September 2000 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Sniffing other user's session
by Juergen Ellinger 21 Sep '00

21 Sep '00

Hi! On Thu, 21 Sep 2000, Robert Casties wrote: >AFAIK all traffic on the wire goes unencrypted, cookie or not. So if >anyone can sniff the network traffic you can't help it. You are right. The point is, that the application sends requests to the Xserver (for instance it asks to draw a line or paint some text on the screen) and the Xserver informs the application about events of user activity such as "mouse moved", "mouse clicked right", "a-key pressed", "space bar released" and so on. That communication indeed is not encrypted. Imagine the following scenario: You have 3 boxes, say A, B and C on the same net. A is running an Xserver which displays the window of an application, that runs on host B. An intruder is sitting on box C. The intruder might now run an Xserver himself and feed it with all the requests, the app on host B sends to host A. Then the intruder can see on his screen, whatever the application on host B draws on the screen of host A. The MIT-Magic-Cookie is used to secure the Xserver on host A. If it is not used, the intruder could (more easily) start an application that should display its output on the screen of host A and receive its input from there. Now an application needs not to draw anything on the screen and so it can remain invisible. If it connects the server, it just has to tell the server, which events of user interaction it is interested to get delivered (that is useful to save bandwidth - some applications are controlled with the mouse only, so there's no need to transmit keyboard events). The intruder could that way gain access to all the keyboard events on host A. So if you really want a secure scenario, then you have indeed to use some encryption. SSH does it by faking an Xserver local to the application and fake an application local to the Xserver. The two faked components communicate encrypted. I hope, that helps to understand the issue a bit more. I wish you all the best! Juergen --------------------------------------------------------------------- Jürgen Ellinger Siemensstraße 44 88250 Weingarten e-mail: ellinger(a)informatik.uni-tuebingen.de ellinger(a)student.uni-tuebingen.de ellinger(a)spohn.rv.bw.schule.de

1 0

Suse-Firewall is too secure
by Christian Kuhn 21 Sep '00

21 Sep '00

Hi, I tried to set up SuSE Firewall from SuSE 6.4. Starting with /sbin/init.d/firewall start was successful. So i did init S, init 2. And that was the last i did. Firewall first run .... pppoed starting ... (in /var/log/messages: all connections on 53 DENied) ... masquerading failed. Login prompt: i typed root <RETURN>, then i typed my password <RETURN> and the login time exceeded. I did not activate FW_PROTECT_FROM_INTERNAL, but i could not login. When rebooting (with rescue disk, changing FW_START in /etc/rc.config) without firewall, but with masquerading, everything worked fine. After manually starting firewall, i found in log a deny for 192.168.2.2:138 (what is the firewall) to 192.168.2.255:138, what i do not understand. Please could anyone post the right parameters to RTFM. Kind regards, Christian

1 0

SSH for 7.0
by Phillip Beal 21 Sep '00

21 Sep '00

Where can one download SSH for SuSE 7.0 US version? I'd rather not continue to use the ssh.rpm from 6.3. Thanks, -- Phillip Beal Evil Genius In Training Electrical and Computer Engineering "God, Root, what is difference?" S+LUG Vice-President -Userfriendly.org GPG Public Key = seattle.keyserver.net GPG Key fingerprint = 3335 BF29 5180 42DF D7BB 484C 78E0 B0F3 6FB9 81D0

2 1

nmap TCP sequence prediction
by Corvin Russell 21 Sep '00

21 Sep '00

Just out of curiosity-- What exactly is this output of nmap a function of (please, no tautologous responses), and how is it important? What determines the TCP sequence numbers? How real a vulnerability is created by their predictability? TCP Sequence Prediction: Class=random positive increments Difficulty=5272173 (Good luck!) I notice that results can vary from Class=trivially time dependent/ Difficulty=1 (trivial joke) to Class=truly random/ Difficulty=9999999. Is it possible or in any way desirable to tweak the system to change the TCP sequence numbers (I think I am OK already, I'm just asking)? Or is this type of vulnerability too esoteric to in any way concern the home user? Secondly, are the time and daytime daemons needed for anything, really, if we're talking about a home user? I have them disabled. No difference, as far as I can see, in mail headers (which either way are not synchronized with the SMTP relay host) or anywhere else. (On an unrelated point of interest -- if they are enabled, nmap cannot identify the OS.) Best, Corvin -- Corvin Russell <corvinr(a)sympatico.ca>

2 2

Using Linux Firewall with NT Network
by Andy W. K. Chan 20 Sep '00

20 Sep '00

I wanna using Linux Firewall in our branch office. Can I use NT password to allow or disallow my colleauges to access Internet ? If yes, do I need install the program in client side or server side ?

