October 2007 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] LUKS and its master key
by Jochen+opensuse-security＠Hayek.name 12 Dec '07

12 Dec '07

I found LUKS recently through SUSE Linux 10.3, and the other night a read an article in c't 2006/11. I can't seriously appreciate the technical internals, as I'm not too compentent there. Anyway: Kudos to Clemens Fruhwirth! But I am not really sure, whether I can trust, what I read in that article regarding the master key, spefically that the master key can be read from the LUKS volume by the sys admin without any difficulties. Does that really mean, that as soon as somebody gains control over my computer with a mounted LUKS encrypted (external) disc and he also manages to gain root priviliges, that he can retrieve the necessary information, to mount that disc himself with LUKS-means again?!? I mean without me passing the keys to him. If that is seriously so, I think I will have to find myself another disc encryption toolset, as I cannot tolerate, that intruders can deal with my personal data without my explicit permission and support. Whether those intruders have governmental permissions, I don't f...ing care. I appreciate your serious comments. J. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

6 11

[opensuse-security] Blocking Skype
by kl 23 Oct '07

23 Oct '07

Good afternoon. My client is running an openSUSE 10.3 gateway server with Squid and fetchmail/postfix/maildrop/qpopper. He wants to restrict Internet HTTP access to servers on an allowed list and no direct access to external mail. Is there any way I can stop the uncontrolled use of Skype or other messengers from the Windows workstations? Will appreciate any hint as how to handle this. Regards Wolfgang Kluge --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

4 4

[opensuse-security] kerberos authentication and pam help with 10.3
by Christopher Dick 22 Oct '07

22 Oct '07

I am trying to get my SuSE 10.3 machine to authenticate using Kerberos. There are pretty clear instructions out and about on how to do it with SuSE 10.2 and earlier. However, with the elimination of the pam_unix2.conf and such, those instructions no longer apply. Is there anyone who can help me make appropriate changes to the various files in /etc/pam.d to allow true Kerberos authentication? I have the kerberos client configured appropriately, because when I issue a "kinit" command, I do get a ticket issued. Any help is appreciated. Thanks! __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] squid access logs
by darko g 18 Oct '07

18 Oct '07

hi, i have a squid setup and am monitoring the access logs. all the http requests are being logged as going DIRECT. does that mean the clients are not using the local squid cache? -- cheers, dg <a href="http://opensuse.org"><img style="border: 0px solid ; width: 80px; height: 15px;" alt="openSUSE.org" title="openSUSE.org" src="http://files.opensuse.org/opensuse/en/6/6e/Suselinux-green.png" /></a> --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] openvpn-auth-pam.so?
by Frank Steiner 18 Oct '07

18 Oct '07

Hi, is there any reason why the openvpn.rpm (checked 10.1 and 10.3) does not include openvpn-auth-pam.so? The use of this plugin is recommended over the auth-pam.pl script for security reasons, as far as I understand. cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. * --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

3 3

[opensuse-security] Adding Kerberos LDAP attributes with Yast user add
by Bill Merriam 11 Oct '07

11 Oct '07

I am awed and confused by the template based LDAP user creation stuff in openSuSE 10.3. It seems quite flexible and configurable. As best I can figure out, if I want to use Kerberos for authentication then I need extra attributes in the users LDAP entry. Something along the line of this stuff. objectclass: krbPrincipalAux objectclass: krbPolicyAux objectclass: krbPwdPolicyRefAux krbPrincipalName: jsmith(a)ACME.COM I think I should be able to get Yast to add the extra stuff by modifying the template and/or creating another plugin. Am I on the right track? Is this already taken care of somewhere? Is there documentation on how to do it? Should I be looking at using CASA for authentication, instead of Kerberos? Bill --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] [Fwd: [PM] vdrift-full-data 20070323 (openSUSE 10.3/noarch)]
by Aniruddha 08 Oct '07

08 Oct '07

Maybe somebody here knows the answer? -------- Forwarded Message -------- From: Aniruddha To: toni(a)links2linux.de Cc: packman(a)links2linux.de Subject: [PM] vdrift-full-data 20070323 (openSUSE 10.3/noarch) Date: Tue, 09 Oct 2007 01:30:57 +0200 Hi, When I try to install vdrift through smart I get the following an error message. I think this is weird since I already have added packman's gnupg key to smart. Can I trust this package? How can I tell? Thanks in advance! Regards, Aniruddha The above GPG key has been imported successfully. It is required to install this package: vdrift-full-data-20070323-0.pm.1.noarch.rpm Do you want to trust this key forever? You must verify the below fingerprint before answering. pub 1024D/1DFA8F0C 2004-09-24 Key fingerprint = 931D 878F 07E5 48CC 5B2B 9F24 FA6D 29CC 1DFA 8F0C uid oc2pus zuhause (may the source be with you) <oc2pus(a)arcor.de> sub 1024g/315F7863 2004-09-24 If you answer "Yes" all other packages signed with this key will be installed automatically. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] Question on "sux" utility
by Greg Byrd 08 Oct '07

