- openSUSE Security

Re: [SuSE Security] Re: nessus output
by cogNiTioN 02 Aug '99

02 Aug '99

On Fri, 30 Jul 1999, Hubert Mantel wrote: > > > PS: SuSE: Could someone please configure this mailing list, so that I > > will not get a dozen errors, if someone is on vacation or if his or her > > e-mail address doesnt exist. It's pissing me of. :-( I agree. It really is a waste of bandwidth, yours for sending them, but mainly ours for having to download them. > IMHO there is nothing we can do about it. The failure messages are sent > directly to you, our server is not involved. As I see it, the error messages are bounced back to suse-security(a)suse.com which then redistributes it to the list. Isn't there a way the server can be set up to detect bounced messages, and not redistribute them. I maybe wrong, feel free to flame me if I am. cog -- ,------------------------------, ================| S H U N A N T I O N L I N E |================ ================'------------------------------'================ == David M. Webster ++ aka cogNiTioN ++ cognition(a)bigfoot.com == ================================================================ == My New Domain <cognite.net> should be up and running soon. == ================================================================ == I use Linux every day to up my productivity - so up yours! == ================================================================

2 1

Re: [suse-security] Re: [SuSE Security] Re: nessus output
by Daniel Clemens 02 Aug '99

02 Aug '99

The wrong email address's are not being sent from the <suse security list> they are being sent from the failed mail server. Look @ the headers and you can see where it fails. thank you, dan At 07:52 PM 8/2/99 +0000, you wrote: >On Fri, 30 Jul 1999, Hubert Mantel wrote: >> >> > PS: SuSE: Could someone please configure this mailing list, so that I >> > will not get a dozen errors, if someone is on vacation or if his or her >> > e-mail address doesnt exist. It's pissing me of. :-( > >I agree. It really is a waste of bandwidth, yours for sending them, but >mainly ours for having to download them. > >> IMHO there is nothing we can do about it. The failure messages are sent >> directly to you, our server is not involved. > >As I see it, the error messages are bounced back to suse-security(a)suse.com >which then redistributes it to the list. Isn't there a way the server can >be set up to detect bounced messages, and not redistribute them. > >I maybe wrong, feel free to flame me if I am. > >cog >-- ,------------------------------, > ================| S H U N A N T I O N L I N E |================ > ================'------------------------------'================ > == David M. Webster ++ aka cogNiTioN ++ cognition(a)bigfoot.com == > ================================================================ > == My New Domain <cognite.net> should be up and running soon. == > ================================================================ > == I use Linux every day to up my productivity - so up yours! == > ================================================================ > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com

1 0

network device encryption and compression
by Bernd Thallner 02 Aug '99

02 Aug '99

hi, i have a 9600 b/s pocket net point to point tcp/ip connection and i want to encrypt and compress all data transferrd over this device (sm0 or ax25). i use http, pop, ssh, telnet, nfs, samba, ftp and many more with partly confidential data over this connection and i think the best solution would be to encrypt and compress on one side and to decrypt and decompress on the other side paticularly because the data is tranferred over the air and monitoring is absolute no problem. changing all protocols would be much more work a no real alternativ because same protocols have no secure alternativ (intranet http, samba a.s.o.). is there a solution for encrypting and compressing all trafic for a device (tcp and udp) with no big data overhead but if necessary cpu power? thx; bernd

3 2

CGI-scan
by belial 01 Aug '99

01 Aug '99

hi Today i downloaded CGI-scanner and scanned my PC(SuseLinux 6.0).The scanner founds only one bug: Searching for test-cgi : Found!! Can somebody tell me how does this bug work and what would a cracker do to gain access. And how can i fix this bug? Th@nx Christian

