September 2008 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] nss-mdns and SuSEfirewall2
by Jan Ritzerfeld 14 Oct '08

14 Oct '08

Hello, I am trying to resolve the name of my printer via nss-mdns. It works fine with "avahi-resolve -n KY623B6B.local". But "ping KY623B6B.local" does not work because the SuSEfirewall2 blocks the incoming answers from port 5353 of the printer to a random port of my computer. The avahi service opens upd and broadcast on port 5353 but not answers from port 5353. Using FW_ALLOW_INCOMING_HIGHPORTS_UDP="mdns" makes "ping KY623B6B.local" working but that option is deprecated ... Gruß Jan -- If you make people think they're thinking, they'll love you. But if you really make them think they'll hate you. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

3 6

[opensuse-security] ACLs, HAL and serial devices (was: HAL and serial devices)
by Jan Ritzerfeld 12 Oct '08

12 Oct '08

Hello, inspired by the thread "Want to could use /dev/ttyS0 as user" on the opensuse-factory maling list, I tried to figure out whether access to /dev/ttyS0 can be granted by HAL/resmgr (since this works fine with the alsa devices). According to /etc/hal/fdi/policy/90osvendor/80-resmgr.fdi, access to serial devices should be granted to "members" of the resmgr modem class (desktop users are not "member" of this class by default). But using 10.3, I cannot even find any serial device via HAL: jan@karl:~> hal-find-by-capability --capability serial jan@karl:~> Obviously, udev recognizes my /dev/ttyS0: jan@karl:~> udevinfo --query=all --name=/dev/ttyS0 P: /devices/platform/serial8250/tty/ttyS0 N: ttyS0 I do not need access to /dev/ttyS0, but I do want to learn more about HAL. :) Gruß Jan -- A fail-safe circuit will destroy all others. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 4

[opensuse-security] udev rules; use of uucp group for devices
by Günter Dannoritzer 02 Oct '08

02 Oct '08

Hi, I had asked this question over at the [opensuse] mailing list on 09/14/2008 12:46 AM and got the recommendation to ask the security people about this issue. So here I am. I want to use a USB device which comes up as /dev/ttyUSB0 with the user:group = root:uucp. Now my question is how is the intended use of this device for a normal user? When I look at my user information with the id command I get: uid=1000(linux) gid=100(users) groups=16(dialout),33(video),100(users) I am hesitant to add my user to the uucp group, as I am not sure whether that is the intended use of the group. I know there are some user/groups on Linux only intended for some software and not for real user accounts. I tried to overwrite the udev rule and make the ttyUSB0 device belong to the dialout group, as my user belongs to it, but was not successful with that. Could someone please explain the intended use of the uucp group in connection with hardware devices and how users are intended to access the hardware? Thanks for your help. Cheers, Guenter -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

6 15

[opensuse-security] Today kernel upgrade breaks crypto system!
by Carlos E. R. 11 Sep '08

11 Sep '08

nimrodel:~ # /etc/init.d/boot.crypto start Activating crypto devices using /etc/cryptotab ... /dev/disk/by-id/ata-ST3320620A_5QF2M56F-part15... failed It does not ask for password, it simply fails. There is no entry in logs. No clue :-/ nimrodel:~ # uname -a Linux nimrodel 2.6.25.16-0.1-pae #1 SMP 2008-08-21 00:34:25 +0200 i686 i686 i386 GNU/Linux nimrodel:~ # cat /proc/version Linux version 2.6.25.16-0.1-pae (geeko@buildhost) (gcc version 4.3.1 20080507 (prerelease) [gcc-4_3-branch revision 135036] (SUSE Linux) ) #1 SMP 2008-08-21 00:34:25 +0200 nimrodel:~ # cat /etc/SuSE-release openSUSE 11.0 (i586) VERSION = 11.0 Where can I get the previous kernel to back-off just the last upgrade? -- Cheers, Carlos Robinson --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 2

