May 2002 - openSUSE Security - openSUSE Mailing Lists

Firewall2 question
by Geordon VanTassle 21 May '02

21 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hello , I'm trying to set up my firewall as my primary POP and SMTP box (VERY small LAN). On my internal server box (192.168.1.2) I have sent mail to my username@domain but got the following in my firewall log. Can someone help me figure out how to tell the firewall to allow this connection? In a similar vein, can someone suggest how to tell my firewall to redirect requests from inside to the masqueraded/port-forwarded location? Thanks May 20 16:09:50 gvantass kernel: SuSE-FW-NO_ACCESS_INT->FWEXT IN=eth1 OUT= MAC=00:a0:c9:1e:9d:73:00:60:08:93:a8:a1:08:00 SRC=192.168.1.2 DST=XXX.XXX.XXX.XXX LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=61923 DF PROTO=TCP SPT=41027 DPT=25 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A037C30320000000001030300) - -- Best regards, Geordon mailto:gvantass@interaccess.com PGP Key ID: 0xFCF06B79 Your Fortune ==> "He who can, does. He who cannot, teaches." (George Bernard Shaw) ��h�� -----BEGIN PGP SIGNATURE----- Version: PGP 6.5i iQEVAwUBPOlu0t77fDX88Gt5AQELGAf+MCairRjPsNGJM7n4LmoIaAA4SPB4tili l/hV6QtFU0tx7bPrFOShT3Dcg4I/wTv0QH0iCQMfdgkDlARRrzMFGWqZUw3cSGQp 5OWUHmJ+W4cG+cfZbySqRRZche6Kw0f5VJyJ2d2CjLdCvhn6R6iDrs0Cmu8bZbPN uIgQ8/UdVZ7hHxlLQSuHEPhzO45cHV48G+dp/HThuopqeJuKRvW62Aaib6DVZw79 SHHYbg2d9/WK/JxQq8yvdW5CoE52PFxG2NFZy5qKdZ5ZlV0p7dKRaAvXQK8rPE51 DImVEYKiiOdwZkADUrpHfKrUuqW9ZZw8ap25yX20yhWT/RfnMyz5EQ== =IQ0H -----END PGP SIGNATURE-----

3 2

AMaViS
by Fred A. Miller 21 May '02

21 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Anyone been using AMaViS (virus scanning)? If so, how well does it work? Thanks, Fred - -- Fred A. Miller Systems Administrator Cornell Univ. Press Services fm(a)cupserv.org, www.cupserv.org - --- SuSE Linux v8.0 Pro--- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAjzpCW4ACgkQB9vk4ichYXf8awCghDTRrlxr2+grnLW3+9PC8ktv 0IkAoKKbQ6ZeLmrBOVJyui+86CJPAFO7 =aY8e -----END PGP SIGNATURE-----

8 7

Re: [suse-security] striped binaries
by Bill.Light＠kp.org 21 May '02

21 May '02

Yeah - like I'm going to open the attachment. "Theo v. Werkhoven" <twe-suse-sec(a)ferrets4me.xs4all.nl> 05/20/02 02:22 PM To: suse-security(a)suse.com cc: Subject: Re: [suse-security] striped binaries ------ Attachment(s) have been removed ------

4 4

RE: [suse-security] suse security list - another heaven for spam bots
by VANTASSLE, GEORDON M (AIT) 21 May '02

21 May '02

Sounds like it's time to install Spam Assassin! -----Original Message----- From: PW [mailto:subscribed@megapublic.com] Sent: Tuesday, May 21, 2002 12:26 PM To: suse-security(a)suse.com Subject: [suse-security] suse security list - another heaven for spam bots Dear all, We are all grinding today under loads of spam. I was not among the amused as I received the first spam directed to my private E-mail address which, until today, was also my subscription address to the SuSE security list (it has not been published anywhere else). Apparently, a grave mistake. This list with all its messages is archived with the complete headers, mirrored and searchable throughout the net. That of course also attracts the dirty spam bots. In my opinion there should be at least one BIG warning in the subscription confirmation message alerting the user that this list is archived and his E-mail address therefore open to the entire public. I was not aware of this fact as I subscribed. Just a hint. Best regards, Philippe Wiede Megapublic [r], Inc. Gemsberg 11, 4051 Basel, Switzerland www.megapublic.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] Securing SuSE Linux 7.3
by Peer Stefan 21 May '02

