April 2003 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] IP Tunnel in only one direction possible
by telest＠gmx.net 23 Apr '03

23 Apr '03

1 0

Suse 8.2 und Cisco VPN
by Mike.Hollaebder 23 Apr '03

23 Apr '03

Hallo, leider bekomme ich den Cisco-VPN-Client nicht zum Laufen Suse 8.2 , Cisco VPN 3.6.2 Das Kernelmodul kompiliert, aber anschliessend meckert der vpnclient, dass er nicht auf das VPN-Subsystem zugreifen kann (The VPN sub-system is busy or has failed.) ... Best regards Mike Hollaender

3 2

Re: [suse-security] IP Tunnel in only one direction possible
by telest＠gmx.net 23 Apr '03

23 Apr '03

Thomas: I tested several configurations within ipsec.conf: (basically I do the same as on GW1) interfaces=%defaultroute interfaces="ipsec0=ppp0" interfaces="ipsec0=eth0 ipsec1=%defaultroute" interfaces="ipsec0=eth0 ipsec1=ppp0" And the only thing I see is (dropped packets): ipsec1 Link encap:IPIP Tunnel HWaddr inet addr:217.235.200.173 Mask:255.255.255.255 UP RUNNING NOARP MTU:1412 Metric:1 RX packets:34 errors:0 dropped:0 overruns:0 frame:0 TX packets:32 errors:0 dropped:32 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:2395 (2.3 Kb) TX bytes:3440 (3.3 Kb) I also test with a wide open Firewall without sucess.... :( Here is my basic configuration: # basic configuration config setup # THIS SETTING MUST BE CORRECT or almost nothing will work; # %defaultroute is okay for most simple cases. interfaces="ipsec0=eth0 ipsec1=ppp0" klipsdebug=none plutodebug=none plutoload=%search plutostart=%search uniqueids=yes overridemtu=1412 conn %default keyingtries=0 disablearrivalcheck=no authby=rsasig conn MUCWIL left=tsfwwillich.dyndns.org leftsubnet=192.168.100.0/24 leftrsasigkey=%cert leftcert=gw.wil.cert.pem leftid="/C=DE/ST=GER/O=Teleconnect und Service GmbH/OU=TSD/CN=GATEWAY VPN WILLICH/Email=info(a)teleconnect-service.de" # Right security gateway, subnet behind it, next hop toward left. right=tsfwmuenchen.dyndns.org rightsubnet=192.168.101.0/24 rightnexthop=217.5.98.100 rightcert=gw.muc.cert.pem rightid="/C=DE/ST=GER/O=Teleconnect und Service GmbH/OU=TSD/CN=GATEWAY VPN WILLICH/Email=info(a)teleconnect-service.de" rightrsasigkey=%cert auto=start Ray: How can I verify that forwarding is enabled? Also, make sure forwarding is turned on for that interface. On Wed, 2003-04-23 at 13:02, Thomas Kerkau wrote: > Hi Peter, > > > > |NET2 pings NET1: GW2(eth0) logs an icmp request ? > > on eth0: > > 9 7.631138 192.168.101.239 192.168.100.205 ICMP Echo > > (ping) request > > the paket is entering GW2. > > > > > 192.168.101.0/24 ist net2 internal > > 192.168.100.0/24 ist net1 internal > > > > on ipsec0: > > 3 1.694921 217.235.199.35 192.168.100.205 ICMP > > Echo (ping) request > > the paket is leaving ipsec0 > > > > > on eth1: > > nothing-- > > > > on ppp0 > > nothing-- > > but not forwarded to ppp0/eth1. Just checked this on a 7.3, you will see > ESP-pakets on both. hopfully this was not changed. Is ipsec0 bound to > eth1/ppp0 (interfaces directive in ipsec.conf)? > > > Yes I forgot to paste int the reply. :) > > but basically ipsec0 looks differnent on both machines > > > > GW2:|> 10:21:04.305584 192.168.101.239 > 192.168.100.1: icmp: echo > > GW1:|> 08:51:05.057368 unknown ip 0 > > Are you shure that these entries are correlated? Do you see ESP-pakets > on the external interface of GW1? > > My feeling at this point is that GW2 doesn't send any paket to GW1. > Check if "ipsec eroute" and "ipsec auto --status" shows the correct > connections, and check "route". > > Greetings, Thomas > > > -- > www.ArcStyler.com - the Architectural IDE for MDA:J2EE/.NET/EAI > -> CyberOne Award > -> Winner Crossroads A-List Award USA > -> IBM Solution Excellence Award winner for Hot Java Solution > -> European Information Society Technologies Prize Winner > -> Made with ArcStyler: http://www.io-software.com/customers > -> OMG Press, John Wiley 2002 www.ConvergentArchitecture.com > > ----- < iO > --------------------------------------------------------- > Interactive Objects Software GmbH > mailto:Thomas.Kerkau@io-software.com > http://www.io-software.com > Basler Strasse 65, D-79100 Freiburg, Germany > Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 > ---------------------------------------------------------------------- -- +++ GMX - Mail, Messaging & more http://www.gmx.net +++ Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage!

