April 2006 - openSUSE Security - openSUSE Mailing Lists

Statefull packet inspection in SuSEfirewall2
by pronco＠conae.gov.ar 25 Jul '06

25 Jul '06

Hi, Is it there any way to configure stateful packet inspection rules in SuSEfirewall2 for masquerade networks? When I configure a rule in FW_MASQ_NETS in order to allow traffic from the outside to the DMZ, I also have to configure a rule for responses. Example: Incoming traffic to my web server in a DMZ with private addresses FW_FORWARD_MASQ="0/0,192.168.1.5,tcp,80 I also need to set up the following rules in order to let responses out FW_MASQ_NETS="192.168.1.5/32,0/0,tcp,1024:65535" This rule permits not only established sessions, but additionally it allows my web server to establish connections to the outside world. Dont know why the FW_FORWARD rules are stateful as I want, but FW_MASQ_NETS ones dont. Any suggestion? Is it possible to math the SYN, ACK and FIN TCP bits with SuSEfirewall2? Thanks in advance. Pablo Ronco

4 5

AppArmor in SUSE 10.0
by Malte Gell 08 May '06

08 May '06

Hello, if I understood it correctly the AppArmor version 1.2 of SUSE 10.0 does not allow to create new profiles with the Add Profile Wizard. But when I played with it I found out the command line tool "genprof" actually does allow to generate a new profile and genprof is nothing else than the Yast Wizard, is this right? So I actually can add a new profile using genprof, but just not using the Yast Wizard? BTW, are there Novell/OpenSUSE sites that offer new profiles for download? Thanks Malte

5 10

SuSE 10.0 yast2 vpn module seg faults when importing certs - manual, config?
by Michael Reilly 28 Apr '06

28 Apr '06

I am new to SuSE so if the answers to these questions are well known please point me to the appropriate resource. I have searched but not found anything relevant (maybe I used the wrong search terms). I am attempting to configure my laptop running SuSE 10.0 to setup an IPSec tunnel to my office router (a Cisco) so that I am able to access servers behind the router. I selected the vpn module in yast and imported my key. Then I tried to import the CA certificate in pem format. When I double click on the certificate filename in the dialog box the entire VPN config window goes away. The yast control center window remains. I ran the ipsec module from the command line and this is what I see when the windows disappears - Host:/etc/ipsec/certificates # /sbin/yast2 ipsec Segmentation fault at ipsec/complex.ycp:509 /sbin/yast2: line 209: 22020 Segmentation fault $ybindir/y2base $module "$@ " qt -geometry "$Y2_GEOMETRY" $Y2QT_ARGS Is this a known problem? The certificates were provided by our CA - I manually generated a CSR using openssl and enrolled with our CA. I now have my private key, laptop certificate and CA certificate all in pem format. As an alternative is there a HowTo or similar document to allow me to manually configure openswan to use X.509 certificates and to be able to access the servers at the office? Thanks, michael -- ---- ---- ---- Michael Reilly michaelr(a)cisco.com Cisco Systems, California

1 0

VPN and SuSEfirewall2
by Jonathan Baxter 28 Apr '06

28 Apr '06

Please excuse me if this is not the correct forum for VPN and firewall issues on SuSE. I am trying to setup an ipsec VPN between two private subnets, and I have run into a snag that I cannot resolve. The VPN establishes itself fine, and I can connect from any machine on the right subnet to any machine on the left subnet, but not vice versa. Here's the setup: 192.168.1.0/24===a.a.a.a---b.b.b.b...c.c.c.c---d.d.d.d===192.168.200.0/24 "a.a.a.a" is the external interface of a SuSE 10.0 box which masquerades machines on the internal 192.168.1.0/24 subnet. "b.b.b.b" is its nexthop router. "d.d.d.d" is the external interface of my home linksys AG241 DSL router. "c.c.c.c" is its nexthop router (at the ISP). I have an ipsec, pre-shared key tunnel from a.a.a.a to d.d.d.d. The SuSE box is running it with OpenSwan, the linksys router is just set up via the normal linksys configuration (which may well be OpenSwan under the hood). Everything works fine from right-to-left - ie all machines on the 192.168.200.0 subnet behind the linksys router can see all machines on the 192.168.1.0 subnet behind the SuSE box. But nothing works from left-to right; neither the SuSE router box itself, nor from any machines on the 192.168.1.0 subnet behind it can see any machines on the 192.168.200.0 subnet at the other end of the tunnel. This seems to me like it must be a routing problem, but I can't for the life of me work out how to fix it. I am running SuSEfirewall2 on the SuSE router. I have explicitly enabled forwarding between the two subnets by setting FW_FORWARD in /etc/sysconfig/SuSEfirewall2: FW_FORWARD="192.168.1.0/24,192.168.200.0/24,,,ipsec \ 192.168.200.0/24,192.168.1.0/24,,,ipsec" I have explicitly disabled NAT of packets between the two subnets by adding the following line to the fw_custom_before_port_handling() section of /etc/sysconfig/scripts/SuSEfirewall2-custom: iptables -t nat -A POSTROUTING -o eth2 -s 192.168.1.0/24 -d \! 192.168.200.0/24 -j MASQUERADE the tunnel config in /etc/ipsec.conf looks like: conn net-to-net # Key exchange method authby=secret # Left security gateway, subnet behind it, nexthop toward right. left=a.a.a.a leftsubnet=192.168.1.0/24 leftnexthop=b.b.b.b # Right security gateway, subnet behind it, nexthop toward left. right=d.d.d.d rightsubnet=192.168.200.0/24 rightnexthop=c.c.c.c auto=start Any suggestions? Thanks, Jonathan Baxter

