To add to that, it would be interesting to compare OS by "vulnerabilites by architectural flaws". At the top of my head, I know a few for NT and related products (display driver run on kernel ring, PPTP-security, ..). I assume, that MS would win this "market share execise" easily. anyway, Moody seems to be on the MS payroll. On the other side, Linux distributors could do even better. My wishlist for Suse: - configure security level (like harden_suse questions) with yast, and make it more granular. - by default, no shell user should be allowed to log in to ftp/telnet/pop using the same password or at all - have an installation option, that compares installed packages versus ftp.suse.com and lists known vulnerabilites and available fixes, and does updates on request I think, that a lot of security can be gained my making defaults more secure, or easy, selectable installation options. Few systems get the attention, that they should .. Rainer Frank Hart <frhart@home.nl> Sent by: hart@pingala.netpromote.co.at 02.08.00 20:31 To: cc: suse-security@suse.com Subject: Re: [suse-security] SuSE security reputation, etc.. Len Rose wrote:
http://www.abcnews.go.com/sections/tech/FredMoody/moody.html It really sucks that SuSE wasn't even mentioned.
What really sucked was that this article is a total piece of crap. Based on the number of vulnerability's mr. Moody qualified a total OS. Also he adds the vulnerabilities of every linux distro but that is nonsence, cause there's a big chance a vulnerablility found in eg RedHat also affects SuSE. -- SuSE Linux 6.4 -o) | Like the ski resort of girls looking for Kernel 2.2.16 /\ | husbands and husbands looking for girls, the on a i686 _\_v | situation is not as symmetrical as it might mailto:frhart@home.nl | seem. -- Alan McKay --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
Hi, all -- ...and then rhoerbe@netpromote.co.at said... ... % Moody seems to be on the MS payroll. Yep. Blindingly so :-) % % On the other side, Linux distributors could do even better. My wishlist % for Suse: % - configure security level (like harden_suse questions) with yast, and % make it more granular. Great idea. % - by default, no shell user should be allowed to log in to ftp/telnet/pop % using the same password or at all Here's what throws me. I understand you to say that the default should be for a console-only system. Is that what you meant?? I also don't know what you mean by "same password"... % - have an installation option, that compares installed packages versus % ftp.suse.com and lists known vulnerabilites and available fixes, and does % updates on request That would be nice, too :-) % % I think, that a lot of security can be gained my making defaults more % secure, or easy, selectable installation options. Few systems get the % attention, that they should .. Yep. Few users, me included, even know all of the places to look, much less have the time to go and get updated packages and install them and make sure they really don't break anything else... % % Rainer % % % % % Frank Hart <frhart@home.nl> % Sent by: hart@pingala.netpromote.co.at % 02.08.00 20:31 % % % To: % cc: suse-security@suse.com % Subject: Re: [suse-security] SuSE security reputation, etc.. % % Len Rose wrote: % % > http://www.abcnews.go.com/sections/tech/FredMoody/moody.html % > It really sucks that SuSE wasn't even mentioned. % % What really sucked was that this article is a total piece of crap. Based % on the number of vulnerability's mr. Moody qualified a total OS. Also he % adds the vulnerabilities of every linux distro but that is nonsence, % cause there's a big chance a vulnerablility found in eg RedHat also % affects SuSE. % % -- % SuSE Linux 6.4 -o) | Like the ski resort of girls looking for % Kernel 2.2.16 /\ | husbands and husbands looking for girls, the % on a i686 _\_v | situation is not as symmetrical as it might % mailto:frhart@home.nl | seem. -- Alan McKay % % --------------------------------------------------------------------- % To unsubscribe, e-mail: suse-security-unsubscribe@suse.com % For additional commands, e-mail: suse-security-help@suse.com % % % % % % % --------------------------------------------------------------------- % To unsubscribe, e-mail: suse-security-unsubscribe@suse.com % For additional commands, e-mail: suse-security-help@suse.com :-D -- David T-G * It's easier to fight for one's principles (play) davidtg@bigfoot.com * than to live up to them. -- fortune cookie (work) davidtgwork@bigfoot.com http://www.bigfoot.com/~davidtg/ Shpx gur Pbzzhavpngvbaf Qrprapl Npg! The "new millennium" starts at the beginning of 2001. There was no year 0. Note: If bigfoot.com gives you fits, try sector13.org in its place. *sigh*
You know another thing that would be nice would be if suse set up a way of downloading patches fro say within yast i.e something like you go to update system and then it checks the ftp site and determines which packages need updating preferably only those for which security anouncement have been made some of us really can't go hunting all over their web site for the latest patches. Noah ksemat@eahd.or.ug
On Wed, 2 Aug 2000 ksemat@wawa.eahd.or.ug wrote:
You know another thing that would be nice would be if suse set up a way of downloading patches fro say within yast i.e something like you go to update system and then it checks the ftp site and determines which packages need updating preferably only those for which security anouncement have been made some of us really can't go hunting all over their web site for the latest patches.
