January 2002 - openSUSE Security - openSUSE Mailing Lists

YOU does not preselect openssh patches (suse 7.3)
by Thomas Werschlein 04 Jan '02

04 Jan '02

I just noticed that YOU does not preselect the openssh patches although the openssh RPM is installed. If you rely on the preselection (which would be nice) this is dangerous because you won't get any openssh patches installed even though they are available. The reason for this behaviour seems to be the version of the RPM I have got on my 7.3 CD: openssh-2.9p2-39.i386.rpm The patches on the other hand have versions openssh-2.9.9p2-[38|74].i386.rpm ^^ !! so original RPM and patches do not match and yast does not preselect it. I think it would be nice if SuSE would point to this version mismatch in an upcoming security posting (apologies if there was one and I missed it). Thomas -- Thomas Werschlein, Interlace AG, CH-8005 Zurich werschlein(a)interlace.ch Tel +41 1 440 53 33 Fax +41 1 440 53 36 http://www.interlace.ch

2 2

FTP
by Mike H. 04 Jan '02

04 Jan '02

I assume that, as a part of the security, FTPD writes all files as 740 permissions. How do I change the umask for FTP? The .profile umask is set to 022 but has no effect. I want to do this without messing up any security that is being provided. Thanks Mike --- Outgoing mail has been certified as virus free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.311 / Virus Database: 172 - Release Date: 12/27/2001

2 1

chroot/quota
by JohnvD 04 Jan '02

04 Jan '02

All, Happy newyear first of all. I have a problem : I have a user I want to end up in a chroot'ed environment after login. (same environment as anonymous ftp user) I am planning to use him to be able to write stuff to my ftp server remotely. However, I do not want this user to be able to roam the filesystem. (other people will use him as well) This is where chroot comes in. Furthermore I want to enable quota support for this user. I am running suse6.4 with kernel 2.2.16. No quota software is currently installed. I have set his homedir to /usr/local/ftp/pub, his shell is /bin/false. Also, to allow anonymous downloads, this user is member of "daemon" group. So that when you upload something as this user, anonymous ftp users can immediately download it. At this point in time it was the best compromise between ease of use and security I could come up with. My questions are : >> how do I set up the chrooted env for this user ? >> quota , help !! >> Is this OK, or does anybody have better ideas to achieve the same goals ?? Thanks for any help and/or suggestions, JohnvD.

1 0

Filtering Software
by OKDesign oHG Security Administrator 04 Jan '02

04 Jan '02

Hi folks, is there any working filtering-software for Squid, which stops the LAN from fetching URLs with pornographic and/or securityrisk-relevant sites (maybe Warez and especially virus-containing sites) ? If not, maybe there is any good filtering-software for the clients (running W2k). The problem is, that I have no budget for this :-( God damn the ignorant bosses... So I need a free software. Is there any ? thx. Crest

7 7

kernel panic under high load
by Christoph Egger 04 Jan '02

04 Jan '02

Hello! I use SuSE 7.3 on a file server with Samba 2.2.1a (shipped with SuSE 7.3). But under high load, the SuSE Kernel panics. I am now downloading kernel 2.4.17 to compile and install myself. And I want to update Samba to 2.2.2, because of some oplock fixes. Is a ready SuSE rpm somewhere available? If not, which configure options have I to use in order to overwrite the old binaries and that the binaries searches smb.conf in /etc/samba? -- CU, Christoph

6 10

httpd.log-entries now clear
by OKDesign oHG Security Administrator 04 Jan '02

04 Jan '02

Okay, thank you for the information. It is NIMBDA scanning for code red II infected and other vulnerable hosts. As I'm running Linux, there seems to be no risk for my system. Thank you again. Stephan

1 0

building boot cd
by Gunther Stammwitz 04 Jan '02

04 Jan '02

Hello List, I'd like to create a boot-cd that contains the three suse boot-disks: bootdisk,modules and modules2. What's necessary in order to do that ? Thanks a lot, Gunther

