September 2002 - openSUSE Security - openSUSE Mailing Lists

IP aliasing and SuSE Firewall
by Chris Herrnberger 29 Sep '02

29 Sep '02

Greetings: I need to setup a suse firewall to protect 6 IP based virtual sites. There are no options to switching to named sites. Its the firewall that I dont have a lot of experience with and I was wondering what is the best way to address the aliasing. What my concern is that if I use ifconfig eth0:xxx method to alias the six addresses and then port forward:80 to the masqued server what effect if any will the alias's have on the firewall functionality.?? Is this the best way to address this or are their alternatives. Basic setup is very simple. ISP---->{firewall and masq] | |---------------------server 10.10.0.0.1(eg) | (video and mysql) | |--------------------server 10.10.0.2 (eg) Apache 6 IP based VH's Many thanks for any advice. /ch

1 0

chgrp su to wheel
by Susan Buczak 29 Sep '02

29 Sep '02

So ok anyone know how to chgrp su to wheel on suse8.0 and have it maintain the group wheel on reboot? as it is Yast ( or something)rewrites it's own desired config everytime I reboot... yesy I did chgrp as root... but the system doesn't listen to root it listens to yast... I don't want all users using su, just a couple...

2 1

AW: [suse-security] iptables --status
by mailinglists＠belfin.ch 29 Sep '02

29 Sep '02

do you mean iptables -L -n -v [-t nat]? > -----Ursprüngliche Nachricht----- > Von: Susan Buczak [mailto:sbuczak2@comcast.net] > Gesendet: Sonntag, 29. September 2002 19:41 > An: suse-security > Betreff: [suse-security] iptables --status > > > anybody know the proper command for iptables --list or > --status on suse8.0? > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

what a relief
by Susan Buczak 29 Sep '02

29 Sep '02

I worked 5-6 days just trying to figure that one simple thing out so i could safely test our connection which praise God WORKS! I have searched every single suse database and help file in existence and not one of them tells you how to turn on the personal-firewall the first time... but there's lots of info about kmail... geez...

1 0

Re: [suse-security] RE: initiate personal-firewall
by Susan Buczak 29 Sep '02

29 Sep '02

Ok you have to go into /etc/sysconfig and edit the file manually to start, there isn't a Yast2 link to it...or even a hint which would have saved me 2 days of searching... then run /sbin/SuSEconfig which will update the system config because it's in that folder... now any ideas for updating other /etc files such as /etc/security/access.conf because they aren't in /etc/sysconfig and yast doesn't know they exist... neither does the rest of the system... which far as i can tell is still leaving us with a major security breach...as to who can attempt login or not when personal-firewall is not active... I am pretty sure I read somewhere about linking files to sysconfig... anyone know for sure? so essentially I am assuming you have to then turn personal-firewall off and on either by editing it's sysconfig file or using run-level... as yast crazy as this machine is you would think there would be simply... a button. nonetheless.

1 0

RE: [suse-security] Securityaspects of mysql
by Arjen De Landgraaf 29 Sep '02

29 Sep '02

Hi Ruprecht, At the www.e-secure-db.us site you can check out all current and historical vulnerabilties of MySQl. Location: Folder - MySQl Vulnerabilities: http://www.e-secure-db.us/dscgi/ds.py/View/Collection-853 It is contained in a parent folder: Databases and SQL related vulnerabilities: http://www.e-secure-db.us/dscgi/ds.py/View/Collection-55 where you can find all major (and many other) databases and what vulnerabilities on each one has been recorded. Information on SQl injection etc vulns and methods is located in: http://www.e-secure-db.us/dscgi/ds.py/View/Collection-1451 Have fun with the site; you will find thousands of other IT Security subjects and let me know how you go. Best regards, Arjen de Landgraaf New Zealand www.e-secure-it.us -----Original Message----- From: Ruprecht Helms [mailto:rhelms@mayn.de] Sent: Sunday, 29 September 2002 8:07 p.m. To: suse-security(a)suse.com Subject: [suse-security] Securityaspects of mysql Hi, I want to know how secure is mysql. At the moment I'm contaced by a firm for planing a database with connections to a department in spain in a few years. So I've some points that are interessting to me. How secure is the securitymanager of mysql? How secure are the content in the database saved internal? How secure is the communication between mysqlserver and mysql-client? What is nessessary for security for using the database in the internet. The internetpart is used by customers and the external stuff of the firm. How can I secure the communication between the firms headquarter and the department in spain. Regards, Ruprecht ------------------------------------------------------------ Ruprecht Helms IT-Service und Softwareentwicklung Tel/Fax: +49[0]7621 16 99 16 email: info(a)rheyn.de Homepage: http://www.rheyn.de ------------------------------------------------------------- -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Securityaspects of mysql
by Ruprecht Helms 29 Sep '02

