C header files that match your running kernel? [/usr/src/linux/include] The directory of kernel headers (version 2.4.16-4GB) does not match your running kernel (version 2.4.16-4GB-SMP). Even if the module were to compile successfully, it would not load into the running kernel. ------end-paste So, the question is where can I get the source tree for the SMP kernel or is it the same source with a different compile option? -- _________________________________________________ No I Don't Yahoo! And I'm getting pretty sick of being asked if I do. _________________________________________________ John Andersen / Juneau Alaska

2 1

Re: [suse-security] SuSE 8.0 no ftp installation possible ? NFS is insecure
by Lionel 04 May '02

04 May '02

Le Jeudi 2 Mai 2002 01:44, gstammw(a)gmx.net a écrit : > Hello, > > I've just been trying to install SuSE 8.0 via FTP, but I couldn't believe > it > hwen I saw it: > there is no ftp-installation option. What a bad idea ! It was a very good way to install missing programms without cdroms, very interessant when servers are too far , when you don't know where your cdrom's are , or when you have to operate for distant administration tasks. Will We have to plan for another distribution or will next release have ftp option enabled again ? Lionel, disapointed . -- AgrogeomaTIC CNERTA-ENESAD, 4 rue champs-prevois, batiment grand-champs, 21000 Dijon 03.80.77.28.49

1 0