2 1

WebLog entry
by webmaster 23 Apr '03

23 Apr '03

Hi List, Marc Heuse v2.0 SecCheck started logging recently * Changes (+: new entries, -: removed entries): - httpd root TCP *:80 (LISTEN) - httpd root TCP *:80 (LISTEN) Web server is running, 80/tcp open Any idea what can it be about? Thanks Antal

1 0

pppd sporadically uses ppp1 instead of ppp0
by Peter Karl Müller 23 Apr '03

23 Apr '03

Hi I'm using SuSE 7.3 as a firewall accessing the IN via DSL. By chance I found in the archived /var/message files of the last months that pppd sporadically connects thru ppp1 instead of ppp0: messages:Apr 13 12:11:37 xxxxxx pppd[6215]: Using interface ppp1 messages:Apr 13 12:11:37 xxxxxx pppd[6215]: Connect: ppp1 <--> /dev/pts/1 messages:Jan 18 15:51:36 xxxxxx pppd[2511]: Using interface ppp1 messages:Jan 18 15:51:36 xxxxxx pppd[2511]: Connect: ppp1 <--> /dev/pts/2 Since my firewall rules are bound to ppp0 my firewall box has been unshielded, right? As a workaround I have blocked all traffic thru ppp1, ppp2, ppp3. Questions: a) How do I ensure that pppd only takes ppp0? b) Do ppp2, ppp3 etc. exist? Best regards Peter

3 2

Re: [suse-security] IP Tunnel in only one direction possible
by telest＠gmx.net 23 Apr '03

