October 2004 - openSUSE Security - openSUSE Mailing Lists

PHP sessions
by suse＠karsites.net 18 Oct '04

18 Oct '04

> On Monday, 18 October 2004 04.00, Derek Fountain wrote: > > On Monday 18 October 2004 09:42, Anders Johansson wrote: > > Yes it's disabled as a built-in feature, what's in that rpm is an extension. > It *should* put an "extension=session.so" line in /etc/php.ini for you when > it installs Is this not also a security issue - ie allowing dynamic loading of php modules? Check out the PHP manual section 3 - configuration // quote Extension Loading Directives enable_dl boolean This directive is really only useful in the Apache module version of PHP. You can turn dynamic loading of PHP extensions with dl() on and off per virtual server or per directory. The main reason for turning dynamic loading off is security. With dynamic loading, it's possible to ignore all the safe_mode and open_basedir restrictions. The default is to allow dynamic loading, except when using safe-mode. In safe-mode, it's always imposible to use dl(). extension_dir string In what directory PHP should look for dynamically loadable extensions. extension string Which dynamically loadable extensions to load when PHP starts up. // unquote Regards - Keith Roberts http://www.karsites.net

1 0

PHP sessions
by Derek Fountain 18 Oct '04

18 Oct '04

I just hit the issue of a PHP program which used to run happily failing with an error at the PHP session_start() function. A spot of Googling (and the phpinfo() function) confirms that SUSE have disabled session support in their recent PHP builds. I found a thread on the issue on the SUSE-English list which quickly dissolved into a rant, but not before someone said it was a security thing. I found the same question and answer in other places, but couldn't find anything further. So, two requests for information: 1) What can I read which tells me why PHP sessions are a security problem? 2) What can I read which tells me what I need to do to make my PHP program work again?

3 8

/usr/sbin/tickeradj from SuSE 8.2 infected ?
by R. Schmidt 16 Oct '04

16 Oct '04

Hello folkes, after applying the latest McAfee virusscan signature, I had to discover that VirusScan claimed /usr/sbin/tickeradj beeing infected with Linux/Rootkit-Dica.dam. Even the very latest signature 4399 came to the same result. So I tried to reinstall the xntp-package 4.1.1-261.i386.rpm with option --force. This, however didn't improve the situation. After that I installed the xntp-package from SuSE 9.0 which looks like beeing clean. I wonder if this is a false positive alert or if it is really infected. Had someone out there noticed the same behavior on his/her SuSE 8.2 machine ? Thank you very much Rainer

5 4

Re: [suse-security] Why some patches are not inclded in Security Announcement?
by goodman 15 Oct '04

15 Oct '04

Could you tell me if those patches not liesed in Announcement are minor to importance or severity? Thanks, Ben >On Thu, Oct 14, 2004 at 12:01:35AM -0800, goodman wrote: > I find some security patches in Suse web page, but no presence in Security >Announcement. Why? Does it break Suse's Security "Announcement"? >We do not send out announcements for all issues and updates we do. >Maintenance customers get notifications mails for any update. >Normal box customers get their updates via YOU. >We mention unannounced updates in a section of other security announcements. >Ciao, Marcus

5 5

RE: [suse-security] re: strange but true
by DChristensen＠theimg.net 15 Oct '04

15 Oct '04

Ben There are several utilities on TuCows that would let you schedule automatic reboots/power downs on your problematic Windows workstation users. Look for a freeware product called "PowerDown". That might help you close that door. Dave -----Original Message----- From: Ben [mailto:willcu@paradise.net.nz] Sent: Tuesday, September 28, 2004 10:37 PM To: suse-security(a)suse.com Subject: Re: [suse-security] re: strange but true On Tue, 28 Sep 2004 00:33:12 -0800, John Andersen <jsa(a)pen.homeip.net> wrote: > On Tuesday 28 September 2004 06:57 pm, Ben wrote: >> On Mon, 27 Sep 2004 23:45:01 -0800, John Andersen >> <jsa(a)pen.homeip.net> > >> I have set up another SuSE as a firewall to another node on the >> network and they are so impressed i nearly have the go ahead to >> convert the lot to SuSE. But to find out why this logged off problem >> is happening would help me explain to them why this has happend. >> Could it be a fault in the hardware or something like a false >> positive/reading??? > > Just because the user is logged off does not mean the computer is > doing nothing. Both Windows and Linux have dozens of programs running > even when all users are logged off. > > If you want them off POWER THEM DOWN. > > Any number of things can be going on... > Checking for updates > Renewing their dynamic IPs > Synchronizing clocks > Electing Browse masters > Answering ARP requests.. > Spewing Spam from a spam bot... > --- The list goes on and on... > > If the machine is on, its doing something, if you don't like that you > have to turn it off. Power down. Pull the plug. > > Ben, I'm a little worried about you. You talk like you are setting up > your own IT department but then you come with a question like this... > Scares me! > > > Yes i try an tell people to shut down but alas no luck, drives me up the wall, lol -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/ -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Why some patches are not inclded in Security Announcement?
by goodman 14 Oct '04