08 Oct '07

Everyone, When I typed "w" to see who was logged into a SLES 9 server, I noticed a user's pty connection showing "[priv]" in the right column. I assumed this user had figured out a way to escalate their rights on the server, but in testing the sux utility, this isn't true. My question is why does the sux utility show "[priv]" when the user really doesn't have privileged access? Thanks in advance, Greg ____________________________________________________________________________________ Check out the hottest 2008 models today at Yahoo! Autos. http://autos.yahoo.com/new_cars.html --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] Re: [opensuse] How do I keep openSUSE secure?
by Aniruddha 08 Oct '07

08 Oct '07

Hi Joe, Thank you for your answers! May I conclude that is is safe to accept gnupg keys from repositories in yast2 -> Community Repositories ? What do you mean with "the packages... are signed and checked independently"? Does this mean the repo owner checks the packages for vulnerabilities and yast only checks if the contents matches with the signature of the repo owner? Which trusted sources for (source) rpm's do you recommend? Thanks again. Regard, Aniruddha On Mon, 2007-10-08 at 19:41 +0800, Joe Morris (NTM) wrote: > On 10/08/2007 07:21 PM, Aniruddha wrote: > > Coming from Gentoo I wonder how do I keep openSUSE secure (e.g. for > > rootkits)? In Gentoo there is one repository with 11.000+ packages which > > are all checked for vulnerabilities and verified with shasum. > > > > In contrast openSUSE has many different repositories (Packman, Guru > > etc). I assume these are trusted resources. How can I tell if these > > rpm's are tampered with? > > > use Yast to install your packages. It checks the gpg signatures to > verify every package installed. > > How do I safely use the gnupg key system for repositories? > repository files are signed as well as each package. These are also > checked by Yast. > > Is accepting > > these keys when adding repositories with yast the preferred way? > Depends on your paranoia. You could also check the authenticity before > accepting, but remember that is only the authenticity of the files that > describe the contents to yast, NOT the packages themselves. They are > signed and checked independently. > > And if > > so how can I tell these are the correct keys? > > > They are usually published on the web sites and or via the gpg key servers. > > What about rootkits? How do I protect my system for rootkits when > > downloading rpm's from sites such as rpmbone? > > > Only get packages from trusted sources. If it isn't available, ask or > build it yourself. You can download the src rpms and build it on your > machine and check it to be sure. > > And my last question; where do I find security information for openSUSE? > > > Yast Online Update > > Is there a news site or mailinglist with announcement about security > > threats and vulnerabilities? > > > Yes, opensuse-security(a)opensuse.org and > opensuse-security-announce(a)opensuse.org > > I ask these questions because I am planning to sell openSUSE 10.3 on > > retail pc's through my company. I want the make sure I get all the pro's > > and cons of openSUSE security wise before doing so. > > > > > HTH > > -- > Joe Morris > Registered Linux user 231871 running openSUSE 10.2 x86_64 > > > > > --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

3 3

[opensuse-security] How do I keep openSUSE secure?
by Aniruddha 08 Oct '07

08 Oct '07

Coming from Gentoo I wonder how do I keep openSUSE secure (e.g. for rootkits)? In Gentoo there is one repository with 11.000+ packages which are all checked for vulnerabilities and verified with shasum. In contrast openSUSE has many different repositories (Packman, Guru etc). I assume these are trusted resources. How can I tell if these rpm's are tampered with? How do I safely use the gnupg key system for repositories? Is accepting these keys when adding repositories with yast the preferred way? And if so how can I tell these are the correct keys? What about rootkits? How do I protect my system for rootkits when downloading rpm's from sites such as rpmbone? And my last question; where do I find security information for openSUSE? Is there a news site or mailinglist with announcement about security threats and vulnerabilities? I ask these questions because I am planning to sell openSUSE 10.3 on retail pc's through my company. I want the make sure I get all the pro's and cons of openSUSE security wise before doing so. Thanks in advance! Regards, Aniruddha --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

3 3