April 2005 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] unsubscrive
by Matt T. Duval 27 Apr '05

27 Apr '05

Spell check. Thank you, Matt Duval Sr. Network Engineer HealthTrans www.healthtrans.com "Transforming Healthcare, One Transaction At A Time" (720) 493-8252 6061 South Willow Drive Suite 125 Greenwood Village, CO 80111 -----Original Message----- From: Eric Lalande [mailto:eric@lalande.com] Sent: Wednesday, April 27, 2005 1:31 PM To: suse-security(a)suse.com Subject: [suse-security] unsubscrive unsubscribe >-----Original Message----- >From: Theo v. Werkhoven [mailto:twe-suse.sec@ferrets4me.xs4all.nl] >Sent: Wednesday, April 27, 2005 02:07 PM >To: suse-security(a)suse.com >Subject: Re: [suse-security] SuSEconfig and read-only proc in 9.2 > >On Sun, 24 Apr 2005, Joe made the net somewhat safer by saying: > >> On Sonntag, 24. April 2005 17:43 Theo v. Werkhoven wrote: >> > On Sat, 23 Apr 2005, Joe made the net somewhat safer by saying: >> > > On Samstag, 23. April 2005 03:38 Joe Knall wrote: >> > >> > [..] >> > >> > > > Unmounting /var/spool/postfix/proc does apparently not >> > > > affect anything. >> > > > >> > > > Is there a deeper meaning in it in the end? >> > > >> > > This question is still open. Is there anybody in the know? >> > > Thanks for your comments >> > >> > Don't enable chroot for Postfix, unless you know what you're >> > doing. >> > >> > Theo >> >> Well, that may be correct. Would you mind providing me any >> enlightning link or so to let me really make the net somewhat >> safer? > >The topic regularly comes up in the Postfix mailinglist. >There's a script in the Postfix documentation directory to setup >chroot without the special SuSE tricks. >/usr/share/doc/packages/postfix/examples/chroot-setup/LINUX2 > >> Btw, my chrooted apaches, mysql and squid all work well without a >> proc filesystem within their jails, but those are selfmade. With >> postfix I just a feature included in delivery. And that's one of >> the reasons why I still ask for the meaning behind this config of >> postfix or what ever may be behind it. > >I can't guess the reasons behind SuSE's implementation of the chroot >environment for Postfix, I do know that Postfix's author tells >people that chroot isn't an end to all security problems and it can >be more trouble than it's worth. > >Theo >-- >Theo v. Werkhoven Registered Linux user# 99872 http://counter.li.org >ICBM 52 13 26N , 4 29 47E. + ICQ: 277217131 >SUSE 9.2 + Jabber: muadib(a)jabber.xs4all.nl >Kernel 2.6.8 + See headers for PGP/GPG info. >Claimer: any email I receive will become my property. Disclaimers do not apply. > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > >

1 0

SuSEconfig and read-only proc in 9.2
by Joe Knall 27 Apr '05

27 Apr '05

Hi all, every time after yast ran suseconfig /proc is additionally mounted *read-only* as /var/spool/postfix/proc. My question is how to get rid of this feature. Yes, this may be slightly off topic here, but at least it prevents me from running online-update (yast) and iptables things (write in proc) cronbased without umounting a filesystem first - seems to be nonsense. It concerns all of my boxes running 9.2 with postfix chrooted by yast. Unmounting /var/spool/postfix/proc does apparently not affect anything. Is there a deeper meaning in it in the end? Thanks for any even deeper insight! Joe