[opensuse-security] SuSEfirewall2 and ipt_recent
by Christian Boltz 10 Sep '08

10 Sep '08

Hello, I hit a problem with the ipt_recent support in SuSEfirewall2 on openSUSE 11.0. I'm trying to limit the SSH connections to 5 new connections per 5 minutes. The setting I use is: FW_SERVICES_ACCEPT_EXT="0/0,tcp,22,,hitcount=5,blockseconds=300,recentname=ssh" The problem: The firewall only allows _one_ successful connection and already blocks the second attemp. Do I have some misconfiguration or did I find a bug? My full SuSEfirewall configuration: # grep '^[^#]' /etc/sysconfig/SuSEfirewall2 FW_DEV_EXT="any eth0" FW_DEV_INT="" FW_DEV_DMZ="" FW_ROUTE="no" FW_MASQUERADE="no" FW_MASQ_DEV="zone:ext" FW_MASQ_NETS="0/0" FW_NOMASQ_NETS="" FW_PROTECT_FROM_INT="no" FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_EXT_RPC="" FW_CONFIGURATIONS_EXT="apache2 apache2-ssl courier-imap courier-imap-ssl postfix vsftpd" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_DMZ_RPC="" FW_CONFIGURATIONS_DMZ="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_INT_RPC="" FW_CONFIGURATIONS_INT="" FW_SERVICES_DROP_EXT="" FW_SERVICES_DROP_DMZ="" FW_SERVICES_DROP_INT="" FW_SERVICES_REJECT_EXT="" FW_SERVICES_REJECT_DMZ="" FW_SERVICES_REJECT_INT="" FW_SERVICES_ACCEPT_EXT="0/0,tcp,22,,hitcount=5,blockseconds=300,recentname=ssh" FW_SERVICES_ACCEPT_DMZ="" FW_SERVICES_ACCEPT_INT="" FW_SERVICES_ACCEPT_RELATED_EXT="" FW_SERVICES_ACCEPT_RELATED_DMZ="" FW_SERVICES_ACCEPT_RELATED_INT="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="" FW_ALLOW_INCOMING_HIGHPORTS_UDP="" FW_FORWARD="" FW_FORWARD_REJECT="" FW_FORWARD_DROP="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG_LIMIT="" FW_LOG="" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_SOURCEQUENCH="" FW_ALLOW_FW_BROADCAST_EXT="no" FW_ALLOW_FW_BROADCAST_INT="no" FW_ALLOW_FW_BROADCAST_DMZ="no" FW_IGNORE_FW_BROADCAST_EXT="yes" FW_IGNORE_FW_BROADCAST_INT="no" FW_IGNORE_FW_BROADCAST_DMZ="no" FW_ALLOW_CLASS_ROUTING="" FW_CUSTOMRULES="" FW_REJECT="" FW_REJECT_INT="yes" FW_HTB_TUNE_DEV="" FW_IPv6="" FW_IPv6_REJECT_OUTGOING="" FW_IPSEC_TRUST="no" FW_ZONES="" FW_USE_IPTABLES_BATCH="" FW_LOAD_MODULES="ip_conntrack_ftp" FW_FORWARD_ALWAYS_INOUT_DEV="" FW_FORWARD_ALLOW_BRIDGING="" Regards, Christian Boltz -- > Und wie nennt man das Gegenteil von Durstig? Besoffen. [Kai Poehlmann & Mickey Kottenhahn in detebe] --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

3 3

[opensuse-security] Re: Failing @ basic Setup & Test of OpenSuse's SASL
by Ric 06 Sep '08

06 Sep '08

I've stumbled a bit further, but still can't get the simple tests to work. Realizing that I need to open _two_ shell windows, one to launch the sample-server and the other to launch the sample-client, I can step through the transaction, (1) # @ SHELL #1, "server" /usr/bin/cyrus_sasl_sample_server -s ldap -p 389 -m GSSAPI trying 2, 1, 6 trying 10, 1, 6 socket: Address family not supported by protocol (2) # @ SHELL #2, "client"/usr/bin/cyrus_sasl_sample_client -s ldap -p 389 -m GSSAPI dirsvr.domain.com receiving capability list... recv: {6} GSSAPI GSSAPI please enter an authorization id: (3) # @ SHELL #1, "server" accepted new connection send: {6} GSSAPI (4) # @ SHELL #2, "client" (please enter an authorization id: ) ldap/dirsvr.domain.com (5) # @ SHELL #1, "server" recv: {6} GSSAPI recv: {1} Y recv: {655} `[82]... [0][0][0][A3][82][1]ha[82][1]d0[82][1]`[A0][3][2][1][5][A1][14][1B][ 12]DOMAIN.COM[A2]10/[A0][3][2][1][3][A1](0&[1B][4]ldap[1B][1E]dirsvr .domain.com[A3][82][1][E]0[82][1]...[F0][D9][B2][1]~[9C][D2][FD] starting SASL negotiation: generic failure closing connection (6) # @ SHELL #2, "client"send: {6} GSSAPI send: {1} Y send: {655} `[82]... [0][0][0][A3][82][1]ha[82][1]d0[82][1]`[A0][3][2][1][5][A1][14][1B][ 12]DOMAIN.COM[A2]10/[A0][3][2][1][3][A1](0&[1B][4]ldap[1B][1E]dirsvr .domain.com[A3][82][1][E]0[82][1]...[F0][D9][B2][1]~[9C][D2][FD] authentication failed closing connection Clearly there's some sort of communication occuring, but negotitation/authentication is still failing. Also, I still see the suspect, "socket: Address family not supported by protocol" Searching, I've found an old discussion here, http://www.irbs.net/internet/cyrus-sasl/0402/0070.html that suggests, "you need to create a /usr/lib/sasl2/sample.conf and configure what password verification service it should use as well as additional parameters that come with the pvs you want to use." I've tried various entries in "/usr/lib/sasl2/sample.conf". So far, I've seen no change at all in errors/behavior from above. I am confused by exactly _which_ ".conf" needs to be populated -- as well as what goes in it. Reading @ cyrus-sasl's docs/sysadmin.html, "The default configuration file By default, the Cyrus SASL library reads it's options from /usr/lib/sasl2/App.conf (where "App" is the application defined name of the application). For instance, Sendmail reads it's configuration from "/usr/lib/sasl2/Sendmail.conf" and the sample server application included with the library looks in "/usr/lib/sasl2/sample.conf"." What exactly does "App" is the application defined name of the application? mean? Given that on OpenSuse11, the app is named "cyrus_sasl_sample_server", which do I need? /usr/lib/sasl2/slapd.conf /usr/lib/sasl2/sample.conf or, /usr/lib/sasl2/cyrus_sasl_sample_server.conf And, on my system, find /usr -type d | grep sasl | grep lib /usr/lib64/sasl2 So should any/all of the conf DIRs above be in "/usr/lib64/..." instead of "/usr/lib/..." ? Ric -- Hotel pics, info and virtual tours. Click here to book a hotel online. http://tagline.hushmail.com/fc/Ioyw6h4eRCkvVvofMtoxR0EomX7V7hDNbOcr2Ogs3Isl… --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] Failing @ basic Setup & Test of OpenSuse's SASL
by Ric 05 Sep '08

