July 2002 - openSUSE Security - openSUSE Mailing Lists

SuSE personal firewall in 7.3
by Richard Farla 19 Jul '02

19 Jul '02

Greetings all, As newbie and not well know in Linux I use SuSE 7.3 prof. with SuSE personal Firewall. From the, by me, well know Windows-os I use severall firewalls on different pc's. What strikes me is that I have on these Windows-machines allways a easy to read logfile of the firewall. This is something I cannot find on my Linux-machine. I went thru severall logfiles but cannot find anything that says something like : access denied, blocked, refused .... together with ip-addresses and so on. Is their any logfile kept by this personal firewall of SuSE 7.3 and is their, where to look exactly ? Is their also a way to filter out these info. Rits

2 1

Re: [suse-security] Deploy SuSE network infrastructure
by GentooRulez 19 Jul '02

19 Jul '02

>Hi, > I'm Fabrizio and my target is to deploy serveral services on a network of >windows client. >The service ara: >-SMTP>-IMAP>-Samba>-DHCP > >and a authentication service in a network of a windows client. > >My question is: > >What the best authentication infrastructure can I deploy with a SuSE 8.0 >server? >The best is: > > >passwd flat file pam > most fast, hard to implement failover. > >NIS > SuSE YAST config, most Info manage(home etc..), failover, no secure > >Kerberos > No SuSE YAST config, someone tell me strong security, failover. > >LDAP > no useradd or manage application, hard to deploy, secure?? I think no, >not build to make auth, YAST config, failover Me would suggest, the check LDAP again. There are web interfaces for managing it and a lot of docs that describe the coop with samba and other services !!! To secure it check bugs on secorityfocus and so on. btw - what secure are the network transmissions in your windows network - ssl based ? :O) If you want to have a more fast solution without any work, try to click some services on w2k and look goes on ? :O) Yours Michael

2 1

Konqueror
by arawak 19 Jul '02

19 Jul '02

Is it possible to protect your anonymity when browsing on the internet while using Konqueror? Dre Luck is my game ;-) Linux is my aim :)

3 2

Deploy SuSE network infrastructure
by Fabrizio Fabbri 18 Jul '02

18 Jul '02

Hi, I'm Fabrizio and my target is to deploy serveral services on a network of windows client. The service ara: -SMTP -IMAP -Samba -DHCP -... and a authentication service in a network of a windows client. My question is: What the best authentication infrastructure can I deploy with a SuSE 8.0 server? The best is: secure. failover standard SuSE rpm packet, no time to ./compile or config. services integration(with SAMBA SMTP(sendmail) etc..) client friendly with Manage application( YAST2 www application) fast to deploy remote monitor I've valuate some: passwd flat file pam most fast, hard to implement failover. NIS SuSE YAST config, most Info manage(home etc..), failover, no secure Kerberos No SuSE YAST config, someone tell me strong security, failover. LDAP no useradd or manage application, hard to deploy, secure?? I think no, not build to make auth, YAST config, failover What? Can SNMP help me to remote control? HOW? P.S. Sorry for my English. thanks bix

1 0

Re: [suse-security] IDS goes off at /etc
by GentooRulez 18 Jul '02

18 Jul '02

Am 18.07.2002 13:02:32, schrieb Roman Drahtmueller <draht(a)suse.de>: >> Maybe that will be your final solution: >> >> I did following: >> >> google: file hook linux >> >> and got that: >> >> http://www.sysinternals.com/linux/utilities/filemon.shtml >> >> Let me now wether it meet your needs. >> >> Huhu, they wrote that stuff using kylix, so i'll be able to patch it >> down to console if it necessary. > > >I don't think so. It has a few problems: > >1) the license >2) the availiability of the source code >3) the fact that it comes along with a kernel module that sets function > pointers to its own functions to intercept the system calls. This > kernel module can't run reliably. > >We wouldn't ship it, no chance. > It was not the intention, to add it to suse-distri, but the proposal to solve the problem of this discussion for matthias.riese :O) Michael

