June 2003 - openSUSE Security - openSUSE Mailing Lists

ipsec and NAT Traversal
by Ralf Ronneburger 11 Jun '03

11 Jun '03

Hi everyone, did anyone get ipsec and NAT Traversal running under SuSE Linux 8.2? I've used the ipsec-Kernel-Module which does have NAT Traversal Support, but then I get an error message, that the NAT Traversal Support in the kernel is missing. So I tried to patch the kernel, but that did not work, the kernel would afterwards not compile. And the standard SuSE Kernel is not patched... I could use a kernel from kernel.org, but then I'd have the problem, that nobody provides me with updates and it would probably take hours to configure the kernel so it will run on a comparable wide variety of systems as the standard SuSE Kernel does... Any help would be greatly appreciated! Greetings, Ralf ------------------------------------------------------------ Ralf Ronneburger ralf(a)ronneburger.de Prefers to receive encrypted Mail, download public-key from http://www.ronneburger.de/gpg/ralf_ronneburger.asc ------------------------------------------------------------ " The trouble with computers is that they do what you tell them, not what you want. " -- D. Cohen ------------------------------------------------------------

1 0

sshd, Is it safe to use "Password authentication Yes"
by Bo Jacobsen 11 Jun '03

11 Jun '03

I think it's much more convinient to use "Password Authentication" then using keys, but how safe is it. Also should I use ChallengeResponseAuthentication" or not. I use SuSE 8.2. Thanks in advance Bo Jacobsen

3 2

Re: [suse-security] second user with uid 0
by Marc Samendinger 11 Jun '03

11 Jun '03

> -----Original Message----- > From: Massimiliano Hofer [mailto:max@bbs.cc.uniud.it] > Sent: Wednesday, June 11, 2003 8:36 PM > > > Alle 12:56 PM, mercoledì 11 giugno 2003, Marc Samendinger ha scritto: > > > I need a second superuser as a service account. > > When I add a user and change his uid:gid entry in > > /etc/passwd to 0:0 this user can act as superuser. > [...] > > Any other suggestions where to search for a solution? > > If you use OpenSSH (recommended) you can just add more public > keys to your > root account (without using double entries in /etc/passwd). > If you need finer logging you can create a normal user and > then grant it some > privileges with su-wrapper or sudo (this may include a root shell). First of all thanks alot for all suggestions. I haven't thought of sudo - shame on me - just because I was used to do it like I described above in SuSE 7.2 Your suggestions are not only a solution for my problem but are the better way to solve it (probably the only way :) > -- > Bye, > Massimiliano Hofer > Nucleus Thanks again Massimiliano, David and Dirk (in a private mailling :) marc

1 0

second user with uid 0
by Marc Samendinger 11 Jun '03

11 Jun '03

Hi list, I need a second superuser as a service account. When I add a user and change his uid:gid entry in /etc/passwd to 0:0 this user can act as superuser. System is a SuSE 8.2 The problem is, when I add another user through yast yast seems to remove the superuser account that has been there before creating a second one (root in that case) I searched around and found SORT_PASSWD_BY_UID="no" in /etc/sysconfig/suseconfig but like stated above this Variable is allready set to no. Any other suggestions where to search for a solution? TIA marc

3 2

Re: [suse-security] second user with uid 0
by Marc Samendinger 11 Jun '03

11 Jun '03

> -----Original Message----- > From: Marc Samendinger > Sent: Wednesday, June 11, 2003 12:56 PM > > > Hi list, > > I need a second superuser as a service account. > When I add a user and change his uid:gid entry in > /etc/passwd to 0:0 this user can act as superuser. > > System is a SuSE 8.2 > > The problem is, when I add another user through yast > yast seems to remove the superuser account that has > been there before creating a second one (root in > that case) I forgot to add it only gets removed in /etc/passwd the entry in /etc/shadow is still there marc

1 0

CVS Security question
by Joerg Mayer 11 Jun '03

11 Jun '03

Hello, I'm using cvs from Suse 8.2 (cvs-1.11.5-43), tried to check out some software and was rewarded with the following result: jmayer@alice:~/work/games/freeoxyd/enigma> cvs -t up -> main loop with CVSROOT=:pserver:anoncvs@subversions.gnu.org:/cvsroot/enigma -> Connecting to subversions.gnu.org(199.232.41.2):2401 can't create temporary directory /mnt/ramfs/cvs-serv22847 Permission denied -> Lock_Cleanup() jmayer@alice:~/work/games/freeoxyd/enigma> So far I'd assumed that CVS does not try to access files outside my local cvs tree. I'm especially astonished that the client allows access to absolute file/path names. It this behaviour acceptable? I think not, but then, that's just my personal paranoid opinion. Comments? Ciao Jörg -- Joerg Mayer <jmayer(a)loplof.de> We are stuck with technology when what we really want is just stuff that works. Some say that should read Microsoft instead of technology.

