November 1999 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

multi-services server securing
by Gediminas Grigas 16 Aug '00

16 Aug '00

Hello there, I feel erroneusly (?) secure after .host.denyed in.telnetd and in.sshd from everywhere except one pc, which is denying all exept keyboard. I belive that if i can keep hosts.deny and hosts.allow files safe, and from time to time patch most actual security holes i`ll be conditionaly safe. Em i wrong? Probably I do. I just cant imaginate how system can be cracked in lower stage, so that is my problem. I heard that inetd is very insecure, and some peoples using tcpd (or soundlike). I run harden_suse, but was forced to answer 8/10 to no, as my server should provide a lot of public services, and have world writible directories as well. And thats right - this script was developed not for systems like mine one. However i`ll run SuSE-firewall-3.0 script, to make my system even stronger. But thats all. I dont know what can i do else. I should keep folowing services open: httpd; smptd; pop3d; ftpd; snmpd; named; inetd; sshd; nscd. So if you know how to keep them at minimal risk, or know some holes at those, i would be very gratefull for any info and/or tips. I dont ask to do work for me - link to good manual would be nice too. By the way i have SuSE 6.3 (2.2.13). Thanks in advice. Sincerely Yours, Gediminas Grigas mailto:gedas@kryptis.lt

5 5

ssh-authtication
by Security Webmaster OKDesign oHG 06 Dec '99

06 Dec '99

Hi folks, umm, I have a small problem. When setting up our server, I tried to get the best security as possible. Maybe I changed some config-file to fit our needs to allow ssh-logins only from specified users.(But I have no idea which file this was :-(( ) Now I want to allow another user to login using ssh. I made ssh-keygen for this user, entered the password, copied identity.pub to authorized_keys in the .ssh-directory. But when trying to login via ssh, servers sends permission denied. What else must be done ? TIA ---Stephan

3 2

portscanning and high ports
by Chris Reeves 03 Dec '99

03 Dec '99

Hi all, I have been portscanned a number of times recently by the same computer. I've used a combination of nslookup and finger and have the name of the culprit. It is being dealt with. This has prompted me to look even more closely at my firewalling. Ports <1024 are OK, as they are totally blocked, but those >1023 are pretty much open. Although virtually every single service is commented out in inetd.conf, I still want to block and log any connect attempts to 'special' ports. At the moment, these are the high numbered ports I block: 1433 Microsoft SQL 2049 NFS 5432 PostgreSQL 5999:6010 X-Windows 7100 X Font Server 12345:12346 NetBus 31337 Back Orifice I was having a look at the high numbered ports that he was scanning, and was wondering what the significance of these ports was (I couldn't see anything in /etc/services). By the way, the following are the high numbered ports that he tried to scan, have any ideas what they are used for? 5190 5191 5192 5193 5631 5632 5800 5900 8000 8010 8080 9100 25867 31787 33333 And finally, are there any other high numbered ports that you think could be potentially damaging (eg webmin - which port is that on)? Even if I'm not running that service, I would still like to know which ones pose a security threat so that I can block them anyway (in case I'm playing and start webmin, for example, without realilsing it). Is it generally considered safe to open up most high numbered ports? What do the people on these lists do? Do you close them all and open some, or open all and close some (all meaning all ports >1023)? One last question - I keep on coming around to this one every so often. If someone wants to connect to me using ICQ, they connect to a port >1023. I am assuming that ICQ doesn't have a daemon or anything listening on every possible port, so how does it know when another ICQ user is trying to connect? This isn't an ICQ specific question - I'm just using it as an example - it could apply to any remotely opened connection to a port >1023. How is this handled (how does the computer know whether ICQ should handle the connect attempt or whether it should be handled by some other process)? Thanks in advance, Chris -- __ _ -o)/ / (_)__ __ ____ __ Chris Reeves /\\ /__/ / _ \/ // /\ \/ / ICQ# 22219005 _\_v __/_/_//_/\_,_/ /_/\_\

4 4

AW: [suse-security] Possible Hack attack ?
by Stefan Becker 01 Dec '99

01 Dec '99

Hi everybody, There has been alot of talk about portscans. What utility are you using to detect a portscan. Do I NEED a firewall before I can detect a portscan on the machine. Could someone please point me to utility / package to simply detect such a portscan and send a mail to me (the Network Admin). thanks, Stefan Becker LUFA Speyer becker(a)lufa-sp.vdlufa.de > Right. But, as as my log-files show, in many cases an attack follows the port > scan. > > I _always_ contact the gateway admin if I find a port scan, and, in some cases, > they find out that somebody intruded in their systems. > > So I think it is helpful to inform admins about port scans that come from their > systems. It's one way to avoid attacks followed by port scans. > > Regards, > > Martin

8 7

SuSE Security Announcement - new security tools
by marc＠suse.de 01 Dec '99

01 Dec '99

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Announcement of new security tools from SuSE ______________________________________________________________________________ Please note, that that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ Tools developed by SuSE (all open source) and included in SuSE 6.3 : SuSE FTP Proxy - The first program of the SuSE Proxy Suite. A secure FTP proxy with support for SSL, LDAP, command restriction, active and passive FTP support, and much more. RPM: fwproxy.rpm, fwproxys.rpm (SSL - not in the US version) SuSE Firewall - The new firewall script from SuSE, rewritten from scratch. Autodetection of interface information, masquerading, autoprotection of services, protection from internal networks, fail-close design and easy to configure. RPM: firewals.rpm Harden SuSE - A special script for hardening a SuSE Linux 5.3 - 6.3. By answering 9 questions, the system is reconfigured very tightly. e.g. disabling insecure network services, removing suid/sgid/world-writable permissions which are not critical. RPM: hardsuse.rpm SuSE Secumod - This loadable kernel module enhances the security of the system by adding a symlink/hardlink/pipe protection, procfs protection, trusted path execution and capabilities. RPM: secumod.rpm SuSE Secchk - These are cron scripts which run daily, weekly and monthly to check the security of the system and compare them to the last run. RPM: seccheck.rpm Yast-1 - New administration menu for setting password aging, authentication fail delay and logging of logins + failures. RPM: yast.rpm SuSE auditdisk - Please note that this tool is in beta phase! This tool generates a bootdisk with checksum data and all binaries etc. needed to automaticaly verify file checksums upon booting. This way it can't be subverted by lkm's like a standard e.g. tripwire installation. WWW: http://www.suse.de/~marc - not included on SuSE 6.3 yet Watch out for updates of these tools on our WWW or FTP update sites. Although these are tools developed by SuSE, they (should) work on any Linux distributions with little problems. New tools included in the SuSE Linux distribution (not created by SuSE): FreeS/WAN - IPSEC implementation to build secure VPN tunnels via public networks. RPM: freeswan.rpm (not in the US version) GNU Privacy Guard - A free pgp-like tool for secure (not limited to email) communication. Frontends are also included. RPM: gpg (not in the US version) Nessus - A very good network security scanner! RPM: nessus plus tmpwatch, arpwatch, plug, sslwrap, the newest nmap and more. "Old" packages include: john, saint, cipe, pgp, scanlogd, ssh, tripwire, etc. ______________________________________________________________________________ General information on SuSE Linux: http://www.suse.com You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update for Intel processors ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors or try the following web pages for a list of mirrors: http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/en/support/download/updates/ Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOD8G4Xey5gA9JdPZAQGdHwf9EqxQRsGFv+fONA6F5Aviv2pkf1pua3XM kRAJJcrvpZswnDb2PH3sJBq3YGm9ZXnz0JVhSEDoxuSz1V8GXV5wjh73wBg9YtGR hx6OzgfyFFYFdmJNEB3OpHNFzLmXuX0szrIfifRRcidWQzsPzAL50mtfcmGSZkab 3QHD3tz6oZLxuvQ6BGyie/iua3boza0MeJl2juKNq12VfievhZP6UK8/Y0nLbK2m 2zVqekGZIKfvlPitwCYPzF5Pxn9eh3TTnGDijxWTsMe0XpeakRZcAFte77kv9bNL SQwqA0nUKtoOGXdFVGxrspCbDRMDOKuMryNPo5ljsqpo3fjkfRNYVg== =obl6 -----END PGP SIGNATURE-----

6 5

PGP
by Scott McEachern 01 Dec '99

01 Dec '99

Does anyone know if PGP works with Netscape's Messenger? I was at the pgp site and it listed a lot of mail clients, no Netscape. -- mailto:scott.mceachern@sympatico.ca On the side of the software box, in the "System requirements section", it said "Requires Windows 95 or better." So I installed Linux.

