March 2006 - openSUSE Security - openSUSE Mailing Lists

Statefull packet inspection in SuSEfirewall2
by pronco＠conae.gov.ar 25 Jul '06

25 Jul '06

Hi, Is it there any way to configure stateful packet inspection rules in SuSEfirewall2 for masquerade networks? When I configure a rule in FW_MASQ_NETS in order to allow traffic from the outside to the DMZ, I also have to configure a rule for responses. Example: Incoming traffic to my web server in a DMZ with private addresses FW_FORWARD_MASQ="0/0,192.168.1.5,tcp,80 I also need to set up the following rules in order to let responses out FW_MASQ_NETS="192.168.1.5/32,0/0,tcp,1024:65535" This rule permits not only established sessions, but additionally it allows my web server to establish connections to the outside world. Dont know why the FW_FORWARD rules are stateful as I want, but FW_MASQ_NETS ones dont. Any suggestion? Is it possible to math the SYN, ACK and FIN TCP bits with SuSEfirewall2? Thanks in advance. Pablo Ronco

4 5

sendmail update for suse 9.0 ?
by iS-Fun Internet Services GmbH, Holger Diehm 04 Apr '06

04 Apr '06

Hi anyone in the list, I wonder if anyone knows a repository that still makes updates for suse 9.0 or even earlier available? For other distros there are som "addicts" that share their update-efforts with others für no longer officially supported Versions. Due to the severity of the latest sendmail race-condition problem I'd like to update my older mail servers but i really want to avoid a complete distrie-update just for sendmail. Has anyone a clue für such non-vendor-update-sites? Or does a person at novell/suse perhaps still provide some packages on some site ? Or would a package for SLES8 match with glibc of suse 9.0 (I tried the ackages of 9.1 but they don't fit)? any help is welcome. Thanks, Holger

15 31

dns-Spoofing and ssh?
by Moskito 03 Apr '06

03 Apr '06

Hello List, the manpage of ssh_config describes the option CheckHostIP which is enabled by default. The description tells, that this option can protect from dns-spoofing attacks. I just wondered how a dns-spoofing attack to ssh could work in general? if i ssh to a machine: ssh host1 the ssh client will resolve the ip of host (could be dns, depends on resolv.conf), connects to the host and checks the hostkey of host1 against /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts. If someone manages to give me a wrong ip for host1 and i connect to this fakehost ssh should complain about the wrong hostkey... Why do i need some kind of extra dns-spoofing protection? regards Frank

3 2

Moving from OLD Portal to New Portal.
by Boyd Lynn Gerber 31 Mar '06

31 Mar '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I just noticed that I needed to mirgrate all my infromation (from the suse security announce list. How does one find old protal names to migrate. Saddly all my Novell information and SuSE information is gone on the new portal. This is very frustrating. I had licences/registration from the very first. I did notice last year that portal.suse.com remove all licences and such from prior to 8.2 and the novell data base only showed 4.2 on IIRC. No problem as they were not suppored any more. But I would like to get all my Novell and SUSE stuff on the new portal back and uptodate. What is the proper procedure to get this done. I am using this list as it where I think follow ups to the suse security announce list are to be directed. Thanks, - -- Boyd Gerber <gerberb(a)zenez.com> ZENEZ 1042 East Fort Union #135, Midvale Utah 84047 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: For info see http://quantumlab.net/pine_privacy_guard/ iD8DBQFELXHsVtBjDid73eYRAvt3AJ4/EGyH9ptRcMG8cPGmFwRbOPpVHACcCkko qBYhgXq3bGvxhoajVSMRlIs= =fpoG -----END PGP SIGNATURE-----

1 0

Re: [suse-security] Turning off susewatcher
by GarUlbricht7＠netscape.net 30 Mar '06

