June 2002 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Securing Bind9
by Reckhard, Tobias 28 Jun '02

28 Jun '02

[restrict recursive queries to trusted clients] > That way only your clients can query and cachepoinoning is > not so likely > anymore. What gives you the impression that this will reduce the likelihood of cache poisoning? Caches are poisoned by wrongly configured or malicious DNS servers, not clients. Tobias PS: The smart-ass response of a djbdns-advocate would, of course, be: the best way to secure your DNS server is to remove any trace of BIND and install djbdns. Of course, nobody wanted to hear that. ;-)

1 0

Securing Bind9
by Patrik Breitenmoser 27 Jun '02

27 Jun '02

Hi all. I've just installed the bind9 nameserver from the suse7.3 CD and then applayed all patches. now the name server ist up and running. my questions is now. what can i do (named.conf, ...) to make the server more secure? thanks a lot patrik Breitenmoser

4 3

RE: [suse-security] Re: [suse-security-announce] SuSE SecurityAnnouncement: OpenSSH (SuSE-SA:2002:023)
by ts 27 Jun '02

27 Jun '02

> Like I said this list sucks! > Ryan, Some individuals can be trying, but that's life. Roman, I have noticed, can be abrupt if he feels the issue has been sufficiently examined and explained. By and large however the SuSE security team is extremely responsive and probably more capable than many competing distros IMO. BUT: Your attacks on these individuals really just demonstrates some immaturity and your insults and racial epithets are embarrassing and disturbing. In this case you are in the wrong and need to make a decision tete-a-tete SuSE quietly and in private without venting everywhere and against everyone.

1 0

CFS Crypto-File Problems
by Ryan Swenson 27 Jun '02

27 Jun '02

Hello, Some of us here use SuSe Linux at each foreign site to provide CFS filesystems to protect a directory containing certificates for all our various java security related certs. Its more or less our Key Escrow. Unfortunately a German co-worker took off for a 5 week vacation, and a system crashed and restarted but never mounted the CFS. Normally in the boot process we are prompted for the passphrase. What can I do to remount the CFS filesystem in the security mount point partion I created. I have a partition all of its own for CFS, the directory exists but has not mounted the filesystem. Where do I begin, to find where CFS is specified, how to mount it, etc. Thanks, Ryan S.

3 2

tricky firewall problem ...
by Martin Schichl 27 Jun '02

27 Jun '02

Dear list, I want to switch to another ISP and as I have a server, i have to run the machine for a while on two completely different IPs (with different gateways). I managed to get the system up with: eth1 = old IP Adress eth2 = new IP Adress standard gateway = gateway of eth1 if i come from inside my machine, everything works OK: ping to IP within new IP-Range: the ping goes across eth2 ping to any other IP-Adress: the ping goes across eth1 BUT: If I ping from an extern machine, I can only reach eth1 If I try to ping eth2 from extern I get following lines in my firewall log: Packet log: input ACCEPT eth2 PROTO=1 129.27.115.31:8 62.99.248.227:0 L=84 S=0x00 I=6768 F=0x0000 T=58 (#16) martian source 1f731b81 for e3f8633e, dev eth2 ll header: 00 4f 49 06 b6 f3 00 a0 c5 47 9e 6a 08 00 -> martian source ... that means, that the firewall does expect a package with this source IP adress via this route ... On the other hand, if I ping eth2 from within our subnet of the new provider it works and if I ping eth1 from here i get the same situation vice versa ... any idea how to handle this? ThanX, Martin ----------------------------------------------------------------- Dipl.-Ing. Martin Schichl SC&C Software, Communication & Consulting GmbH & Co KEG Grottenhofstr. 3, A-8053 Graz Tel. +43/(0)316/265-205, Fax +43/(0)316/265-234 mschichl(a)scc.co.at, http://scc.co.at

1 0

OpenSSH 3.3p1
by Ralf Koch 27 Jun '02

27 Jun '02

Hi list, after updating my OpenSSH installation on a SuSE 7.3 system, md5 passwords no longer work with OpenSSH. Does this mean I have to convert my complete shadow file from md5 to standard crypt passwords, or is there (will there be) a pam fix to solve this issue? Thx in advance, Ralf

4 3

RE: [suse-security] Re: [suse-security-announce] SuSE SecurityAnnouncement: OpenSSH (SuSE-SA:2002:023)
by Ryan Swenson 27 Jun '02

