January 2004 - openSUSE Security - openSUSE Mailing Lists

nmap
by Michael Galloway 29 Jan '04

29 Jan '04

looks like there is an nmap release that resolves the issue of root not being able to run scans: maple:~ # rpm -qa | grep nmap nmap-3.30-70 thanks guys for getting this out. -- michael

2 1

Fw: Fw: [suse-security] sftp with no ssh login
by Manuel Balderrábano 28 Jan '04

28 Jan '04

Ups! You are absolutely right! I did not want to change my instalation, but it looks not only the best solution but the only one. Regards. > Yes ... user can still remove it, because he owns his home directory and > has therefore delete rights. You COULD set the permissions like in /tmp > (1755), but I ask myself, why you don't use scponly or rssh as shell, as I > suggested? They are designed for your purpose. No clumsy scripts and > permissions necessary! > > Markus > -- > __________________ /"\ > Markus Gaugusch \ / ASCII Ribbon Campaign > markus(at)gaugusch.at X Against HTML Mail > / \

2 1

Amavis + Sendmail + Suse9.0
by Tall0n 28 Jan '04

28 Jan '04

Is there anywhere that there is documentation on how to get amavis and sendmail up and running on a fresh Suse 9.0 machine. In the Readme.Suse in /usr/share/doc/packages/amavis-new/ it just says do 2 things. I did those and it's not checking for virii. TIA, Tall0n

1 0

vsftpd & epsv4 mode
by Nikolisin, Harald 28 Jan '04

28 Jan '04

hi list yesterday I set up a vsftpd server - sucessfully ;-) all common connections (from the beloved redmond tools) make no problems. curiously the lukeftp command line tool has problems connecting the server. in standard mode all command which active the passive mode fails: 229 Entering Extended Passive Mode (|||46597|) ...here is dead end. after googeling I discover the epsv4 toggle mode. after disabling the extended passive commands, following server message appear: 227 Entering Passive Mode (XXX,XXX,XX,XX,23,72) that works quite good. curiously I can establish a connection to this ftp-server via VPN (and the private IP-Number). within my enterprise network the 229 - Extended Passive Mode works! therefore it is definitely not the fault of vsftpd. here comes my questions. 1) I assume the number "46579" is the port number given from the FTP server in the case of epsv. the ",23-72" is the range of data port given by FTP in case of pasv mode. is that correct? therefore one firewall seems blocking the high-port 46579 in the case of internet-connection (at VPN connection all traffice goes through..)?? 2) if I establish with lukeftp a connection to "ftp.suse.com" I am immediately in the pasv mode (instead epsv). I assume SuSE also running vsftpd - therefore a setting must exist which forces ftp-clients to use classical pasv mode. unfortunately I could not find this option. regards harald -- Mit freundlichen Grüßen / With kind regards Dipl.-Ing. Harald Nikolisin SOFiSTiK AG (Entwicklung)

8 9

Tripwire Segmentation Fault error...
by Stefano Bertotti 27 Jan '04

27 Jan '04

Dear Sir, we are near to SuSE 9.1 without official solutions for this problem in SuSE 9.0 ... You have never explained the real nature of the problem. Are You supporting the porting solutions from 8.2 proposed in this list ? If the answer is "yes" can You publish the official patch on the onlineupdate servers, otherwise can You explain this incredible support delay...? Regards

6 9

Discussing W32 worms and viruses and some other crap on this list
by Martin Peikert 27 Jan '04

27 Jan '04

Hello, list admins, please corect me if I'm wrong. Since this list is intended for 'Linux security discussions'[1], I really do not know why MS worms and viruses are discussed here. The same holds for spam you get as a result of posting to this list. Please reduce the traffic to discussions that are related to Linux _and_ security, not _only_ security, crap related to MS products or spam (for that issue I would contact the list admins - they can ban spammers from the list, I cannot). TIA GTi [1] http://www.suse.com/us/private/support/online_help/mailinglists/ P.S.: Please don't cc me, I'm on the list.

