February 2004 - openSUSE Security - openSUSE Mailing Lists

AW: AW: [suse-security] Samba 3.0, ADS, Kerberos
by Christian Lange 19 Feb '04

19 Feb '04

Hello, the following worked fine with my Windows-ADS-2003-Servers and my Linux Mailserver running SuSE 9.0 with Heimdahl Kerberos. Please excuse me, that i didn`t translate the extract from my personal-howto into english: A. auf dem Windoze 2003 Server 1. Im AD wird ein Benutzer mit dem Account linux und dem Namen xms010 (nicht fqdn) erzeugt. Passworteigenschaften auf ..läuft nie ab und ... nicht bei der ersten Anmeldung ändern setzen. 2. Auf dem Windoze 2003 Server die Support-Tools von der Server CD installieren. 3. Dos-Box. Service Principal Name erzeugen: D:\zak\Support Tools\setspn a host/xms010.fqdn.de xms010 4. Erzeugen und exportieren des Keytab-files D:\zak\Support Tools\ktpass princ host/xms010.fqdn.de(a)FQDN.DE pass password mapuser xms010 out linux.keytab 5. Das erzeugte Keytab-file auf den Linux-Server kopieren That was the part on the Windows-Server. Now we`re switching to our favorite linux-machine. 2. Umbenennen der vom DC kopierten linux.keytab in krb5.keytab: # mv linux.keytab /etc/krb5.keytab 3. erstellen der /etc/krb5.conf [libdefaults] ticket_lifetime = 24000 default_realm = FQDN.DE dns_lookup_realm = false dns_lookup_kdc = false clockskew = 300 [realms] FQDN.DE = { kdc = tcp/ads_dc01.fqdn.de:88 admin_server = ads_dc01.fqdn.de:749 kpasswd_server = ads_dc01.fqdn.de default_domain = fqdn.de } [domain_realm] .fqdn.de = FQDN.de fqdn.de = FQDN.de [logging] default = SYSLOG:NOTICE:DAEMON kdc = FILE:/var/log/kdc.log kadmind = FILE:/var/log/kadmind.log [appdefaults] pam = { ticket_lifetime = 1d renew_lifetime = 1d forwardable = true proxiable = false retain_after_close = false minimum_uid = 0 debug = false krb4_convert = false } --------------------------------------------------------- fqdn =^ domain.name.de FQDN =^ DOMAIN.NAME.DE ads_dc01 = Windows Active Directory Domain Controller xms010 = Linux Mailserver I don`t know wether this settings are the most sophisticated, but for now it works. I´m using a cron to get a new tg-ticket. Greetings, Chris > Ich habe verwendet: > > kinit -t /etc/krb5.keytab \ > host/linuxrechner.fullqualifieddomain.org > > Ist das noch korrekt? Ich bekomme nämlich als Antwort: > kinit: krb5_get_init_creds: Additional pre-authentication required > > [Zu diesem Zeitpunkt habe ich ein gültiges Ticket > (Administrator) auf dem Linuxrechner] > > Vielleicht liegt der Fehler ja auch vorher: > unter W2K habe ich einen Benutzeraccount namens linux > angelegt, und diesen mit Adminrechten versehen. > > [Für diesen Account möchte ich nun ein keytabfile erzeugen, > das ich auf den linuxrechner verschiebe und dann dort verwende.] > --------------- > ktpass -princ > host/linuxrechner.fullqualifieddomain.org(a)fullqualifieddomain.org \ > -mapuser linux -pass test123 -out linux.keytab > ---------------------- > Als antwort bekomme ich unter Windows in etwa: > ----------------- > Sucessfully mapped host/linuxrechner.fullqualifieddomain.org to \ > user linux > Key created > Output to linux.keytab > Keytab version > keysize ... > Account has been set for DES-only encryption > > Danke für alle Hilfen! > > P.S.: Ich habe aus Versehen diese Mail in Deutsch > geschrieben, deswegen kriegst du sie mal zuerst, ich muss Sie > nachher noch umtexten für die Liste > > > > > A following klist shows your current tgt. > > > > > > > > > > Mit freundlichen Grüßen > > > > > > Chris > > > > > -----Ursprüngliche Nachricht----- > > > Von: Markus Feilner [mailto:lists@feilner-it.net] > > > Gesendet: Dienstag, 17. Februar 2004 11:00 > > > An: suse-security List > > > Betreff: [suse-security] Samba 3.0, ADS, Kerberos > > > > > > Hello List, > > > I have successfully integrated samba to an Active Directory > > > Domain, and it is authenticating against the ADS, but only > > > while the Kerberos ticket is valid. After that period it > > > seems to take only the user/group list from its (winbind) cache. > > > > > > By now i can get a kerberos ticket with "kinit Administrator" > > > or any other username that has administrative rights on ADS > > > and all is fine. > > > But after 8 hours this ticket is no longer valid. How can I > > > renew or re-get an (new) ticket automatically? > > > > > > I searched many sites and found several solutions, but > none worked. > > > Probably the best one is about keytabs, which I could > > > generate on The Windows System, but kerberos does not seem to > > > use them. > > > > > > Most of the solutions I found are for MIT kerberos, but I use > > > heimdal (as of SuSE 9.0), where e.g. the hints from new > > > zealand's linux wiki > > > (http://www.wlug.org.nz/ActiveDirectorySamba) don't work. > > > They tell me to import the keytab file with > > > ----------------- > > > % ktutil > > > ktutil: rkt mail.keytab > > > ktutil: list > > > ktutil: wkt /etc/krb5.keytab > > > ktutil: q > > > ------------------ > > > But this does not work - not with ktutil and not with kadmin. > > > Perhaps i missed something? > > > Thanks a lot!!! > > > -- > > > Mit freundlichen Grüßen > > > Markus Feilner > > > -- > > > Linux Solutions, Training, Seminare und Workshops - auch > > > Inhouse Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg > > > fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 > > > web: http://feilner-it.net mail: mfeilner(a)feilner-it.net > > > > > > -- > > > Check the headers for your unsubscription address > > > For additional commands, e-mail: suse-security-help(a)suse.com > > > Security-related bug reports go to security(a)suse.de, not here > > -- > Mit freundlichen Grüßen > Markus Feilner > > Linux Solutions, Training, Seminare und Workshops - auch Inhouse > Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg > fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 > web: http://feilner-it.net mail: mfeilner(a)feilner-it.net >

