August 2003 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Remote Mail via Sendmail 8.12.2 and SMTP ?
by GentooRulez 14 Aug '03

14 Aug '03

@Robert Davies <rob_davies(a)ntlworld.com> > On Thursday 14 Aug 2003 13:26, GentooRulez wrote: >> @Robert Davies <rob_davies(a)ntlworld.com> >> >> >> On Thursday 14 Aug 2003 10:20, GentooRulez wrote: >> >On Thu, 14 Aug 2003 13:00:44 +0100, Robert Davies >> > <rob_davies(a)ntlworld.com> >> >> wrote: >> > How does that address the questioners authentication needs? >> > >> >>>On Thu, 14 Aug 2003 10:58:21 +0200, remote >> >> <remote(a)leat.ruhr-uni-bochum.de> wrote: >> >>> I´d like to implement some sort of POP3 before SMTP-policy so that >> only >> >>> authenticated users can send mails. I use Sendmail 8.12.2, no >> >>> modifications. > >> I adressed this issue: >> >On Thu, 14 Aug 2003 10:58:21 +0200, remote >> > <remote(a)leat.ruhr-uni-bochum.de> wrote: >> >but are not allowed to send any mails, unless the mail is addressed to >> a > > But if you open up a relay without authentication you have Spammer's > paradise. How would the SMTP server, distinguish someone who has POP3 > access? And again, i did only provide the information how to relay non local mails. The questioner himself already adressed the spam issue and measures against it. Where is here an open relay? >>>On Thu, 14 Aug 2003 10:58:21 +0200, remote <remote(a)leat.ruhr-uni-bochum.de> wrote: >>>For security and anti-spam reasons I´d like to implement some sort of POP3 >>>before SMTP-policy so that only authenticated users can send mails. >How would the SMTP server, distinguish someone who has POP3 >access? Häää? > >> and so i proposed to set up a relay to deliver non local messages. There >> was no exact error >> message and so decided to give that standard advice. >> >> BTW: You're are not an answerer, are'nt you? > > No, but I thought the OP's points on spam avoidance and authentication > needed highlighting. "No" means you are'nt? Btw, here is the original question: >>>On Thu, 14 Aug 2003 10:58:21 +0200, remote <remote(a)leat.ruhr-uni-bochum.de> wrote: >>>What do I have to do so that my users can use their local accounts to send mails to non- local addresses. Saw no answer from you to the questioner until now. > Rob > Michael

2 1

Re: [suse-security] YOU - not installing Apache upgrade
by keith＠topaz5.worldonline.co.uk 14 Aug '03

14 Aug '03

Hi Markus and eveyone. I have just found something interesting in YaST System Restoration option. It says that the following versions are missing, (the installed versions are the ones that I downloaded with YOU recently). Package Version Installed version apache 1.3.26-39 1.3.26-57 apache-doc 1.3.26-39 1.3.26-57 mod_php4 4.2.2-82 4.2.2-235 mod_php4-core 4.2.2-82 4.2.2-235 If Yast can display the build number, is there a reason for not including the build number when doing 'httpd -v', or 'mysqld -v' etc? It would make tracking YOU updates alot easier! On Fri 8 Aug 2003, Markus Gaugusch wrote: > > linux:/ # httpd -v > > Server version: Apache/1.3.26 (Linux/SuSE) > > Server built: Oct 21 2002 17:06:49 > This looks fine, the last YOU apache update is from Oct-25 2002. Regards - Keith Roberts

3 2

Re: [suse-security] Remote Mail via Sendmail 8.12.2 and SMTP ?
by GentooRulez 14 Aug '03

14 Aug '03

@Robert Davies <rob_davies(a)ntlworld.com> >> On Thursday 14 Aug 2003 10:20, GentooRulez wrote: >> You need to name a mail relay server, where mail that is not >> local get delivered to. >> >> /etc/sendmail.cf >> >> DS [mail.relay.ip.address] >On Thu, 14 Aug 2003 13:00:44 +0100, Robert Davies <rob_davies(a)ntlworld.com> wrote: > > How does that address the questioners authentication needs? > >>>On Thu, 14 Aug 2003 10:58:21 +0200, remote <remote(a)leat.ruhr-uni-bochum.de> wrote: >>> I´d like to implement some sort of POP3 before SMTP-policy so that only >>> authenticated users can send mails. I use Sendmail 8.12.2, no >>> modifications. > > Rob I adressed this issue: >On Thu, 14 Aug 2003 10:58:21 +0200, remote <remote(a)leat.ruhr-uni-bochum.de> >wrote: >but are not allowed to send any mails, unless the mail is addressed to a local mail >address. and so i proposed to set up a relay to deliver non local messages. There was no exact error message and so decided to give that standard advice. BTW: You're are not an answerer, are'nt you? Michael

3 2

Re: [suse-security] Remote Mail via Sendmail 8.12.2 and SMTP ?
by Gregor Bruhin 14 Aug '03

14 Aug '03

>> >> pop before smtp is not the best way to do it for multiple reasons, I >> highly suggest smtpa or smtpsa (using esmtp auth feature and tls for >> encryption), for this you have to install sasl (authentication >> sublayer) you can configure sendmail to check via sasl for valid >> users in your std passwd/shadow file, and allow relaying for them ... >> >> try to google: smtp auth sasl sendmail >> >> CU Greg >> >> On Thursday, August 14, 2003, at 10:58 AM, remote wrote: >> >>> Hi ! >>> >>> I administer a small network of Linux and Windows boxes, using a >>> SuSE 8.0 Professional box as router, firewall and mail server. >>> Everything is running fine right now, except for one little thing : >>> >>> I want my users to connect to my mail server from outside my domain, >>> so that they can send e-mails using their mail accounts on my >>> server. Right now, they can download their mail from outside via >>> POP3, but are not allowed to send any mails, unless the mail is >>> addressed to a local mail address. >>> What do I have to do so that my users can use their local accounts >>> to send mails to non- local addresses. >>> For security and anti- spam reasons I´d like to implement some sort >>> of POP3 before SMTP- policy so that only authenticated users can >>> send mails. >>> I use Sendmail 8.12.2, no modifications. >>> >>> Any suggestions ? >>> >>> Thanks >> >

