August 2002 - openSUSE Security - openSUSE Mailing Lists

YOU & Firewall
by Michael Rauter 09 Aug '02

09 Aug '02

Hi Does anybody know, which ports must be open for successful you-update ? I closed all ports and left only the http/s, ftp, ssh, dns ports open. I analyzed the packet trace of my firewall router and see something about port 113 and 333 when starting you. Any hints ? Regards Michael Rauter

6 8

Auto Negotiation with 8.0 (OT)
by david lubowa 09 Aug '02

09 Aug '02

hey guys , i know this is not a security related thing but i am having a problem getting my suse 8.0 auto negotiating i tried setting the speed for my Nic using mii-tool but it failed to recognise the Interface(eth0). Is there another way i can get my Nic to negotiate at a particular speed. thanks Ziggy __________________________________________________ Do You Yahoo!? HotJobs - Search Thousands of New Jobs http://www.hotjobs.com

1 0

RE: Re: [suse-security] Re: Automatically blacklist IP after multiple SSH login failures
by christian.burri＠synecta.ch 09 Aug '02

09 Aug '02

<SNIP> > >No, you don't. If you spoof the IP, you wouldn't be able to get past >the TCP handshake. If you don't have a connection, you couldn't send >a wrong password and so you're unable to lock him out. > >It would be possible if you are in control of the public sites >router, but not for everyone. > </SNIP> I agree that a "true" spoofing of TCP isnt trivial, BUT: What about SOCKS or HTTP proxies? Even the dumb takeover kiddies on IRC know how to "spoof" theyr IPs with proxies. What about ./ any shell provider box with a /16 subnet of IPs assigned? Oh woo. Someone I know usually telnets off some cisco routers... Just my two cents Chris

1 0

Re: [suse-security] need help to limit access of external ssh-users
by GentooRulez 09 Aug '02

09 Aug '02

>I have limited experience in linux but I'll find my way around if >kicked in the right direction, I hope. ;) > >I'd want to open a ssh port to my homebox for external staff and >some friends. I don't suppose they'll try to be funny but safe is >better than sorry. > >For this I created a group "external" and userids like "staff01". >How can I keep them from walking around in my system ? >They should only be able to drop and collect documents which are in >their home-directory. another good idea is to hide the processes of users in (friends|staff) to eachother. to reach this add security kernel patches like grsecurity to your system setup Michael

1 0

Re: [suse-security] need help to limit access of external ssh-users
by GentooRulez 09 Aug '02

09 Aug '02

>I have limited experience in linux but I'll find my way around if >kicked in the right direction, I hope. ;) >I'd want to open a ssh port to my homebox for external staff and >some friends. I don't suppose they'll try to be funny but safe is >better than sorry. >For this I created a group "external" and userids like "staff01". >How can I keep them from walking around in my system ? >They should only be able to drop and collect documents which are in >their home-directory. there are two buzzwords: "restricted shells" and "chroot jails" that should let you go to the right direction. Furthermore you can assign your friends to a group friends and your staff to group staff. Both groups should'nt have any access rights elsewhere but in their homedir. Michael

1 0

need help to limit access of external ssh-users
by Andreas Fiesser 08 Aug '02

08 Aug '02

Hi, I have limited experience in linux but I'll find my way around if kicked in the right direction, I hope. ;) I'd want to open a ssh port to my homebox for external staff and some friends. I don't suppose they'll try to be funny but safe is better than sorry. For this I created a group "external" and userids like "staff01". How can I keep them from walking around in my system ? They should only be able to drop and collect documents which are in their home-directory. I have sshd working and login works, so I only need advice for further security aspects. My system is an up to date SuSE 7.2 Thanks Andreas

1 0

PAM-MODULE locked user out / how to activate?
by isp＠plansee.at 07 Aug '02

07 Aug '02

Hello, I have a server which was made secure by harden_suse and by using the pammodules. I have configured my server in that way that no one can logon as root. Everyone has to logon with his username and than he has to "su -" (users with group wheel). Additional after a user has entered a wrong password five times the account is locked. Now one of my users can't login and in the messages-log I get the message: Aug 7 14:16:10 webspider login[683]: Authentication failure Aug 7 14:16:14 webspider pam_tally[685]: user glsupport (502) tally 21, deny 5 I believe that the user has entered five times the wrong PWD an now the user-account is locked but who can I unlock this account? Thanks and best regards Martin

2 1

Apache update
by Alex Levit 06 Aug '02

06 Aug '02

Here is what I get after today's apache update using YOU, on SuSE MAIL III server. [error] [Tue Jul 30 16:33:29 2002] RefSecMod.pm: Can't locate RefSecMod.pm in @INC (@INC contains: /var/www/perllib /usr/lib/perl5/5.6.0/i586-linux /usr/lib/perl5/5.6.0 /usr/lib/perl5/site_perl/5.6.0/i586-linux /usr/lib/perl5/site_perl/5.6.0 /usr/lib/perl5/site_perl . /var/www/ /var/www/lib/perl) at (eval 156) line 3. [Tue Jul 30 16:33:30 2002] [notice] child pid 31044 exit signal Segmentation fault (11) -- Alex Levit Senior Network Engineer Kel-Tek Inc. TEL: 626-571-6927 FAX: 626-571-8794 'Alex(a)kel-tek.com'

2 1

Squid Problem
by Drew J. Como 06 Aug '02

06 Aug '02

All, I am running the latest version of the Squid package which was released on July 9th. However, when I go to an FTP site, the icons do not show up. I checked on the squid-cache.org site and found that this is a bug in the latest version of the 2.3 package, however when I take a look at the spec file for the SuSE built src package, it says that the fix for this is already in the package. Is anyone else having this same problem? ============================================ Drew J. Como Phone: 631-434-6600 Systems Administrator Fax: 631-434-7800 dcomo(a)bascom.com Web: www.bascom.com Bascom Global Internet Services, Inc. -------------------------------------------- "When quality is the goal, winning is guaranteed."

1 0

sendmail spam
by rutger 06 Aug '02

06 Aug '02

hello list, someone is using our server to send spams. the log: Aug 5 18:33:33 tms sendmail[618]: g75GXVd00616: to=bennyb911@aol.com,bennybad@aol.com, ctladdr=wwwrun (30/65534), delay=00:00:02, xdelay=00:00:01, mailer=esmtp, pri=151214, relay=mailin-04.mx.aol.com. [64.12.137.152], dsn=2.0.0, stat=Sent (OK) the received entry in the returned mail: Received: (from wwwrun@localhost) by tms.screendesign-net.de (8.11.2/8.11.2/SuSE Linux 8.11.1-0.5) id g75EvBW32281; any ideas what to do?? thanx, rutger kontakt: | tel.: 06341/9821252 r.frechen | email: r.frechen(a)gmx.de multimediadesign & | programmierung | ·--/\--· alfred-nobel-platz 1 | / \ 76829 landau | \ / germany | ·--\/--· email: r.frechen(a)gmx.de ___________________________________________________________ "We go where WE want." bye bill

5 7