10 10

Re: [suse-security] nessus output
by earendil7＠juno.com 31 Jul '99

31 Jul '99

On Thu, 29 Jul 1999 17:39:03 +0100 (IST) Eric Mosley <ericm(a)iol.ie> writes: >Hi, > >I recently ran nessus and it gave me some information like this ... > >On this machine, there is an X11-Server that grants access >without authentification. That means a hacker is able to sniff >every keystroke that is typed on the X11-Server (or get a copy of the >victims screen). >Solution: use MIT-Cookies, xauth. > >How do I get rid of this and stil use X11. Is using MIT-Cookies, xauth a >real big change?? > >Also, can I comment out in inetd.conf telnet shell and login and still >start a new xterm? > >Thanks for you thoughts, > >Eric If you don't need or want to export your x server to any other machines, I think you can configure xhost to not accept any connections at port 6000 from anywhere other than the localhost. I did that with my suse 6.1 box, and I no longer get an open port 6000 in any scans I do (nessus, nmap, etc.). Look at man xhost. I'm not positive, but with this setup, a box will not be compromised *because* of X, but could be manipulated to setup up X to export. Course, at that point, the box is already compromised anyway... dan ___________________________________________________________________ Get the Internet just the way you want it. Free software, free e-mail, and free Internet access for a month! Try Juno Web: http://dl.www.juno.com/dynoget/tagj.

1 0

nessus output
by Eric Mosley 30 Jul '99

30 Jul '99

Hi, I recently ran nessus and it gave me some information like this ... On this machine, there is an X11-Server that grants access without authentification. That means a hacker is able to sniff every keystroke that is typed on the X11-Server (or get a copy of the victims screen). Solution: use MIT-Cookies, xauth. How do I get rid of this and stil use X11. Is using MIT-Cookies, xauth a real big change?? Also, can I comment out in inetd.conf telnet shell and login and still start a new xterm? Thanks for you thoughts, Eric

6 7

SSL in C++?
by Dennis 29 Jul '99

29 Jul '99

Hi, Are there any SSL librarys written in C++ or any C++ wrappers for SSLeay/OpenSSL? (An iostream-like library would be the best.) Thanks in advance, Dennis Stachowicz

1 0

Re: [suse-security] nessus output
by Michael Bausch 29 Jul '99

29 Jul '99

hi all, SuSE 6.0 provides a solution for MIT-Cookies in conjunction with startx almost out of the box. one just has to find (!) and activate it. from /etc/skel/.xserverrc.secure (in package aaa_skel-98.12.10-0.rpm): # move this file to ~/.xserverrc, if you don't want to allow # everybody to get access to your X-Server copying /etc/skel/.xserverrc.secure to /usr/X11R6/lib/X11/xinit/xserverrc istaead of to ~/.xserverrc enables MIT-Cookies for all users of the system. (SuSE: why not doing this in the default installation?) btw: there is a startx-related local security issue. when you fire up X11 using startx, xlock the screen and walk away, someone with access to the keyboard could just switch back to the text console, background the startx process, kill the xlock process and thus gain full access to your Xsession. this can be prevented by using something like (startx &); exit instead of startx. michael ------------------------------------------------------------------------------- Michael Bausch Arbeitsbereich Funktionalanalysis // Mathematisches Institut // Uni Tuebingen miba(a)michelangelo.mathematik.uni-tuebingen.de +49 7071 29-78566 -------------------------------------------------------------------------------

1 0

any major suse 6.1 security flaws? with the 2.2.7 kernel?
by steganos 29 Jul '99

29 Jul '99

i just recently upgraded my suse6.1 with the 2.2.5 kernel to 6.1 with the 2.2.7 kernel, and was wondering if theres any major security flaws with it? i was using rh6.0 and was getting hacked all the time, so i got smarter and switched to suse and havent been hacked yet....I just hope that suse6.2 doesnt become bloated like rh6 did and increase their price on it if i order online or purchase it in the store? be sure to stop by irc-2.mit.edu:6667 #linux and say hey to everyone. for those who still use rh, version 5.2 with the 2.2.9 kernel is pretty good and secure......L8tr

1 0

passwd
by Dieter M�ller 29 Jul '99

29 Jul '99

Hello, I already sent this message a few days ago, but I didn't saw it on the list, if I only missed it I have to say sorry in advance. I need a one-time-password authentication system which allows me to log in via an untrusted terminal, p.ex via telnet from win-xy. The problem is that I can't disable telnet on my pc thince I still need it to log in from my secure network. The very best would be a telnet-alike protocol which allows to choose between giving a normal or a one-time password. Dieter _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com

10 10