July 2004 - openSUSE Security - openSUSE Mailing Lists

Email Spoofing
by Eric Kahklen 22 Jul '04

22 Jul '04

We are using Suse 9.0 Professional. I am getting email that is claiming to be from my domain and the Posfix logs confirm it is from an outside IP. After searching the logs, I figured out where the connection initiated, and then the regular smtp traffic proceeded with the spoofed email address (user(a)mydomain.com) to my real users email address realusers(a)mydomain.com). The unique identifiers helped me correspond the traffic. There were two other email sessions that based on their unique identifier did not have the full smtp process. For example, this is all that is entered in the logs for the unique process. I usually see a connect and disconnect process before and after this and the random character user does not exisit! BTW, this is a mail gateway for Exchange. Any ideas?? Jul 20 11:54:59 gateway postfix/smtp[10247]: 649E6AD30: to=<user1(a)mydomain.com>, relay=10.0.0.5[10.0.0.5], delay=14, status=sent (250 2.6.0 <hxdgpusiesezuvbkmcc(a)mydomain.org> Queued mail for delivery) Jul 20 11:55:10 gateway postfix/smtp[10247]: 8BFB2AD43: to=<user2(a)mydomain.com>, relay=10.0.0.5[10.0.0.5], delay=25, status=sent (250 2.6.0 <oityeuiuogzvyivawrs(a)mydomain.com> Queued mail for delivery) Thanks, Eric -- ______________________________________________________________________ Eric Kahklen, MS 530 4th Ave. W. Seattle, WA

12 25

TEST - PLEASE IGNORE
by Jonathan Gardner 22 Jul '04

22 Jul '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I've heard that someone or something (maybe us!) are harvesting email addresses on this list and sending email to them from our legitimate servers. (See http://spf.pobox.com and try host -t txt amazon.com) I'm hoping they'll bite and send me one as well. - -- Jonathan M. Gardner Mass Mail Systems Developer, Amazon.com jonagard(a)amazon.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQFA/tRXBFeYcclU5Q0RAgZ+AJ4vdFSHos9XpSjB+hY9HZcpoliGlQCfd4+B 6SE5x4lW4sJ9wL40ilRGf5s= =JUCr -----END PGP SIGNATURE-----

2 5

SuSEFirewall2 and custom rules
by Mobeen Azhar 22 Jul '04

22 Jul '04

I have an existing RH box with my own iptables firewall rules. On RH, I simply have to run this script of mine, then run RH's iptables save. After this my rules take effect whenever RH's firewall startup script executes. I am now moving to SuSE 9.1. While they have a pretty elaborate collection of scripts as part of their SuSEFirewall package, is there a way that I can have their firewall startup scripts use my own rules, without me having to define all the little things in their scripts? Or do I have no choice but to not run their firewall startup scripts and run my own instead? The reason I would rather use their firewall startup scripts (if I can get them to use my rules only) instead of my own is because then I do not have to worry about the firewall startup script execution order. Thanks in advance for any help, -- --Moby They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. -- Benjamin Franklin First they came for the Jews and I did not speak out because I was not a Jew. Then they came for the Communists and I did not speak out because I was not a Communist. Then they came for the trade unionists and I did not speak out because I was not a trade unionist. Then they came for me and there was no one left to speak out for me. -- Pastor Martin Niemöller