5 6

Re: [suse-security] non-working mail-funktion
by Daniel Quappe 04 Jan '02

04 Jan '02

hi again, ...and now the output of # rcsendmail status works right: Checking for service sendmail: No process on the 7.2-host. as i told you, the old machine could be a little bit creppy...;-) have a nice day, daniel p.s. sorry for posting so much %( -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 3

httpd.log-entries
by OKDesign oHG Security Administrator 03 Jan '02

03 Jan '02

Hi folks, sorry if this was already discussed. In my httpd.error_log I can find hundreds of entries which show that I get permanently scanned for "root.exe" and "cmd.exe". Okay cmd.exe is of course the command interpreter of Windows-Systems. This interpreter is being searched in lots of locations (winnt/system32 and different other locations; of course without affort as I'm runnign a linux-System). But I've never heard of root.exe. What is this ? root sounds familiar *sigh* but I've never heard of a root.EXE... As this scans also take place on my Dial-In-machine, there seems to be a scanprogram which scans the range(s). Does anybody know of such a scanprogram ? Is there any danger for my linux-system ? thx. Stephan

2 1

SuSEfirewall2 and adsl pptp connection
by Alberto Cordone 03 Jan '02

03 Jan '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear friends, I have a problem with the configuration of SuSEfirewall2 on my server with SuSE 7.3. The scenario: Internal Lan (192.168.1.1)eth1 | | - --------------------------- SuSE server FW2 ___________________________ 10.0.0.1 eth0 | | |ppp0 (with fixed ip) | | | 10.0.0.138 | - ------------------------ | Alcatel Speed Touch | ________________________ | | | Tiscali ISP Could you show me a correct configuration with FW2. I tried with my old configuration but I hadn't luck. I read all the documentation and the discussions's groups but I haven't understood the problem with tuneling (pptp) between eth0 and SpeedTouch. Perhaps I have to put 10.0.0.138/32 in FW_TRUSTED_NETS ? My apologies if the scenario isn't so beautiful. Best regards - -... -.-- . -... -.-- . Alberto Cordone Cascina Triulzina, 4 26834 Corte Palasio Lo Home +39 371 472029 Cell +39 3287443985 FaxH +39 1782274985 FaxO +39 2700528231 Email: acordone(a)tiscalinet.it, alberto.cordone(a)mi.unicatt.it - -.-. .. .- --- -.-. .. .- --- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8NMdK2F48h2Y4fkwRAu+qAKCJ3uLXmXSvJhSCDbEto2BSaiK9IACfTIW3 SryLJ/un7JdEtXtdFFgQb1s= =NKt5 -----END PGP SIGNATURE-----

1 0

SuSEFirewall2 and IPTABLES Question
by Robert Rottscholl 03 Jan '02

03 Jan '02

Dear List, I built an own Firewall with IPTABLES (I inserted every Rule myself) and I want now change to SuSEFirewall2. My Questions are, 1. Would you change to SuSEFirewall2 or would you act like the slogan says "Never touch a running System!"? 2. I've inserted a rule to only let connections into my network if they belong to a parent connection like: <!--snap iptables -A FORWARD -d $LOCAL_NET -i $WORLD_DEV -o $LOCAL_DEV -m state --state RELATED,ESTABLISHED -j ACCEPT snap--!> Now my Question: Does SuSEFIREWALL2 offer this Feature and how can it be activated? What do you think about this rule? Is it usefull or garbish? Sysinfo: kernel: 2.4.17 SuSE: 7.2 iptables: 1.2.2 Ciao ;-) Robert - DE

2 1

YOU
by OKDesign oHG Security Administrator 03 Jan '02

03 Jan '02

Hi folks, simple question: Is it possible to run YOU (YaST Online Update) from the shell or must it be done from within YaST2 ? For any reasons I cannot run YaST2, no idea why. But I'd like to update my system regularly with YOU to be up to date with bugfixes and patches. A simple "you" on the shell doesn't work. What do I have to do ? thx. Stephan

4 3

Re: [suse-security] non-working mail-funktion
by Daniel Quappe 02 Jan '02

02 Jan '02

hi nicola, i just tried to install sendmail and deinstalled postfix for test-reasons. now it works...;-( ;-) ... no idee! just for your info, best regards, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

