September 2004 - openSUSE Security - openSUSE Mailing Lists

cipher algorithm
by Sébastien V 21 Sep '04

21 Sep '04

Hello, i m using the VPN solution openVPN, and OPENVPN provides quite many cipher algorithm,the default one is blowfish. here is the list: DES-CBC 64 bit default key (fixed) RC2-CBC 128 bit default key (variable) DES-EDE-CBC 128 bit default key (fixed) DES-EDE3-CBC 192 bit default key (fixed) DESX-CBC 192 bit default key (fixed) BF-CBC 128 bit default key (variable) RC2-40-CBC 40 bit default key (variable) CAST5-CBC 128 bit default key (variable) RC2-64-CBC 64 bit default key (variable) AES-128-CBC 128 bit default key (fixed) AES-192-CBC 192 bit default key (fixed) AES-256-CBC 256 bit default key (fixed) CBC mode is recommended but it seems they are all CBC anyway. Which one do you recommand me? i want an efficient and robust cipher algorithm. best regards sebastien _________________________________________________________________ MSN Messenger : discutez en direct avec vos amis ! http://www.msn.fr/msger/default.asp

2 1

Re: [suse-security] cipher algorithm
by Wilfred van Velzen 21 Sep '04

21 Sep '04

Here's a recent article on hash functions: http://www.schneier.com/crypto-gram-0409.html#3 Draw your own conclusion... ;-) Met vriendelijke groet / Best regards, Wilfred van Velzen >>> Sébastien V <soloturku(a)hotmail.com> 2004-09-21 08:38:46 >>> hello I m trying to setup a VPN under Suse Linux machines(using OpenVPN): i have some questions about cipher and digest algorithm: BlowFish is the default cipher and SHA1 is the default message digest. Are they good algorithms? OpenVPN provides also other cipher such as: cipher DES-EDE3-CBC # Triple-DES cipher AES-128-CBC # AES Which cipher and digest method should i use? i want to secure my VPN as much as possible. thanks a lot sebastien _________________________________________________________________ MSN Search, le moteur de recherche qui pense comme vous ! http://search.msn.fr/worldwide.asp -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- SERCOM Regeltechniek b.v. Heereweg 9 2161 AB Lisse Nederland +31 (0)252 416530 (voice) +31 (0)252 419481 (fax) <http://www.sercom.nl/> Op al onze offertes, op alle opdrachten aan ons en op alle met ons gesloten overeenkomsten zijn toepasselijk de METAALUNIEVOORWAARDEN, gedeponeerd ter Griffie van de Rechtbank te Rotterdam, zoals deze luiden volgens de laatstelijk aldaar neergelegde tekst. De leveringsvoorwaarden worden u op verzoek toegezonden.

1 0

cipher algorithm
by Sébastien V 21 Sep '04

21 Sep '04

hello I m trying to setup a VPN under Suse Linux machines(using OpenVPN): i have some questions about cipher and digest algorithm: BlowFish is the default cipher and SHA1 is the default message digest. Are they good algorithms? OpenVPN provides also other cipher such as: cipher DES-EDE3-CBC # Triple-DES cipher AES-128-CBC # AES Which cipher and digest method should i use? i want to secure my VPN as much as possible. thanks a lot sebastien _________________________________________________________________ MSN Messenger : discutez en direct avec vos amis ! http://www.msn.fr/msger/default.asp

1 0

cipher algorithm
by Sébastien V 21 Sep '04

21 Sep '04

hello I m trying to setup a VPN under Suse Linux machines(using OpenVPN): i have some questions about cipher and digest algorithm: BlowFish is the default cipher and SHA1 is the default message digest. Are they good algorithms? OpenVPN provides also other cipher such as: cipher DES-EDE3-CBC # Triple-DES cipher AES-128-CBC # AES Which cipher and digest method should i use? i want to secure my VPN as much as possible. thanks a lot sebastien _________________________________________________________________ MSN Search, le moteur de recherche qui pense comme vous ! http://search.msn.fr/worldwide.asp