29 Sep '02

Hi, I want to know how secure is mysql. At the moment I'm contaced by a firm for planing a database with connections to a department in spain in a few years. So I've some points that are interessting to me. How secure is the securitymanager of mysql? How secure are the content in the database saved internal? How secure is the communication between mysqlserver and mysql-client? What is nessessary for security for using the database in the internet. The internetpart is used by customers and the external stuff of the firm. How can I secure the communication between the firms headquarter and the department in spain. Regards, Ruprecht ------------------------------------------------------------ Ruprecht Helms IT-Service und Softwareentwicklung Tel/Fax: +49[0]7621 16 99 16 email: info(a)rheyn.de Homepage: http://www.rheyn.de -------------------------------------------------------------

1 0

Libsafe
by Richard Ibbotson 28 Sep '02

28 Sep '02

Hi Just wanted to ask what might or might not be a simple question. I've installed libsafe-2.0-9.i386.rpm into an SuSE 8.0 firewall box that I've created. This is attached to an ISDN line which runs a local community project. Win98 machines on the internal network. Can't find any documents about using Libsafe with SuSE software. Do I need to do any more configuration or will it be fine as it is ? Do I need to change any configuration files ? -- Thanks Richard www.sheflug.co.uk

1 0

LDAP, Novell and Squid
by Thomas Wheeler 28 Sep '02

28 Sep '02

Hi All Is it possible to get squid to use ldap to authenticate users via novell. I want it implement a squid but I want users to enter there username and passwords with out giving them a new set of usernames and passwords and confusing my minions. has any one out there done this kind of implementation yet ? Regards Thomas Wheeler

5 4

router-problem ?
by Glenn Remstedt 28 Sep '02

28 Sep '02

hi list, could be that I´m in the wrong list. The situation; See attached Network-layout A wireless network made up of 3 Cisco Aironet APs is connected to a Nomadix USG gateway. The Nomadix is connected to the Internet via an MXStream connection. The wireless network is working correctly; the only problem lies "outside" or upstream of the Nomadix. The Nomadix requires 2 public IP addresses. The MXStream connection only provides one single IP address. In order to get around this, we have placed a Netopia Router between the ADSL modem and the Nomadix. This router is performing Network Address Translation. The Nomadix also provides an SMTP redirect function. This means that regardless of the SMTP settings of the end user, the nomadix sends all outgoing email to the SMTP server of the local ISP, meaning that the end user does not need to change his or her SMTP server at each different location. In some cases (in my experience about 10% of cases), the end user cannot send email. The following is the issue who point-out the problem: 1) I could send very short mails (4 lines or so) 2) anything beyond that did not work. 3) telnet to relay.versatel.se on port 25 was handled by smtpzilla1.xs4all.se (as it should) 4) "ethereal" did tell me that the communication with the mail server the Nomadix did emit messages that looked it came from relay.versatel.se 5) however I also saw equally frequent messages from 10.0.1.1 (the Netopia) that told me (on icmp) that the host was not reachable. I assume that this mightily confuses the IP stack (at lease the WinXP one). What is puzzling me is the fact that the netopia sees these messages at all. Mail client was configured to send via relay.versatel.se This was correctly diverted to smtpzilla1.xs4all.se (the smtp server of our ISP). However a network analyzer detected error messages coming back from the Netopia router. The problem then, as I see it, is that the netopia router is not correctly configured to do NAT - it is in fact doing NAT, but it is interfering with email, which it should not do. Please note that MXStream uses the PPTP protocol, so the router needs to be able to terminate a PPTP connection. Any suggestion are most appreciated. // glenn

1 0