3 2

Re: SuSE Security Announcement - new security tools
by marc＠suse.de 30 Nov '99

30 Nov '99

Hi, > Yummy, now these tools sound nice :) Especially the proxie suite. What > is the ambition here? A "new FWTK"? We could really use one (i.e. FWTK > is getting old). new secure proxies, which will replace most stuff of the fwtk > > SuSE FTP Proxy - The first program of the SuSE Proxy Suite. > > A secure FTP proxy with support for SSL, LDAP, command > > restriction, active and passive FTP support, and much more. > > RPM: fwproxy.rpm, fwproxys.rpm (SSL - not in the US version) > > Which bugs/exploits does this check for? almost everything. you can configure very much > Also, is there a ML that conatins *only* security announcements & > alerts (no posting from third parties) ? If not would you consider > making one, as this ML contains a bit to much "off-topic" disscusion > when surfing on a cell phone? ever heard of suse-security-announce? send an email to suse-security-announce-subscribe(a)suse.com it was created when suse-security was created .... Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

Re: SuSE Security Announcement - new security tools
by marc＠suse.de 30 Nov '99

30 Nov '99

Hi, > Is there a possibility to get these packages as poor 6.{0,1,2} user > without having to buy the new distribution? > > If it is open source, please place the srpms or rpms somewhere where > we can find them! 1) You can find them on the CDs ;-) 2) You will find them on the ftp server once the distribution is placed there. I don't know when this will happen, I think somewhere in december. 3) You can find most of the tools at http://www.suse.de/~marc 4) the FTP-Proxy (which is really cool!) can be found at http://proxy-suite.suse.de Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

AW: [suse-security] Info on passwords
by Michael Hamm 30 Nov '99

30 Nov '99

> >when i install suse my passwd file have a lot of users, like dbmaker and so on. How can i know these users password ? >Um Abraco. > to increase the system-security set the shell of this user to "/bin/false"

5 4

SuSE Security Announcement - inn
by thomas＠suse.de 30 Nov '99

30 Nov '99

-----BEGIN PGP SIGNED MESSAGE----- _____________________________________________________________________________ SuSE Security Announcement Package: inn <= 2.2.1 Date: Wed Nov 24 18:54:33 CET 1999 Affected SuSE versions: 5.3 - 6.3 Vulnerability Type: remote denial-of-service attack SuSE default package: no Other affected systems: all unix systems using inn <= 2.2.1 ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The Inter Net News server inn does not do proper bounds checking. 2. Impact The daemon could be crashed remotely by overflowing the static buffers. 3. Solution Update the package from our FTP server. The fixed inn package for 6.3-AXP is included in the SuSE-AXP distribution. Our maintainer of inn tries to build a RPM for 5.3, which will as soon as possible be available if everything goes well. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: b37b74d4ca8e4a7a22e1e4bac620e68b inn-2.2.1-24.alpha.rpm (6.1, AXP) 51d1dd707a53eb9dc49eeac06c86e2c2 inn-2.2.1-24.i386.rpm (6.1, x86) 833f6814deefac2524cd3bac705a271d inn-2.2.1-24.i386.rpm (6.2, x86) fc4673cc8fd04dca5ff061a48e861b39 inn-2.2.1-23.i386.rpm (6.3, x86) ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/inn-2.2.1-24.alpha.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/inn-2.2.1-24.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/inn-2.2.1-24.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/inn-2.2.1-23.i386.rpm or try the following web pages for a list of mirrors: http://www.suse.de/de/support/download/ftp/inland.html http://www.suse.de/de/support/download/ftp/ausland.html or http://www.suse.de/en/support/download/ftp/germ_mirrors.html http://www.suse.de/en/support/download/ftp/int_mirrors.html Our webpage for patches: http://www.suse.de/de/support/download/updates/index.html or http://www.suse.de/en/support/download/updates/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOEPi6Xey5gA9JdPZAQGQOAf/acJjk3Ak0yc78GRglAwF+qEDINF9jMdm pZivtOSSuJ/ief4L/YQneEuO9x34+9fcUXVtr0ScD1MYrfKvTnDEAR3Tx4vuDQgE A4FHvb57tPwWO5Y34UzUfmqvLcTV0V2iNgZHhMB9haQ/+BAdCE6I1FuzyXqryzmb NCwPSiugcS8PO0dG1Ww9Uto5dsqpbxPj6KPRaAO0fXvxZ5pNtLDTJusq7Lh8VAOp QN+hmEZ3Bg9aoJCNiMilPTi3lF8+pG3rrs0U6pDXhoVI3Vk/wsOm6g1TviNjzpVl O23l1HPo3dIajDvKAeJIUdMMTLdPbWdoTDE7qdDmBIaVR63ESbxqgw== =tDUu -----END PGP SIGNATURE-----

1 0

Re: [suse-security] Possible Hack attack ?
by Martin P. Peikert 30 Nov '99

30 Nov '99

Dear Jürgen Eder, concerning your mail sent on Mon, 29 Nov 1999 let me reply the following: >Big deal, you speak of port scans like they are something illegal! There is >nothing illegal about port scanning. Right. But, as as my log-files show, in many cases an attack follows the port scan. I _always_ contact the gateway admin if I find a port scan, and, in some cases, they find out that somebody intruded in their systems. So I think it is helpful to inform admins about port scans that come from their systems. It's one way to avoid attacks followed by port scans. Regards, Martin -- ---------------------------------------------------- Martin Peikert EN 636 Fachgebiet Theoretische Elektrotechnik TU Berlin Sekretariat EN 2 fon 314-23881 fax 314-22284 http://www-tet.ee.tu-berlin.de/peikert/index.html ----------------------------------------------------

1 0

Re: [suse-security] portscanning and high ports
by Louis J. LaBash 30 Nov '99

30 Nov '99

On Mon, Nov 29, 1999 at 02:32:49PM -0700, -|D|- wrote: > On Mon, 29 Nov 1999, Chris Reeves wrote: ... > Big deal, you speak of port scans like they are something > illegal! There is nothing illegal about port scanning. Well, turning doorknobs is not illegal either; but when you stoop down and try to pick the lock: that is a different story. Chris is just being vigilant, *not* paranoid. Repeated probes need to be watched before they turn into lock picking. -- Louis-ljl-{labash(a)lou1.ll.siue.edu}

1 0

RE: [suse-security] Info on passwords
by Sandow, Malte 30 Nov '99

30 Nov '99

Hi, >when i install suse my passwd file have a lot of users, like dbmaker and so on. How can i know these users password ? If you look into /etc/shadow you see something like this: bin:*:8902:0:10000:-1:-1:-1: daemon:*:8902:0:10000:-1:-1:-1: lp:*:9473:0:10000:-1:-1:-1: uucp:*:0:0:10000:-1:-1:-1: games:*:0:0:10000:-1:-1:-1: The second field is for the password and as you can see it is a '*'. This means nobody can login as one of these users as they do not have a valid password. > Personally I think it is ridiculous that I have users: > informix, db2[...], > amande, virtuouso etc etc when I don't use or intend to use > them on this boxen. > Why should I have all these accounts and they are not even > attached to *real* > users or processes? Can you not make the installation remove > the users that > are not needed and install the users when an app does need > them? Why this effort? It is no security risk to have these users because as stated above, they can not log in. If anything is done by these users someone (root) has to su to one of them. >to increase the system-security set the shell of this user to "/bin/false" There is no reason to do this. Is there an account less dangerous than one whith a '*' in the pw field? - No. Greetings Malte Sandow

3 2

AW: [suse-security] portscanning and high ports
by Stephan Gerling 30 Nov '99

30 Nov '99

Hi Chris, Webmin is using Port 10000 by default, but you can change it to what ever you want. BO2K can use other Ports as by default are given. The other one can be used by an Trojan Horse maybe. Service Port Protokol Description AOL 5190 tcp/udp America-Online AOL-1 5191 tcp/udp America-Online-1 AOL-2 5192 tcp/udp America-Online-2 AOL-3 5193 tcp/udp America-Online-3 pcanywheredata 5631 tcp/udp PCAnywhere pcanywherestat 5632 tcp/udp PCAnywhere ????? 5800 ????? 5900 irdmi 8000 tcp/udp irdmi ????? 8010 http-alternate 8080 tcp/udp HTTP Alternate Port, can be used by some Proxy Server ????? 9100 ????? 25867 ????? 31787 ????? 33333 Good Luck Stephan Gerling -----Ursprüngliche Nachricht----- Von: Chris Reeves [SMTP:chris.reeves@iname.com] Gesendet am: Montag, 29. November 1999 21:14 An: SuSE Mailing List; suse-security(a)suse.com Betreff: [suse-security] portscanning and high ports Hi all, I have been portscanned a number of times recently by the same computer. I've used a combination of nslookup and finger and have the name of the culprit. It is being dealt with. This has prompted me to look even more closely at my firewalling. Ports <1024 are OK, as they are totally blocked, but those >1023 are pretty much open. Although virtually every single service is commented out in inetd.conf, I still want to block and log any connect attempts to 'special' ports. At the moment, these are the high numbered ports I block: 1433 Microsoft SQL 2049 NFS 5432 PostgreSQL 5999:6010 X-Windows 7100 X Font Server 12345:12346 NetBus 31337 Back Orifice I was having a look at the high numbered ports that he was scanning, and was wondering what the significance of these ports was (I couldn't see anything in /etc/services). By the way, the following are the high numbered ports that he tried to scan, have any ideas what they are used for? 5190 5191 5192 5193 5631 5632 5800 5900 8000 8010 8080 9100 25867 31787 33333 And finally, are there any other high numbered ports that you think could be potentially damaging (eg webmin - which port is that on)? Even if I'm not running that service, I would still like to know which ones pose a security threat so that I can block them anyway (in case I'm playing and start webmin, for example, without realilsing it). Is it generally considered safe to open up most high numbered ports? What do the people on these lists do? Do you close them all and open some, or open all and close some (all meaning all ports >1023)? One last question - I keep on coming around to this one every so often. If someone wants to connect to me using ICQ, they connect to a port >1023. I am assuming that ICQ doesn't have a daemon or anything listening on every possible port, so how does it know when another ICQ user is trying to connect? This isn't an ICQ specific question - I'm just using it as an example - it could apply to any remotely opened connection to a port >1023. How is this handled (how does the computer know whether ICQ should handle the connect attempt or whether it should be handled by some other process)? Thanks in advance, Chris -- __ _ -o)/ / (_)__ __ ____ __ Chris Reeves /\\ /__/ / _ \/ // /\ \/ / ICQ# 22219005 _\_v __/_/_//_/\_,_/ /_/\_\ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Info on passwords
by "João Teles" 30 Nov '99