1 0

firewall/mailServer
by Paul Ikanza 21 Sep '04

21 Sep '04

Can Anyone please recommend for me between suse 9.1 and 8.2 which one is better for mail (postfix) as well as proxy/firewall-not too familiar with 9.1 yet. Paul

1 0

[Fwd: Fwd: Re: SELinux]
by Jophn Deo 20 Sep '04

20 Sep '04

1 0

FreeSWAN: Win2k ok, XP fails
by Stefan-Michael. Günther (in-put GbR) 20 Sep '04

20 Sep '04

Hello, during this week I have set up a FreeSWAN gateway and tested the configuration succesfully with another gateway and a Win2k client. After this I copied the certificate and the configuration I used with Win2K to a XP box (ipsecmd installed, no SP2, ipsec-tool from vpn.ebootis.de). ipsec -debug looked good and a ping to an apache behind the FreeSWAN gateway told me "ip security negotiated". But in /var/log/messages I find the following line: "encrypted Informational Exchange message is invalid because it is for incomplete ISAKMP SA" I saw this message before, when I used the wrong ca in the Win2k ipsec.conf. But this time the ca must be right, because I was able to connect to the apache with the Win2k -client over the vpn (tcpdump and the browser prooved that) Does anyone of you know whether it's necessary to make any change to the config files when the client is an XP box ? I haven't found a note on that in the documentation. Thanks for any hint. Bye, Stefan -- ***************************************** in-put GbR - Das Linux-Systemhaus Stefan-Michael Günther Moltkestraße 49 D-76133 Karlsruhe Tel./Fax : +49 (0)721 / 83044 - 98/93 http://www.in-put.de *****************************************

2 2

startup and shutdown
by Sébastien V 20 Sep '04

20 Sep '04

hi, I made a small shell script(firewall) and i want to launch this script when suse linux boot and shut down this script when i close suse linux. how can i do that? best regards sebastien _________________________________________________________________ MSN Search, le moteur de recherche qui pense comme vous ! http://search.msn.fr/worldwide.asp

3 2

Re: [suse-security] SuSE Firewall and CUPS (UDP rules)?
by Maxim A Belushkin 17 Sep '04

17 Sep '04

No, my question is *much* simpler, sorry :) The 4 steps of configuring the firewall with Yast: Step 1: select interface. I have no trusted net, no "internal" interface. So eth0 is the only one, and it's set to external. Step 2: Services. Additional services is set to: 631. This is what's causing my confusion. It drops UDP packets destined for port 631. And in fact, in that dialog box it says "TCP services". What am I missing in the Yast firewall setup tool? :P I've normally set iptables rules by hand, but decided to try the Yast setup, and... I feel I'm missing a lot of things :) So my question amounts to: can the Yast tools do it? it's a very simple rule, seriously! Or do I need to insert it by hand? In which case I might as well trash all the rules Yast set up in there and put in my own standard set. - Vfrc - barrulus wrote: > > ------------------------------------------------------------------------ > > On Friday 17 September 2004 09:05, Maxim A Belushkin wrote: > >> a print server on the network is bcasting queue names to UDP port >>631. SuSE firewall seems to only have exceptions for TCP ports, and not >>UDP. Any "clean" workaround for this avoiding digging into the iptables >>rules the firewall creates? > > > ??? > > You can set up trusted nets with UDP, allow interfaces to listen with UDP, > forward UDP traffic and masquerade UDP traffic? > > When you say "exceptions" what do you mean? > Do you want the local CUPS server to be listening on that port to pick up the > broadcasts, or do you want the broadcasts to be forwarded into your LAN from > your DMZ?

4 5

connecting 2 machine via internet
by Giovanni Racciu 17 Sep '04

17 Sep '04

Hi, I need to establish a secure connection between 2 machines (running Suse9.1pro) via Internet. I have a server machine, with a static ip address while the client is behind a modem/router/ADSL which has its own static/dynamic IP and performs NAT translation. client (192.168.0.x) ----- NAT/ADSL(Router static ip) ---- Server (Suse9.1pro with static IP) My final purpose is to be able to login on the client suse box. I also would like to support multiple clients and the connection on client side should be established without user intervention. I am evaluating vtun a the moment. Do you have any suggestion ? Thanks Ciao Giovanni

3 2