August 2002 - openSUSE Security - openSUSE Mailing Lists

NEED: Updated info for "Installation of a Secure Webserver" on SuSE 8.0
by Ken Mumme 09 Aug '02

09 Aug '02

Does anyone out there have updates for the information contained in the "Installation of a Secure Webserver"? I have tried following the checklist contained in the online document, but it appears to be very much out-of-date. Please keep in mind that I am not a Linux expert... so, examples of the needed changes will be most appreciated. Thanks!

1 0

User should be able to start a root-program
by isp＠plansee.at 09 Aug '02

09 Aug '02

Hello, I have a program that runs a root (the program also starts child-prozesses as root). Now there is one user who should be able to start/stop this program. I have tried to give the program-file the s bit -> the users was able to start the program but then he receives a error that the start of the child-prozesses is forbidden. Is there a posibility to start the program without root-rights? Thanks Martin

2 1

Re: [suse-security] Patch Updated via yast ( text version) does n ot work
by Togan Muftuoglu 09 Aug '02

09 Aug '02

* Thomas Wheeler; <ThomasW(a)safine.co.za> on 09 Aug, 2002 wrote: >HI > >I have tried the suggestion below I still get a no patches to install the >yast online update sends me to ftp.suse.de. I a) What do you have as the first server listed in /etc/suseservers using a mirror like the bewlo may help ftp://ftp.gwdg.de/pub/linux/suse/ftp.suse.com/suse b) maybe the whole system is uptodate ? -- Togan Muftuoglu Unofficial SuSE FAQ Maintainer http://dinamizm.ath.cx

1 0

Re: [suse-security] FreeS/wan trough NATing Router
by GentooRulez 09 Aug '02

09 Aug '02

>> 192.168.1.0/24 as Subnet1 --> >> 192.168.1.1 : 10.10.10.1 as FreeS/Wan Router 1--> >> 192.168.10.11 : ext.ip.addr.no1 as external router does nat --> >> INTERNET >> INTERNET <-- ext.ip.addr.no2 : 192.168.2.1 : as FreeS/Wan Router 2 >> 192.168.2.0/24 as Subnet 2 >your config looks screwed to me. I might be misunderstanding you (i cant see >where the hell the ip 10.10.10.1 comes into things, for example), but your >definition of the problem makes no sense. For example, >192.168.10.11 is this machine a gateway? yes, but i do not own it, thats why there comes double NAT in game >whats the gateway at the other end? you dont seem to mention one. ext.ip.addr.no2 : 192.168.2.1 , that does NAT for subnet 2 >Does this mean you dont use NAT the other end? Both FreeS/Wan Router 1 as well as FreeS/Wan Router 1 are my boxes and doing NAT-gateway for Subnet1&2 >but from the ip of the freeswan >machine, you use 192.168.2.1, which means you do use nat, yes? as above >Also, are the ext ip addresses fixed? Yes >in theory, the machines running freeswan would need external (fixed) IP's to communicate. Thats the point here, subnet 1 gets double NATed through 10.10.10.1 and ext.ip.addr.no1 >If they both sites behind nat walls, how does your external router know how to route traffic between the subnets? only one side is behinde a net wall. Just an example 192.168.1.100 to 192.168.2.200 : 192.168.1.100 --- [gateway]---> 192.168.1.1 [NAT] 10.10.10.1 --[gateway]--> 10.10.10.11[NAT] ext.ip.addr.no1 ---> INTERNET ROUTING --->ext.ip.addr.no2 [NAT]192.168.2.1----->[gateway]--->192.168.200.200 I've got no routing problem until know, but the message: initial Main Mode message received on ext.ip.addr.2 :500 but no connection has been authorized Further ideas ??? Thx in advance Michael

1 0

Patch Updated via yast ( text version) does not work
by Thomas Wheeler 09 Aug '02

09 Aug '02

Hi All My yast does not seem to detect the patches via the update from ftp. I do not have kde or gnome on my Suse 8.0 server. Yast does go to the ftp and searches for patches but returns with no updates found. How do I get this to work?.. Regards, Thomas Wheeler -=No Trees Were Harmed By Sending This Email, Only A View Electrons Were Seriously Discomforted =-

2 1

hidden directories
by rutger 09 Aug '02

09 Aug '02

hello list, how can i view 'hidden' directories. i suppose someone found a way to build directories in our common ftp-directory. but root can not easily view them. any hints? thanx, rutger kontakt: | tel.: 06341/9821252 r.frechen | email: r.frechen(a)gmx.de multimediadesign & | programmierung | ·--/\--· alfred-nobel-platz 1 | / \ 76829 landau | \ / germany | ·--\/--· email: r.frechen(a)gmx.de ___________________________________________________________ "We go where WE want."

