April 2004 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Tripwire on Suse 9.0
by Jeremy Gardner 27 Apr '04

27 Apr '04

Thanks to all of you for telling me about the update. Still getting used to Suse, forgot updates were available and hadn't seen any mention of it in the email lists. I did a clean install on the whole package and everything works great. Thanks again! Jeremy -----Original Message----- From: Oswald Jaskolla [mailto:oswald@jaskolla.net] Sent: Monday, April 26, 2004 11:53 AM To: suse-security(a)suse.com Subject: Re: [suse-security] Tripwire on Suse 9.0 Hi Jeremy, Jeremy Gardner wrote: > So you're saying: > 1. Install tripwire-2.3.1-98.i586.rpm from 9.0 CD > 2. Run online update to patch tripwire Right! > Do you know what version the update would bring me to? I just want > to make sure I have the correct latest version. That's tripwire-2.3.1-138.i586.patch.rpm, But I guess you should be able to install the whole package instead ofthe old one and patching. The problem was with a change in the binutils package. At least that's what http://www.suse.de/de/private/download/updates/90_i386.html says Greetings, Oswald -- _/_/ _/ | _/ _/ _/ | Oswald Jaskolla <oswald(a)jaskolla.net> _/ _/ _/ _/ | http://www.jaskolla.net/oswald/ _/_/ _/ _/_/ _/ | -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Re: [suse-security] Tripwire on Suse 9.0
by Jeremy Gardner 26 Apr '04

26 Apr '04

So you're saying: 1. Install tripwire-2.3.1-98.i586.rpm from 9.0 CD 2. Run online update to patch tripwire And skip installing/configuring from source? Do you know what version the update would bring me to? I just want to make sure I have the correct latest version. Thanks! Jeremy -----Original Message----- From: Oswald Jaskolla [mailto:oswald@jaskolla.net] Sent: Monday, April 26, 2004 2:57 AM To: suse-security(a)suse.com Subject: Re: [suse-security] Tripwire on Suse 9.0 Hi! Christian Lange wrote: > Jeremy Gardner schrieb: >> I am trying to get Tripwire working on Suse 9.0. I started with >> tripwire-2.3.1-98.i586.rpm. After I got the segmentation fault on my >> first twadmin command, (...) > > (...) > 1. install the newest tripwire-xy.tar.gz > 2. install the original tripwire.rpm from your SuSE 9.0 release > Alternatively skip 1. and install the patch from online update. Greetings, Oswald -- _/_/ _/ | _/ _/ _/ | Oswald Jaskolla <oswald(a)jaskolla.net> _/ _/ _/ _/ | http://www.jaskolla.net/oswald _/_/ _/ _/_/ _/ | -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

RIF: [suse-security] Hardening SuSE 9
by Palmerini Gian Fabio 26 Apr '04

26 Apr '04

Hello after "configuring" harden_suse script in the installation media of SuSE 9.0 you can find SecCheck Script V2.0 that help you to verify the status of your machine you can find documentation and script about hardening suse and susefirewall2 at http://www.suse.com/~marc/ and: http://susefaq.sourceforge.net/guides/fw_manual.html for susefirewall 2 Best regards Gian Fabio -----Messaggio originale----- Da: GarUlbricht7(a)netscape.net [mailto:GarUlbricht7@netscape.net] Inviato: lun 26/04/2004 9.52 A: suse-security(a)suse.com Cc: Oggetto: RE: [suse-security] Hardening SuSE 9 Armin Schoech wrote on 4/26/2004 2:45:05 AM Eastern Daylight Time: > >> On the actual hardening, >> there is a script for hardening SuSE linux systems >> called harden_suse or hard_suse or something similar to that. >> Searching the CDs using yast for the string "hard" should find it. >> > AFAIK, this script has not been updated for a while. > So be careful before applying it to a SuSE 9.0 system. > It may not work and/or cause problems. > >Armin --< sig line trimmed >----- There are several different approaches the I am awear of: Go into YaST2 --> Security & Users --> Security settings --> --> "change level" Install "bastille" (this was last upgraded on 12/3/03 for SuSE 9.0 per change notes). It's on the 9.0 CD/DVD. { Bastille Linux is a security hardening program for various Linux distributions.} "bastile" doesn't show up for 8.2 (at least I couldn't find it) For 8.0 there is a script with "harden" in it's name, and I think that is the one Armin is referring to above... Anther approach is the custom one. Do port scans and shut down all the services you aren't using etc., removing rpms that aren't needed, etc. (SuSE is shipping with more and more things turned off -- but it is always good to check) Hope this helps, -- "Paranoia is heightened awareness." -- __________________________________________________________________ Introducing the New Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Tripwire on Suse 9.0
by Jeremy Gardner 26 Apr '04

26 Apr '04

Howdy, I am trying to get Tripwire working on Suse 9.0. I started with tripwire-2.3.1-98.i586.rpm. After I got the segmentation fault on my first twadmin command, I did some research and discovered this is a known issue. Many people said to use the version that comes with Suse 8.2, tripwire-2.3.1-25.i586.rpm. I removed the 9.0 version and installed the 8.2 version. I was able to get through the twadmin commands, but still got the segmentation fault when I ran `tripwire --init`. I downloaded the source from tripwire.org for tripwire-2.3-47.bin.tar.gz and installed that. Same segmentation fault problem. Many people posted that the 8.2 version worked for them, but I couldn't get it to work for me. Do I need to install a library, downgrade a library, or something else? Is there a version to install that I don't know about? This is very frustrating, a big reason I went with Suse was that it had newer versions of packages than many, and you can run Tripwire for free over Solaris, but what's the point if it doesn't work on a version of Suse that's been out for awhile now. I just switched from Redhat and Suse, hope I don't regret it. Thanks! Jeremy