3 3

Re: [suse-security] nat of locally generated connections
by BLeonhardt＠analytek.de 27 Jan '04

27 Jan '04

I was looking for a solution concurrently in the web - but didn't find anything that answers my question . imho, this should work : iptables -A OUTPUT -t nat -o eth1 -j MASQUERADE but I get following error : iptables: Invalid argument -bruno Martin Peikert <list(a)nolog.org> schrieb am 27.01.2004 10:59:13: > Hello, > > BLeonhardt(a)analytek.de wrote: > > how do I masquerade / source-nat locally generated packets with iptables - any hints ? > > rtfm and the HowTos you'll find at netfilter.org. Next time try google > first before asking '31337' questions. > > GTi

4 5

Allow ssh access only at certain times
by Tom Knight 27 Jan '04

27 Jan '04

Hi, I allow ssh access to a number of accounts on one of my servers from a list of IP addresses, but I don't really want people to be using this service outside normal working hours.. I'm restricting access to these accounts thus: In /etc/pam.d/sshd, add: account required pam_time.so In /etc/security/time.conf, add: sshd;*;user;Wd0900-1700 All well and good, BUT... I can't log in! (And yes, it _is_ a weekday between 9am and 5pm....) Given that the only system change is the addition of that line, and that in /var/log/messages I see: Jan 27 12:07:13 carbon pam_time[4642]: garbled syntax; expected name (rule #1) Jan 27 12:07:13 carbon sshd[4642]: PAM rejected by account configuration[6]: Permission denied I'm using SLES 8, and my pam package is version 0.76-109 Does the positioning of the line in pam.d/sshd matter that much? It's currently the last "account" line, but it was the first "account" line. (And no, Mr PromotionFactory, I don't want to be on your list) Tom. --------------- Tom Knight System Administration Officer Arts & Humanities Data Service Web: http://www.ahds.ac.uk Email: tom.knight(a)ahds.ac.uk Tel: (0)20 7928 7371

4 4

Please remove this @#$%^&% from the list.
by Kenneth Schneider 27 Jan '04

27 Jan '04

On Tue, 2004-01-27 at 07:11, maillist(a)promotionfactory.net wrote: > Please reply to this e-mail to receive our current specials. If others > should get this, include their e-mail also. This is the whois info. Maybe this could be posted on a few newsgroups, I'm sure they would like to get the additional phone calls. Registrant: Lockhart Design (LMTIZXWXGD) 7505 Big Buck Trail Waxhaw, NC 28173 US Domain Name: PROMOTIONFACTORY.NET Administrative Contact, Technical Contact: Dunn, Lance (LD3695) dunnnc(a)AOL.COM Dunn Mfg Corp dba Adcap Line 1400 Goldmine Rd. Monroe, NC 28110 US 704-283-2147 fax: 704-289-6857 Record expires on 19-Aug-2004. Record created on 19-Aug-2003. Database last updated on 27-Jan-2004 07:16:01 EST. Domain servers in listed order: NS1.PROMOTIONFACTORY.NET 66.193.15.252 NS2.PROMOTIONFACTORY.NET 66.193.15.253 This comes back from ARIN kens:~ # whois 66.193.15.252 Time Warner Telecom TWTC-NETBLK-4 (NET-66-192-0-0-1) 66.192.0.0 - 66.195.63.255 Charlotte Colocation TWTC-CHRL-C-CHCO-00 (NET-66-193-8-0-1) 66.193.8.0 - 66.193.15.255 Perhaps a complaint to Time Warner would be in order. -- Ken Schneider unix user since 1989 linux user since 1994 SuSE user since 1998 (5.2)

2 1

Test - ???
by Giovanni Racciu 27 Jan '04

27 Jan '04

I've received a mail from the list (today at 0.38) with the subject test. It appears to be a w32.novarg.a@mm virus. Any idea ? Giovanni

6 6

promotionfactoory again!
by Giovanni Racciu 27 Jan '04

27 Jan '04

After having sent a message to the list I got back a mail from promotionfactory.net !! Didn't we get rid of this? Giovanni

