December 2005 - openSUSE Security - openSUSE Mailing Lists

Openssh + security
by Bruno Cochofel 14 Dec '05

14 Dec '05

I need to install an ssh server and I need some information about security options. I know that has been some kind off "attacks" on port 22 on the internet so I want to know a little more about those options under /etc/ssh/sshd_config. Thanks, Bruno

21 50

[suse-security] Re: Openssh + security (fwd)
by suse＠karsites.net 14 Dec '05

14 Dec '05

Me too. :-) What's the problem with running X on a server, apart from memory consumption? Keith ---------- Forwarded message ---------- To: Markus Gaugusch <markus(a)gaugusch.at> From: Bruno Cochofel <bruno.cochofel(a)gmail.com> Subject: [suse-security] Re: Openssh + security Well, I'm running X. I'm a home user and the "server" it's also my PC so I have to use it. I'm also running xscreensaver and aMule (this one all the time). Maybe this is bad!!!

1 0

Status of apache2-mod_php/mod_rewrite patch
by David Harrison 14 Dec '05

14 Dec '05

Hi, I was wondering if anyone had any status info on a fix to the broken php/rewrite modules in Apache. Last time this was mentioned on the list last month it was estimated a fix would be out in a week or two: http://lists.suse.com/archive/suse-security/2005-Nov/0160.html Regards, David Harrison

4 4

Xen3 and SuSEfirewall
by Hamish 13 Dec '05

13 Dec '05

Hello I am pulling my hair out over Xen and SuSEfirewall. After messing around with things in xen, I discovered that rather than a misconfiguration, SuSEfirewall was causing a "dead" network. Looking in the docs, it says: "If you use SUSEfirewall2, you'll probably want to add xenbr0, peth0, vif0.0 and the vifX.1 [X in 1 ... N] to the list of interfaces; as eth0 is on there, you'll probably want to add xenbr0 to the same class as eth0. You also need to enable forwarding (FW_FORWARD="yes") and allow forwarding of packets from xenbr0, vif0.0 and vifX.1, possibly by inserting a custom rule into the forward_XXX chain. For testing it's easiest to disable SuSEfirewall2, make sure that iptables -P FORWARD ACCEPT is set." I cannot really tell what this means, and what I should do about it. I have added the interfaces to INTERNAL and set FW_FORWARD="yes". This seems to conflict with the comments in the SuSEfirewall config file, which seem to expect [sourcenet],[destnet]). I have no idea how to allow forwarding from the different interfaces, can anyone help? It is a strange way that the interfaces are set up, from the docs again: "When using bridging, in domain0, the eth0 device will be renamed to peth0 and its MAC addr be set to fe:ff:ff:ff:ff:ff and ARP disabled. veth0 will take over the old MAC address, be renamed to eth0 and be enabled (ifup'ed). vif0.0 and peth0 are then enslaved to xenbr0. veth0 is connected to vif0.0 behind the scenes, that's why it works." I can get a dhcp address with the firewall up, but cannot ping or query dns. With the firewall down, everything works fine. Any suggestions welcome! Thanks, H

1 0

Re: [suse-security] Openssh + security
by Bruno Cochofel 13 Dec '05

13 Dec '05

I was having a problem because 'UsePAM yes' I have: PasswordAuthentication no PermitRootLogin no PubKeyAuthentication yes but because of the option UsePAM this was overllaped... My question: When using PubKeyAuthentication only users that have .ssh/authorized_keys file can login, right? So no test, postgres, mysql, admin, guest, etc...

2 3

PPPoE. Is this illegal what has happened to my pc? (really security stuff)
by Raicu Andi 13 Dec '05

13 Dec '05

Hello all. I live in Romania, in the city of Pitesti. There, the (probably) best ISP is RDS. Now, RDS gives us internet trough PPPoE, which requires an user and a password. Since it's the hollidays now, I forgot to pay my bill and they cut my account off. I'm SURE I haven't payed it. After a fresh format (installing SUSE10), when I was installing, I set-up my pppoe connection (dsl-like). After the installation is done... suprize: I could browse the web. BUT kinternet reports me that I'm NOT connected, and I don't have other ways of connecting, and I don't know other accounts. When I downloaded the ISOs, sometimes windows reseted the pc (stupid win!) and some rpm were corrupted (kernel source, kpim etc.) and were not installed due to the md5 checks. I usually have 128kbps and download with 15-16KB/s, but now I have like 4-5KB/s. I can't understand what is going on! Please excuse me if this is not a security-related issue (even I can't explain how I got connected to the net...) , but I gotto find out what has happened. Thank you all in advance!

2 1

unsubscription
by Gerhard Ostermann 13 Dec '05

13 Dec '05

1 0

SPAM: Re: [suse-security] Openssh + security
by Jaime Santos 11 Dec '05

11 Dec '05

Hi, You can use RSA challenge-response authentication, and the machine you are connecting to will only accept connections if you have a private key (which you protect through a passphrase), provided you disabled simple password login in it (in the file sshd_config, see below). An attacker would need first to obtain a copy of your private key and then would have to guess the passphrase (note that, if he does obtain the private key, he can launch a dictionary attack in the privacy of his room, so the passphrase should be a very strong one). The inconvenient is that you can only login from machines where this key is saved (under your directory ~/.ssh) or you have to otherwise carry such a private key with you on a diskette or USB stick. In order to generate such a key, you can use the ssh-keygen command. But, hey, security never rimes with conveniency :-) ... You should also disable root login via ssh, under all circunstances. And only use the SSH2 protocol, SSH1 has known weaknesses (someone else has just referred these two options as well). The file to tweak is /etc/ssh/sshd_config. The list is sort of self-explanatory. If you need further help, check the man pages for ssh, ssh-keygen, ssh-agent and ssh-add. If this does not help, drop me a note, I have a little bit of experience with the use of ssh. Note that there is a wonderfull reference, from O'Reilly, on SSH, 'SSH, the secure shell - The definitive guide', by Barrett and Silvermann. It is really a definitive guide, I learned practically everything from there. As far as I know, the version OpenSSH_4.1p1, which shipped with 10.0, has no known security bugs, but I could be wrong. In any case, there are no patches to it from SuSE. Check the openssh website for more information. Hope this helps. Best, Jaime.

1 0

Re: [suse-security] Nagios versus Snort
by Bruno Cochofel 09 Dec '05

09 Dec '05

Thank you all for your clarification. I was trying to run Nagios but I think there's no easy way to start... Can I have o simple configuration just for one service (like ssh) and maybe have some web admin generating all that config files so that I can have a starting point? Thanks, Bruno

3 2

Spurious SSL handshake interrupt
by Andreas Otto 08 Dec '05

08 Dec '05

Hello, I am recieving this message in the ssl_engine_log all requests that generate this entry are comming from two gateways of a client. I suspect that the gateways are not very well configured. Can someone point me to an explanation for this? Cheers, Andreas -- Seit 595219 Sekunden. Since 595219 seconds. "When the going gets tough, the tough get empirical" -- Jon Carroll

1 0