July 2003 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Weird scenario...
by Peer Stefan 09 Jul '03

09 Jul '03

Hi Chris, > From: chris001(a)softhome.net [mailto:chris001@softhome.net] > Hi all!! > > Well I would like to thank you all for your replies regarding > root2. I will > think about what I am going to do about this. > > I would like to ask you another thing now. I have a linux-box > that connects > to the internet via modem. The ip that it gets is dynamic, ie > it changes > everytime it logs in. > Can someone tell me a way to create something like an > automated e-mail > message that the server will send to me whenever it logs on > and inform me of > its local ip assigned from the ISP? There is a directory called "/etc/sysconfig/network/if-up.d". Place any script which should run whenever an interface goes up in there (like firewall-startup, routing or whatever) > This is a weird situation because I have to leave the city > for a few weeks > and I would like to be able to ssh to the server whenever it > logs on the > internet. The little script #!/bin/sh /sbin/ifconfig <IF-NAME>|mail -s "Interface <IF-NAME> Up" your(a)mail.address should do the trick. > > Can someone please help me with this?? > > Thank you all again for your help! > Regards > Chris cheers, Stefan

1 0

Limiting users SU ability
by Nigel Gaylard 09 Jul '03

09 Jul '03

Hi All Is it possible to turn off certain users ability to "su" either to root only or to any other user? I would apreciate some direction on this. Regards Nigel Gaylard

4 3

RE: [suse-security] Unencrypted YOU password readable by all
by Peer Stefan 09 Jul '03

09 Jul '03

Hi, > From: Kenny [mailto:kenny-sp@uol.com.br] > In SUSE 8.2 te pass isn't in this file Yes, because Mark was talking about SuSE Linux Enterprise Server. You buy one year (or at least 3 months) of maintenance and you get a username and password for the ftp-updates. Mark was referring to this password. And AFAIK YOU is still not capable of connecting to the internet via proxy-servers in 8.2. Regards, Stefan > > On Tue, 8 Jul 2003 16:36:15 +0200 > "Mark Perry" <PERRY(a)de.ibm.com> wrote: > > > Hi List, > > I just noticed that the Userid and Password for YOU (Yast > Online Update) > > are stored unencrypted in /etc/sysconfig/onlineupdate and > that file is > > readable by anyone. > > FYI: this is on IBM zSeries (SLES/8 s390). > > > > This might not be the Userid and Password for access to the > Linux system > > itself, but I for one am uncomfortable about leaving such > information wide > > open. > > At the very least it enables unauthorized use of YOU on > another system > > where the "cracker" may already have root access. > > > > Note this same file can optionally also contain a userid > and password for > > access to a proxy server, which may in fact be more of an exposure. > > > > All the Best / Mit Freundlichen Gruessen > > Mark G. Perry > > > > IBM Germany Development GmbH / IBM Deutschland Entwicklung GmbH > > Schoenaicher Strasse 220, 71032 Boeblingen, Germany > > Email/Sametime: perry(a)de.ibm.com > > Office Tel: (+49)-7031-16-3626 > > > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

2 1

CA Suggestions
by Sturgis, Grant 08 Jul '03

08 Jul '03

Greetings All, Does anyone have any suggestions for a low-end CA package? I am not looking for anything to use on a public website, just certs to use in-house. We need certificates to use for https (ssl) and VPN. I am currently looking at OpenCA but any comments or recommendations are welcome. Thanks, Grant --------

5 4

Unencrypted YOU password readable by all
by Mark Perry 08 Jul '03

08 Jul '03

Hi List, I just noticed that the Userid and Password for YOU (Yast Online Update) are stored unencrypted in /etc/sysconfig/onlineupdate and that file is readable by anyone. FYI: this is on IBM zSeries (SLES/8 s390). This might not be the Userid and Password for access to the Linux system itself, but I for one am uncomfortable about leaving such information wide open. At the very least it enables unauthorized use of YOU on another system where the "cracker" may already have root access. Note this same file can optionally also contain a userid and password for access to a proxy server, which may in fact be more of an exposure. All the Best / Mit Freundlichen Gruessen Mark G. Perry IBM Germany Development GmbH / IBM Deutschland Entwicklung GmbH Schoenaicher Strasse 220, 71032 Boeblingen, Germany Email/Sametime: perry(a)de.ibm.com Office Tel: (+49)-7031-16-3626

2 1

[Apache - SuSE 8.2 Pro] 2 different WWW virtual hosts, 2 different certs
by Dominik Sk?adanowski 08 Jul '03