3 7

[Fwd: Re: [suse-security] VPN and SuSEfirewall2]
by Carsten Voigt 27 Apr '06

27 Apr '06

Jonathan, if you ping one interface of a host you can surely reach by another, you might get an answer, even if the host adressed even does not forward anything. You just do really know routers are routing, if something behind router A is reaching something behind router B. -- Kind regards i.A. Carsten Voigt bios ag (hrb-hh 73193) brauhausstieg 15-17 d-22041 hamburg fon +49 40 689 439 0 fax +49 40 689 439 39 cvo(a)bios.de www.bios.de aufsichtsratsvorsitzender: wolfgang borchert vorstand: ulrich kalthoff, heinrich zwiebelmann -------- Original-Nachricht -------- Betreff: Re: [suse-security] VPN and SuSEfirewall2 Datum: Thu, 27 Apr 2006 18:28:57 +0930 Von: Jonathan Baxter <jbaxter(a)panscient.com> An: suse-security(a)suse.com Referenzen: <200604271536.13792.jbaxter(a)panscient.com> <20060427071254.GA16610(a)suse.de> On Thursday 27 April 2006 16:42, Ludwig Nussel wrote: > Jonathan Baxter wrote: > > [...] > > But nothing works from left-to right; neither the SuSE router box > > itself, nor > > The router itself cannot reach the subnet on the other side if you > use it's external IP as source. You'd need a second tunnel for that. I think I understand what you're getting at. If the external IP address is the source address the packets won't get redirected down the tunnel, because the tunnel's source is the internal network. Reproducing the network diagram: 192.168.1.0/24===a.a.a.a---b.b.b.b...c.c.c.c---d.d.d.d===192.168.200.0/24 "a.a.a.a" is the external interface of the problematic SuSE box, 192.168.1.1 is its internal interface. d.d.d.d is the external interface of the linksys router, 192.168.200.1 is the internal interface. With tcpdump on the SuSE router, I see the following when pinging from right to left (192.168.200.2 -> 192.168.1.2): IP 192.168.200.2 > 192.168.1.2: ICMP echo request, id 51223, seq 18, length 64 IP 192.168.200.2 > 192.168.1.2: ICMP echo request, id 51223, seq 18, length 64 IP a.a.a.a > b.b.b.b: ESP(spi=xxx,seq=0x15), length 116 So that works fine (I don't know why there are two decoded lines per ping, but at least it seems correct: ESP packet between the external addresses decoded to the ICMP packet between the internal addresses). However, if I ping the other way (192.168.1.2 -> 192.168.200.2), tcpdump on the SuSE router shows: IP a.a.a.a > 192.168.200.2: ICMP echo request, id 25444, seq 18, length 64 No "ESP" packet. Since the source address is rewritten as "a.a.a.a", does that means the packets from 192.168.1.2 are being masqueraded, which per Ludwig's comment above means they are not being directed down the tunnel? If so, I guess my iptables directive in /etc/sysconfig/scripts/SuSEfirewall2-custom is not working: > > I have explicitly disabled NAT of packets between the two subnets by > > adding the following line to the fw_custom_before_port_handling() section > > of /etc/sysconfig/scripts/SuSEfirewall2-custom: > > > > iptables -t nat -A POSTROUTING -o eth2 -s 192.168.1.0/24 -d \! > > 192.168.200.0/24 -j MASQUERADE > But if I do as Ludwig suggests and set FW_MASQ_NETS="0/0,!192.168.200.0/24" in /etc/sysconfig/SuSEfirewall2 then the firewall drops the packets from 192.168.1.2 altogether - they never make it to the external interface on the SuSE router at all. I get the following in /var/log/firewall: SFW2-FWDint-DROP-DEFLT IN=eth1 OUT=eth2 SRC=192.168.1.2 DST=192.168.200.2 So I guess the left->right packets are not making it down the tunnel, but I am still confused as to why not..... - Jonathan -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

