September 2004 - openSUSE Security - openSUSE Mailing Lists

Re: [SLE] re: why wont my suse compile
by Ben 29 Sep '04

29 Sep '04

On Wed, 29 Sep 2004 14:54:40 -0700, Ben <willcu(a)paradise.net.nz> wrote: > On Tue, 28 Sep 2004 19:51:28 -0700, Randall R Schulz <rschulz(a)sonic.net> > wrote: > >> Patrick, >> >> On Tuesday 28 September 2004 19:32, Patrick Shanahan wrote: >>> * Randall R Schulz <rschulz(a)sonic.net> [09-28-04 09:59]: >>> > It's called "Dictionary" (Gasp! What an inspired name!) >>> > >>> > It's always in the recent applications section of my KDE menu, so >>> > I'll have to go looking for it's original home... There it is. It's >>> > in the "Office..." sub-menu of the KDE menu. Assuming you installed >>> > it. >>> >>> and is available from the cl as 'dict'. Much easier to use this way. >> >> That's debatable, and probably dependent on the context in which you're >> using it. >> >> I'm by no means command-line-phobic (or even possessed of an overall >> bias >> one way or the other), but in this case, I like the GUI. >> >> It's somewhat like the discussion of how best to extract user names from >> an "ls" listing. "Best" is very context- and purpose-dependent. >> >> >> What I would like to have (but have not had time to investigate, yet) is >> the ability to have the current text selection automatically primed into >> a Dictionary / dict search. I do miss that level of integration with MS >> Bookshelf. >> > This is the thread i started the other day, look how far removed from > the question > it has become, WTF is it all about suse, security or gramma and nit > picking > PSS When i did CL "dict" no such thing?. Is that for SuSE 9.1 pro? cause it dont werk in SuSE 9.1 personal? A decent Dictionary would be handy for me as the flames i get for spelling is terrible, So i guess i should do something about it really. :) >>> -- >>> Patrick Shanahan >> >> >> Randall Schulz >> > > > -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

2 1

re: strange but true
by Ben 29 Sep '04

29 Sep '04

Hello all I have a strange problem, I keep watch on a network belonging to a non-profit org at which there are one hardware firewall (linksys) that is a embedded linux (i think). The computers where logged off yet i saw that three of the computers made a tcp connection to the net. How is it possible to make this connection if the computers are logged off? is this a fault with the firewall or is it possible for a logged off computer to make an outgoing connection? Any suggestion's will be greatfully received Yours...Ben :D -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

5 21

Re: [suse-security] re: Time
by Scott Leighton 29 Sep '04

29 Sep '04

On Wednesday 29 September 2004 3:49 pm, you wrote: > On Tue, 28 Sep 2004 20:45:42 -0700, Scott Leighton <helphand(a)pacbell.net> > > >> > > >> > Well, your mail header has this: > >> > > >> > Date: Wed, 29 Sep 2004 14:41:07 -0700 > >> > > >> > Which is clearly the wrong date and time. I'm in that > >> > timezone and the time right now is > >> > > >> > Tues, 28 Sep 2004 18:57:41 -0700 > >> > > >> > Scott > >> > >> Sorry bro but today is wednesday here??????? > > > > Then you can't possibly be in the PDT timezone. > > > > As noted above, -0700 > > > > Scott > > OHH, I see. Time zone! > im not sure what time zone i should be in (and thats pretty typical for > me). > i choose Auckland NZ when i install but i notice that its never right! > that must be the problem. I used to do NTPDATE TIME.PARADISE.NET.NZ and > that > would fix it, but that doesnt work in SuSE, What is the SuSE equivalent to > NTPDATE? > Do you know if there is a Command line script for it? > Thanks, i see that you are right! > I'll have to defer your question to one of the experts on the list. All I know is that I set my timezone in the clock in the lower right hand corner of KDE and it all just works. I use xntp to keep it all sync'd, but don't recall having to specify any timezone when setting that up. Someone will surely come along who knows the facts and can help you with specifics. Scott -- POPFile, the OpenSource EMail Classifier http://popfile.sourceforge.net/ Linux 2.6.5-7.108-default x86_64

1 0

Re: [suse-security] re: Time
by Scott Leighton 29 Sep '04

29 Sep '04

On Wednesday 29 September 2004 3:01 pm, you wrote: > On Tue, 28 Sep 2004 19:58:37 -0700, Scott Leighton <helphand(a)pacbell.net> > > wrote: > > On Wednesday 29 September 2004 2:41 pm, Ben wrote: > >> I have noticed that someone complained about the time. > >> What was wrong with my time? > >> It seem right from where i sit? > >> But i am happy to listen if there is a prob with my time > >> Again, my time seems right from here? > >> is it wrong at your end? > > > > Well, your mail header has this: > > > > Date: Wed, 29 Sep 2004 14:41:07 -0700 > > > > Which is clearly the wrong date and time. I'm in that > > timezone and the time right now is > > > > Tues, 28 Sep 2004 18:57:41 -0700 > > > > Scott > > Sorry bro but today is wednesday here??????? Check your timezone. I'm in -0700 which is Pacific Daylight Time. Your headers are showing -0700, which is obviously not correct for where you are really located. Scott -- POPFile, the OpenSource EMail Classifier http://popfile.sourceforge.net/ Linux 2.6.5-7.108-default x86_64