Well, what I really would like to have is: - A SuSE distribution that comes with the SuSE public PGP key on the CD-Rom (thus regarding it as being trusted). - A YaST-option that allows download and update of SuSE-packages from the SuSE-FTP-server using the rpm -K and checking the PGP signature of the package againts the public key on CD (and the checksum as well) automatically. That would make live much easier and updates much more trusted and it would make the average SuSE installation being more up-to-date and thus (hopefully) more secure. Cheers, Thomas |--------------------------------------------------------------------------| | Thomas Forbriger email: Thomas.Forbriger@geophys.uni-stuttgart.de | | Universitaet Stuttgart - Institut fuer Geophysik | | Richard-Wagner-Str. 44 D-70184 Stuttgart Germany | | Tel ++49 (711) 121-3593 or 3422 or 3424 or 3590 | Fax ++49 (711) 2361218 | | http://www.geophys.uni-stuttgart.de/thof | | "... there's nothing more bizarre than reality..." (M. Kindermann) |
Hi Thomas, there's a packet named 'autorpm' existing, I think it's on www.kaybee.org. Unfortunately it does not work with Suse, but the functionality it provides is great. I wish somebody would implement such a packet (or change autorpm, that it works also with Suse ;-). my two cents (has nothing to do with security, I know) Thomas Forbriger wrote:
On Wed, 2 Aug 2000 ksemat@wawa.eahd.or.ug wrote:
You know another thing that would be nice would be if suse set up a way of downloading patches fro say within yast i.e something like you go to update system and then it checks the ftp site and determines which packages need updating preferably only those for which security anouncement have been made some of us really can't go hunting all over their web site for the latest patches.
Well, what I really would like to have is:
- A SuSE distribution that comes with the SuSE public PGP key on the CD-Rom (thus regarding it as being trusted). - A YaST-option that allows download and update of SuSE-packages from the SuSE-FTP-server using the rpm -K and checking the PGP signature of the package againts the public key on CD (and the checksum as well) automatically.
That would make live much easier and updates much more trusted and it would make the average SuSE installation being more up-to-date and thus (hopefully) more secure.
Cheers, Thomas
|--------------------------------------------------------------------------| | Thomas Forbriger email: Thomas.Forbriger@geophys.uni-stuttgart.de | | Universitaet Stuttgart - Institut fuer Geophysik | | Richard-Wagner-Str. 44 D-70184 Stuttgart Germany | | Tel ++49 (711) 121-3593 or 3422 or 3424 or 3590 | Fax ++49 (711) 2361218 | | http://www.geophys.uni-stuttgart.de/thof | | "... there's nothing more bizarre than reality..." (M. Kindermann) |
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
Hi, On Thu, 3 Aug 2000, Gerd Bitzer wrote:
there's a packet named 'autorpm' existing, I think it's on www.kaybee.org. Unfortunately it does not work with Suse, but the functionality it provides is great. I wish somebody would implement such a packet (or change autorpm, that it works also with Suse ;-).
One of our developers hacked autorpm to work with SuSE Linux as well. You can get the RPM from here (within the nex few hours, mirroring to the outside may take a while): http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.noarch.rpm http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.src.rpm This package already includes a suse-update configuration. Enjoy! Bye, LenZ -- ------------------------------------------------------------------ Lenz Grimmer SuSE GmbH mailto:grimmer@suse.de Schanzaeckerstr. 10 http://www.suse.de/~grimmer/ 90443 Nuernberg, Germany Our life is a trip between two eternities.
