December 2003 - openSUSE Security - openSUSE Mailing Lists

ppp_mppe does not load on static kernel
by chip＠innovates.com 26 Dec '03

26 Dec '03

On the 2.4.21-144 kernel on SuSE 9.0, the ppp_mppe module will not load if it is statically compiled into the kernel. It loads fine if compiled as a module. I need to get this working for running my poptop server in a UML running in jail mode, since jail mode requires a static kernel w/o modules. The current mppe patch seems to be updated to statically link, but not the version in the SuSE kernel. Are there any patches for the SuSE kernel available to fix this? Thank you, Chip Schweiss

1 0

RE: [suse-security] When an updated 8.1 kernel?
by GarUlbricht7＠netscape.net 23 Dec '03

23 Dec '03

Erik Hensema <erik(a)hensema.net> wrote: > > About three weeks ago SuSE delivered the wrong kernel as an update > for the do_brk() vulnerability for SuSE 8.1. > SuSE (8.1) is shipped with a 2.4.19 kernel, > but the update contains a 2.4.21 kernel which seems to be from SUSE 9.0. > > Because of the potential impact of the vulnerability, > I can understand that such an error is made > when customers are demanding updates yesterday. > But things have calmed down now. > > So when is this mistake to be corrected? > > I'd very much like to patch my servers, > but I can't because the updated (2.4.21) kernel isn't stable on them. > I get kernel oopses, kernel BUGs, altogether slow I/O, > kernel threads stuck in uninterruptable sleep, and crashes. > Not good. > >-- >Erik Hensema (erik(a)hensema.net) > Hi Erik, I am running a 8.1 box with new k_deflt kernel, and have observed none of the problems you have outlined above. Knock on wood, but my box has been rock steady. Regardless, as you know: http://www.suse.de/cgi-bin/feedback.cgi and http://www.suse.com/cgi-bin/feedback.cgi are the places to provide general and technical feedback to SUSE. The SUSE mailing lists (including [suse-security] are public lists for SUSE users to share information. They aren't in general monitored by SUSE as a means of providing technical support, bug fixes, enhancements, etc. Further, not to put words in Roman's mouth, but SUSE employees responding on this list often do so on their own time and rarely in any official capacity unless the post specifically says: "suse-security-announcement" or similar type words. So to make sure that known bugs, unwelcome features, wanted changes or enhancements are noticed by SUSE, it would be my suggestion for you to go to: http://www.suse.de/cgi-bin/feedback.cgi and fill that a "bug report" I am sure SuSE will want to know what architecture you have, and other data you can provide so they can reproduce the problem you have experienced. Friendly greetings, Gar -- "The quickest way to get information on the net is not to ask a question, but to post the wrong information." - Aahz' Law (re-stated) -- __________________________________________________________________ New! Unlimited Access from the Netscape Internet Service. Beta test the new Netscape Internet Service for only $1.00 per month until 3/1/04. Sign up today at http://isp.netscape.com/register Act now to get a personalized email address! Netscape. Just the Net You Need.

2 1

When an updated 8.1 kernel?
by Erik Hensema 22 Dec '03

22 Dec '03

About three weeks ago SuSE delivered the wrong kernel as an update for the do_brk() vulnerability for SuSE 8.1. SuSE is shipped with a 2.4.19 kernel, but the update contains a 2.4.21 kernel which seems to be from SUSE 9.0. Because of the potential impact of the vulnerability, I can understand that such an error is made when customers are demanding updates yesterday. But things have calmed down now. So when is this mistake to be corrected? I'd very much like to patch my servers, but I can't because the updated (2.4.21) kernel isn't stable on them. I get kernel oopses, kernel BUGs, altogether slow I/O, kernel threads stuck in uninterruptable sleep, and crashes. Not good. -- Erik Hensema (erik(a)hensema.net)

