May 2002 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] SuSE 8.0 no ftp installation possible ? NFS is insecure.
by John Trickey 02 May '02

02 May '02

> Stop writing corny firewall & get a hard on SuSE scripts for > newbies. Wheres does this fit into the technical crowd whose I am feeling SuSE are losing their way. I first used 6.2 and was quite happy with its content. In providing a production service, I moved to 7.2 but have gone no further. The lack of kernel updates and now the eventual release of 2.4.16 when we are up to 2.4.19rc4. Yes, 8.0 I believe has 2.4.18 but should I move to 8.0 just for that? No! My biggest complaint - and this is of all distros - is that they will insist on fiddling with the file system layouts. If I find I need to patch a particular application to fix a problem which SuSE have not resolved, I end up with a major effort. Usually it ends up with downloading the updated src from the author's site and then getting it to map SuSE's layout. If you think the above has nothing to do with security you'd be wrong. All I want from a distro is a stable and secure platform. I use a distro to save time in fixing things myself and am willing to pay for that benefit. What I do not want is bells and whistles at the expense of aging products. SuSE - feel free to comment as I'd like to know where you are going. John

1 0

AW: [suse-security] SUSE 8.0: IS Harden-SuSE supported ??
by Gunther Stammwitz 02 May '02

02 May '02

Hello Johan, thanks for your reply, but just TRYING is _NOT_ an option for me. We're using linux in productive enviorments. Errors mustn't happen. Maybe Marc can tell us if we can use harden_use together with SuSE 8.0. Bye, Gunther -----Ursprüngliche Nachricht----- Von: Johan Stäring [mailto:js@fy.chalmers.se] Gesendet: Donnerstag, 2. Mai 2002 15:06 An: Gunther Stammwitz Cc: suse-security(a)suse.com; marc(a)suse.de Betreff: Re: [suse-security] SUSE 8.0: IS Harden-SuSE supported ?? On Thu, 2 May 2002, Gunther Stammwitz wrote: :can I use harden_suse with SuSE-8.0 ?? :I'm askin because the latest version of Harden SuSE is v3.5 from the 12th :June 2001. :This is definitive BEFORE SuSE 8.0 has been released. Why not try instead of ask? :) Change the line $debug = 0 to $debug = 1 in the harden_suse script and execute it. Look for error messages and look through the output files that in debug mode ends up in a directory named something similar to /tmp/.harden_suse.<pid> If nothing seems to break, the script works. /Johan, without a SuSE 8.0-machine to try on -- ================================================================ || js(a)fy.chalmers.se || Johan Stäring || +46-(0)70-672 79 01 || || ICQ#: 7290407 || http://www.fy.chalmers.se/~js || ================================================================

3 2

SSH
by Robert Greenwell 02 May '02

02 May '02

I have SuSe 7.3 with rpm package openssh-2.9.9p2-98. I noticed that openssh is at version 3.1p1. Are there plans to provide the newer version? Thanks, Robert Greenwell

3 2

AW: [suse-security] SUSE 8.0: IS Harden-SuSE supported ??
by Gunther Stammwitz 02 May '02

