March 2004 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] HTTP File Uploads
by Keith Roberts 12 Mar '04

12 Mar '04

To Ralf Ronneburger, Tom Knight. On Fri, 12 Mar 2004, Ralf Ronneburger wrote: > you don't need to put max_file_size into the form, that can be fooled > much easier. Better is to put some quota on the dir so nobody uploads > you your 1MB jpeg until the disk is full. You could also check the size > of the upload-folder in you php-script. I shall write a php function to check for a minimal amount of disk space on the partition before copying the file(s) there. QUOTE PHP MANUAL ---------------------------------------- float diskfreespace (string directory) Given a string containing a directory, this function will return the number of bytes available on the corresponding filesystem or disk partition. UNQUOTE PHP MANUAL ---------------------------------------- > About viruses - I'd not worry about it too much. If someone uploads a > virus for you then the webserver will in no way execute that file. And > you will probably not do a chmod +x *.jpg ;-). Just be sure to have the > right file-permissions. I shall make sure that the file permissions are NOT set to 'x' on any uploaded files. > I'm quite sure you could also check if the file > is really a jpeg or not and reject it if it is not, ImageMagick or GDLib > will do such things for you. I shall look into this too. From: Tom Knight <thomas.knight(a)ahds.ac.uk> Subject: RE: [suse-security] HTTP File Uploads In addition to this you could use a separate partition for this sort of data. If you want to get anal you could mount this partition noexec...? I do have a seperate 3Gig partition for /tmp, so space should not really be a problem at the moment. For now upload file are kept in a /tmp sub-dir. I may need to copy the jpg files to another partition, apart from /tmp. Probably check the integrity of the uploaded files in the seperate directory. If they pass the checks, move them into the database partiton - This is so the photos will be backed up when I backup the databases. > (I don't know what you're intending to do with these > files). My site is an online mutual exchange register. I'm working on allowing registered users to be able to upload photos of their properties. When another user searches the site, they can ask for the photos of interesting exchange properties to be displayed. It's a free community based website for King's Lynn, Norfolk, UK, that I work on in my spare time. Thanks for your comments. Kind Regards Keith Roberts. www.karsites.net PS - would anyone like to try some XSS attacks against my site? Please email me first before doing so.

1 0

Anti-Virus reports
by Barry Gill 12 Mar '04

12 Mar '04

Hello All. As most of you are technical, you should for the most part be in control of, or have the ear of the person who is in control of your corporate anti-virus solutions. Please for the sake of the internet can you STOP your servers sending virus notifications to the originators of the message as with today's modern virii 90% of virii use spoofed "from:" addresses. So, every time some poor person out there with MY name in their address book, or contacts folder gets a virus, I get 3000 messages (as I am sure do most of you on this list at least) telling me that I sent a virus to someone I have never heard of in my life before. This form of server administration is a very very poor form of security as you are willfully informing people who have possibly never thought of you or your servers before several key steps that it may have taken them some time to figure out. Things like... Antigen for Exchange found ScanMail for Microsoft Exchange took action on the message. The message details were: Symantec AVF detected an unrepairable NAV for Microsoft Exchange etc etc etc. Sending out mass mailer responses to virii wastes as much respource as coping with the virii themselves. Stop wasting your and my bandwidth, send reports only to admin, check the headers and if you receive mail form an address or domain often and the headers check out, THEN notify the admin/postmaster of that domain. I mean please, telling Lucy in the clerks dept about the fact that she is sending virii to somebody she has never met in Luxembourg is only going to cost her tima and money as she will call out her IT people to clean her "infected machine" Sorry about the rant, this is just one of the most annoying things that for some reason no-one ever seems to consider when setting up all this AV stuff. Barry

6 6

Re: [suse-security] pam_winbind problem ...User not known to the underlying authentication module
by Lars Ellenberg 12 Mar '04

