January 2003 - openSUSE Security - openSUSE Mailing Lists

revocation of a pgp-key
by Bruno Leonhardt 22 Jan '03

22 Jan '03

Hi , how do I delete or revoke a key from the key-server if I've lost the pass and have no revocation-cert ? ..:: bruno ::..

2 1

RE: [suse-security] Re: 3 SuSEfirewall2 questions
by Howard, Neal 22 Jan '03

22 Jan '03

In addition to SuSEFirewall2 and Shorewall, there is also Webmin's interface to iptables configuration. The president of our local LUG swears by Webmin's power and flexibility and he gave an impressive demonstration of its iptables manipulation features at our last meeting. Personally I'm uncomfortable with running Webmin on an Internet firewall machine, but maybe someday I'll be convinced that it is secure enough. -----Original Message----- From: Thomas Seliger [mailto:CRJLJAKTJORB@spammotel.com] Sent: Wednesday, January 22, 2003 6:30 AM To: suse-security Subject: [suse-security] Re: 3 SuSEfirewall2 questions Hi, i changed from using SuSEFirewall to Shorewall, its very easy to configure. You have to edit at least 3 files (very simple edits tho), but i found it easier to set up some special things with it than with SuSEFirewall. If you absolutely cant do a thing with SuSEFirewall, try Shorewall. Thats the nice thing with linux, you got the choice ;) Peace, Tom -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

cool
by Nikolisin, Harald 22 Jan '03

22 Jan '03

sorry guys.. false address! -- Mit freundlichen Grüßen / With kind regards Dipl.-Ing. Harald Nikolisin SOFiSTiK AG (Entwicklung)

1 0

Antwort: Re: [suse-security] gpg - question
by BLeonhardt＠analytek.de 22 Jan '03

22 Jan '03

hi, I've tried to import a revocation-cert yesterday - but nothing was happening. The "there haven't been found a changed key or signature" message occur and nothing was done. Okay, I've tried it with GnuPG for Win and an MS Outlook PlugIn from www.gdata.de/gpg/ ( just for tests ). Later I'm going to use it with Pygmy - Mail Client on Red Hat. ..:: bruno ::.. Raymond Leach <raymondl(a)knowledgefactory.co.za> 22.01.03 15:09 Bitte antworten an raymondl An: BLeonhardt(a)analytek.de Kopie: SuSE Security <suse-security(a)suse.com> Thema: Re: [suse-security] gpg - question On Wed, 2003-01-22 at 16:25, BLeonhardt(a)analytek.de wrote: > Hi, > > is anybody using GnuPG for encrypting mail-messages ? > > My Question : > > If I made my private and public key and even a revocation-cert. Is the > revocation-cert used to delete or deactivate my public key ( which has the > sender ) or is it just a info-message for not using this key because it's > insecure / no longer used or anything else ? > To deactivate your public key, you have to 'import' the revocation cert to the key server where your public key resides (if any) or send the revocation cert to everyone you send your public key to and ask them to import it into their keyrings (or just delete the public key from their keyring) > regards, > ..:: bruno ::.. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ( Raymond Leach ) ) Knowledge Factory ( ( ) ) Tel: +27 11 445 8100 ( ( Fax: +27 11 445 8101 ) ) ( ( http://www.knowledgefactory.co.za/ ) ) http://www.saptg.co.za/ ( ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ o o o o .--. .--. | o_o| |o_o | | \_:| |:_/ | / / \\ // \ \ ( | |) (| | ) /`\_ _/'\ /'\_ _/`\ \___)=(___/ \___)=(___/

1 0

Router vs Software Firewall
by Yakov Baghdanov 22 Jan '03

22 Jan '03

This may be a silly question, but if you are using a broadband cable/dsl router does that not work as a firewall? The one I have does not allow for state-full packet filtering, but with port forwarding and other various security options enabled could this replace having a firewall on each desktop? I have 3 machines connecting through this router which also links the internal network. 1 machine is running Windows XP Pro with Zonealarm and the built in firewall up and running. The other is a project gentoo box and my rig is a dual-boot winxpro and SuSE 8.1 box. I have the suse firewall up and running on my box and I'm not sure if that by itself is good enough. I want to get pure-ftp up and running on it and I am concerned about my security. - I am a lu$er and a LUGnut