Re: [suse-security] non-working mail-funktion
by Daniel Quappe 02 Jan '02

02 Jan '02

hi nicola, this machine should not be a mail-server, indeed ;-) is it possible that an old installation (6.4) on another intranet-host works properly by using sendmail which does not need to be setup explizit for local- mail-delivery? this old machine does not run sendmail as a daemon (see "netstat -an" and "grep" ): tcp 0 0 192.168.0.100:22 192.168.0.13:1535 ESTABLISHED tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN raw 0 0 0.0.0.0:1 0.0.0.0:* 7 raw 0 0 0.0.0.0:6 0.0.0.0:* 7 dbs:~ # grep SMTP /etc/rc.config # have mail daemon on SMTP port? ("yes" or "no") # As uucp site, you can get along with "SMTP=no", if you make SMTP="no" but checking sendmail with # rcsendmail status gives the follwing response: # Checking for service sendmail: OK but maybe this machine is a little bit greppy... does anyone know about the relations? ;-) best regards, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

Aktive FTP wit Iptables
by mk＠hitchhiker.com 02 Jan '02

02 Jan '02

Hello List, I'm trying to connect to any outside FTP with a aktive ftp conx type from a client behind the supposed firwall but that doesnt work, only passive is allowed. I understand the basics with in/output and forwarding, all my supposed sercies are working in and outgoing, from my firewall i can connect aktiv or passive ftp out and vice versa but not from the client behind. It doesnt matter if I allow all new connections to input or forward, the only difference is that ftp_data is not appearing in the log anymore ????, the ip_conntrack_ftp module is loaded. Does anybody discover the same problem or has a fix/sample for this case ??? Many thx i adv Matthias Krauss

2 1

non-working mail-funktion
by Daniel Quappe 02 Jan '02

02 Jan '02

hi list, the last days i configured a firewall-machine with a stripped-down suse 7.2 (all patches installed). i am using SuSEfirewall2 etc. and have installed postfix for dependency-reasons, but stopped it. as far as i know i can use the command "mail ..." for mailing to other hosts without running postfix. but i have got problems with the seccheck-info-mails because no mail has ever been delivered. do i have to start the mail-software to get the info- mails by secceck or other processes? best regards, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

2 1

[suse-security] WAS Help: Port Forwarding using SuSEfirewall2
by Luke Loh 02 Jan '02

02 Jan '02

Problem solved with much thanks to Nadeem Hassan. Wasn't a port forwarding problem - it's just that FW_MASQ_NETS needs to be set to allow the DNS server in the DMZ to be able to talk to all port numbers or the firewall will drop all return packets to the external queryer. Luke -----Original Message----- From: nhasan(a)nadmm.com [mailto:nhasan@nadmm.com] Sent: Wednesday, January 02, 2002 1:12 PM To: Luke Loh Subject: Re: [suse-security] Help: Port Forwarding using SuSEfirewall2 Good. I guess you wanna post the whole thread to the list too. Someone else may need this in the future :) Luke Loh wrote: > > Nadeem > > Thank you for your help:) Yes, the firewall was dropping the reply packets - > I had to explicitly set FW_MASQ_NETS to allow my DNS server to connect to > high port numbers in order for the replies to go through:) > > Wish I'd thought of this first before assuming it was a pfw problem. Argh. > > Again, many thanks. > > Luke > > -----Original Message----- > From: nhasan(a)nadmm.com [mailto:nhasan@nadmm.com] > Sent: Wednesday, January 02, 2002 11:36 AM > To: Luke Loh > Subject: Re: [suse-security] Help: Port Forwarding using SuSEfirewall2 > > Luke Loh wrote: > > > > Nadeem > > > > Thanks for replying. Yes, I'm using the external IP address of my firewall > > as my DNS IP address. Doesn't seem to work. I assume then that this line > is > > correct? > > > > FW_FORWARD_MASQ="0/0,192.168.1.2,tcp,53 0/0,192.168.1.2,udp,53" > > That line looks correct to me. > > > > > I don't get much in error logs, all I know is that when I try to do an > > nslookup using my firewall's external IP address as my server (I use a > > seperate dial-up to test external-to-internal connectivity) I get a > timeout. > > Looks like a firewall issue. Your firewall seems to be dropping the > reply packets. Try running tcpdump on both the EXT and DMZ interfaces > to look at whats going through. > > Try in one session (for EXT): > > # tcpdump -i eth2 host your-dialup-ip > > and in onother session (for DMZ): > > # tcpdimp -i eth1 host your-dialup-ip > > and then try to run nslookup like before. You should now see what is going > on :) > > > > > What I did try was to telnet to port 53 to see if it would forward the > > packet. > > > > From /var/log/firewall: > > > > Jan 2 10:29:48 zeus kernel: SuSE-FW-ACCEPT-REVERSE_MASQIN=eth2 OUT=eth1 > > SRC=211 > > .28.77.195 DST=192.168.1.2 LEN=48 TOS=0x00 PREC=0x00 TTL=116 ID=1075 DF > > PROTO=TC > > P SPT=3467 DPT=53 WINDOW=8760 RES=0x00 SYN URGP=0 OPT (020405B401010402) > > > > Does this mean that portforwarding *has* worked and the problem might lie > > with my DNS server? Which is odd, because it works fine internally, and > once > > it's pfwed it's already a private ip address ... > > > > Thanks again. > > > > Luke > > -- > Nadeem Hasan > nhasan(a)nadmm.com > http://www.nadmm.com/ -- Nadeem Hasan nhasan(a)nadmm.com http://www.nadmm.com/