14 Oct '04

I find some security patches in Suse web page, but no presence in Security Announcement. Why? Does it break Suse's Security "Announcement"? Thanks Ben

2 1

Susefirewall2 + VPN
by enis 13 Oct '04

13 Oct '04

Hi all Im using suse 9.0 as a mail and Proxy server with susefirewall2 in my Office. I have a win2003 server behind of firewall in my internal lan and I want to connect it from home by using vpn connection. Without susefirewall2 I could connect to win2003 server with iptables commands as shown below By the way I use adsl for the internet Win2003 server ip = 192.168.0.111 Linux server ext eth (connected to the adsl router) = eth2 Linux server internal ip = 192.168.0.5 /sbin/iptables -N pptp /sbin/iptables -A pptp -p tcp --destination-port 1723 --dst 192.168.0.111 -j ACCEPT /sbin/iptables -A pptp -p 47 --dst 192.168.0.111 -j ACCEPT /sbin/iptables -I FORWARD -j pptp /sbin/iptables -t nat -N pptp /sbin/iptables -t nat -A pptp -i eth2 -p tcp --dport 1723 -j DNAT --to 192.168.0.111:1723 /sbin/iptables -t nat -A pptp -i eth2 -p 47 -j DNAT --to 192.168.0.111 /sbin/iptables -t nat -A PREROUTING -j pptp Although I changed the parameters in /etc/sysconfig/SuSefirewall2 file listed below, I couldnt make any connection to win2003 server. FW_DEV_EXT="eth2" FW_DEV_INT="eth0 eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.0.0/24" FW_SERVICES_EXT_TCP="ftp 80 smtp ssh 1723" FW_SERVICES_EXT_IP="47" FW_FORWARD_MASQ="810/0,192.168.0.111,tcp,1723 0/0,192.168.0.111,udp,1701" Am I missing something ??

1 0

Susefirewall2 + VPN
by Enis Büyükgüner 13 Oct '04

13 Oct '04

Hi all I'm using suse 9.0 as a mail and Proxy server with susefirewall2 in my Office. I have a win2003 server behind of firewall in my internal lan and I want to connect it from home by using vpn connection. Without susefirewall2 I could connect to win2003 server with iptables commands as shown below By the way I use adsl for the internet Win2003 server ip = 192.168.0.111 Linux server ext eth (connected to the adsl router) = eth2 Linux server internal ip = 192.168.0.5 /sbin/iptables -N pptp /sbin/iptables -A pptp -p tcp --destination-port 1723 --dst 192.168.0.111 -j ACCEPT /sbin/iptables -A pptp -p 47 --dst 192.168.0.111 -j ACCEPT /sbin/iptables -I FORWARD -j pptp /sbin/iptables -t nat -N pptp /sbin/iptables -t nat -A pptp -i eth2 -p tcp --dport 1723 -j DNAT --to 192.168.0.111:1723 /sbin/iptables -t nat -A pptp -i eth2 -p 47 -j DNAT --to 192.168.0.111 /sbin/iptables -t nat -A PREROUTING -j pptp Although I changed the parameters in /etc/sysconfig/SuSefirewall2 file listed below, I couldn't make any connection to win2003 server. FW_DEV_EXT="eth2" FW_DEV_INT="eth0 eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.0.0/24" FW_SERVICES_EXT_TCP="ftp 80 smtp ssh 1723" FW_SERVICES_EXT_IP="47" FW_FORWARD_MASQ="810/0,192.168.0.111,tcp,1723 0/0,192.168.0.111,udp,1701" Am I missing something ??

1 0

LDAP Problem
by Stefan.Junge＠ssi-schaefer.de 12 Oct '04

12 Oct '04

Hi! I have got an authorization Problem concerning ldap and Microsoft Windows 2003 AD Server. I`m absolutely new to ldap and Microsoft AD. I tried a simple request but I only receive this: ldapsearch -h 192.168.0.1 -x -b dc=example,dc=com version: 2 # # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 1 Operations error text: 00000000: LdapErr: DSID-0C0905FF, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece # numResponses: 1 Instead of useing the '-x' option with -k I got : ldapsearch: not compiled with Kerberos support Any hints for me ? Thanks. Stefan

2 1

File permissions under /etc/hotplug/
by Peli 11 Oct '04

11 Oct '04

Hi, I found, that these two files have "strange" permissions on my 9.1 system: -r-xr-xr-x root root /etc/hotplug/usb/openct -rw-r--r-- root root /etc/hotplug/tape.permissions I think, that the following file-permissions are more reliable, than the above defaults: -rwxr-xr-x root root /etc/hotplug/usb/openct -rwxr-xr-- root root /etc/hotplug/tape.permissions Is it worth to modify?! Thanks, Peli

2 1