January 2004 - openSUSE Security - openSUSE Mailing Lists

Antw: [suse-security] Hints for Frees/WAN on SuSEFirewall2-protected systems?
by Andreas Thierer 04 Jan '04

04 Jan '04

Hi, have a look at /usr/lib/ipsec/_updown and /usr/lib/ipsec/_updown.x509. The updown-script is primarily for dynamic changes in the firewall. Read the FreeS/WAN chapter about firewalls and the updown-script. Do you use AH or ESP? greetz Andy >>> Mathias Homann <admin(a)eregion.de> 10.12.03 13.10 >>> Hi, i got two suse 8.0 systems. Frees/WAN up and running, as far as i can say. in /var/log/messages i see something that looks like a sucessful handshake, and after that the systems have the proper routing tables. Now, how do i tweak SuSEfirewall2 to make the tunnel actually work? Subnet behind box1: 192.168.238.0/24 Subnet behind box2: 192.168.237.0/24 Connectivity in both cases: eth0 points to internal net, ipsec0 (via pppß which is DSL over eth1) is the tunnel. What do i put where in /etc/sysconfig/SuSEfirewall to make the tunnel work? bye, MH -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! gpg key fingerprint: 5F64 4C92 9B77 DE37 D184 C5F9 B013 44E7 27BD 763C -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Freeswan client for Windows (2000/XP)?
by Michael Ryan 04 Jan '04

04 Jan '04

Hi list, Can anyone recommend a good commercial Freeswan/IPSec client for Windows which copes well with multiple configurations e.g. remote IPSec connections using: Analog dial-up GSM/GPRS card Home broadband behind router/firewall WLAN behind router/firewall Have been using Marcus Mullers' ipsec.exe tool over the past year but end users are increasingly dissatisfied with it TIA Michael

7 6

SuSEfirewall2 Webmin module - New release
by intraRedes 02 Jan '04

02 Jan '04

# - CHANGELOG ChangeLog for SuSEfirewall2 Webmin module + Added feature * Updated/improved feature - Deleted/deprecated feature 1.02 (2004-1-1) + Test rules mode to auto stop firewall. * Edit config files - Now allow users to edit personal rules. 1.0 (2003-10-15) + First version! Download : http://www.intraredes.com/projects/download/SuSEfirewall2-1.0.2-2.noarch.tgz by Hernando Furlan <hfurlan(a)Intraredes.com>

1 0

RE: [suse-security] Re: openssh install error
by laavanya.gopalan＠wipro.com 02 Jan '04

02 Jan '04

Thank you. Shall report the same. Regards, Laavanya -----Original Message----- From: Stefan Andreas Tichy [mailto:listuser@pi4tel.de] Sent: Friday, January 02, 2004 3:54 PM To: suse-security(a)suse.com Subject: [suse-security] Re: openssh install error On Fri, Jan 02, 2004 at 09:21:17AM +0530, laavanya.gopalan(a)wipro.com wrote: > Does that mean that I cannot install the package with the > --excludedocs option at all ever ? Or is there any other version of > the same package that would install with the excludedocs option ? SuSE should fix this. There is a feedback form you may use to report this problem: http://www.suse.de/cgi-bin/feedback.cgi -- Stefan Tichy <listuser(a)pi4tel.de> -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here Confidentiality Notice The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain confidential or privileged information. If you are not the intended recipient, please notify the sender at Wipro or Mailadmin(a)wipro.com immediately and destroy all copies of this message and any attachments.

1 0

RE: [suse-security] openssh install error
by laavanya.gopalan＠wipro.com 02 Jan '04