Wow! Now that was really quick kepp it up please! thanks. On Thu, 3 Aug 2000, Lenz Grimmer wrote:
Date: Thu, 3 Aug 2000 16:56:58 +0200 (CEST) From: Lenz Grimmer <grimmer@suse.de> To: suse-security@suse.com Subject: Re: [suse-security] SuSE security reputation, etc..
Hi,
On Thu, 3 Aug 2000, Gerd Bitzer wrote:
there's a packet named 'autorpm' existing, I think it's on www.kaybee.org. Unfortunately it does not work with Suse, but the functionality it provides is great. I wish somebody would implement such a packet (or change autorpm, that it works also with Suse ;-).
One of our developers hacked autorpm to work with SuSE Linux as well. You can get the RPM from here (within the nex few hours, mirroring to the outside may take a while):
http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.noarch.rpm http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.src.rpm
This package already includes a suse-update configuration. Enjoy!
Bye, LenZ -- ------------------------------------------------------------------ Lenz Grimmer SuSE GmbH mailto:grimmer@suse.de Schanzaeckerstr. 10 http://www.suse.de/~grimmer/ 90443 Nuernberg, Germany Our life is a trip between two eternities.
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
Noah ksemat@eahd.or.ug
You guys rock! I've just pushed this onto several of my systems and it's working beautifully. - Herman Lenz Grimmer wrote:
Hi,
On Thu, 3 Aug 2000, Gerd Bitzer wrote:
there's a packet named 'autorpm' existing, I think it's on www.kaybee.org. Unfortunately it does not work with Suse, but the functionality it provides is great. I wish somebody would implement such a packet (or change autorpm, that it works also with Suse ;-).
One of our developers hacked autorpm to work with SuSE Linux as well. You can get the RPM from here (within the nex few hours, mirroring to the outside may take a while):
http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.noarch.rpm http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.src.rpm
This package already includes a suse-update configuration. Enjoy!
Bye, LenZ -- ------------------------------------------------------------------ Lenz Grimmer SuSE GmbH mailto:grimmer@suse.de Schanzaeckerstr. 10 http://www.suse.de/~grimmer/ 90443 Nuernberg, Germany Our life is a trip between two eternities.
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
Okay can someone give me pointers as to how to install this package? the noarch refused with an error of autorpm can not be installed and the src though it is installed I can't seem to be able to use it. Is there a tar.gz package for this I am really not used to rpms especially without a readme. On Fri, 4 Aug 2000, Herman Knief wrote:
Date: Fri, 04 Aug 2000 22:54:42 -0700 From: Herman Knief <herman@knief.net> To: Lenz Grimmer <grimmer@suse.de> Cc: suse-security@suse.com Subject: Re: [suse-security] SuSE security reputation, etc..
You guys rock! I've just pushed this onto several of my systems and it's working beautifully.
- Herman
Lenz Grimmer wrote:
Hi,
On Thu, 3 Aug 2000, Gerd Bitzer wrote:
there's a packet named 'autorpm' existing, I think it's on www.kaybee.org. Unfortunately it does not work with Suse, but the functionality it provides is great. I wish somebody would implement such a packet (or change autorpm, that it works also with Suse ;-).
One of our developers hacked autorpm to work with SuSE Linux as well. You can get the RPM from here (within the nex few hours, mirroring to the outside may take a while):
http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.noarch.rpm http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.src.rpm
This package already includes a suse-update configuration. Enjoy!
Bye, LenZ -- ------------------------------------------------------------------ Lenz Grimmer SuSE GmbH mailto:grimmer@suse.de Schanzaeckerstr. 10 http://www.suse.de/~grimmer/ 90443 Nuernberg, Germany Our life is a trip between two eternities.
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
Noah ksemat@eahd.or.ug
When I tried to install it on 6.3 it complained that it needs perl_net. When can I find it? Thanks, Avi Herman Knief wrote:
You guys rock! I've just pushed this onto several of my systems and it's working beautifully.
- Herman
Lenz Grimmer wrote:
Hi,
On Thu, 3 Aug 2000, Gerd Bitzer wrote:
there's a packet named 'autorpm' existing, I think it's on www.kaybee.org. Unfortunately it does not work with Suse, but the functionality it provides is great. I wish somebody would implement such a packet (or change autorpm, that it works also with Suse ;-).