30 Nov '99

when i install suse my passwd file have a lot of users, like dbmaker and so on. How can i know these users password ? Um Abraco. Joao Teles teles(a)tecnolink.com

1 0

SMTP
by Security Webmaster OKDesign oHG 29 Nov '99

29 Nov '99

Hi, one of our clients wants to read his mailaccount with SMTP instead of POP3. Question one: What has to be changed/modified to prepare our server for this ? Question two (thats why I post to this list): It's told that this solution has some security-holes. What are these holes and how can the security be increased ? Is there a bug (for which a bugfix exists ?) in the smtpd or what ? BTW: Running SuSE-Linux 6.0 TIA. --- Stephan

3 2

UUCP and Kernel 2.2.5
by suse＠hsan.hh.schule.de 29 Nov '99

29 Nov '99

Hi, I am using SuSE 6.1 and an ISDN connection to WiNShuttle for some weeks now. Last week I realised a problem with UUCP. The connect alway runs into 'Time out' after about 400kByte. The transfer rate is less than 1000 Byte. This seems to me very slow. Is there a networking problem in Kernel 2.2.5? With SuSE 5.3 my configuration worked fine. Best Uwe -- **************************************************** * Uwe Debacher Uwe(a)Debacher.de Homepage http://www.debacher.de Tel. 0700-debacher (0700-33222437) * Hamburger Bildungsserver http://lbs.hh.schule.de

1 0

samba-2.0.6-3 and automounting smbfs
by Robert Casties 29 Nov '99

29 Nov '99

Hello! I just found a little error (at least I think it is) in the new samba-2.0.6-3 package. The package supplies an /sbin/mount.smbfs what I think should be called /sbin/mount.smb The problem is that you have to use "-fstype=smbfs" in your automounter map and it ignores "passwd=" and "guest" options. Then you get "Password:" prompts all over the place. That's because smbfs-support is allready built into autofs (I have autofs-3.1.3-48) so it ignores the mount.smbfs script. If you rename mount.smbfs to mount.smb and use "-fstype=smb" it works fine. Or does anyone know how to supply password or guest options to automounts smbfs? Cheers Robert -- Robert Casties --------------------- http://philoscience.unibe.ch/~casties History & Philosophy of Science Tel: +41/31/631-8505 Room: 216 Institute for Exact Sciences Sidlerstrasse 5, CH-3012 Bern Uni Bern (PGP key on homepage: D7 2B DE 64 2D 65 16 A0)

1 0

Re: [suse-security] Possible Hack attack ?
by Eilert Brinkmann 29 Nov '99

29 Nov '99

Jürgen Eder <juergen.eder(a)d33.net> wrote: > I found some entries like: connect from 195.119.130.86 to dump(): > request from unauthorized host As I have some entries with different > IPs, I'm not shure - Is this a hack attack or not ? This message says that someone tried to find out which RPC services (e.g., mountd) are running on your host. (Can be done by hand with the command `rpcinfo -p YOUR.HOST.NAME'). This request was rejected by your portmapper because the remote IP address is not listed in /etc/hosts.allow. Such an attempt may indicate that someone was looking for vulnerable services on your host that can allow him to break into it. This request for it's own is not an actual break in attempt -- that could have been the next step if your host had answered the request. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0

[suse-security] Possible Hack attack ?
by Jürgen Eder 29 Nov '99

29 Nov '99

I found some entries like: connect from 195.119.130.86 to dump(): request from unauthorized host As I have some entries with different IPs, I'm not shure - Is this a hack attack or not ?

1 0

nfs-server bug
by Juergen Hannappel 26 Nov '99

26 Nov '99

Hello, concerning the security hole in the NFS-server (as announced in http://lists.suse.com/archives/suse-security-announce/1999-Nov/0000.html) i wonder if the bug also affects the kmountd, which is used when the kernel based nfs server is used? Greetings, Juergen -- Dr. Juergen Hannappel Office: W148 Phone: +49 228 73 2447 FAX +49 228 73 7869 mailto:hannappe@lisa2.physik.uni-bonn.de Physikalisches Institut der Uni Bonn http://lisa2.physik.uni-bonn.de/~hannappe Nussallee 12, D-53115 Bonn, Germany CERN: Phone: +412276 76461 Fax: 77930 Bat. 892-R-A13 F-01631 CERN CEDEX, France

1 0

why do they scan port 31337?
by alex medvedev 26 Nov '99

26 Nov '99

hi, i am often scanned on the port 31337. why? thanks, -alexm the bandwidthwaister

5 4

Re: why do they scan port 31337?
by Jochen Lillich 25 Nov '99

25 Nov '99

Stu Green <stugreen(a)inetport.com> writes: > > i am often scanned on the port 31337. > > why? > That's where Back Orifice defaults to. "31337" reads "ELEET" (elite) in hacker writing. Best regards, Jochen -- *** Linux BBS: Die deutsche Website fuer Linux-News und -Infos *** http://www.linuxbbs.org/

1 0

bug in /usr/bin/find ?
by Vladimir Kukuruzovic 25 Nov '99

25 Nov '99

Hi This is very odd: (suse 6.2 - updated from 6.0) kuki@c00l:~ > pwd /home/office/kuki kuki@c00l:~ > find /home/office/kuki/ -name linux-* -print /home/office/kuki/linux-animation.html kuki@c00l:~ > find /home/office/kuki/dl/ -name linux-* -print kuki@c00l:~ > cd dl kuki@c00l:~/dl > find /home/office/kuki/dl/ -name linux-* -print /home/office/kuki/dl/linux-2.3.28.tar.bz2 kuki@c00l:~/dl > cd .. kuki@c00l:~ > find . -name linux-* -print ./linux-animation.html kuki@c00l:~ > cd dl kuki@c00l:~/dl > find . -name linux-* -print ./linux-2.3.28.tar.bz2 kuki@c00l:~/dl > if I try find /home -name linux-* -print the program finds it. It also succedes if I use path /home/office On suse 6.0 this works ok Regards, Vladimir

2 1

find with * :)
by Vladimir Kukuruzovic 24 Nov '99

24 Nov '99

Thanx to all for very quick answer :) Regards, Vladimir

1 0

Re: [linux-security] Ipchains
by Martin P. Peikert 24 Nov '99

24 Nov '99

On Mon, 22 Nov 1999 Notedite Nada wrote: > >Hi- > >I heard about a bug in ipchains, could you please tell me what to do? >Thanks > > Hi, on the bugtraq archives (bugtraq id: 543) one can find: # BEGIN BUGTRAQ Linux IPChains Fragment Overlap Vulnerability: This patch was provided with the DataProtect advisory posted to BugTraq on July 27, 1999. The solution was incorporated into the 2.2.11 kernel, released in August 1999. *** linux.old/net/ipv4/ip_fw.c Wed Jun 9 05:33:07 1999 --- linux/net/ipv4/ip_fw.c Fri Jul 23 19:20:45 1999 *************** *** 37,42 **** --- 37,45 ---- * 19-May-1999: Star Wars: The Phantom Menace opened. Rule num * printed in log (modified from Michael Hasenstein's patch). * Added SYN in log message. --RR + * 23-Jul-1999: Fixed small fragment security exposure opened on 15-May-1998. + * John McDonald <jm(a)dataprotect.com> + * Thomas Lopatic <tl(a)dataprotect.com> */ /* *************** *** 644,650 **** default: size_req = 0; } ! offset = (ntohs(ip->tot_len) < (ip->ihl<<2)+size_req); } src = ip->saddr; --- 647,666 ---- default: size_req = 0; } ! ! /* If it is a truncated first fragment then it can be ! * used to rewrite port information, and thus should ! * be blocked. ! */ ! ! if (ntohs(ip->tot_len) < (ip->ihl<<2)+size_req) ! { ! if (!testing && net_ratelimit()) { ! printk("Suspect short first fragment.\n"); ! dump_packet(ip,rif,NULL,NULL,0,0,0,0); ! } ! return FW_BLOCK; ! } } src = ip->saddr; # END BUGTRAQ So, if you have a kernel >= 2.2.11 you are not vulnerable to the "Linux IPChains Fragment Overlap Vulnerability". If your kernel is <2.2.11, update or patch your sources and build a new one. I hope that helps. Regards, Martin -- ---------------------------------------------------- Martin Peikert EN 636 Fachgebiet Theoretische Elektrotechnik TU Berlin Sekretariat EN 2 fon 314-23881 fax 314-22284 http://www-tet.ee.tu-berlin.de/peikert/index.html ----------------------------------------------------

2 1

geheimnis
by george steward 24 Nov '99

24 Nov '99

Hi all, I've just installed gnupg-version 1.0.0 (http://www.gnupg.org) and have being trying to install geheimnis-version 0.90 (http://members.home.com/cdwiegand/geheimnis) to use with my kde desktop-version 1.1.2 (http://www.kde.org). Problem is that './configure' is unable to find my 'x includes' even when I specify them with the suggested options: ./configure --x-includes=/usr/include/X11/ --x-libraries=/usr/lib/X11/ I found their locations using 'whereis X11' and they definetely contain files but './configure' fails with: 'checking for X... configure: error: Can't find X includes. Please check your installation and add the correct paths!' I am running SuSE 6.2 and X runs perfectly and so does kde. I've also used rpm to uninstall qt2.0.1 and installed both the main and development rpm packages for qt1.4.4 as required in the geheimnis 'INSTALL' It looks as if I'm doing something wrong with the 'x-include' and 'x-libraries' paths but what? Can anyone give me a file name from each location that I can search for on my system just in case the above paths don't contain them and they have in fact been moved somewhere else on my system, please?

