October 2003 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Old question: what is SUSE going to do with harden_suse / Bastille
by Bo Jacobsen 28 Oct '03

28 Oct '03

> Hi, > > Am Samstag, 25. Oktober 2003 02:04 schrieb Bo Jacobsen: > > The standard SuSE installation is much to open. > > I agree upon that. But instead of hardening the system _after_ it has > already been set up, I'd prefer a clean install that's not "too open". > Maybe SuSE can introduce an install option such as "secure system" or > something similar. > > If only that fsck'ing portmapper wouldn't be run by default. That is the > same ...stuff like MS Windows with RPC bound to anything looking like > an interface -- remember W32/Blaster? Each time I set up a SuSE, I get > angry about that idiocy. > > Best wishes, > Lutz > I agree 100%. They need an install option named firewall, or some thing like that, that leaves out ANY stuff that should not run on a firewall. I actually find it a little strange that they have not implemented that a long time ago, since security has been a hot topic for a long time now. One of the advantages of being able to run a separate script like hardensuse, is that if something will not run, it can be difficult to figure out if it's a problem with the tightened security, or if it's something else. I have had some problems in the past, where something would not run after executing hardenSuSE, but I knew it had something to do with the things the script did, so I just had to run hardensuse step-by-step to find out what system changes caused the problem. Another advantage was that I could run hardensuse on systems that was used as normal file, print and email servers. I just had to NOT select the security options that I new would disrupt the programs running on the server, or I could just make changes afterwoods, to the specific programs. However implemented, it would be a lot better then the situation we have today where there is s no official, and simple, way to upgrade the security of a SuSE host. The normal SuSE installation even have world-read permission on all files in /root !!!. I find that more then a little open. Actually, SuSE's lack of priority on basic system secutity tools, has forced me to start looking at other systems like FreeBSD etc. Bo

3 3

SUSE 9 in Germany
by Ian David Laws 27 Oct '03

27 Oct '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello everyone,. Would just like to inform u. that in the Mayersche book store in German they are selling SUSE 9 professional for €64.99 and the Personal for €49.95 as special offer until 15.1103 I think that is the date I saw but do not quote me. On there Internet side it is not published. So get of your bum and go get it. Ian - -- A child of five would understand this. Send someone to fetch a child of five. Groucho Marx - ---------------------------------------------------- This mail has been scanned for virus by AntiVir for UNIX Copyright (C) 1994-2003 by H+BEDV Datentechnik GmbH. PGP ID: 589F8449 Fingerprint: EB1C FACF 6BEB 540E 8AC0 F04E 2A25 A2F1 589F 8449 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE/nVpaKiWi8VifhEkRAuNqAKCIz/hKdOHPfaKemf8dIDln+SjixACeNe2k FutWKxmnQzKuNSiPlfcswC0= =5yAf -----END PGP SIGNATURE-----

1 0

Cannot access SuSE 9.0 through PuTTY
by Radu Voicu 27 Oct '03

27 Oct '03

Hi there! I am trying to access my machine at work with PuTTY (the latest version) and I keep obtaining "access denied"... though, I can connect from any machine running Linux... so... what's wrong in this picture? :) Regards, Radu

6 9

About "opiekeys" in sendmail-Suse8.2 logs
by J.J. Gallardo 27 Oct '03

27 Oct '03

Hi: I have a machine running SuSE 8.2-2.4.20-64GB-SMP with sendmail-8.12.7-77. My file "/var/log/messages" (not mail) shows this ========= Oct 26 10:53:59 mxserver sendmail[1368]: OTP unavailable because can't read/write key database /etc/opiekeys: No such file or directory ========= since the last days but sendmail is running (sending and receiving) and seems to do it normally.I don't know the meaning of this log messages. There isn's any file named "/etc/opiekeys" in the system and searching at /etc/sendmail.cf, /etc/sysconfig/(send)mail i can't see anything relationed with this. Anybody knows the meaning of this log?