[Fwd: [suse-security] VPN and SuSEfirewall2]
by Carsten Voigt 27 Apr '06

27 Apr '06

Hi Jonathan, I am not absolutely sure, how to interpret your "A can see B". But it sounds like "Ping from A to B is answered" or "A can see B's samba shares"? In that case to me your problem seems to be at the "linksys"-side. It is a stadard-behaviour of some firewalls, to let everything out of but only authorized things into the local network. Some firewalls provide opportunities, to filter VPN-traffic like that, too. Can it be, the linksys device does have filters, which keep the Linux-side from adressing services needed to "see" things behind the linksys? It is a standard-behaviour of NAT-Routers to translate non-reserved ports proxy-vise (to the internet only the outside interfaces IP of the router is visible). But all services of internal Servers have to be translated from local host IP and Port to Router's outside Interface's IP and Port. Do your really have evidence, your connection "A to B" is going through the IPSec-tunnel? Other possible problems might be, that the Linux-Router-Side can not resolve names or access directory services at the linksys side. If you say "B does not see A" - do you mean, it does not find it by name or by IP? -- Kind Regards i.A. Carsten Voigt bios ag (hrb-hh 73193) brauhausstieg 15-17 d-22041 hamburg fon +49 40 689 439 0 fax +49 40 689 439 39 cvo(a)bios.de www.bios.de aufsichtsratsvorsitzender: wolfgang borchert vorstand: ulrich kalthoff, heinrich zwiebelmann -------- Original-Nachricht -------- Betreff: [suse-security] VPN and SuSEfirewall2 Datum: Thu, 27 Apr 2006 15:36:13 +0930 Von: Jonathan Baxter <jbaxter(a)panscient.com> An: suse-security(a)suse.com Please excuse me if this is not the correct forum for VPN and firewall issues on SuSE. I am trying to setup an ipsec VPN between two private subnets, and I have run into a snag that I cannot resolve. The VPN establishes itself fine, and I can connect from any machine on the right subnet to any machine on the left subnet, but not vice versa. Here's the setup: 192.168.1.0/24===a.a.a.a---b.b.b.b...c.c.c.c---d.d.d.d===192.168.200.0/24 "a.a.a.a" is the external interface of a SuSE 10.0 box which masquerades machines on the internal 192.168.1.0/24 subnet. "b.b.b.b" is its nexthop router. "d.d.d.d" is the external interface of my home linksys AG241 DSL router. "c.c.c.c" is its nexthop router (at the ISP). I have an ipsec, pre-shared key tunnel from a.a.a.a to d.d.d.d. The SuSE box is running it with OpenSwan, the linksys router is just set up via the normal linksys configuration (which may well be OpenSwan under the hood). Everything works fine from right-to-left - ie all machines on the 192.168.200.0 subnet behind the linksys router can see all machines on the 192.168.1.0 subnet behind the SuSE box. But nothing works from left-to right; neither the SuSE router box itself, nor from any machines on the 192.168.1.0 subnet behind it can see any machines on the 192.168.200.0 subnet at the other end of the tunnel. This seems to me like it must be a routing problem, but I can't for the life of me work out how to fix it. I am running SuSEfirewall2 on the SuSE router. I have explicitly enabled forwarding between the two subnets by setting FW_FORWARD in /etc/sysconfig/SuSEfirewall2: FW_FORWARD="192.168.1.0/24,192.168.200.0/24,,,ipsec \ 192.168.200.0/24,192.168.1.0/24,,,ipsec" I have explicitly disabled NAT of packets between the two subnets by adding the following line to the fw_custom_before_port_handling() section of /etc/sysconfig/scripts/SuSEfirewall2-custom: iptables -t nat -A POSTROUTING -o eth2 -s 192.168.1.0/24 -d \! 192.168.200.0/24 -j MASQUERADE the tunnel config in /etc/ipsec.conf looks like: conn net-to-net # Key exchange method authby=secret # Left security gateway, subnet behind it, nexthop toward right. left=a.a.a.a leftsubnet=192.168.1.0/24 leftnexthop=b.b.b.b # Right security gateway, subnet behind it, nexthop toward left. right=d.d.d.d rightsubnet=192.168.200.0/24 rightnexthop=c.c.c.c auto=start Any suggestions? Thanks, Jonathan Baxter -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] VPN and SuSEfirewall2
by Thorsten Hahn 27 Apr '06

27 Apr '06

Hi Jonathan, perhaps it will be a good start to enable some debugging and look at the logs - on both sides. Maybe the packets are lost in your SuSE-Box, but I think not, you wouldn't be able to reach 192.168.1.0 from 192.168.200.0 if routing is the problem. Did you check MTU sizes? Perhaps (I don't know b.b.b.b) a.a.a.a sends packets to large and they reach the Linksys fragmented and are dropped (is ping allowed and does it work?) Can you give some more input? Sincerly, Thorsten Hahn

1 0

MozillaFirefox 1.0.8 update for SUSE 10.0
by Malte Gell 23 Apr '06

23 Apr '06

Hi there, just installed MozillaFirefox-1.0.8-0.2.i586.rpm and during the process I got "su: user /dev/null does not exist" Of course /dev/null does exist, a minor bug in a script somehwere? Nevertheless the rpm can be installed. Malte

3 6

load script at boot
by Walter Pabon Guerra 23 Apr '06

23 Apr '06

hi, i need load a script to start suse, how i do ?.... -- Atte. <<_waltico_>> Walter Pabon Guerra "Don't worry, Be Linux..." http://www.utpinux.org http://waltico.utpinux.org http://www.jawservices.net

5 4

Firewall denying outgoing connections?
by Carlos E. R. 14 Apr '06

14 Apr '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 What causes this error in the firewall? Apr 14 17:03:37 nimrodel kernel: SFW2-OUT-ERROR IN= OUT=eth0 SRC=192.168.1.12 DST=85.85.72.60 LEN=40 TOS=0x08 PREC=0x00 TTL=64 ID=53126 DF PROTO=TCP SPT=6881 DPT=4712 WINDOW=32767 RES=0x00 ACK URGP=0 Apr 14 17:03:57 nimrodel kernel: SFW2-OUT-ERROR IN= OUT=eth0 SRC=192.168.1.12 DST=85.85.72.60 LEN=40 TOS=0x08 PREC=0x00 TTL=64 ID=53548 DF PROTO=TCP SPT=6881 DPT=4712 WINDOW=32767 RES=0x00 ACK URGP=0 Apr 14 17:04:17 nimrodel kernel: SFW2-OUT-ERROR IN= OUT=eth0 SRC=192.168.1.12 DST=85.85.72.60 LEN=40 TOS=0x08 PREC=0x00 TTL=64 ID=53840 DF PROTO=TCP SPT=6881 DPT=4712 WINDOW=32767 RES=0x00 ACK URGP=0 Apr 14 17:04:37 nimrodel kernel: SFW2-OUT-ERROR IN= OUT=eth0 SRC=192.168.1.12 DST=85.85.72.60 LEN=40 TOS=0x08 PREC=0x00 TTL=64 ID=54228 DF PROTO=TCP SPT=6881 DPT=4712 WINDOW=32767 RES=0x00 ACK URGP=0 Why am I denied outgoing access to some ports now and then? These seem to be triggered by bttorrent downloading the RC1, but I also get some to port 80. At the moment, dozens like the log entry above. port 6881 is allowed entry in the config: FW_SERVICES_EXT_TCP="6881:6889" - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFEP7qbtTMYHG2NR9URAhFtAJ48MvbrCMKjutgoJ9gHCeUs8ElONwCfTrGj i4PJS6b+KLMEChJSXp2KmSg= =RrDm -----END PGP SIGNATURE-----

