June 2002 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] OpenSSH ISSUE
by Ryan Swenson 27 Jun '02

27 Jun '02

Hello, OpenSSH has released 3.4 which addresses these security issues with regard to challenge response configuration options,etc etc... It fixes several other issues; there now exists official advisories from www.cert.org,www.openssh.com, and ISS. Perhaps everyone stop wasting their time with 3.3 and obtain 3.4 which is well supported and documented. -----Original Message----- From: Roman Drahtmueller [mailto:draht@suse.de] Sent: Thu 6/27/2002 6:23 AM To: Nico van Eikema Hommes Cc: suse-security(a)suse.com; Olaf Kirch Subject: Re: [suse-security] OpenSSH 3.3p1, HostBasedAuthentication > Hi, > > For the record, or for others using this feature: the helper program > "ssh-keysign", needed for HostBasedAuthentication, is missing in the > OpenSSH 3.3p1 RPM. Actually, there are many things missing, broken or otherwise braindead in this package (this is why some people pay for a linux distribution). Please do not send us the error reports any more. We know that it's broken. If possible, please downgrade to the openssh-2.9.9p2 package if you still have it, or await the packages that we publish soon. No promises wrt the version of these packages. > Best wishes, > > Nico van Eikema Hommes > -- > Dr. N.J.R. van Eikema Hommes Computer-Chemie-Centrum > hommes(a)chemie.uni-erlangen.de Universitaet Erlangen-Nuernberg > Phone: +49-(0)9131-8526532 Naegelsbachstr. 25 > FAX: +49-(0)9131-8526565 91052 Erlangen, Germany Grüße, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - - -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

OpenSSH 3.3p1, HostBasedAuthentication
by Nico van Eikema Hommes 27 Jun '02

27 Jun '02

Hi, For the record, or for others using this feature: the helper program "ssh-keysign", needed for HostBasedAuthentication, is missing in the OpenSSH 3.3p1 RPM. Best wishes, Nico van Eikema Hommes -- Dr. N.J.R. van Eikema Hommes Computer-Chemie-Centrum hommes(a)chemie.uni-erlangen.de Universitaet Erlangen-Nuernberg Phone: +49-(0)9131-8526532 Naegelsbachstr. 25 FAX: +49-(0)9131-8526565 91052 Erlangen, Germany

2 1

RE: [suse-security] Securing Bind9
by Peer Stefan 27 Jun '02

27 Jun '02

hi > From: Patrik Breitenmoser [mailto:pbreitenmoser@festland.ch] > Hi all. > > I've just installed the bind9 nameserver from the suse7.3 CD and then > applayed all patches. > > now the name server ist up and running. > > > my questions is now. what can i do (named.conf, ...) to make > the server more > secure? this depends very much on your configuration. how many clients do you have, do you want to allow all clients to be able to query all domains/zones? what about zone-transfers, what about forwarders, client authentication and so on. please provide some more information about your environment, how many clients, how many zones, what do you want to do with it (apart from "i want to resolve names!" - this is why you set up dns after all, i believe ;-) cheers, stefan

1 0

YaST 2 Online Update Problem?
by Simon Oliver 27 Jun '02

27 Jun '02

I've just installed SuSE 8.0 from DVD. All went well (great work SuSE). So first thing to do was an on-line update via ftp. However, while downloading the patches YaST complains on every patch: "Cannoton check patch [whatever] because the GPG package because the GPG package is not installed or the package diescription is corrupted." I've checked and GPG is installed. What's up? -- Simon Oliver

2 2

SuSefirewall2-ftp
by Carlos Carrera 27 Jun '02

27 Jun '02

Friendo, in FW_MASQ_NETS=172.16.0.0/24,0/0,tcp,21 Allow FTP in NET = 172.16.0.0/24 But NO ALLOW !!!, access FTP failure.. Help me