3 3

Re: [suse-security] postgresql suse 9.0
by piet 19 Feb '04

19 Feb '04

Keith Roberts wrote: > On Wed, Feb 18, 2004 at 12:22:45PM +0000, Keith Roberts wrote: > > Hi piet! > > You could try the following: > > Use yast to uninstall postgresql. > > Use yast to reinstall postgresql. > > Use fou4s or YaST Online Update to get the latest security > patches. > > Use yast and go to: > > System Runlevel editor. > > Click on run level properties. > > Highlight postgresql line. > > Click on Set/Reset and Enable the service. > > Click on Start/Stop/Reset and Start Now. > > See if postgresql starts ok. > > If yes, click on Finish to save the run level configuration. > > You could then exit yast, and as root try > > /etc/init.d/postgresql stop > > /etc/init.d/postgresql start > > If the above works ok, then at next reboot, postgresql > should start ok. > > PS I use mysql instead & SuSE 8.1. > > HTH - Regards Keith Roberts > > > I just wanted to try out a program named photo-organizer, it makes use of postgresql, and compair it to Linpha (which uses MySQL) If I was smart enough I would write stuff like that myself, but I guess I am better in making pictures, and just use programs as they are. regards, piet

1 0

AW: [suse-security] Apache Header
by Stefan.Junge＠ssi-schaefer.de 19 Feb '04

19 Feb '04

Hi Uli ! Thank you ! It works ! Stefan

1 0

Apache Header
by Stefan.Junge＠ssi-schaefer.de 19 Feb '04

19 Feb '04

Hi, Is it possible to modify the apache header without recompiling the whole package ? I have installed a standard apache (RPM) shipped with SuSE. When I´m scanning the box you will see e.g Server:Apache/1.3.x(Linux/Suse)... Any hints ? Stefan

2 2

PPTP VPN Connection Windows XP client - Linux Server
by Stefan Gofferje 18 Feb '04

18 Feb '04

Good morning everyone! I need to integrate some WinXP clients into a Linux-dominated VPN-network. Can anyone give me a hint, how I could tell WinXP to connect to a VPN-server on startup and set a static route to a remote LAN through the VPN server while leaving the default route set to the local Internet gateway. regards, Stefan

9 13

AW: [suse-security] PPTP VPN Connection Windows XP client - Linux Server
by Josef.Fuchs＠leykam.com 18 Feb '04

