February 2000 - openSUSE Security - openSUSE Mailing Lists

[INVALID SERVER LICENCE]
by als 21 Feb '00

21 Feb '00

Hi , i installed Suse 6.3 with firewall 1.4. I want to permit the following access through the firewall: www, domain, ftp, smtp and ssh. Then i made some adjustments in "rc.firewall" like : FW_ROUTE="yes" FW_TCP_SERVICES_EXTERNAL="smtp www domain ftp" FW_UDP_SERVICES_EXTERNAL="domain smtp ftp" After starting of firewall i have full access from internal network to internet but there isn't any access from Internet and no mail.... Could someone tell me what should i do? Als

1 0

Unusual ifconfig info
by L. Sassaman 21 Feb '00

21 Feb '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi folks, One of the members of our staff has a Redhat 6.0 box on our network for his personal use. (Yes, I am having him upgrade to SuSE ASAP...). Recently some people noticed IP conflicts on the subnet... and it turns out that his box had bound all available IPs in that subnet to itself. The owner of the box swears he didn't do any "root level" operations preceeding the event, and I believe him. The questions I have are: could this possibly happen on its own? And, baring that, what kind of exploit would utilize this? Is this evidence of a packet sniffer? Does anyone have any epxerience with this kind of thing? I post this here, rather than the Redhat list, since the level of security awareness is far greater with the SuSE folk. I hope someone can clue me in on this issue. __ L. Sassaman System Administrator | "All of the chaos Technology Consultant | Makes perfect sense..." icq.. 10735603 | pgp.. finger://ns.quickie.net/rabbi | --Joe Diffie -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.1 (GNU/Linux) Comment: OpenPGP Encrypted Email Preferred. iD8DBQE4sN1gPYrxsgmsCmoRAiTwAKDAh7gh/w5UHuZVU49GMGC7L6ZOUgCg1xLO etWUo2EU8pZ0QnmW31EJrIA= =tgjJ -----END PGP SIGNATURE-----

2 1

AW: [suse-security] WARNING: User Malk
by klaus oblasser 20 Feb '00

20 Feb '00

yes, he´s in "town" since 12 month! comming in with "postmaster"-accounts or popper on my old (suse5.3) system! bye k. you:-> Hi! you:-> Maybe, you should scan your /etc/passwd for a user called "Malk" and/or "Malk2" you:-> which has uid:gid 0:0 but no password! you:-> I found this user on four independent systems I'm managing. It came along with you:-> a new directory inside /dev which contained some tools to hack the system, hide you:-> tasks/files in ps/ls and some more! you:-> bye, you:-> Sebastian

1 0

Re: Warning User Malk
by Webdirekt Sysop 20 Feb '00

20 Feb '00

Sebastian Willing wrote: > > Hi! > Maybe, you should scan your /etc/passwd for a user called > "Malk" and/or "Malk2"> which has uid:gid 0:0 but no > password! You could also a run a diff-routine every hour or so.( Which is what I am doing since he`s been. Also check the end of inetd.conf. >It came along with a new directory inside /dev which > > >contained some tools to hack the system, hide tasks/files in >ps/ls and some more! Also /etc usaully hidden from the modified ls. Likes to use "blah" as dirname. Maybe he`s a robot. > bye, > Sebastian bye for now. dan ----------------------------------------------------------- ~ WEBDIREKT INTERNET SERVICE GMBH ~ ~ the e-business intelligence company ~ ----------------------------------------------------------- ~ Dieselstr. 5 Fon: (+49) 6173 / 9359-88 ~ ~ D-61476 Kronberg Fax: (+49) 6173 / 9359-59 ~ ~ http://www.webdirekt.de mailto:sysop@webdirekt.de ~ -----------------------------------------------------------

1 0

WARNING: User Malk
by Sebastian Willing 20 Feb '00

20 Feb '00

Hi! Maybe, you should scan your /etc/passwd for a user called "Malk" and/or "Malk2" which has uid:gid 0:0 but no password! I found this user on four independent systems I'm managing. It came along with a new directory inside /dev which contained some tools to hack the system, hide tasks/files in ps/ls and some more! bye, Sebastian

1 0

SuSE-firewall & kernel 2.3.x
by thunder7＠xs4all.nl 19 Feb '00

19 Feb '00

Will the SuSE-firewall script work with the newer 2.3.x kernels? I'm not entirely clear on the effects of ipchains having disappeared and being replaced by netfilter, which seems to be in a constant state of flux. Thanks, Jurriaan -- Never use "etc." -- it makes people think there is more where there is not or that there is not space to list it all, etc. Linux 2.2.14 SMP up 2:14 4 users load av: 0.95 0.40 0.22

2 1

passwd does not work
by Tera 18 Feb '00

18 Feb '00

I work with SuSE 6.2 kernel 2.2.10 on some linux-boxes Today I made a new user with "useradd <username>" (I was logged in as root via ssh), and tried at the next command, to give this new user a password with passwd <username>. The system replies: passwd: Unknown user <username> but the user is listed in /etc/passwd and /etc/shadow but it is not possible to set a new password with "passwd". I checked the passwd-binary with tripwire, but checksums are OK Trying with "userdel" to remove the user, causes system to tell: userdel: user <username> does not exist so I decided to remove the lines manually. Might it be that the system is compromised by intruders? Am I blind for some easy things? Thanks for all ideas! Thomas Hartl

6 5

AW: [suse-security] passwd does not work
by Sebastian Willing 18 Feb '00

18 Feb '00

> Trying with "userdel" to remove the user, causes system to tell: > userdel: user <username> does not exist Hi! I got the same problem (see the messages "how to nuke PAM"). It seems, that PAM doesn't like root users to create other users using standard tools. ;-( bye, Sebastian

1 0

Re: [suse-security] Portscan
by Eilert Brinkmann 18 Feb '00

18 Feb '00

Stephen Thompson <s.p.thompson(a)mindspring.com> wrote: > Feb 14 10:57:59 reaper scanlogd: From 216.77.42.93:20 to 192.168.0.51 ports > 1764, 1765, 1766, 1767, 1768, 1769, 1770, 1771, 1772, ..., flags ??rp?u, > TOS 10, TTL 114, started at 10:57:45 [...] Probably this was a number of FTP transfers, not a portscan. FTP opens a new TCP connection for each file or directory listing tranferred. scanlogd warnings are triggered by many connections from the same host within a short time, therefore it is not unusual that scanlogd interprets FTP sessions as portscans. So, *if* you did FTP to 216.77.42.93 at that time, you don't have to worry. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

2 1

pt0 device permissions
by alex medvedev 18 Feb '00

18 Feb '00

hi, thanks for the replies. what are these devices? are the permissions ok? crw-rw---- 1 root disk 96, 0 Apr 30 1999 pt0 crw-rw---- 1 root disk 96, 1 Apr 30 1999 pt1 crw-rw---- 1 root disk 96, 2 Apr 30 1999 pt2 crw-rw---- 1 root disk 96, 3 Apr 30 1999 pt3 is it related to my "only root can run xterm" problem? thanks, -alexm

6 6