6 6

Re: [suse-security] Test - ???
by mailings - kunstwerke.designs 27 Jan '04

27 Jan '04

Hi Giovanni, i got the same message too from lists.suse.com. Regards Ben --------------------- the source is: Received: from lists.suse.com (lists.suse.com [195.135.221.131]) but did you (all) receive the same e-mail ? Giovanni

1 0

nat of locally generated connections
by BLeonhardt＠analytek.de 27 Jan '04

27 Jan '04

Hi, how do I masquerade / source-nat locally generated packets with iptables - any hints ? -bruno

1 0

FreeSwan Kernel Config
by David White 27 Jan '04

27 Jan '04

I am trying to get Freeswan to work with my SuSE 8.1 Pro installation. My kernel does not have KLIPS support, so I am trying to recompile it. I got the files from the http://www.suse.de/~garloff/linux/FreeSWAN/ website and I am still coming up blank. I downloaded and installed the following files via YaST2 freeswan-1.99_0.934-0.i586.rpm freeswan-1.99_0.934-0.src.rpm km_freeswan-1.99_0.934-0.i586.rpm I then issued the following commands # cd /usr/src/linux # make xconfig (left all the default settings in xconfig) # make dep # make bzImage # cd /usr/src/kernel-module/zz_freeswan # make xgo As I understand it, at this point, I should be able to go to the NETWORK OPTIONS in the xconfig and selection the options for FreeSwan and IPSEC. However, I do not have any options for FreeSwan anywhere in the configuration window! I do not understand why this is the case. I am new to kernel configs, so any information would be helpful! Thanks

2 1

test
by nordi＠addcom.de 26 Jan '04

26 Jan '04

The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.

1 0

ezmlm warning (fwd)
by Hubertus Haniel 26 Jan '04

26 Jan '04

It appears that SuSE has been blacklisted at http://ordb.org/ Best regards Hubba

5 4

can anyone tell me ??
by João M. C. Alvega 26 Jan '04

26 Jan '04

Can anyone tell me where to find the kernel 2.6 RPM's for suse linux??? or where can i find any kernel's rpm?

2 1

chroot: ssh works, scp doesn't
by Tom Knight 26 Jan '04

26 Jan '04

Hello all.... Thanks for earlier help setting up a chroot ssh login. That now works fully, and because of "compartment"'s --user --group options I don't need the su that I thought I did (in the chroot user's /bin). Problem: I can log on to my chroot user's area using ssh, but I can't scp files across to it. I _can_ scp files from the chroot login to the remote server. I'll eventually use rsync, but scp is a starting point; scp and rsync fail similarly. The command I'm running from the remote machine is: "scp -vvv rsync/* update@test:/tmp/tmk" And the output is as follows: (snip lots) 2634: debug2: we sent a publickey packet, wait for reply 2634: debug1: authentications that can continue: publickey,password 2634: debug2: we did not send a packet, disable method 2634: debug3: authmethod_lookup password 2634: debug3: remaining preferred: ,password 2634: debug3: authmethod_is_enabled password 2634: debug1: next auth method to try is password update@test's password: 2634: debug3: packet_send2: adding 64 (len 59 padlen 5 extra_pad 64) 2634: debug2: we sent a password packet, wait for reply 2634: debug1: ssh-userauth2 successful: method password 2634: debug1: fd 4 setting O_NONBLOCK 2634: debug1: fd 5 setting O_NONBLOCK 2634: debug1: channel 0: new [client-session] 2634: debug3: ssh_session2_open: channel_new: 0 2634: debug1: send channel open 0 2634: debug1: Entering interactive session. 2634: debug2: callback start 2634: debug1: ssh_session2_setup: id 0 2634: debug1: Sending command: scp -v -d -t /tmp/tmk 2634: debug1: channel request 0: exec 2634: debug2: callback done 2634: debug1: channel 0: open confirm rwindow 0 rmax 32768 2634: debug2: channel 0: rcvd adjust 131072 Obviously, the password works fine, but I can't figure out where to look next. I can send the output of running "ssh -vvv update@test" if that helps. Permissions on $JAIL/tmp/tmk look like this: tmp: total 0 0 drwxrwxrwx 3 update nogroup 72 2004-01-22 14:34 . 0 drwxr-xr-x 10 update nogroup 272 2004-01-22 14:34 .. 0 drwxrwxrwx 2 update nogroup 48 2004-01-22 14:34 tmk tmp/tmk: total 0 0 drwxrwxrwx 2 update nogroup 48 2004-01-22 14:34 . 0 drwxrwxrwx 3 update nogroup 72 2004-01-22 14:34 .. I can send a description of the setup of the chroot jail if _that_ helps. I know this isn't directly a security issue, so I won't be hurt if you point me somewhere else... just _don't_ suggest Google, I've had a look around there already! In the long run I'll be using public key stuff to avoid passwords, but I've taken that out to eliminate it as a possible problem. Thanks, Tom. --------------- Tom Knight System Administration Officer Arts & Humanities Data Service Web: http://www.ahds.ac.uk Email: tom.knight(a)ahds.ac.uk Tel: (0)20 7928 7371

