February 2004 - openSUSE Security - openSUSE Mailing Lists

Can't access from outside
by Arie Reynaldi Zanahar 07 Feb '04

07 Feb '04

Dear All, I'm really new in susefirewall2. I have setup susefirewall2 with suse 8.2 using Yast. I also have added services that available in my server : FW_SERVICES_EXT_TCP="http imap pop3 smtp ssh" .... But my smtp is not reachable from internet. Only from internal or my network that in 1 subnet. Please help :( -- Arie Reynaldi Zanahar reyman(a)reynaldi.com

8 12

Samhain
by Shawn L Johnston 06 Feb '04

06 Feb '04

Greetings, Has anyone had experience with Samhain? http://la-samhna.de/ I'm considering using it and would appreciate any feedback on those who have. Many thanks, Shawn

4 3

Using SSL Certs
by Eric Kahklen 06 Feb '04

06 Feb '04

I followed the directions from http://www.eclectica.ca/howto/ssl-cert-howto.php to create and use SSL certificates. I was able to successfully create the certificates for testing but cannot get an ssl connection via my browser to the site. I added the site certificate and private key paths to the httpd.conf like below from the 'how to': SSLCertificateFile /home/httpd/ssl/cert.pem SSLCertificateKeyFile /home/httpd/ssl/key.pem This is my first attempt at using SSL with Apache so is there something I am missing? The how to simply says to put these entries in the httpd.conf and restart Apache. mod_ssl is also installed. Any ideas would be appreciated. Thanks, Eric

3 4

Re: [suse-security] postfix smtp client: only plaintext ?
by Marc Samendinger 06 Feb '04

06 Feb '04

> -----Original Message----- > From: l.g.e(a)web.de [mailto:l.g.e@web.de] > Sent: Friday, February 06, 2004 8:52 AM > > > SuSE 9.0 > postfix-2.0.14-41 > > postfix/smtp client refuses to use noplaintext AUTH methods. > Plaintext LOGIN seems to work just well, see below. > > What am I missing? > Are CRAM-MD5 and DIGEST-MD5 plaintext auth methods? If you have installed the cyrus-sasl rpm you have to install the cyrus-sasl-crammd5 and cyrus-sasl-digestmd5 rpms. Otherwise check if your sasl was compiled with CRAM-MD5 and DIGEST-MD5 > Thanks, > Lars Ellenberg hth marc

2 1

SQUID Reverse Proxy
by Barry Gill 06 Feb '04

06 Feb '04

Hello All, I have set up a SQUID proxy on my SuSE 8.2 box, running Postfix, IPTables/Netfilter (using SuSEfirewall2 config wrapper) and Trend interscan Viruswall. Site looks like: Internet | Router | SuSE 8.2--MS SBS 2000 | LAN The client wants to now run a web site off of their SBS server, but for security reasons I do not want to set up a reverse forward rule to their DMZ to the IIS server on the MS SBS server. Has anyone here configured a SuSE box to use SQUID as a reverse proxy so that no direct connection is established to the IIS server, but just to the proxy (where I can run my virus checks and maliscious code checks through Trend (basic but better than nothing) before connecting to the internal IIS server? Any help would be greatly appreciated. Kind Regards Barry Gill