4 8

unsubscrive
by Eric Lalande 27 Apr '05

27 Apr '05

unsubscribe >-----Original Message----- >From: Theo v. Werkhoven [mailto:twe-suse.sec@ferrets4me.xs4all.nl] >Sent: Wednesday, April 27, 2005 02:07 PM >To: suse-security(a)suse.com >Subject: Re: [suse-security] SuSEconfig and read-only proc in 9.2 > >On Sun, 24 Apr 2005, Joe made the net somewhat safer by saying: > >> On Sonntag, 24. April 2005 17:43 Theo v. Werkhoven wrote: >> > On Sat, 23 Apr 2005, Joe made the net somewhat safer by saying: >> > > On Samstag, 23. April 2005 03:38 Joe Knall wrote: >> > >> > [..] >> > >> > > > Unmounting /var/spool/postfix/proc does apparently not >> > > > affect anything. >> > > > >> > > > Is there a deeper meaning in it in the end? >> > > >> > > This question is still open. Is there anybody in the know? >> > > Thanks for your comments >> > >> > Don't enable chroot for Postfix, unless you know what you're >> > doing. >> > >> > Theo >> >> Well, that may be correct. Would you mind providing me any >> enlightning link or so to let me really make the net somewhat >> safer? > >The topic regularly comes up in the Postfix mailinglist. >There's a script in the Postfix documentation directory to setup >chroot without the special SuSE tricks. >/usr/share/doc/packages/postfix/examples/chroot-setup/LINUX2 > >> Btw, my chrooted apaches, mysql and squid all work well without a >> proc filesystem within their jails, but those are selfmade. With >> postfix I just a feature included in delivery. And that's one of >> the reasons why I still ask for the meaning behind this config of >> postfix or what ever may be behind it. > >I can't guess the reasons behind SuSE's implementation of the chroot >environment for Postfix, I do know that Postfix's author tells >people that chroot isn't an end to all security problems and it can >be more trouble than it's worth. > >Theo >-- >Theo v. Werkhoven Registered Linux user# 99872 http://counter.li.org >ICBM 52 13 26N , 4 29 47E. + ICQ: 277217131 >SUSE 9.2 + Jabber: muadib(a)jabber.xs4all.nl >Kernel 2.6.8 + See headers for PGP/GPG info. >Claimer: any email I receive will become my property. Disclaimers do not apply. > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > >

1 0

RE: [suse-security] Securely wiping external usb hard drive
by Baenen Eric P Contr AFRL/HEC 27 Apr '05

27 Apr '05

BCWipe worked perfectly! And ironically it turns out we have a site license for bcwipe - it just never dawned on me that there was a Unix/Linux version - my group has always just used the boot floppy version (which doesn't support usb drives). The rpm installed without issue under SUSE 9.2 and a simple "bcwipe -bvmd /dev/sda" - 7 passes later (probably about six hours or so) and the drive was nicely wiped. Thank you very much for the pointer. As always - list members have been most helpful. Eric Eric Baenen Program Manager - Scientific Network Environments General Dynamics - Advanced Information Systems Phone: 937-255-8180 FAX: 937-255-8845 2255 H Street (AFRL/HEC) Area B Bldg 248 Rm 108 Wright Patterson AFB, OH 45433 -----Original Message----- From: Craig Rodenberg [mailto:crodenberg@sbcglobal.net] Sent: Tuesday, April 26, 2005 10:30 AM To: suse-security(a)suse.com Cc: Baenen Eric P Contr AFRL/HEC Subject: Re: [suse-security] Securely wiping external usb hard drive Hello Eric, Jetico BCWipe will destroy data on SuSE. Heck, they even provide RPM's. http://www.jetico.com I have verified the effectiveness of BCwipe on SuSE (reiserfs and ext3), RedHat(ext3 anf JFS) and Slackware (ext2) against EnCase Enterprise edition, Forensic Tool Kit and Recovery Pro in our labs. During "whole disk" linux erasures, BCwipe performed flawlessly. If you are looking to satisfy OPSEC or COMSEC standards for wiping a Linux drive, BCwipe will meet your needs. There are other wiping programs available('srm' at sf.net comes to mind..), but so far none of them have satisfied my Security Engineers like BCwipe for destroying sensitive or controversial data. Hope that helps. Craig Rodenberg, GIAC Director, Information Security MyTek Managed Security Services www.mytek.net