3 2

RE: [suse-security] Hardening SuSE 9
by GarUlbricht7＠netscape.net 26 Apr '04

26 Apr '04

Armin Schoech wrote on 4/26/2004 2:45:05 AM Eastern Daylight Time: > >> On the actual hardening, >> there is a script for hardening SuSE linux systems >> called harden_suse or hard_suse or something similar to that. >> Searching the CDs using yast for the string "hard" should find it. >> > AFAIK, this script has not been updated for a while. > So be careful before applying it to a SuSE 9.0 system. > It may not work and/or cause problems. > >Armin --< sig line trimmed >----- There are several different approaches the I am awear of: Go into YaST2 --> Security & Users --> Security settings --> --> "change level" Install "bastille" (this was last upgraded on 12/3/03 for SuSE 9.0 per change notes). It's on the 9.0 CD/DVD. { Bastille Linux is a security hardening program for various Linux distributions.} "bastile" doesn't show up for 8.2 (at least I couldn't find it) For 8.0 there is a script with "harden" in it's name, and I think that is the one Armin is referring to above... Anther approach is the custom one. Do port scans and shut down all the services you aren't using etc., removing rpms that aren't needed, etc. (SuSE is shipping with more and more things turned off -- but it is always good to check) Hope this helps, -- "Paranoia is heightened awareness." -- __________________________________________________________________ Introducing the New Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

1 0

RE: [suse-security] Hardening SuSE 9
by sematin＠mtn.co.ug 26 Apr '04

26 Apr '04

Well my take on this is this: Install the applications first and test that they are working first before you run any hardening scripts. That way if something stops working after you've run the hardening script, you're sure that the problem has been brought about by the scripts and thus you can reverse the scripts actions one by one until you find the cause. On the actual hardening, there is a script for hardening SuSE linux systems called harden_suse or hard_suse or something similar to that. Searching the CDs using yast for the string "hard" should find it. Noah. > -----Original Message----- > From: Ajay Venkatesh [mailto:ajay_nv@hotmail.com] > Sent: 26 April 2004 08:50 > To: suse-security(a)suse.com > Subject: [suse-security] Hardening SuSE 9 > > > > Hi , > > I am new to Linux and am trying to implement SNORT on SuSE > linux 9 with > MYSQL , APACHE + PHP and NTOP. I have few questions : > > - I am looking at securing the box and trying to find some hardening > scripts for the same could someone help me . > > - secondly, should I harden the box before installing SNORT > and the rest of > the apps or after? > > > Thanks for you help in advance. > > Regards, > Ajay Venkatesh > >

3 3

RE: [suse-security] Hardening SuSE 9
by sematin＠mtn.co.ug 26 Apr '04

26 Apr '04

> -----Original Message----- > From: Ajay Venkatesh [mailto:ajay_nv@hotmail.com] <snip> > Next , There is no package or script in the CDs like "hard" > or "harden_suse" , could this be a third party application. > and if so where can I find it. I used to pick these up from http://www.suse.de/~marc O hope they are still there. However I do my own hardening these days so I do not use the script anymore. > and one more, the hardening script , will it be the same for > all the versions of SuSE ( i.e 8.0 , 8.0 and 9.0 etc) Someone has pointed out that it hasn't been updated in a while so it may be wiser to read the actual script that implement what it does yourself or edit it to fit your system rather than just run it. Noah.

1 0

Hardening SuSE 9
by Ajay Venkatesh 26 Apr '04

26 Apr '04

Hi , I am new to Linux and am trying to implement SNORT on SuSE linux 9 with MYSQL , APACHE + PHP and NTOP. I have few questions : - I am looking at securing the box and trying to find some hardening scripts for the same could someone help me . - secondly, should I harden the box before installing SNORT and the rest of the apps or after? Thanks for you help in advance. Regards, Ajay Venkatesh

1 0

ssh and lock
by Murat Akca 25 Apr '04

25 Apr '04

Hi; We have a problem with ssh.We are using Suse 9.0 and Intel server with 1 GB RAM. When we connect our server via SSH sometimes it locks the machine. I have looked /var/log/messages and could not found anything. Mostly we encountered this problem when our internet connection speed is slow. Do u have any idea? Is there a log for SSH? Best Regards; Murat

4 3

SuSE 8.0: problem with ethereal update
by Armin Schoech 24 Apr '04

24 Apr '04

Hi ! I'm still runnning some SuSE 8.0 servers. When I tried to update the ethereal package wo the newest version 0.10.3-10 I get the following error (fou4s / rpm output): ************************ * ERROR: Update failed * ************************ error: failed dependencies: libethereal.0 is needed by ethereal-0.10.3-10 libwiretap.0 is needed by ethereal-0.10.3-10 Updating works smoothless on SuSE 9.0 were the mentioned libraries are provided by the new updated ethereal-0.10.3.11.rpm package. I suspect they were accidentally missed from the SuSE 8.0 rpm ? Or can I get them by installing some other package on my 8.0 system ? Thanks, Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50

1 0