December 2005 - openSUSE Security - openSUSE Mailing Lists

Substitute for depricated FW_ALLOW_INCOMING_HIGHPORTS_TCP in SuSEFirewall2?
by David Huecking 31 Dec '05

31 Dec '05

Hello everybody! Since the update to SuSE10.0 there are messages that FW_ALLOW_INCOMING_HIGHPORTS_TCP is depricated in SuSEFirewall2 and will be removed in future versions. Now without the entries there some incoming connections e.g. to a filesharing tool does not work. - What is the substitution for this entry. TIA, -- Eat, sleep and go running, David Hücking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216

2 1

Why Install Telnet by Default?
by WebDev 28 Dec '05

28 Dec '05

I am not a security expert by any means, nor necessarily a "purist", when it comes to installing only the apps I need to run. I do install some apps that I want to tinker with, even though I may not use them regularly. However, I understand that we should avoid using telnet because it is "insecure". Yet, telnet is still installed by default on SUSE, when the secure alternatives seem to be more appropriate. I assume there is a reason for this. I ask, because I deselected telnet when I installed SUSE 10.0, and duringa repair process, my system reported that telnet was a core app. If we should avoid using it, shouldn't we avoid installing it to begin with? Thanks in advance for your input. Don -- Web Developer Oakdale Christian Fellowship http://matheteuo.org/

14 24

Redirect traffic for transparent proxy
by Jordi Espasa Clofent 28 Dec '05

28 Dec '05

Hi all, I'm trying to set up a machine with proxy-cache (Squid 2,5 STABLE); the setting process is well-documented, but I've found a trouble when I want redirect the traffic for transparent proxy. My goal is obvious: redirect all traffic from port 80 (the clients) to port 3128 (the proxy in the server) to set up transparent proxy. The structure is: Server eth0 -- connection to internet 192.168.1.2 (EXT) eth1 -- connection to LAN 172.26.0.1 (INT) Client eth0 -- connection to eth1 Server 172.26.0.x (where x is 2+) 1) In SuSE manual, the syntaxis of redirected traffic is (page 763 of Reference Guide SuSE 10.0): FW_REDIRECT_TCP="172.26.0.0/24,0/0,80,3128" FW_REDIRECT_UDP="172.26.0.0/24,0/0,80,3128" 2) In the /etc/sysconfig/SuSEfirewall2 the comments of section 14 (¿whereis section 15???) says the same line both protocols, TCP and UDP. So, the correct syntaxis should be: FW_REDIRECT="172.26.0.0/24,0/0,80,3128" 3) Both syntaxis (1 & 2) doesn't works in my server. Even I've tried to do it with iptables: iptables -t nat -A PREROUTING -i $INTERFACE -p tcp --dport 80 -j REDIRECT --to-port 3128 Apparently squid works fine; if I test without transparent proxy (setting the client browsers to port 3128 directly) there isn't problems. The trouble is redirect traffic. -- Salut, Jordi Espasa

3 3

FW: [suse-security] Redirect traffic for transparent proxy
by Dragan Andric 28 Dec '05

28 Dec '05

Jordi, Please check did you setup squid properly as well. You need to uncomment and put the following directives with values in squid.conf httpd_accel_host virtual httpd_accel_port 80 httpd_accel_with_proxy on httpd_accel_uses_host_header on Happy new year. Regards, Dragan Andric -----Original Message----- From: Jordi Espasa Clofent [mailto:jespasac@yahoo.es] Sent: Wednesday, December 28, 2005 1:18 PM To: suse-security(a)suse.com Subject: [suse-security] Redirect traffic for transparent proxy Hi all, I'm trying to set up a machine with proxy-cache (Squid 2,5 STABLE); the setting process is well-documented, but I've found a trouble when I want redirect the traffic for transparent proxy. My goal is obvious: redirect all traffic from port 80 (the clients) to port 3128 (the proxy in the server) to set up transparent proxy. The structure is: Server eth0 -- connection to internet 192.168.1.2 (EXT) eth1 -- connection to LAN 172.26.0.1 (INT) Client eth0 -- connection to eth1 Server 172.26.0.x (where x is 2+) 1) In SuSE manual, the syntaxis of redirected traffic is (page 763 of Reference Guide SuSE 10.0): FW_REDIRECT_TCP="172.26.0.0/24,0/0,80,3128" FW_REDIRECT_UDP="172.26.0.0/24,0/0,80,3128" 2) In the /etc/sysconfig/SuSEfirewall2 the comments of section 14 (¿whereis section 15???) says the same line both protocols, TCP and UDP. So, the correct syntaxis should be: FW_REDIRECT="172.26.0.0/24,0/0,80,3128" 3) Both syntaxis (1 & 2) doesn't works in my server. Even I've tried to do it with iptables: iptables -t nat -A PREROUTING -i $INTERFACE -p tcp --dport 80 -j REDIRECT --to-port 3128 Apparently squid works fine; if I test without transparent proxy (setting the client browsers to port 3128 directly) there isn't problems. The trouble is redirect traffic. -- Salut, Jordi Espasa -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