2 1

postfix smtp client: only plaintext ?
by Lars Ellenberg 06 Feb '04

06 Feb '04

SuSE 9.0 postfix-2.0.14-41 postfix/smtp client refuses to use noplaintext AUTH methods. Plaintext LOGIN seems to work just well, see below. What am I missing? Are CRAM-MD5 and DIGEST-MD5 plaintext auth methods? Thanks, Lars Ellenberg smtp_sasl_security_options = noanonymous, noplaintext postfix/smtp: < IP[IP]: 220 [...] ESMTP [...] postfix/smtp: > IP[IP]: EHLO its.me postfix/smtp: < IP[IP]: 250-[...] postfix/smtp: < IP[IP]: 250-PIPELINING postfix/smtp: < IP[IP]: 250-SIZE postfix/smtp: < IP[IP]: 250-ETRN postfix/smtp: < IP[IP]: 250-AUTH LOGIN PLAIN ANONYMOUS CRAM-MD5 DIGEST-MD5 postfix/smtp: < IP[IP]: 250-AUTH=LOGIN PLAIN ANONYMOUS CRAM-MD5 DIGEST-MD5 postfix/smtp: < IP[IP]: 250-XVERP postfix/smtp: < IP[IP]: 250 8BITMIME postfix/smtp: server features: 0x2f size 0 postfix/smtp: maps_find: smtp_sasl_passwd: hash:/etc/postfix/saslpass: \ [IP] = lars:secret postfix/smtp: smtp_sasl_passwd_lookup: host `IP' user `lars' pass `secret` postfix/smtp: starting new SASL client postfix/smtp: name_mask: noanonymous postfix/smtp: name_mask: noplaintext postfix/smtp: smtp_sasl_authenticate: IP[IP]: SASL mechanisms \ LOGIN PLAIN ANONYMOUS CRAM-MD5 DIGEST-MD5 postfix/smtp: warning: SASL authentication failure: No worthy mechs found postfix/smtp: connect to subsystem private/defer Doh. smtp_sasl_security_options = noanonymous [...] postfix/smtp: starting new SASL client postfix/smtp: name_mask: noanonymous postfix/smtp: smtp_sasl_authenticate: IP[IP]: SASL mechanisms \ LOGIN PLAIN ANONYMOUS CRAM-MD5 DIGEST-MD5 postfix/smtp: > IP[IP]: AUTH LOGIN postfix/smtp: < IP[IP]: 334 VXNlcm5hbWU6 postfix/smtp: smtp_sasl_authenticate: IP[IP]: decoded challenge: Username: postfix/smtp: smtp_sasl_get_user: lars postfix/smtp: smtp_sasl_get_passwd: secret postfix/smtp: smtp_sasl_authenticate: IP[IP]: uncoded client response lars postfix/smtp: > IP[IP]: bGFycw== postfix/smtp: < IP[IP]: 334 UGFzc3dvcmQ6 postfix/smtp: smtp_sasl_authenticate: IP[IP]: decoded challenge: Password: postfix/smtp: smtp_sasl_authenticate: IP[IP]: uncoded client response secret postfix/smtp: > IP[IP]: c2VjcmV0Cg== postfix/smtp: < IP[IP]: 235 Authentication successful

1 0

AW: [suse-security] Using SSL Certs
by Stefan.Junge＠ssi-schaefer.de 06 Feb '04

06 Feb '04

Hi Eric, Have you configuered the file /etc/sysconfig/apache ? There is a setting to enable SSL: HTTPD_SEC_MOD_SSL=yes. Greetings Stefan > -----Ursprüngliche Nachricht----- > Von: Eric Kahklen [mailto:eric@kahklen.com] > Gesendet: Freitag, 6. Februar 2004 06:48 > An: suse-security List > Betreff: [suse-security] Using SSL Certs > > I followed the directions from > http://www.eclectica.ca/howto/ssl-cert-howto.php to create > and use SSL certificates. I was able to successfully create > the certificates for testing but cannot get an ssl connection > via my browser to the site. I added the site certificate and > private key paths to the httpd.conf like below from the 'how to': > SSLCertificateFile /home/httpd/ssl/cert.pem > SSLCertificateKeyFile /home/httpd/ssl/key.pem > > This is my first attempt at using SSL with Apache so is there > something I am missing? The how to simply says to put these > entries in the httpd.conf and restart Apache. mod_ssl is > also installed. > > Any ideas would be appreciated. > > Thanks, > > Eric > > -- > Check the headers for your unsubscription address For > additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

AW: AW: [suse-security] Using SSL Certs
by Stefan.Junge＠ssi-schaefer.de 06 Feb '04

