September 2006 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] PGP key server
by HG 10 Sep '06

10 Sep '06

Hi! On 9/8/06, Kim Johansen - WebDeal AS <kim(a)webdeal.no> wrote: > Hi, > > I would probably upload all public keys to pgp.mit.edu, or set up a own > pgp server for internal use. For internal use I do not think I need a key server, more for the customers and 3rd parties that need to communicate using encryption. As somebody said, there doesn't seem to be any PGP servers easily available for SUSE. So it'll be quite a jub to get it up and running - if I'll even find one. So, I guess the route will be the public PGP servers. I'm thinking of setting up one "company master key" that I'll use to sign everybody's keys. I think I should upload that key to the key servers. Right? Anything to consider there? The users can then either upload their keys or not. -- HG.

4 6

PGP key server
by HG 08 Sep '06

08 Sep '06

Hello! A small company of 25-35 people needs to set up PGP for everybody. The server solution that is offered by PGP corp is too expensive route, so the individual route has been desided to take. But still some key management or at least distribution is needed. Question is: how should the public keys be distributed to the world? 1) Upload them all to the web-server? 2) Upload the "master" key to the web-server and then just have everybody email their keys to 3rd parties (who can verify the keys as they are signed with the master)? 3) Set up a own key server using SUSE obviously? 4) Just upload all the keys to some public key sever? Which? What would you recommend? -- HG.

4 3

SuSEfirewall2 and VPN
by Christian Wittmer 04 Sep '06

04 Sep '06

Hi list-users, trying to setup SuSEfirewall2 (SuSE 9.3) to work with IPSEC, but with no success. tunnel is up, but packets who should go through tunnel did not go through. Any help would be appreciated. Here some info about my config: I'm using DSL with fixed IP. VARS from SuSEfirewall2: FW_DEV_EXT="ppp0" FW_DEV_INT="eth0 eth1" # eth0 192.168.101.0/24 FW_MASQ_NETS="192.168.101.0/24 172.16.17.0/29 0/0,!192.168.2.0/24" FW_SERVICES_EXT_UDP="37 53 123 500 873 922 2401 4500" FW_SERVICES_EXT_IP="esp" FW_FORWARD="\ 172.16.17.0/29,192.168.101.0/24,ICMP \ 192.168.101.0/24,172.16.17.0/29,ICMP \ 172.16.17.0/29,192.168.101.220,tcp,19226 \ 192.168.101.220,172.16.17.0/29,tcp,19226 \ 192.168.101.0/24,192.168.2.0/24,,,ipsec \ 192.168.2.0/24,192.168.101.0/24,,,ipsec \ 192.168.101.0/24,192.168.68.0/24,,,ipsec \ 192.168.68.0/24,192.168.101.0/24,,,ipsec" FW_IPSEC_TRUST="no" ################## hades:/etc/sysconfig # iptables -L -n -t nat Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all -- 192.168.101.0/24 0.0.0.0/0 MASQUERADE all -- 172.16.17.0/29 0.0.0.0/0 MASQUERADE all -- 0.0.0.0/0 !192.168.2.0/24 Chain OUTPUT (policy ACCEPT) target prot opt source destination ################## hades:/etc/sysconfig # setkey -D xxx.xxx.xxx.188 xxx.xxx.xxx.138 esp mode=tunnel spi=3117414419(0xb9cff813) reqid=16385(0x00004001) E: 3des-cbc 334fec87 9c497e97 2ee43f9b d70dfe2a 65ae72e0 cb08c64b A: hmac-md5 177d6696 9e1143ec 102ec467 f2e8d9bf seq=0x00000000 replay=32 flags=0x00000000 state=mature created: Sep 4 18:29:37 2006 current: Sep 4 21:36:02 2006 diff: 11185(s) hard: 0(s) soft: 0(s) last: hard: 0(s) soft: 0(s) current: 0(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 0 hard: 0 soft: 0 sadb_seq=1 pid=28506 refcnt=0 xxx.xxx.xxx.138 xxx.xxx.xxx.188 esp mode=tunnel spi=2811047203(0xa78d2d23) reqid=16385(0x00004001) E: 3des-cbc 47767294 28a98de2 34a641be e1606fcc 16837566 ----------------------------------------- Diese E-Mail wurde durch SquirrelMail versandt "Webmail for nuts!" ----------------------------------------- Bereitgestellt fuer Kunden von Scorpio IT http://www.scorpio-it.net

1 0