October 2003 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Problem: permission bits changed on files automatically (SOLVED)
by David C. Grosvold 10 Oct '03

10 Oct '03

Stefan: On Monday 06 October 2003 07:17 am, Stefan Seyfried wrote: > On Fri, Oct 03, 2003 at 10:38:41AM -0500, David C. Grosvold wrote: > > Nope - that's not it, but your comment led me down a new path. Now that > > you mention it, it happens after the On-Line update when SuSEConfig runs. > > > > Guess what? I just had to change the setting of CHECK_PERMISSIONS in > > /etc/ sysconfig/security to "warn" rather than "set" and the problem is > > solved! > > but anyway, SuSEconfig should not do anything in a $HOME. What user are we > talking about? root or a mere mortal? The only thing which would explain > this (to me) is some weird bind-mount or symbolic link into a home, but > this is pure speculation. > > regards, > > Stefan What an interesting thought! We're talking about a mere mortal. I thought I had this solved until earlier today. I updated something in YaST, and once again, the permission bits on all the executables in my normal user's home directory and below were changed from 775 to 675. As far back as SuSE 7.3 I've maintained a symbolic link to /srv/www/htdocs in my "mere mortal" home directory for convenience during web development. To test, I removed the symbolic link, and reran SuSEconfig. The permission bits were NOT changed after removing the link. You might be on to something... Hmmmmm. -- --------------------------------------------------- Dave Grosvold dave(a)rcanyon.com ---------------------------------------------------

1 0

Apache Proxy Acces
by Jan Rüdiger 10 Oct '03

10 Oct '03

Hello I detected a lot of messages like this in my http-access.log 38.117.18.175 - - [01/Oct/2003:00:20:33 +0200] "QUIT" 302 - 38.117.18.177 - - [01/Oct/2003:00:20:40 +0200] "QUIT" 302 - 38.117.18.178 - - [01/Oct/2003:00:20:48 +0200] "POST http://134.155.65.115:25/ HTTP/1.1" 302 318 The Apache is beside a http server also a proxy for a local service running on port 20000. The Access to the Proxy is restricted by: <Directory proxy:*> Order deny,allow Deny from all Allow from 10.0.0. </Directory> Should i be aweare, because 302 means somehting like service temporary unavailable, but there where 318 bytes of data transmited? thanks four your help jan

1 0

Solved ! RE: [suse-security] SuSe Firewall 2 - FW_HTB_TUNE_DEV ???
by Cees Tool 10 Oct '03

10 Oct '03

Hi, > Oh I see you are using SuSEfirewall2 from SuSE 8.1 No, I have Suse 8.2, but I have done updates via Yast Online Update, maybe that goes wrong ?? I have seen more references to Suse 8.1 during upgrading. I will try to find-out what's going wrong with that.... Update after some tests: I have investigated data with "Ethereal", the online-update of Suse 8.2 gets it's updates from pub/suse/i386/update/8.1/.... So the update program was getting the wrong updates (8.1 instead of 8.2) all the time. This is probably also the answer of other minor problems with updating. Now the next thing is to find an updated version of "YOU" (yast online update), and I have to do this manually as the update-program can never find this..... (Probably I am not the only one with this problem ;) > I recomend you to download > SuSEfirewall2-3.1.95.noarch.rpm > from: > ftp.suse.com/pub/suse/i386/update/8.2/rpm/noarch/SuSEfirewall2-3.1- > 95.noarch.rpm [Cees Tool] I have done this, and indeed now the "FW-HTB*" references are in the Susefirewall2 script and it seems to work now ! Thanks all, for the information. Problem (almost) solved. Now I have to see if there is a solution for the wrong directory in yast online update.... Regards, Cees

4 7

RE: [suse-security] Problems with SuSEFirewall
by Sturgis, Grant 09 Oct '03

09 Oct '03

One solution is to have split DNS. The inside DNS points www to the inside address (i.e. 192.168.x.x) while the outside (public) DNS points to the public IP address. -GS -----Original Message----- From: Andrés Tarallo [mailto:atarallo@acm.org] Sent: Thursday, October 09, 2003 10:55 AM To: suse-security(a)suse.com Subject: [suse-security] Problems with SuSEFirewall Hi !!! I have a problem with a firewall I've configured with SuSEFirewall2 and SuSE Linux 8.2. My firewall has a public IP address, and a private IP for a LAN. In the LAN I have a WWW server and a email server. People who want to check their mail from the Internet just connect to the public IP in the firewall and I have set there rules to redirect the trafic to the mail server and WWW server in the LAN. This works fine, also the people in the lan browse the internet via a transparent proxy. My problem starts because the people on the private LAN want's to access the WWW server from the lan, in the same manner they do from the Internet. When they point their browser to http://www.company.com they get a error message from squid that says that the conection was refused. If i ping the WWW server from the LAN by it's name i get no answer. This problems is driving me mad, I don't know what to do. Thanks in advance for your advice. Andrés This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

