March 2004 - openSUSE Security - openSUSE Mailing Lists

read it immediately
by poeml＠suse.de 14 Mar '04

14 Mar '04

why?

1 0

RE: [suse-security] NAI on unix do not find actual virus
by GarUlbricht7＠netscape.net 13 Mar '04

13 Mar '04

"Mrvka Andreas" <mrv(a)tuev.at> wrote: > > hi, > > i use the NAI product for my SuSE Linux 9 distribution. > VirusScan for Unix: with actual engine and Dat file... ----<text snipped>--- > i copied the exe file out of the zip file and ran > the uvscan but nevertheless i was unsuccessful :-( > And you are unhappy ??? My father has a saying: "Don't go looking for trouble, it will find you soon enough." Unless you have a test environment that is off the web, please don't go opening up stange files... However, in this case i would suspect that SuSE or one of the ISP's stripped out the virus, IAE, i hope so ... if not maybe a re-install would be a good idea --- especailly if your machine is dual boot ... There is also a Urban Lengend that the anti-virus people update their dat files as soon as they hear of new virus -- just so people feel good --- however,in some cases it may take them a while before they actually have a fix. You might want to try again running your virus scan. -- "Paranoia is heightened awareness." -- __________________________________________________________________ Introducing the New Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

8 10

RE: [suse-security] harden_suse for 9.0?
by GarUlbricht7＠netscape.net 12 Mar '04

12 Mar '04

Lucky Leavell <susesec(a)UniXpress.com> wrote: > I downloaded the RPM which indicated it was for 8.1; > will it work on 9.0 > Might, but my general recommendation is don't install rpms from one distro in another. Reason: changes in libraries, files systems, etc. If you really want it, rebuild it from the source code. > > or is there a later version available? > >Thank you, >Lucky Leavell > Hi Lucky, With regard to a later version, in my limited experiencce, I have noticed that SuSE has "cranked down" the open ports, shut down unnecessary services, etc. and in general done the things that "harden suse" did. As a result they are no longer maintainig it. Further, In my humble opinion, security includes having a security policy and a good fire wall, preferably on a box that is "separate" from the rest of your system. If you want to "harden" your system, you can go into YaST Control Center --> Security & Users --> Security Settings --> and do either custom settings or "whatever" Hope this helps, Gar -- "The quickest way to get information on the web is not to ask a question, but to post the wrong information." - Aahz' Law restated -- __________________________________________________________________ Introducing the New Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

1 0

postfix/imap/cyrus-sasl and Pam backend
by Markus Feilner 12 Mar '04

12 Mar '04

Hello List, I am looking for a site with good information about postfix, cyrus-sasl (and later kerberos authentikation against Active Directory). I have postifix and imap running with cyrus sasl and sasldb, but i did not manage to get it to authenticate against pam or kerberos. I have been googling, but i could not find a solution. I know that: - /etc/sysconfig/saslauthd tells saslauthd which mech to use. the entry is: SASLAUTHD_AUTHMECH=pam - /usr/lib/sasl2/smtpd.conf pwcheck_method: saslauthd mechlist: plain login crammd5 digestmd5 -/etc/posstfix/main.cf for testing: (...) smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous broken_sasl_auth_clients = yes (...) Now: postfix grants all users access based on user/password kombinations in sasldb - and only those users. Shouldn't saslauth use the local user/password Kombination? (BTW: Why does sasl with PAM only work with PLAIN?) Thanks a lot! -- Mit freundlichen Grüßen Markus Feilner -- Linux Solutions, Training, Seminare und Workshops - auch Inhouse Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