12 Mar '04

Message-ID: <REfBP6x3toMX1dymaz5YdCk=lge(a)web.de> Reply-To: In-Reply-To: <200403121253.58396.mfeilner(a)feilner-it.net> / 2004-03-12 13:05:33 +0100 \ Markus Feilner: > Hello List, > I have successfully integrated samba 3 to ADS Domain, and now i want to > allow domain-users to access services on my linux box. For testing i > chose /etc/pam.d/login and tried to allow ADS Users access to the > console. But i always get the following errors: > > Mar 12 12:45:59 cuba90 pam_winbind[9011]: user 'r-ermer+mfeilner' > granted acces > Mar 12 12:45:59 cuba90 login[9011]: User not known to the underlying > authentication module guessing only: it might be that the "not known" error comes from pam_mkhomedir Lars Ellenberg > r-ermer is the correct domain, user is auth'd correctly, but no access > is given. Why? I do not understand the second error, about User not > known ... . > Here is my /etc/pam.d/login: > > #%PAM-1.0 > auth required pam_securetty.so > auth required pam_env.so > auth sufficient pam_unix2.so nullok > auth sufficient pam_winbind.so use_first_pass > auth required pam_deny.so > auth required pam_nologin.so > account sufficient pam_winbind.so > account required pam_unix2.so > password required pam_pwcheck.so nullok > #password required pam_unix2.so nullok use_first_pass use_authtok > session sufficient pam_unix2.so none # debug or trace > session sufficient pam_limits.so > session required pam_mkhomedir.so skel=/etc/skel/ umask=0022 > > I am running SuSE 9.0, and i remember that this used to work with an NT > domain under SuSE 8.0 - but what did I do wrong? > Thanks!!!

2 1

pam_winbind problem ...User not known to the underlying authentication module
by Markus Feilner 12 Mar '04

12 Mar '04

Hello List, I have successfully integrated samba 3 to ADS Domain, and now i want to allow domain-users to access services on my linux box. For testing i chose /etc/pam.d/login and tried to allow ADS Users access to the console. But i always get the following errors: Mar 12 12:45:59 cuba90 pam_winbind[9011]: user 'r-ermer+mfeilner' granted acces Mar 12 12:45:59 cuba90 login[9011]: User not known to the underlying authentication module r-ermer is the correct domain, user is auth'd correctly, but no access is given. Why? I do not understand the second error, about User not known ... . Here is my /etc/pam.d/login: #%PAM-1.0 auth required pam_securetty.so auth required pam_env.so auth sufficient pam_unix2.so nullok auth sufficient pam_winbind.so use_first_pass auth required pam_deny.so auth required pam_nologin.so account sufficient pam_winbind.so account required pam_unix2.so password required pam_pwcheck.so nullok #password required pam_unix2.so nullok use_first_pass use_authtok session sufficient pam_unix2.so none # debug or trace session sufficient pam_limits.so session required pam_mkhomedir.so skel=/etc/skel/ umask=0022 I am running SuSE 9.0, and i remember that this used to work with an NT domain under SuSE 8.0 - but what did I do wrong? Thanks!!! -- Mit freundlichen Grüßen Markus Feilner -- Linux Solutions, Training, Seminare und Workshops - auch Inhouse Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

1 0

HTTP File Uploads
by Keith Roberts 12 Mar '04

12 Mar '04

Hi everyone. I'm using SuSE 8.1 pro fully patched. I'm working on a php script to upload user supplied jpg photos to my server. The pictures will be moved from /tmp to another temp directory for virus checking. What are the security issues involved when allowing users to upload files to my server like this? Any advice would be appreciated. Kind Regards - Keith Roberts

4 4

Configuring SuSEfirewall2 on SuSE 9.0 as a personal firewall
by Marc Saric 12 Mar '04