TIME_WAIT
by Silva, Ernesto - Webmaster 26 Dec '05

26 Dec '05

Hi, this is my first post to the list. I think I've got this problem since last tuesday when I've put in production state my first SLES9. I have lots of connections in TIME_WAIT state. As I understand the TIME_WAIT state is used to indicate that a closing socket still have to manage some packets in the network before "disapear". My /proc/sys/net/ipv4/tcp_fin_timeout is set to 30 seconds, and apparently most (all?) connections are ending by this timeout, not by themselves. Most of the sockets interconnect processes running in the very same machine, I don't understand why is the timeout reached. I supose this would be a normal situation with a slow machine, but this is a new one with 2 Xeon processors @ 3GHz and 2 GB of ram, it only have to handle 1 Mbps of internet connection. I cannot put into production the old machine to compare them. As as second problem the machine stales for various seconds (5 to 20) from time to time. I've also changed the NIC, but the situation is still present. I've applied all possible patches, the OS is up to date. Running processes: apache2 (prefork) postfix imss, interscan antivirus daemon, postfix content filter netstat -nep see the attached file. Best regards, Ernesto Silva.

1 0

aide.conf
by Bruno Cochofel 21 Dec '05

21 Dec '05

I've installed aide on a fresh SuSE 9.3 and did: # aide --init When I run: #aide --check I get always references to /dev diferences. I haven't changed aide.conf, so I'm working with SuSE default. Can I do something to change that behavior? Maybe only check inodes under /dev dir?! Thanks, Bruno

1 0

Depedency failure
by John 19 Dec '05

19 Dec '05

Hi to all I have just downloaded the new php packages from the ftp.suse.com apache2-php4 and php4 version 4.4.0-12.1 php4-4.3.10-14 was previously installed. I also have installed the httpd2-2.0.55 with success. Now the problem is that when i run the rpm command against those new php4 packages i recieve the error. apache_mmn_20051115 is needed by apache2-mod_php4-4.4.0-12.1 I have installed the apach2-prefork and other package such apache2, libpar0, etc.. What is wrong? Thanks in advance.

1 0

Ownership of Directories/Files under /srv/www/htdocs
by Lucky Leavell 17 Dec '05

17 Dec '05

OS: SuSE 10.0 Pro I recently installed PostfixAdmin 3.1 doing the install as root and changed file permissions to 640 per the instructions. However, I cannot access it unless I make the files world readable (644). Question: What owner:group should applications be installed as under /srv/www/htdocs? I currently have phpMyAdmin and PostfixAdmin. Thank you, Lucky Leavell