3 7

Re: [suse-security] Server hang up after firewall operations or net operations
by Keith Roberts 25 Jan '04

25 Jan '04

Hi there - just a quick observation. Are you using the right kernel for your machine? > 2.4.21-166-smp4G AFAIK this is a kernel built for Symetrical Multiple Processor machines. If you only have one CPU in your machine, try the default kernel to see if that works ok. 2.4.21-168-default Regards - Keith Roberts On Sun, 25 Jan 2004, Mario Neubert wrote: > To: 'Suse-Security' <suse-security(a)suse.com> > From: Mario Neubert <mario_neubert(a)gmx.de> > Subject: [suse-security] Server hang up after firewall operations or net > services > > hello list, > > has anyone seen such behaviour? > My new server hangs after some network/firewall related tasks and the only solution is a hard reset. Memory-test has no failure. I > don't know what is it. How I can find out the problem. Please read the logfile, to discover what's happened. I have grep'ed some > lines before/after the syslogd restart (the first line after reboot). Mostly hangs happends on this machine during ssh connects but > not only. The Server is a Celeron-2GHz/512MB/SuSE9.0 ... > > hostxxx:/ # uname -r > 2.4.21-166-smp4G

1 0

NMap
by Brock Hensley 23 Jan '04

23 Jan '04

Sorry if this isnt exactly a security issue, but it is being used to test security.. so does that count? :-] Running SuSe 9... trying to run nmap, i get this error unless i use options '-P0 -sT' "... Starting nmap 3.30 ( http://www.insecure.org/nmap/ ) at 2004-01-23 12:31 EST pcap_open_live: socket: Address family not supported by protocol There are several possible reasons for this, depending on your operating system: LINUX: If you are getting Socket type not supported, try modprobe af_packet or recompile your kernel with SOCK_PACKET enabled. *BSD: If you are getting device not configured, you need to recompile your kernel with Berkeley Packet Filter support. If you are getting No such file or directory, try creating the device (eg cd /dev; MAKEDEV <device>; or use mknod). SOLARIS: If you are trying to scan localhost and getting '/dev/lo0: No such file or directory', complain to Sun. I don't think Solaris can support advanced localhost scans. You can probably use "-P0 -sT localhost" though. ..." Thank You, -Brock -- Brock Hensley Hi-Tech Companies http://www.Hi-TechCompanies.com/ Phone: 269.488.7788x112 1.800.968.1155x112 Fax: 269.488.7799 Mobile: 269.267.5406 This communication is intended solely for the use of the addressee and may contain information that is legally privileged, confidential or exempt from disclosure. If you are not the intended recipient, please note that any dissemination, distribution, or copying of this communication is strictly prohibited. Anyone who receives this message in error should notify the sender immediately and delete it from his or her computer. If you suspect e-mail abuse please contact abuse(a)hi-techcompanies.com Notice: Attachments are automatically scanned for viruses using the Kaspersky Engine.