05 Sep '08

I'm working on getting SASL setup & tested, for eventual use with GSSAPI/KerberosV authentication. I'm not sure what the right OpenSuse list for this is, but since it is a security topic, I thought 'here' would be a good start. I've got Cyrus SASL installed from distribution repos on OpenSuse 11, saslauthd -v saslauthd 2.1.22 authentication mechanisms: getpwent kerberos5 pam rimap shadow ldap I'm reading the SASL docs' "Configuring GSSAPI and Cyrus SASL" (.../gssapi.html). The instructions there state: "The command-line used for sample-server needs to specify the GSSAPI service name and the location of the plug-ins; your sample command line might look something like this: ./sample-server -s host -p ../plugins/.libs on UNIX" On OpenSuse, apparently, the app is instead (?), /usr/bin/cyrus_sasl_sample_server Checking the sample server/client apps' usage options, they're, usage: client [-p port] [-s service] [-m mech] host usage: server [-p port] [-s service] [-m mech] where "-p" refers to "port". Which is clearly *not* the plugin library, as per the docs/example. When I try to run the recommended test, I get simply, cyrus_sasl_sample_server -p 389 -s ldap -m GSSAPI trying 2, 1, 6 trying 10, 1, 6 socket: Address family not supported by protocol and, @ syslog: Sep 5 09:08:31 dirsvr cyrus_sasl_sample_server: auxpropfunc error invalid parameter supplied Sep 5 09:08:31 dirsvr cyrus_sasl_sample_server: _sasl_plugin_load failed on sasl_auxprop_plug_init for plugin: ldapdb not, as the doc says, " You should get a response similar to: Generating client mechanism list... Sending list of 3 mechanism(s) S: R1NTQVBJIFBMQUlOIEFOT05ZTU9VUw== " Can someone please clarify how to set up, run & pass the simple 'sample' tests? Or, point to some other docs? Or, even explain what the console output/ log errors might mean? I've posted what I've done so far (much the same as here) on the Cyrus SASL list too, @ http://www.irbs.net/internet/cyrus-sasl/0809/0005.html To be honest, I've managed to get more confused since I started. Thanks, Ric -- Hotel pics, info and virtual tours. Click here to book a hotel online. http://tagline.hushmail.com/fc/Ioyw6h4eRCkUqa67voYXqzEG9Kr77Qh9kxfyTayJUNWA… --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] GNUTLS
by Carsten Koch-Mauthe 05 Sep '08

05 Sep '08

Hi, there are some vulnerabilities in gnutls. CVE-2008-1949 GNUTLS-SA-2008-1-2 GnuTLS null-pointer dereference CVE-2008-1950 GNUTLS-SA-2008-1-3 GnuTLS memory overread flaw CVE-2008-1948 GNUTLS-SA-2008-1-1 GnuTLS buffer overflow CVE-2008-2377 GNUTLS-SA-2008-2 GnuTLS Local denial of service http://www.gnu.org/software/gnutls/security.html I've not found any updates adressing these problems for Suse/Opensuse. Is Suse/Opensuse not affected by these problems ? Thank you Carsten --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 1