1 0

NT group defs from Samba?
by timo 22 Dec '03

22 Dec '03

Newest version of samba for SuSE 8.1 seems to be based on 2.2 series and there exists no build for 3.0.0 or 3.0.1? The problem is that I need to install a windows application that requires about 10 groups from PDC - and the PDC is Samba 2.2.x on Linux. Samba 2.2.x series does not seem to support the "domain group map" so how do I provide these groups from Linux? What choices do I have and what is the suggested way of doing this? I think options include at least: - changing PDC to windowsNT - obtaining prebuild 3.0.1 samba for SuSE 8.1 - building and installing from 3.0.1 sources - any others/suggestions? So how should I do this? Installing the windows software with only "users" and "administrators" groups breaks its security - and likely the rest of the system security after that. regards, timo

2 1

request for opinions: SuSE 9 secure as a web server?
by Adalberto Castelo 22 Dec '03

22 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi folks, I'm planning to serve web pages from my personal box (family pictures and the like), running SuSE 9 stock with all patches. The machine will be handed all port 80 (or whatever port I decide to use) requests from my linksys router/ firewall, therefore being completely exposed on that port. I'll also be letting ssh through. So my question is: how dangerous is this? How secure is a SuSE 9 box (with no tweaks or anything, just configured everthing with yast). I'm asking your opinion as to whether SuSE is considered reasonably safe for what I have in mind or if I should look for other options. And perhaps if there are simple steps I can take to increase my chances of not being cracked. Just some more info: in my internal network I'm running NFS, so can't use the suse firewall (since it blocks that service). I'm also running rsync. Cheers, Adalberto -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iQIVAwUBP+Rz596AspoXaofZAQLWTRAAmvTlJMOuFYHaTl1jd0wBG783DT/EasRi +n2kvNw6h1miR1aAvkObE//+/h1Vu2SHdMTnwIJvaMfXpdYg4Id+114+uk8MhJ6F JuaRMx6WL3bjw2oh/yGUP/n8TMxrYDVKIDmm2lrFmAb35UMnqa4J9bfJyAnMt3gm fZii/bd+BRzf7aZrJG7BZeHNLBFDTLMemU+pTH3ZqjVwxNbV9uE7gfCnK05TSrdZ 7pUFCVe0zEeGglO2r9lxpjQ+Azd2Ml2CDUq7m7YXPTg5ZBYXlVX0x6HaxUkS/YT4 MvfNbSVGqRp5e2iVV7TzYasddXr7FKwSLHJ6myGxUKTwn3iMSX3Z0j8fS1tFHSRj 9KboPqjWdsrGf86CfJeUwLRL+ZtuAu3do96tooYRDbzrMkbCgKmGXfJw1dxC5QkZ ovGuLK6HumtG8FSJebSlLZRvR6ctuo/+BfcLlHfKHbwTrYx6wVpXcqA4iGMfg1Fy 2tJ85UhoEMQzUHmQ3s3EJTVoKASAdOSVB9cVQ3TpFdLCsqavKD4tiLxkMN021ExC f2V2Xq7Kd38F0FG5ZLbGzdlSnCQ3rcaX9llI7kSxXxVf1lipEdYStNJ5H1ZORx9D AvLsGNfLQa7nl5yPev+NdA6wmxHF/fTFxVWsRdhMpAIaglpWoTweOlNA3ll3ivr0 Tdv6s4wYs9I= =Y+/m -----END PGP SIGNATURE-----

5 7

RE: [suse-security] request for opinions: SuSE 9 secure as a web server?
by Sturgis, Grant 21 Dec '03