3 4

RE: [suse-security] unsubscribe to the mailling list
by Phil Betts 11 Apr '06

11 Apr '06

Roman Drahtmueller wrote on Tuesday, April 11, 2006 12:52 AM:: >> hi: >> >> I like to unsubscrib the the suse mailing list. How can I do it ? >> > > You look at the footers of all the mails and find out. > I cringe whenever I see this type of query (particularly when the message itself is distributed with the requested information), however the very next thread did NOT contain the info. Any idea why? Looking back through my archive, this happens quite a lot. Many of the messages without the info appended were PGP signed, or had other attachments, but there are others that just seem to slip through unmolested. Is there an X-Teflon header? If so, (obviously not called that!) it could prove useful for avoiding the sort of pseudo-legal rubbish that my employer appends to my mail. Phil -- Anything below this is gibberish, anything above may be also. ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the H.E Information Systems Ltd. Tel: 0161 866 9066 Web: www.heis.co.uk This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.clearswift.com **********************************************************************

1 0

Patch information retrieval failed
by Miguel ALBUQUERQUE 11 Apr '06

11 Apr '06

Hello guys, I got this error when manually updating a system : ERROR(You:Error parsing patch description.) Error parsing 'Deltas' attribute. Line ' xorg-x11-server-6.8.2-100_100.4.i586.delta.rpm 245406 3ad5216c49cc61665280daa091d520e8 xorg-x11-server-6.8.2-100 1126567701 3e051563544c6ffdf167c19a999566c4' doesn't have form 'filename size md5sum name-edition-release buildtime srcmd5sum seq'. Is that me or the patch description is corrupted ? Many thanks Miguel Albuquerque Network Administrator CODaLIS SA Chemin de Trèfle-Blanc 18 1228 Plan-Les-Ouates / CH TEL : +41 22 827 30 80 FAX : +41 22 827 30 33 http://www.codalis.ch DISCLAIMER - This message is intended for the use of the named person only. The information contained in this E-mail is confidential and any disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly prohibited. This message does not represent a formal commitment by Codalis SA. Codalis SA is neither liable for the proper and complete transmission of the information contained in this communication nor for any delay in its receipt.

2 1

Unverifiable GPG Signatures
by Bernie Hoefer 10 Apr '06

10 Apr '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Java2 and Java2-JRE 1.4.2-129.23 packages that were uploaded to the SuSE FTP site on March 28th don't have the same version of GPG signatures as previous Java2 packages. Thus, they cannot be verified. (Or at least I do not know how to verify them.) For example, on one of the packages that was released 2005-12-20: === > $ rpm --checksig ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/java2-1.4.2-129.19.i58… > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/java2-1.4.2-129.19.i58…: sha1 md5 gpg OK === I can verify the GPG signature. But on one of the packages that was released 2006-03-28: === > $ rpm --checksig ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/java2-1.4.2-129.23.i58… > only V3 or V4 signatures can be verified, skipping V0 signature > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/java2-1.4.2-129.23.i58…: sha1 md5 OK === - -- Bernie Hoefer PGP e-mail is welcome! Get my 1024 bit signature key from: <http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x446A6F93>. "The more I know, the more I realize how much I do not understand." -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQFENpJbckGmqURqb5MRAlVaAJ4le5jc5HWhXWxkHKBQAz3iMxizOACeK2ra yGkOg+nUFCTQLrgqe7kCILE= =bnjS -----END PGP SIGNATURE-----

5 5

SPAM:
by Bojahra, Uwe 05 Apr '06

05 Apr '06

1 0

Problem with "kaffeine-52821"
by Armin Schoech 05 Apr '06

05 Apr '06

Hi, there is an error in the patch file "kaffeine-52821" from "March 30 09:00" in the name of the delta package. WRONG: Deltas: kaffeine-0.5-10_10.2.i586.hurwitz_suse_de_1111592786.delta.rpm 47211 71e98b6b08e2f48c50ea2cca57bda6f3 kaffeine-0.5-10 1111592786 a49a94349af970d37250937fc1efbe6c kaffeine-0.5-10-58da41c73c1a0f4300d0c703475623edf920 RIGHT: Deltas: kaffeine-0.5-10_10.2.i586.delta.rpm 47211 71e98b6b08e2f48c50ea2cca57bda6f3 kaffeine-0.5-10 1111592786 a49a94349af970d37250937fc1efbe6c kaffeine-0.5-10-58da41c73c1a0f4300d0c703475623edf920 Could someone from SuSE please clean up this patch file. This would be great. Or is this a problem of "fou4s" only and YOU figures out the correct filename ? Thanks for your help! Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50

2 1

sendmail update for suse 9.0 ?
by iS-Fun Internet Services GmbH, Holger Diehm 04 Apr '06