1 0

Fw: [suse-security] Advice Please - Extending a Network
by Philip B Cook 23 Jan '04

23 Jan '04

> If the hardware solutions described are not an option then you have two > options using Linux (i) seperate subnets or (ii) a bridge. The latter > consists of extra modules in the kernel which effectively turn your box into > a switch, thus saving the expense, and all LAN traffic goes across both > segments. Alternatively split the LAN into two subnets, have two IP > addresses, one for each NIC and have DHCP serve different IP addresses to > hosts on each segment. This is more traditional in some ways but can be > annoying for users, depending on what applications they use. For instance > if they are SMB clients that want to browse a "Network Neighbourhood" then > you'll need to implement a WINS server (and possibly a domain server) to > keep the two subnets talking to each other. > > Carl Peto > Linux Server Support > Bookman Associates It seems to be quite hard to find an 8 port hub with a coax connector, though I will keep looking. In the meantime can you expand on what I need to do following your (i) seperate subnets suggestion. I am already running ... 1) DHCP(providing IP addresses to the local machines and also updating the DNS zone files automatically) 2) DNS (administering the local domain and forwarding to my Cable Company's DNS servers) 3) SuSEFirewall2 (blocks everything inbound, there are NO services accessible from the internet other than those initiated by the local network machines) 4) Samba to support Windows Clients 5) Squid so I think I have all the parts running I need, but need some pointers on how to add the extra interface into the settings for each. Thanks everyone for your advice. Philip

4 5

Filesystem choice in secure server installation
by Togan Muftuoglu 23 Jan '04

23 Jan '04

Hi, I was reading the SLES8_EAL2_SecurityGuide.pdf http://www.suse.de/de/security/eal2/SLES8_EAL2_SecurityGuide.pdf On page 8 it stated to have the "/" partion as ext3. If I remember correctly SuSE had ReiserFS since 6.4 and and it has been the default choice of filesystem for quite a time. So want I want to understand is what makes "ext3" as a better choice for the meeting of criteria and what are the reasons reiserfs fails. I do not want to start a flame war but I want to understand the facts in making such a decision. Thanks and greetings from Stuttgart -- Togan Muftuoglu Unofficial SuSE FAQ Maintainer Please reply to the list; http://susefaq.sf.net Please don't put me in TO/CC. Nisi defectum, haud refiecendum

9 11

AW: [suse-security] Filesystem choice in secure server installati on
by Schirmer, Manfred 23 Jan '04

23 Jan '04

Togan Muftuoglu wrote: > Hi, > > I was reading the SLES8_EAL2_SecurityGuide.pdf > http://www.suse.de/de/security/eal2/SLES8_EAL2_SecurityGuide.pdf > > On page 8 it stated to have the "/" partion as ext3. If I remember > correctly SuSE had ReiserFS since 6.4 and and it has been the default > choice of filesystem for quite a time. > > So want I want to understand is what makes "ext3" as a better choice > for the meeting of criteria and what are the reasons reiserfs fails. > > I do not want to start a flame war but I want to understand the facts > in making such a decision. > > Thanks and greetings from Stuttgart > -- > > Togan Muftuoglu > Unofficial SuSE FAQ Maintainer Please reply to the list; > http://susefaq.sf.net Please don't put me in TO/CC. > > Nisi defectum, haud refiecendum Hi Togan, I suppose it's because they use ACLs. This feature is not supported by reiserfs. See also: http://www.redhat.com/docs/manuals/enterprise/RHEL-3-Manual/sysadmin-guide/c h-acls.html greetings, -- Manfred Schirmer InformationsSysteme Systemtechnik

6 6

-no subject-
by Steffen Enke 23 Jan '04

23 Jan '04

Hallo Liste! Benutze 9.0 pro und damit die SuSEfirewall2. Habe alle Highports TCP gesperrt und UDP nur DNS erlaubt. Wie kann es passieren, daß trotzdem ACCEPT-Meldungen für ebenjene gesperrten Ports kommen? Gruß! Steffen Enke

2 1

OT: PPPoE Server
by BLeonhardt＠analytek.de 23 Jan '04

23 Jan '04

Hi, does anybody has successfully setup a pppoe-server with rp-pppoe ? I'd need to test various client settings - so I'd need a test server ... any hints ? I've already googled and was looking in the rp-pppoe forum but "nothing" that will tell me how to setup the server .. -bruno

1 0