3 3

Re: [suse-security] SuSEfirewall2, two links and routing between them
by Fabiano Felix 27 Oct '03

27 Oct '03

Hi Marcelo, The only problem that I'm having is the describe into the first message, because this I believe that my setup is correct ("I" believe ;)) )... Well, I sent my configuration below: " FW_QUICKMODE="no" FW_DEV_EXT="eth0 eth1" # I have two Internet links FW_DEV_INT="eth2" # I have a DMZ and a LAN FW_DEV_DMZ="eth3" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24 192.168.1.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="22 80" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="80 3128" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="192.168.0.0/24 200.171.207.195" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="0/0,192.168.1.2,tcp,5000 \ 0/0,192.168.1.2,tcp,1115" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="no" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV="" " Regards, Fabiano Felix Em Sex, 2003-10-24 às 15:09, Unidad de Soporte Técnico del Instituto Crandon escreveu: > some questions about that . . . > > * did you enable routing between dmz, internal and external nets ? > * did you allow the correct services in the dmz interface ? > > anycase, if you want, send me your firewall conf file so that I can help you > beter > > Greetings > Marcelo. > -- Original Message -- > From: "Fabiano Felix" <felix(a)getnet.com.br> > To: <suse-security(a)suse.com> > Sent: Friday, October 24, 2003 1:44 PM > Subject: [suse-security] SuSEfirewall2, two links and routing between them > > > > Hi all, > > > > I'm having a problem using SuSEfirewall2. I have the following > > environment: > > - 01 Internet link with 2Mb (ADSL); > > - 01 Internet link with 256Kb (F. Relay); > > - 01 DMZ; > > - 01 LAN. > > > > The ADSL connection is used to Internet access. The FR is used to > > provide a Windows Media Server, and the WM Server is on the DMZ. > > Accessing this service from Internet I don't have any problems, but when > > I try to access it from LAN, I receive the following message: > > " > > SuSE-FW-ACCESS_DENIED_INT IN=eth2 OUT= > > MAC=00:06:4f:06:78:59:00:50:da:64:58:e2:08:00 SRC=192.168.0.58 DST=200. > > 300.400.500 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=18893 DF PROTO=TCP > > SPT=2368 DPT=1115 WINDOW=64240 RES=0x00 SYN URGP=0 OPT > > (020405B401010402) > > " > > Searching into archives, I found that it is a (correct) firewall > > protection, but I need to solve this. I was wondering that is possible > > to correct this creating a custom rule. Can someone help me?? > > > > Regards, > > > > Fabiano Felix > > > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] About "opiekeys" in sendmail-Suse8.2 logs
by J.J. Gallardo 27 Oct '03

27 Oct '03

Gerhard den Hollander wrote: > Hint: > type the error message you got above > OTP unavailable because can't read/write key database /etc/opiekeys > as a search string in Google. Really : it's monday and i'm still "sleepy"... i will search it (search first in google juancho, search first in google juancho...-:).

1 0

Problem with Authentification
by Gordon Cichon 27 Oct '03

27 Oct '03

Dear Madams and Sirs, we have here a small, trusted network (with trusted users) that consists of a heterogenous (i.e., Suse, Redhat, Solaris) set of machines and operates a common, unified file system (w/ autofs and nis). We also would like to provide a convenient mechanism to remotely login to the various machines. This is especially important for shell scripts which have to run various parts of our process on different machines which have different sets of softwa After an internal evaluation, we came to the conclusion that rsh/rlogin is a better solution than ssh. Ssh comes with an overhead about authentification that is not justified in our small, trusted network. Also its encryption limits its performance. e.g., when transferring large amounts of data through remote copy or pipes. We also don't like to switch off these mechanisms in ssh because we still would like to use a strongened ssh for connections outside our network. If we were selectively switching off ssh's security mechanisms, we would see a risk that we would introduce wholes in our security system (mainly because of human-cause configuration errors). We would like to keep rsh and ssh separated. My favorite solution would be to use /etc/hosts.equiv, e.g. > +@catnet in order to enable for the whole netgroup. (fyi. > ypmatch -k catnet netgroup yields: > catnet (veltins,,) (holsten,,) (spaten,,) (andechs,,) (becks,,) (paulaner,,) Then, I would like to rsh, e.g.: > rsh andechs pwd Alternatively, I could put either of those > @catnet gordon > +@catnet gordon > +@catnet > @catnet into .rhosts. That does not work either. The only thing that would is to put the whole list of hosts literally into .rhosts > holsten gordon BTW, in my /etc/nsswitch.conf, it says: > netgroup: files nis What is wrong with it? How can I get get good-old hosts.equiv back to work again? It might have something to do with PAM. I don't understand PAM though, and I don't find anything about my topic in its documentation. Best Regards, Gordon.