5 5

FreeS/wan trough NATing Router
by GentooRulez 09 Aug '02

09 Aug '02

Hi list, i googled and rtfm+faq on freeswan.org for some hours but cannot find a solution for the example 192.168.1.0/24 as Subnet1 --> 192.168.1.1 : 10.10.10.1 as FreeS/Wan Router 1--> 192.168.10.11 : ext.ip.addr.no1 as external router does nat --> INTERNET INTERNET <-- ext.ip.addr.no2 : 192.168.2.1 : as FreeS/Wan Router 2 192.168.2.0/24 as Subnet 2 The error is ever the same: packet from ext.ip.addr.no1:xxx: initial Main Mode message received on ext.ip.addr.no2:500 but no connection has been authorized I think the problen is the router that does NAT because FreeS/Wan Router 1 gots an privat IP that not routeable. ipsec.conf on freeS/Wan Router 1 conn snt left=10.10.10.1 leftsubnet=192.168.1.0/24 leftnexthop=192.168.10.11 leftrsasigkey=xxx leftfirewall=yes right=ext.ip.adrr.no2 rightsubnet=192.168.2.0/24 rightnexthop= rightrsasigkey=xxx auto=start ipsec.conf on freeS/Wan Router 2 conn snt left=10.10.10.1 leftsubnet=192.168.1.0/24 leftnexthop=192.168.10.11 leftrsasigkey=xxx leftfirewall=yes right=ext.ip.adrr.no2 rightsubnet=192.168.2.0/24 rightnexthop= rightrsasigkey=xxx auto=add In the FAQ i read, that this error only occurs if left/right or leftsubnet/rightsubnet differs, but they dont. ???? Michael

1 0

Automatically blacklist IP after multiple SSH login failures
by Jeff Stewart 09 Aug '02

09 Aug '02

I'd like to protect myself against dictionary or brute force login attacks. Is there a way within OpenSSH or another package to automatically blacklist an IP address after x number of failed login attempts? Thanks, Jeff Stewart

5 5

AW: [suse-security] Auto Negotiation with 8.0 (OT)
by Ulrich Roth 09 Aug '02

09 Aug '02

Hello Ziggy, > i know this is not a security related thing but i am > having a problem getting my suse 8.0 auto negotiating > > i tried setting the speed for my Nic using mii-tool > but it failed to recognise the Interface(eth0). Is > there another way i can get my Nic to negotiate at a > particular speed. So what do you want? Do you want your NIC to auto-negotiate its speed, as you said in the first paragraph, or do you want to set it to a fixed speed, as you said in the second paragraph? Auto-negotiate means: the NIC finds out which speed the opposite NIC can do, and then sets its own speed to the same speed as the opposite NIC. Normally, you connect your computer to a hub or switch. If the hub or switch can do 100 MBit/sec, the NIC of your computer will set to 100 MBit/sec. If the hub or switch can do only 10 MBit/sec, the NIC will set to 10 MBit/sec. That's called auto-negotiation and should be the default for most NICs. For the NICs from 3Com, for example, always existed a DOS based configuration program. Boot your computer to DOS and start the configuration program to enable or disable auto-negotiation or set the NIC to a fixed speed. But I don't know if other vendors offer also such a tool. Well, most operating systems nowadays should also be able to configure the NIC. I can set the speed of my Win2k machine in the properties of "My network places", but how to do this under Linux, I never tried out. :-( Best regards Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

2 1

RE: [suse-security] SuSE Security Announcement: openssl (SuSE-SA:2002:027)
by Alan Rouse 09 Aug '02

09 Aug '02

So, if I'm using OpenSSH but (otherwise) not OpenSSL, will my remedy require an update of OpenSSH or of OpenSSL, or both? -----Original Message----- From: Olaf Kirch [mailto:okir@suse.de] Sent: Wednesday, July 31, 2002 4:14 AM To: Graham Murray Cc: suse-security(a)suse.com Subject: Re: [suse-security] SuSE Security Announcement: openssl (SuSE-SA:2002:027) On Tue, Jul 30, 2002 at 09:58:43PM +0100, Graham Murray wrote: > Openssh uses openssl. Is openssh vulnerable to any of the openssl > exploits? Potentially, yes. It may be possible to trigger the ASN.1 signedness bug when decoding RSA keys during/after RSA authentication. The other bugs, no, because OpenSSH doesn't use SSL. Olaf -- Olaf Kirch | Anyone who has had to work with X.509 has probably okir(a)suse.de | experienced what can best be described as ---------------+ ISO water torture. -- Peter Gutmann -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2