1 0

Help: Port Forwarding using SuSEfirewall2
by Luke Loh 01 Jan '02

01 Jan '02

My apologies if this is not the right place to ask for help with regards to SuSEfirewall2, in which case please point me in the right direction. I'm running an out-of-box install of SuSE 7.3, kernel 2.4.10 and using Marc Heuse's SuSEfirewall2 script. I've gone through the examples and readme and everything works fine except for port forwarding. My scenario: Internet ------ Firewall ------- LAN | DMZ I'm running a DNS server on a private ip address in my DMZ and I need the firewall to automatically forward all requests to tcp + udp 53 to my DNS server, which is 192.168.1.2. I've set up the following in firewall.rc.config: FW_FORWARD_MASQ="0/0,192.168.1.2,tcp,53 0/0,192.168.1.2,udp,53" FW_SERVICE_DNS="yes" FW_SERVICES_EXT_TCP="53" <---- curious, are these necessary? I assume so because if port 53 isn't open the firewall will drop the packet before port forwarding FW_SERVICES_EXT_UDP="53" I don't think it is a BIND9 problem because I can successfully contact and resolve names from both my DMZ and my LAN (using the private IP address). I just can't get the internet to see my DNS server. Also, do I need to have inetd running at all? Luke Loh Network Engineer Nicholls Price Pty Ltd Ph : 61 2 9222 9155 Fx : 61 2 9222 9166 www.nph.com.au Level 1, 70 Pitt Street Sydney NSW 2000

2 1

updated class A's not in use
by Kurt Seifried 01 Jan '02

01 Jan '02

68.0.0.0 is now in use and I am seeing activity from it, looks like Cox got 68.0-68.15, with more assignments to others expected. I am compiling a list of active class B's and C's (essentially, has anyone from them talked to me, or can I talk to anyone on them). Anyone interested in helping should contact me (essentially sanitized www/email logs containings hostnames/IP's that have connected to you are what I am looking for). 0.0.0.0/255.0.0.0 1.0.0.0/255.0.0.0 2.0.0.0/255.0.0.0 5.0.0.0/255.0.0.0 7.0.0.0/255.0.0.0 10.0.0.0/255.0.0.0 23.0.0.0/255.0.0.0 27.0.0.0/255.0.0.0 31.0.0.0/255.0.0.0 36.0.0.0/254.0.0.0 39.0.0.0/255.0.0.0 41.0.0.0/255.0.0.0 42.0.0.0/255.0.0.0 58.0.0.0/254.0.0.0 60.0.0.0/255.0.0.0 69.0.0.0/255.0.0.0 70.0.0.0/254.0.0.0 72.0.0.0/248.0.0.0 82.0.0.0/254.0.0.0 84.0.0.0/252.0.0.0 88.0.0.0/248.0.0.0 96.0.0.0/224.0.0.0 197.0.0.0/255.0.0.0 219.0.0.0/255.0.0.0 220.0.0.0/252.0.0.0 224.0.0.0/224.0.0.0 Kurt Seifried, kurt(a)seifried.org A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://www.seifried.org/security/

1 0