12 Mar '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I try to use SuSEfirewall2 as included in SuSE 9.0 to secure the eth0-connection of a server-machine (only one interface, connected to the university network, no routing, NAT, bridging, etc.) but I'm a bit confused about the options and the available documentation (especially regarding differences between the current and older versions of SuSEfirewall2): What I have read (but maybe not fully understood :-)) so far: ============================================================= ~ * http://seismo.ethz.ch/linux/firewall.html, which deals with SuSE up to version 8.1 (which has obviously differences to the current version) ~ * http://susefaq.sourceforge.net/articles/firewall/fw_manual.html a nice manual about the same package also up to version 8.1 ~ * the archive of this mailinglist ~ * Googled the usual newsgroups/pages for more help. What I want to do: ================== Secure a server which should be used as a department server running SAMBA, NFS (maybe not), Netatalk, Apache, ssh/scp/sftp, xntpd (i.e. a plain simple standard intranet- and fileserver) against access from the outside world. The setup: ========== All machines are directly connected to the Internet (via the university network thanks to the University of Tuebingen not running their own firewall), therefore I want to grant/deny access to the server based on ~ * IP-address (i.e. "FW_TRUSTED_NETS") individually (per machine) ~ * possibly MAC-address (possible to set this in the firewall-config??) ~ * login and password-protection for services of course (not part of the ~ firewall) and deny access to all services except ssh for the rest of the world. In http://seismo.ethz.ch/linux/firewall.html I found the following entry which seems to be ok for me FW_TRUSTED_NETS="123.123.xxx.yyy 195.195.yyy.zzz" # Adjust FW_SERVICES_TRUSTED_TCP="1:65535" # Should be adjusted to needed services per machine, not globaly everything. FW_SERVICES_TRUSTED_UDP="1:65535" # see above in connection with FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="" # Do I have to set eth0 here as well??? FW_SERVICES_EXT_TCP="" # drop all FW_SERVICES_EXT_UDP="" # drop all FW_AUTOPROTECT_SERVICES="yes" FW_PROTECT_FROM_INTERNAL="yes" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="no" FW_SERVICE_AUTODETECT="yes" ... (among others) to deny everything else from unknown computers. The problem is, that the variables "FW_SERVICES_TRUSTED*" seem to be absent in SuSEfirewall2-3.1-206 (as installed with SuSE 9.0). Can someone point me in the right direction to solve this problem? How to enable (more or less) fine-grained access controll to a computer on IP-address-basis (or better IP and MAC)? Thanks in advance. - -- Bye, Marc Saric Dr. Marc Saric, Bioinformatik, Proteom Centrum Tübingen, Paul-Ehrlich-Str. 15, D-72076 Tübingen, Germany, Tel: +49 (0)7071 29 77645, marc.saric(a)uni-tuebingen.de http://www.proteom-centrum-tuebingen.de -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFAUHy3BLD6PjSWyL4RAk9sAJ9RhHC0uVBfaRTWPPi/NV1OYyJNOwCeLOQ7 9HQHFLZ2fEBBRnt3ziatNF8= =tasY -----END PGP SIGNATURE-----

2 3

foward with SuSEFirewall2.
by Joao M.C. Alvega 12 Mar '04

12 Mar '04

Hello, i'm trying to use squid as a transparante proxy, i have allready configurated squid to do that, but now i don't know how to redirect all tcp trafic from port: 80 to Squid port, can anyone help? thank's in advence for all the help! João Alvega.

3 2

harden_suse for 9.0?
by Lucky Leavell 12 Mar '04

12 Mar '04

I downloaded the RPM which indicated it was for 8.1; will it work on 9.0 or is there a later version available? Thank you, Lucky Leavell

2 1

susefirewall not forwarding
by Paul A. Arbour 12 Mar '04

12 Mar '04

Hi, To make a long story short, I'm moving from one firewall/web server to another. I have my new server plugged in and all setup masquerading for my internal network. I have port 80 forwarded from my new firewall into my existing web server(separate box). Everything is hunky dory from the outside, but from the inside I can not access either the old server, or if I disable port forwarding, the new server by throwing in their external address, i.e. my dyndns domain name. So basically what is happening is that the firewall is rejecting requests on the external IPs from the internal network with this error: Mar 9 21:03:32 grimlock kernel: SuSE-FW-ACCESS_DENIED_INT IN=eth1 OUT= MAC=00:xx:xx:0f:xx:9b:00:07:95:ac:24:e4:08:00 SRC=192.168.0.15 DST=24.xxx.xxx.xxx LEN=48 TOS=0x08 PREC=0x00 TTL=128 ID=23221 DF PROTO=TCP SPT=2131 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402) What am I missing? Here is a copy of my config file: FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="http https imap imaps pop3 pop3s smtp ssh 80 ftp" FW_SERVICES_EXT_UDP="500" FW_SERVICES_EXT_IP="51 50" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="80" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="0/0,0/0,80" FW_FORWARD_MASQ="0/0,192.168.0.5,tcp,80" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE- FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV="" grimlock:/etc/sysconfig # grep '^[A-Z]' SuSEfirewall2 FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="http https imap imaps pop3 pop3s smtp ssh 80 ftp" FW_SERVICES_EXT_UDP="500" FW_SERVICES_EXT_IP="51 50" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="80" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="0/0,0/0,80" FW_FORWARD_MASQ="0/0,192.168.0.5,tcp,80" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE- FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV="" grimlock:/etc/sysconfig # grep '^[A-Z]' SuSEfirewall2 FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="http https imap imaps pop3 pop3s smtp ssh 80 ftp" FW_SERVICES_EXT_UDP="500" FW_SERVICES_EXT_IP="51 50" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="80" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="0/0,0/0,80" FW_FORWARD_MASQ="0/0,192.168.0.5,tcp,80" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV=""

