December 2003 - openSUSE Security - openSUSE Mailing Lists

Q. RTFM for firewall on 8.2
by neville seed 15 Dec '03

15 Dec '03

hello Can anyone point to to a RTFM for the firewall on suse 8.2. I am looling to configure multiple external interfaces. regards neville __________________________________ Do you Yahoo!? New Yahoo! Photos - easier uploading and sharing. http://photos.yahoo.com/

2 1

Re: [suse-security] Curious response
by Keith Roberts 14 Dec '03

14 Dec '03

Thanks for the explaination Sven. I have tried altering my from address in Pine 4.44, under SuSE 8.1 pro. When I try to send the mail to suse-security(a)suse.com with a dummy from address in the header from, Pine gives me the following error message: Mail not sent: <keith(a)no.more.spam.net> Sender address rejected: Domain not found. This may be pine checking the header from, not suse-security(a)suse.com. So I change this header from address in Pine to: <keith(a)no.more.spam.co.uk> With that address, it gets past pine, but hasn't made it to this list yet! (It may bounce back soon!) Have you got an http:// address for the mailing-list FAQ please? Kind Regards - Keith On Sat, 13 Dec 2003, Sven Wahl wrote: > To: suse-security(a)suse.com > From: Sven Wahl <x1svewah(a)stud.slu.se> > Subject: Re: [suse-security] Curious response snip > A2. The header from is probably what you think of as the "from"; > e.g. > From: foo(a)bar.com > It is contained in DATA portion of the mail (that's the part > of the mail that you, as a user, write). The envelope from > is written by your mail transport agent, or MTA. That's the > thing that your mail client hands the message you just wrote > off to to have it delivered. An envelope is generally > represented as this in the traditional mbox format: > From foo(a)bar.com Fri Mar 1 12:59:36 2002 > If you use maildirs or some other mailbox format you probably > won't have that. Most MTAs copy the envelope from to the > Return-Path header so you can also get it from that. > This is who your MTA, in the words of RFC 822bis, says "the > author(s) of the message, that is, the mailbox(es) of the > person(s) or system(s) responsible for the writing of the > message.'' > The mailing list software we use (ezmlm+idx) takes the envelope > from as the address to subscribe when you email > LISTNAME-subscribe(a)suse.com. Other mailing list software might > use the header from. > > There are lots of good technical reasons why the envelope from > is used (which you can read all about at the author's site: > http://cr.yp.to/immhf.html) but a big benefit for you is that > since the envelope from isn't displayed in list postings and > the header from is ignored you can set your header from to be > whatever you want. This means that you can use your main email > address for the list and, if you munge the address, you won't > need to worry about it being harvested by an an evil spammer. > In other words, you are encouraged rot13, reverse, encrypt, > or do whatever to your header from (*except* leave it > unqualified) and it won't affect your subscription at all.

3 3

[suse-security] unsuscribe
by tony knight 14 Dec '03

14 Dec '03

Please unsuscribe me from this list. Thanx ------------------------------------------------------------- Sign up for ICQmail at http://www.icq.com/icqmail/signup.html

3 2

Re: [suse-security] Curious response
by Keith Roberts 13 Dec '03

13 Dec '03

> As far as I remember, the thing is: ezmlm doesn't (necessarily) > check the FROM address in the header of an e-mail sent to the list > in order to verify if you are subscribed or not. The thing that > matters is the envelope address header, which is not included when > ezmlm forwards a message to all list members. So, you could have a > fake address in the FROM field as long as the envelope address is > set to the address used for subscription. Would it be possible to configure ezmlm to check the real FROM address in the email header to verify that a person is subscribed to this list. This may allow us to use FAKE addresses when sending mail to the list, but still allowing ezmlm to check for validity of subscriber's real email address??? I have a new email address that I would like to use to post messages to this list from, and drop the email account (topz5.worldonline.co.uk) that gets all the spam messages. Any replies from suse-security mailing list manager (real person) would be appreciated. Kind Regards - Keith Roberts

2 2

Can't open any port
by Daryl Lee 13 Dec '03

13 Dec '03

I am trying to configure my firewall to accept remote SSH logins, but it will not. Configuration: Linux server (combination internet gateway, router, and primary workstation) running SuSE 9.0 (brand new install; replaced RedHat 8.0 a week ago, where this problem did not exist). Windows 2000 laptop (my employer's), and Windows XP laptop (my wife's). All internal LAN access is fine, SMB file and printer sharing works, workstations can all get out to the internet, no problems there. But when I try to come in from the internet and open a SSH session with the firewall up, it will not connect. When I try with the "SuSEfirewall test" command, it goes through okay (so I know sshd is running correctly). Here's my /etc/sysconfig/SuSEfirewall2, with all the comments and blank lines stripped, my comments added: FW_QUICKMODE="no" FW_DEV_EXT="ppp0" # I use DSL FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="0/0" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="ssh http 5800:5805" # 580x, 590x: VNC FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="ssh domain netbios-ssn" # netbios-ssn for SAMBA FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV=""