1 0

Fw: [suse-security] Hard Drive Error
by Philip B Cook 27 Apr '05

27 Apr '05

> I have stripped down the machine, disconnected and reconnected the hard > drives. > I have re-installed LINUX (though not yet allowed YOU to get any updates) > using the same LVM disk partition arrangement, but re-formatted all the > partitions. > I am presently restoring the data to the LVM. > I will let you know if the problem recurs. > > If this still fails then I will switch to an alternative mobo ie change the > ide controller chip.. before finally sending the Primary Slave disk back to > the supplier (it is only 10 months old). > I have now filled the disk with data, and it is performing without problem. I will keep an eye on it for a while. Maybe the re-format helped ? One other thought, am I correct in thinking that having used an LVM I am forced to use LILO rather than GRUB. There are usually special instructions on a Kernel update that require manual intervention when using LILO. Could YOU have installed a new kernel, without the special handling for LILO ? I have previously left YOU to operate as a CRON job and auto-update each night. So far I have not allowed any ONLINE UPDATES to the system as I test it. My system is now a basic SUSE Prof 9.1 straight from the CDs, with no updates. Any thoughts? Philip

2 1

RE: [suse-security] Securely wiping external usb hard drive
by Baenen Eric P Contr AFRL/HEC 27 Apr '05

27 Apr '05

There is nothing particularly sensitive on the drive - unless you count the annual personnel reviews of my team - other than that it's just apt/rpm/deb archives and install disk iso's for several Linux distros in use here. However the US military does require secure wiping of all hard drives before transfer, turn in, etc... just in case. You never know what someone might find useful or interesting... the term used is OPSEC (Operations Security). Windoze programs like bcwipe and eraser (http://www.dirfile.com/eraser.htm) can do the job to military specs - I was just hoping to find a SUSE based solution so I don't have to track down a windoze system I can use for a while. I'm not sure if it's the drive or the laptop but so far "dd if=/dev/urandom of=/dev/sda" has been running for about 8 hours - first pass. I may just have to fall back to a windoze solution - bcwipe only takes a few hours to make 7 passes of varying patterns. This was somewhat of an evaluation/experiment - I don't think we'll be using this make/model of external drive any more. Thanks, Eric Eric Baenen Program Manager - Scientific Network Environments General Dynamics - Advanced Information Systems Phone: 937-255-8180 FAX: 937-255-8845 2255 H Street (AFRL/HEC) Area B Bldg 248 Rm 108 Wright Patterson AFB, OH 45433 -----Original Message----- From: Mike Tierney [mailto:miket@marketview.co.nz] Sent: Monday, April 25, 2005 5:35 PM To: 'Baenen Eric P Contr AFRL/HEC'; 'Suse-Security List (E-mail)' Subject: RE: [suse-security] Securely wiping external usb hard drive Given that you work for the Military, I'd recommend that you have a talk to your local IT people about what they recommend. No doubt they'd have quite stringent rules and regulations for disposing of storage devices that held sensitive information. That's if you are using this drive to transfer information between work and home! In which case I'd hope it was all encrypted as well! However if it's just your own personal hard-drive (that's never held sensitive Air Force information) then running "dd i=/dev/urandom o=/dev/sda" a few times would probably do it. Having said that, I read once that hi-tech hardware data recovery devices can still retrieve "old" information from a hard-drive from its lingering magnetic imprint even AFTER its been wiped over with new data. But those devices are probably only routinely employed by foreign governments, competitors engaging in industrial esponiage and of course data retrievel specialists :)

5 4

RE: [suse-security] Securely wiping external usb hard drive
by Jarosław Nozderko 27 Apr '05