5 21

IPsec und racoon im transport-mode
by Frank Herchet (mailings) 12 Mar '04

12 Mar '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hallo, vielleicht kann mir ja einer helfen, ich versuche gerade die verbindung zwischen zwei hosts via ipsec und racoon zu verschlüsseln. leider klappt das nicht so wie gewollt.... hier ein paar daten: - ----------------------------------------------------------------------- # /usr/sbin/setkey -f # Flush the SAD and SPD flush; spdflsuh; spdadd 192.168.1.10[any] 192.168.1.12[any] any -P out ipsec esp/transport/192.168.1.10-192.168.1.12/require ah/transport/192.168.1.10-192.168.1.12/require; spdadd 192.168.1.12[any] 192.168.1.10[any] any -P in ipsec esp/transport/192.168.1.12-192.168.1.10/require ah/transport/192.168.1.12-192.168.1.10/require; - ----------------------------------------------------------------------- and racoon.conf - ----------------------------------------------------------------------- remote 192.168.1.12 { exchange_mode main; proposal { encryption_algorithm 3des; hash_algorithm md5; authentication_method pre_shared_key; dh_group modp1024; } } sainfo address 192.168.1.0/24 any address 192.168.1.0/24 any { pfs_group modp768; encryption_algorithm 3des; authentication_algorithm hmac_md5; compression_algorithm deflate; } - ----------------------------------------------------------------------- nachdem ich racoon gestartet habe und den anderen host pinge bekomm ich diese meldung, jedoch keine verbindung 2004-03-12 22:58:19: DEBUG: pfkey.c:195:pfkey_handler(): get pfkey ACQUIRE message 2004-03-12 22:58:19: DEBUG: pfkey.c:1548:pk_recvacquire(): suitable outbound SP found: 192.168.1.12/32[0] 192.168.1.10/32[0] proto=any dir=out. 2004-03-12 22:58:19: DEBUG: policy.c:183:cmpspidxstrict(): sub:0xbffff480: 192.168.1.10/32[0] 192.168.1.12/32[0] proto=any dir=in 2004-03-12 22:58:19: DEBUG: policy.c:184:cmpspidxstrict(): db :0x809f490: 192.168.1.10/32[0] 192.168.1.12/32[0] proto=any dir=in 2004-03-12 22:58:19: DEBUG: pfkey.c:1564:pk_recvacquire(): suitable inbound SP found: 192.168.1.10/32[0] 192.168.1.12/32[0] proto=any dir=in. 2004-03-12 22:58:19: DEBUG: pfkey.c:1603:pk_recvacquire(): new acquire 192.168.1.12/32[0] 192.168.1.10/32[0] proto=any dir=out 2004-03-12 22:58:19: ERROR: pfkey.c:1633:pk_recvacquire(): failed to get sainfo. vielleicht kann mir ja jemand helfen .... thx Frank -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iQCVAwUBQFIz+/qrCi15ZonmAQKZrgP/T8HxzogEGV0ludaVxpQraBC9Aq6wy0nl PDCIiStDOHKo7mU6os1bZ3WjasmInRbll6TG0FHUnVVMEXd7GMKOJZX4G9yjqZSC tFgTKsiuMv7D7GZUZdlCJha3+4kw4m750R6LXcj0f27euQ7Xx3hspBigx4gpR1HQ FemrY3mFruA= =h/3D -----END PGP SIGNATURE-----

1 1

Re: [suse-security] HTTP File Uploads
by Keith Roberts 12 Mar '04

12 Mar '04

To Ralf Ronneburger, Tom Knight. On Fri, 12 Mar 2004, Ralf Ronneburger wrote: > you don't need to put max_file_size into the form, that can be fooled > much easier. Better is to put some quota on the dir so nobody uploads > you your 1MB jpeg until the disk is full. You could also check the size > of the upload-folder in you php-script. I shall write a php function to check for a minimal amount of disk space on the partition before copying the file(s) there. QUOTE PHP MANUAL ---------------------------------------- float diskfreespace (string directory) Given a string containing a directory, this function will return the number of bytes available on the corresponding filesystem or disk partition. UNQUOTE PHP MANUAL ---------------------------------------- > About viruses - I'd not worry about it too much. If someone uploads a > virus for you then the webserver will in no way execute that file. And > you will probably not do a chmod +x *.jpg ;-). Just be sure to have the > right file-permissions. I shall make sure that the file permissions are NOT set to 'x' on any uploaded files. > I'm quite sure you could also check if the file > is really a jpeg or not and reject it if it is not, ImageMagick or GDLib > will do such things for you. I shall look into this too. From: Tom Knight <thomas.knight(a)ahds.ac.uk> Subject: RE: [suse-security] HTTP File Uploads In addition to this you could use a separate partition for this sort of data. If you want to get anal you could mount this partition noexec...? I do have a seperate 3Gig partition for /tmp, so space should not really be a problem at the moment. For now upload file are kept in a /tmp sub-dir. I may need to copy the jpg files to another partition, apart from /tmp. Probably check the integrity of the uploaded files in the seperate directory. If they pass the checks, move them into the database partiton - This is so the photos will be backed up when I backup the databases. > (I don't know what you're intending to do with these > files). My site is an online mutual exchange register. I'm working on allowing registered users to be able to upload photos of their properties. When another user searches the site, they can ask for the photos of interesting exchange properties to be displayed. It's a free community based website for King's Lynn, Norfolk, UK, that I work on in my spare time. Thanks for your comments. Kind Regards Keith Roberts. www.karsites.net PS - would anyone like to try some XSS attacks against my site? Please email me first before doing so.

