January 2001 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

Re: is SuSE going to implement libsafe?
by marc＠suse.de 18 Feb '01

18 Feb '01

Hi, >I have just read an Bell Labs anouncement, that they are going to release >libsafe under GNU licence, and that some major Linux distros are going to >be using it. SuSE was not amongst them, why is that? I think that libsafe would >be a good echnacement against buffer overflow. > >Anouncement is on: >http://www.bell-labs.com/news/2000/april/20/1.html just because something new pops up please be careful with questions like "when will you implement it?" ;-) There are several questions to ask: a) is it STABLE and does it NOT affect the stability of other programs? b) does it bring additional security problems into the system? c) is the security protection effective? Well, of course the SuSE Security Team already reviewed libsafe. Here are the answers: a) unsure. it would have to be tested very intensive. this was not done yet. b) the code might have vulnerabilities, however the protection gained is higher even if a vulnerability would be present c) okay, now the tough part: libsafe is a dynamic library which is set in the environment which checks several dangerous functions, which can be a security problem. Because it is a dynamic library, it is NO protection against local attackers, just against remote attackers on network services. (if an attacker wants to attack a local suid file, he would just reset his library path environment). Next thing: it does not check for all known vulnerabilites. It even doesn't protect against all buffer overflows, It just protects against *some* overflows. those which happen because of insecure use of strcat/strcpy etc. summary: I can not remember a vulnerability in a network service for the last year which this tool would have prevented. Therefore: as long as this tool is not enhanced to also protect open/fopen calls against symlink/hardlink/pipe attacks, several more buffer overflow types, system/exec* function protection etc. it is not useful to use this tool. I would rather propose to use the secumod module which comes with SuSE Linux since 6.3 and maybe the secure-linux kernel patch from www.openwall.com - these two tools enhance your security. (and btw, install seccheck, hardensuse and firewals and use them - then your security is very high) Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

5 4

Web Based e-mail servers
by Chosen1 08 Feb '01

08 Feb '01

I am running SuSe 7.0, and I have a couple of questions... 1.) I have been asked by one of my customers to setup a logging function to log all inbound and outbound e-mails that are being sent through their server. What program would be good for this? 2.) I would like to setup a web based e-mail server for my customers so they can get their mail off the web. What is a good program to use and how secure is this? --Brian --Chosen1 Network Operations Administrator (COO) Postmaster and Routing lead Admin of beer.wa.us.ircsol.net /server beer.ircsol.net and Admin of unix.az.us.ircsol.net /server unix.ircsol.net http://www.ircsol.net

6 5

ICMP filter in SuSEfirewall? (again)
by Rick Green 03 Feb '01

03 Feb '01

I posed this questin a few days ago. I got no response, so I've been digging, and maybe I can ask a slightly different question. System: SuSE 6.4 running SuSEfirewall 4.2 Symptom: Output DENY messages when sending mail. I've also sometimes seen these directed at my ISP's DNS servers. When sending mail, I get four repetitions of the following, but the mail goes thru: output DENY ppp0 PROTO=1 my.ip.ad.dr:3 isp.smtp.ip.addr:3 L=108 S=0xC0 I=5893 F=0x0000 T= After reading thru SuSEfirewall, I discovered that the messages disappear when I set FW_ALLOW_FW_TRACEROUTE = "yes" , although my reading of the script looks like they're still being denied by the '# deny all other type 3' rule, which isn't logged. So it's transparent, with the same effect. I tried hacking the script, moving the $DENY port-unreachable $LDC just outside the bracket, and changing it to $ACCEPT port-unreachable $LAC. Now I can turn off FW_ALLOW_FW_TRACEROUTE again. I'm still invisible to traceroute, and sending mail gives me just one message in the log: output ACCEPT ppp0 PROTO=1 64.79.87.98:3 64.79.64.32:3 L=108 S=0xC0 I=26218 F=0x0000 T=255 (#3) The destination address is my ISP's mail relay host. So now my mail is going out without the delay of waiting for four timeouts. But I still have the question of what is going on here? I have not been able to find any documentation of the various parameters displayed with the log message. What port is my ISP's mail host trying to connect to, and why? Is this normal smtp behaviour? Can someone point me to the RFC that defines all the ICMP sub-types? -- Rick Green

7 7

Porn/Xrate-Filter
by Matthias Jaenichen 02 Feb '01

02 Feb '01

Hi, is there any tool to filter pron and other rated sites and/or contents? We want to provide a S.u.S.E-based firewall for a school and think we must at least make it difficult to access any rated content. Reg. Matthias Jänichen

