November 2004 - openSUSE Security - openSUSE Mailing Lists

auto-repetition eines Tastenanschlages
by Carl A. Schreiber 14 Nov '04

14 Nov '04

Hallo, hab immer noch SuSe 9.1 inkl updates: (KDE 3.2.3, Kernel 2.6.5-7.111). Nachdem am Anfang (dieser Distro) eine niedergehaltene Shift-Taste den PC lahmlegte, scheint dieser Bug durch einen anderen ausgetauscht zu sein: Manchmal wird die letzte Taste von selbst ständig wiederholt... Wenn ich dann backspace niederhalte bis alle wieder weg sind wird der nächste Tastenanschlag ignoriert (ist das System beleidigt?). Hat das jemand auch schon bemerkt? Ist das der Kernel oder KDE? LG Calli

1 1

VPN and web application security
by Derek Fountain 13 Nov '04

13 Nov '04

I speak from a position of total ignorance on VPNs. I've never used one. :o) A friend of mine has a web application running on an Internet facing server - web front end, DB backend, username/password login, that sort of stuff. He's hoping (with justifyable optimism in my opinion) to build it into a high value service. Therefore he needs it to be secure, which at the moment it isn't - well, not beyond the basic username/password login screen. I was considering his options. The obvious one is to build a decent firewall to put in front of it and to harden the server as much as possible. But then it occurred to me that since he's going to have only a handful (a few hundred, maybe) of well paying customers, perhaps there are alternatives. May some sort of VPN is one? I'm sort of thinking of a system where a customer uses some sort of software to create a completely secure link to the application server. The idea being to prevent interceptable data flying about the Internet, and to prevent having an obvious "front door" which an attacker might start hammering on. Um, does any of this make sense? Are there any alternatives I should be looking at for him? Or is this just a case of using good old secure HTTP and being done with it?

2 1

routing problem
by dadirtyluk 12 Nov '04

12 Nov '04

Hallo Leute, ich versuche gerade eine kleine intranet geschichte zu testen und datt funktioniert nich so richtig. ich hab eine webapplikation die auf einem webserver auf einer maschine im internen netzwerk läuft. diese ist unter dem internen namen/ip auch zu erreichen. jetzt möchte ich eine globale ip mit domain-namen auf die kiste weiterleiten, damit sie auch von aussen erreichbar ist. wenn ich den domain-namen in der konfigurationsoberfläche der webapplikation als neuen server registrieren will (zusätzlich zu dem internen namen) verklemmt sich dass irgendwie und ich hab folgende fehlermeldungen von der firewall im log: SFW2-OUTPUT-ERROR IN= OUT=eth0 SRC=192.168.10.1 DST=192.168.10.24 [...] GATEWAY=222.333.444.555 [SRC=192.168.10.24 DST=222.333.444.555 [..] ] eth0 ist das interne device mit ip 192.168.10.1 client zum konfigurieren ist die 192.168.10.24 kann irgendwer die fehlermeldung interpretieren? ich versteh das irgendwie nicht... gruz luk

1 0

SSH-Log Entries
by Kai Pfeiffer 12 Nov '04

12 Nov '04

Hello, I took a look at my /var/log/messages and now I have a question about the log-entries from ssh-daemon. Remote-users are only allowed to login via ssh2 and only RSA-authentication is enabled, login via password isn't possible. Root-logins are forbidden. If I use ssh to log into my box, the log-entries of sshd look like this: --snip-- Nov 11 12:56:02 xxx sshd[698]: Connection from ::ffff:my.ip.add.res port 32775 Nov 11 12:56:02 xxx sshd[698]: Found matching RSA key: ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff Nov 11 12:56:02 xxx sshd[698]: Found matching RSA key: ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff Nov 11 12:56:02 xxx sshd[698]: Accepted publickey for meinloginname from ::ffff:xxx.xxx.xxx.xxx port 32775 ssh2 --snip-- If somebody else uses a wrong loginname it looks like this --snip-- Nov 11 21:50:20 xxx sshd[4109]: Connection from ::ffff:xxx.xxx.xxx.xxx port 35472 Nov 11 21:50:22 xxx sshd[4109]: Illegal user test from ::ffff:xxx.xxx.xxx.xxx --snip-- If somebody uses an existing username , eg "root", only this single line is in the logs --snip-- Nov 11 21:50:20 xxx sshd[4109]: Connection from ::ffff:xxx.xxx.xxx.xxx port 35472 --snip-- MY QUESTION IS: WHAT DO THIS TWO ENTRIES MEAN? --snip-- Nov 11 22:09:40 xxx sshd[4132]: Connection from ::ffff:xxx.xxx.xxx.xxx port 48806 Nov 11 22:09:40 xxx sshd[4132]: Did not receive identification string from ::ffff:xxx.xxx.xxx.xxx --snip-- Thank You Kai Pfeiffer