23 Apr '03

Hi Thomas, please see below. |-----Ursprüngliche Nachricht----- |Von: Thomas Kerkau [mailto:Thomas.Kerkau@io-software.com] |Gesendet: Mittwoch, 23. April 2003 10:52 |An: telest(a)gmx.net |Cc: suse-security(a)suse.com |Betreff: Re: [suse-security] IP Tunnel in only one direction possible | | |Hi Peter, | |I'm a little cofused. to get things right: | |> tcpdump told me: |> eth0 (internal) ping request was send (from machine net2 to |machine net1) | |NET2 pings NET1: GW2(eth0) logs an icmp request ? on eth0: 9 7.631138 192.168.101.239 192.168.100.205 ICMP Echo (ping) request 192.168.101.0/24 ist net2 internal 192.168.100.0/24 ist net1 internal on ipsec0: 3 1.694921 217.235.199.35 192.168.100.205 ICMP Echo (ping) request on eth1: nothing-- on ppp0 nothing-- | |> ipsec0 ping request (from fw/gw net2 external IP to machine |net1 (internal |> ip)) ! maybe here is the fault!! | |NET2 pings NET1: GW2(ipsec0) logs an icmp request to NET1? | |> ppp0 (nothing) | |what about eth1? It is absolut correct to have tcpdump report pakets on |ipsec0 to some internal ip at NET1. At the same time the physical |Interface with the same ip as the logical ipsec0 should log some |ESP-pakets. | | |> tcpdump example from the not-working GW NET2 - ipsec0 if |> 10:21:04.304526 192.168.100.1 > 192.168.101.239: icmp: echo request |> 10:21:04.305584 192.168.101.239 > 192.168.100.1: icmp: echo |reply -> this is |> the ping request from net1 to net2 | |The above is NET1 pings NET2, which works. What does it show for NET2 |pings Net1. From the above I would guess only the icmp: echo |request but |no echo reply? Yes I forgot to paste int the reply. :) but basically ipsec0 looks differnent on both machines GW2:|> 10:21:04.305584 192.168.101.239 > 192.168.100.1: icmp: echo GW1:|> 08:51:05.057368 unknown ip 0 | | |> tcpdump example from the working GW NET1 - ipsec0 if |> 08:51:05.057368 unknown ip 0 |> 08:51:05.185805 unknown ip 0 |> 08:51:05.256899 unknown ip 0 |> 08:51:05.386109 unknown ip 0 |> 08:51:05.458005 unknown ip 0 |> 08:51:05.586372 unknown ip 0 |> 08:51:05.659086 unknown ip 0 |> 08:51:05.786648 unknown ip 0 | |This is NET2 pings NET1? | |The Post/Prerouting tabel is viewd by iptables -t nat -L | |Maybe you take a look at your ipsec: |ipsec eroute lists your ipsec routings |ipsec auto --status lists the status of your connections | | |Greetings, Thomas | | |> |> |-----Ursprüngliche Nachricht----- |> |Von: Thomas Kerkau [mailto:Thomas.Kerkau@io-software.com] |> |Gesendet: Mittwoch, 23. April 2003 09:07 |> |An: telest(a)gmx.net |> |Cc: suse-security(a)suse.com |> |Betreff: Re: [suse-security] IP Tunnel in only one |direction possible |> | |> | |> |Hi Peter, |> | |> |this midght be due to yout iptables configuration. It is |unlikley to be |> |due to your ipsec or routing config, cause it works in one |direction. I |> |would try to take down iptables, if possible. This is not |secure but a |> |quick test. Maybe you take a look at your iptables |configuration first, |> |and compare FW1 and FW2, keeping in mind that FW2 has an |external ethX |> |and a pppX interface. |> |Some further ideas: |> |Maybe you try to use tcpdump on FW2, looking for the pakets |> |from Net2 or |> |enable loging for all pakets with iptables. |> | |> |Hope this helps a little but it is very dificult to guess |what might be |> |wrong, |> | |> |Thomas |> | |> | |> |> I have a big problem, that today the VPN tunnel is only |usable in one |> |> direction. |> |> |> |> NET(1) --- FW1/VPN Gateway ---- internet ---- FW2 / VPN |> |Gateway ---- NET(2) |> |> |> |> I can ping from NET1 to NET2 and get replies. ( I also can |> |use different |> |> other thinks like pcanywhere, file access to the pc's on net2,...) |> |> |> |> I cannot ping from NET2 to NET1. There is nothing in the |> |logfiles. I can |> |> only see on the interface statistik that the 4 ping packets |> |are dropped. |> |> |> |> I use on both sides: |> |> Freeswan 1.98b |> |> iptables |> |> Suse Linux 8.0 |> |> |> |> FW1: static IP Adresses , SDSL Connection |> |> FW2: dynamic IP Adresses, SDSL PPPoE Connection |> |> |> |> I'm really stucked and help will be appreaciated. |> |> |> |> Thanks |> |> |> |> Peter |> |> |> |> -- |> |> +++ GMX - Mail, Messaging & more http://www.gmx.net +++ |> |> Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage! |> |> |> |> -- |> |> Check the headers for your unsubscription address |> |> For additional commands, e-mail: suse-security-help(a)suse.com |> |> Security-related bug reports go to security(a)suse.de, not here |> | |> |-- |> |www.ArcStyler.com - the Architectural IDE for MDA:J2EE/.NET/EAI |> | -> CyberOne Award |> | -> Winner Crossroads A-List Award USA |> | -> IBM Solution Excellence Award winner for Hot Java Solution |> | -> European Information Society Technologies Prize Winner |> | -> Made with ArcStyler: http://www.io-software.com/customers |> | -> OMG Press, John Wiley 2002 www.ConvergentArchitecture.com |> | |> |----- < iO > |--------------------------------------------------------- |> |Interactive Objects Software GmbH |> |mailto:Thomas.Kerkau@io-software.com |> |http://www.io-software.com |> |Basler Strasse 65, D-79100 Freiburg, Germany |> |Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 |> ||---------------------------------------------------------------------- |> | |> |> -- |> +++ GMX - Mail, Messaging & more http://www.gmx.net +++ |> Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage! |> |> -- |> Check the headers for your unsubscription address |> For additional commands, e-mail: suse-security-help(a)suse.com |> Security-related bug reports go to security(a)suse.de, not here | |-- |www.ArcStyler.com - the Architectural IDE for MDA:J2EE/.NET/EAI | -> CyberOne Award | -> Winner Crossroads A-List Award USA | -> IBM Solution Excellence Award winner for Hot Java Solution | -> European Information Society Technologies Prize Winner | -> Made with ArcStyler: http://www.io-software.com/customers | -> OMG Press, John Wiley 2002 www.ConvergentArchitecture.com | |----- < iO > --------------------------------------------------------- |Interactive Objects Software GmbH |mailto:Thomas.Kerkau@io-software.com |http://www.io-software.com |Basler Strasse 65, D-79100 Freiburg, Germany |Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 |---------------------------------------------------------------------- | -- +++ GMX - Mail, Messaging & more http://www.gmx.net +++ Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage!