1 0

Hi, just signed up
by Allen Kenner 22 Jan '03

22 Jan '03

Hello, this is my first message so im not sure if it will work or not, but i wanted to say hi to everyone, i just insalled and started actually using Linux for the first time a few days ago, i like it alot, even though i miss Windows, alot of tools i used for web design only run under that, for the most part i do most of the actual website and design in pure HTML codeing but a few places want me to do sites for them so im trying to get a new computer so i can have a Windows box and a Linux box, (my compuuter wont even load Windows anymore and even after fdisking and fdisk/mbr and booting from Windows CDs it just says it cant install even after deleting all partitions, have no idea why but i do have fun using Linux and its good to learn, id like to become a system admin after college, i just turned 20) iv only had a computer for about 4 years but when i first got it, i couldnt help but mess with everything untill i fuguredout how it all worked. Id sit up all night and all day playing with everything (it was runing Windows 95 and i had no books or manuals to learn from so it was mostly play with and learn why it did what it did how and what exactly made it do that) about 2 years ago i got into computer security and that interests me as it did when i first learned to turn a computer on myself. Well just turning it on and going online wasnt enough for me, i wanted to know what was going on under all that and started reading up on it and learning some basic computer knowledge, sorry for rambling on and being a wee bit off topic but i think every newbie should be aloud to make and introduction mail, its polite :) I do have a question, my computer i bought 3 or so years ago, its a P3 733 MGhz 42.9 GB HD with a cd wr drive and a DVd drive and floppy drive built in, i also have a 100 ZIP drive on it (which i was shocked SuSe found all of them and they all work fine) but are there any free firewalls for Linux for download? i googled and searched threw downloads.com and such and didnt find a thing, if anyone could recommend a few that would be great (iv found search engines work better when you know what your looking for) and also, my sound card doesnt work, Linux found it but i dont think i have drivers for it, i checked the system control area and it said under available Hardware: Sound device : risq Modular Multimedia Controller Type: Sound Device Vendor: rockwell International. Configured: no Available : yes Needed: no i searched for the company website but didnt find anything related to my card and googled it but all i found were replies from a message board with the words in it. Also, when i boot, after it gets to the graphical log in screen, it says theres an error sayinf "Linux Kernel unable to read partition table" i asked a few people and they said it was prolly a Hardware problem with my Hard drive wich is worrying, but Linux works fine, i dont understand it, anyway dont mean to have such a long mail so ill shut up now, have a wonderful day everyone and God Bless:) anyway, anyone that can help me out wouid be much appreciated

3 2

Re: [suse-security] OT pop3 help
by bliss＠attbi.com 22 Jan '03

22 Jan '03

Not to be impolite, but it strikes me that people are starting to use this list for general support by starting their message of with a polite "Excuse me, I know this is OT, but ..." The proper lists for posts such as this are: suse-linux(a)suse.com (german) suse-linux-e(a)suse.com (english) suse-linux-ja(a)suse.com (japanese) suse-linux-s(a)suse.com (spanish) Not trying to be mean or anything. Jim > Hello, > > I know it is OT but hoping one can advice me on: > > strange thing with popper that gives Timeout only at one of the > accounts on a Lan W2 machine that connects to SuSe 7.1. > > Outlook settings as well as Linux are all alike - this account worked > flowless as the rest does, and suddenly the Outlook err 0x8004210A > says the Pop does not answer. > > I cannot finde any trace of anything. > > Pine collects emails from that account - Outlook collects all, except > that one. > > /var/spool/mail/account are all oke > > etc/inetd.conf oke > > telnet localhost 110 - oke pop working > > Password changed & checked > > Any ideas? > > Thank you> Antal > > ++++++++++++++++++++ > Kreorg Oktatóközpont > Hunyadi tér 8, > Budapest 1067 > ++++++++++++++++++++ > kreorg(a)kreorg.hu > http://www.kreorg.hu > ++++++++++++++++++++ > Grid - Erõ a változáshoz. > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 2

