March 2005 - openSUSE Security - openSUSE Mailing Lists

install logwatch on suse 9.0
by Cristian Del Carlo 11 Mar '05

11 Mar '05

Hi list, i am trying to install logwatch 6.0.1-4 on a suse professional 9.0 but i have the following failed dependencies: perl(Exporter) perl(Getopt::Long) perl(POSIX) perl(File::Temp) perl(strict) I don't kown what rpm i must install to resolve. Yast doesn't resolve the dependencies. Thanks, Cristian Del Carlo

3 6

parsing /var/log/warn
by John 10 Mar '05

10 Mar '05

Hi to all Which is the best program for parsing, analyzing the /var/log/warn file, iptables log report ?

2 2

RE: [suse-security] Problem with second user with uid 0?
by Wilde, Martin 10 Mar '05

10 Mar '05

Hi Frank, if your rootid user is managed on a per host basis I would not expect *technical* security traps. During logon the passwd file is checked, if there is a user named "rootid", then the crypted password is taken from the shadow file and if there is a match then the userid 0 (or any other id from the passwd file) is set. AFAIK: after login all programs just test the userid (0) to find out if you have root permissions. So everything should be fine except all commands that do an id-to-username translation (like id(1) e. g.). other problems: As you are talking about "normal" users: I do not know if they *really* know what to do. So you usually need someone "trusted" that is aware of what is meant by "having root permissions" - e. g. what happens when he types "rm -rf .*" in some user directory. In case you are using NIS: Be aware that those users will have root permissions on *all* systems. Also keep in mind that this user has access to *all* files including documents from your genaral manager or the human ressources people! Be also sure, that the password for the rootid user is as strong as yours should be! Martin -----Original Message----- From: Frank Steiner [mailto:fsteiner-mail@bio.ifi.lmu.de] Sent: Thursday, March 10, 2005 10:53 AM To: SuSE Securitylist Subject: [suse-security] Problem with second user with uid 0? Hi, are there any security (or other) problems when having a second user with uid 0? We would like to mainain a user "rootid" which has uid 0 and should be used for normal users logging in as root when the admin (me) is e.g. on holidays and sth. fails and needs to be repaired. For this, we have sealed envelopes with the root passwords which some users can open to get the password (the boss wants it like that). To avoid changing "my" root password afterwards, users should get the password for "rootid" and work with that account. After my return, I would just have to change the rootid password and could still work with my normal root password. "sudo" etc. is not a real solution, because users might need to login during boot when fsck fails. And then you need a root password and no sudo etc. Are there any problem with such a setup? Of course the rootid account must be protected the same way the root account is. In a first test, I could do anything with the rootid user, but I'm not sure if there are any security traps that I don't recognize... cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: -4054 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. * -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

openvpn & suse firewall
by Antonio Montani Jimenez 08 Mar '05

08 Mar '05

ok, got a little problem. i (openvpn sevrer) directly connected to the internet, but i have a subnet under me. in order to get the tunnels workin, i have to run the script firewall.sh that comes with openvpn, and i have to knowck down the firewall (yast), but i lose connection to internet from my internal machines. if i activate the firewall (yast) then the tunnel doesnt work. anyone knows a sollution to get them both working? �Tienes alguna duda en tu VIDA? www.howstuffworks.comIf You Ask Me A Fu**in' Question You'd Better Be Prepared For The AnswerNoel GallagherOasis Frontman17/10/02 __________________________________ Celebrate Yahoo!'s 10th Birthday! Yahoo! Netrospective: 100 Moments of the Web http://birthday.yahoo.com/netrospective/

2 1

openvpn & suse firewall
by Antonio Montani Jimenez 08 Mar '05

08 Mar '05

ok, got a little problem. i (openvpn sevrer) directly connected to the internet, but i have a subnet under me. in order to get the tunnels workin, i have to run the script firewall.sh that comes with openvpn, and i have to knowck down the firewall (yast), but i lose connection to internet from my internal machines. if i activate the firewall (yast) then the tunnel doesnt work. anyone knows a sollution to get them both working? �Tienes alguna duda en tu VIDA? www.howstuffworks.comIf You Ask Me A Fu**in' Question You'd Better Be Prepared For The AnswerNoel GallagherOasis Frontman17/10/02 __________________________________ Celebrate Yahoo!'s 10th Birthday! Yahoo! Netrospective: 100 Moments of the Web http://birthday.yahoo.com/netrospective/

2 1

RE: [suse-security] Allow MAC addresses through SuSEfirewall2
by Ness, Todd 07 Mar '05