2 2

realtek driver.
by Joao M.C. Alvega 12 Mar '04

12 Mar '04

Hello again. I have bought a wireless card with realtek 8180 chip, can anyone tell-me where to find the driver for this card? Thank's all! João Alvega.

2 1

Postfix w. tls/Amavisd/pop-before-smtp/Spamassasin
by Philippe Vogel 11 Mar '04

11 Mar '04

Hi! I got another question: I run several mailservers with already working postfix/tls, amavisd, pop-before-smtp. My problem is to implement spamassasin. I found the spamassasion.sh solution, but it did wot work for me, all mail were deferred (spam nerves :-( ). I saw anotherone implementing spamd in amavis, but I did not find any sources with google (only a patch for an older amavisd). Any clue? Another thing would be for amavisd, is it possible to only inform local postmaster with amavid (there were to many errorous fakened mailheaders last months)? Philippe

3 2

Migration from pop to imap
by Rafael E. Herrera 11 Mar '04

11 Mar '04

We recently installed a suse std. server as a mail server to replace an older machine which delivered through pop. We are trying to get the users to switch from pop to imap. The problem we have is that some users will want to transfer their old messages to their imap folders. We use mozilla as mail client and when we try to copy the old emails, the transfer fail with either one of these messages: "The current command did not succeed. The mail server responded: Message contains bare newlines" "The current command did not succeed. The mail server responded: Message contains invalid header" Is there a way to import old pop mailboxes into these imap accounts that avoids these problems? -- Rafael

1 0

Fw: [suse-security] Postfix w. tls/Amavisd/pop-before-smtp/Spamassasin
by Philippe Vogel 11 Mar '04

11 Mar '04

> Hi! > > I got another question: > > I run several mailservers with already working postfix/tls, amavisd, > pop-before-smtp. My problem is to implement spamassasin. I found the > spamassasion.sh solution, but it did wot work for me, all mail were deferred > (spam nerves :-( ). > > I saw anotherone implementing spamd in amavis, but I did not find any > sources with google (only a patch for an older amavisd). > > Any clue? > > Another thing would be for amavisd, is it possible to only inform local > postmaster with amavid (there were to many errorous fakened mailheaders last > months)? Forgot something: How do I use iptunnel or sslwrap with qpopper shipped with SuSE Linux 8.2 (without recompillation) to support tls? I got a certificate already and looked up everything, but I didn't get it to work propper (service is up, but I get conncetion lost with "telnet server 995"). Philippe

1 0

sorting of tcpdump output
by Philippe Vogel 11 Mar '04

11 Mar '04

Hi! I took a tcpdump of a some kind of strange connection (a permanently 24/7 connected station) and want to sort the content from the content I don't want to read (only the one station is of interest, the rest can got to /dev/trash). I only want to knwo, what he/she is doing, or if he/she forgot to logout of an web-app. I used less | grep -e FILTER1 -e FILTER2 [...] > output, but grep anly shows me single lines. Is there any other programm that can filter the output or any tools on the net? Philippe

