June 2002 - openSUSE Security - openSUSE Mailing Lists

MTA with options
by E. Scichilone 13 Jun '02

13 Jun '02

Hello list, does anyone of this list knows a MTA, which can act also as a MDA with the following options: - if mail for userx arrives, check, if host A is up and send a signal (RPC ?) to the client to fetch the mail, be it an Apple, PC or a Linux system - automatically de-/encrypt mails. I just wondered, if it is possible, because the MTA would have to send the pub.key to everyone it is sending mail to... Is that right? - only use encrypted transfer, within a heterogen network with Linux-clients, Apples and PC´s. Would you use TLS? It does not matter, which MTA to use, I would thank for any tip and hint. Thank you in advance, I hope this is not OT. Enrico --

2 1

RSBAC/390 - Rule Set Based Access Control for S/390
by Matthias Jänichen 13 Jun '02

13 Jun '02

Hi, picking up the thread on "NSA SELinux" again: At 14:27 31.05.02 +0200, Mark Müller wrote: >Matthias Jänichen wrote: >>If you need something to use today you should look at www.rsbac.org. >>RSBAC (Rule Set Based Access Controll) is _working_ on Suse, >>running for over two years on productive systems. >We've looked at LIDS, RSBAC and SELinux and decided to give SELinux a >chance. RSBAC is easier to install, but it lacks LSM support and we don't >know where RSBAC is going after Amon has finished its master thesis. For his PhD(!) thesis the conceptual work on RSBAC is much more important. Nevertheless the requested support for LSM has been discussed. Until LSM development settles down he decided to concentrate on the existing implementation based on kernel patches. This is necessary to provide support for the various existing installations. At the moment LSM does not provide enough so that many features would either need to be dropped or would need patches again. After announcement of Version 1.2.0 on the e-open event in Prague Amon has directly started with Version 1.2.1. He has prepared RSBAC 1.2.1pre1 for download at www.RSBAC.org . Due to great interest he implemented architecture support for Linux S/390 and is now looking for pilot installations and/or hardware. Anyone who could help here should get in contact with him directly (Amon Ott <ao(a)rsbac.org>). We expect this to become an important proof of portability and of the concept to even satisfy the needs for big installations. Reg. Matthias Jänichen

1 0

crypt
by Oliver Block 13 Jun '02

13 Jun '02

Hello, I'm running Linux and discovered the following: perl -e "print crypt('thelonger', 'xy');" leads to output: xyCf30g5Eb0U. perl -e "print crypt('thelongerthebetter', 'xy');" leads to output: xyCf30g5Eb0U. actually perl -e "print crypt('thelonge', 'xy');" leads to output: xyCf30g5Eb0U. everything longer than 8 characters seems to be ignored. Or did I make any mistake??? Bye Oliver __________________________________________________________________ Gesendet von Yahoo! Mail - http://mail.yahoo.de Kreative Köpfe gesucht! Machen Sie mit beim Yahoo! SMS Literatur Wettbewerb und gewinnen Sie tolle Preise - http://smswettbewerb.yahoo.de

2 2

susefirewall2 logfile entry
by Wolfgang Schaefer 13 Jun '02

13 Jun '02

hi, how can i change the logfile entry's to the old style? since 3 month i have suse8 and susefirewall2 in use. all works fine, but the style of the logfile entry's is not the same like susefirewall"1" !! how can i change FW_LOG="..." too get the old style or better, ... like this: "time accept/deny source:port destination:port" regards wolfgang

2 3

RE: [suse-security] Automaticaly encrypting outgoing eMail
by Reckhard, Tobias 13 Jun '02

13 Jun '02

Hi Andreas > > I don't know about that tool, but I don't see any problem > in simply calling > > GPG after you've generated the email body to encrypt (and > perhaps sign) > > that, whereafter you can pass it to the MTA. > > Wouldn't that mean that I have to change the script that > generates the eMail? Not necessarily. You do need to change it if the script calls the MTA. If it doesn't, but, for example, dumps the email to a file where a cron job collects it, you don't. > This is what I can't / not supposed to do. You weren't very explicit in your original email. You'd written: >>> Because I am not supposed to change the application I am >>> looking for a tool >>> that sits in between the generation of the eMail and the MTA. Which is exactly what my proposed solution does (sit in between email generation and the MTA). It is unclear to me what the application that you shan't change does. Cheers Tobias

1 0

RE: [suse-security] Automaticaly encrypting outgoing eMail
by Reckhard, Tobias 13 Jun '02