4 3

thanks
by Chrissy LeMaire 23 Nov '99

23 Nov '99

thanks for all who offered webmail solutions.. I went with Endymion's Mailman for various reasons (boy was it easy to setup. Its pretty much 1 cgi file and some graphics). I've heard Roxon is a super great httpd, but I dont have the time and energy to switch from Apache at this moment ;) Now to find the time for SSL...... :/ Thanks again Chrisy

1 0

Re: [suse-security] nfs-exports ro are writeable
by tschweikle＠FIDUCIA.de 23 Nov '99

23 Nov '99

Lutz.Jaenicke(a)aet.TU-Cottbus.DE wrote: > On Tue, Nov 23, 1999 at 11:19:21AM +0100, tschweikle(a)FIDUCIA.de wrote: >... >> That is correct, while the 'w' reflects only the state >> of the 'w' bit on the reomte fs. Not the permission it >> is exported with. >> >>> Please make also sure, that you understand the concept of root->nobody >>> mapping when using NFS. >> >> /usr isn't writable localy by 'nobody'. Shouldn't be >> writable by 'nobody' mounted remote. > > Indeed. > > So, let's try to reproduce: I have SuSE 6.2 with the latest nkita-patch: > /usr**(ro) > (more export points listed below this entry...) > > NFS-Client is HP-UX 10.20: > # mount -F nfs XXXXXX:/usr /tmp_mnt > # mkdir /tmp_mnt/xyz > mkdir: cannot create /tmp_mnt/xyz: Read-only file system > # umount /tmp_mnt > > Sorry, I don't have a Linux client available in the moment. > > (remove /usr line from /etc/exports; /sbin/init.d/nfsserver stop ; > /sbin/init.d/nfsserver start ). > # mount -F nfs XXXXXX:/usr /tmp_mnt > XXXXXX:/usr: access denied > secured again. > > Best regards, Tryed it out with SuSE 6.2 new, clean system: Vulnerable. You are allowed to write to a ro exported fs. Applied latest nkit_a-patch. you are not vulnerable any more. ro exported fs isn't writeable. Thus I upgraded all servers to the latest nkit_a-patch. Thanks for all your help! -- Thomas

1 0

Re: [suse-security] nfs-exports ro are writeable
by tschweikle＠FIDUCIA.de 23 Nov '99

23 Nov '99

Lutz.Jaenicke(a)aet.TU-Cottbus.DE wrote: > On Tue, Nov 23, 1999 at 10:18:29AM +0100, tschweikle(a)FIDUCIA.de wrote: >> We found out, that nfs exports may be writeable. Exports file: >> >> /home (rw,no_all_squash,no_root_squash) >> /usr (ro) >> >> On a remote machine as root: >> >> mount -t nfs myserver:/usr /mnt >> md /mnt/xyz >> ll -d /mnt/xyz >> drwx------ 6 root root 1024 Nov 22 13:26 xyz >> >> rm -rf /mnt/xyz >> ll -d /mnt/xyz >> drwx------ 6 root root 1024 Nov 22 13:26 xyz Arrgh! This should have been: ls: x: Datei oder Verzeichnis nicht gefunden Just copied the wrong line! Excuse! >> Shouldn't be, shouldn't it? >> >> System: SuSE 6.2, no fixes or patches applied. > > What is the problem? You tried to delete it With the example above I had the right to create it... what schouldn't be possible for a fs exported ro either. > and it is still there, so > you could not write. You ommited any kind of messages possibly generated > during the rm -rf procedure. There are no messages - no messages are good news. Meaning no errors. > That "w" is displayed in the list of rights > does not mean, that you really can do it :-) You can also burn a CD with > the "w" bit sets and it will be nevertheless really difficult to write :-) That is correct, while the 'w' reflects only the state of the 'w' bit on the reomte fs. Not the permission it is exported with. > Please make also sure, that you understand the concept of root->nobody > mapping when using NFS. /usr isn't writable localy by 'nobody'. Shouldn't be writable by 'nobody' mounted remote. -- Thomas

2 1

nfs-exports ro are writeable
by tschweikle＠FIDUCIA.de 23 Nov '99

23 Nov '99

Hi! We found out, that nfs exports may be writeable. Exports file: /home (rw,no_all_squash,no_root_squash) /usr (ro) On a remote machine as root: mount -t nfs myserver:/usr /mnt md /mnt/xyz ll -d /mnt/xyz drwx------ 6 root root 1024 Nov 22 13:26 xyz rm -rf /mnt/xyz ll -d /mnt/xyz drwx------ 6 root root 1024 Nov 22 13:26 xyz Shouldn't be, shouldn't it? System: SuSE 6.2, no fixes or patches applied. -- Thomas

2 1

Web based email
by Chrissy LeMaire 23 Nov '99

23 Nov '99

Anyone have any recommendations for a secure web-based email program? I use APOP authentication, so I'm running into a bit of a problem.. I may have to go back to regular Password authentication program :| If you've had good experiences with any web based email programs (hopefully, something quick to setup), please let me know about it. *random info* I only have 5 friends who use the service.. so the load isnt really an issue (my machine is a 166 with 32 megs of sdram)..

3 2

Attempts at an old hack...
by Karsten Johansson 22 Nov '99

22 Nov '99

Does everyone on this list get these lame-brain email attempts at hacks from days-gone-by? Sheez. The hack is some years old. Does it still work anywhere? I just wonder why anyone would even try repeatedly if it didn't work the first time... I just keep getting the bounce messages from the suse bot. ______________________________________________________ Get your free web-based email at http://www.xoom.com Birthday? Anniversary? Send FREE animated greeting cards for any occasion at http://greetings.xoom.com

1 0

Re: [suse-security] Help, my system has been hacked!
by E_u_R_Frohne＠t-online.de 21 Nov '99

21 Nov '99

Hello, the problem I had could be solved with your help. I would like to thank everyone who answered me. It was a workstation not properly set up for DHCP while no DHCP-Server is in my Network. Once again :Thank you! Regards Rainer

1 0

SuSE Security Announcement - syslogd (a1)
by Thomas Biege 18 Nov '99

18 Nov '99

-----BEGIN PGP SIGNED MESSAGE----- _____________________________________________________________________________ SuSE Security Announcement - syslogd (a1) Package: syslogd-1.3.33 (a1) Date: Thu Nov 18 14:00:29 CET 1999 Affected SuSE versions: 6.2 and 6.3 Vulnerability Type: local denial-of-service attack SuSE default package: yes Other affected systems: all Linux systems using the syslog daemon ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The syslogd server uses a Unix Domain stream socket (/dev/log) for receiving local log messages via syslog(3). Unix Domain stream sockets are non connection-less, that means, that one process is needed to serve one client. 2. Impact By opening alot of local syslog connections a user could stop the system from responding. 3. Solution Updated the package from our FTP server. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: c9a9e0f8fc4e29daf30f8a735ae333ab syslogd-1.3.33-9.alpha.rpm (AXP, 6.1) 3104e26a8b474e215ed703b7c4d48888 syslogd-1.3.33-9.i386.rpm (x86, 5.3) a13be12a75232f2f62f51fb1cae26fc0 syslogd-1.3.33-9.i386.rpm (x86, 6.1) fc29df9455288f40eb1e8dbd0f47d5b3 syslogd-1.3.33-9.i386.rpm (x86, 6.2) 869b7fedd5b52807f12b7f66e282002c syslogd-1.3.33-9.i386.rpm (x86, 6.3) ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/syslogd-1.3.33-9.alpha.rpm ftp://ftp.suse.com/pub/suse/i386/update/5.3/a1/syslogd-1.3.33-9.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/syslogd-1.3.33-9.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/syslogd-1.3.33-9.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/syslogd-1.3.33-9.i386.rpm or try the following web pages for a list of mirrors: http://www.suse.de/de/support/download/ftp/inland.html http://www.suse.de/de/support/download/ftp/ausland.html Our webpage for patches: http://www.suse.de/de/support/download/updates/index.html Our webpage for security announcements: http://www.suse.de/de/support/security/index.html If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBODQEOney5gA9JdPZAQG+owf/QKgKybnaz14TyH4A9kjydx/9ibPGkv3p wdcdPJi/7/OWrGEjbh1zgLqnkvUWBnD/Z3jgiDpwxnCuokQ4AvX/pgaDJOYGO/oe dVT6jg/e38HwP6lCVEmg8DvCBG7SbV7w3DW5b9Yv/c3xSvX9iEJ1RZxUpsqgPBfZ 1eHaRTtEklmeSItei3y7YfU/yqogKA11k0ozDH/5E95mwhbEl8OtwolDlWDc5fYb v5ySeXf+uk/2zqoDQ2g/nwOHs6bitRFbgnA0wD1UHxIqh/9cBd8xvXOKStw9hwax r/XyMfKbsksg8SC58DaAzSmDMAjwwaHdw4Xh81Lf0smfVZtq/eG0pA== =WZQd -----END PGP SIGNATURE-----

1 0

Re: [suse-security] SuSE ssh Distro in US
by Eilert Brinkmann 17 Nov '99

17 Nov '99

"Aaron K. Poffenberger" <I_hate_spam.akp(a)hypernote.com> wrote: > On a related note (security), two questions: 1) Do I need to have the > ident daemon on port 113 running? That port is currently open on the > external interface on my firewall. No. None of the usual services depends on the ident daemon. > And 2) from within inetd.conf, can I > set which interface(s) I want a particular service to bind to, or is it a > service-by-service config (as I've found with many, e.g., afpd)? AFAIK inetd always binds to all interfaces. Perhaps it's possible to use a wrapper which checks on which interface a connection is coming in -- never tried this. Service-by-service configs will only work for servers running in daemon mode. For inetd-controlled services inetd binds to the ports/interfaces, and inetd doesn't know about any service-specific configuration. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