02 May '02

Hello Ryan, yes - I have looked at the scripts :-) What I want is that the scrips does exactly what it is supposed to do. Nothing more and nothing less. The functionality is predefined - and yes, it perfectly fits into my security strategy; as one tiny part of course. Where's the problem ? Why shouldn't we use the scripts if they're there AND if we know what they are doing... Bye, Gunther -----Ursprüngliche Nachricht----- Von: Ryan Swenson [mailto:Ryan.Swenson@togethersoft.com] Gesendet: Donnerstag, 2. Mai 2002 19:32 An: Gunther Stammwitz; suse-security(a)suse.com Cc: Johan Stäring Betreff: RE: [suse-security] SUSE 8.0: IS Harden-SuSE supported ?? uh have you ever just looked at the scripts ? so many people ask SuSEfirewall1&2, and Harden_SUSE questions yet they are only scripts making practice of what any security conscious going person if within a production environment should already know. I would not want my network protected by administrators that must rely on scripts without knowing the principles behind the script in that they are mostly easy to learn and thus implement. You can modify it or take out of context things you obviuosly know will work. Gruesse/Hadjo Taag/Regards, Ryan S. -----Original Message----- From: Gunther Stammwitz [mailto:gstammw@gmx.net] Sent: Thursday, May 02, 2002 1:15 PM To: suse-security(a)suse.com Cc: Johan Stäring Subject: AW: [suse-security] SUSE 8.0: IS Harden-SuSE supported ?? Hello Johan, thanks for your reply, but just TRYING is _NOT_ an option for me. We're using linux in productive enviorments. Errors mustn't happen. Maybe Marc can tell us if we can use harden_use together with SuSE 8.0. Bye, Gunther -----Ursprüngliche Nachricht----- Von: Johan Stäring [mailto:js@fy.chalmers.se] Gesendet: Donnerstag, 2. Mai 2002 15:06 An: Gunther Stammwitz Cc: suse-security(a)suse.com; marc(a)suse.de Betreff: Re: [suse-security] SUSE 8.0: IS Harden-SuSE supported ?? On Thu, 2 May 2002, Gunther Stammwitz wrote: :can I use harden_suse with SuSE-8.0 ?? :I'm askin because the latest version of Harden SuSE is v3.5 from the 12th :June 2001. :This is definitive BEFORE SuSE 8.0 has been released. Why not try instead of ask? :) Change the line $debug = 0 to $debug = 1 in the harden_suse script and execute it. Look for error messages and look through the output files that in debug mode ends up in a directory named something similar to /tmp/.harden_suse.<pid> If nothing seems to break, the script works. /Johan, without a SuSE 8.0-machine to try on -- ================================================================ || js(a)fy.chalmers.se || Johan Stäring || +46-(0)70-672 79 01 || || ICQ#: 7290407 || http://www.fy.chalmers.se/~js || ================================================================ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

iptables and squid
by Wahlert Andreas 02 May '02

02 May '02

Hi List, i have configured an Linux BOX with Squid, Squid NCSA_AUTH and dansguardian. It works fine. Now i want to implement iptables. The Squid is not tranparent. But i have no idea about the iptables. Can anyone help??? Regrads Andreas Wahlert

3 2

Re: [suse-security] SUSE 8.0: IS Harden-SuSE supported ??
by Martin Peikert 02 May '02

02 May '02

Julian Wingert wrote: > Hallo > > if you need "harden-suse" to make your server secure, > better not put it in the wild. Hahaha. Usually I run debian and OpenBSD... Can you tell me what the harden-suse script is good for if it's not to secure a server running in the wild? GTi

1 0

Re: [suse-security] SUSE 8.0: IS Harden-SuSE supported ??
by Johan Stäring 02 May '02

02 May '02

[Right... one needs to post from and to the correct address. Sorry about that, Gunther and Marc] On Thu, 2 May 2002, Gunther Stammwitz wrote: :can I use harden_suse with SuSE-8.0 ?? :I'm askin because the latest version of Harden SuSE is v3.5 from the 12th :June 2001. :This is definitive BEFORE SuSE 8.0 has been released. Why not try instead of ask? :) Change the line $debug = 0 to $debug = 1 in the harden_suse script and execute it. Look for error messages and look through the output files that in debug mode ends up in a directory named something similar to /tmp/.harden_suse.<pid> If nothing seems to break, the script works. /Johan, without a SuSE 8.0-machine to try on -- ================================================================ || js(a)fy.chalmers.se || Johan Stäring || +46-(0)70-672 79 01 || || ICQ#: 7290407 || http://www.fy.chalmers.se/~js || ================================================================