13 Jun '02

> When pressing send the data gathered through that form has to > be send by > eMail. > > This eMail has to be encrypted. > > Because I am not supposed to change the application I am > looking for a tool > that sits in between the generation of the eMail and the MTA. > > A search on Google showed pgpsendmail quite a few times. Is > this tool any > good? I don't know about that tool, but I don't see any problem in simply calling GPG after you've generated the email body to encrypt (and perhaps sign) that, whereafter you can pass it to the MTA. Tobias

2 1

Fwd: Re: [suse-security] crypt
by Carsten Meyer 12 Jun '02

12 Jun '02

> Hello, > > I'm running Linux and discovered the following: > > perl -e "print crypt('thelonger', 'xy');" > leads to output: xyCf30g5Eb0U. > > perl -e "print crypt('thelongerthebetter', 'xy');" > leads to output: xyCf30g5Eb0U. > > actually > perl -e "print crypt('thelonge', 'xy');" > leads to output: xyCf30g5Eb0U. > > everything longer than 8 characters seems to be > ignored. Or did I make any mistake??? lets have a look at crypt manpage: (man crypt) DESCRIPTION crypt is the password encryption function. It is based on the Data Encryption Standard algorithm with variations intended (among other things) to discourage use of hardware implementations of a key search. key is a user's typed password. salt is a two-character string chosen from the set [a-zA-Z0-9./]. This string is used to perturb the algorithm in one of 4096 different ways. By taking the lowest 7 bit of each character of the key, a 56-bit key is obtained. This 56-bit key is used to encrypt ------ wich means 56-bit-key / 7bit per char => 8 characters are used (not more!) ------ repeatedly a constant string (usually a string consisting of all zeros). The returned value points to the encrypted password, a series of 13 printable ASCII characters (the first two characters represent the salt itself). The return value points to static data whose content is overwritten by each call. Warning: The key space consists of 2**56 equal 7.2e16 possible values. Exhaustive searches of this key space are possi ble using massively parallel computers. Software, such as crack(1), is available which will search the portion of this key space that is generally used by humans for passwords. Hence, password selection should, at minimum, avoid common words and names. The use of a passwd(1) program that checks for crackable passwords during the selection process is recommended. ... -- Carsten Meyer

1 0

Resetting Firewall2
by GrdnWsl 12 Jun '02

12 Jun '02

I'm not sure if this is the right list to post this to, but it's the closest one I could find on Suse's site. I have a question regarding reloading the Firewall2 scripts. Currently, whenever I make a change to my firewall scripts I restart the whole firewall. Is there a way to just reastart the firewall script itself, without having to restart the whole machine? Something like a "rcfirewall restart" command. Thanks in advance. -- Preston Kutzner | IT Manager Marketing Resources, Inc. This e-mail (and any attachments) is confidential and may contain personal views which are not the views of Marketing Resources, Inc. unless specifically stated. If you have received it in error, please delete it from your system, do not use, copy or disclose the information in any way nor act in reliance on it and notify the sender immediately. Please note that Marketing Resources, Inc. monitors e-mails sent or received. Further communication will signify your consent to this.

7 7

Resetting Firewall2 Solved...
by GrdnWsl 12 Jun '02

12 Jun '02

Thanks for all your answers. I found the best way for my configuration was to create and runn the shell script in an email that was sent directly to me... basically it stops the firewall, then runs the 3 startup scripts in order. #!/bin/sh /etc/init.d/SuSEfirewall2_setup stop /etc/init.d/SuSEfirewall2_init start /etc/init.d/SuSEfirewall2_setup start /etc/init.d/SuSEfirewall2_final start # end This works fine. For some reason some of the other suggestions didn't re-read /etc/rc.config.d/firewall2.rc.config when I did them. It might be only my system, or it might be that they aren't meant to do that. Either way, thanks for the help! -- Preston Kutzner | IT Manager Marketing Resources, Inc. This e-mail (and any attachments) is confidential and may contain personal views which are not the views of Marketing Resources, Inc. unless specifically stated. If you have received it in error, please delete it from your system, do not use, copy or disclose the information in any way nor act in reliance on it and notify the sender immediately. Please note that Marketing Resources, Inc. monitors e-mails sent or received. Further communication will signify your consent to this.

1 0

Automaticaly encrypting outgoing eMail
by Andreas Otto 12 Jun '02

12 Jun '02

Hi, I have the following scenario: User fills in a form on a webpage, access to that page is only possible using https. When pressing send the data gathered through that form has to be send by eMail. This eMail has to be encrypted. Because I am not supposed to change the application I am looking for a tool that sits in between the generation of the eMail and the MTA. A search on Google showed pgpsendmail quite a few times. Is this tool any good? Cheers, Andreas -- Andreas Otto <andreas(a)php4win.de> Using PHP on Windows? www.php4win.de

1 0