21 May '02

hi, > From: Thomas Föcking [mailto:suse@thomas-foecking.de] > Hello! > <SNIP/> > Is this enough to avoid crackers to change my system? I know, > that nothing is > nearly 100% secure, but I think if no one (root included) can > change system > files it should be quite secure also if some breaks into the > system and gets root privileges. a very neat peace of software to keep track of the files is tripwire (md5-sums of all your files) to check which files have been changed since the last checksum. also netfilters like iptables should add to your security. > I think If I'll always install the newest SuSE security > updates the system > would be only a few days unsaved. If then someone would break > into, s/he > could not damage that much, I hope. if someone breaks into your system and adds an account with root-privileges or installs a backdoor or makes sure he/she will be able to enter the system anytime, there is much damage. regards, stefan

2 1

scp withput password
by Dirk Breuer 21 May '02

21 May '02

Hello, I want to use ssh (especially scp and sftp) without being asked for passwords. Can somebody give me a detailed configuration guide: ssh-agent,.. which files must be changed (authorized_keys, ssh_config, ...) . Can sftp and scp handle with x.509 certificates and how can I configure this? Thanks, Dirk Breuer -- Dirk Breuer Forschungszentrum Juelich GmbH e-mail: d.breuer(a)fz-juelich.de ZAM Tel.: +49-(0)2461-61-3628 D-52425 Juelich Germany

2 1

AMaViS
by Achim Lenz 21 May '02

21 May '02

""Anyone been using AMaViS (virus scanning)? If so, how well does it work?""" i don`t know about amavis. so i use "Trend Micro Interscan Virus Wall". and it works fine! the "Virus Wall" scan port-based "smtp-ftp-and http". look at the page from Trend Micro: http://www.antivirus.com/download/register.asp?product_id=36&product_from=is vw after install. you can test it, how it works. look at: http://www.antivirus.com/vinfo/testfiles/ mfg achimAchim Lenz L+L Lieferservice und Logistik GmbH Rheinstraße 10 53560 Vettelschoß Fon: 02645-942-776 Fax: 02645-942-766

2 1

striped binaries
by d_lord＠gmx.de 20 May '02

20 May '02

Hi @ all I' ve got a little question concerning the strip program. My server is not really fast and has very little RAM so I would like to strip some or all binaries. I tested it with ntop so far and it is working quite well as you can see. user@server /test# ll ntop ntop.orig -rwx------- 1 user nobody 18368 May 20 02:29 ntop <-- stripped -rwx------- 1 user nobody 140571 May 20 02:07 ntop.orig user@server /test# I would also like to do this with sshd and some other services my system provides. So now my question is: Does this (stripping a binary) affect security in any way? I think of bufferoverflows etc. Some important information may be lost if I have only 1/10 size. Right or wrong? Thanks for your time and opinion ;-) D. Lord PS.: What does this mailinglist check to verify the email? I can't use my own postfix server even if I specify the right From: adress in mutt. And it's really annoying to go to gmx just to post something to this list! Any hint? -- -- Life is too short to find the easiest way through. Just go straight forward! GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