30 Mar '06

Lee Brotzman <lee(a)brotzman.com> wrote on Tue, 28 Mar 2006 10:04:00 AM EST: > > Marcus Meissner wrote: >> On Tue, Mar 28, 2006 at 08:22:34AM -0500, Lee Brotzman wrote: >>> Hi, >>> >>> How to I make it so that susewatcher does not start when I log in? >>> I've unselected the box in the dialog that says "Start automatically", >>> yet it still starts up at login. >>> >>> It's irritating because it keeps telling me >>> that security updates are available ... (snip) >>> [....] > Hurumph. Now susewatcher is claiming there are no new updates > and the Show Last Log" button is grayed out. [....] > ---<Text trimmed>--- Hi, Carlos gave a way to turn susewatcher off, and it sounds like that will solve your problem. I ran into a similar problem as you reported. However, I have noticed that if I do # SuSEconfig --verbose and # rpm --rebuilddb after I have downloaded using YaST whatever whatever it tells me I need to update, (even if I have updated using fou4s, and if nothing is shown I still do "accept" and "close" after marking "taboo" the rpms I don't want to update (eg "kernel"); susewatcher is happy and doesn't falsely tell me that security updates are available. YMMV. Gar -- __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

2 1

Turning off susewatcher
by Lee Brotzman 28 Mar '06

28 Mar '06

Hi, How to I make it so that susewatcher does not start when I log in? I've unselected the box in the dialog that says "Start automatically", yet it still starts up at login. It's irritating because it keeps telling me that security updates are available even though I've installed them all. It would be nice if it came with any documentation, but that doesn't appear to be so, and I don't have a use for susewatcher in any case. By the way I use gnome, not kde. Thanks, Lee Brotzman -- Lee E. Brotzman, CISSP -- NASA Incident Response Center

4 6

backup solution
by Andy 28 Mar '06

28 Mar '06

Hi to all, I know it is not security related topic, but I don't want to subscribe to another thread. I want to ask for a backup tool for suse 10. For the configuration files and mailserver I am using rsync to backup the files. How can I backup the user list and passwords... and recover them easy in case of disaster?? Andy.

4 4

password history
by discip＠pjm.com 27 Mar '06

27 Mar '06

I have a requirement to keep users from reusing old passwords, specifically, they must not choose a password that has been used within the past 10 passwords they have chosen. Is there an easy way to accomplish this? Thanks, Paul

5 4

Sendmail update for 7.3 ?
by Uwe 26 Mar '06

26 Mar '06

Hi, i know it´s a terrible old version but runs fine for some reasons so is there an sendmail update for Suse7.3 ? Thanks Uwe

2 1

PAM: su to non-root accounts
by discip＠pjm.com 24 Mar '06

24 Mar '06

Hi, I am trying to set up my system to restrict su access to specific accounts to members of groups that correlate. For example, only members of root_members can su to root; only members of web_members can su to user web, etc. The most popular way of doing this in Linux seems to be to set up /etc/pam.d/su with something like the following: auth sufficient /lib/security/pam_stack.so service=root-members auth sufficient /lib/security/pam_stack.so service=web-members auth required /lib/security/pam_deny.so The /etc/pam.d/root-members and /etc/pam.d/web-members would then look like this: # root-members auth required /lib/security/pam_wheel.so use_uid group=root_members auth required /lib/security/pam_listfile.so item=user sense=allow onerr=fail file=/etc/membergroups/root # web-members auth required /lib/security/pam_wheel.so use_uid group=web_members auth required /lib/security/pam_listfile.so item=user sense=allow onerr=fail file=/etc/membergroups/web And /etc/membergroups/web and /etc/membergroups/root contain just the username "web" and "root" respectively. Thus, in order to use the su command you must be in a group that can su to a user, and you must be trying to su to the correct user associated with that group. If those conditions are met, then these are sufficient for authentication. My question is this: SuSE Linux does not have the pam_stack.so module. Is there a "workalike" module I could use? Or in the absence of that, does anyone have any suggestions as to how I might accomplish the same thing in a different fashion. Thanks, Paul

2 1