21 Dec '03

When the proper steps are taken, SuSE can be extrememly secure. You simply must run SuSEfirewall or iptables (they are the same, SuSEfirewall simply adds a config wrapper) and you can configure it to allow NFS or whatever you want on the inside port. You should prevent services from listening on the outside interface and configure the firewall to refuse connection attempts to unwanted services on the outside interface. I would advise that, out of the box, SuSE should not be place on the Internet with no protection. However, with a bit of configuration, SuSE can be reasonable secure on the Internet. Regards, -GS -----Original Message----- From: Adalberto Castelo [mailto:castelo@comcast.net] Sent: Saturday, December 20, 2003 9:08 AM To: suse-security(a)suse.com Subject: [suse-security] request for opinions: SuSE 9 secure as a web server? -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi folks, I'm planning to serve web pages from my personal box (family pictures and the like), running SuSE 9 stock with all patches. The machine will be handed all port 80 (or whatever port I decide to use) requests from my linksys router/ firewall, therefore being completely exposed on that port. I'll also be letting ssh through. So my question is: how dangerous is this? How secure is a SuSE 9 box (with no tweaks or anything, just configured everthing with yast). I'm asking your opinion as to whether SuSE is considered reasonably safe for what I have in mind or if I should look for other options. And perhaps if there are simple steps I can take to increase my chances of not being cracked. Just some more info: in my internal network I'm running NFS, so can't use the suse firewall (since it blocks that service). I'm also running rsync. Cheers, Adalberto -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iQIVAwUBP+Rz596AspoXaofZAQLWTRAAmvTlJMOuFYHaTl1jd0wBG783DT/EasRi +n2kvNw6h1miR1aAvkObE//+/h1Vu2SHdMTnwIJvaMfXpdYg4Id+114+uk8MhJ6F JuaRMx6WL3bjw2oh/yGUP/n8TMxrYDVKIDmm2lrFmAb35UMnqa4J9bfJyAnMt3gm fZii/bd+BRzf7aZrJG7BZeHNLBFDTLMemU+pTH3ZqjVwxNbV9uE7gfCnK05TSrdZ 7pUFCVe0zEeGglO2r9lxpjQ+Azd2Ml2CDUq7m7YXPTg5ZBYXlVX0x6HaxUkS/YT4 MvfNbSVGqRp5e2iVV7TzYasddXr7FKwSLHJ6myGxUKTwn3iMSX3Z0j8fS1tFHSRj 9KboPqjWdsrGf86CfJeUwLRL+ZtuAu3do96tooYRDbzrMkbCgKmGXfJw1dxC5QkZ ovGuLK6HumtG8FSJebSlLZRvR6ctuo/+BfcLlHfKHbwTrYx6wVpXcqA4iGMfg1Fy 2tJ85UhoEMQzUHmQ3s3EJTVoKASAdOSVB9cVQ3TpFdLCsqavKD4tiLxkMN021ExC f2V2Xq7Kd38F0FG5ZLbGzdlSnCQ3rcaX9llI7kSxXxVf1lipEdYStNJ5H1ZORx9D AvLsGNfLQa7nl5yPev+NdA6wmxHF/fTFxVWsRdhMpAIaglpWoTweOlNA3ll3ivr0 Tdv6s4wYs9I= =Y+/m -----END PGP SIGNATURE----- -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

