January 2003 - openSUSE Security - openSUSE Mailing Lists

squid authentication
by Markus Feilner 28 Jan '03

28 Jan '03

Hello List, Sorry for the german mail before - I forgot this is an English list I am running Squid 2.4 with ldap_group_auth in a Windows active Directory Network. It works fine, Clients that are in the WWW_Users group can access the proxy, others can't. What we don't like is: Every user has to authenticate himself actively before accessing the proxy with login/password in a small authentication window. Can't Squid use the authentication data that windows provides? because the user is already logged in in the network, and even windoze sends login/password data, or doesn't it? Thanks! Markus -- Mit freundlichen Grüßen Markus Feilner May you always grok in fullness! Beachten Sie bitte unsere neue Email-Adresse! ------------------------------------------------------------------------------------------------- Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

5 4

Re: [suse-security] squid authentication
by GarUlbricht7＠netscape.net 28 Jan '03

28 Jan '03

Markus: Steffen Dettmer <steffen(a)dett.de> when he wrote the following (see below) said it better than me, but I agree with him. Users tend to complain, but if they use their passwords a lot they memorize them, and just like showing your passport when you cross a border it becomes no big deal (Oh, and my System Admin makes me re-enter mine for similar reasons to what Steffen wrote.) ~Gar >* Raymond Leach wrote on Mon, Jan 27, 2003 at 16:02 +0200: >> Squid supports authentication via helper programs. I'm sure if you look >> hard enough on the net you can find one that will do SMB (windows) >> authentication. > >I don't think that this was the question. He told, the >authentication works, but the users needs to reenter the >password. Well, and maybe the users enter their windows password >in the standard proxy authentication window with basic >authentication - which is transmitted in clear text - even worse, >now there is no need to attack a DC server but a simple traffic >logger can retrieve passwords (you may take a look at >http://sws.dett.de/squid-IP_AUTH.shtml for details ;)). > >Anyway, I cannot answer the question, but I would recommended not >to try so. If a browser can get such important information, >browser attacks like XSS and such would become much more >efficient (but maybe Windows even supports such insecure doing >:)). I would better look how this could be prevented and I >suggest not to transfer such sensitive information in clear to >the proxy. > > >oki, > >Steffen > -- __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

3 2

How can you be sure ...
by Martin Schichl 28 Jan '03

28 Jan '03

Hi - once again ... Sorry, but I want to argue this theme once more, as I think it IS a security problem ... How can you be sure, that the data you have sent to your machine (- the files you have changed on your machine -) are REALLY (not just virtually) written to the harddisk? How can you proof whether your data is on your HDD physically or are just kept in your RAM, because your system cannot write to the HDD for an longer period of time? Is there any command like flush in mysql where you can be sure all data are written to your HDD? Martin ----------------------------------------------------------------- Dipl.-Ing. Martin Schichl SC&C Software, Communication & Consulting GmbH & Co KEG Grottenhofstr. 3, A-8053 Graz Tel. +43/(0)316/265-205, Fax +43/(0)316/265-234 mschichl(a)scc.co.at, http://scc.co.at