07 Mar '05

I would look at 2 factor authentication as another option. http://www.securecomputing.com/index.cfm?skey=1277 is one example of this. -----Original Message----- From: Carlos E. R. [mailto:robin1.listas@tiscali.es] Sent: Sunday, March 06, 2005 7:21 PM To: SuSE Security List Subject: RE: [suse-security] Allow MAC addresses through SuSEfirewall2 The Sunday 2005-03-06 at 14:18 -0000, Thomas Knight wrote: > > There are settings in Yast (profesional version) to force users to > > have "safer" passwords. I supposse the enterprise version has similar settings. > > > > Also, you could set up ssh to not accept login/password entry, but > > public key instead. > > I'm with you there. > What I mean is if I use username/password they'll just save the > password somewhere. You can also force them to change the passwords every two weeks :-P I remember once, while working for a certain important company (US based multinational), we were issued passwords for accessing certain machines (not exactly computers). A "boss" gave us big envelopes. Inside, there was a sealed envelope (secret and confidential) and a booklet explaining how to safely use passwords, how to choose them, how to keep them... etc. We had to sign and return a form as "read and understood". The sealed envelope contained the passwords, of course. I'm unsure now if the person that gave us the envelopes waited nearby till we returned the forms while keeping an eye on us, but I think he did... Sounds too paranoic? :-) Actually, I saw more "paranoic" measures from them a few years later on. > If they use PPK they'll "forget" to specify a passphrase for their > private key, which is out of my control. Yes, that's a thing I noticed recently. The sshd server can not force the client to use a long passphrase, I understand. > Hey, I'll log all access and they'll have limited privs. We do what we can! Yap :-) > > Ta for the thoughts, Welcome. -- Cheers, Carlos Robinson -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re[2]: [suse-security] program to analyse log files
by John 07 Mar '05

07 Mar '05

From: Rune Lynge <lists-suse-security(a)cease.dk> To: suse-security(a)suse.com Date: Monday, March 7, 2005, 1:40:13 PM Subject: [suse-security] program to analyse log files Monday, March 7, 2005, 1:40:13 PM, you wrote: > At 11:58 +0100 07/03/05, Dominik wrote: >>> <SNIP> I want to have a report with a mail every day. Wich >>> is the better tool that I can use ? >> >>I use "logwatch" (www.logwatch.org). Everyday I get mail report about my server logs. > Or you could use logdigest > <http://www.novell.com/products/linuxpackages/professional/logdigest.html> > - badly documented, but quite well working. > Find it on the 9.2 DVDs (it is also on present in 9.1 AFAIK), > spend 10 minutes setting up the ignore.local and you should be up > and running. > Rune is there any command logwatch or just the logwatch.pl ? Seems that saving the report to a file doesn't work. Does it work for you? i just run the logwatch.pl in the scripts directory and then keep the stdout to a file including the stderr. What is your method so, your configuration ?

1 0

program to analyse log files
by Cristian Del Carlo 07 Mar '05

07 Mar '05

Hi, I use suse linux 9.X professional and i am looking for a tool to analyse the logs in a server to find out informations about server activity, unauthorized access to services, status of services etc... I want to have a report with a mail every day. Wich is the better tool that I can use ? Cristian Del Carlo

3 2

Allow MAC addresses through SuSEfirewall2
by Tom Knight 06 Mar '05

06 Mar '05

Hi everyone! Using SuSE Linux Enterprise Server 8, SuSEfirewall2 A user is requesting that a number of developers have access to my server, but the IP addresses are variable across a large subnet, so allowing access to MAC address has been suggested. I want this not to interfere with the existing rules in the /etc/sysconfig/SuSEfirewall file, and I want a number of MAC addresses allowed in. I'm guessing I need to add something like: iptables -A INPUT -m mac --mac-source 12:23:34:45:56 -m tcp --dport [port] -j ACCEPT for each MAC address. Questions: 1. Is my guess at an iptables line anywhere near useful? 2. Is there anything I have to check in my kernel config? I stay with the default kernel. 3. How/where should I make this ionformation available to SuSEfirewall2? 4. Hang on - given they're on a different subnet, will this work anyway? Many thanks, Tom. -- Tom Knight System Administration Officer Arts & Humanities Data Service Web: http://www.ahds.ac.uk Email: tom.knight(a)ahds.ac.uk

4 5

webmail to install
by Cristian Del Carlo 05 Mar '05

05 Mar '05

Hi, i must install to a customer on a suse 9.1 professional a simple webmail,. The customer has a web server with apache2 and php. I know that the webmail can have security problems. Can someone suggest me a safe webmail to install ? Best regards, Cristian Del Carlo

3 2