1 0

re: Time
by Ben 29 Sep '04

29 Sep '04

I have noticed that someone complained about the time. What was wrong with my time? It seem right from where i sit? But i am happy to listen if there is a prob with my time Again, my time seems right from here? is it wrong at your end? Yours...Ben :) -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

2 1

SSH password attacks
by suse＠rio.vg 28 Sep '04

28 Sep '04

This may not be strictly SuSE related, but what the heck: Lately, I've been getting tons of attempts to login via ssh for "guest", "test", "user", and "admin". Plenty others for root, and even one that seemed to have been a list of some script kiddie's /etc/passwd. The root ones are pretty obvious and always blocked, but I've found the others rather curious. Does anyone running a unix server really use "guest", "test", "user", or "admin" as real accounts? Judging by the volume of attempts I'm getting, there has to be something causing this. Was a borked version of ssh server released for windows, or something? Or is this trying to connect to zombie machines? From what I understand, ssh server isn't common on windows, and those accounts certainly aren't common to unix... Anyone know what's going on here? (I'm not worried about my machines, root is blocked by sshd and I don't have the other accounts, I'm just curious.)

16 20

Fou4s 0.12.0 released!
by Markus Gaugusch 28 Sep '04

28 Sep '04

I'm glad to announce Fast OnlineUpdate for SuSE (fou4s) 0.12.0. Many months have passed since the last version came out, mostly because I'm going to school again, in addition to my daily job. Right now, just before school starts again, I've (hopefully) fixed the most annoying bugs and added some nice features. These are the official release notes. The bad news first: * If root starts fou4s in an untrusted directory, the "SuSE-release" script would be executed from that directory. This is fixed now (ownership-check). * Some updates were missed (scripts), and unfortunately I just discovered, that mysql updates from August were also missed on SuSE 9.0. Now the good news: * Fou4s will do a fully automatic backup of your old kernel. It will be named /boot/vmlinuz.fou4s. This backup is independent from the RPM package and must be deleted manually if it is not needed any more. You also have to add an appropriate lilo.conf/grub menu entry by hand, but fou4s will remind you to do so. Of course this feature can also be disabled in fou4s.conf (KernelBackup=0) * Remind to reboot after doing a kernel update (works even if you updated your kernel with YOU :) * Remote host functionality improved (export scripts and kernels) * A Nagios check script (by William Jacqmein) What else? * Fou4s is no longer on the AutoList in the default configuration. Previously, you had to install a cronjob manually and edit it to fit your needs. Now you can use the --cronserver or --cronworkstation commands and you probably won't look inside the cronjob files. Therefore I decided to remove the self-update feature. Existing installations won't be affected, though. * Support for user/password in urls (e.g. ftp://user:pass@mymirror/suse) * No longer run SuSEconfig with GID fou4s This release will probably be the last before 1.0 (ok, probably 0.12.1 will be released with some minor fixes that usually come out after a release). My TODO list is nearly empty :) Last words: If you sent me a mail during the last months and your bug(-fix) is not included with this release, please contact me again. I was very busy and probably just overlooked it. Thank you for your attention Markus Gaugusch -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \

2 1

Re: [suse-security] dns and named in chroot jail
by suse＠tremor.com 28 Sep '04

28 Sep '04

Your issue is that dhcpd is running as the user dhcpd but the permissions on the test.it directory (and I'm assuming the files as well) do not have the correct permissions for dhcpd to update it. If you "chmod 775 test.it" and "chmod 664" the files inside that folder, then make the user dhcpd part of the named group, you should be good. > Hi, > I wanna configure dhcpd and named in chroot jail for security reason. > Dhcpd and named work well but dhcpd does not update named and in the log > files i have nothing that help me to understand the problem. > I use suse professional 9.1. > I read the document in /usr/share/doc/packages/bind but i do not know > where is the problem. > Could you help me ? > Best regards, > Cristian Del Carlo. > > 5) /etc/sysconfig/dhcpd > DHCPD_INTERFACE="eth0" > DHCPD_RUN_CHROOTED="yes" > DHCPD_CONF_INCLUDE_FILES="/etc/named.keys" > DHCPD_RUN_AS="dhcpd" > DHCPD_OTHER_ARGS="" > DHCPD_BINARY="" > > 6) ls -al /var/lib/named > drwxr-xr-x 2 named named 4096 Sep 28 18:54 test.it