2 1

SuSEfirewall2 masquerared server
by Rubén Díez Álvarez - LCD 22 Jul '04

22 Jul '04

Hello, Last days I've been changing the settings of my Suse Linux Standard Server 8.0 firewall (SuSEfirewall2) but I can't get it runs ok. This machine is running as firewall/proxy-server since some months ago without problems, but now we need to have a masquerared server behind it and I can´t get it. I've visited a lot of webpages and the "SuSE Firewall2 Understaning and Using" by Togan Muftuoglu but I can't see where is the problem. I'm sure it's a silly thing but my eyes can see it. So I hope your eyes can help me. I send you an schema of the network, the SuSEFirewall config file, and the log I get. Thanks in advance, Rubén Díez -------------------------------------------- Description ---------------------------------------- I need to see from de external network the Tomcat Service (192.168.5.2:8080) as a masquerared service of the Firewall (192.168.2.2:8080). I can see the Tomcat Service from the Internal network and from the firewall, but I can't see it from the external network. Notes: - The firewall acts as http and https server and I can see these services from the external network, so I'm only having problems with the masquered services. - The internal network machines have access to the external network throw the firewall without problems (http requests are managed by a transparent proxy server). --------------------------------------- Network schema --------------------------------------- External Net (192.168.2.0/24) | eth1(192.168.2.2) FIREWALL eth0(192.168.5.1) | Internal Net(192.168.5.0/24) | Tomcat Server (192.168.5.2) -------------------------------- /etc/suseconfig/SuSEfirewall2 ------------------------------ FW_QUICKMODE="no" FW_DEV_EXT="eth1" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.5.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="http https pop3 smtp" FW_SERVICES_EXT_UDP="500" FW_SERVICES_EXT_IP="50" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="auto" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="yes" FW_FORWARD="" FW_FORWARD_MASQ="192.168.2.0/24,192.168.5.2,8080" FW_REDIRECT="192.168.5.0/255.255.255.0,0/0,tcp,80,3128" #This is for transparent Squid proxy-server FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom" FW_REJECT="no" ------------------------------------- End of file etc/sysconfig/SuSEfirewall2 Log file ------------------------------------------ Jul 22 11:01:18 servabello05 kernel: SuSE-FW-DROP IN=eth1 OUT= MAC=00:0d:9d:97:e5:16:00:0c:76:81:e7:f1:08:00 SRC=192.168.2.140 DST=192.168.2.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=648 DF PROTO=TCP SPT=32820 DPT=8080 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A002BA8D70000000001030300)

1 0

RE: strange Apache Log entries
by suse＠karsites.net 22 Jul '04

22 Jul '04

I've just noticed the following in my apache logs: 207.180.26.146 - - [21/Jul/2004:20:57:28 +0000] "GET / HTTP/1.0" 200 5480 So I guess that the strange entries below are just returning the contents of my home page. >Hi All. > >Just found these entries in my apache access_log today. >Can anyone tell what they are please. > >81.168.215.30 - - [20/Jul/2004:12:45:47 +0000] "\xa8oL:" 200 5480 >81.168.215.30 - - [20/Jul/2004:12:46:26 +0000] "\xd0IO:" 200 5480 >81.168.215.30 - - [20/Jul/2004:12:56:29 +0000] "\xc0\xcdLs" 200 5480 >81.168.215.30 - - [20/Jul/2004:12:57:53 +0000] "8\xb5Rs" 200 5480 Kind Regards - Keith Roberts

