May 2007 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] EAL 3 and 4 rated versions.
by Mark Armstrong 21 May '07

21 May '07

I recently discovered that there are security hardened version of SUSE that are certified/accredited to EAL 3 and even EAL 4. Does anyone have any experienced feedback on how restrictive these setups are? We are looking to implement a data retreival system that access disks over NFS and tape drives over SCSI, but does little else. Would like to know if I could still do these simple things. Regards, Mark Armstrong --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

5 12

[opensuse-security] SSH tunnels without a real shell ?
by Andreas 19 May '07

19 May '07

Hi, is there a way to get expernal people to establish a SSH tunnel to one firewalled internal port without them getting a real shell to snoop around? I'd like to let some externals use our database server that sits behind a port filter. There is only the ssh port to come in. Up until now there was only me and I trust me enough to grant me a shell. ;-) Are there reasonably simple alternatives to do this without SSH? I've got SUSE 9.3 on our server and the clients would be all kinds of Windows. Our Internet connection has no fixed IP but this would be manageable with a dynamic dns service, I suppose. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

7 8

Re: [opensuse-security] LUKS and its master key
by Jochen+opensuse-security＠Hayek.name 18 May '07

18 May '07

>>>>> Paco Cruz writes: >> I found LUKS recently through SUSE Linux 10.3, >> and the other night a read an article in c't 2006/11. PC> Could you post a link to the article you are referring to? Well, the article is in a german printed magazine, so that doesn't really help a lot. [...] >> But I am not really sure, whether I can trust, what I read in that article regarding the master key, >> specifically that the master key can be read from the LUKS volume by the sys admin without any difficulties. PC> This is the part that I don't understand well. PC> Do you have the master key in a file? That's not the point, and that's not my concern, so, no, the master key is not on any (accessible) file. The article says, that the master key can be extracted from a "luksOpen"-ed volume, i.e. from the admin header of the LUKS volume. That's my concern. Kind regards, J. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

RE: [opensuse-security] LUKS and its master key
by J.Witvliet＠MINDEF.NL 18 May '07

18 May '07

Hi all, -----Original Message----- From: Martin Konold [mailto:martin.konold@erfrakon.de] Sent: Friday, May 18, 2007 12:04 AM To: opensuse-security(a)opensuse.org Subject: Re: [opensuse-security] LUKS and its master key Am Donnerstag 17 Mai 2007 schrieb Jochen+opensuse-security(a)hayek.name: Hi Jochen, > manages to gain root priviliges, > that he can retrieve the necessary information, There is no easy way to prevent this for any Linux encryption solution. As soon as a 3rd party has either root or physical access to your linux machine this party will be able to gain access to all volumes which are currently in use. E.g. it is trivial as user root to obtain all access permissions of any user on the system. <snip> Some small side-way remarks... A) If an intruder has physical access to your machine (a co-worker, or something else is very wrong!!), he doesn't directly has access to your private data. First step would probably be to gain root access. Assuming the root user didn't leave any console open (...) it would at least mean a reboot. Stopping of the system should trigger (snmp) maintenance/security actions. Default boot-medium (with keys) can be removed. Non-default booting through grub can be protected by a password. Booting from other media can be protected by bios-password. Altering bios-setup (default pwd) can be protected by locks on your 19" cubboard Enough delaying, for maintenance/security people to have a look why the related system got offline. Even when he removes the disks and put them in another system, it's possible to encrypt root, swap, etc etc. B) Intruder has root access to your machine (through social enginering or so). It shouldn't imply that he has access to your data. For every account ther should be at least one or more private vault, that can only be opened by the user, and no-one else, not even the root user. Your data is only vulnarable (for rogue-root) if you open your vault, and mount it. So if somebody gets root-privileges, all other users should be alerted. (E.G.: Don't trust root! All his entrences and actions should be guarded) C) refering to Hobson, security has it price. If you introduce two-factor or tree-factor security; it means that a trusted person with key/dongle needs to be present when the system must be restarted. Hans --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] too many open files problem
by Cevahir Pilpil 17 May '07

17 May '07

Hi everybody, I am using OpenSuSE 10.0 with default installation and kernel 2.6. When an application tries to run with root user, it returns an error "Can not open files - too many open files". I checked kernel limits (file-max, file-nr) and bash limits (limits.conf) then have changed values as follows. ulimit open files (-n) 10240 sysctl fs.file-max = 10240 fs.file-nr = 600 0 10240 After I restart, I am still having same error message. I am listing and counting open files with lsof command. It seems, it can not open files more than 1024. Does anyone have any idea what is wrong about that? Thanks, Regards, Cevahir Pilpil --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 1

[opensuse-security] Certificate acceptance
by kl 17 May '07

17 May '07

Good morning. Many thanks for the help. Regards Wolfgang Kluge --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] Certificate acceptance
by kl 16 May '07

16 May '07

Good afternoon. I would be grateful if someone could point me to the right site or give me some clue in this matter. Whenever I log in into my remote Linux box ( 10.2 ) the first time via SSH I will be asked to accept the certificate of that server. Is it possible to configure the server to accept only connections from selected clients based on the client's certificate? Regards Wolfgang Kluge --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

3 2

[opensuse-security] CN=Miguel ALBUQUERQUE/O=JGSACERT is out of the office.
by Miguel ALBUQUERQUE 03 May '07

03 May '07

I will be out of the office starting 27.04.2007 and will not return until 07.05.2007. for urgent matters please call +41 22 827 3030 --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] Updates for 9.3
by Sven.Hartrumpf＠FernUni-Hagen.de 03 May '07

03 May '07

Hi all. Novell announced that 9.3 updates end on 2007-04-15 and that a last kernel update will be available at the end of 2007-04. Any news on this? (Today's "SUSE Security Summary Report" did not mention this issue.) Greetings Sven

5 10

[opensuse-security] problemas con fibertel
by Gaston DeSouza 02 May '07

02 May '07

hola gente, les cuento cual es el problema que tengo. el vierner me puse fibertel, la gente vino lo instalo y probo en una maquina con winXP y funciono a la perfeccion, yo que en mi casa tengo un sles9 como server con dos placas una LAN(192.168.1.7) y otra PUBLIC (es por dhcp la de fibertel) no me esta dejando navegar, probe con ping a una ip publica del mundo y nada... alguien ya tuvo este problema asi me puede ayudar a solucionarlo??? desde ya muchas gracias. s2 --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 1