04 Apr '06

Hi anyone in the list, I wonder if anyone knows a repository that still makes updates for suse 9.0 or even earlier available? For other distros there are som "addicts" that share their update-efforts with others für no longer officially supported Versions. Due to the severity of the latest sendmail race-condition problem I'd like to update my older mail servers but i really want to avoid a complete distrie-update just for sendmail. Has anyone a clue für such non-vendor-update-sites? Or does a person at novell/suse perhaps still provide some packages on some site ? Or would a package for SLES8 match with glibc of suse 9.0 (I tried the ackages of 9.1 but they don't fit)? any help is welcome. Thanks, Holger

15 31

[Fwd: Re: [suse-security] sendmail update for suse 9.0 ?]
by Chuck Linsley 04 Apr '06

04 Apr '06

Rainer Duffner wrote: > Crispin Cowan wrote: >> miguel gmail wrote: >> >>>> Therefore it is basically not possible for SUSE to distribute Qmail. >>>> At >>>> most we could bundle the source code and give you instructions on how >>>> to >>>> compile it. >>>> >>>> >>> Oh! That would be more than wellcome for newcommers to mail servers >>> administrators... :-) # ./configure; make; make install worked for me. :-) Of course, configuration is another matter. > creates less headaches) - but what I really miss are RPMs (or > .spec-files) for djbdns (and daemontools and ucspi-tcp). > DJB's DNS-cache is one of those things that I end up installing on all > hosts that need to do more than a handful of lookups - and it can boost > performance several orders of magnitude compared to using a non-local > DNS-resolver. I installed daemontools, but not (yet) djbdns nor ucspi-tcp. But my server will typically not need to do more than a handful of lookups. Actually, at least for now, most/all of my outgoing mail is routed through my ISP's SMPT server. I am using qmail mostly for incoming mail. > So, as binaries are not allowed for all DJB-ware and the default install > is really horrible, I'd appreciate if some kind of "clean" .spec file, > that helps installing it in a SuSE-compliant way, was available. > Because it does offer significant value ;-) What is horrible about the default install? You and others mention that it needs a lot of patching to give it basic functionality? I used the default install, and it *seems* to be working for me. However, I am not stressing it much (and probably never will; it will be the server for my family and my wife's small business -- perhaps a few dozen outbound messages a day, a once-a-month mass mailing to a list of 100 or so subscribers, and maybe a hundred or so incoming messages a day). I have not figured out how to hook it up to SpamAssasin, but I have not put much effort in to it yet -- almost nobody knows about the addresses handled by my server, so it is not getting spammed (yet). I'm concerned about security issues in the default install. I'm less concerned about performance issues, since it is not going to be processing much mail. -- Chuck Linsley linsley(a)sonic.net