3 2

Re: AW: [suse-security] IP Tunnel in only one direction possible
by Thomas Kerkau 23 Apr '03

23 Apr '03

Hi Peter, something came to my mind as I read the mail from Ray: maybe its in your MASQ/SNAT rules on GW2. I guess you use Masquerading for outgoing trafic from NET2? In this case you should exclude traffic to 192.168.0.0/16 from this rule. I dont use SuSEFirewall, but the shellcommand for SNAT is something like: iptables -t nat -I POSTROUTING -s $ownnet -d ! 192.168.0.0/16 -j SNAT --to-source $badIP where $ownnet is my internal (something like 192.168.22.0/24) and $badIP is the external IP of the FW. Greetings, Thomas -- www.ArcStyler.com - the Architectural IDE for MDA:J2EE/.NET/EAI -> CyberOne Award -> Winner Crossroads A-List Award USA -> IBM Solution Excellence Award winner for Hot Java Solution -> European Information Society Technologies Prize Winner -> Made with ArcStyler: http://www.io-software.com/customers -> OMG Press, John Wiley 2002 www.ConvergentArchitecture.com ----- < iO > --------------------------------------------------------- Interactive Objects Software GmbH mailto:Thomas.Kerkau@io-software.com http://www.io-software.com Basler Strasse 65, D-79100 Freiburg, Germany Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 ----------------------------------------------------------------------

1 0

Re: [suse-security] IP Tunnel in only one direction possible
by telest＠gmx.net 23 Apr '03