7 7

Re: [suse-security] Porn/Xrate-Filter
by Volker Kuhlmann 02 Feb '01

02 Feb '01

Or what to do with a home networking setup and the kids... > >we use "squid" as proxy with stopword list's. Our list is about 350 line > >long. One approach. The bad news is, they all don't work. It is impossible to automatically do a linguistic analysis and decide which sites are junk. People can get very irate when good discussions about sexuality are blocked! This is just one example. You will find more than your software will ever be able to handle. Filtering by URL doesn't work either. For detecting URLs to blacklist see above. There is commercial software about, but it all sucks. See the example of cyberpatrol: it was proven(!) that they generate their blacklists automatically, badly, and black out a large amount of valid sites as well as missing junk ones. Waste of money. Btw filtering by URL is easily circumvented: use a URL-anomymiser/redirector. There goes that idea. > Problem: how to keep that list updated? Precisely. Forget it. > reffering to that, a teacher I know keeps a very pragmatical and > practical method of doing this: With the help of his pupils. > Checking squid's logfiles, new sites are frequently added to the black > list. *laugh* do the pupils know about their help? :-) > Any other ideas around? None which are practical, except for this, but that isn't going to be easy: > But never forget to solve the problem of pornsite surfing in school at > the roots. An the roots are the pupils, and not the net. Can't fix a social problem with blacklists... My EUR0.02 Volker

2 1

SuSEFirewall slows down connection
by Christian Bohn 01 Feb '01

01 Feb '01

Hi! I encountered the following problem with the SuSEfirewall-skript: First of all, my configuration: I've got a Linux Box (SuSE 6.4) running as a DSL-Router (incl. Masquerading) for an internal Network. The firewall-skript (which Version doesn't really matter, I've tried out several versions, including the newest form Marc's Website) is installed on that Linux-Box. The Problem: HTTP & SSH are working well but when I try to connect to a Internet-Server via FTP, POP(sometimes) or SMTP it takes a long time (ca. 20sec) until data is transferred although the connection itself is established immediately. I do not think that it is a DNS problem, reverse&forward lookups are working well. Although I think that it has nothing to do with masquerading because if I work on the server console, the problem also occurs. If I shut down the firewall, everything is working fine! I hope somebody can help me an that this is not a FAQ ;-) bye Christian Bohn

4 4

Re: [suse-security] Porn/Xrate-Filter
by Daniele Frijia 01 Feb '01

01 Feb '01

I saw, that other people are interested too. So here's the mail I wrote to Matthias. But never forget to solve the problem of pornsite surfing in school at the roots. An the roots are the pupils, and not the net. Try to get a good supervision and everything works fine. I know that most of you are 'just' freaks and so it's naturally that you try to solve this problem on a technical level, buit it has to be solved on a social level. Ok, here's the rest of the mail: On Wed, Jan 31, 2001 at 01:40:35PM +0100, Daniele Frijia wrote: > On Wed, Jan 31, 2001 at 12:36:52PM +0100, Matthias Jaenichen wrote: > > is there any tool to filter pron and other rated sites and/or contents? We > > want to provide a S.u.S.E-based firewall for a school and think we must at > > least make it difficult to access any rated content. > > www.smartfilter.com > But check out: http://ifix.cx/squid/ (german only). > There is a little Script, that gets Porn-Domains from the net. > > If the school is connceted via belwue, the German provider for schools > in BaWue, then you can use their proxy. They installed smartfilter on > it. > > Regards, Daniele

2 1

cryptographic filesystem
by Christian Haufe 31 Jan '01

31 Jan '01

Hi list members, I'd like to setup a cryptographic filesystem using the loopback device in combination with ext2 fs. Which of the crypto codecs supplied by the international kernel patch should I choose to get a secure but still fast fs ? Are there other crypto fs implementations for linux ? Many thanks in advance. Christian

2 1

SuSE Firewall
by Alexander Kühn 31 Jan '01

31 Jan '01

Hi all, I have a little LAN with a SuSE 6.4 Server as gateway, within my LAN I have a NT box with IIS, I want to be able to access the the httpd on the NT box from the internet by specifying some port on my gateway. I have firewals-2.1-5 installed and all clients in my LAN have unlimited access to the internet and to the gateway. I tried configuring the redirection, but seems to me like this only works when the NT box has an public IP, but it has not not, an will never have. So is it possible to do it with the firewall or do I have to fiddle with ipchains ? Thanks & regards, Nagilum. -- ======================================================================== # _ __ _ __ http://home.htwm.de/akuehn/ \n icq://69646724 # # / |/ /__ ____ _(_) /_ ____ _ nagilum(a)chillout.org \n +01776461165 # # / / _ `/ _ `/ / / // / ' \ Amiga (68k/PPC): AOS/NetBSD/Linux # # /_/|_/\_,_/\_, /_/_/\_,_/_/_/_/ Mac (PPC): MacOS9 / Linux / MacOS-X # # /___/ x86: Linux/FreeBSD/OpenBSD/QNX/Win98SE # ========================================================================

4 3