July 2003 - openSUSE Security - openSUSE Mailing Lists

Network structure and security
by Socrates Alichanides 11 Jul '03

11 Jul '03

Hi list, I have just been appointed net admin at the company I work for. Although I have some experience with Suse Linux and networks I have not yet delt with firewall configuration etc. The problem: We are considering installing an ADSL connection (newly available in Greece) and I were discussing whether to use a PC as the firewall/router or a Cisco router. The problem is mainly a security one as having a static IP enables someone on the Internet to attack us. Also is there any reason for the firewall and router software to run on separate machines? Is there any set-up anyone would propose for the network? There won't be any web server at least for a couple of months or more. The only computers needing access to the Internet will be our mail server (?) and about 5 PCs. If this is of topic for the list can somebody please point me to any other? Socrates Alichanides (MIEE) Engineer

7 10

KDE-Login for root
by Joachim.Winter＠malberg-edv.de 11 Jul '03

11 Jul '03

Hello List, after setting the "paranoid file security" the root user cannot login to KDE. After setting of "easy file security" the login istn't possible too. Where are the hidden settings to correct this problem? Mit freundlichen Grüßen Joachim Winter Malberg EDV-Systemberatung GmbH Humboldtstrasse 18 04105 Leipzig Tel.: 0341 / 986 - 2860 Fax: 0341 / 986 - 2879 www.malberg-edv.de

4 3

Antwort: RE: [suse-security] KDE-Login for root
by Joachim.Winter＠malberg-edv.de 10 Jul '03

10 Jul '03

Yes, it works fine, thank you. The file is located in /etc/opt/kde3/share/config/kdm and contains 2 sections with "AllowRootLogin". Joachim Schoene Gruesse zurueck an british energy ;-) Best regards |---------+-----------------------------------> | | Stritzel Diana | | | <diana.stritzel@british-| | | energy.com> | | | | | | 10.07.2003 14:29 | | | | |---------+-----------------------------------> >------------------------------------------------------------------------------------------------------------------------------| | | | An: "'Joachim.Winter(a)malberg-edv.de'" <Joachim.Winter(a)malberg-edv.de> | | Kopie: | | Thema: RE: [suse-security] KDE-Login for root | >------------------------------------------------------------------------------------------------------------------------------| You have to configure the file "kdmrc". Set there "AllowRootLogin=true" otherwise it won't work. Under RH Linux the file is located in /etc/kde/kdm. If you want to know this for SuSE I can have a look as well. Hope this helps, Diana PS Schoene Gruesse nach Leipzig ;) -----Original Message----- From: Joachim.Winter(a)malberg-edv.de [mailto:Joachim.Winter@malberg-edv.de] Sent: 10 July 2003 13:04 To: suse-security(a)suse.com Subject: [suse-security] KDE-Login for root Hello List, after setting the "paranoid file security" the root user cannot login to KDE. After setting of "easy file security" the login istn't possible too. Where are the hidden settings to correct this problem? Mit freundlichen Grüßen Joachim Winter Malberg EDV-Systemberatung GmbH Humboldtstrasse 18 04105 Leipzig Tel.: 0341 / 986 - 2860 Fax: 0341 / 986 - 2879 www.malberg-edv.de -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here |* This message has been sent from the British Energy Group. |* |* British Energy plc |* Registered Office:- |* Redwood Crescent, Peel Park, East Kilbride, G74 5PR, United Kingdom |* Registered in Scotland (Number 162273). |* |* This email message and any attachments are for the use of the addressee only. If you are not |* the addressee you may not copy or use or disclose the contents of this email to anyone else. |* British Energy's communications systems may be monitored and recorded by the company. |* |* If you believe you have received this email in error please notify us by telephoning +44 (0)1452 653113. |*

2 1

iptables rules for HTML Form Protocol Attack
by Muammer Arslan 10 Jul '03

10 Jul '03

Hi All, Last days I often see below messages in Apache log files: 1.1.1.1 - - [09/Jul/2003:17:32:00+0200] "POST http://11.1.106.18:25/ HTTP/1.1" 200 475 "-" "-" I suspect some kind of HTML protocol attack and want to stop this. Can I do it somehow with IP-Tables as it is already installed on the server or do you have any other ideas? I use SuSE 8.1 and SuSEfirewall2 with SuSEfirewall2-custom rules. Thanks for your replies. Muammer

2 2

Root user
by Chris Bek 10 Jul '03

10 Jul '03

I was wondering is there is a way to create another root user account say root2. Is this possible?? Thanx.