3 2

Wierd stuff coming out of SuSE's nameserver?
by suse＠rio.vg 11 Mar '04

11 Mar '04

Over the past two days, one of my servers has been getting connections from ns.suse.de attempting to send mail to strange addresses in my domain. For instance: Mar 11 09:56:38 shadow postfix/smtpd[17219]: connect from ns.suse.de[195.135.220.2] Mar 11 09:56:38 shadow postfix/smtpd[17219]: 9AED41E4F2: client=ns.suse.de[195.135.220.2] Mar 11 09:56:39 shadow postfix/smtpd[17219]: 9AED41E4F2: reject: RCPT from ns.suse.de[195.135.220.2]: 450 <20040203131322.ckkgoccks8owc80s(a)rio.vg>: User unknown in local recipient table; from=<> to=<20040203131322.ckkgoccks8owc80s(a)rio.vg> proto=ESMTP helo=<Cantor.suse.de> Mar 11 09:56:41 shadow postfix/smtpd[17219]: disconnect from ns.suse.de[195.135.220.2] As "ns.x.x" is generally the nameserver, I assume that SuSE would be running linux on such a server. Over the past two days, I have recieved over a dozen of these attempts. I've sent an e-mail to security(a)suse.com and abuse(a)suse.com, but I thought it might be wise to also give a heads up to the list. Is anyone else getting these connections? Has ns.suse.de been owned by nefarious parties? Or is this some new exploit in postfix or even a linux worm?

1 1

RE: [suse-security] windows to squid to internet
by Sturgis, Grant 11 Mar '04

11 Mar '04

Scott, You can test squid a number of different ways. Point your client's web browser (after it has been configured to use the proxy) to a web page. Then, on the proxy, watch access_log (usually /usr/local/squid/var/logs/access_log ). You should see the traffic in that log. If that doesn't work, telnet to port 3128 of the proxy server from the client. If it connects, you should be able to issue HTTP commands like: GET http://www.w3.org HTTP/1.0 and get a response. If that doesn't work, you can try squidclient on the proxy server. That binary is in /usr/local/squid/bin on your proxy server. cd /usr/local/squid/bin ./squidclient http://www.w3.org and you should get back a bunch of html. If that doesn't work, then your squid server is not connected to the Internet correctly. Also, check your error_log in /usr/local/squid/var/logs Check those things and let us all know how it works out. Grant > -----Original Message----- > From: Scott Wrobel [mailto:saw424@xeomail.com] > Sent: Wednesday, March 10, 2004 7:46 PM > To: suse-security(a)suse.com > Cc: suse-slstd-e(a)suse.com > Subject: [suse-security] windows to squid to internet > > > > > I am trying to set up two windows boxes to connect to the > internet throught my linux box using squid. I have made my > own squid.conf file as shown below. > I have gone into the windows computers (2000 pro > (192.168.1.27) and 98 (192.168.1.25)) and told them both to > use the proxy server over a network, address: localhost and > port: 3128, however i am getting no results. > The windows computers are manually configured to be in the > same workgroup, gateway, netmask, and have the same first 3 > segments of the ip addres as the server and can ping the server. > Samba is running and is working. > DHCP is giving me problems now that i have finally gotten > it working. > The modem in the linex box does connect to the internet. > Any help / opinions / reasons why this is not related to a > security mailing list ;) / etc. will be accepted warmly. > > http_access allow src 192.168.1.25 > http_access allow src 192.168.1.27 > http_access allow all > acl all src 0.0.0.0/0.0.0.0 > acl manager proto cache_object > acl localhost src 192.168.1.25/255.255.255.0 > acl localhost src 192.168.1.27/255.255.255.0 > acl to_localhost dst 127.0.0.0/8 > acl SSL_ports port 443 563 > acl Safe_ports port 80 # http > acl Safe_ports port 21 # ftp > acl Safe_ports port 443 563 # https, snews > acl Safe_ports port 70 # gopher > acl Safe_ports port 210 # wais > acl Safe_ports port 1025-65535 # unregistered ports > acl Safe_ports port 280 # http-mgmt > acl Safe_ports port 488 # gss-http > acl Safe_ports port 591 # filemaker > acl Safe_ports port 777 # multiling http > acl CONNECT method CONNECT > > FadMart - http://www.fadmart.com - An Associate of the > World's Largest Store! > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

1 0

Re: [suse-security] Problems in installing OpenVPN on SuSE 8.1
by Philipp Rusch 11 Mar '04