7 6

Re: [suse-security] Re: identd (was: SuSE ssh Distro in US)
by Aaron K. Poffenberger 17 Nov '99

17 Nov '99

I like this group -- lots of good information (I decided to disable it). Thanks. --Aaron On 11/17/99 12:30, eilert(a)Informatik.Uni-Bremen.DE wrote: >Robert Casties <robert.casties(a)philo.unibe.ch> wrote: >> I second that. The tcp-wrapper can also be configured to only accept >> connections from hosts running ident. > >It's possible, but it will exclude many clients. I.e., users on >non-UNIX hosts (and on many UNIX hosts, too) will not be able to >access the service. There may be situations where this doesn't matter, >but for typical public FTP or web servers this seems inappropriate to >me. > >> In priciple you may have an interest yourself using ident because it makes >> it possible to find out which user on an specific machine is using a >> connection. In case of a breakin attempted from your machine it is >> possible to find the user account used to do it. > >In many cases, e.g. on hosts on which usually aren't many users logged >in simultanously, it's probably possible to identify the account by >other means (wtmp entries etc.). For private hosts with dialup >connections identd answers are completely meaningless. But, yes, I can >think of such situations where identd can be useful to identify >attackers. And in some environments the use of identd may make it a >little less simpler to spoof the sender of emails etc., but it's no >real protection. IMHO identd is of little use in most cases, >especially on dialup hosts. > >On the other hand identd can be a privacy issue, e.g., web servers can >use it to identify and track visitors. (There are a lot of other means >to achive this.) Theoretically it can be possible to conclude from an >identd reply (the user name) to the e-mail address of the user in some >cases. I don't know if this is done, and probably this method won't be >very efficient. However, I suppose that most web servers issuing >identd requests don't do this (only) for security reasons. > >> The ident answer can of >> course be spoofed and you might be liable anyway for things going on on >> your machine... > >Which means that the ident protocol should never be used for "secure" >authentication. However, it can be used for logging purposes, and >there are situations where this might be useful. > >It should not a major security risk to leave port 113 open. But I >don't see a great security improvement through identd in most >situations, that's why I tend to disable it. It can also be a solution >to restrict identd access to specific hosts/domains where it is >needed. > >Eilert >-- >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik >eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com > http://www.informatik.uni-bremen.de/~eilert/ > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

bind 4 upgrade
by peter＠frontierflying.com 17 Nov '99

17 Nov '99

I applied the SuSE 6.1 bind 4 upgrade to our 6.0 installation as per the instructions. Now my daemon.log is filled with entries like this Nov 15 10:21:14 hangar named[11230]: ns_forw: query(pop.frontierflying.com) cont ains our address (HANGAR.FRONTIERFLYING.COM:209.193.9.208) learnt (A=128.63.2.53 :NS=128.63.2.53) Nov 15 10:38:58 hangar named[11230]: ns_forw: query(frontierflying.com) contains our address (HANGAR.FRONTIERFLYING.COM:209.193.9.208) learnt (A=128.63.2.53:NS= 128.63.2.53) Nov 15 10:50:11 hangar named[11230]: ns_forw: query(mail.frontierflying.com) con tains our address (HANGAR.FRONTIERFLYING.COM:209.193.9.208) learnt (A=128.63.2.5 3:NS=128.63.2.53) Nov 15 11:03:29 hangar named[11230]: ns_forw: query(frontierflying.com) contains our address (HANGAR.FRONTIERFLYING.COM:209.193.9.208) learnt (A=128.63.2.53:NS= 128.63.2.53) Nov 15 11:36:21 hangar named[11230]: ns_forw: query(payroll.frontierflying.com) contains our address (HANGAR.FRONTIERFLYING.COM:209.193.9.208) learnt (A=128.63. 2.53:NS=128.63.2.53) Nov 15 11:53:23 hangar named[11230]: ns_forw: query(kahuna.frontierflying.com) c ontains our address (HANGAR.FRONTIERFLYING.COM:209.193.9.208) learnt (A=128.63.2 .53:NS=128.63.2.53) I am also having problems with nslookup being unable to get the name of our name server root@hangar:/etc > nslookup *** Can't find server name for address 209.193.9.208: Server failed Default Server: husky.ptialaska.net Address: 209.193.30.245 I can force it to go back and use our primary name server but again this is new behavior since the bind 4 upgrade. Any ideas? Thank you peter peter stern Frontier Flying Service Inc. Network Administrator 5245 Airport Industrial Rd 907-474-1739 x249 Fairbanks AK 99709

1 0

Re: [suse-security] Re: identd (was: SuSE ssh Distro in US)
by Eilert Brinkmann 17 Nov '99

17 Nov '99

Robert Casties <robert.casties(a)philo.unibe.ch> wrote: > I second that. The tcp-wrapper can also be configured to only accept > connections from hosts running ident. It's possible, but it will exclude many clients. I.e., users on non-UNIX hosts (and on many UNIX hosts, too) will not be able to access the service. There may be situations where this doesn't matter, but for typical public FTP or web servers this seems inappropriate to me. > In priciple you may have an interest yourself using ident because it makes > it possible to find out which user on an specific machine is using a > connection. In case of a breakin attempted from your machine it is > possible to find the user account used to do it. In many cases, e.g. on hosts on which usually aren't many users logged in simultanously, it's probably possible to identify the account by other means (wtmp entries etc.). For private hosts with dialup connections identd answers are completely meaningless. But, yes, I can think of such situations where identd can be useful to identify attackers. And in some environments the use of identd may make it a little less simpler to spoof the sender of emails etc., but it's no real protection. IMHO identd is of little use in most cases, especially on dialup hosts. On the other hand identd can be a privacy issue, e.g., web servers can use it to identify and track visitors. (There are a lot of other means to achive this.) Theoretically it can be possible to conclude from an identd reply (the user name) to the e-mail address of the user in some cases. I don't know if this is done, and probably this method won't be very efficient. However, I suppose that most web servers issuing identd requests don't do this (only) for security reasons. > The ident answer can of > course be spoofed and you might be liable anyway for things going on on > your machine... Which means that the ident protocol should never be used for "secure" authentication. However, it can be used for logging purposes, and there are situations where this might be useful. It should not a major security risk to leave port 113 open. But I don't see a great security improvement through identd in most situations, that's why I tend to disable it. It can also be a solution to restrict identd access to specific hosts/domains where it is needed. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0

ipchains and masquerading (fwd)
by Thomas Biege 17 Nov '99

17 Nov '99

Hi Rene, please subscribe to suse-security mailinglist. I'll fwd. your question to this list. Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47 ---------- Forwarded message ---------- Date: Wed, 17 Nov 1999 11:49:08 +0100 From: Rene Bangemann <rbrabe(a)wvr.tfh-wildau.de> To: Thomas Biege <thomas(a)suse.de> Subject: ipchains and masquerading Hi, I´m using S.u.S.E. Linx 6.1 with ipchains as a firewall. I´ve got a problem using ftp through the firewall from a private network using IP´s 192.168.x.x. If I connect to an ftp-Server I can login, but if I use commands like "ls" (which is using the PORT Command) I always get error 500 ("500 Invalid PORT Command. ftp: bind: Address already in use") or 501 ("501 IP Address for data destination doesn't match client's. ftp: bind: Address already in use"). This happens only, if masquerading is used. If I use ftp from a computer which got a official IP, everything works fine. Does anyone got an idea or a solution of this problem?? Thx in advance for your help. Rene P.S.: port number 20 and 21 are open to outwards.

3 2

bind8
by Oliver Leue 17 Nov '99

17 Nov '99

hi .... while i updatet yesterday the actual bind8 from ftp.suse i'm missing now nslookup and dig and something else. i can't find it now on the system. it looks like it was deleted. someone else too? gruß oliver -------------------------------------------- E-Mail: Oliver Leue <artus-ol(a)gmx.net> Date: 17-Nov-99 Time: 12:47:53 This message was sent by XFMail/Linux 2.2.10 --------------------------------------------

4 4

rplayd
by Security Webmaster OKDesign oHG 17 Nov '99

17 Nov '99

Hi, I recently found some of the following messages in my /var/log/messages: Nov 14 23:29:10 server2 rplayd[9800]: connect from xxx.xxx.xxx.xxx Nov 14 23:29:10 server2 rplayd[9800]: error: cannot execute /usr/sbin/rplayd: No such file or directory What daemon is rplayd ? Is this some kind of breakin-attempt ? I never had such a message before. Thanks in advance for your help. --- Stephan