One of our developers hacked autorpm to work with SuSE Linux as well. You can get the RPM from here (within the nex few hours, mirroring to the outside may take a while):
http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.noarch.rpm http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.src.rpm
This package already includes a suse-update configuration. Enjoy!
Bye, LenZ -- ------------------------------------------------------------------ Lenz Grimmer SuSE GmbH mailto:grimmer@suse.de Schanzaeckerstr. 10 http://www.suse.de/~grimmer/ 90443 Nuernberg, Germany Our life is a trip between two eternities.
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
-- Avi Schwartz Get a Life avi@CFFtechnologies.com Get Linux
Try ftp.suse.com or a mirror of it and grab it from the 6.4 distribution: /pub/suse/i386/6.4/suse/d1/perl_net.rpm It worked fine in my 6.3 box :-) Artemios G. Voyiatzis "Think negative" ----- Original Message ----- From: "Avi Schwartz" <avi@CFFtechnologies.com> To: "SuSE Security" <suse-security@suse.com> Sent: Saturday, August 05, 2000 4:50 PM Subject: Re: [suse-security] SuSE security reputation, etc..
When I tried to install it on 6.3 it complained that it needs perl_net. When can I find it?
Thanks, Avi
Herman Knief wrote:
You guys rock! I've just pushed this onto several of my systems and
it's
working beautifully.
- Herman
Lenz Grimmer wrote:
Hi,
On Thu, 3 Aug 2000, Gerd Bitzer wrote:
there's a packet named 'autorpm' existing, I think it's on www.kaybee.org. Unfortunately it does not work with Suse, but the functionality it provides is great. I wish somebody would implement such a packet (or change autorpm, that it works also with Suse ;-).
One of our developers hacked autorpm to work with SuSE Linux as well. You can get the RPM from here (within the nex few hours, mirroring to the outside may take a while):
http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.noarch.rpm http://www.suse.de/~grimmer/export/autorpm-1.9.8.4-0.src.rpm
This package already includes a suse-update configuration. Enjoy!
Bye, LenZ -- ------------------------------------------------------------------ Lenz Grimmer SuSE GmbH mailto:grimmer@suse.de Schanzaeckerstr. 10 http://www.suse.de/~grimmer/ 90443 Nuernberg, Germany Our life is a trip between two eternities.
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
-- Avi Schwartz Get a Life avi@CFFtechnologies.com Get Linux
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
% On the other side, Linux distributors could do even better. My wishlist % for Suse: % - configure security level (like harden_suse questions) with yast, and % make it more granular.
Great idea.
We see that there is a narrow path between the resulting complexity of a more detailed and granular configuration tool on the one side and the user's skills (plus patience and time) to use it on the other side. If a user can answer all detailed questions, he's probably capable of fixing unwanted configuration items himself. By consequence, the configuration can't exceed a certain level
From this standpoint, the existing system (/etc/permissions / chkstat / yast / harden_suse for the truly paranoid) surely has its advantages - it needs more consistency and completeness though. We're working on it.
% - by default, no shell user should be allowed to log in to ftp/telnet/pop % using the same password or at all
Here's what throws me. I understand you to say that the default should be for a console-only system. Is that what you meant?? I also don't know what you mean by "same password"...
This is a no-go. By default, a SuSE distribution doesn't have any users with a password after the installation, and only root can access the machine. Since it is generally considered to be a bad idea to log on as root without encryption, root login is only possible on the console and via ssh. If you add users and issue passwords, you usually expect them to log on. If we disable this possibility by default, we remove what people expect when they use a network transparent O/S.
% - have an installation option, that compares installed packages versus % ftp.suse.com and lists known vulnerabilites and available fixes, and does % updates on request
That would be nice, too :-)
Yes, indeed. There are many problems to face: Let rpm work flawlessly, let the tool work seamlessly with the servers, in short: Do everything necessary that the system works. Yet, there are still situations where the upgrade of a package may fail because local configuration changes have been made. In this case, we'd have to blame it on the administrator. I must admit that I don't like this idea. We're thinking of a semi-automatic solution.
% % I think, that a lot of security can be gained my making defaults more % secure, or easy, selectable installation options. Few systems get the % attention, that they should ..