2 1

Re: [suse-security] Email Spoofing
by Dirk Schreiner 21 Jul '04

21 Jul '04

Uhh, guess my English was too bad, or you did not read my mail carefully. Dana Hudes schrieb: > > On Wed, 21 Jul 2004, Dirk Schreiner wrote: > >>SMTP (as the name says) is the transport layer for Mail communication, >>and as UDP in the OSI-Layer 4, it is just DATAGRAM based and _not_ reliable! >>(Hey, we should use SNMP to make UDP reliable. SCNR) > > > SMTP most certainly does not use UDP. DNS does, but SMTP uses TCP port 25. > Always has. As native SMTP speaker, i know it is using TCP. I meant SMTP is transporting Mail. And SMTP does this like UDP transports Data. Packetwise, and not reliable. > > SMTP is Simple Mail Transport Protocol > I Knew this. ;-) > As for SPf. There IS an SPF which is a routing algorithm (not protocol). > It uses the Djikstra algorithm. SPF is used in OSPF and in IS-IS. > Yes, OSPF uses UDP -- and has nothing particularly to do with e-mail. Oh, yes, heard this at my cisco certification. ;-) > > The SPF for e-mail however ...well, yeah since it relies on dns it can be > said to use UDP. The reliability? Left to DNS (n.b. zone transfers in DNS > may be done over TCP but that's not relevant here). > > I'm not arguing the impact or lack thereof of the SPF e-mail > authentication initiative. I just need to make sure you are talking about > the right issues for the right reasons. Yes, i just used those as example. I meant, that SMTP is working like a Routing Protocol (therefore often spoken as "Mail Routing"). It uses "Routers" (Mailserver) "routing-Tables" (MX-record), "Gateway`s" (Forwarder). ... > > One does not need SPF to prevent people sending you email with your own > domain from elsewhere. That is accomplished with SASL. I haven't gotten > around to setting up SASL myself because I don't get much spam -- or > viruses-- with my own domain that gets past all the RBL (spamcop, sorbs, > abuseat, among others) I have setup in Postfix. > Mind, I do get some but an awful lot is blocked. I prefer to mark Spam as Spam, and delete by hand. (Never trust anything/body just talking 0 or 1) > > The far more controversial action is to block foreign (i.e. not under the > same administrativ authority) dynamic ip address ranges from talking to > your mail server. This DOES break some people who have setup, on their > NAT'd cable modem -attached LAN, their own mail relay so they can see that > the mail was in fact delivered. Worse yet there are people on dialup who > do the same thing. They then whine and complain that all ip addresses are > created equal and there is no basis for discriminating. I never will understand, why anybody needs to block IP (Layer3) to prevent Spammers. Spam is a Problem on Layer 5. > > If ISPs blocked the use of external mail relays and forced you to go > through their relay if you are on a dynamic ip address range this wouldn't > be a problem. but if you do that these users whine and complain. I guess, you do not do buisiness traveling. 6:30 At Home Checking E-Mail. 9:00 Location 1 Checking E-Mail. 12:00 Customers Network Checking E-Mail. 16:00 Railway-Station Wlan Checking E-Mail 19:00 Hotel, Checking E-Mail. And sometimes: 22:00 Bar-Wlan Checking E-Mail. Just a normal Day. 6 Times configuring different SMTP Server. Think about this. > > Still, for every 1 message that's legitimate from a dynamic ip address > I get a thousand viruses and spams. You should not put youre E-Mail Address in any Web-Formula. Use temporary E-Mail Addresses for such usage. ;-)) > > Here and there I lose legit email from losers whose dns is inconsistent: > they have a forward entry which resolves to an ip address which reverse > resolves to a DIFFERENT hostname which does not have a forward entry. > I've got postfix configured, per RFC 2055, to drop such e-mail. > Have yet to convince any of these clowns network team that they have a > problem. I agree, i hate such configuration problems too. > > I will name names upon request. > No, no, don`t do so. ;-)) Dirk TRIA IT-consulting GmbH Joseph-Wild-Stra?e 20 81829 Munchen Germany Tel: +49 (89) 92907-0 Fax: +49 (89) 92907-100 http://www.tria.de -------------------------------------------------------- working hard | for your success -------------------------------------------------------- Registergericht Munchen HRB 113466 USt.-IdNr. DE 180017238 Steuer-Nr. 802/40600 Geschaftsfuhrer: Hubertus Wagenhauser -------------------------------------------------------- Nachricht von: dirk.schreiner(a)tria.de Nachricht an: suse-security(a)suse.com # Dateianhange: 0 Die Mitteilung dieser E-Mail ist vertraulich und nur fur den oben genannten Empfanger bestimmt. Wenn Sie nicht der vorgesehene Empfanger dieser E-Mail oder mit der Aushandigung an ihn betraut sind, weisen wir darauf hin, da? jede Form der Kenntnisnahme, Veroffentlichung, Vervielfaltigung sowie Weitergabe des Inhalts untersagt ist. Wir bitten Sie uns in diesem Fall umgehend zu unterrichten. Vielen Dank The information contained in this E-Mail is privileged and confidental intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient or competent to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this E-Mail is strictly prohibited. If you have received this E-Mail in error, please notify us immediately. Thank you

1 0

RE: [suse-security] Email Spoofing
by Sturgis, Grant 21 Jul '04

21 Jul '04

Eric, It is possible to send multiple emails with one "connect / disconnect" session even to different recipients and from different "MAIL FROM" addresses. Only the original connect and the final quit will be logged. Two ways to minimize the spoofing problem: 1. Enforce reverse DNS lookups on the connecting IP address. 2. RBL subscriptions, for what those are worth. Another option (not necessarily recommended) is to force the "from" domain to match the reverse lookup completed on the connecting IP address. This will break many email attempts from legitimate sources because the SMTP servers don't necessarily belong to the sending domain (MX gateway services, for instances). Is that the question you are asking? HTH, Grant -----Original Message----- From: Eric Kahklen [mailto:eric@kahklen.com] Sent: Wednesday, July 21, 2004 11:08 AM To: suse-security(a)suse.com Subject: [suse-security] Email Spoofing We are using Suse 9.0 Professional. I am getting email that is claiming to be from my domain and the Posfix logs confirm it is from an outside IP. After searching the logs, I figured out where the connection initiated, and then the regular smtp traffic proceeded with the spoofed email address (user(a)mydomain.com) to my real users email address realusers(a)mydomain.com). The unique identifiers helped me correspond the traffic. There were two other email sessions that based on their unique identifier did not have the full smtp process. For example, this is all that is entered in the logs for the unique process. I usually see a connect and disconnect process before and after this and the random character user does not exisit! BTW, this is a mail gateway for Exchange. Any ideas?? Jul 20 11:54:59 gateway postfix/smtp[10247]: 649E6AD30: to=<user1(a)mydomain.com>, relay=10.0.0.5[10.0.0.5], delay=14, status=sent (250 2.6.0 <hxdgpusiesezuvbkmcc(a)mydomain.org> Queued mail for delivery) Jul 20 11:55:10 gateway postfix/smtp[10247]: 8BFB2AD43: to=<user2(a)mydomain.com>, relay=10.0.0.5[10.0.0.5], delay=25, status=sent (250 2.6.0 <oityeuiuogzvyivawrs(a)mydomain.com> Queued mail for delivery) Thanks, Eric -- ______________________________________________________________________ Eric Kahklen, MS 530 4th Ave. W. Seattle, WA -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