2 1

Firewall with Iptables
by Roland T�rk 27 Jan '03

27 Jan '03

Hello, Sorry, my English is not so good! I have write my Firewall with Iptables.I can connect an FTP Server but not make a ls or dir. linux:~ # ftp ftp.suse.com Connected to ftp.suse.com (217.9.113.66). 220 "Welcome to the SuSE ftp server: Please login as user 'ftp'" Name (ftp.suse.com:root): ftp 331 Please send your email address as a password. Password: 230-+----------------------------------------------------------------+ 230-| Welcome to the SuSE Linux FTP archives in Nürnberg Germany | 230-+----------------------------------------------------------------+ 230-+------------------------------+ +------------------------------+ 230-| SuSE Inc. | | SuSE GmbH | 230-| 318 Harrison St. | | Deutschherrnstr. 15-19 | 230-| Oakland, CA 94607 | | 90429 Nuernberg | 230-| USA | | Germany | 230-+------------------------------+ +------------------------------+ 230-| Tel: +1-510-628-3380 | | Tel: +49-911-740530 | 230-| FAX: +1-510-628-3381 | | FAX: +49-911-7417755 | 230-+------------------------------+ +------------------------------+ 230-| http://www.suse.com/ | | http://www.suse.de/ | 230-+------------------------------+ +------------------------------+ 230-Please make sure to read pub/INDEX before sending mail to 230-ftpadmin(a)suse.com 230- 230-User limit: 600 - consider using a mirror-site: 230-http://www.suse.de/en/support/download/ftp/int_mirrors.html (Int.) 230-http://www.suse.de/en/support/download/ftp/germ_mirrors.html (DE) 230- 230-Users from Europe (in particular German universities): 230-ftp://ftp.gwdg.de/pub/linux/suse/ 230-ftp://ftp.leo.org/pub/comp/os/unix/linux/suse/suse/ 230-ftp://ftp.uni-kl.de/pub/linux/suse/ 230- 230-If you are experiencing any problems with this server, please email 230-ftpadmin(a)suse.com. 230- 230 Login successful. Have a lot of fun. Remote system type is UNIX. Using binary mode to transfer files. ftp> dir 200 PORT command successful. Consider using PASV. -------------------------------------------------- -------------------------------------------------- -----snip------ #My Firewall config for FTP # FTP OUT Control-Connection iptables -A OUTPUT -p TCP --sport $p_high --dport ftp -j ACCEPT iptables -A INPUT -p TCP --dport $p_high --sport ftp ! --syn -j ACCEPT # FTP OUT Passive Data-Connection iptables -A OUTPUT -p TCP --sport $p_high --dport $p_high -j ACCEPT iptables -A INPUT -p TCP --dport $p_high --sport $p_high ! --syn -j ACCEPT # MASQUERADING iptables -t nat -A POSTROUTING -o $EXT -j MASQUERADE echo "1" > /proc/sys/net/ipv4/ip_forward echo "1" > /proc/sys/net/ipv4/ip_dynaddr iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i $INT -o $EXT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i $EXT -o $INT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -p ICMP --icmp-type echo-request -j ACCEPT iptables -A FORWARD -o $EXT -p ICMP --icmp-type echo-request -j ACCEPT iptables -A FORWARD -o $EXT -m state --state NEW -p TCP --sport $p_high --dport ftp -j ACCEPT iptables -A FORWARD -o $EXT -m state --state NEW -p TCP --sport $p_high --dport $p_high -j ACCEPT -----snap----- ---------------------------------------------------------------------- ---------------------------------------------------------------------- tcpdump -i ippp0 19:59:13.290242 217.4.250.8.filenet-tms > 213.95.15.193.domain: 2909 A? ftp.suse.com. (30) (DF) 19:59:13.345807 213.95.15.193.domain > 217.4.250.8.filenet-tms: 2909* 1/2/2 A 217.9.113.66 (132) [tos 0x10] 19:59:13.347190 217.4.250.8.35608 > 217.9.113.66.ftp: S 926670463:926670463(0) win 5840 <mss 1460,sackOK,timestamp 52220628 0, 19:59:13.447849 217.9.113.66.ftp > 217.4.250.8.35608: S 840322402:840322402(0) ack 926670464 win 32120 <mss 1460,sackOK,timest 19:59:13.447945 217.4.250.8.35608 > 217.9.113.66.ftp: . ack 1 win 5840 <nop,nop,timestamp 52220638 2286511272> (DF) 19:59:13.518270 217.9.113.66.ftp > 217.4.250.8.35608: P 1:249(248) ack 1 win 32120 <nop,nop,timestamp 2286511282 52220638> (DF 19:59:13.518367 217.4.250.8.35608 > 217.9.113.66.ftp: . ack 249 win 6432 <nop,nop,timestamp 52220645 2286511282> (DF) [tos 0x1 19:59:13.518817 217.4.250.8.35608 > 217.9.113.66.ftp: F 1:1(0) ack 249 win 6432 <nop,nop,timestamp 52220645 2286511282> (DF) [ 19:59:13.525785 217.9.113.66.ftp > 