18 Feb '04

-----Ursprüngliche Nachricht----- Von: Rasp, Robert [mailto:Rob@killrob.de] Gesendet: Mittwoch, 18. Februar 2004 14:07 An: suse-security(a)suse.com Betreff: AW: [suse-security] PPTP VPN Connection Windows XP client - Linux Server Wichtigkeit: Niedrig You can use RASDIAL on the windows client to dial a preconfigured VPN connection Also you can use PING to check for the existenz of the connetion. Put all into a batch file and use it to establish connection . . . RASDIAL NameOfVPNconnection Username Password if errorlevel 1 goto DispError ROUTE ADD .... MASK .... .... :Retry PING YourRemoteHostIP 2>NUL >NUL if errorlevel 1 goto Retry NET USE X: \\Servername\ShareName /PERSISTENT:NO . . . kind regards Josef Fuchs vox: +43 316 2800 218 Leykam Medien AG fax: +43 316 2800 69218 Ankerstraße 4 mailto:josef.fuchs@leykam.com A-8054 Graz http://www.leykam.com

2 1

SuSEfirewall2 and masquerading
by Ralf Ronneburger 18 Feb '04

18 Feb '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi everyone, I have a box (SuSE 9.0, SuSEfirewall2) in front of a school-network with 2 public IPs on the outside Interface. Is there a way to configure masquerading so that one internal machine masquerades to IP1 (server) and the other to IP2 when connections are opened from internal? As far as I can see everything is masqueraded to the primary IP of the external interface... Greetings, Ralf -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFAM5ruLbWu9MVtJiYRAmh6AJ95B/mkvpJAPgLZ5x4zvF39J5WCIQCfZhGO 0XnI2mjpM8ZBmZOVwAXwxF0= =aC0r -----END PGP SIGNATURE-----

1 0

mremap again...
by Sven 'Darkman' Michels 18 Feb '04

18 Feb '04

For those who don't know already: http://isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt (yes, its something new...) Regards, Sven

2 2

AW: [suse-security] PPTP VPN Connection Windows XP client - Linux Server
by Rasp, Robert 18 Feb '04

18 Feb '04

Try the Connection-Manage from Windows 2000 Server or Windows 2003 Server CU Robert -----Ursprüngliche Nachricht----- Von: Graham Smith [mailto:gqs@iinet.net.au] Gesendet: Mi 18.02.2004 08:59 An: suse-security(a)suse.com Cc: Betreff: Re: [suse-security] PPTP VPN Connection Windows XP client - Linux Server

1 0

AW: [suse-security] ID wwywxugwisi... thanks
by Jensen, Gerard 18 Feb '04

18 Feb '04

Hi there, just my "2cents worth" on this security related issue, which I feel can be extended to generally any type of mailing list, even those we may set up for our own networks at home or on the office: > i would not like to remove all attachments, sometimes ppl post configs > etc. or maybe a png about a network topology. Actually I think that on a list that deals with security issues we should be able to come up with a solution here that could serve as an example for other lists, perhaps very specifically giving hints on how to configure a system to do similar filtering say on lists served my majordomo. What type of attachmenets for example would one allow? I especially put the question this way around, because I think that's easier to define than to attempt to pinpoint everything one would want to *disallow*. Obviously one would have the option to only allow MIME type attachmenets and then filter out any "unwanted" types, such as HTML, mpeg and whatever else produces a headache (obviously it's a better idea to agree on what types we *will* let through then arguing the other way around, as that might end up in an endless discussion). How can one go about this project using available tools under Linux? > Besides from that, i would more like if ppl would learn not to click > on every shit in an email. Who wouldn't. Then again, generations of EMail users have tried to educate other users about this one, and it still doesn't seem to hit home with everyone. So if you can't get what you want, accept it as a given fault you can't rectify and rather see how we can prevent these people to receive hazardous attachments from this list in the first place - after all, if they don't think, we'll have to. > If you really want to drop attachments, then maybe just the well known > windows executables like com exe bat pif scr etc. There have been terrifyingly aggressive discussions on other lists wether to allow anything else but pure "text/plain" messages, so one probably can grab all of those already stated arguments and reguritate them here as well - but in general I can follow the otherwise also abundantly practiced policy of only allowing what is absolutely necessary to fullfill a specific purpose of a system - here to conduct a security related discussion in a meaningfull way. Essentially that means: we shouldn't allow any attachment types apart from those we have speicifically agreed upon here. As I said, *not* the other way around: attempting to specify what types we will *not* allow just leaves too many loopholes. > just my 2eurocents. Same here... > Sven Gerard

1 0