02 Jan '04

Thanks for the clarification. Does that mean that I cannot install the package with the --excludedocs option at all ever ? Or is there any other version of the same package that would install with the excludedocs option ? Thanks, Laavanya -----Original Message----- From: Michel Messerschmidt [mailto:lists@michel-messerschmidt.de] Sent: Thursday, January 01, 2004 7:44 PM To: Laavanya K R (WT01 - EMBEDDED & PRODUCT ENGINEERING SOLUTIONS) Cc: suse-security(a)suse.com Subject: Re: [suse-security] openssh install error On Thu, Jan 01, 2004 at 06:43:23PM +0530, laavanya.gopalan(a)wipro.com wrote: > %post > %{fillup_and_insserv -n -s -y ssh sshd START_SSHD} > mkdir -p ar/adm/notify/messages > cat ./%{_defaultdocdir}/%{name}/README.SuSE > >var/adm/notify/messages/%{name} -changes > > Not sure, why the postinstall section is expecting the document to be > present. Could you please help me out. This is a notification service for important behaviour changes between suse distribution versions. Whenever you install a package than has some significant changes, some information is mailed to root and added to /var/log/update-messages. -- Michel Messerschmidt lists(a)michel-messerschmidt.de antiVirusTestCenter, Computer Science, University of Hamburg Confidentiality Notice The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain confidential or privileged information. If you are not the intended recipient, please notify the sender at Wipro or Mailadmin(a)wipro.com immediately and destroy all copies of this message and any attachments.

3 2

rootkit?
by Patrick Ahlbrecht 02 Jan '04

02 Jan '04

hi list, just curious, if this would ring a bell with someone. Recently I noticed several strange things on one of my boxes (SuSE 8.2 with stock kernel for athlon). Among evidence, that something fishy is going on, I found a rather strange process in psauwx: USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.0 500 72 ? S 2003 0:03 init [3] root 2 0.0 0.0 0 0 ? SW 2003 0:00 [keventd] root 3 0.0 0.0 0 0 ? SWN 2003 0:00 [ksoftirqd_CPU0] root 4 0.0 0.0 0 0 ? SW 2003 0:23 [kswapd] root 5 0.0 0.0 0 0 ? SW 2003 0:00 [bdflush] root 6 0.0 0.0 0 0 ? SW 2003 0:00 [kupdated] root 7 0.0 0.0 0 0 ? SW 2003 0:06 [kinoded] root 9 0.0 0.0 0 0 ? SW 2003 0:00 [mdrecoveryd] root 12 0.0 0.0 0 0 ? SW 2003 0:00 [scsi_eh_0] root 15 0.0 0.0 0 0 ? SW 2003 0:57 [kjournald] at 219 0.0 0.0 1492 104 ? S 2003 0:00 [atd] root 425 0.0 0.0 0 0 ? SW 2003 0:00 [eth0] I have never seen something like [eth0] anywhere else (btw: what's the actual meaning of square brackets? Demons show them to, but these are kernel tasks). Looking at /proc/425 doesn't give any clues, except that it has one file descripter open pointing to /dev/initctl and a PPID of 1. I also found port 6667 to be open, or better "filtered" (nmap). The firewall (self made) doesn't touch it, and I can't associate a process with it (it doesn't accept connections either if simply telnetted to). So the question: Has anyone seen such a thing? I checked with the "checkrootkit" suit, but nothing was found. -- Patrick Ahlbrecht Systemadministration billiton internetservices direct phone: 0271 30386 19