3 2

IPTABLES example
by Flavius Porumb 21 Jul '04

21 Jul '04

Hello all, hope you'll find it usefull too, i did http://www.kabelverhau.ch/elwms/en_iptables.php rgrds, F. Anybody's got a better version ? ;) ============================================ #! /bin/bash IF_INET="eth0" IF_LAN="eth1" IF_LAN_NET="192.168.0.0/24" IF_WLAN="wlan0" # (SMB) (NFS) (X11) BAD_TCP="135:139 1433 2049 5999:6063" BAD_UDP="135:139 1433 2049 5999:6063" case "$1" in start) echo "Cleaning up..." echo 0 > /proc/sys/net/ipv4/ip_forward iptables -F iptables -t nat -F iptables -t mangle -F echo -n "Determinating IP-Address of Internet Interface... " IF_INET_IP="`ifconfig $IF_INET | grep 'inet addr' | awk '{print $2}' | sed -e 's/.*://'`" echo $IF_INET_IP echo "Creating IPTABLES rules:" echo " Masquerading..." iptables -t nat -A POSTROUTING -o $IF_INET -j MASQUERADE echo " Protecting well-known ports..." for i in $BAD_TCP; do iptables -A INPUT -p tcp --dport $i -j DROP iptables -A INPUT -p tcp --sport $i -j DROP iptables -A OUTPUT -p tcp --dport $i -j DROP iptables -A OUTPUT -p tcp --sport $i -j DROP iptables -A FORWARD -p tcp --dport $i -j DROP iptables -A FORWARD -p tcp --sport $i -j DROP done for i in $BAD_UDP; do iptables -A INPUT -p udp --dport $i -j DROP iptables -A INPUT -p udp --sport $i -j DROP iptables -A OUTPUT -p udp --dport $i -j DROP iptables -A OUTPUT -p udp --sport $i -j DROP iptables -A FORWARD -p udp --dport $i -j DROP iptables -A FORWARD -p udp --sport $i -j DROP done echo " Rules for ICMP..." # 0: echo reply # 3: destination unreachable # 4: source quench # 5: redirect # 8: echo request # 9: router advertisement # 10: router solicitation # 11: time exceeded # 12: parameter-problem # 13: timestamp request # 14: timestamp reply # 15: information request # 16: information reply # 17: address mask request # 18: address mask reply iptables -A INPUT -p icmp --icmp-type 0 -j ACCEPT iptables -A INPUT -p icmp --icmp-type 3 -j ACCEPT iptables -A INPUT -p icmp --icmp-type 4 -j ACCEPT iptables -A INPUT -p icmp --icmp-type 11 -j ACCEPT iptables -A INPUT -p icmp --icmp-type 12 -j ACCEPT iptables -A INPUT -p icmp --icmp-type 14 -j ACCEPT iptables -A INPUT -p icmp --icmp-type 16 -j ACCEPT iptables -A INPUT -p icmp --icmp-type 18 -j ACCEPT iptables -A INPUT -p icmp -j LOG -m limit --log-prefix "FILTER ICMP-BAD-TYPE-IN:" iptables -A INPUT -p icmp -j DROP iptables -A OUTPUT -p icmp --icmp-type 4 -j ACCEPT iptables -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT iptables -A OUTPUT -p icmp --icmp-type 12 -j ACCEPT iptables -A OUTPUT -p icmp --icmp-type 13 -j ACCEPT iptables -A OUTPUT -p icmp --icmp-type 15 -j ACCEPT iptables -A OUTPUT -p icmp --icmp-type 17 -j ACCEPT iptables -A OUTPUT -p icmp -j LOG -m limit --log-prefix "FILTER ICMP-BAD-TYPE-OUT:" iptables -A OUTPUT -p icmp -j DROP iptables -A FORWARD -p icmp -j ACCEPT echo " Stateful inspection..." iptables -A INPUT -m state --state ESTABLISHED,RELATED -i $IF_INET -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -i $IF_INET -j ACCEPT echo " Rules for Loopback Interface..." iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT echo " Rules for local LAN..." iptables -A INPUT -i $IF_LAN -j ACCEPT iptables -A FORWARD -i $IF_LAN -j ACCEPT echo " Rules for local WLAN..." iptables -A INPUT -p tcp --dport 53 -i $IF_WLAN -j ACCEPT iptables -A INPUT -p udp --dport 53 -i $IF_WLAN -j ACCEPT iptables -A INPUT -p tcp --dport 67 -i $IF_WLAN -j ACCEPT iptables -A INPUT -p udp --dport 67 -i $IF_WLAN -j ACCEPT iptables -A FORWARD -p tcp --dport 22 -i $IF_WLAN -j ACCEPT iptables -A FORWARD -p tcp --dport 80 -i $IF_WLAN -j ACCEPT iptables -A FORWARD -d ! $IF_LAN_NET -i $IF_WLAN -j ACCEPT echo " Local public services (all interfaces):" echo " SSH..." iptables -A INPUT -p tcp --dport 22 -j ACCEPT #echo " Forwarding:" #echo " SSH..." #iptables -A FORWARD -p tcp -d 192.168.0.100 --dport 22 -j ACCEPT #iptables -t nat -A PREROUTING -i $IF_INET -p tcp -d $IF_INET_IP --dport 2222 -j DNAT --to 192.168.0.100:22 echo " Logging & Dropping..." iptables -A INPUT -p tcp -j LOG -m limit --log-prefix "FILTER TCP-BAD-IN:" iptables -A INPUT -p tcp -j DROP iptables -A INPUT -p udp -j LOG -m limit --log-prefix "FILTER UDP-BAD-IN:" iptables -A INPUT -p udp -j DROP iptables -A INPUT -j LOG -m limit --log-prefix "FILTER UNKNOWN-BAD-IN:" iptables -A INPUT -j DROP iptables -A FORWARD -p tcp -j LOG -m limit --log-prefix "FILTER TCP-BAD-FWD:" iptables -A FORWARD -p tcp -j DROP iptables -A FORWARD -p udp -j LOG -m limit --log-prefix "FILTER UDP-BAD-FWD:" iptables -A FORWARD -p udp -j DROP iptables -A FORWARD -j LOG -m limit --log-prefix "FILTER UNKNOWN-BAD-FWD:" iptables -A FORWARD -j DROP echo "Setting up spoofing protection..." for i in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $i done # disable source routed packets echo "Disabling source routed packets..." for i in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo 0 > $i done echo "Setting default policy..." iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -P FORWARD DROP echo "Starting up routing..." echo 1 > /proc/sys/net/ipv4/ip_forward ;; stop) echo "Shutting down routing..." echo 0 > /proc/sys/net/ipv4/ip_forward iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -F iptables -t nat -F iptables -t mangle -F ;; *) echo "Usage: ./filter {start|stop}" exit 1 ;; esac exit 0

