October 2004 - openSUSE Security - openSUSE Mailing Lists

New Release: fou4s 0.12.3
by Markus Gaugusch 05 Oct '04

05 Oct '04

A few days ago I released fou4s 0.12.3. It fixes a nasty usability bug (a prompt asked for "yes/no", and you could only enter y/n), which was introduced in fou4s 0.12.0. Another new (old) feature is the detection of deleted files that are still in use after an Update on SuSE 9.x. Many thanks to Bob Vickers for the hint how to fix that! The new version should also be compatible with upcoming SuSE 9.2, although I haven't yet tested it personally. Auto-detection of some business products has also been added. As always, the new version is available from http://fou4s.gaugusch.at/ or via fou4s -ui --checkfou4s kind regards Markus Gaugusch -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \

1 0

how to change saslauthd log file?
by Andrei Bintintan 05 Oct '04

05 Oct '04

Hi, I have a suse 9.1 box with cyrus-sasl installed. I was wondering how can I change the saslauthd log file. There is the configuration file in /etc/sysconfig/saslauthd Momentan all the logs are written in the /var/log/messages file, but I would like to write these logs in another file. Are there also some other settings like log level? Thanx in advance. Andy.

2 1

Getting SELINUX going on 9.1
by Dan Am 05 Oct '04

05 Oct '04

[Sorry for crossposting, but not much seems to be happening on the suse-selinux list. Interested anyone ?] Hello List, being quite willing to dig into an unknown application I have managed to get Selinux going with the Sourceforge Tutorial, ready to explore. Here are my questions/observations so far: 1. Even in permissive mode insertion of the pam_selinux session modules make login impossible, "no chown of tty possible". Hmmmm.... 2. Proceeding are quite tedious. Are there scripts/frontends available ? Maybe in SLES 9 ? 3. Is there any Policy available for 9.1 ? I am getting quite a lot of "avc denied" in the log, which would make the system unusable in "enforce" mode, not so ? (2 & 3: While all this is fun, I am not one to reinvent the wheel, either) 4. Any other howto's/Docu for SuSE, apart from nsa.gov ? Well, I hope I don't get to much flamefor this and looking forward to your answers. Regards Dan -- buddha 2.6.4-54.5-default 9:05am an 19:31, 1 Benutzer,

1 0

[suse-security] Anti-Virus Problem
by Björn Scorey 05 Oct '04

05 Oct '04

Hi Everyone ! I am running Suse 9.0 and I have installed qmail (netqmail Ver. 1.05) amavis (amavis-new Ver. 20030616p5-23) antivir (Ver 2.08-16) Antivir seems to be an evaluation version. (The one that came with Suse 9.0) I donwloaded the EICAR E-Mail Test Virus but when I send either an infected attachment or simply copy the virus string on the mail, the antivirus doesn't recognize the virus, and the mail passes normally. However when I run antivir on the infected file (attachment) by itself, it recognizes the virus. The same occured with f-prot (however I got some minor errors while installing f-prot). When I run either anti-virus scanner on my mailbox (mbox), none of them manage to see the virus. Anyone has an idea what's wrong ? Regards Björn

5 4

Automated kernel updates
by Andreas Haupt 04 Oct '04

04 Oct '04

Hello, I plan to recheck SuSE's security updates before installing them on the machines. "Normal" packages are easy. I just imitate an update mirror with just links in it. If a link exists the corresponding patch will be installed. This way I can use SuSE's online_update. Kernel updates on the other hand should just be installed when the system is going down. Furthermore I want the last working kernel not to be deinstalled when the new kernel is being installed. "rpm -i" would do this for me so I have vmlinuz (new kernel) and vmlinuz.previous (last working kernel) later on. Does anyone have such a system installed at his/her site? Otherwise there is some work to do for me... Can you give me some advises on the implementation? Thanks in advance Andreas -- | Andreas Haupt | E-Mail: andreas.haupt(a)hmi.de | Hahn-Meitner-Institut (DN) | WWW: | Glienicker Straße 100 | Phone: +49/30/8062-2597 | 14109 Berlin | Fax: +49/30/8062-2096