1 1

dns and named in chroot jail
by Cristian Del Carlo 28 Sep '04

28 Sep '04

Hi, I wanna configure dhcpd and named in chroot jail for security reason. Dhcpd and named work well but dhcpd does not update named and in the log files i have nothing that help me to understand the problem. I use suse professional 9.1. I read the document in /usr/share/doc/packages/bind but i do not know where is the problem. Could you help me ? Best regards, Cristian Del Carlo. My configuration is the following : 1) /etc/dhcpd.conf default-lease-time 600; max-lease-time 7200; include "/etc/named.keys"; authoritative; allow unknown-clients; ddns-update-style interim; ignore client-updates; subnet 10.1.1.0 netmask 255.255.255.0 { range 10.1.1.101 10.1.1.185; option domain-name "test.it"; option domain-name-servers 10.1.1.1; option subnet-mask 255.255.255.0; option routers 10.1.1.1; option domain-name-servers 10.1.1.1; ddns-domainname "test.it"; ddns-rev-domainname "1.1.10.in-addr.arpa"; zone test.it. { primary 127.0.0.1; key DHCP_UPDATER; } zone 1.1.10.in-addr.arpa. { primary 127.0.0.1; key DHCP_UPDATER; } } 2) /etc/named.conf acl PROVIDER { 192.168.9.30; }; acl BIND { 10.1.1.1; 127.0.0.1/8; }; acl RETELOCALE { 10.1.1.0/24; 127.0.0.1/8; }; options { directory "/var/lib/named"; dump-file "/var/log/named_dump.db"; statistics-file "/var/log/named.stats"; forwarders { 192.168.9.30; }; listen-on port 53 { BIND; }; listen-on-v6 { any; }; allow-query { RETELOCALE; }; allow-transfer { none; }; allow-recursion { RETELOCALE; }; notify no; }; < .......> include "/etc/named.conf.include"; include "/etc/named.keys"; zone "test.it" in { type master; file "test.it/master.zone"; allow-transfer { 127.0.0.0/8; }; allow-update { key DHCP_UPDATER; }; }; zone "1.1.10.in-addr.arpa" in { type master; file "test.it/10.1.1.0.zone"; allow-transfer { 127.0.0.0/8; }; allow-update { key DHCP_UPDATER; }; }; 3) /etc/named.keys key DHCP_UPDATER { algorithm hmac-md5; secret "<samething>"; }; 4) /etc/sysconfig/named NAMED_RUN_CHROOTED="yes" NAMED_CONF_INCLUDE_FILES="rndc-access.conf /etc/named.keys" NAMED_ARGS="" 5) /etc/sysconfig/dhcpd DHCPD_INTERFACE="eth0" DHCPD_RUN_CHROOTED="yes" DHCPD_CONF_INCLUDE_FILES="/etc/named.keys" DHCPD_RUN_AS="dhcpd" DHCPD_OTHER_ARGS="" DHCPD_BINARY="" 6) ls -al /var/lib/named drwxr-xr-x 10 root root 4096 Sep 23 14:02 . drwxr-xr-x 58 root root 4096 Sep 28 08:34 .. -rw-r--r-- 1 root root 192 Apr 6 04:06 127.0.0.zone drwxr-xr-x 2 root root 4096 Sep 28 08:27 dev drwxr-xr-x 2 named named 4096 Apr 6 04:06 dyn drwxr-xr-x 3 root root 4096 Sep 28 14:55 etc -rw-r--r-- 1 root root 158 Apr 6 04:06 localhost.zone drwxr-xr-x 2 named named 4096 Sep 24 12:07 log drwxr-xr-x 2 root root 4096 Sep 23 14:02 master -rw-r--r-- 1 root root 2517 Apr 6 04:06 root.hint drwxr-xr-x 2 named named 4096 Sep 23 12:11 slave drwxr-xr-x 2 named named 4096 Sep 28 18:54 test.it drwxr-xr-x 4 root root 4096 Sep 23 09:31 var

1 0

Re: [suse-security] re: strange but true
by Derek Fountain 28 Sep '04

28 Sep '04

On Wednesday 29 September 2004 12:28, you wrote: > On Tue, 28 Sep 2004 17:26:40 +0800, Derek Fountain <dflists(a)iinet.net.au> > > wrote: > > On Wednesday 29 September 2004 11:57, Ben wrote: > >> it seems to me that linux has as many security probs > >> as MS does?. > >> > >> as i am pretty much a newbie (only got into linux the last 2-3 months) > > > > Given the latter statement I'd suggest you hold your judgement on the > > former! > > True! > do you have a suggestion on a security concious linux Dist? Um, yes, SUSE! I think they're as security conscious as any other major distro, and they make patches available promptly (at least for the the latest version of their product). If you mean "security paranoid" perhaps you should look at something like Trustix? While Linux doesn't, IMHO, have anything like the security problems of Windows, you are wise as a newbie to hit the Linux ground running, so to speak, with security issues in mind. Occasionally Linux does have a problem which could be as grave as some of the Windows ones. The recent image based buffer overflows are a case in point - we only dodged that bullet because of a limited user base. I have a feeling the JPEG issue on Windows which has popped up over the last 24 hours will demonstrate what can be done with this sort of problem.

1 0