1 0

Re: [suse-security] IDS goes off at /etc
by GentooRulez 18 Jul '02

18 Jul '02

>> > and it should not be popper. So offer a wider range of the log prior to >> > 22:04, cauze - as roman wrote - e.g. >> > a mount cmd ends up with such modified [c|m]times. >> >> The rest of the log around that time +-1 hour also just consists of >> qrunner and popper log entries, dropped packages from the firewall >> and: >> >> Jul 16 21:59:00 p15089763 /USR/SBIN/CRON[14347]: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly) >> Jul 16 22:59:00 p15089763 /USR/SBIN/CRON[14612]: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly) >> >> There have been definitely NO mounts or umounts. At least not >> regularly each day. Except if any SuSE cron job mounts and umounts >> something regularly? > > >Turn on "fascist" logging, eg allmessages (line in syslog.conf). It could >as well be some mail triggering this, depending on the sickness of some >software (that wouldn't work with ro-mounted /etc). Check _all_ syslogs >from that time. Check if you have an automounter running. At last, use the >tmpwatch package (temp-watch -d /etc) to check, it's more like winning a >race if you want to see something, but still. (Hint for winning the race: >Do "renice -15 $$" as root and _then_ run the temp-watch program. Box gets >sluggish then, of course.) The tool isn't really that smart... > >> Matthias Riese > >Roman. Maybe that will be your final solution: I did following: google: file hook linux and got that: http://www.sysinternals.com/linux/utilities/filemon.shtml Let me now wether it meet your needs. Huhu, they wrote that stuff using kylix, so i'll be able to patch it down to console if it necessary. Michael

2 1

RE: [suse-security] URGENT: SuSE 8.0 freezes when using iptables..
by Andreas Marbet 18 Jul '02

18 Jul '02

> > The reason why I would like to get SuSEfirewall to work is to setup a > firewall without having to learn all about iptables - I'm a > programmer not a > sysadm and just need a setup to protect our office computers. You could try shorewall (www.shorewall.net) as well. This firewall is IMHO much more flexible than SuSEfirewall2 and has a lot of good documentation, but you have to spend a little more time for configuring it. I have it working perfectly here on SuSE 8.0. Andreas

1 0

Port-forwarding
by Z_God 17 Jul '02

17 Jul '02

What is the best way to forward TCP and UDP ports from one computer to another? I have only one ip adress and I want to use programs like WinMX, that require an incomming port, on different computers behind my firewall. I'm using SuSE Linux 7.3 with SuSEfirewall2. Thanks in advance.

3 3

Re: [suse-security] IDS goes off at /etc
by GentooRulez 17 Jul '02

17 Jul '02

>What you have seen is most likely a result of a mount command creating a >temporary file named /etc/mtabXXX (XXXX is arbitrary) when /etc/mtab is >changed. This changes the mtime of the directory inode. >> Charles >> >Roman. and the ctime, too. Did a short test for myself. What exactly says /var/log/messages comes up e.g. at 22:05, charles ? Michael

2 1

IDS goes off at /etc
by Matthias Riese 17 Jul '02

17 Jul '02

Hi, Does anybody know what makes my IDS (tripwire) go off at /etc each other day? No changes otherwise. Just the directory /etc being modified. I suppose something creates and removes again a file in /etc regularly, but can't figure out what it is. changed: drwxr-xr-x root 4096 Jul 16 22:05:13 2002 /etc ... ### Attr Observed (what it is) Expected (what it should be) ### =========== ============================= ============================= /etc st_mtime: Tue Jul 16 22:05:13 2002 Sat Jul 13 11:16:03 2002 st_ctime: Tue Jul 16 22:05:13 2002 Sat Jul 13 11:16:03 2002 Best regards from Bremen, Mit freundlichen Grüßen aus Bremen, Matthias Riese

4 4