1 0

exploit problem
by maurizio_eta 21 Jul '04

21 Jul '04

hi, I have a Apache-1.3.28-74 web server on SuseLinux9.0 os and my apache's file log is full of exploit requests write below, how i can protect my system? tank's in advance Maurizio '\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\ x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\ xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x 02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb 1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\ x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\ xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x 02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb 1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\ x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\ xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x 02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb 1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\ x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\ xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x 02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb 1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\ x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\ xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x 02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb 1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\ x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\ xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x 02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb 1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\ x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\x b1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\ xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x 02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb 1\x02\xb1\x02\xb1\x02\xb1\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90 \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90\ '

2 2

RE: [suse-security] Secure updating/installing of packages
by Hemsley, Trevor 21 Jul '04

21 Jul '04

-----Original Message----- From: suse(a)rio.vg [mailto:suse@rio.vg] Sent: 21 July 2004 14:09 To: suse-security(a)suse.com Subject: Re: [suse-security] Secure updating/installing of packages Quoting Christian <neodaxus(a)gmx.net>: > > > All SuSE packages are cryptographically signed with the SuSE build key > > (build(a)suse.de). It is automatically installed from the CDs. > > But does YOU and Yast check the signature of every package before > installing it? Who knows this for sure? > I haven't looked at the code, but the program is supposed to If you uninstall GPG and then install/patch other products then you get a popup from Yast for each one telling you that it cannot verify the signature and asking if you want to proceed. __________________________________________________________________________ This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Atos Origin group liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. __________________________________________________________________________

1 0