2 3

do sasldb2 store passwords as plain-text?
by Jürgen Rohrbach 13 Dec '03

13 Dec '03

hello, is it right that saslpasswd2 stores the entered password as plain-text? if so, is it possible to change this so that the passwords are encrypted? thanks, juergen

2 1

Curious response
by Richard 12 Dec '03

12 Dec '03

Hi all, Is anybody getting these after posting to this list? <quote> Subject:Thank you for your inquiry. From:"maillist(a)promotionfactory.net" <maillist(a)promotionfactory.net> To:<suse-security(a)nergenshuizen.nl> Please reply to this e-mail to receive our current specials. If others should get this, include their e-mail also. <unquote>

8 13

problems with proxy-proxy communication
by Ralf Ronneburger 12 Dec '03

12 Dec '03

Hi everyone, I have a problem with SuSE Proxy Suite (in front of an ftp-server) when communication with client behind another proxy server (a delegate 8.5.5). Communication with other clients works without any problems, active or passive, the SuSE Proxy is configured for active and passive ftp. My network looks like this: external interface proxy (SuSE Linux 8.1, SuSE Proxy Suite) internal interface (10.0.0.254) | | ftp-server (10.0.0.200) When connecting from a client behind the delegate-proxy the logfile looks like this (where 172.16.0.1 is the IP of the delegate-proxy, 10.0.0.254 is the internal IP of the SuSE Proxy): ftp-child [19569] <11/26-12:43:14> USER-INF connect from 172.16.0.1 ftp-child [19569] <11/26-12:43:14> USER-INF 'USER USERNAME' from 172.16.0.1 ftp-child [19569] <11/26-12:43:14> USER-INF reading data for 'USERNAME' from cfg-file ftp-child [19569] <11/26-12:43:14> TECH-DBG from Server-PI (3): '220 SERVERNAME.' ftp-child [19569] <11/26-12:43:14> TECH-DBG from Server-PI (3): '331 Password required for USERNAME.' ftp-child [19569] <11/26-12:43:14> USER-INF 'PASS XXXX' from 172.16.0.1 ftp-child [19569] <11/26-12:43:14> USER-INF 'PASS XXXX' from 172.16.0.1 ftp-child [19569] <11/26-12:43:14> TECH-DBG from Server-PI (3): '230 User USERNAME logged in.' ftp-child [19569] <11/26-12:43:14> USER-INF 'PWD' from 172.16.0.1 ftp-child [19569] <11/26-12:43:14> TECH-DBG from Server-PI (3): '257 "/USERNAME" is current directory.' ftp-child [19569] <11/26-12:43:14> USER-INF 'SYST' from 172.16.0.1 ftp-child [19569] <11/26-12:43:14> TECH-DBG from Server-PI (3): '215 SERVERSYSTEM' ftp-child [19569] <11/26-12:43:20> USER-INF 'PORT 172.16.0.1:4568' from 172.16.0.1 ftp-child [19569] <11/26-12:43:20> USER-INF 'LIST' from 172.16.0.1 ftp-child [19569] <11/26-12:43:20> TECH-INF 'PORT 10.0.0.254:54975' for 172.16.0.1 ftp-child [19569] <11/26-12:43:20> TECH-DBG from Server-PI (3): '200 PORT command successful.' ftp-child [19569] <11/26-12:43:20> TECH-ERR can't connect Cli-Data for 172.16.0.1 ftp-child [19569] <11/26-12:43:50> USER-INF closing connect from 172.16.0.1 after 36 secs - read 0/0, sent 0/0 byte/sec Has anybody experienced something similar? How can I or the admin of the delegate-proxy solve this? This has also happened to me with another proxy on the other side, unfortunately they did not wanna tell me what technology they use... Greetings, Ralf Ronneburger

1 0

Linux Pam 8.2
by Jörg Kalmund 12 Dec '03

12 Dec '03

Hi, if I try to put just a pam authentication skeleton module (returning always PAM_SUCCESS) on the pam auth stack, the login process hangs after showing the greeting according to /etc/motd (Have a lot of fun ...). I.e. no shell is loaded. The process tree shows that the login process starts another login process and not a shell. With Suse 8.0 everything is fine, i.e. a shell is loaded. Any ideas ? wenn ich ein immer PAM_SUCCESS zurückgebendes Pam-Module auf den auth-stack lege, dann hängt sich der login-prozess nach der meldung aus /etc/motd (Have a lot of fun ...) auf. Im Prozessbaum sieht man, dass der login prozess erneut einen login process startet, aber nicht eine shell. Mit Suse 8.0 klappt das und die entsp. shell wird geladen. Irgendwelche Vorschläge ? Regards/ Gruß, Jörg

1 0

Is SLES8 SP2a vulnerable to the brk() system call?
by Cristian Veronesi 12 Dec '03

12 Dec '03

Hello, I'm running Oracle Application Server on a SLES8 SP2a box. Recently a I received a Maintenance Support Information message about the brk() system call vulnerability in SLES7. I'm wondering whether SLES8 SP2a is vulnerable too (since I received no messages about this topic). Thank you. Kind regards, -- Cristian Veronesi - C.R.P.A. S.p.A. - Reggio Emilia, Italy The only truly safe way to avoid Outlook problems is to avoid using Outlook.

2 1