4 3

Re: [suse-security] AMaViS
by Carlos Campos 20 May '02

20 May '02

Sorry, I have got confused. I thought I was on my spanish list. I said that I used amavis with Mcafee uvscan and It didn't work well. It stop a lot of viruses but when the infected mail traffic was to heavy it, let some viruses pass. Then I try with MailScanner it seems to work better than amavis, but It has just two days working. Good Luck! Carlos ----- Original Message ----- From: Carlos Campos To: suse-security Sent: Monday, May 20, 2002 2:04 PM Subject: Re: [suse-security] AMaViS Yo lo he probado con un sendmail usando McAfee comom antivirus, y no he tenido muy buenos resultados. Funciona, pero cuando el trafico de mails infectados es muy grande deja pasar algunos. Recientemente he probado el MailScanner tambien con McAfee y parece un poco mas robusto. Solo funciona con SendMail y la configuracion no es muy dificil. Suerte Carlos ----- Original Message ----- From: Chad Whitten To: Fred A. Miller ; suse-security Sent: Monday, May 20, 2002 9:59 AM Subject: Re: [suse-security] AMaViS I have just installed RAV antivirus software for sendmail. It is working great. I tried getting amavis working with antivir but just couldnt get enough documentation to get it working. rav antivirus was a snap though and using sendmail's libmilter interface there is almost zero performance loss. http://www.raeinternet.com On Monday 20 May 2002 09:34 am, Fred A. Miller wrote: > Anyone been using AMaViS (virus scanning)? If so, how well does it work? > > Thanks, > > Fred -- Chad Whitten Network/Systems Administrator neXband Communications cwhitten(a)nexband.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Connection from sourceforge after mailing to list
by GertJan Spoelman 20 May '02

20 May '02

Hello list, Does anyone know why sourceforge is doing this everytime I send something to this list? May 17 19:29:13 mail sendmail[576]: NOQUEUE: connect from usw-sf-fw2.sourceforge.net [216.136.171.252] May 17 19:29:13 mail sendmail[576]: g4HHTDY00576: --> 220 mail.gjs.cc ESMTP Sendmail 8.11.3/8.11.3/SuSE Linux 8.11.1-0.5; Fri, 17 May 2002 19:29:13 +0200 May 17 19:29:13 mail sendmail[576]: g4HHTDY00576: <-- HELO usw-sf-list1.sourceforge.net May 17 19:29:13 mail sendmail[576]: g4HHTDY00576: --> 250 mail.gjs.cc Hello usw-sf-fw2.sourceforge.net [216.136.171.252], pleased to meet you May 17 19:29:13 mail sendmail[576]: g4HHTDY00576: <-- MAIL FROM:<> May 17 19:29:13 mail sendmail[577]: g4HHTDY00577: --> 250 2.1.0 <>... Sender ok May 17 19:29:13 mail sendmail[577]: g4HHTDY00577: <-- RCPT TO:<sl(a)gjs.cc> May 17 19:29:13 mail sendmail[577]: g4HHTDY00577: --> 250 2.1.5 <sl(a)gjs.cc>... Recipient ok May 17 19:29:13 mail sendmail[577]: g4HHTDY00577: <-- RSET May 17 19:29:13 mail sendmail[577]: g4HHTDY00577: --> 250 2.0.0 Reset state May 17 19:29:13 mail sendmail[577]: g4HHTDY00577: from=<>, size=0, class=0, nrcpts=1, proto=SMTP, daemon=MTA, relay=usw-sf-fw2.sourceforge.net [216.136.171.252] May 17 19:29:14 mail sendmail[576]: g4HHTDY00576: <-- MAIL FROM:<> May 17 19:29:14 mail sendmail[578]: g4HHTEY00578: --> 250 2.1.0 <>... Sender ok May 17 19:29:14 mail sendmail[578]: g4HHTEY00578: <-- RCPT TO:<postmaster(a)gjs.cc> May 17 19:29:14 mail sendmail[578]: g4HHTEY00578: --> 250 2.1.5 <postmaster(a)gjs.cc>... Recipient ok May 17 19:29:14 mail sendmail[578]: g4HHTEY00578: <-- QUIT May 17 19:29:14 mail sendmail[578]: g4HHTEY00578: --> 221 2.0.0 mail.gjs.cc closing connection May 17 19:29:14 mail sendmail[578]: g4HHTEY00578: from=<>, size=0, class=0, nrcpts=1, proto=SMTP, daemon=MTA, relay=usw-sf-fw2.sourceforge.net [216.136.171.252] -- GertJan

7 10