1 0

syslogd
by alex medvedev 20 Sep '00

20 Sep '00

hallo, i installed the update for the syslogd. this little program hangs my 6.4 system hard when run for <1min as a regular user: ------------ start ---------------- #include <stdio.h> #include <stdlib.h> #include <syslog.h> int main () { syslog( 1, "%1$*1$s", "str" ); exit (0); } ------------- end ----------------- it consumes 100% of the cpu time. you can still ping it but can not telnet/rsh/ssh into it. can not login from the console either --> enter the user name --> never prompts you for the passwd. i have to press the reset button. maybe my system is screwed up but i do not have another system to test it on. moreover, it looks like syslog() will write anything in the /var/log/messages without specifying the id of the user who wrote the "stuff". well, it is fun to pick on the university sysadmins logging cool "errors" such as: ------------------------------------------------------ Sep 20 09:24:21 quake a.out: you have been owned by "name of the professor you do not like goes here" ------------------------------------------------------ why can normal users write to /var/log/messages via syslogd? can anybody else reproduce the "hang" with syslog() -alexm

1 0

fingerprint
by bacano＠esoterica.pt 20 Sep '00

20 Sep '00

Hi2all, I hope this can bring some more light in the fingerprint issue ... This is done by using active tools like nmap, that operate on the principle that every OS's IP stack has his own idiosyncrasies. This means that each OS responds in diferent ways to malformed packets. A database with this responses is needed by the tool, for comparing the responses of the target OS with the ones from the database. This is called Active Fingerprint. Passive fingerprint is based on capturing packets send from the target system. Based on sniffer traces of those packets, for determine the OS of the target. For knowing the OS of the target box, you must know: TTL (Time To Live) used for outbound packets; Window Size used; DF (Don't Fragment bit) is used or not; TOS (Type of Service) used. But this is not a garanty that you will know the OS on the target machine, it is just a way for trying to know. As you may know IT it is not an exact science, when it will be, my technical client support job will blow up eheh It is also not hard to mix things for your OS cant be fingerprinted, like you can change the default TTL value: echo 'number' > /proc/sys/net/ipv4/ip_default_tll I hope this can help on our esoteric issue =) Much better then me, the SuSe Security Team got the knowledge to clarify such things (sorry guys but i have enough trouble in helping my own clients eheh). And they can also talk a little about this kind of tools, like the tests they have done with Nessus for 64bit systems, that they could share with us (could they? at least it is a much better info then some linux magazine cover on resumees, dont you think? eheh) [ ]'s bacano --------------------------------------------- Esta mensagem foi enviada usando o WebPOP II. http://www.via-net-works.pt/email

1 0

Re: [suse-security] SuSE Security Announcement: syslogd/klogd
by Eilert Brinkmann 20 Sep '00

20 Sep '00

Roman Drahtmueller wrote: > SuSE-6.2 > ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/syslogd-1.3.33-9.i386.rpm > fc29df9455288f40eb1e8dbd0f47d5b3 > source rpm: > ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/syslogd-1.3.33-9.src.rpm > ae980989a754e6bf85de9dd60676b321 [...] > SuSE-5.3 > ftp://ftp.suse.com/pub/suse/i386/update/5.3/a1/syslogd-1.3.33-9.i386.rpm > 3104e26a8b474e215ed703b7c4d48888 > source rpm: > ftp://ftp.suse.com/pub/suse/i386/update/5.3/zq1/syslogd-1.3.33-9.src.rpm > 09c9539df1c4225d2366a2a860b01dbb I wonder if this is correct. The package syslogd-1.3.33-9 was already released with the last security update in november 1999, so I suspect that this part of the announcement is a mistake and syslogd-1.3.33-9 does not fix the vulnerabilities addressed in the current announcement. For all other SuSE versions the announcement tells to update to syslogd-1.3.33-161 or syslogd-1.3.33-162. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0

sysklogd
by alex medvedev 19 Sep '00

19 Sep '00

hallo, is this is what i am looking for? ftp://ftp.suse.com/pub/suse_update/6.4/a1/ syslogd-1.3.33-161.i386.rpm 50 Kb Tue Sep 19 05:03:00 2000 thanks, -alexm

2 1

Re: [suse-security] Masquerading connects very slow
by Volker Kuhlmann 19 Sep '00

19 Sep '00

> able to access every web site. Actually, just a short list of > sites. Among those was hotmail.com. This is a big problem because there > are about a dozen different IPs in use by hotmail. Only a dozen? Try www.gmx.{de,net} ... Just specify www.hotmail.com to ipchains instead of a single IP, and ipchains will insert a rule for each IP it gets from the DNS lookup. The bunch of IPS for hotmail shouldn't change all that often, and you could re-insert the hotmail rule every so often. > One more question, I'm just dropping connection attempts to doubleclick's > servers. So, the connections time out with an error message. There's a > better way. Right? Seems to work for me. Appended to the output chain. I use a reject, not deny, and netscape seems to give up after few attempts. Volker

2 1