217.4.250.8.35608: F 249:249(0) ack 1 win 32120 <nop,nop,timestamp 2286511282 52220638> (DF 19:59:13.526164 217.4.250.8.35608 > 217.9.113.66.ftp: . ack 250 win 6432 <nop,nop,timestamp 52220646 2286511282> (DF) [tos 0x1 19:59:13.572175 217.9.113.66.ftp > 217.4.250.8.35608: . ack 2 win 32120 <nop,nop,timestamp 2286511290 52220645> (DF) 19:59:20.501533 217.4.250.8.35609 > 217.9.113.66.ftp: S 933158888:933158888(0) win 5840 <mss 1460,sackOK,timestamp 52221343 0, 19:59:20.551516 217.9.113.66.ftp > 217.4.250.8.35609: S 856735184:856735184(0) ack 933158889 win 32120 <mss 1460,sackOK,timest 19:59:20.551613 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 1 win 5840 <nop,nop,timestamp 52221348 2286511987> (DF) 19:59:20.650476 217.9.113.66.ftp > 217.4.250.8.35609: P 1:67(66) ack 1 win 32120 <nop,nop,timestamp 2286511993 52221348> (DF) 19:59:20.650579 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 67 win 5840 <nop,nop,timestamp 52221358 2286511993> (DF) [tos 0x10 19:59:24.856106 217.4.250.8.35609 > 217.9.113.66.ftp: P 1:11(10) ack 67 win 5840 <nop,nop,timestamp 52221778 2286511993> (DF) 19:59:24.896293 217.9.113.66.ftp > 217.4.250.8.35609: . ack 11 win 32120 <nop,nop,timestamp 2286512422 52221778> (DF) 19:59:24.910156 217.9.113.66.ftp > 217.4.250.8.35609: P 67:118(51) ack 11 win 32120 <nop,nop,timestamp 2286512422 52221778> (D 19:59:24.910224 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 118 win 5840 <nop,nop,timestamp 52221784 2286512422> (DF) [tos 0x1 19:59:26.198941 217.4.250.8.35609 > 217.9.113.66.ftp: P 11:25(14) ack 118 win 5840 <nop,nop,timestamp 52221913 2286512422> (DF 19:59:26.261343 217.9.113.66.ftp > 217.4.250.8.35609: P 118:190(72) ack 25 win 32120 <nop,nop,timestamp 2286512557 52221913> ( 19:59:26.261425 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 190 win 5840 <nop,nop,timestamp 52221919 2286512557> (DF) [tos 0x1 19:59:26.277847 217.9.113.66.ftp > 217.4.250.8.35609: P 190:262(72) ack 25 win 32120 <nop,nop,timestamp 2286512557 52221913> ( 19:59:26.277920 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 262 win 5840 <nop,nop,timestamp 52221920 2286512557> (DF) [tos 0x1 19:59:26.294356 217.9.113.66.ftp > 217.4.250.8.35609: P 262:334(72) ack 25 win 32120 <nop,nop,timestamp 2286512557 52221913> ( 19:59:26.294424 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 334 win 5840 <nop,nop,timestamp 52221922 2286512557> (DF) [tos 0x1 19:59:26.310864 217.9.113.66.ftp > 217.4.250.8.35609: P 334:406(72) ack 25 win 32120 <nop,nop,timestamp 2286512557 52221913> ( 19:59:26.310932 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 406 win 5840 <nop,nop,timestamp 52221924 2286512557> (DF) [tos 0x1 19:59:26.521730 217.9.113.66.ftp > 217.4.250.8.35609: P 406:1771(1365) ack 25 win 32120 <nop,nop,timestamp 2286512563 52221919 19:59:26.521806 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 1771 win 8190 <nop,nop,timestamp 52221945 2286512563> (DF) [tos 0x 19:59:26.523495 217.4.250.8.35609 > 217.9.113.66.ftp: P 25:31(6) ack 1771 win 8190 <nop,nop,timestamp 52221945 2286512563> (DF 19:59:26.599132 217.9.113.66.ftp > 217.4.250.8.35609: P 1771:1790(19) ack 31 win 32120 <nop,nop,timestamp 2286512590 52221945> 19:59:26.638231 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 1790 win 8190 <nop,nop,timestamp 52221957 2286512590> (DF) [tos 0x 19:59:29.151684 217.4.250.8.35609 > 217.9.113.66.ftp: P 31:56(25) ack 1790 win 8190 <nop,nop,timestamp 52222208 2286512590> (D 19:59:29.208498 217.9.113.66.ftp > 217.4.250.8.35609: P 1790:1841(51) ack 56 win 32120 <nop,nop,timestamp 2286512852 52222208> 19:59:29.208584 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 1841 win 8190 <nop,nop,timestamp 52222213 2286512852> (DF) [tos 0x 19:59:29.208840 217.4.250.8.35609 > 217.9.113.66.ftp: P 56:62(6) ack 1841 win 8190 <nop,nop,timestamp 52222213 2286512852> (DF 19:59:29.257378 217.9.113.66.ftp-data > 217.4.250.8.35610: S 870057160:870057160(0) win 32120 <mss 1460,sackOK,timestamp 22865 19:59:29.325064 217.9.113.66.ftp > 217.4.250.8.35609: . ack 62 win 32120 <nop,nop,timestamp 2286512860 52222213> (DF) 19:59:32.304569 217.9.113.66.ftp-data > 217.4.250.8.35610: S 870057160:870057160(0) win 32120 <mss 1460,sackOK,timestamp 22865 Which Ports must I open? Thanks for Your config or Help Roland