1 0

Re: [suse-security] Kernel 2.4 bugs or security issues?
by Lise Moorveld 14 Aug '03

14 Aug '03

Hi, >From: "Philippe Vogel" <filiaap(a)freenet.de> [...] > > > > > > I'm wondering whether the following two problems are security related, >or > > > actually just bugs: > > > > > > -fix problem with ecc reporting garbage in /proc/ram > > > -fix console redirect bug > > > > > > Does anyone have any idea of what is actually the problem and what the > > > security impact would be? > > > > Both of them are only very loosely security-related. They have been > > mentioned in the description for completeness and for some people who >have > > asked us to fix these bugs. This way they can easily see that the issues > > have been addressed. > > > > Thanks, > > Roman. > >There are issues mentioned @ netfilter.org for 2.4.20 kernels: > >http://www.netfilter.org/security/2003-08-01-nat-sack.html >http://www.netfilter.org/security/2003-08-01-listadd.html Yes, though those are not the issues I'm curious about. The netfilter issues you mention have CVE references and the two issues I mentioned do not :-/ >For further information you have to search here: > >http://www.securityfocus.com/ >http://www.securiteam.com/ >http://www.cert.org/ I have tried. Though as there is actually very little description from SuSE and no references (like CVE id's, CERT-KB id's, BID's), it becomes quite hard to find more info about them. I was hoping someone on the list might know a reference... kind regards, Lise _________________________________________________________________ The new MSN 8: smart spam protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0

Re: [suse-security] Remote Mail via Sendmail 8.12.2 and SMTP ?
by GentooRulez 14 Aug '03

14 Aug '03

You need to name a mail relay server, where mail that is not local get delivered to. /etc/sendmail.cf DS [mail.relay.ip.address] Michael

2 1

Re: [suse-security] YOU - not installing Apache upgrade
by keith＠topaz5.worldonline.co.uk 14 Aug '03

14 Aug '03

Thanks Arjen and everyone else for your help. Iv'e just checked the builds for apache and mod_php4 with rpm -q <packagename> and rpm is returning the latest downloaded versions. So. before updating with YOU, I could do rpm -q <pn> to get the current version & build, go online with YOU, and upgrade a package, then do rpm -q <pn>, just to verify that the package has been correctly installed. Brill! Regards - Keith Roberts On Wed, 13 Aug 2003, Arjen de Korte wrote: > On Wednesday 13 August 2003 21:16, keith(a)topaz5.worldonline.co.uk wrote: > > > If Yast can display the build number, is there a reason for > > not including the build number when doing 'httpd -v', or > > 'mysqld -v' etc? > > Yes. YaST queries the RPM database, which stores the build number (to keep > track of versions). The deamons themselves can't do that, since it is quite > possible that they are not installed by RPM. If you want to know the build > number, 'rpm -q <packagename>' will help. See 'man rpm'. > > Best regards, > Arjen > -- > 51 N 25' 05.1" - 05 E 29' 14.1" > Key fingerprint - 66 4E 03 2C 9D B5 CB 9B 7A FE 7E C1 EE 88 BC 57 >

2 1

quota problem with user-nfs
by Martin Walter 13 Aug '03

13 Aug '03

hi, i am trying to export a filesystem with quotas to nfs clients. server and clients are suse 8.2. if i use kernel nfs (nfs-utils) at the server, quotas are honored by the clients. but if i use user-nfs (nfs-server-2.2beta51-39) at the server, clients can write over all quota limits. do i anything wrong or is this a known bug? is there any workaround? best regards, martin. ps: please don't answer: why not using server-nfs -- Martin Walter University of Freiburg i.Br. --- Germany --- Fon/Fax: +49 761 203-4651/-4643 Rechenzentrum der Universitaet, Hermann-Herder-Str.10, D-79104 Freiburg i.Br.

3 4

Kernel 2.4 bugs or security issues?
by Lise Moorveld 13 Aug '03

13 Aug '03

Hi, In SuSE Security Announcement: kernel (SuSE-SA:2003:034) there is a list of fixes for the 2.4 kernel. Unfortunately, the descriptions of the different problems are very short and no CVE or Cert references are added :-/ I'm wondering whether the following two problems are security related, or actually just bugs: -fix problem with ecc reporting garbage in /proc/ram -fix console redirect bug Does anyone have any idea of what is actually the problem and what the security impact would be? Kind regards, Lise _________________________________________________________________ The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

4 3

Choice of ftp server
by Tommy Rönnholm 13 Aug '03

13 Aug '03

Hello list, I use SuSE Linux 8.1 and want to install a good ftp-server. What ftp-server should I use in mind of security? I would like to setup different access requirements for users on both file restrictions and OS command. Hälsningar/Regards - Tommy Rönnholm ======================================= Tel/phone: 070-6400232 Int: +46(70)6400232 Fax: 070-3889387 Int: +46(70)3889387 tommy.ronnholm(a)elcaro.se http://www.elcaro.se

3 4