3 5

RE: [suse-security] suse 8.1 mod_php update
by POULINGUE Cyril FTRD/SVA/LAN 11 Jun '03

11 Jun '03

update overwrote the php.ini file (i noticed that because of an include path needed for one of the apps), but i did some changes after (including register_globals) and i still have the same problem. -----Message d'origine----- De : Michael Scherer [mailto:mscherer@gis-systemhaus.de] Envoye : mercredi 11 juin 2003 11:06 A : suse-security(a)suse.com Objet : Re: [suse-security] suse 8.1 mod_php update Hi List. ----- Original Message ----- From: POULINGUE Cyril FTRD/SVA/LAN [cyril.poulingue(a)rd.francetelecom.com] Date: Mittwoch, 11. Juni 2003 11:01 +0200 Subject: [suse-security] suse 8.1 mod_php update > phpinfo tells me that sessions are enabled and some investigations with > test scripts show that session are created correctly but data associated > with them aren't stored anymore. Is there anything with the "register_globals = <on|off>" changed? Or has the update overwritten your own php.ini and replaced it with it's own? just guessing ;) Greetings, Michael -- It's a book about a Spanish guy called Manual, you should read it. -- Dilbert -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

suse 8.1 mod_php update
by POULINGUE Cyril FTRD/SVA/LAN 11 Jun '03

11 Jun '03

Hello, i've just updated my SuSE 8.1 server with online update and php applications using sessions don't work anymore. phpinfo tells me that sessions are enabled and some investigations with test scripts show that session are created correctly but data associated with them aren't stored anymore. is there a problem in the update packages ? did anyone have the same problem, and how did you solve this ? the only solution i found was to reinstall packages from the original distribution. the packages which work are : mod_php4-4.2.2-117 mod_php4-core-4.2.2-117 the updated packages which cause my problems are : mod_php4-4.2.2-215 mod_php4-core-4.2.2-215 Cyril Poulingue France Télécom R&D/SVA/TOP Ingénieur R&D 2, avenue Pierre Marzin 22307 Lannion Cedex Tél. : + 33 (0)2 96 05 25 99 Fax : + 33 (0)2 96 05 18 49 http://www.francetelecom.com/rd

3 2

Re: [suse-security] iptables: limit
by Mark Perry 10 Jun '03

10 Jun '03

And to complete the explanation: If something comes in after 6mins then the rule is matched once and the --limit-burst in dropped from 1 back to 0. Thus providing the actual sustained rate is higher that 10/m then only one match will occur every 6 mins. If the rate drops to 0 for 30mins then --limit-burst will reach its maximum of 5 once more (and increase no more.) Martin's analogy to tokens in a bucket works very well, it separates the average rate (--limit) from the initial burst (--limit-burst which is time independent.) I will use Martin's explanation (reworded) in future ;-) All the Best / Mit Freundlichen Gruessen Mark G. Perry IBM Germany Development GmbH / IBM Deutschland Entwicklung GmbH Schoenaicher Strasse 220, 71032 Boeblingen, Germany Email/Sametime: perry(a)de.ibm.com Office Tel: (+49)-7031-16-3626 |---------+-----------------------------> | | Mark | | | Perry/Germany/Cont| | | r/IBM@IBMDE | | | | | | 10/06/2003 15:17 | | | | |---------+-----------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | | | To: suse-security(a)suse.com | | cc: | | Subject: Re: [suse-security] iptables: limit | | | >-------------------------------------------------------------------------------------------------------------------------------| Having re-read Martins explanation a few times, I think we are saying the same thing - so apologies if I misunderstood you Martin, I actually think your explanation is very good. I was confused over the use of "rule doesn't match anymore" thinking you meant the --limit, but your of course meant the actual rule stops matching because the --limit is now matched. To complete the original example of --limit 10/m which would have a default --limit-burst 5 the first 5 would match the rule, then only 1 every 6mins would match. If nothing comes in within 6mins then the --limit-burst is raised from 0 to 1, and so on every 6mins. All the Best / Mit Freundlichen Gruessen Mark G. Perry IBM Germany Development GmbH / IBM Deutschland Entwicklung GmbH Schoenaicher Strasse 220, 71032 Boeblingen, Germany Email/Sametime: perry(a)de.ibm.com Office Tel: (+49)-7031-16-3626 ----- Forwarded by Mark Perry/Germany/Contr/IBM on 10/06/2003 15:10 ----- |---------+-----------------------------> | | Mark | | | Perry/Germany/Cont| | | r/IBM@IBMDE | | | | | | 10/06/2003 13:47 | | | | |---------+-----------------------------> > -------------------------------------------------------------------------------------------------------------------------------| | | | To: lists4me(a)web.de, suse-security(a)suse.com | | cc: | | Subject: Re: [suse-security] iptables: limit | | | > -------------------------------------------------------------------------------------------------------------------------------| Forgive the intrusion to your thread, but I thought the --limit-burst was the initial number of matches (default 5) that had to be reached BEFORE the --limit rule is applied. The explanation given is the exact reverse of that? I think the idea here is so that a lightly used "rule" can be allowed to peak higher that the basic rule (--limit) and only when the burst rate reaches a certain threshold (--limit-burst) does the (--limit) rule come into effect in order to throttle the throughput back below the peak. Providing that the peak never exceeds the threshold (--limit-burst) then the rule (--limit) is never used. All the Best / Mit Freundlichen Gruessen Mark G. Perry IBM Germany Development GmbH / IBM Deutschland Entwicklung GmbH Schoenaicher Strasse 220, 71032 Boeblingen, Germany Email/Sametime: perry(a)de.ibm.com Office Tel: (+49)-7031-16-3626 |---------+----------------------------> | | Markus Hochmann | | | <lists4me(a)web.de>| | | Sent by: | | | lists4me(a)web.de | | | | | | | | | 10/06/2003 13:03 | | | Please respond to| | | lists4me | | | | |---------+----------------------------> > -------------------------------------------------------------------------------------------------------------------------------| | | | To: <suse-security(a)suse.com> | | cc: | | Subject: Re: [suse-security] iptables: limit | | | > -------------------------------------------------------------------------------------------------------------------------------| Am Dienstag, 10. Juni 2003 12:58 schrieb Martin Köhling: > On Fri, 6 Jun 2003, Markus Hochmann wrote: > > Good, but for what is the "--limit-burst" parameter? > > And this 10 massages, are they the first massages received or only 1 in 6 > > seconds? > > The best explanation I've seen so far was something like this: > > For every "limit" rule, there's a "bucket" containing "tokens"; whenever > the rule matches, a token is removed; when the token count reaches zero, > the rule doesn't match anymore. > > "--limit" is the bucket refill rate. > "--limit-burst" is the bucket size (number of tokens that fit). Thats really easy to understand :D Thx Markus -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Re: [suse-security] iptables: limit
by Mark Perry 10 Jun '03