Yep. Few users, me included, even know all of the places to look, much less have the time to go and get updated packages and install them and make sure they really don't break anything else...
Agreed. I think you see the trade-off btw. secure configuration and the ease of use.
% Len Rose wrote: % % > http://www.abcnews.go.com/sections/tech/FredMoody/moody.html % > It really sucks that SuSE wasn't even mentioned.
:-) Thank you, Len, for providing the link to the page. Roman. -- - - | Roman Drahtmüller <draht@suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -
Hi, I just followed this thread and found it a great idea to manage different passwds for pop/ftp and local. But how can I make the system using different passwds? thanks Benjamin On Thu, 3 Aug 2000, Roman Drahtmueller wrote:
% On the other side, Linux distributors could do even better. My wishlist % for Suse: % - configure security level (like harden_suse questions) with yast, and % make it more granular.
Great idea.
We see that there is a narrow path between the resulting complexity of a more detailed and granular configuration tool on the one side and the user's skills (plus patience and time) to use it on the other side. If a user can answer all detailed questions, he's probably capable of fixing unwanted configuration items himself. By consequence, the configuration can't exceed a certain level
From this standpoint, the existing system (/etc/permissions / chkstat / yast / harden_suse for the truly paranoid) surely has its advantages - it needs more consistency and completeness though. We're working on it.
% - by default, no shell user should be allowed to log in to ftp/telnet/pop % using the same password or at all
Here's what throws me. I understand you to say that the default should be for a console-only system. Is that what you meant?? I also don't know what you mean by "same password"...
This is a no-go. By default, a SuSE distribution doesn't have any users with a password after the installation, and only root can access the machine. Since it is generally considered to be a bad idea to log on as root without encryption, root login is only possible on the console and via ssh. If you add users and issue passwords, you usually expect them to log on. If we disable this possibility by default, we remove what people expect when they use a network transparent O/S.
% - have an installation option, that compares installed packages versus % ftp.suse.com and lists known vulnerabilites and available fixes, and does % updates on request
That would be nice, too :-)
Yes, indeed. There are many problems to face: Let rpm work flawlessly, let the tool work seamlessly with the servers, in short: Do everything necessary that the system works. Yet, there are still situations where the upgrade of a package may fail because local configuration changes have been made. In this case, we'd have to blame it on the administrator. I must admit that I don't like this idea. We're thinking of a semi-automatic solution.
% % I think, that a lot of security can be gained my making defaults more % secure, or easy, selectable installation options. Few systems get the % attention, that they should ..
Yep. Few users, me included, even know all of the places to look, much less have the time to go and get updated packages and install them and make sure they really don't break anything else...
Agreed. I think you see the trade-off btw. secure configuration and the ease of use.
% Len Rose wrote: % % > http://www.abcnews.go.com/sections/tech/FredMoody/moody.html % > It really sucks that SuSE wasn't even mentioned.
:-) Thank you, Len, for providing the link to the page.
Roman. -- - - | Roman Drahtm�ller <draht@suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | N�rnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
On Thu, Aug 03, 2000 at 13:33 +0000, Benjamin Janson wrote:
I just followed this thread and found it a great idea to manage different passwds for pop/ftp and local. But how can I make the system using different passwds?
Just redirect the apropriate servers away from /etc/shadow and have them use their own user database. Although you will notice that this will increase the burdon of administration and will be difficult for the users to realize that they have to update several passwords regularly using absolutely(?) different mechanisms. It's your decision.
[ ... unrelated fullquote snipped, sigh! ... ]
virtually yours 82D1 9B9C 01DC 4FB4 D7B4 61BE 3F49 4F77 72DE DA76 Gerhard Sittig true | mail -s "get gpg key" Gerhard.Sittig@gmx.net -- If you don't understand or are scared by any of the above ask your parents or an adult to help you.
participants (12)
-
Artemios G. Voyiatzis -
Avi Schwartz -
Benjamin Janson -
David T-G -
Gerd Bitzer -
Gerhard Sittig -
Herman Knief -
ksemat＠wawa.eahd.or.ug -
Lenz Grimmer -
rhoerbe＠netpromote.co.at -
Roman Drahtmueller -
Thomas Forbriger