March 2004 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] windows to squid to internet
by Sturgis, Grant 11 Mar '04

11 Mar '04

Scott, You can test squid a number of different ways. Point your client's web browser (after it has been configured to use the proxy) to a web page. Then, on the proxy, watch access_log (usually /usr/local/squid/var/logs/access_log ). You should see the traffic in that log. If that doesn't work, telnet to port 3128 of the proxy server from the client. If it connects, you should be able to issue HTTP commands like: GET http://www.w3.org HTTP/1.0 and get a response. If that doesn't work, you can try squidclient on the proxy server. That binary is in /usr/local/squid/bin on your proxy server. cd /usr/local/squid/bin ./squidclient http://www.w3.org and you should get back a bunch of html. If that doesn't work, then your squid server is not connected to the Internet correctly. Also, check your error_log in /usr/local/squid/var/logs Check those things and let us all know how it works out. Grant > -----Original Message----- > From: Scott Wrobel [mailto:saw424@xeomail.com] > Sent: Wednesday, March 10, 2004 7:46 PM > To: suse-security(a)suse.com > Cc: suse-slstd-e(a)suse.com > Subject: [suse-security] windows to squid to internet > > > > > I am trying to set up two windows boxes to connect to the > internet throught my linux box using squid. I have made my > own squid.conf file as shown below. > I have gone into the windows computers (2000 pro > (192.168.1.27) and 98 (192.168.1.25)) and told them both to > use the proxy server over a network, address: localhost and > port: 3128, however i am getting no results. > The windows computers are manually configured to be in the > same workgroup, gateway, netmask, and have the same first 3 > segments of the ip addres as the server and can ping the server. > Samba is running and is working. > DHCP is giving me problems now that i have finally gotten > it working. > The modem in the linex box does connect to the internet. > Any help / opinions / reasons why this is not related to a > security mailing list ;) / etc. will be accepted warmly. > > http_access allow src 192.168.1.25 > http_access allow src 192.168.1.27 > http_access allow all > acl all src 0.0.0.0/0.0.0.0 > acl manager proto cache_object > acl localhost src 192.168.1.25/255.255.255.0 > acl localhost src 192.168.1.27/255.255.255.0 > acl to_localhost dst 127.0.0.0/8 > acl SSL_ports port 443 563 > acl Safe_ports port 80 # http > acl Safe_ports port 21 # ftp > acl Safe_ports port 443 563 # https, snews > acl Safe_ports port 70 # gopher > acl Safe_ports port 210 # wais > acl Safe_ports port 1025-65535 # unregistered ports > acl Safe_ports port 280 # http-mgmt > acl Safe_ports port 488 # gss-http > acl Safe_ports port 591 # filemaker > acl Safe_ports port 777 # multiling http > acl CONNECT method CONNECT > > FadMart - http://www.fadmart.com - An Associate of the > World's Largest Store! > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

1 0

Re: [suse-security] Problems in installing OpenVPN on SuSE 8.1
by Philipp Rusch 11 Mar '04

11 Mar '04

wow, this was the fastest response I ever had from any list ... :-) For the headers, you mean ? That they need them to compile the SSL-libs into their package ... hmmm, could be, I will try it ! Thanks, Philipp Hemsley, Trevor schrieb: >OpenSSL-devel perhaps? > >-----Original Message----- >From: Philipp Rusch [mailto:philipp.rusch@rusch-edv.de] >Sent: 11 March 2004 15:39 >To: suse-security(a)suse.com >Subject: [suse-security] Problems in installing OpenVPN on SuSE 8.1 > > >Hello all, >today i encountered a problem when installing OpenVPN 1.6.rc2 >on a SuSE 8.1 with all patches applied. >Doing a ./configure-run after unpacking the tarball gives me an error >about missing OpenSSL headers with a hint to install that package >before traing to install OpenVPN. >BUT- I have OpenSSL 0.9.6 ... installed through YAST, it is reported >as being installed and I even used TinyCA with it to set up my RootCA, >so it is working quite well. >What do I miss ? > >TIA, Philipp > > > >

1 0

Problems in installing OpenVPN on SuSE 8.1
by Philipp Rusch 11 Mar '04

11 Mar '04

Hello all, today i encountered a problem when installing OpenVPN 1.6.rc2 on a SuSE 8.1 with all patches applied. Doing a ./configure-run after unpacking the tarball gives me an error about missing OpenSSL headers with a hint to install that package before traing to install OpenVPN. BUT- I have OpenSSL 0.9.6 ... installed through YAST, it is reported as being installed and I even used TinyCA with it to set up my RootCA, so it is working quite well. What do I miss ? TIA, Philipp