1 1

ezmlm warning
by suse＠karsites.net 04 Apr '06

04 Apr '06

Are other people on the list getting these warnings from ezmlm, or is it just me? Or is someone spamming the list? Regards Keith ---------- Forwarded message ---------- Return-Path: <suse-security-return-warn-1144005131.nlibmageogeagcdobghp-suse=karsites.net @suse.com> X-Original-To: keith@localhost Delivered-To: keith(a)localhost.karsites.net Received: from localhost (localhost [127.0.0.1]) by karsites.net (Postfix) with ESMTP id 0C5D8E55B8 for <keith@localhost>; Sun, 2 Apr 2006 20:06:28 +0100 (BST) X-Original-To: karsites(a)kar.eclipse.co.uk Delivered-To: karsites(a)kar.eclipse.co.uk Received: from mail.eclipse.co.uk [82.153.251.6] by localhost with IMAP (fetchmail-6.2.5) for keith@localhost (single-drop); Sun, 02 Apr 2006 20:06:29 +0100 (BST) Received: from MXA05.ch.as12513.net (mxa05.ch.as12513.net [82.153.252.56]) by mda03.ch.as12513.net (Postfix) with ESMTP id 1A8D6F3A24 for <karsites(a)kar.eclipse.co.uk>; Sun, 2 Apr 2006 20:12:21 +0100 (BST) Received: from localhost (localhost [127.0.0.1]) by MXA05.ch.as12513.net (Postfix) with ESMTP id F375EC046B for <karsites(a)kar.eclipse.co.uk>; Sun, 2 Apr 2006 20:12:21 +0100 (BST) Received: from MXA05.ch.as12513.net ([127.0.0.1]) by localhost (MXA05.ch.as12513.net [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 05716-01-93 for <karsites(a)kar.eclipse.co.uk>; Sun, 2 Apr 2006 20:12:20 +0100 (BST) Received: from fwd01.ch.as12513.net (fwd01.ch.as12513.net [82.153.252.42]) by MXA05.ch.as12513.net (Postfix) with ESMTP id E4A99C011A for <karsites(a)kar.eclipse.co.uk>; Sun, 2 Apr 2006 20:12:20 +0100 (BST) Received: from mxa04.ch.as12513.net (mxa04.ch.as12513.net [82.153.252.45]) by fwd01.ch.as12513.net (Postfix) with ESMTP id A0C94F3A1D for <suse(a)karsites.net>; Sun, 2 Apr 2006 20:12:19 +0100 (BST) Received: from lists.suse.com (lists.suse.de [195.135.221.131]) by mxa04.ch.as12513.net (Postfix) with SMTP id 7E255C043E for <suse(a)karsites.net>; Sun, 2 Apr 2006 20:12:20 +0100 (BST) Received: (qmail 12207 invoked by alias); 2 Apr 2006 19:12:15 -0000 Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm Date: 2 Apr 2006 19:12:15 -0000 Message-ID: <1144005135.12148.ezmlm-warn(a)suse.com> From: suse-security-help(a)suse.com To: suse(a)karsites.net Content-type: text/plain; charset=us-ascii Subject: ezmlm warning X-Virus-Scanned: by Eclipse VIRUSshield at eclipse.net.uk X-Spam-Status: No, hits=0.124 tagged_above=0.1 required=0.3 tests=NO_REAL_NAME X-Spam-Level: Hi! This is the ezmlm program. I'm managing the suse-security(a)suse.com mailing list. I'm working for my owner, who can be reached at suse-security-owner(a)suse.com. Messages to you from the suse-security mailing list seem to have been bouncing. I've attached a copy of the first bounce message I received. If this message bounces too, I will send you a probe. If the probe bounces, I will remove your address from the suse-security mailing list, without further notice. I've kept a list of which messages from the suse-security mailing list have bounced from your address. Copies of these messages may be in the archive. To retrieve a set of messages 123-145 (a maximum of 100 per request), send an empty message to: <suse-security-get.123_145(a)suse.com> To receive a subject and author list for the last 100 or so messages, send an empty message to: <suse-security-index(a)suse.com> Here are the message numbers: 26706 --- Enclosed is a copy of the bounce message I received. Return-Path: <> Received: (qmail 19586 invoked from network); 22 Mar 2006 03:57:26 -0000 Received: from unknown (HELO Relay1.suse.de) (195.135.221.8) by 0 with SMTP; 22 Mar 2006 03:57:26 -0000 Received: from Relay1.suse.de (localhost [127.0.0.1]) by Relay1.suse.de (Postfix) with ESMTP id C0D826FC83 for <suse-security-return-26706-suse=karsites.net(a)lists.suse.com>; Wed, 22 Mar 2006 04:57:26 +0100 (CET) Received: from Relay1.suse.de ([127.0.0.1]) by Relay1.suse.de (Relay1 [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 27618-04 for <suse-security-return-26706-suse=karsites.net(a)lists.suse.com>; Wed, 22 Mar 2006 04:57:26 +0100 (CET) Received: from mx2.suse.de (cantor2.suse.de [195.135.220.15]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by Relay1.suse.de (Postfix) with ESMTP id 668BB6BEA2 for <suse-security-return-26706-suse=karsites.net(a)lists.suse.com>; Wed, 22 Mar 2006 04:57:26 +0100 (CET) Received: from mxa02.ch.as12513.net (mxa02.ch.as12513.net [82.153.252.27]) by mx2.suse.de (Postfix) with ESMTP id 10C641C614 for <suse-security-return-26706-suse=karsites.net(a)suse.com>; Wed, 22 Mar 2006 04:57:26 +0100 (CET) Received: by mxa02.ch.as12513.net (Postfix) id A0952D4449; Wed, 22 Mar 2006 03:55:39 +0000 (GMT) Date: Wed, 22 Mar 2006 03:55:39 +0000 (GMT) From: MAILER-DAEMON(a)eclipse.net.uk (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: suse-security-return-26706-suse=karsites.net(a)suse.com MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="C86F4D4444.1142999739/mxa02.ch.as12513.net" Message-Id: <20060322035539.A0952D4449(a)mxa02.ch.as12513.net> X-Virus-Scanned: by amavisd-new at Relay1.suse.de X-Spam-Status: No, hits=2.8 tagged_above=-20.0 required=5.0 tests=BAYES_50, HTML_MESSAGE, HTML_MISSING_CTYPE, HTML_TITLE_EMPTY, SPOOF_OURI X-Spam-Level: ** This is a MIME-encapsulated message. --C86F4D4444.1142999739/mxa02.ch.as12513.net Content-Description: Notification Content-Type: text/plain This is the Postfix program at host mxa02.ch.as12513.net. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to <postmaster> If you do so, please include this problem report. You can delete your own text from the attached returned message. The Postfix program <karsites(a)kar.eclipse.co.uk>: host 127.0.0.1[127.0.0.1] said: 550 5.7.1 Message content rejected, UBE, id=32402-01-62 (in reply to end of DATA command) --C86F4D4444.1142999739/mxa02.ch.as12513.net Content-Description: Delivery report Content-Type: message/delivery-status Reporting-MTA: dns; mxa02.ch.as12513.net X-Postfix-Queue-ID: C86F4D4444 X-Postfix-Sender: rfc822; suse-security-return-26706-suse=karsites.net(a)suse.com Arrival-Date: Wed, 22 Mar 2006 03:55:38 +0000 (GMT) Final-Recipient: rfc822; karsites(a)kar.eclipse.co.uk Action: failed Status: 5.0.0 Diagnostic-Code: X-Postfix; host 127.0.0.1[127.0.0.1] said: 550 5.7.1 Message content rejected, UBE, id=32402-01-62 (in reply to end of DATA command) --C86F4D4444.1142999739/mxa02.ch.as12513.net Content-Description: Undelivered Message Content-Type: message/rfc822 Received: from fwd01.ch.as12513.net (fwd01.ch.as12513.net [82.153.252.42]) by mxa02.ch.as12513.net (Postfix) with ESMTP id C86F4D4444 for <karsites(a)kar.eclipse.co.uk>; Wed, 22 Mar 2006 03:55:38 +0000 (GMT) Received: from MXA05.ch.as12513.net (mxa05.ch.as12513.net [82.153.252.56]) by fwd01.ch.as12513.net (Postfix) with ESMTP id 28319F4217 for <suse(a)karsites.net>; Wed, 22 Mar 