3 2

SuSE Security Announcement - bind
by Marc Heuse 17 Nov '99

17 Nov '99

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: bind8 < 8.2.2p2 + bind4 < 4.9.7-REL Date: Fri, 12 Nov 1999 01:56:04 GMT Affected SuSE versions: all Vulnerability Type: remote root compromise, denial of service SuSE default package: yes (not activated by default) Other affected systems: all unix systems using bind8 ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description Several vulnerabilities were found within bind4 and bind8. 2. Impact All bind4 and bind8 versions can be crashed in certain circumstances. bind8 8.2 until 8.2.1 can be compromised remotely through a buffer overflow. 3. Solution Updated the package from our FTP server. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: (For SuSE 6.0, please use the 6.1 updates) 76afbb91c001880687e47f4dc0404807 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/bind8-8.2.2-8.alpha.rpm a5f453329a023221476143956cf11b2d ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/bindutil-8.2.2-8.alpha.rpm f510a224c9f45014853c128bb0f0d0da ftp://ftp.suse.com/pub/suse/i386/update/5.3/n1/bind-4.9.7-101.i386.rpm 1e6234a05cbe7dd3c4e207743d3b4f6f ftp://ftp.suse.com/pub/suse/i386/update/5.3/n1/bind8-8.2.2-8.i386.rpm 036fbc51c9902f7fe5cba1db5ef171e0 ftp://ftp.suse.com/pub/suse/i386/update/5.3/n1/bindutil-8.2.2-8.i386.rpm bca65a23d1e6ffe284956549e8eda731 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/bind-4.9.7-101.i386.rpm d0bb5a9d2e4a0bb918856681828d677a ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/bind8-8.2.2-8.i386.rpm 23a77b3103ce7cae0003d632a228ce87 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/bindutil-8.2.2-8.i386.rpm 3a69c1344e970d1edb580420614d052f ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/bind-4.9.7-101.i386.rpm e621dff7568fc5a6933e19df40283d0a ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/bind8-8.2.2-8.i386.rpm e3c23546e73f3cffeea662c9de953d99 ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/bindutil-8.2.2-8.i386.rpm ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update for Intel processors ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/patches/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBODA5eney5gA9JdPZAQFLrQf/X1rtLhCY/LsaT/vhqe3NcgfUQ5hU1RUg yNpJGanWMafehZDQzAd/z7Uh92rGOmIqBKbDKKRV2CBuNPuyQZOrmrQLIjVtpdqA Jh1HLzWcPoyleFpXj7WLBuKogRLNG5b28QBffhAfP0tGRsCA3qZivTEfO7BKjqFY bDd/jqiywGhw3iobwi3uqi3D3MBdkjLhpmxZdtjU2hTSyVPYytkI90CeezdSkL+Z iI3AVW7OOQbRL0Jf1AfxyyGRMHb9AWfMEasusmEQeHgyokLrRt3OSAHvLqCDWH39 E2uA8C+91yNwmSzWlTfuWDCZ3EaSNSOOqpTBDy3gKwqEM+8jDto82g== =OT4w -----END PGP SIGNATURE-----

4 3

unsubscribe cguillen2@prcnet.com
by Guillen, Carlos 17 Nov '99

17 Nov '99

unsubscribe cguillen2(a)prcnet.com

1 0

MS-Exchange Folders convert to LINUX-Files ?
by MichaelRoth＠schmuecker.de 17 Nov '99

17 Nov '99

Hi, is there any way to convert the "Public Folders" from MS-Exchange-Servers (--> Outlook-Clients) to "Linux-Files" ? I am planning a security-Intranet with Apache-Webserver (i want to abolish the MS-NT-Server; it has to many sec. holes) Regards Michael J. Roth ************************************************************************ Schmücker & Partner GmbH Telefon 069/57005-421 Lurgiallee 14 Telefax 069/57005-800 60439 Frankfurt Mobil 0171/3213343 HTTP://www.schmuecker.de MichaelRoth(a)schmuecker.de ***********************************************************************

5 4

ipchains and masquerading
by Rene Bangemann 17 Nov '99

17 Nov '99

Hi, I´m using S.u.S.E. Linx 6.1 with ipchains as a firewall. I´ve got a problem using ftp through the firewall from a private network using IP´s 192.168.x.x. If I connect to an ftp-Server I can login, but if I use commands like "ls" (which is using the PORT Command) I always get error 500 ("500 Invalid PORT Command. ftp: bind: Address already in use") or 501 ("501 IP Address for data destination doesn't match client's. ftp: bind: Address already in use"). This happens only, if masquerading is used. If I use ftp from a computer which got a official IP, everything works fine. Does anyone got an idea or a solution of this problem?? Thx in advance for your help. Rene P.S.: port number 20 and 21 are open to outwards.

3 2

Re: [suse-security] Re: identd (was: SuSE ssh Distro in US)
by Eilert Brinkmann 17 Nov '99

17 Nov '99

"Torsten Behle" <tbehle(a)fcb-wilkens.com> wrote: > > This is not totally correct. I had port 113 disabled (&logged) a long > > time. I got denys during FTP transfers nethertheless FTP worked. > > But there are some FTP-Servers, which need the port open, else no > > connection will be made. > > I think the question also involved: If *yes*, how secure is it? > (And: If *not secure*, is there a way to secure it?) > Does anyone have information on that? It's totally insecure. The results of an identd request are only as trustworthy as the host running the identd. And usually you can't trust any foreign host. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0

Re: [suse-security] SuSE ssh Distro in US
by Eilert Brinkmann 17 Nov '99

17 Nov '99

"Leopold Toetsch" <lt(a)toetsch.at> wrote: > > No. None of the usual services depends on the ident daemon. > > This is not totally correct. I had port 113 disabled (&logged) a long > time. I got denys during FTP transfers nethertheless FTP worked. > But there are some FTP-Servers, which need the port open, else no > connection will be made. I agree, a server can be implemented that way. (I saw this with the finger service on some hosts, too.) But this is not part of any standard (FTP, HTTP, ...) and will exclude *many* clients. You will hardly find an identd on non-UNIX platforms, and even many UNIX/Linux hosts are run with identd disabled. Therefore, IMHO in general it's a very bad idea to implement such a "feature". (Maybe there are exceptions in some very special cases.) Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0

RE: [suse-security] MS-Exchange Folders convert to LINUX-Files ?
by Freudenberger Joerg 17 Nov '99

17 Nov '99

Hallo Miteinander Leider ist die bei Freashmeat angegebenen Adressen Download: http://www.halcyon.com/mango/mstons/MsToNs-1.0.tar.gz Homepage: http://www.halcyon.com/mango/mstons/ nicht mehr existent. Dummerweise auch keine Treffer in den üblichen Software-Suchmaschinen. Gruß Jörg > Try "MSToNS": MsToNs will convert your Microsoft Outlook Express and > Internet Mail e-mail folders to Netscape e-mail folders. Using Outlook > Express you can convert Outlook 9X and other e-mail formats as well. > http://freshmeat.net/appindex/1998/09/13/905661610.html Bye, LenZ

1 0

SuSE ssh Distro in US
by Aaron K. Poffenberger 17 Nov '99

17 Nov '99

Hello, I'm running SuSE 6.1 and would like to find a SuSE rpm for ssh. I live in the US. Any help would be appreciated (not to mention war stories and gotchas). --Aaron ------------ I am a man; nothing human is alien to me. --Terence Remove Anti-Spam before mailing.

3 2

SuSE Security Announcement
by Thomas Biege 17 Nov '99

17 Nov '99

-----BEGIN PGP SIGNED MESSAGE----- _____________________________________________________________________________ SuSE Security Announcement - thttpd Package: thttpd 1.90a - 2.04 Date: Tue Nov 16 19:44:14 CET 1999 Affected SuSE versions: 6.2 and 6.3 Vulnerability Type: remote compromise SuSE default package: no Other affected systems: all unix systems using the thttpd-server ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The thttpd web server doesn't do proper bounds checking in the date parsing function tdate_parse(). 2. Impact By overflowing a static buffer in tdate_parse() an attacker could remotely execute commands on the thttpd host with the permissions of thttpd. 3. Solution Updated the package from our FTP server. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: 160a166713f186a61b2111c45786e26a thttpd-2.04-31.i386.rpm (6.2) 4eb85acb72a30873842257cd923f9332 thttpd-2.04-31.i386.rpm (6.3) ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/thttpd-2.04-31.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/thttpd-2.04-31.i386.rpm or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/de/support/download/updates/index.html Our webpage for security announcements: http://www.suse.de/de/support/security/index.html If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBODJYZHey5gA9JdPZAQHpqggAgZ4iA4ffpWsVUClNkvGRBT/8z1RjG5cw jsrtp5C3vM2WQpY91cr6mfYFPavt8vv6kUDQSTPK+FU6M31jjhGyxRx7a6lmukDU dn01HMYFN5xiI9WQRn/8FxVjcVQsJV72b3Q/doEiqZpmcJ2/68E9HYFcxVLu2RAK 4pYx5pX69krDwZGrDYPryPdcDch1iUIA7/cmdTC6zRzp8rS4toahE7rOqeMmLLov 3gBYkFY6HyjHPhl8g+/FcMX7kgYajFfSjlnXLVz0ZxogR73iAvLgBXCAKWF3xqkk Jbrk5nfOx5jYhhbr656R1r/EABZJjfMDVIMVtwWhKktDSp3KjRjHdw== =WVr2 -----END PGP SIGNATURE-----

1 0

Re: [suse-security] SuSE ssh Distro in US
by Aaron K. Poffenberger 17 Nov '99

17 Nov '99

Thanks for all the responses helpful responses. On a related note (security), two questions: 1) Do I need to have the ident daemon on port 113 running? That port is currently open on the external interface on my firewall. And 2) from within inetd.conf, can I set which interface(s) I want a particular service to bind to, or is it a service-by-service config (as I've found with many, e.g., afpd)? Thanks, --Aaron On 11/16/99 17:37, draht(a)uni-freiburg.de wrote: >> >> Hello, >> I'm running SuSE 6.1 and would like to find a SuSE rpm for ssh. I live >> in the US. Any help would be appreciated (not to mention war stories and >> gotchas). >> >> --Aaron > >rpm -ihv >ftp://ftp.uni-freiburg.de/pub/linux/mirrors/suse/6.1/i386.de/suse/sec1/ssh >.rpm > >is your friend. > >Roman. >-- > _ _ >| Roman Drahtmüller "Caution: Cape does not | > CC University of Freiburg enable user to fly." >| email: draht(a)uni-freiburg.de (Batman Costume warning label) | > - - >People often find it easier to be a result of the past than a cause of >the future. > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