1 0

Anti-Virus reports
by Barry Gill 12 Mar '04

12 Mar '04

Hello All. As most of you are technical, you should for the most part be in control of, or have the ear of the person who is in control of your corporate anti-virus solutions. Please for the sake of the internet can you STOP your servers sending virus notifications to the originators of the message as with today's modern virii 90% of virii use spoofed "from:" addresses. So, every time some poor person out there with MY name in their address book, or contacts folder gets a virus, I get 3000 messages (as I am sure do most of you on this list at least) telling me that I sent a virus to someone I have never heard of in my life before. This form of server administration is a very very poor form of security as you are willfully informing people who have possibly never thought of you or your servers before several key steps that it may have taken them some time to figure out. Things like... Antigen for Exchange found ScanMail for Microsoft Exchange took action on the message. The message details were: Symantec AVF detected an unrepairable NAV for Microsoft Exchange etc etc etc. Sending out mass mailer responses to virii wastes as much respource as coping with the virii themselves. Stop wasting your and my bandwidth, send reports only to admin, check the headers and if you receive mail form an address or domain often and the headers check out, THEN notify the admin/postmaster of that domain. I mean please, telling Lucy in the clerks dept about the fact that she is sending virii to somebody she has never met in Luxembourg is only going to cost her tima and money as she will call out her IT people to clean her "infected machine" Sorry about the rant, this is just one of the most annoying things that for some reason no-one ever seems to consider when setting up all this AV stuff. Barry

6 6

Re: [suse-security] pam_winbind problem ...User not known to the underlying authentication module
by Lars Ellenberg 12 Mar '04

12 Mar '04

Message-ID: <REfBP6x3toMX1dymaz5YdCk=lge(a)web.de> Reply-To: In-Reply-To: <200403121253.58396.mfeilner(a)feilner-it.net> / 2004-03-12 13:05:33 +0100 \ Markus Feilner: > Hello List, > I have successfully integrated samba 3 to ADS Domain, and now i want to > allow domain-users to access services on my linux box. For testing i > chose /etc/pam.d/login and tried to allow ADS Users access to the > console. But i always get the following errors: > > Mar 12 12:45:59 cuba90 pam_winbind[9011]: user 'r-ermer+mfeilner' > granted acces > Mar 12 12:45:59 cuba90 login[9011]: User not known to the underlying > authentication module guessing only: it might be that the "not known" error comes from pam_mkhomedir Lars Ellenberg > r-ermer is the correct domain, user is auth'd correctly, but no access > is given. Why? I do not understand the second error, about User not > known ... . > Here is my /etc/pam.d/login: > > #%PAM-1.0 > auth required pam_securetty.so > auth required pam_env.so > auth sufficient pam_unix2.so nullok > auth sufficient pam_winbind.so use_first_pass > auth required pam_deny.so > auth required pam_nologin.so > account sufficient pam_winbind.so > account required pam_unix2.so > password required pam_pwcheck.so nullok > #password required pam_unix2.so nullok use_first_pass use_authtok > session sufficient pam_unix2.so none # debug or trace > session sufficient pam_limits.so > session required pam_mkhomedir.so skel=/etc/skel/ umask=0022 > > I am running SuSE 9.0, and i remember that this used to work with an NT > domain under SuSE 8.0 - but what did I do wrong? > Thanks!!!

2 1

pam_winbind problem ...User not known to the underlying authentication module
by Markus Feilner 12 Mar '04

12 Mar '04

Hello List, I have successfully integrated samba 3 to ADS Domain, and now i want to allow domain-users to access services on my linux box. For testing i chose /etc/pam.d/login and tried to allow ADS Users access to the console. But i always get the following errors: Mar 12 12:45:59 cuba90 pam_winbind[9011]: user 'r-ermer+mfeilner' granted acces Mar 12 12:45:59 cuba90 login[9011]: User not known to the underlying authentication module r-ermer is the correct domain, user is auth'd correctly, but no access is given. Why? I do not understand the second error, about User not known ... . Here is my /etc/pam.d/login: #%PAM-1.0 auth required pam_securetty.so auth required pam_env.so auth sufficient pam_unix2.so nullok auth sufficient pam_winbind.so use_first_pass auth required pam_deny.so auth required pam_nologin.so account sufficient pam_winbind.so account required pam_unix2.so password required pam_pwcheck.so nullok #password required pam_unix2.so nullok use_first_pass use_authtok session sufficient pam_unix2.so none # debug or trace session sufficient pam_limits.so session required pam_mkhomedir.so skel=/etc/skel/ umask=0022 I am running SuSE 9.0, and i remember that this used to work with an NT domain under SuSE 8.0 - but what did I do wrong? Thanks!!! -- Mit freundlichen Grüßen Markus Feilner -- Linux Solutions, Training, Seminare und Workshops - auch Inhouse Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

1 0

HTTP File Uploads
by Keith Roberts 12 Mar '04

12 Mar '04

Hi everyone. I'm using SuSE 8.1 pro fully patched. I'm working on a php script to upload user supplied jpg photos to my server. The pictures will be moved from /tmp to another temp directory for virus checking. What are the security issues involved when allowing users to upload files to my server like this? Any advice would be appreciated. Kind Regards - Keith Roberts

4 4