4 4

encore:.. winscp& openssh
by piet 15 Dec '05

15 Dec '05

ok people, server is 9.3 suse open ssh xp-box is winscp. I made a public & private key with PuTTY, copy-paste the public to a text file: renamed it public.pub put it in /home/xxxx/.ssh did: touch authorized_keys chmod 600 authorized_keys cat public.pub >>authorized_keys rm public.pub loaded private key (private.pkk) in peagent key on de xp-box but cannot login why???? ---------------------------------------------------------------- here is my ssh file: ............................. # $OpenBSD: ssh_config,v 1.19 2003/08/13 08:46:31 markus Exp $ # This is the ssh client system-wide configuration file. See # ssh_config(5) for more information. This file provides defaults for # users, and the values can be changed in per-user configuration files # or on the command line. # Configuration data is parsed as follows: # 1. command line options # 2. user-specific file # 3. system-wide file # Any configuration value is only changed the first time it is set. # Thus, host-specific definitions should be at the beginning of the # configuration file, and defaults at the end. # Site-wide defaults for various options Host * # ForwardAgent no # ForwardX11 no # If you do not trust your remote host (or its administrator), you # should not forward X11 connections to your local X11-display for # security reasons: Someone stealing the authentification data on the # remote side (the "spoofed" X-server by the remote sshd) can read your # keystrokes as you type, just like any other X11 client could do. # Set this to "no" here for global effect or in your own ~/.ssh/config # file if you want to have the remote X11 authentification data to # expire after two minutes after remote login. ForwardX11Trusted yes # RhostsRSAAuthentication no # DSAAuthentication yes # RSAAuthentication yes # PasswordAuthentication yes # HostbasedAuthentication no # BatchMode no # CheckHostIP yes # AddressFamily any # ConnectTimeout 0 # StrictHostKeyChecking ask # IdentityFile ~/.ssh/identity # IdentityFile ~/.ssh/id_rsa # IdentityFile ~/.ssh/id_dsa # Port 22 # Protocol 2 # Cipher 3des # Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc # EscapeChar ~ # GSSAPIAuthentication no # GSSAPIDelegateCredentials no # Set this to 'yes' to enable support for the deprecated 'gssapi' authentication # mechanism to OpenSSH 3.8p1. The newer 'gssapi-with-mic' mechanism is included # in this release. The use of 'gssapi' is deprecated due to the presence of # potential man-in-the-middle attacks, which 'gssapi-with-mic' is not susceptible to. # GSSAPIEnableMITMAttack no # This enables sending locale enviroment variables LC_* LANG, see ssh_config(5). SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT SendEnv LC_IDENTIFICATION LC_ALL ............................ ............................ sshd file ............................. # $OpenBSD: sshd_config,v 1.69 2004/05/23 23:59:53 dtucker Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options change a # default value. #Port 22 #Protocol 2,1 ; is de orginele regel geinterpreteerd als het volgende: Protocol 2 #ListenAddress 0.0.0.0 #ListenAddress :: # HostKey for protocol version 1 #HostKey /etc/ssh/ssh_host_key #HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_dsa_key # Lifetime and size of ephemeral version 1 server key #KeyRegenerationInterval 1h #ServerKeyBits 768 # Logging #obsoletes QuietMode and FascistLogging #SyslogFacility AUTH #LogLevel INFO # Authentication: #LoginGraceTime 2m PermitRootLogin no #StrictModes yes #MaxAuthTries 6 #volgende regel toegevoegd nav vosberg: piet #DSAAuthentication yes RSAAuthentication yes #PubkeyAuthentication yes AuthorizedKeysFile ~/.ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #RhostsRSAAuthentication no # similar for protocol version 2 #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # RhostsRSAAuthentication and HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes # To disable tunneled clear text passwords, change to no here! PasswordAuthentication no PermitEmptyPasswords no # Change to no to disable s/key passwords #ChallengeResponseAuthentication yes # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes # Set this to 'yes' to enable support for the deprecated 'gssapi' #authentication # mechanism to OpenSSH 3.8p1. The newer 'gssapi-with-mic' mechanism is #included # in this release. The use of 'gssapi' is deprecated due to the presence #of # potential man-in-the-middle attacks, which 'gssapi-with-mic' is not #susceptible to. #GSSAPIEnableMITMAttack no # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication mechanism. # Depending on your PAM configuration, this may bypass the setting of # PasswordAuthentication, PermitEmptyPasswords, and # "PermitRootLogin without-password". If you just want the PAM account #and # session checks to run without PAM authentication, then enable this but #set # ChallengeResponseAuthentication=no #UsePAM yes #AllowTcpForwarding yes #GatewayPorts no X11Forwarding yes #X11DisplayOffset 10 #X11UseLocalhost yes #PrintMotd yes #PrintLastLog yes #TCPKeepAlive yes #UseLogin no #UsePrivilegeSeparation yes #PermitUserEnvironment no #Compression yes #ClientAliveInterval 0 ClientAliveCountMax 3 #UseDNS yes #PidFile /var/run/sshd.pid #MaxStartups 10 # no default banner path #Banner /some/path # override default of no subsystems Subsystem sftp /usr/lib/ssh/sftp-server # This enables accepting locale enviroment variables LC_* LANG, see sshd_config(5). AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL ...................................................................... regards, piet regards, piet

5 12

unsubscribe please
by Dharmendra Chaturvedi 15 Dec '05

15 Dec '05

-- Fling Officer D Chaturvedi Tel- 08482-228244 9448567754

2 1