Permissions for /var/spool/lpd ?
by Robert Casties 16 Nov '99

16 Nov '99

Hello! What exactly has changed in lprold-3.0.44-0 concerning file permissions? I had no problems using the earlier version that came with SuSE 6.2 but when I upgraded to the new package I got messages in syslog like Nov 3 17:36:13 hera lpd[12495]: restarting lp Nov 3 17:36:13 hera lpd[12495]: lp: status: Permission denied and printjobs got stuck in the queue. Upon some experimentation I changed the permissions for the lpd directory to group writable and this seemed to help: hera:~ # ll /var/spool/lpd/ total 4 drwxr-xr-x 3 lp lp 1024 Nov 3 17:27 . drwxr-xr-x 16 root root 1024 Sep 6 18:26 .. drwxrwxr-x 2 lp lp 1024 Nov 5 16:41 drucker -rw-r--r-- 1 root root 6 Nov 3 20:32 lpd.lock I still don't have a good feeling about this solution. Can anyone explain the problem and is there any better solution? Cheers Robert -- Robert Casties --------------------- http://philoscience.unibe.ch/~casties History & Philosophy of Science Tel: +41/31/631-8505 Room: 216 Institute for Exact Sciences Sidlerstrasse 5, CH-3012 Bern Uni Bern (PGP key on homepage: D7 2B DE 64 2D 65 16 A0)

5 7

wu-ftpd fix
by Thomas Biege 16 Nov '99

16 Nov '99

Hi, someone of you told me, that the file perms are to restrictive for uploaded files. I send a patch (appendix) to our maintainer, so watch out for a new RPM. Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

Help, my system has been hacked!
by E_u_R_Frohne＠t-online.de 15 Nov '99

15 Nov '99

Hello, the organisation I work for has a new gateway to the Internet. There is a leased line (Telekom) over a Cisco 1003 which I cannot configure (because the Telekom doesn't allow it. after that there is a DMZ and a Firwall built with the tools that are coming with Suse-Linux 6.2. The organisation is not small and there are severall workstations with Win95 and NT containing ISDN-Cards with a connection to the Internet. In addition to that there are serveral AVM-MPR's running, connecting the network (Novell, Linux NT) to different Cities. The Problem occured on an internal Linux machine (behind the Firewall and DMZ). Here is an excerpt of the log: "Nov 10 13:58:06 bone portmap[4177]: connect from 169.254.118.212 to getport(nfs): request from unauthorized host Nov 10 14:20:33 bone portmap[4265]: connect from 169.254.216.71 to getport(nfs): request from unauthorized host" I could not see anything logged on my firewall and the DMZ, so I think that this is coming over a workstation. Am I true or is it possible to come through the firewall without a trace? Could anyone help me to identify the ip-addresses listed above? I would be very happy if anyone could help me! regards Rainer Frohne

4 3

Logging IPCHAINS separate ?
by MichaelRoth＠schmuecker.de 12 Nov '99

12 Nov '99

Hi all, is there any way to write the logging-output from ipchains to an other file as /var/log/messages ? Greetings, Michael J. Roth **************************************************************************** ************ Schmücker & Partner GmbH Telefon 069/57005-421 Lurgiallee 14 Telefax 069/57005-800 60439 Frankfurt Mobil 0171/3213343 HTTP://www.schmuecker.de MichaelRoth(a)schmuecker.de ***********************************************************************

3 2

SuSE Security Announcement - nfs-server
by Marc Heuse 12 Nov '99

12 Nov '99

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: nfs-server < 2.2beta47 within nkita Date: Fri, 12 Nov 1999 02:12:50 GMT Affected SuSE versions: all Vulnerability Type: remote root compromise SuSE default package: yes (not activated by default) Other affected systems: all linux systems using the nfs-server ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The rpc.nfsd which is part of the nfs-server package was found to have two remote vulnerabilities. 2. Impact Via a buffer overflow, remote root access can be achieved. Write access to the local filesystem which is exported is necessary. Another security problem are improper root_sqash export handlings. 3. Solution Updated the package from our FTP server. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: f03592bc738b6fa5cfa2f3a21250125a ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/nkita-99.11.11-0.alpha.rpm c4fd6ad2029165a14e26140c56c64a06 ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/nkita-99.11.11-0.i386.rpm 75c7b4aa20d13f4b81428013690fbf3f ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/nkita-99.11.11-0.i386.rpm ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update for Intel processors ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/patches/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOCxSlney5gA9JdPZAQEUbgf/ZhcxgxXlrIcEZnFEtiWsRqrr6qRB9jyD uV4SqRTUa6ywdO9ZWsQIAvHXI2siTaUea99CJFkDxmNIWgz9Zg2WtiUa4nvKscQv jWV7yBxBvnpZVkFfZmm7X9Lo3vQgf3+6uocy+NAoiKsLWISazUY7rdahxgE3gEAY qFN3cP9B2ABtrTuLcUbaGWy57MDuQHEC1MiMv71UtkGSkX12OtMfrSIG5IXTdbjs wIkMj0KKtJNk2W4mWgUk1U2twWXb8ZVzRJwaP1XY2S/yjF898X9FcM6AzQBdBT/3 QVQ1viXvAhvI0k7Cxy6+QALieShi4cIWn8jK6+0S+2wFODohnakC/g== =rVGR -----END PGP SIGNATURE-----

1 0

SuSE is not vulnerable to the SSH overflow
by Marc Heuse 12 Nov '99

12 Nov '99

Hi folks, SuSE is *not* vulnerable to the reasonly found SSH overflow which can result in a root compromise. We don't use the RSA library which has got the bug. Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

3 4

Re: [suse-security] Logging IPCHAINS separate ?
by Martin P. Peikert 12 Nov '99

12 Nov '99

Uuh, sorry, it is /etc/syslog.conf and not /etc/syslogd.conf you have to edit... -- ---------------------------------------------------- Martin Peikert EN 636 Fachgebiet Theoretische Elektrotechnik TU Berlin Sekretariat EN 2 fon 314-23881 fax 314-22284 http://www-tet.ee.tu-berlin.de/peikert/index.html ----------------------------------------------------

1 0

https
by Chrissy LeMaire 12 Nov '99

12 Nov '99

Anyone have a good recommendation for a pre-configured (rpm preferred -- a SuSE rpm would be even better;) for a quick and easy setup of SSL and Apache? I'm using SuSE 6.1 I'm using MindTerm.jar to have quick access to an SSH client via a browser. I'd like to protect the sessions via https.. thanks much Chrissy

3 2

Re: Re: [suse-security] Problems with wu.ftpd
by Holger Schmidt 12 Nov '99

12 Nov '99

> On Thu, 11 Nov 1999, Holger Schmidt wrote: > > > I have problems with ftp. Sometimes when my shellscript is started the ftp > > hangs and the timeout does not work either. There are no error messages in > > /var/log/messages and /var/log/warn. > > > > The script calls the ftp like this: > > (cd /dir1 > > prompt > > mget * > > ) | ftp ftp-proxy > > > > Does anyone have an idea ? > > Ich habe zwar keinen blassen Schimmer, warum Du Englisch schreibst aber > sei's drum... > > Was Du da oben tust, ist, die Kommandos "cd /dir1", "prompt" und "mget > *" lokal in der Shell auszuführen - was vermutlich zu Fehlermeldungen > führt - und den Output in den FTP-Client zu pipen. Du siehst vermutlich > selber ein, dass das nicht das ist, was Du willst. > > Richtig wäre > > echo "cd /dir1\nprompt\nmget *" | ftp ftp-proxy > > oder auch > > ( echo "cd /dir1"; echo "prompt"; echo "mget *" ) | ftp ftp-proxy > > wobei Du Dich noch nicht authentifiziert hättest. > > MfG Henning Hucke Erstemal danke für deine Antwort, aber das Skript funktioniert ja einwandfrei (zu 98% in den letzten 3 Monaten). Nur manchmal bleibt der FTP einfach hängen. Ohne ersichtlichen Grund und ohne eine Fehlermeldungzu zu erzeugen (uns ich lasse schon jeden Sch... mitloggen). Die Authentifizierung erfolgt über .netrc, aber ich denke deine Idee ist auch nicht schlecht. Danke nochmal und ciao Holger -- Sent through Global Message Exchange - http://www.gmx.net

1 0

Re: Re: [suse-security] Problems with wu.ftpd
by Holger Schmidt 12 Nov '99

12 Nov '99

> On Thu, 11 Nov 1999, Holger Schmidt wrote: > > > I have problems with ftp. Sometimes when my shellscript is started the ftp > > hangs and the timeout does not work either. There are no error messages in > > /var/log/messages and /var/log/warn. > > > > The script calls the ftp like this: > > (cd /dir1 > > prompt > > mget * > > ) | ftp ftp-proxy > > > > Does anyone have an idea ? > > Ich habe zwar keinen blassen Schimmer, warum Du Englisch schreibst aber > sei's drum... > > Was Du da oben tust, ist, die Kommandos "cd /dir1", "prompt" und "mget > *" lokal in der Shell auszuführen - was vermutlich zu Fehlermeldungen > führt - und den Output in den FTP-Client zu pipen. Du siehst vermutlich > selber ein, dass das nicht das ist, was Du willst. > > Richtig wäre > > echo "cd /dir1\nprompt\nmget *" | ftp ftp-proxy > > oder auch > > ( echo "cd /dir1"; echo "prompt"; echo "mget *" ) | ftp ftp-proxy > > wobei Du Dich noch nicht authentifiziert hättest. > > MfG Henning Hucke Erstemal danke für deine Antwort, aber das Skript funktioniert ja einwandfrei (zu 98% in den letzten 3 Monaten). Nur manchmal bleibt der FTP einfach hängen. Ohne ersichtlichen Grund und ohne eine Fehlermeldungzu zu erzeugen (uns ich lasse schon jeden Sch... mitloggen). Die Authentifizierung erfolgt über .netrc, aber ich denke deine Idee ist auch nicht schlecht. Danke nochmal und ciao Holger -- Sent through Global Message Exchange - http://www.gmx.net