1 0

Re: allow 'su' to limited users
by Thomas Leske 11 Mar '04

11 Mar '04

Gero Schmidt-Kärst wrote: > I guess there is a easy possibility to allow the command 'su' only to a > small group of users. You can also configure PAM (plugable authentication modules) for this purpose. The following configuration of /etc/pam.d/su is not only convenient, because it does not prompt for a password. It may be also more secure: When you use a ssh client with X11-Forwarding, the other side can also try to listen to the passwords that you enter in an other window on the same Xserver. You should also never su from a less secure account to a more secure one, because the su command may have been replaced by a trojan. This configuration does not allow that in the first place, and thus enforces good security practice. As you are never prompted for a password, a trojaned "su" can also not trick you to enter one so easily. /etc/pam.d/su: #%PAM-1.0 # This configuration never prompts for a password. # SuSE-Default: auth sufficient pam_rootok.so # The users (usually only one) in suuser_list.txt are allowed to switch to any user. # These accounts should only be used for system maintainance. (For instance you don't want to start KDE directly as root). auth sufficient pam_listfile.so item=ruser sense=allow file=/etc/pam.d/suuser_list.txt onerr=fail # The users (usually only one) in suuser_list2.txt can only switch to users in suuser_list2_to.txt. # This allows one to set up an extra account ("surfer") for web browsing. So in case there is a security # hole in the browser, the attacker does not get access sensitive data (like private gpg or ssh keys). # Konqueror can be started like this: sux -c "cd; /opt/kde3/bin/konqueror" -l surfer auth required pam_listfile.so item=ruser sense=allow file=/etc/pam.d/suuser_list2.txt onerr=fail auth sufficient pam_listfile.so item=user sense=allow file=/etc/pam.d/suuser_list2_to.txt onerr=fail # (I wonder, how to extend the scheme to more pairs of suuser_list?.txt, suuser_list?_to.txt.) # no other uses of su are allowed: auth required pam_deny.so # SuSE-Defaults: account required pam_unix2.so password required pam_pwcheck.so nullok password required pam_unix2.so nullok use_first_pass use_authtok #session required pam_homecheck.so session required pam_unix2.so debug # none or trace

1 0

Email account utilization warning.
by noreply＠suse.com 11 Mar '04

11 Mar '04

Dear user of Suse.com, Your e-mail account has been temporary disabled because of unauthorized access. For further details see the attach. For security reasons attached file is password protected. The password is "75812". The Management, The Suse.com team http://www.suse.com

1 0

ssh: Changing Host Keys
by Lucky Leavell 11 Mar '04

11 Mar '04

OS: SuSE 9.0 using SuSEfirewall2 This was a Red Hat 8 box which we blew away when doing a FTP install of SuSE 9 (neat!). Unfortunately, we had used this box to ssh into and used the same IP address for the SuSE install. After a bit of tweaking, I got ssh to connect but now it complains about the host key change: Script started on Wed Mar 10 15:12:58 2004 ris713 lucky /home/lucky 0:0 $ ssh -p 70 lucky(a)209.44.30.102 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that the RSA host key has just been changed. The fingerprint for the RSA key sent by the remote host is 85:e3:e6:b0:ab:67:38:9b:ce:22:e7:92:9b:31:d7:c8. Please contact your system administrator. Add correct host key in /home/lucky/.ssh/known_hosts to get rid of this message. Offending key in /home/lucky/.ssh/known_hosts:4 RSA host key for 209.44.30.102 has changed and you have requested strict checking. Host key verification failed. script done on Wed Mar 10 15:13:16 2004 Just exactly which key(s) should be deleted/added from where? Thank you, Lucky Leavell

4 3

Sendmail on 9.0
by edwin 11 Mar '04

11 Mar '04

Hi all, I just installed Sendmail-8.12.10-7 on SuSE 9.0. I set SuSEfirewall2 to listen to SMTP. I also already set SMTPD_LISTEN_REMOTE ="yes" in /etc/syscinfig/mail. When I do 'lsof | grep LISTEN' it shows that sendmail 2721 r oot 4u IPv4 4929 TCP *:smtp (LISTEN) but when I send an email from trusted network to someone in internet it replys that RELAYING DENIED for the to address. I just only send the email from local. Anyone facing this problem? TIA edwin

4 8

RE: [suse-security] DHCP Problems
by sematin＠mtn.co.ug 11 Mar '04

11 Mar '04

> -----Original Message----- > From: Frank Huebsch [mailto:SuSE-security@fhuebsch.de] > Sent: 11 March 2004 11:30 > To: suse-security(a)suse.com > Subject: RE: [suse-security] DHCP Problems > > > Hello! > > What kind of network infrastructure are you using? > I experienced problems with dhcp clients connected to managed > switches. The problem ocurred when fastpath was activated on > the client port. After disabling fastpath the first dhcp > request passed without problems. > > Can anyone give me further information on the reason/implication?!? You didn't mention what vendor your "managed switch" is from... Noah.

1 0

RE: [suse-security] Sendmail on 9.0
by sematin＠mtn.co.ug 11 Mar '04

11 Mar '04

You do not have to run sendmail form xinetd or inetd for that matter in order to change the port it listens on. You just have to change DaemonPortOptions in sendmail.cf and restart sendmail. Noah. > -----Original Message----- > From: edwin [mailto:edwin@nsi.co.id] > Sent: 11 March 2004 11:55 > To: suse-security(a)suse.com > Subject: RE: [suse-security] Sendmail on 9.0 > > > Yes my firewall is masqueraded. > Actually I already put the domain name on > /etc/mail/relay-domains but it is not work. > > And after your email I put also the name of the firewall and > its ip address, and voila it works. Thanks for your suggestion Holger. > > Anyway, in 7.3 I use an antivirus daemon to protect smtp ( I > still have client using W$$$$ws). I give the port 25 to the > antivirus and move the sendmail to another port. It is > possible because smtp was running through inetd. > > Is it possible to use xinetd for sendmail in 9.0 and move the smtp > (sendmail) to another port? Anyone here have experienced? > > TIA > medwin > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

AW: [suse-security] DHCP Problems
by Rasp, Robert 11 Mar '04

11 Mar '04

Hello, are you sure, your dhcpd is running ?? Is your dhcpd set at least in runnlevel 3 ?? CU Robert -----Ursprüngliche Nachricht----- Von: Scott Wrobel [mailto:saw424@xeomail.com] Gesendet: Do 11.03.2004 04:14 An: suse-security(a)suse.com; suse-slstd-e(a)suse.com Cc: Betreff: [suse-security] DHCP Problems

1 0