2 2

ipchains on dynamic ip
by Oliver Block 27 Jun '02

27 Jun '02

Hi everybody, I have a questions. How to allow traffic to a specific port without specifying the ip-address. Does i.e. ipchains -I input -i ippp0 --destination-port 3128 -p tcp -j ACCEPT work? Which other ways a to filter dynamic ip-adresses? tia Oliver Block __________________________________________________________________ Gesendet von Yahoo! Mail - http://mail.yahoo.de Yahoo! präsentiert als offizieller Sponsor das Fußball-Highlight des Jahres: - http://www.FIFAworldcup.com

2 1

Re: [suse-security] ipchains on dynamic ip - P.S.
by BLeonhardt＠analytek.de 27 Jun '02

27 Jun '02

... P.S. : ... but why should you allow 3128 (Proxy) on your ISDN Interface ? ... that's no good idea ! Regards / Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Besuchen Sie uns im Internet unter: http://www.analytek.de Oliver Block <oblock2002(a)yahoo.de> 27.06.02 02:43 An: suse-security(a)suse.com Kopie: Thema: [suse-security] ipchains on dynamic ip Hi everybody, I have a questions. How to allow traffic to a specific port without specifying the ip-address. Does i.e. ipchains -I input -i ippp0 --destination-port 3128 -p tcp -j ACCEPT work? Which other ways a to filter dynamic ip-adresses? tia Oliver Block __________________________________________________________________ Gesendet von Yahoo! Mail - http://mail.yahoo.de Yahoo! präsentiert als offizieller Sponsor das Fußball-Highlight des Jahres: - http://www.FIFAworldcup.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] ipchains on dynamic ip
by BLeonhardt＠analytek.de 27 Jun '02

27 Jun '02

Hi, I think your "skript" should work ... I've made nearly the same rule the iptables / netfilter and is working correctly ... try it ?!? Regards / Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Besuchen Sie uns im Internet unter: http://www.analytek.de Oliver Block <oblock2002(a)yahoo.de> 27.06.02 02:43 An: suse-security(a)suse.com Kopie: Thema: [suse-security] ipchains on dynamic ip Hi everybody, I have a questions. How to allow traffic to a specific port without specifying the ip-address. Does i.e. ipchains -I input -i ippp0 --destination-port 3128 -p tcp -j ACCEPT work? Which other ways a to filter dynamic ip-adresses? tia Oliver Block __________________________________________________________________ Gesendet von Yahoo! Mail - http://mail.yahoo.de Yahoo! präsentiert als offizieller Sponsor das Fußball-Highlight des Jahres: - http://www.FIFAworldcup.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] SuSE Apache patch sufficient?
by Alan Rouse 26 Jun '02

26 Jun '02

>> However, the exploit posted this morning on vulnwatch indicates that >> such an exploit exists against Linux. > > Again: > No, the exploit posted on vulnwatch this morning works agains xBSD > only. If you read the comments in the .c file, you will see their claim that they have exploited this under linux. Quoting below: * However, contrary to what ISS would have you believe, we have * successfully exploited this hole on the following operating systems: * * Sun Solaris 6-8 (sparc/x86) * FreeBSD 4.3-4.5 (x86) * OpenBSD 2.6-3.1 (x86) * Linux (GNU) 2.4 (x86) So either they are bluffing or the eploit does exist. I prefer not to assume the former. And I don't exactly consider these folks a trusted third party.

7 9

libwrap.a in own programmes
by Armin Schöch 26 Jun '02

26 Jun '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi ! I want to use the tcp_wrapper library in my own programmes to make them look at /etc/hosts.allow/deny in order so see whether a network connection should be refused or allowed. Unfortunately, I couldn't find much information about the way of doing this. The man page of "request_init" did help but was not enough. A search with Google didn't help me so now I'm hoping someone on this list could give me a hint where to find more information about the tcp_wrapper library. Any links, docs ? Thanks, Armin - -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: Weitere Infos: siehe http://www.gnupg.org iD8DBQE9GPQsG8Xv4GxznLoRArIAAKDPxFnRpSI7vMj5SrutAEzrUVzb4ACghMuk khlt7i4mhWq8ViIpsExJ72g= =DiYA -----END PGP SIGNATURE-----

3 2