2 1

SuSE 9.2: Problem with Tripwire reports sent via postfix
by Christoph Illnar 11 Nov '04

11 Nov '04

Hi everyone, we recently installed the new 9.2 packages at our site. we configured postfix as our MTA and set up daily tripwire-audits. reports should be sent with "/usr/sbin/sendmail -oi -t" as the mailing command. this stands for "do not take lines with a single dot as end of mail" and "extract headers from mail content" with our old SuSE 8.2 this worked fine and delivered nice tripwire-reports. we ran into the problem that we are receiving mails with no headers set (to, from, subject, date, ...) it seems that this is a result of the switch to fully unicode support: linebreaks are mis-interpreted and sometimes we get those typical two-letter-unicode characters the first lines of such a report look like: ---------- Date: Thu 11 Nov 2004 15:30:53 +0100 From: "Tripwire(R) 2.3.1.2" <tripwire@xxxxxxxxx> To: root@xxxxxxxxxxxxx Subject: TWReport xxxxxxx 20041111153002 V:116 S:100 A:68 R:23 C:25 Content-Type: text/plain Content-Transfer-Encoding: 7-bit Message-Id: <20041111143053.624F72FE867@xxxxxxxxxxxx> Return-Path: root@xxxxxxxxxxxxxxxxxx X-OriginalArrivalTime: 11 Nov 2004 14:30:15.0109 (UTC) FILETIME=[F5B29750:01C4C7FA] Tripwire(R) 2.3.0 Integrity Check Report ---------- any idea what we could do? my first guess would be the change of locales or something like that. cheers, Christoph

1 0

cipe in SuSE 9.1,9.2 ?
by klaus keppler 11 Nov '04

11 Nov '04

Hi, what is the reason, that packet CIPE is no longer available in newer SuSE-distributions ? After compiling cipe-1.6 and starting, the system freezes after the first packet. What's wrong ? Any ideas ? Regards Klaus

3 2

SuSEfirewall2 and SuSE 92
by Martin Fahlgren 10 Nov '04

10 Nov '04

SuSEfirewall2 (64 bit version) is dropping ssh packets. In /etc/sysconfig/SuSEfirewall2 I have opened ssh traffic FW_SERVICES_EXT_TCP="http smtp ssh" I can open a ssh session, but suddently it is stopped. After a while (1-10 minutes) access is granted again etc. The problem doesn't occur if the firewall is inactivated. The log file confirms that the firewall is the offender with entries like the following (I have changed addresses): Nov 9 13:26:19 xxx kernel: SFW2-INext-DROP-DEFLT-INV IN=eth0 OUT= MAC=00:11:2f:etc... SRC=23.132.63.123 DST=193.181.84.121 LEN=112 TOS=0x00 PREC=0x00 TTL=60 ID=29130 DF PROTO=TCP SPT=7321 DPT=22 WINDOW=19152 RES=0x00 ACK PSH URGP=0 OPT (010.....) Thus the firewall is dropping packages: SFW2-INext-DROP-DEFLT-INV This is a SuSE 9.2 (64 bit) phenomenon, it doesn't appear in older SuSE i386 versions (9.1, 9.0). I haven't checked the 9.2 i386 version, so I can't tell if it's a 64 bit problem only. What's the cause (kernel, firewall program ...)? How to solve/circumvent it? Martin

1 0

need a way to set more secure 8character passwords
by jfweber＠bellsouth.net 10 Nov '04