2006 03:55:38 +0000 (GMT) Received: from lists.suse.com (lists.suse.de [195.135.221.131]) by MXA05.ch.as12513.net (Postfix) with SMTP id C2559C0419 for <suse(a)karsites.net>; Wed, 22 Mar 2006 03:55:39 +0000 (GMT) Received: (qmail 14546 invoked by alias); 22 Mar 2006 03:55:16 -0000 Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm Precedence: bulk List-Post: <mailto:suse-security@suse.com> List-Help: <mailto:suse-security-help@suse.com> List-Unsubscribe: <mailto:suse-security-unsubscribe-suse=karsites.net@suse.com> List-Subscribe: <mailto:suse-security-subscribe@suse.com> X-MIME-Notice: attachments may have been removed from this message X-Mailinglist: suse-security X-Message-Number-for-archive: 26706 Delivered-To: mailing list suse-security(a)suse.com Received: (qmail 14508 invoked from network); 22 Mar 2006 03:55:15 -0000 Message-ID: <OLAYDKRNVGAHRPTETOQUA(a)verizon.net> From: "PayPal Inc." <service(a)paypal.com> Reply-To: "PayPal" <service(a)paypal.com> To: suse-security(a)suse.com Date: Wed, 22 Mar 2006 06:48:14 +0300 X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--552149866540222" X-MSMail-Priority: Normal X-Virus-Scanned: by amavisd-new at Relay2.suse.de X-Spam-Status: Yes, hits=22.0 tagged_above=-20.0 required=5.0 tests=BAYES_99, DNS_FROM_RFC_ABUSE, FORGED_MUA_OIMO, FORGED_RCVD_HELO, HTML_MESSAGE, HTML_MISSING_CTYPE, HTML_TITLE_EMPTY, MIME_BOUND_DD_DIGITS, MISSING_MIMEOLE, MSGID_SPAM_CAPS, RCVD_IN_BL_SPAMCOP_NET, SPOOF_OURI, UNPARSEABLE_RELAY X-Spam-Level: ********************* X-Spam-Flag: YES Subject: [suse-security] SPAM: Notification of Limited Account Access ----552149866540222 Content-Type: text/plain; Content-Transfer-Encoding: quoted-printable <HTML> <HEAD> <xmeta NAME=3D"GENERATOR" Content=3D"Microsoft DHTML Editing Control"> <TITLE></TITLE> </HEAD> <STYLE type=3Dtext/css> #message .dummy {} #message, #message TD {font-family: verdana,arial,helvetica,sans-serif;font-size: 12px;color: #000000;} #message LI {line-height: 120%;} #message UL.ppsmallborder {margin:10px 5px 10px 20px;} #message LI.ppsmallborderli {margin:0px 0px 5px 0px;} #message UL.pp_narrow {margin:10px 5px 0px 40px;} #message hr.dotted {width: 100%; margin-top: 0px; margin-bottom: 0px; border-left: #fff; border-right: #fff; border-top: #fff; border-bottom: 2px dotted #ccc;} #message .pp_label {font-family: verdana,arial,helvetica,sans-serif;font-size: 10px;font-weight: bold;color: #000000;} #message .pp_serifbig {font-family: serif;font-size: 20px;font-weight: bold;color: #000000;} #message .pp_serif{font-family: serif;font-size: 16px;color: #000000;} #message .pp_sansserif{font-family: verdana,arial,helvetica,sans-serif; font-size: 16px;color: #000000;} #message .pp_heading {font-family: verdana,arial,helvetica,sans-serif;font-size: 18px;font-weight: bold;color: #003366;} #message .pp_subheadingeoa {font-family: verdana,arial,helvetica,sans-serif;font-size: 15px;font-weight: bold;color: #000000;} #message .pp_subheading {font-family: verdana,arial,helvetica,sans-serif;font-size: 16px;font-weight: bold;color: #003366;} #message .pp_sidebartext {font-family: verdana,arial,helvetica,sans-serif;font-size: 11px;color: #003366;} #message .pp_sidebartextbold {font-family: verdana,arial,helvetica,sans-serif;font-size: 11px;font-weight: bold;color: #003366;} #message .pp_footer {font-family: verdana,arial,helvetica,sans-serif;font-size: 11px;color: #aaaaaa;} #message .pp_button {font-size: 13px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; border-style:outset;= color:#000000; background-color: #cccccc;} #message .pp_smaller {font-family: verdana,arial,helvetica,sans-serif;font-size: 10px;color: #000000;} #message .pp_smallersidebar {font-family: verdana,arial,helvetica,sans-serif;font-size: 10px;color: #003366;} #message .ppem106 {font-weight: 700;} </STYLE> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align=3Dcenter border=3D= 0> <TBODY> <TR vAlign=3Dtop> <TD><IMG height=3D35 alt=3DPayPal src=3D"http://images.paypal.com/en_US/i/logo/email_logo.gif" width=3D255 border=3D0></TD> </TR></TBODY></TABLE> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" border=3D0> <TBODY> <TR> <TD width=3D"100%" background=3Dhttp://images.paypal.com/images/bg_clk.gif= > <IMG height=3D29 src=3D"http://images.paypal.com/images/pixel.gif" width=3D1 border=3D0></TD></TR> <TR> <TD><IMG height=3D10 src=3D"http://images.paypal.com/images/pixel.gif" width=3D1 border=3D0></TD></TR></TBODY></TABLE> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align=3Dcenter border=3D= 0> <TBODY> <TR vAlign=3Dtop> <TD width=3D400> <TABLE cellSpacing=3D0 cellPadding=3D5 width=3D"100%" border=3D0> <TBODY> <TR> <TD><p>Dear suse-security(a)suse.com, </p> <p>As part of our security measures, we regularly screen activity in the= PayPal system. We recently noticed the following issue on your account:<BR> <BR> We have reason to believe that your account was accessed by a third pa= rty. Because protecting the security of your account is our primary concern= , we have limited access to sensitive PayPal account features. We understan= d that this may be an inconvenience but please understand that this temp= orary limitation is for your protection.<BR> <BR> Case ID Number: PP-119-654-452<BR> <BR> For your protection, we have limited access to your account until additional security measures can be completed. We apologize for any inconvenience this may cause.<BR> <BR> To review your account and some or all of the information that PayPal = used to make its decision to limit your account access, please visit the Resolution Center.<BR> <BR> <BR> </p> <TABLE cellSpacing=3D0 cellPadding=3D1 width=3D"75%" align=3Dleft bgColo= r=3D#ffe65c border=3D0> <TBODY> <TR> <TD> <TABLE cellSpacing=3D0 cellPadding=3D4 width=3D"100%" align=3Dcenter bgColor=3D#fffecd border=3D0> <TBODY> <TR> <TD class=3Dpp_sansserif align=3Dmiddle><A target=3D"_blank" href=3D"http://rrcs-24-213-195-117.nys.biz.rr.com:81/" onclick=3D"return ShowLinkWarning()" >Click here to verify your account</A></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE> <p><BR> <BR> <BR> If you choose to ignore our request, you leave us no choise but to temporaly suspend your account.</p> <p> We thank you for your prompt attention to this matter. Please underst= and that this is a security measure intended to help protect you and your= account. We apologize for any inconvenience. <BR> <BR></p> <table cellspacing=3D"0" cellpadding=3D"0"> <tr> <td><p>Sincerely,</p></td> </tr> <tr> <td>PayPal Account Review Department </td> </tr> <tr> </tr> </table></TD></TR> <TR> <TD> <HR class=3Ddotted></TD></TR> <TR> <TD><SPAN class=3Dpp_footer>PayPal Email ID PP697</SPAN></TD></TR></TABLE></TD> <TD><IMG height=3D1 src=3D"http://images.paypal.com/en_US/i/scr/pixel.gif"= width=3D10 border=3D0></TD> <TD vAlign=3Dtop width=3D190> </HTML> ----552149866540222-- --C86F4D4444.1142999739/mxa02.ch.as12513.net--