1 0

Old question: what is SUSE going to do with harden_suse / Bastille
by Bo Jacobsen 25 Oct '03

25 Oct '03

I find it a little strange that SuSE apparently ignores the need for such an important tool as the old harden_suse or Bastille. I still use parts of the old harden_suse (from SuSE 7.3 !!!) just to close the most apparent problems. The standard SuSE installation is much to open. My problem is that I'm not capable enough to keep harden_suse up to date with all the changes of the new systems. Now we are on version 9.0, and SuSE has still not included any tools to replace the old harden_suse. At least they could had updated harden_suse just so it could run without any modifications. In SuSE 8.1 they had included bastille. What happened to that. It was gone in version 8.2, and in 9.0 it's still not there. Any ideas on what's going on Bo

1 0

SuSEfirewall2, two links and routing between them
by Fabiano Felix 24 Oct '03

24 Oct '03

Hi all, I'm having a problem using SuSEfirewall2. I have the following environment: - 01 Internet link with 2Mb (ADSL); - 01 Internet link with 256Kb (F. Relay); - 01 DMZ; - 01 LAN. The ADSL connection is used to Internet access. The FR is used to provide a Windows Media Server, and the WM Server is on the DMZ. Accessing this service from Internet I don't have any problems, but when I try to access it from LAN, I receive the following message: " SuSE-FW-ACCESS_DENIED_INT IN=eth2 OUT= MAC=00:06:4f:06:78:59:00:50:da:64:58:e2:08:00 SRC=192.168.0.58 DST=200. 300.400.500 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=18893 DF PROTO=TCP SPT=2368 DPT=1115 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402) " Searching into archives, I found that it is a (correct) firewall protection, but I need to solve this. I was wondering that is possible to correct this creating a custom rule. Can someone help me?? Regards, Fabiano Felix

2 1

Re: [suse-security] Solved (?): mysql_connect: Access denied
by Thomas Roth 24 Oct '03

24 Oct '03

Hi Steffen, I don't quite understand all you wrote. On Friday 24 October 2003 09:03, Steffen Dettmer wrote: > > 1) I found that the PHP-script was actually read: supplying > > some special characters instead of the said parameters to > > mysql_connect() resulted in a parse error at that line of the > > script. > > How could you manipulate your script to use special characters in > mysql_connect? By changing the sources? Yes, I wrote the script in the first place, why shouldn't I be able to put something like mysql_connect(@@@) into it? Doesn't make sense, of course, but produces a parse error which in turn tells me that I edited the right script and the right connect()-statement: the most primitive way of debugging your programs: put write()-statements whereever you think there might be problems ;-) >Of course you have to > make sure that this isn't possible by passing malformed data on > the external interfaces. I think there are conditions where > variables can be taken from the CGI environment somewhat > automatically. I think that is a big pitfall as you might find > yourself in using not-sanitized data from untrusted source > (browser). Well, I at least hope the said script is not directly accessible to the outside, short of cracking the system and the like... There is a html-form to put in data, processsing the data is done by some other script, checking these data, and so on. > > 2) However, sensible values seemed never to be used for the > > connection attempt. (PASSWORD: NO in the error message) > > You cannot process sensible values with PHP, except if you have a > dedicated (logical) server for each user - at least when using > mod_php instead of CGI mode. The reason is the mod_ stuff - > performant but insecure: every script runs in the same > environment as the same user. PHP may try to put some security > from top-level, but this cannot work well because of the > complexity. Oh, sorry, I did not mean something that sophisticated, but mysql_connect(@@@) = nonsense mysql_connect($host,$name,$pass) = sensible > > 3)The trick was to switch off the sql.safe_mode in php.ini. > > (And that is not connected to the setting of php safe_mode ) > > Yep, another drawback of mod_php is the global configuration :) > Again, if you have one script (-system), then it's no problem of > course. Why did you need to set sql.safe_mode off? What does this > mean exactly? I would expect that you want sql.safe_mode plus a > possibility to connect (however, this seems to be *really* > secure :-)). After having found that the problem was with sql.safe_mode, it was of course easy to google for it.There seems to be basically only one explication: http://www.n3rd.net/ZendInformationCenter/ZendServerCenter/sql_safe_mode.htm Synopsis: If the SQL Safe Mode option is enabled the MySQL and Ingres extensions will ignore the supplied host, user and password information and will use only the default ones. It's also nice to read: (if I only had done it some weeks ago ;-<) http://www.phpbuilder.com/mail/php-install/2001091/0131.php The php-manual hasn't improved since - maybe people where then distracted from reading that posting by something else... Greetings Thomas

1 0