08 Jul '03

Hello I tried to startup 2 SSL virtual hosts (every virtual host has it's own cert) on the same machne with 1 IP. Apparently it looks fine... The problem is: when I connect to https://virtual1.domain.com/ cert is for domain virtual1.domain.com, but when I connect to https://virtual2.domain.com/ cert is for domain virtual1.domain.com too. Isn't it strange? Or maybe I made a mistake. Here is fragment on my /etc/httpd/httpd.conf: ----------------------------------------------------------------------- NameVirtualHost xxx.xxx.xxx.xxx:443 <VirtualHost virtual1.domain.com:443> DocumentRoot "/srv/www/virtual1/htdocs" ServerName virtual1.domain.com ServerAdmin root(a)domain.com ErrorLog /var/log/httpd/error_log TransferLog /var/log/httpd/access_log SSLEngine on SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL SSLCertificateFile /etc/httpd/virtual1cert.pem SSLCertificateKeyFile /etc/httpd/virtual1req.pem SSLCACertificatePath /usr/share/ssl/misc/demoCA SSLCACertificateFile /usr/share/ssl/misc/demoCA/cacert.pem <Files ~ "\.(cgi|shtml|phtml|php3?)$"> SSLOptions +StdEnvVars </Files> <Directory "/srv/www/cgi-bin"> SSLOptions +StdEnvVars </Directory> SetEnvIf User-Agent ".*MSIE.*" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 CustomLog /var/log/httpd/ssl_request_log \ "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" </VirtualHost> <VirtualHost virtual2.domain.com:443> DocumentRoot "/srv/www/virtual2" ServerName virtual2.domain.com ServerAdmin root(a)domain.com ErrorLog /var/log/httpd/error_log TransferLog /var/log/httpd/access_log SSLEngine on SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL SSLCertificateFile /etc/httpd/virtual2cert.pem SSLCertificateKeyFile /etc/httpd/virtual2req.pem SSLCACertificatePath /usr/share/ssl/misc/demoCA SSLCACertificateFile /usr/share/ssl/misc/demoCA/cacert.pem <Files ~ "\.(cgi|shtml|phtml|php3?)$"> SSLOptions +StdEnvVars </Files> <Directory "/srv/www/cgi-bin"> SSLOptions +StdEnvVars </Directory> SetEnvIf User-Agent ".*MSIE.*" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 CustomLog /var/log/httpd/ssl_request_log \ "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" </VirtualHost> ----------------------------------------------------------------------- -- ++++++++++++++++++++++++++++++++++++++++++ Dominik Skladanowski ++++++++++++++++++++++++++++++++++++++++++

6 10

AW: [suse-security] apache virtual host
by mailinglists 08 Jul '03

08 Jul '03

Hi, > > > public ip > > ROUTEUR > > eth2 192.168.1.1 > > > > eht3 192.168.1.10 > > FIREWALL eth0 192.168.2.1 ------- eth1 192.168.2.10 WEB SERVER > > > > my virtual host : > > > somebody could help me ? > > You either need NAT or a reverse proxy in the DMZ. I > recommend the latter. Oh, yes, would be definitly my choice no1, too. fqdns you can either setup in /etc/hosts or use a full-blown dns which you point this reverse proxy at. HTH Philipp

1 0

apache virtual host
by Frédéric Poulet 08 Jul '03

08 Jul '03

hi, i would like use apache virtual host but i know why it doesnt't work ! i have a firewall and a web server : INTERNET | public ip ROUTEUR eth2 192.168.1.1 | eht3 192.168.1.10 FIREWALL eth0 192.168.2.1 ------- eth1 192.168.2.10 WEB SERVER my virtual host : <VirtuaHost 192.168.2.10> DocumentRoot /home/x ServerName www.x.com </VirtualHost> somebody could help me ? ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com

2 1

WG: [suse-security] apache virtual host
by Andreas.Doerfler＠kempten.de 08 Jul '03

08 Jul '03

hi there, just a try: NameVirtualHost * <VirtualHost *> ServerAdmin webmaster(a)xxx.de DocumentRoot /data/web/xxx ServerName www.xxx.de ServerAlias *.xxx.de </VirtualHost> greetz -----Ursprüngliche Nachricht----- Von: Frédéric Poulet [mailto:pofrederic@yahoo.fr] Gesendet: Dienstag, 8. Juli 2003 09:34 An: suse-security(a)suse.com Betreff: [suse-security] apache virtual host hi, i would like use apache virtual host but i know why it doesnt't work ! i have a firewall and a web server : INTERNET | public ip ROUTEUR eth2 192.168.1.1 | eht3 192.168.1.10 FIREWALL eth0 192.168.2.1 ------- eth1 192.168.2.10 WEB SERVER my virtual host : <VirtuaHost 192.168.2.10> DocumentRoot /home/x ServerName www.x.com </VirtualHost> somebody could help me ? ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

[suse-security] CA Suggestions
by Bill.Light＠kp.org 07 Jul '03

07 Jul '03

Grant - There was a short "HOW-TO" that I had found last year: (courtesy of google) http://palmcoder.net/files/howtos/SSL%20CA%20HOWTO/SSL_CA-HOWTO.pdf - Bill ================================================================ Greetings All, Does anyone have any suggestions for a low-end CA package? I am not looking for anything to use on a public website, just certs to use in-house. We need certificates to use for https (ssl) and VPN. I am currently looking at OpenCA but any comments or recommendations are welcome. Thanks, Grant

1 0