5 5

shred doesn't work in reiserfs?!
by Adalberto Castelo 01 Jan '04

01 Jan '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I was reading the man page for shred, and it says it is not effective in reiser. From the man page: "The following are examples of filesystems on which shred is not effective: * log-structured or journaled [sic] filesystems, such as those supplied with AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.)" The reason is that, apparently, those filesystems do not overwrite data in place. I use shred to delete some important temporary files. I keep some sensitive info in encrypted files. Once in a while I need to decrypt them, look at it, and then shred them when I'm done, keeping the encrypted version. It seems this procedure was giving me a false sense of security, since I use ReiserFS all around. Can anybody elaborate on this? Is there a shred equivalent for Reiser, or is Reiser immune to that kind of approach? How easy is it to retrieve deleted file info from a ReiserFS formatted partition? Happy new year! Adalberto -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iQIVAwUBP/Rlot6AspoXaofZAQIkvg/+JMHVQZVl4BXh+ms5gRehPyDXjv+f0H8C cPb7hczjjYKOKnXH7H+sbuVgUr++rV87QS7DEbiDmiBAKQqZOxmWj/Yh3NMYjrYT Gx2H12SL2ZrxTMtszirnXk2erogkPn6so+GfEAi4SQYbE/nTyhPcxiHcPHo83w6l KO7vchiXPXt9n91hipnuz/xPjktoxj13uKqIrZACmdID3sMXyoFZbaJuqyNsf9BW 2gr2cZ9a1Lrx5ESCYz3vH1qFSgFXVy4rqswPHjaAoOXNNcEmjPFKMqd73V3AOTje D3NKSHSvjVQalaS/6hN3ljXPonZvxuT2rvkvc+8XKvOMcBJjkQLindbcmFleiBhj P+irnvLOwebFikBRVoOWHT5xCoBM6puNRq4nmfMNQ7diWr11O2JVj9zMruiMyqHz /5GV9rAFHhfWS30OUESjcTUBbSeRnb46MamukZrQGfYCb8s3LW9iAXnvu8C3Lzeh LyivVbWao18Tnzg2smoNt5ESRSFRchr9s+Vj4Zjt40oNWcP8PPtUNvuoH0FKhsnR G5zjNm2jBlO2EnShNulVlee/eM7riIjut+NGKg0nraDBqWsL96SSPvEwOSiK83s3 KjB+kPO5Rb3F0VCUz97HZuTO5TsjJKWU5acVI6kUKFKuoj9pBj8f1M/Azpsfk0lr Uy3or2ixPQ4= =7Qsd -----END PGP SIGNATURE-----

1 0

openssh install error
by laavanya.gopalan＠wipro.com 01 Jan '04

01 Jan '04

Hi, When i install the openssh rpm ["rpm -i --excludedocs openssh-3.4p1-105.i586.rpm"] the following error message is displayed and the installation exits with a non-zero status. linux:~ # rpm -i --excludedocs /mnt/rpms/openssh-3.4p1-105.i586.rpm Updating etc/sysconfig/ssh... cat: .//usr/share/doc/packages/openssh/README.SuSE: No such file or directory execution of openssh-3.4p1-105 script failed, exit status 1 linux:~ # echo $? 1 The spec file for this openssh RPM has the following lines in the %post section %post %{fillup_and_insserv -n -s -y ssh sshd START_SSHD} mkdir -p ar/adm/notify/messages cat ./%{_defaultdocdir}/%{name}/README.SuSE >var/adm/notify/messages/%{name} -changes Not sure, why the postinstall section is expecting the document to be present. Could you please help me out. The same installation goes through fine without the --excludedocs option. Does that mean that I can not use the --excludedocs option for this RPM ? Regards, Laavanya Confidentiality Notice The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain confidential or privileged information. If you are not the intended recipient, please notify the sender at Wipro or Mailadmin(a)wipro.com immediately and destroy all copies of this message and any attachments.

2 1

Re: [suse-security] A question and some thanks
by Thomas.Schweikle＠fiducia.de 01 Jan '04

01 Jan '04

Hi! > I know uptime shouldn't be the reason patches are [...] > anyway, whats the best youv had? Or seen at a > place of work? The longest uptime I've seen was with an OS/2-Server. We had to upgrade it and noticed it running with OS/2 2.0 -- us expecting OS/2 Warp 3.0. This was running for seven years without being rebooted! While testing if we could even boot this machine after powering off, we found the FD inoperable: too much dust inside. All harddrives where seven years old too. But nothing broken! After cleaning the whole thing. We could install the new OS/2 Warp 4 --- but the fantastic uptime was gone. ;-( The longest uptime with Linux (SuSE 7.3) had my domino server: a few more than 400 days before upgrading to SuSE 9.0. For FreeBSD I have a test system running for about two years now. But uptime does not tell about how long systems weren't powered off. Looking at power on state, I have systems running for more than 8 years now (kerberos server -- Pentium 60, 32 MByte RAM, 2,1 GByte HD). Various upgrades in between. OS- Uptime is often not more than 200 days... -- Thomas

1 0

nmap on SuSE 9.0
by Mathias Homann 01 Jan '04

01 Jan '04

Yet again that topic is adressed here. in a good way, though: i have prepared a rpm package of nmap with the modification suggested in a post on the nmap developer list. feel free to grab it from ftp://ftp.eregion.de/pub/ and try it out. Source RPM is there as well, for the courious. bye, MH --

3 4