7 7

iptables and MSS-clamp
by Andreas Paulick 21 Dec '03

21 Dec '03

Hi there! I have a problem with mss-clamping in iptables. Here is a Suse 8.2-box with an ADSL-Connection (TDSL from Deutsche Telekom AG; Germany) that serves internet access for some win-clients. As many ohters in this situation, I ran into the mss-problem: "some websites ar'nt accessible with the win-clients" and I solve this on other boxes by using SuSE-Firewall. But this time I have a router with 3 internal ethernet-devices, so I could'nt use SuSeFirewall. With someones help (who I can't ask now), I put a iptables-script together. This script runs fine for dialup-connections so I reuse this and insert the TCPMSS-line in the forward-rules. It simply doesn't, what it should do: some websites aren't reacheable ("waiting for de.search.yahoo.com" in Mozilla) but reacheable by lynx on the Linux-router-box. Has anyone an idea, how to solve this? My knowledge in iptables is very limited, because other networking stuff is more important for me. Unfortunatly, this problem comes up suddenly and I have no time for "trial & error - learning" so I only can "learning by example" this time. As usual, I have searched the internet and read the two HOWTOs coming with the iptables.rpm in SuSE - no luck :(. Does someone know, where I have to look at? Thanks in advantage Andreas Here is the script: ----snip--- #!/bin/sh echo "1" > /proc/sys/net/ipv4/ip_forward; iptables --flush ###################################################### #ROUTING ###################################################### iptables -t nat -F; iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE ###################################################### #FORWARD ###################################################### iptables -F FORWARD iptables -A FORWARD -s 192.168.1.0/24 -j ACCEPT iptables -A FORWARD -d 192.168.1.0/24 -j ACCEPT iptables -A FORWARD -s 192.168.2.0/24 -j ACCEPT iptables -A FORWARD -d 192.168.2.0/24 -j ACCEPT iptables -A FORWARD -s 192.168.4.0/24 -j ACCEPT iptables -A FORWARD -d 192.168.4.0/24 -j ACCEPT iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu ###################################################### #INPUT ###################################################### iptables -A INPUT -s 127.0.0.1 -j ACCEPT iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT iptables -A INPUT -s 192.168.2.0/24 -j ACCEPT iptables -A INPUT -s 192.168.4.0/24 -j ACCEPT iptables -A INPUT -p tcp --destination-port 22 -j ACCEPT ##################################################### #Create chain which blocks new connections, except if coming from inside #################################################### iptables -N block iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A block -m state --state NEW -i ! ppp0 -j ACCEPT iptables -A block -j DROP ###################################################### #Jump to that chain from INPUT and FORWARD chains. ###################################################### iptables -A INPUT -j block iptables -A FORWARD -j block ###################################################### #OUTPUT ###################################################### iptables -P OUTPUT ACCEPT iptables -F OUTPUT ###################################################### echo "iptables set" ----snap----

3 2

RE: [suse-security] request for opinions: SuSE 9 secure as a web server?
by Barry Gill 20 Dec '03

20 Dec '03

Adalberto Castelo <castelo(a)comcast.net> wrote the Dec 20, 2003 6:07 PM: > opinion as to whether SuSE is considered reasonably safe for what I have in > mind or if I should look for other options. And perhaps if there are simple > steps I can take to increase my chances of not being cracked. If you have a Linksys firewall, you are going to be as safe on your SuSE box as you would on any other non-tweaked machine. If you are running Roxen as a web server you will have less security threat as there are simply fewer exploits than are around for Apache, but apache is also more secure than a badly configured MS IIS server... Always all boils down to how well you set your machine up. (P.S. There is no reason why you can't run SuSEfirewall2 on this box, simply open the ports for the NIS server...)

1 0

Connection to a wireless accesspoint
by Ruprecht Helms 20 Dec '03

20 Dec '03

Hi, I have a netgear wg311 wireless card and want to connect to a wireless firewall ruter. How do I make it under Suse 9.0. Suse tells me that it founds a networkadapter and configurate it as a wireless card. But by typing in the ssid and the wep-key (128 bit encryption) I get no connection to the accesspoint. On which position I've to enter the radiochannel? Regards, Ruprecht

2 1

password change on NIS as root?
by Bjorn Tore Sund 19 Dec '03

19 Dec '03

Having just upgraded my NIS (no plus) Master from SuSE 8.0 to 9.0 I all of a sudden have a problem. Normal users can change their NIS passwd running 'passwd', the root user cannot - I'm prompted for the user's password not the root password. Even when running the command on the NIS master. Yppasswd used to help, but these days only informs me that it's deprecated and seems to simply run passwd. Local password file and NIS password file are different on the server, by design. Root is not a NIS user, again, because I like it that way. I _can_ change the password by running htpasswd and using vi(1) on the NIS shadow file (I just did, the problem became apparent because of a user who had forgotten his password), but I was looking for something slightly less ugly. There must surely still be tools? Bjørn -- Bjørn Tore Sund Phone: (+47) 555-84894 Stupidity is like a System administrator Fax: (+47) 555-89672 fractal; universal and Math. Department Mobile: (+47) 918 68075 infinitely repetitive. University of Bergen VIP: 81724 teknisk(a)mi.uib.no Email: bjornts(a)mi.uib.no http://www.mi.uib.no/

3 4