10 Jun '03

Having re-read Martins explanation a few times, I think we are saying the same thing - so apologies if I misunderstood you Martin, I actually think your explanation is very good. I was confused over the use of "rule doesn't match anymore" thinking you meant the --limit, but your of course meant the actual rule stops matching because the --limit is now matched. To complete the original example of --limit 10/m which would have a default --limit-burst 5 the first 5 would match the rule, then only 1 every 6mins would match. If nothing comes in within 6mins then the --limit-burst is raised from 0 to 1, and so on every 6mins. All the Best / Mit Freundlichen Gruessen Mark G. Perry IBM Germany Development GmbH / IBM Deutschland Entwicklung GmbH Schoenaicher Strasse 220, 71032 Boeblingen, Germany Email/Sametime: perry(a)de.ibm.com Office Tel: (+49)-7031-16-3626 ----- Forwarded by Mark Perry/Germany/Contr/IBM on 10/06/2003 15:10 ----- |---------+-----------------------------> | | Mark | | | Perry/Germany/Cont| | | r/IBM@IBMDE | | | | | | 10/06/2003 13:47 | | | | |---------+-----------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | | | To: lists4me(a)web.de, suse-security(a)suse.com | | cc: | | Subject: Re: [suse-security] iptables: limit | | | >-------------------------------------------------------------------------------------------------------------------------------| Forgive the intrusion to your thread, but I thought the --limit-burst was the initial number of matches (default 5) that had to be reached BEFORE the --limit rule is applied. The explanation given is the exact reverse of that? I think the idea here is so that a lightly used "rule" can be allowed to peak higher that the basic rule (--limit) and only when the burst rate reaches a certain threshold (--limit-burst) does the (--limit) rule come into effect in order to throttle the throughput back below the peak. Providing that the peak never exceeds the threshold (--limit-burst) then the rule (--limit) is never used. All the Best / Mit Freundlichen Gruessen Mark G. Perry IBM Germany Development GmbH / IBM Deutschland Entwicklung GmbH Schoenaicher Strasse 220, 71032 Boeblingen, Germany Email/Sametime: perry(a)de.ibm.com Office Tel: (+49)-7031-16-3626 |---------+----------------------------> | | Markus Hochmann | | | <lists4me(a)web.de>| | | Sent by: | | | lists4me(a)web.de | | | | | | | | | 10/06/2003 13:03 | | | Please respond to| | | lists4me | | | | |---------+----------------------------> > -------------------------------------------------------------------------------------------------------------------------------| | | | To: <suse-security(a)suse.com> | | cc: | | Subject: Re: [suse-security] iptables: limit | | | > -------------------------------------------------------------------------------------------------------------------------------| Am Dienstag, 10. Juni 2003 12:58 schrieb Martin Köhling: > On Fri, 6 Jun 2003, Markus Hochmann wrote: > > Good, but for what is the "--limit-burst" parameter? > > And this 10 massages, are they the first massages received or only 1 in 6 > > seconds? > > The best explanation I've seen so far was something like this: > > For every "limit" rule, there's a "bucket" containing "tokens"; whenever > the rule matches, a token is removed; when the token count reaches zero, > the rule doesn't match anymore. > > "--limit" is the bucket refill rate. > "--limit-burst" is the bucket size (number of tokens that fit). Thats really easy to understand :D Thx Markus -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0