4 9

RE: [suse-security] Suspect TCP fragment
by GarUlbricht7＠netscape.net 03 Oct '04

03 Oct '04

Vakvarju wrote on Sat Oct 02 2004 - 10:57:25 CEST: > >Hi all, > > I had this morning this message in my /var/log/warn file. > Any idea what can it be? > > > Suspect TCP fragment. > eth1 PROTO=6 80.95.79.9:0 10.0.11.15:0 L=40 S=0x00 I=0 F=0x0001 T=254 >(#0) >icmp_send: destinationless packet >icmp_send: destinationless packet >icmp_send: destinationless packet >icmp_send: destinationless packet ---<text trimed>--- > >Vakvarju Hi, I did a little "google search" There are lots emails discussing: "Suspect TCP fragment" One of them said: I assume the computer you are dealing with is a firewall and nothing else. There is a fragment attack that tries to sneak past sentry programs by sending fragment tcp statements a few parts at a time. Its only dangerous if you are running a vulnerable system to the normal attack. (I forget the exact terminology) But before suspecting foul play there are a few things to look at 1) Its a new month and your cron.monthly may have rotated your wtmp files. Check /var/log/ for files like wtmp.1 or try: last -f /var/log/wtmp.1 2) Check out www.sans.org they have a nice series of articles for general security and linux security. Reference: http://www.icarus.net/linux-users/2001/msg00212.html HTH, -- __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

1 0

Suspect TCP fragment
by Vakvarju 02 Oct '04

02 Oct '04

Hi all, I had this morning this message in my /var/log/warn file. Any idea what can it be? Suspect TCP fragment. eth1 PROTO=6 80.95.79.9:0 10.0.11.15:0 L=40 S=0x00 I=0 F=0x0001 T=254 (#0) icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet icmp_send: destinationless packet Suspect TCP fragment. eth1 PROTO=6 192.168.1.254:0 10.0.11.15:0 L=40 S=0x00 I=0 F=0x0001 T=252 (#0) Suspect TCP fragment. eth1 PROTO=6 192.168.1.254:0 10.0.11.15:0 L=40 S=0x00 I=0 F=0x0001 T=252 (#0) -- ________________________ /"\ Vakvarju \ / ASCII Ribbon Campaign vakvarju_at_spektrum-3d_dot_hu X Against HTML Mail / \

1 0

[Genera] Rules for firewall?
by Rikard Johnels 01 Oct '04

01 Oct '04

Hi all! I dont know if this is the right list, but here goes. I am fairly new to firewalling and iptables. I have a setup as follows: firewall: red eth0 external interface (adsl, dhcp) yellow eth1 dmz interface green eth2 internal interface On dmz is a combined server running web/ mysql/ ftp/ caching dns/ time/ outgoing mail and nfs server I only want web/ftp to be available from red All other services is for green (and yellow) network I have several machines on green (So i guess i want NAT there) One Linux server with NFS Three linux ones running gnomemeeting amsn and licq Two windows ones running Netmeeting, MSN, ICQ All machines run bittorrent, limewire and dc++ I want ssh access to all boxes I want to be able to run all communicationservices from arbitrary box. All internal boxes shall use time/ dns/ outgoing mail om the dmz server The firewall is to be locked down for user login only via ssh. Anything to be done is sudo'ne (note to self, find out how to lock ssh to userlogin only) But i want access from red to firewall so i can "jump" to green and yellow if needed. I want as full access as possible from green to red I have read the SuSEFirewall2 docs in /usr/share/docs/packages/SuSEFirewall2 but i cant figure it out.. What so set, what to add/remove.. Any pointers on where to start learning? Any pointers on how to set it up? -- /Rikard ------------------------------------------------------------------------------------ Rikard Johnels email : rikjoh(a)norweb.se Web : http://www.rikjoh.com Mob : +46 735 05 51 01 ------------------------ Public PGP fingerprint ---------------------------- < 15 28 DF 78 67 98 B2 16 1F D3 FD C5 59 D4 B6 78 46 1C EE 56 >

5 5