11 11

AW: [suse-security] Q: vsftpd "cd ~ftp" not working
by Ulrich Roth 10 Jul '03

10 Jul '03

Hi, > Everything is fine, put I have one problem: > when a normal user is using ftp, he/she will > first be in the HOME of the user. OK, that's fine. > But it is not possible to use "cd ~ftp" for a normal > user to go to the public ftp place. > You can enter the path by hand (absolut path) , but I > do not like absolut pathes (you have always trouble > changing absolut pathes). > > Any idea ? Yes, log in as "ftp" or "anonymous". That's the design of FTP: local users see their home directory when logging in via ftp, anonymous users see the public tree when logging in. No need to mix up both. If you need your local users to access a common directory, I suggest to create an extra one of which the name is easily to remember. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

RE: [suse-security] HTTP Strange LOG
by POULINGUE Cyril FTRD/SVA/LAN 10 Jul '03

10 Jul '03

hi, this is a typical code-red worm attack trying to exploit a buffer oberflow but youu don't have to worry about this. this worm only targets microsoft IIS web servers Cyril -----Message d'origine----- De : cydonia(a)cbn.net.id [mailto:cydonia@cbn.net.id] Envoyé : jeudi 10 juillet 2003 10:54 À : suse-security(a)suse.com Objet : [suse-security] HTTP Strange LOG Dear List, I have this strange logs in my APache Web server, 202.159.151.106 - - [10/Jul/2003:14:53:15 +0700] "GET /default.ida?XXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u909 0%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00% u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 271 "-" "-" Is My WEb server attacked ? If it is, How should i configure my Apache? Best Regards, Kheli -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

5 7

Q: vsftpd "cd ~ftp" not working
by Peer-Joachim Koch 10 Jul '03

10 Jul '03

Hi, I want to setup a new ftp server for our institute so currently I am playing around with vsftpd. Everything is fine, put I have one problem: when a normal user is using ftp, he/she will first be in the HOME of the user. OK, that's fine. But it is not possible to use "cd ~ftp" for a normal user to go to the public ftp place. You can enter the path by hand (absolut path) , but I do not like absolut pathes (you have always trouble changing absolut pathes). Any idea ? Bye, Peer _________________________________________________________ Max-Planck-Institut fuer Biogeochemie Dr. Peer-Joachim Koch Winzerlaer Str.10 Telefon: ++49 3641 57 6705 D-07745 Jena Telefax: ++49 3641 57 7864

2 2

Starnge situation, need help!
by chris001＠softhome.net 09 Jul '03

09 Jul '03

Hi all!! Well I would like to thank you all for your replies regarding root2. I will think about what I am going to do about this. I would like to ask you another thing now. I have a linux-box that connects to the internet via modem. The ip that it gets is dynamic, ie it changes everytime it logs in. Can someone tell me a way to create something like an automated e-mail message that the server will send to me whenever it logs on and inform me of its local ip assigned from the ISP? This is a weird situation because I have to leave the city for a few weeks and I would like to be able to ssh to the server whenever it logs on the internet. Can someone please help me with this?? Thank you all again for your help! Regards Chris

5 4

Weird scenario...
by chris001＠softhome.net 09 Jul '03

09 Jul '03

Hi all!! Well I would like to thank you all for your replies regarding root2. I will think about what I am going to do about this. I would like to ask you another thing now. I have a linux-box that connects to the internet via modem. The ip that it gets is dynamic, ie it changes everytime it logs in. Can someone tell me a way to create something like an automated e-mail message that the server will send to me whenever it logs on and inform me of its local ip assigned from the ISP? This is a weird situation because I have to leave the city for a few weeks and I would like to be able to ssh to the server whenever it logs on the internet. Can someone please help me with this?? Thank you all again for your help! Regards Chris

3 2