27 Jun '02

Like I said this list sucks! -----Original Message----- From: Stefan Eissing [mailto:stefan.eissing@greenbytes.de] Sent: Thursday, June 27, 2002 10:54 AM To: suse-security(a)suse.com Subject: Re: [suse-security] Re: [suse-security-announce] SuSE SecurityAnnouncement: OpenSSH (SuSE-SA:2002:023) Just for the record: I completely agree with Martin's statement and his analysis of the mail he commented. SuSE is doing a fantastic job and this mailing list and their announcements are very supportive and informative. Thanks to all involved! Regards, Stefan Am Donnerstag den, 27. Juni 2002, um 16:42, schrieb Martin Leweling: > Hi, > > On Thursday 27 June 2002 16:17, Ryan Swenson wrote: >> --- Redhat our neighbor handled this extremely well by putting >> this through >> their QA teams and found that there were many many issues with >> 3.3; they >> found that just by configuring counter-active options in the >> sshd.config >> would prevent such exploits without making the mistake to have their >> customers go to version 3.3 and not in many cases be able to support >> backward compatibility. > > That's not QA. This is just what I call a wait-and-see approach. > Red Hat just waited for the problem to go away, SuSE could have done > that as well. > > ISS and the OpenBSD team are the ones you should blame, for their > very vague and nebulous announcements. > > Anyway, SuSE's announcement was clear enough for me to decide not > to upgrade in the first place but to firewall sshd instead, until > further > clarification concerning the impact of the vulnerability. Personally, > I trust my own intelligence enough to not rely on hand-holding from any > vendor too much. > > I'll skip the rest of your mail since useless flames are not worth > repeating. > > Regards, > Martin > -- > Martin Leweling > Institut fuer Planetologie, WWU Muenster > Wilhelm-Klemm-Str. 10, 48149 Muenster, Germany > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Open-SSH-3.4p1 and Kernel 2.0.x
by Christoph Wegener 27 Jun '02

27 Jun '02

Hi, does anybody have a kernel 2.0.x and Open-SSH-3.4p1 running _WITH_ SepPriv activated?!? I always get an mm error even when compression is turned off... :(( Thanx for any hint Christoph -- .-. Ruhr-Universitaet Bochum /v\ L I N U X Lehrstuhl fuer Biophysik // \\ >Penguin Computing< c/o Christoph Wegener /( )\ Gebaeude ND 04/Nord ^^-^^ D-44780 Bochum, GERMANY Tel: +49 (234) 32-25754 Fax: +49 (234) 32-14626 mailto:cwe@bph.ruhr-uni-bochum.de http://www.bph.ruhr-uni-bochum.de

1 0

RE: [suse-security] OpenSSH Vulnerability and Setting PrivilegeSe paration
by Reckhard, Tobias 27 Jun '02

27 Jun '02

> Again I feel SuSE jumped ahead or in with a knee-jerk > reaction to the alleged OpenBSD/OpenSSH exploit for SSH whose > argument to this moment has been largely unfounded. Until > they have produced enough documentation actually warning of > the exploit and where exactly it does so, it has not even > been made a CVE candidate, released in any official advisory > except SuSE. The Developers of OpenSSH do not even have an > answer themselves but to upgrade to 3.3 for a mere workaround > whereas 3.3 has fundemental issues of its own. ISS and Theo announced a *remote root exploit* in OpenSSH, not giving any information about mitigating factors or any other details. This is a very serious problem. And if there wasn't an exploit out in the wild already, after this announcement it is highly probable that it wouldn't take long for one to appear. On the black-hat side, that is. In the meantime, with the news being out, the only half-solution given was adopted by SuSE very quickly and released to its customers, not few of whom rely on OpenSSH to administer systems across the Internet. > I would wait until its official before getting all too > excited -perhaps look at > http://online.securityfocus.com/advisories/4230 That's exactly what Olaf et al. checked out. I don't see your point. SuSE didn't claim that the new OpenSSH RPMs fix the problem, it was rather clear (at least to me) that they were 'only' patched so as to conform to Theo's recommended mitigator. I see nothing wrong with that. And if you know better, don't update your package, it's not like they're forcing you or anything. I think you'll agree that just because you've got a vendor, that doesn't mean you shouldn't try to make informed decisions of your own about your systems. But it's nice to have prompt assistance from the vendor, SuSE in this case. Tobias

2 1

RE: [suse-security] OpenSSH ISSUE
by Ryan Swenson 27 Jun '02

27 Jun '02

By far it is, it is a great product. For a client and even server implementation also www.appgate.com is nice as well! All Swedish Security is good! :) mindterm is an applet that can be local to your system, or imbedded in your webpage and implements a full ssh1/ssh2 compliant application that supports tcp/udp tunneling and ftp as well. It uses Arcfour and supports AES as well as all 4 modes of DES/3DES. Its free for personal use. The server is not and is expensive as hell as most things in Sweden are. Ryan S. -----Original Message----- From: Stefan Suurmeijer [mailto:stefan@raptorweb.nl] Sent: Thursday, June 27, 2002 8:38 AM To: Ryan Swenson Cc: suse-security(a)suse.com; Olaf Kirch Subject: Re: [suse-security] OpenSSH ISSUE If you're going to go that way you might want to consider the "commercial" ssh version. It's free for non-commercial use (download it from www.ssh.com). Version 3.2 now, and it seems a lot more stable than openssh. Ryan Swenson wrote: >Hello, >OpenSSH has released 3.4 which addresses these security issues with regard to challenge response configuration options,etc etc... It fixes several other issues; there now exists official advisories from www.cert.org,www.openssh.com, and ISS. Perhaps everyone stop wasting their time with 3.3 and obtain 3.4 which is well supported and documented. > > > >

1 0