4 3

Secure root alias logins
by keith.anthony.roberts＠bigfoot.com 27 Jan '03

27 Jan '03

Hi again everyone! Thanks to ALL that responded to my query on changing the name for the root user. Some very interesting replies indeed! I have a new installation of SuSE 8.1 professional to do ASAP. May try some of your suggestions then, with a clean installation. I'll keep you posted (if you'll pardon the pun!) Thanks again Keith Roberts Surely it would be more difficult for any attacker to break into Linux if they did not know the username for the root account? I just wondered if it was possible to make root logins MUCH more secure with the following suggestions. When a NEW installation of Linux is done, allow the root user to select their -*OWN*- unique username for the root account in YaST, instead of the default 'root' username. Disallow the use of username 'root' for ALL root superuser logins. When a superuser logs-in they provide their unique username that they choose when installing Linux eg. under YaST. Each login program would need to be modified to reject the username of 'root'. The login program then checks say, password file for the unique root alias name (provided by superuser at installation time) and matches this up with the root account. If a matching root alias and a valid password for that alias name are present, then the superuser gets logged into the root account. The root account need not be touched in any way. The superuser alias name is just used as a 'WRAPPER' to protect the username of root for login purposes only. Would this be feasable to implement? This may have been implemented already. If it has - please let me know. Thankyou - Keith Roberts.

3 4

Re: [suse-security] Files ACLs
by Fabiano Felix 27 Jan '03

27 Jan '03

I'm sorry, but I'm take confused... the version which is standard supported is SLES 8.0. But the 8.1 kernel have the support, you made active it. See the article bellow: http://sdb.suse.de/en/sdb/html/81_acl.html Regards, Fabiano On Mon, 2003-01-27 at 16:09, Listas de Correo wrote: > On 27 Jan 2003 14:14:10 -0200 > Fabiano Felix <felix(a)getnet.com.br> wrote: > > |Hi Markus, > | > |In SuSE 8.1, Reiserfs also have support to ACLs... > | > |Regards, > | > |Fabiano > | > [snip] > > Hi Fabiano, > > I wasn't able to find any documentation about this in SuSE 8.1 Adm. Guide, do u' know where can i find any documentation about ACL's over Raiserfs in SuSE ? > > Googling for "SuSE + Reiserfs + ACL" only gives me a reiserfs-acl.diff, but this is a production server and I don't want to experiment with it. > > thanks, > > Jorge Buchmann

1 0

hosts.deny
by Wouter 27 Jan '03

27 Jan '03

Hi, I try to black al the incoming conecctions to pop3 in hosts.deny. Only it dont works... When i try it whit ssh there is no problem. I would like to block whit hosts.deny all the pop3 and i will add a few hosts in hosts.allow who are allowed for pop3. Is it also poselebel to do this whit iptables ? Can i see if your host ends whit *.ISP.nl you have access tot the pop server ? Greets Wouter

4 4

Re: [suse-security] Strange behaviour ...
by Martin Schichl 27 Jan '03

27 Jan '03

Thanks Andreas ... For the others: sorry, I've forgotten to say ... I did of course a df ... and both disks (/ and /home) still have enough free space ... although the fsck did not bring any strange results ... At 16:48 27.01.2003 +0100, you wrote: >check, if your disk is full. >#df -h > >andreas ----------------------------------------------------------------- Dipl.-Ing. Martin Schichl SC&C Software, Communication & Consulting GmbH & Co KEG Grottenhofstr. 3, A-8053 Graz Tel. +43/(0)316/265-205, Fax +43/(0)316/265-234 mschichl(a)scc.co.at, http://scc.co.at

2 2

Files ACLs
by Listas de Correo 27 Jan '03

27 Jan '03

I used to work with AIX where i have ACLs (base and extended) for files. Seems not to be acledit or lsacl commands here. Is there any implementation for doing this with SuSE Linux ? Thanks in advance -- Jorge D. Buchmann | jbuchmann(a)intraredes.com | intraRedes S.R.L. | http://www.intraredes.com

3 2

closing ports
by Allen Kenner 27 Jan '03

27 Jan '03

Hi, today i did an nmap on myself and it said i had 3 ports open, Port State Service 22/tcp Open ssh 111/tcp Open sunrpc 6000/tcp Open X11 it said these were open, my question is, how can i close these? i dont run a server, just a desktop that i use for...well alot, but i dont use a server and dont have one running, i do use SSH to access my friends network sometimes but thats about it. i was RTFM and found out a wee bit about these ports but it wasnt much more than what Nmap said, any suggestions? -- Kill the lights, let the candles burn behind the pumpkins’ mischievous grins, And let the skeletons dance. For one thing is certain, The Misfits have returned And once again everyday is Halloween.

2 1