3 SuSEfirewall2 questions
by Richard Ems 22 Jan '03

22 Jan '03

Hi list. This is my 2nd try. I hope this time I get some answers ;-) I have 3 questions about SuSEfirewall2. This is a SuSE Linux 8.1 system. 1) What is NEW_FW_MASQ_DEV good for? I have in my /etc/sysconfig/SuSEfirewall2 FW_DEV_EXT="eth0 eth0:3" and FW_MASQ_DEV="$FW_DEV_EXT" but in /sbin/SuSEfirewall2 (from SuSEfirewall2-3.1-26) FW_MASQ_DEV is "filtered" and eth0:3 discarded. So after this filtering I have only FW_MASQ_DEV="eth0". Is this needed/wanted? Why? ========== 2) I'm trying to connect from a public external ip (a) to a private internal masqueraded ip, over the public ip address (b) at eth0:3. From tcpdump on both the external and internal devices, pakets are being correctly forwarded from ext to int, but when responses arrive at the internal device they are being dropped on the last forward_int chain rule. For this to work I have set on /etc/sysconfig/SuSEfirewall2 FW_FORWARD_MASQ="1.2.3.4,192.168.30.15,tcp,2222,22,5.6.7.8" where 1.2.3.4 is the ext source public ip (a) and 5.6.7.8 is the public ip address (b) Does someone have any clue? ========== 3) What do _ext/_int/_dmz mean on forward_xxx or input_xxx ? [forward|input]_pakets_COMING_FORM_xxx or [forward|input]_pakets_GOING_TO_xxx ??? Many thanks, Richard -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

SuSefirewall2 with NAT for several servers.....
by Carlos Carrera 22 Jan '03

22 Jan '03

Hello friends, a question... Has somebody configured their SuSEfirewall2 with several servants that have addresses IP you publish each one?, How does the SuSEfirewall2 differentiate the packages that you/they go like destination to one or another servers if in the variable alone FW_FORWARD_MASQ the address source is placed, later the address private IP of the server inside your LAN? thank you, I hope they respond me..... please.

2 1

RE: [suse-security] SuSEfirewall2 on multiple servers but no "firewall"
by Peer Stefan 22 Jan '03

22 Jan '03

Hi > From: Philipp Rusch [mailto:Philipp.Rusch@rusch-edv.de] > Hi Peter, > When you say "failsafe", did you intend to be redundant through > that setup with multiple servers behind that router ? > Then I would add to the setup that Stefan recommended (which > is the same I would prefer over yours ...;-) ) as follows: > > (|ISP-Router|) > | > ---------(|1st SWITCH|)------------ ... > | | > (|1st Firewall|) (|2nd Firewall|) > | | > ---------(|2nd SWITCH|)------------ ... > | | | > (|Server 1|)(|Server 2|)(|Server 3|) ... > > what you have here is a redundant Setup of your firewall, > if one goes down, the other is taking over the whole traffic. > You don't need a complicated setup for this, in the simplest > way you could do this by adding alternative routes and duplicate > the DNS entries of your firewall (internal and external). > The rest is done by the DNS and its "round robin" should give > you a simple kind of load balancing, if both systems are up. Be carefull with DNS doing the round robin - not every dns resolver can handle more than one ip-address for one name. E.g. Windows 9x/ME strips off all additional ip-addresses. It only uses the first ip-address it gets. Then there is such a thing called name cache. All resolved hosts are stored within this cache for performance reasons. If such a "bad" net-member (using just the first ip of an answer-section and storing this ip into the local resolver-cache) tries to access the "server-in-service", it will get an error like that: "timeout. could not access resource due to connection timeout." > I do this at two sites with very good success and I am able > to do maintenance on that systems, while everybody keeps on > working, without them even noticing my reboots ;-) Same with heartbeat - and you don't have to wait for your ISP to enter another address for the same name ;o) > Regards, Philipp Rusch regards, Stefan

3 2