1 0

Re: [suse-security] SuSE is not vulnerable to the SSH overflow
by Volker Kuhlmann 12 Nov '99

12 Nov '99

> SuSE is *not* vulnerable to the reasonly found SSH overflow which can result > in a root compromise. We don't use the RSA library which has got the bug. Good to know of course, but it would be better to announce this on the suse-security-announce list. That's what it's there for, or? It would be much better if the security-announce list was working like the redhat-watch-list. It tells me what I need to know when I don't have time to follow endless discussions. SuSE's announcement policy was discussed here within the last few days. As an example, I received a CERT advisory re BIND problems at 2:30 this morning. At 9:43, I received a Red Hat security advisory saying "problem, fix" and listing the URL of the rpms to download for update. When will there be something similar from the SuSE announce list? Or is SuSE linux never vulnerable to these things? Hm, one wold have to be somewhat naive to think that. It would be good if SuSE changed their policy accordingly - important things to security-announce. The security list should be expendible. Volker

1 0

Problems with wu.ftpd
by Holger Schmidt 11 Nov '99

11 Nov '99

Hi, I have problems with ftp. Sometimes when my shellscript is started the ftp hangs and the timeout does not work either. There are no error messages in /var/log/messages and /var/log/warn. The script calls the ftp like this: (cd /dir1 prompt mget * ) | ftp ftp-proxy Does anyone have an idea ? Bye Holger -- Sent through Global Message Exchange - http://www.gmx.net

2 1

Re: [suse-security] https
by Chrissy LeMaire 11 Nov '99

11 Nov '99

For all who may be interested: http://www.mindbright.se/mindterm/ At 09:46 PM 11/11/1999 +0100, you wrote: >Can you send me a link (or the *.jar file) please :-) > > >Anyone have a good recommendation for a pre-configured (rpm preferred >-- a > >SuSE rpm would be even better;) for a quick and easy setup of SSL and > >Apache? I'm using SuSE 6.1 > >I'm using MindTerm.jar to have quick access to an SSH client via a >browser. > >I'd like to protect the sessions via https.. > > > >thanks much > >Chrissy > > > >-- > >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

Re: [suse-security] WU-FTPD vunrability
by Omar Al-Sakka 10 Nov '99

10 Nov '99

Gentlmen, Well about this whining, I think the problem is that this mailing list should not be a bugtraq replacment! If you want to know about wuftpd security holes, and patches, then that's where to get them from. Otherwise only SUSE specific stuff should be posted here!! It's a waste of time getting messages that ask about a specific piece of software, when you can go to the software's home page and download the patches yourself!!! AND PS. This happens to be the most sorted out Linux distribution out there, well.. so far! By the power of /sbin/init.d :) May you all live long and prospor...

6 6

updating rpms YOURSELF
by Tyler Durden 10 Nov '99

10 Nov '99

Greetings, As a sysadmin who administers rpm based installations, you should learn to use rpm to build your own updated packages. This is especially important when a security patch is issued, you dont want to be waiting on someone else to release an updated rpm for your distro while your systems stand vulnerable. ------------------- You can find comprehensive resources at www.rpm.org, but just to show how easy it is ( usually ;) ): Install the srpm of the package you want to update: # rpm -i package.srpm If you are using SUSEs rpm setup, the above command put files in 2 directories: /usr/src/packages/SOURCE and /usr/src/packages/SPECS. Into the first directory goes the pristine source tarball and patches for the package. Into the latter, the spec file for the package. Download the update patch, or source tarball and move it into the /usr/src/packages/SOURCE dir. Modify the spec file for the package to build from the new tarball, or patch the existing one. ( Chapter 13 in the 'Maximum RPM' online book has everything you ever wanted to know about spec files. ) Build your new rpm with: # rpm -ba /usr/src/packages/SPECS/package.spec The new rpm file will be located in /usr/src/packages/RPMS ------------------------- sry for the length, thought it might be useful. . SUSE might be pissed that i suggest such a thing, it's a great distro, but i dont count on them for timely security updates, nor should i i'm paying for the distro on disk, that's it ps, use the in.ftpd that came from openbsd if you want a secure ftp service. . nulliFIRE. . ------------------------- selcuk ozturk wrote: > The question was, when would SuSe supply the fixed version. Yes, > I can go get it and compile. But, what's the point of having rpm's > then. If I start compiling and replacing all the packages how much > time will it take the next time I want to do a major system upgrade. __________________________________________________ FREE Email for ALL! Sign up at http://www.mail.com

2 1

Re: [suse-security] WU-FTPD vunrability
by Tim Williams 09 Nov '99

09 Nov '99

I think that Derek has made a VERY important point when he said: >I understand your point, and it is well taken (people should be subscribed >to BugTraq as well), but SuSE should - when a BugTraq item appears in a >SuSE distribution - post something to the effect of: This program is/is-not >affected. The newest RPM with the bugfix (and with any SuSE-specific >patches/enhancements) can be found at <url>. I personally like the SuSE distribution BUT I would really like to know when and where to get the SuSE patch to a known security bug. I have been waiting for such an announcement regarding Proftp for some time. Indeed I could have down loaded the source, compiled it....etc but it would not have had the "SuSE seal of approval" so to speak. I value the expertise at SuSE and I would like to know when THEY release an rpm. So SuSE could you please announce security patches to this group (and where they are located). regards Tim Williams

1 0

Re: [suse-security] WU-FTPD vulnaribility
by Selcuk Ozturk 09 Nov '99

09 Nov '99

Thomas, it seems like the upgraded wu-ftpd 2.4.2 version has a problem. Whatever umask you use all files get created with rw-r---- rights. The 2.6 version seems to work as expected in this regard. Selcuk <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=> < Selcuk Ozturk <+> > < MIS Deputy Director <+> > <=============================<#>===================================> < Phone : (301)883-2482 <+> FDCH > < Fax : (301)883-9754 <+> 1100 Mercantile Lane, Ste 119 > < E-mail : sozturk(a)fdch.com <+> Largo, MD 20774 > <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=>

2 1

WU-FTPD vulnaribility
by Selcuk Ozturk 09 Nov '99

09 Nov '99

Is anybody from Suse reading this list at all or is this for the users to discuss things between themselves? I sent a message to support(a)suse.com about the latest CERT advisory for wu-ftpd. The response was 'please don't send any messages concerning this issue here'. They suggested 'feedback(a)suse.de' and this list here. I wrote to both and after 2 weekes not a peep. I am very disappointed in Suse. From now on, I will never purchase anything from Suse and will try to discourage anybody else from making the same mistake on any public forum I am a participant. Selcuk <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=> < Selcuk Ozturk <+> > < MIS Deputy Director <+> > <=============================<#>===================================> < Phone : (301)883-2482 <+> FDCH > < Fax : (301)883-9754 <+> 1100 Mercantile Lane, Ste 119 > < E-mail : sozturk(a)fdch.com <+> Largo, MD 20774 > <=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=><=>

4 3

Certificate Revocation Lists
by Steven T. Hatton 09 Nov '99

09 Nov '99

I am attempting to design a program that can traverse a certificate revocation list(CRL). I am particularly interested in the CRL provided by Netscape. Netscape provides a signed binary stream. Does anybody have an idea as to how I can crack it open and read the CRL? TIA, Steve

1 0

umask for part of file-system?
by Rupert Koenig 08 Nov '99

08 Nov '99

hi! i'd like to have a special umask for some areas of the filesystem. Unfortunatly it seems that the command <umask> sets a mask only for the whole system. Does anybody know a way to have different permissions applyed to new files and dirs in only a sub-tree of the filesystem? The only method in know until now is running a cronjob which sets the permissions to the right form:( not very nice at all and so slow... cu LaX

2 1

Wvdial
by Bernat Ginard 05 Nov '99

05 Nov '99

Hi all, I want to use the wvdial program to connect to my ISP and I want the program to be run by regular users, but I have a problem, the program insists to change the permissions to /dev/ttyS0 (I suppose that is done by pppd not by wvdial because wvdial is not setuid but pppd is and it happens too when the program is started by a regular user), how can I remove this feature so wvdial can be run as a regular user without make it setuid root? Thanks -- Bernat Ginard Lladó mailto:bernat@kaos.es http://www.kaos.es

2 2

security-bug
by Michael Hamm 04 Nov '99

04 Nov '99

hi, I looking out for documentation of scurity-bugs in old Linux-Software (in Internet-Daemons). Thanx

2 1

[Fwd: Re: [suse-security] WU-FTPD vulnerability?]
by James Myles 01 Nov '99

01 Nov '99

Will someone (at SuSE?) please clarify this. -- Regards, James Selcuk Ozturk wrote: > > Do the 3 vulnerabilities mentioned in the CERT advisory affect SuSe 6.2? > > If so, when will there be an update? >

1 0

ftp
by Frank Dittberner 01 Nov '99

01 Nov '99

how can i disable that a user loged in with ftp to see other directories (like / ), except his home directory and the directories under them. I use wu_ftp version from suse6.2. F. Dittberner

2 1