December 1999 - openSUSE Security - openSUSE Mailing Lists

strange kernel message.
by Mirek Szymczak 13 Dec '99

13 Dec '99

Hello Everybody , Has anyone an idea what this message means? "kernel: eth0: Setting promiscuous mode. " in the same time the kernel routing table of this machine had an strange entry to a host of our provider but this host was not in the local intranet. thank you in advance. Mirek

2 1

Re: [suse-security] Strange log entry in messages
by Eilert Brinkmann 13 Dec '99

13 Dec '99

"Schäfer, Axel" <a.schaefer(a)uwt.mb.uni-siegen.de> wrote: > Since some days I happen to find the following line in my messages-file: > > Dec 13 06:53:31 snooker su: (to nobody) root on none > > The funny thing is, that this happens every day exactly at 06:53! I am > totally goofed by this thing - have no idea. This is a cron job which is installed by default. When executing updatedb (to update the locate database) it switches to user nobody. This is normal and is done to ensure that only files in world readable directories are included in the database. Files in directories with read permission for owner and group only will not appear in the database, because nobody can't read this directories. Otherwise locate would give every user the ability to get the names of files in directories which he can't read. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0

Strange log entry in messages
by "Schäfer, Axel" 13 Dec '99

13 Dec '99

Hi! Since some days I happen to find the following line in my messages-file: Dec 13 06:53:31 snooker su: (to nobody) root on none The funny thing is, that this happens every day exactly at 06:53! I am totally goofed by this thing - have no idea. I am running SuSE 5.3 on the PC. It serves as a router and firewall between the Internet and our internal network (2 NIC's). No special software running, no strange processes to be observed. No other funny entries. It started of one day and since then, this entry appeared every day in the logs at exactly 06:53! The alarming thing is, that su: reports this entry. Can anybody tell me, what this means? Any security-thread? Axel

3 2

Re: [suse-security] strange kernel message.
by Chrissy LeMaire 13 Dec '99

13 Dec '99

Ive never dabbled with tcpdump..so im not sure. The LRK readme mentioned the following: ifconfig Trojaned! Hide sniffing do an ifconfig..see if it reports that the card is in promiscuous mode (it will be quite obvious..) if it does.. thats possibly a good thing.. if it doesnt.. a LRK has probably been installed At 01:09 PM 12/13/1999 +0100, Mirek Szymczak wrote: >First of all thank you all for the prompt answer. Can't this mean >something else? recently i was playing around with tcpdump can't this be >the reason? >Mirek >

1 0

RE: [suse-security] strange kernel message.
by Freudenberger Joerg 13 Dec '99

13 Dec '99

Hallo together > Has anyone an idea what this message means? > "kernel: eth0: Setting promiscuous mode. " This means, that someone (or some program) changed the ethernet interface program (that part of the kernel or the board) to promiscuous mode. This mode is quite unusual for normal workstations. The other contributors are real right for their view. _B_U_T_ (not for shout, but for strong emphasis) Is essential for many special services: Broadcast and Multicast: e.g. used for special syslog and new deamons network management devices special real time services video, etc. distribution or for the various Programming Logical Controller links which are base on the differing ISO OSI protocols Please be quite quite careful using the adminitrator's pump guns. >in the same time the kernel routing table of this machine had an strange >entry to a host of our provider but this host was not in the local >intranet. Is software of your provider added on your machine. So ask her/him who they are doing with that software. You may need it, but insist on getting the real answer. With best wishes Jörg

1 0

Re: [suse-security] strange kernel message.
by Chrissy LeMaire 13 Dec '99

13 Dec '99

Also, and hopefully, it could be ntopd setting your network card up to read stats. If you are running SuSE 6.3, it comes with ntop ..but I dont think its automatically started... Chrissy

1 0

Log Question
by MethodNet 11 Dec '99

11 Dec '99

I found this in my mail log and on a lightly used POP server that only a few people use. I was wondering if it has any special meaning regarding security or any known exploit as whoever this it is unlikey it was an 'accident' Dec 10 04:29:05 popper[1257]: @dns.sf-bsi.co.jp: -ERR POP EOF received Thanks all Pat

2 1

error interpretation
by Manuel Diaz 10 Dec '99

10 Dec '99

I was trying to login to my webpage and I got this error What might it be? Internal Server Error The server encountered an internal error or misconfiguration and was unable to complete your request. Please contact the server administrator, webmaster(a)unm.edu and inform them of the time the error occurred, and anything you might have done that may have caused the error. More information about this error may be available in the server error log. --------------------------------------------------------------------------- ----- Apache/1.3.9 Server at www.unm.edu Port 80

2 1

Re: [suse-security] error interpretation
by Security Webmaster OKDesign oHG 10 Dec '99

10 Dec '99

Hi Manuel, this is a standard webpage sent from the webserver to tell that something is misconfigured with the webserver. Thie message alone does not tell what exactly went wrong, as there are many possibilities. Do what the message says at the end and have a look at /var/log/messages, /var /log/http.error_log or whatever you have set the error-log to. If you don't understand what's written in there, send a new mail to the list with the relevant log-entries. Sorry, but without this nobody can help. --- Stephan M. Ott // OKDesign oHG Internet-Providing / Netzwerkmanagement smo(a)okdesign.de ..... http://www.okdesign.de tel. 0961-3814139 ..... fax. 0961-3814140 handy. 0171-8351130 oder 0171-7858064 -----Ursprüngliche Nachricht----- Von: Manuel Diaz <mannyd(a)unm.edu> An: suse-security(a)suse.com <suse-security(a)suse.com> Datum: Freitag, 10. Dezember 1999 19:07 Betreff: [suse-security] error interpretation >I was trying to login to my webpage and I got this error >What might it be? > >Internal Server Error >The server encountered an internal error or misconfiguration and was unable >to complete your request. >Please contact the server administrator, webmaster(a)unm.edu and inform them >of the time the error occurred, and anything you might have done that may >have caused the error. > >More information about this error may be available in the server error log. > > > >--------------------------------------------------------------------------- >----- > >Apache/1.3.9 Server at www.unm.edu Port 80 > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

RE: [suse-security] SSH clients
by Simon Istvan 10 Dec '99

10 Dec '99

Yes, I use the following: SSH Windows Client Version: Feb 27 1999 By: Cedomir Igaly, e-mail: c.igaly(a)doc.ic.ac.uk Rev. 2.112 -- Istvan > -----Original Message----- > From: Massimiliano Hofer [mailto:max@bbs.cc.uniud.it] > Sent: Dienstag, 07. Dezember 1999 14:09 > To: suse-security(a)suse.com > Subject: [suse-security] SSH clients > > > Hi, > I happily used ssh for a while, but I have to allow access to > a Linux box > from various other clients and many of them run on Windows. > > Does anyone know if there is some porting of OpenSSH (or similar) for > Windows or MacOS? > > -- > Bye, /\/\ / Admin of SiLink > |char*p="char*p=%c%s%c;main(){printf(p, > (/\/\)ax. SysOp of Ade BBS > |34,p,34);}";main(){printf(p,34,p,34);} > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

4 4