2 1

SUSE 8.0: IS Harden-SuSE supported ??
by Gunther Stammwitz 02 May '02

02 May '02

Hello, can I use harden_suse with SuSE-8.0 ?? I'm askin because the latest version of Harden SuSE is v3.5 from the 12th June 2001. This is definitive BEFORE SuSE 8.0 has been released. Thanks, Gunther + Serverhousing @ www.rackbase.de + --------------------------------------------------------- Mainlab GmbH Sachsenhäuser Landwehrweg 236 60598 Frankfurt am Main Tel. / Fax: 0700-2MAINLAB (0700-26246522) Email: info(a)mainlab.de Web: www.mainlab.de

1 0

Strange system log entries Can anyone explain and help get rid off
by Ralph F. De Witt 02 May '02

02 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all: I have noticed after doing my SuSE 8.0 install these strange log entires about eth0 can anyone explain them and how to correct what ever is not working right. Just for background I did a clean install of 8.0 pro. I connect to the internet through a cable modem connected to eth0. During setup I did not specifie any addresses except for dns servers and the default 255.x.x.x stuff, I checked DHCP. This is a snip of the system log file: May 2 01:19:12 Unkitty kernel: SuSE-FW-UNAUTHORIZED-TARGET IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:04:bd:c1:18:0f:08:00 SRC=192.168.100.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2 May 2 01:22:12 Unkitty kernel: SuSE-FW-UNAUTHORIZED-TARGET IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:04:bd:c1:18:0f:08:00 SRC=192.168.100.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2 May 2 01:25:12 Unkitty kernel: SuSE-FW-UNAUTHORIZED-TARGET IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:04:bd:c1:18:0f:08:00 SRC=192.168.100.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2 May 2 01:25:47 Unkitty su: (to root) ralph on /dev/pts/2 May 2 01:25:47 Unkitty su: pam_unix2: session started for user root, service su May 2 01:25:47 Unkitty su: pam_unix2: session finished for user root, service su May 2 01:25:47 Unkitty su: (to root) ralph on /dev/pts/2 May 2 01:25:47 Unkitty su: pam_unix2: session started for user root, service su May 2 01:28:12 Unkitty kernel: SuSE-FW-UNAUTHORIZED-TARGET IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:04:bd:c1:18:0f:08:00 SRC=192.168.100.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2 Thanks for your help. - -- Yours, Ralph. It said Use Windows XP or better, so I installed SuSE 8.0 Professional Register Linux User 168814 ICQ #49993234 AIM ralphdewitt GPG Public Key available at http://www.keyserver.net Key fingerprint = 6426 1CFF 0987 9D51 76D6 06BC F22A CFF4 559A 03E7 Kernel version 2.4.18-4GB Current Linux uptime: 2 days 2 hours 22 minutes. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE80Psy8irP9FWaA+cRAvjgAJ0V6w+woqGeHJBDomtPzrUEGPFAWgCfdYwF BwZ20neYoxBdtd7Ylq8E2CI= =Ic/v -----END PGP SIGNATURE-----

1 0

RE: [suse-security] Installing a Firewall on the same system runi ng HTTP, Mail, DNS, ..
by Peer Stefan 02 May '02

02 May '02

Hi > From: Reckhard, Tobias [mailto:tobias.reckhard@secunet.com] > > > Is there some security feature, if we ran a firewall on the > > same server, > > which is running other services like HTTP, .. > > Personally, I'd suggest to get a firewall running on a > > specific server, and > > all other services on other systems. I totally agree with your personal opinion. > The main problem with using a firewall to perform other > services is that > vulnerabilities in those services can have disastrous > effects, typically > much graver ones than if merely a server is compromised. Another thing are users. For larger environments you will have a webteam, which requires several user-accounts on the webserver. You will have ftp enabled, because standard web-design tools like dreamweaver or frontpage allow you to update entire webpages via ftp. Or even worse - you'll have to enable the frontpage extensions - all those services add some new holes to your system. regards, Stefan

1 0