11 Mar '04

wow, this was the fastest response I ever had from any list ... :-) For the headers, you mean ? That they need them to compile the SSL-libs into their package ... hmmm, could be, I will try it ! Thanks, Philipp Hemsley, Trevor schrieb: >OpenSSL-devel perhaps? > >-----Original Message----- >From: Philipp Rusch [mailto:philipp.rusch@rusch-edv.de] >Sent: 11 March 2004 15:39 >To: suse-security(a)suse.com >Subject: [suse-security] Problems in installing OpenVPN on SuSE 8.1 > > >Hello all, >today i encountered a problem when installing OpenVPN 1.6.rc2 >on a SuSE 8.1 with all patches applied. >Doing a ./configure-run after unpacking the tarball gives me an error >about missing OpenSSL headers with a hint to install that package >before traing to install OpenVPN. >BUT- I have OpenSSL 0.9.6 ... installed through YAST, it is reported >as being installed and I even used TinyCA with it to set up my RootCA, >so it is working quite well. >What do I miss ? > >TIA, Philipp > > > >

1 0

Problems in installing OpenVPN on SuSE 8.1
by Philipp Rusch 11 Mar '04

11 Mar '04

Hello all, today i encountered a problem when installing OpenVPN 1.6.rc2 on a SuSE 8.1 with all patches applied. Doing a ./configure-run after unpacking the tarball gives me an error about missing OpenSSL headers with a hint to install that package before traing to install OpenVPN. BUT- I have OpenSSL 0.9.6 ... installed through YAST, it is reported as being installed and I even used TinyCA with it to set up my RootCA, so it is working quite well. What do I miss ? TIA, Philipp

1 0

Re: allow 'su' to limited users
by Thomas Leske 11 Mar '04

11 Mar '04

Gero Schmidt-Kärst wrote: > I guess there is a easy possibility to allow the command 'su' only to a > small group of users. You can also configure PAM (plugable authentication modules) for this purpose. The following configuration of /etc/pam.d/su is not only convenient, because it does not prompt for a password. It may be also more secure: When you use a ssh client with X11-Forwarding, the other side can also try to listen to the passwords that you enter in an other window on the same Xserver. You should also never su from a less secure account to a more secure one, because the su command may have been replaced by a trojan. This configuration does not allow that in the first place, and thus enforces good security practice. As you are never prompted for a password, a trojaned "su" can also not trick you to enter one so easily. /etc/pam.d/su: #%PAM-1.0 # This configuration never prompts for a password. # SuSE-Default: auth sufficient pam_rootok.so # The users (usually only one) in suuser_list.txt are allowed to switch to any user. # These accounts should only be used for system maintainance. (For instance you don't want to start KDE directly as root). auth sufficient pam_listfile.so item=ruser sense=allow file=/etc/pam.d/suuser_list.txt onerr=fail # The users (usually only one) in suuser_list2.txt can only switch to users in suuser_list2_to.txt. # This allows one to set up an extra account ("surfer") for web browsing. So in case there is a security # hole in the browser, the attacker does not get access sensitive data (like private gpg or ssh keys). # Konqueror can be started like this: sux -c "cd; /opt/kde3/bin/konqueror" -l surfer auth required pam_listfile.so item=ruser sense=allow file=/etc/pam.d/suuser_list2.txt onerr=fail auth sufficient pam_listfile.so item=user sense=allow file=/etc/pam.d/suuser_list2_to.txt onerr=fail # (I wonder, how to extend the scheme to more pairs of suuser_list?.txt, suuser_list?_to.txt.) # no other uses of su are allowed: auth required pam_deny.so # SuSE-Defaults: account required pam_unix2.so password required pam_pwcheck.so nullok password required pam_unix2.so nullok use_first_pass use_authtok #session required pam_homecheck.so session required pam_unix2.so debug # none or trace

1 0

Email account utilization warning.
by noreply＠suse.com 11 Mar '04

11 Mar '04

Dear user of Suse.com, Your e-mail account has been temporary disabled because of unauthorized access. For further details see the attach. For security reasons attached file is password protected. The password is "75812". The Management, The Suse.com team http://www.suse.com