10 Nov '04

** "from the bottom of my heart, off the coast of Carolina, after one or two false starts ** Someone, apparently, hacked my email account at Bellsouth last week sometime... We of course have no idea how, since they (Bellsouth's alleged "Techs" ) spent all the timefrom the start, telling me it was a) my email client that was doing the damage ( eating my email ) Of course using their website and looking but not downloading email, they could see it disappearing right off the server! But I wasn't doing it.. I even shut off my computer for a night, and my email clients are all set to only download email when the fetch button it clicked, That way it has no chance of interfering w/ info from Celaria or similar... No lockups or anything else.. Tonight we finally reached a person who had a clue. And he told me my account had been hacked, they even watched someone accessing the email, and further attempting to access it after we changed the password. Unfortunatly they only allow and 8 character pwd.. so it wont take someone very long to get into it again.. esp if they are using a linux computer.. but the whole episode has the smell of a windows kiddie playing w/ toys the power of which he has not the slightest clue. I figure he wont bother trying to hack my email again as he never did manage to get anything interesting.. most of my emails are to and from Suse lists <G> But since I couldn't get any email at all I was unable to unsub.. I seem to recall discussion about a program or paper or something about nonsense passwords that could be remembered ... google has let me down today. I couldn't find the article I'm looking for. If anyone remembers reading such a thing please let me know , send an url if there is one... If anyone has a suggestion for making an 8 character password that is reasonably safe or hard to guess w/o being too hard for me to remember , I welcome such suggestions. Now that we finally have confirmation that Bellsouth was the culprit, I shall finish my transformation to all 9.2 boxes... hehehe Since they kept insisting it was not them but my computers that were causing the problems we stopped the installs.. to be certain . why is it that Windows admins refuse to accept they are the problem, or at least the problem is at their end??It shouldn't have taken over a week to ferret out the culprit. Anyone who looked at the accounts inbox could see email arriving and being deleted. Removed from the server while on the phone w/ me .. And they could watch email that was there just disappearing from the servers... but still they insisted I was doing it. ( so why was I talking to them on the phone ??? The logic escapes me) I can't wait to have 9.2 on this box it's really smooth even for something old and underpowered, once you get past the ncurses install... and as speedy as an old celery can be.. And this is a pretty quick athlon w scsi drives etc. so it should be loverly.. TIA to any and all who attempt to help , I wish you happiness.. and offer extra good karma points to anyone who has an idea. -- j -- nemo me impune lacessit

5 4

unpredictable DHCP assignment due to missing powertweak option
by dok＠dok-net.net 09 Nov '04

09 Nov '04

I have found that in SUSE Linux Professional 9.1 and 9.2, the powertweak settings are missing an important feature of at least the 2.6 kernels: /proc/sys/net/ipv4/conf/*/arp_filter. When my noteboook is plugged into the ethernet LAN and well as connected to the WLAN, the wireless AP/router/bridge cannot discern properly between the two interfaces, since without arp_filter activated the Linux kernel responds on all physical interfaces to requests for all logical IPV4 interfaces. This confuses the AP, undermining it's firewalling, for instance. As a result, the MAC-addressed based DHCP IP number assigments don't work, but instead IP addresses from the dynamic address pool are used. It would be trivial for me, or any so inclined SUSE developer, to add this setting to the powertweak package. I am just desparing over how to push such a fix into the main distro, and optimally, distribute it as a security fix (which in cases like mine it really is). Any takers? -Dirk

1 0

twofish256 crypto-loop
by Torsten Flammiger 09 Nov '04

09 Nov '04

Hi, i used an encrypted partition using twofish-256 under gentoo with kernel 2.6.8.1 and 2.6.9. Today i installed SuSE 9.2 and would like to take over my data from that partition/harddisk. But that failed with: requested cipher or key length (256 bits) not supported by kernel after a long warning message: <snip> Passwords shorter than 20 characters are considered too short and insecure. Use of rmd160 password hash permits use of such short passwords for compatibility with other systems that do not enforce minimum length. SuSE has introduced a patch which also permits short passwords with a minimal length of 8 characters for all other hashes. Hopefully this message is annoying enough that you discontinue using such short passwords. </snip> I thought, ok lets use rmd160: # losetup -e twofish256 -H rmd160 /dev/loop0 /dev/hdb1 but that did not help at all The twofish-module loads fine into the running kernel. Something i missed? TIA Torsten

2 1