27 Apr '05

Another 'wipe' tool: http://abaababa.ouvaton.org/wipe/ Regards, Jarek > -----Wiadomość oryginalna----- > Od: Richard Ems [mailto:suse-security@mtg-marinetechnik.de] > Wysłano: 26 kwietnia 2005 17:37 > Do: suse-security(a)suse.com > Temat: Re: [suse-security] Securely wiping external usb hard drive > > What about wipe? > > wipe-2.2.0-21 on SuSE 9.2 > > NAME > wipe - secure file deletion utility > > > SYNOPSIS > wipe > > [-ucwsiIhfFdDnNvVzZrRtTkKaA] [-B(count)] [-S(size)] > [-C(size)] [-o[size] -O] [-l[0-2]] [-x[1-32] -X] [-p(1-32)] > [-b(0-255)] [files] > > > DEFAULT > wipe -ZdntVAkO -S512 -C4096 -l1 -x8 -p1 > > > DESCRIPTION > Wipe is a secure file wiping utility. There are some low > level issues that must be taken into consideration. One of > these is that there must be some sort of write barrier > between passes. Wipe uses fdatasync(2) (or fsync(2)) as a > write barrier, or if fsync(2) isn't available, the file is > opened with the O_DSYNC or O_SYNC flag. For wipe to be effec‐ > tive, each pass must be completely written. To ensure this, > the drive must support some form of a write barrier, write > cache flush, or write cache disabling. SCSI supports ordered > command tags, has a force media access bit for commands, and > write cache can be disable on mode page 8. IDE/ATA drives > support write cache flushes and write cache disabling. Unfor‐ > tunetly, not all drives actually disable write cache when > asked to. Those drives are broken. Write caching should > always be disabled, unless your system is battery backed and > always powers down cleanly > > > -- > Richard Ems > Tel: +49 40 65803 312 > Fax: +49 40 65803 392 > Richard.Ems(a)mtg-marinetechnik.de > > MTG Marinetechnik GmbH - Wandsbeker Koenigstr. 62 - D 22041 Hamburg > > GF Dipl.-Ing. Ullrich Keil > Handelsregister: Abt. B Nr. 11 500 - Amtsgericht Hamburg Abt. 66 > USt.-IdNr.: DE 1186 70571 > > > -- > Check the headers for your unsubscription address For > additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

pppd timeout options
by Miguel ALBUQUERQUE 26 Apr '05

26 Apr '05

Hi all, I'm trying to find that obscure option in pptpd that will keep an even idle connection alive forever...any ideas ? Thanks ______________________________________________________________ «¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»«¤»¥«¤»§«¤»¥«¤» ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯ CODALIS SA www.codalis.ch 17, rue de la Fontenette, CAROUGE TEL : +41 22 827 30 30 FAX : +41 22 827 30 33 ______________________________________________________________ «¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»«¤»¥«¤»§«¤»¥«¤» ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

5 8

Securely wiping external usb hard drive
by Baenen Eric P Contr AFRL/HEC 26 Apr '05

26 Apr '05

List members, I'm running SUSE 9.2 Pro... can anyone recommend an app or technique for securely wiping the contents on an external usb hard drive with a single 120GB reiserfs partition? - unfortunately because of the case design - cracking the case and removing the drive so it can be connected directly to an IDE controller is not an option - fdisk'ing the drive, just wiping the partition table, reformating, etc. are not sufficient - I need an option that will make the drive's current contents reasonably unrecoverable - it's been suggested that I repeatedly do "dd i=/dev/urandom o=/dev/sda && dd i=/dev/zero o=/dev/sda" - and I will do this if necessary - but would rather not take the days that this is likely to take - it's also been suggested to use 'shred' - however, in the man pages for shred is says that because of the redundancies and protections built into the Reiser filesystem - that shed will not truely and securely wipe the files - there is a reasonable chance of recovery after shreddig files on Reiser Thanks, Eric Eric Baenen Program Manager - Scientific Network Environments General Dynamics - Advanced Information Systems Phone: 937-255-8180 FAX: 937-255-8845 2255 H Street (AFRL/HEC) Area B Bldg 248 Rm 108 Wright Patterson AFB, OH 45433

10 13

CUPS / LPR Access Control
by Bill Miller Jr 25 Apr '05

25 Apr '05

Hello, I am trying to find where LPR / CUPS do their access control to enable the wwwrun user to print documents. As this deals with access control I believe this is the correct place to ask this question. A little background on what I am trying to accomplish. I am designing a strictly internal web based data collection and reporting system. I have a PHP script that on certain conditions will print a file to a printer. In testing I am doing su -c 'cat testdoc | lpr -Pprinter' - normal_user which works fine and su -c 'cat testdoc | lpr -Pprinter' - wwwrun which does not work at all. Looking through cups admin at http://127.0.0.1:631/ shows all the print jobs for normal users and none of the print jobs for wwwrun. Thank You. Bill Miller jrmiller(a)cbnlottery.com

2 1