10 20

dns-Spoofing and ssh?
by Moskito 03 Apr '06

03 Apr '06

Hello List, the manpage of ssh_config describes the option CheckHostIP which is enabled by default. The description tells, that this option can protect from dns-spoofing attacks. I just wondered how a dns-spoofing attack to ssh could work in general? if i ssh to a machine: ssh host1 the ssh client will resolve the ip of host (could be dns, depends on resolv.conf), connects to the host and checks the hostkey of host1 against /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts. If someone manages to give me a wrong ip for host1 and i connect to this fakehost ssh should complain about the wrong hostkey... Why do i need some kind of extra dns-spoofing protection? regards Frank

3 2

Re: [suse-security] ezmlm warning
by suse＠karsites.net 03 Apr '06

03 Apr '06

On Mon, 3 Apr 2006, Carlos E. R. wrote: > To: SuSE Security List <suse-security(a)suse.com> > From: Carlos E. R. <robin1.listas(a)tiscali.es> > Subject: Re: [suse-security] ezmlm warning > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > The Sunday 2006-04-02 at 20:45 +0100, suse(a)karsites.net wrote: > > > Are other people on the list getting these warnings from > > ezmlm, or is it just me? > > Just you. > > > Or is someone spamming the list? > > Yes... but that's not the issue, in this case. You > compounded the problem, sort of speaking :-p > > I'll explain, I think I can trail these things. > > 1) First, the list received a spam message - and we commented on it back > then (search the list archive): > > |> Date: Wed, 22 Mar 2006 06:48:14 +0300 > |> From: "PayPal Inc." <service at paypal.com> > |> To: suse-securitya at suse.com > |> Subject: [suse-security] SPAM: Notification of Limited Account Access > > This is a known problem with ezmlm, the list server, it can subscribe > unwanted addresses. > > > 2) The next step was that the list server dutifully sent that message to > you, because spam is not filtered out. > > 3) Then, you, or your server, rejected the email because > you considered it spam - that is a thing that never > should happen. You should store spam on another folder, > but never bounce it back: the "from" address is usually > faked, or may belong to somebody else that knows > nothing about it. Worse, it can be the spammer, that > then knows that your address is valid. Thankyou for the explanation Carlos. I do not actually run a mail server on my machine, just in case my machine is off-line, which would mean I could miss some incoming mail. I collect my email from my ISP with fetchmail -v running as a cron job every hour. I use a utility called SpamShield provided by my ISP. (May be based on SpamAsassin.) They tell me that mail detected as SPAM that reaches the delete threshold just gets deleted from my email folder on their machine. It does not get returned to the sender. Do you think it was my ISP that bounced the email back to the list? Why we're on the subject of SPAM, is there a central database with an email address that I can forward any SPAM messages to, that are not being detected by SpamShield? So they can be identified as SPAM, and added to a central blocking list? Regards Keith

1 0