3 2

root has no shell
by Ulrich Kautz 09 Oct '03

09 Oct '03

Hello All, Ive got a big Problem. I changed the root shell to /bin/false. There is neither a user in the sudoers nor is there any other root-user or even a user in the root group. Is it possible to switch back the shell to /bin/bash or sh or something? Ive tried: sudo -- not in sudoers su -s /bin/bash -c "command" -- "using restricted shell: /bin/false" thanks in advance, Ulrich

19 27

Problems with SuSEFirewall
by Andrés Tarallo 09 Oct '03

09 Oct '03

Hi !!! I have a problem with a firewall I've configured with SuSEFirewall2 and SuSE Linux 8.2. My firewall has a public IP address, and a private IP for a LAN. In the LAN I have a WWW server and a email server. People who want to check their mail from the Internet just connect to the public IP in the firewall and I have set there rules to redirect the trafic to the mail server and WWW server in the LAN. This works fine, also the people in the lan browse the internet via a transparent proxy. My problem starts because the people on the private LAN want's to access the WWW server from the lan, in the same manner they do from the Internet. When they point their browser to http://www.company.com they get a error message from squid that says that the conection was refused. If i ping the WWW server from the LAN by it's name i get no answer. This problems is driving me mad, I don't know what to do. Thanks in advance for your advice. Andrés

1 0

AW: [suse-security] root has no shell
by Ulrich Roth 08 Oct '03

08 Oct '03

Hi Ulrich, > Ive got a big Problem. I changed the root shell to /bin/false. ROTFL! ;-) Okay, boot the machine using the SuSE CDs. Mount the appropriate partition and edit the passwd file. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth at impact dot de

1 0

Secure dynDNS-Update with Router
by Andreas Thierer 07 Oct '03

07 Oct '03

Hi, i want to update my SuSE 8.2 / BIND 9.2 DNS-Server dynamically with TSIG-Keys. Is this possible, if the Client is behind a router? The Netgear RP314 ADSL-Router, as an example, has a builtin DynDNS-Client which happens to work only with dyndns.org (they don't use TSIG-Keys for authorisation). Exist any routers which are able to handle custom dynDNS-servers with TSIG-Keys? Best regards and thanks for any help Andy

2 1

RE: [suse-security] SuSe Firewall 2 - FW_HTB_TUNE_DEV ???
by Cees Tool 07 Oct '03

07 Oct '03

>From: Stefan Seyfried > > On Tue, Oct 07, 2003 at 11:18:57AM +0200, Cees Tool wrote: > > > Do you know if I can check somewhere if the SuseFirewall2 script does > > anything with the "FW_HTB_TUNE_DEV" variable ? > > just read /sbin/SuSEfirewall2, its all in there ;-) > That is the file I have examined too ;) But unfortunately there is no reference to "FW_HTB*" in there. I have searched this file. So probably it does nothing with the "FW_HTB_TUNE_DEV" setting. That's why I asked if I need to install any other thing to have this working.. Regards, Cees

3 3

SuSe Firewall 2 - FW_HTB_TUNE_DEV ???
by Cees Tool 07 Oct '03

07 Oct '03

Hello, I am using Suse 8.2 (kernel 2.4.20) and SuSe Firewall 2. I want to shape my upstream speed and tried to enter : FW_HTB_TUNE_DEV="eth0,125" But I do not see any change in upstream speed, even if I try to enter "eth0,10", my upstream speed remains the same (128 Kbps). From the help-text in sysconfig I understand that this parameter should do the trick, but maybe more has to be set. I cannot find more information. - Do I need to load any module for this ? (Which?) - Do I need to configure anything else to have this parameter work ? - Any other hints ? Regards, Cees

2 2