1 0

ssh: Changing Host Keys
by Lucky Leavell 11 Mar '04

11 Mar '04

OS: SuSE 9.0 using SuSEfirewall2 This was a Red Hat 8 box which we blew away when doing a FTP install of SuSE 9 (neat!). Unfortunately, we had used this box to ssh into and used the same IP address for the SuSE install. After a bit of tweaking, I got ssh to connect but now it complains about the host key change: Script started on Wed Mar 10 15:12:58 2004 ris713 lucky /home/lucky 0:0 $ ssh -p 70 lucky(a)209.44.30.102 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that the RSA host key has just been changed. The fingerprint for the RSA key sent by the remote host is 85:e3:e6:b0:ab:67:38:9b:ce:22:e7:92:9b:31:d7:c8. Please contact your system administrator. Add correct host key in /home/lucky/.ssh/known_hosts to get rid of this message. Offending key in /home/lucky/.ssh/known_hosts:4 RSA host key for 209.44.30.102 has changed and you have requested strict checking. Host key verification failed. script done on Wed Mar 10 15:13:16 2004 Just exactly which key(s) should be deleted/added from where? Thank you, Lucky Leavell

4 3

Sendmail on 9.0
by edwin 11 Mar '04

11 Mar '04

Hi all, I just installed Sendmail-8.12.10-7 on SuSE 9.0. I set SuSEfirewall2 to listen to SMTP. I also already set SMTPD_LISTEN_REMOTE ="yes" in /etc/syscinfig/mail. When I do 'lsof | grep LISTEN' it shows that sendmail 2721 r oot 4u IPv4 4929 TCP *:smtp (LISTEN) but when I send an email from trusted network to someone in internet it replys that RELAYING DENIED for the to address. I just only send the email from local. Anyone facing this problem? TIA edwin

4 8

RE: [suse-security] DHCP Problems
by sematin＠mtn.co.ug 11 Mar '04

11 Mar '04

> -----Original Message----- > From: Frank Huebsch [mailto:SuSE-security@fhuebsch.de] > Sent: 11 March 2004 11:30 > To: suse-security(a)suse.com > Subject: RE: [suse-security] DHCP Problems > > > Hello! > > What kind of network infrastructure are you using? > I experienced problems with dhcp clients connected to managed > switches. The problem ocurred when fastpath was activated on > the client port. After disabling fastpath the first dhcp > request passed without problems. > > Can anyone give me further information on the reason/implication?!? You didn't mention what vendor your "managed switch" is from... Noah.

1 0

RE: [suse-security] Sendmail on 9.0
by sematin＠mtn.co.ug 11 Mar '04

11 Mar '04

You do not have to run sendmail form xinetd or inetd for that matter in order to change the port it listens on. You just have to change DaemonPortOptions in sendmail.cf and restart sendmail. Noah. > -----Original Message----- > From: edwin [mailto:edwin@nsi.co.id] > Sent: 11 March 2004 11:55 > To: suse-security(a)suse.com > Subject: RE: [suse-security] Sendmail on 9.0 > > > Yes my firewall is masqueraded. > Actually I already put the domain name on > /etc/mail/relay-domains but it is not work. > > And after your email I put also the name of the firewall and > its ip address, and voila it works. Thanks for your suggestion Holger. > > Anyway, in 7.3 I use an antivirus daemon to protect smtp ( I > still have client using W$$$$ws). I give the port 25 to the > antivirus and move the sendmail to another port. It is > possible because smtp was running through inetd. > > Is it possible to use xinetd for sendmail in 9.0 and move the smtp > (sendmail) to another port? Anyone here have experienced? > > TIA > medwin > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

AW: [suse-security] DHCP Problems
by Rasp, Robert 11 Mar '04

11 Mar '04

Hello, are you sure, your dhcpd is running ?? Is your dhcpd set at least in runnlevel 3 ?? CU Robert -----Ursprüngliche Nachricht----- Von: Scott Wrobel [mailto:saw424@xeomail.com] Gesendet: Do 11.03.2004 04:14 An: suse-security(a)suse.com; suse-slstd-e(a)suse.com Cc: Betreff: [suse-security] DHCP Problems

1 0