06 Feb '04

Hi, sorry - I forgot to say that this is for apache 1.3.x. For apache 2 AFAIK there are other rules for configuration. Mit freundlichen Grüßen Stefan Junge -------------------------------------------- Fritz Schäfer GmbH Abteilung EDV/Org. Fritz-Schäfer-Strasse 20 57290 Neunkirchen Telefon +49/2735/70-809 -o) Fax +49/2735/78286018 /\\ Email stefan.junge(a)ssi-schaefer.de _\_v Internet http://www.ssi-schaefer.de > -----Ursprüngliche Nachricht----- > Von: Eric Kahklen [mailto:eric@kahklen.com] > Gesendet: Freitag, 6. Februar 2004 07:23 > An: Stefan.Junge(a)ssi-schaefer.de > Betreff: Re: AW: [suse-security] Using SSL Certs > > No I haven't checked that. Would I check apache or apache2?? > > Thanks, > > Eric > > Stefan.Junge(a)ssi-schaefer.de wrote: > > >Hi Eric, > > > >Have you configuered the file /etc/sysconfig/apache ? > >There is a setting to enable SSL: HTTPD_SEC_MOD_SSL=yes. > > > >Greetings > > > >Stefan > > > > > > > >>-----Ursprüngliche Nachricht----- > >>Von: Eric Kahklen [mailto:eric@kahklen.com] > >>Gesendet: Freitag, 6. Februar 2004 06:48 > >>An: suse-security List > >>Betreff: [suse-security] Using SSL Certs > >> > >>I followed the directions from > >>http://www.eclectica.ca/howto/ssl-cert-howto.php to create > and use SSL > >>certificates. I was able to successfully create the > certificates for > >>testing but cannot get an ssl connection via my browser to > the site. > >>I added the site certificate and private key paths to the > httpd.conf > >>like below from the 'how to': > >> SSLCertificateFile /home/httpd/ssl/cert.pem > >> SSLCertificateKeyFile /home/httpd/ssl/key.pem > >> > >>This is my first attempt at using SSL with Apache so is there > >>something I am missing? The how to simply says to put these > entries in > >>the httpd.conf and restart Apache. mod_ssl is also installed. > >> > >>Any ideas would be appreciated. > >> > >>Thanks, > >> > >>Eric > >> > >>-- > >>Check the headers for your unsubscription address For additional > >>commands, e-mail: suse-security-help(a)suse.com Security-related bug > >>reports go to security(a)suse.de, not here > >> > >> > >> > > > > > > >

1 0

AW: [suse-security] Squid Proxy Problem
by Stefan.Junge＠ssi-schaefer.de 06 Feb '04

06 Feb '04

Hi guys, I solved the problem ! My Firewall blocked the requests. I have changed my configuration for squid proxy and some iptables rules. Thank´s for your help ! Stefan

1 0

Re: [suse-security] Is it iptables enough?
by John 05 Feb '04

05 Feb '04

----- Original Message ----- From: "Keith Roberts" <keith(a)kar.eclipse.co.uk> To: "John" <isofroni(a)cc.uoi.gr> Sent: Tuesday, February 03, 2004 8:06 AM Subject: Re: [suse-security] Is it iptables enough? > > > > IPTables operates at the > > > kernel level, and it's conceiveable that some clever shithead could write > > > a kernel module that alters IPTables' behavior in a way that nullifies > > > it's protection of your server. Remember, a rootkit gives anyone who > > > accesses it absolute power over the server to do anything they want, > > > including poisoning your detection mechanisms. > > Or just type: > > # iptables -P INPUT ACCEPT > # iptables -P OUTPUT ACCEPT > # iptables -P FORWARD ACCEPT > # iptables -F > > as root to flush your IPTables script! > > Regards - Keith Roberts > > > How can i put the above commands at the boot time. I put iptables command in the boot.local but nothing happened.

3 3