23 Apr '03

Hi Thomas, thanks for yours suggestions. I try to see if my FW drops packets, but there is not entry in the firewall logfile. The only information I can see is in the link statistics ip -s link there are dropped packets at if ipsec0 tcpdump told me: eth0 (internal) ping request was send (from machine net2 to machine net1) ipsec0 ping request (from fw/gw net2 external IP to machine net1 (internal ip)) ! maybe here is the fault!! ppp0 (nothing) tcpdump example from the not-working GW NET2 - ipsec0 if 10:21:04.304526 192.168.100.1 > 192.168.101.239: icmp: echo request 10:21:04.305584 192.168.101.239 > 192.168.100.1: icmp: echo reply -> this is the ping request from net1 to net2 10:21:04.500970 192.168.100.1.cnrprotocol > 192.168.101.223.telnet: . ack 9658 win 64058 (DF) 10:21:04.501566 192.168.101.223.telnet > 192.168.100.1.cnrprotocol: P 9658:10007(349) ack 0 win 5488 (DF) [tos 0x10] 10:21:04.700379 192.168.100.1.cnrprotocol > 192.168.101.223.telnet: . ack 10007 win 63709 (DF) 10:21:04.700979 192.168.101.223.telnet > 192.168.100.1.cnrprotocol: P 10007:10221(214) ack 0 win 5488 (DF) [tos 0x10] 10:21:04.901447 192.168.100.1.cnrprotocol > 192.168.101.223.telnet: . ack 10221 win 63495 (DF) 10:21:04.902043 192.168.101.223.telnet > 192.168.100.1.cnrprotocol: P 10221:10437(216) ack 0 win 5488 (DF) [tos 0x10] 10:21:05.101170 192.168.100.1.cnrprotocol > 192.168.101.223.telnet: . ack 10437 win 63279 (DF) 10:21:05.101764 192.168.101.223.telnet > 192.168.100.1.cnrprotocol: P 10437:10653(216) ack 0 win 5488 (DF) [tos 0x10] 10:21:05.302252 192.168.100.1.cnrprotocol > 192.168.101.223.telnet: . ack 10653 win 64484 (DF) 10:21:05.302872 192.168.101.223.telnet > 192.168.100.1.cnrprotocol: P 10653:10869(216) ack 0 win 5488 (DF) [tos 0x10] 10:21:05.311890 192.168.100.1 > 192.168.101.239: icmp: echo request tcpdump example from the working GW NET1 - ipsec0 if 08:51:04.985548 unknown ip 0 08:51:05.057368 unknown ip 0 08:51:05.185805 unknown ip 0 08:51:05.256899 unknown ip 0 08:51:05.386109 unknown ip 0 08:51:05.458005 unknown ip 0 08:51:05.586372 unknown ip 0 08:51:05.659086 unknown ip 0 08:51:05.786648 unknown ip 0 |-----Ursprüngliche Nachricht----- |Von: Thomas Kerkau [mailto:Thomas.Kerkau@io-software.com] |Gesendet: Mittwoch, 23. April 2003 09:07 |An: telest(a)gmx.net |Cc: suse-security(a)suse.com |Betreff: Re: [suse-security] IP Tunnel in only one direction possible | | |Hi Peter, | |this midght be due to yout iptables configuration. It is unlikley to be |due to your ipsec or routing config, cause it works in one direction. I |would try to take down iptables, if possible. This is not secure but a |quick test. Maybe you take a look at your iptables configuration first, |and compare FW1 and FW2, keeping in mind that FW2 has an external ethX |and a pppX interface. |Some further ideas: |Maybe you try to use tcpdump on FW2, looking for the pakets |from Net2 or |enable loging for all pakets with iptables. | |Hope this helps a little but it is very dificult to guess what might be |wrong, | |Thomas | | |> I have a big problem, that today the VPN tunnel is only usable in one |> direction. |> |> NET(1) --- FW1/VPN Gateway ---- internet ---- FW2 / VPN |Gateway ---- NET(2) |> |> I can ping from NET1 to NET2 and get replies. ( I also can |use different |> other thinks like pcanywhere, file access to the pc's on net2,...) |> |> I cannot ping from NET2 to NET1. There is nothing in the |logfiles. I can |> only see on the interface statistik that the 4 ping packets |are dropped. |> |> I use on both sides: |> Freeswan 1.98b |> iptables |> Suse Linux 8.0 |> |> FW1: static IP Adresses , SDSL Connection |> FW2: dynamic IP Adresses, SDSL PPPoE Connection |> |> I'm really stucked and help will be appreaciated. |> |> Thanks |> |> Peter |> |> -- |> +++ GMX - Mail, Messaging & more http://www.gmx.net +++ |> Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage! |> |> -- |> Check the headers for your unsubscription address |> For additional commands, e-mail: suse-security-help(a)suse.com |> Security-related bug reports go to security(a)suse.de, not here | |-- |www.ArcStyler.com - the Architectural IDE for MDA:J2EE/.NET/EAI | -> CyberOne Award | -> Winner Crossroads A-List Award USA | -> IBM Solution Excellence Award winner for Hot Java Solution | -> European Information Society Technologies Prize Winner | -> Made with ArcStyler: http://www.io-software.com/customers | -> OMG Press, John Wiley 2002 www.ConvergentArchitecture.com | |----- < iO > --------------------------------------------------------- |Interactive Objects Software GmbH |mailto:Thomas.Kerkau@io-software.com |http://www.io-software.com |Basler Strasse 65, D-79100 Freiburg, Germany |Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 |---------------------------------------------------------------------- | -- +++ GMX - Mail, Messaging & more http://www.gmx.net +++ Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage!

2 1

ver7.2 server was hacked - pls help
by Istvan Hollo 23 Apr '03

23 Apr '03

Hello Guru's, On the weekend our web server (SuSE 7.2 kernel 2.4.4-4GB) was hacked by some very clever guys. They placed some programs which i can not remove anymore and which is even worse - the root's password also was changed (I can not start in single user mode - init 1 - password is wrong). A "sysadmin" user was created by the hacker and mtab also was changed. When i try to login and type the username than Enter -> the "pasword" question is not coming but the screen is hanging. It means we can not log in anymore. Which is interesting, this is our mail server also and we can send/receive mails but via samba is not possible to connect to the shared drives. I'm afraid i have to reinstall the machine, but before i do it want to know what and how happened. If someone of you experienced with this and could give good advices about what to do and how i can analyse who logged it would be appreciated. TIA, istvan Istvan HOLLO GlobalTech Hungary Informatikai Kft. phone : +36 28 590 500 fax : +36 28 590 501 email : istvan.hollo(a)ija.hu www : www.thegt.com www.ija.hu

4 3

Re: [suse-security] ver7.2 server was hacked - pls help
by GentooRulez 23 Apr '03

23 Apr '03

> I'm afraid i have to reinstall the machine, but before i do it want to > know what and how happened. That is the normal way. Reinstall your box after doing a forensic analysis on what is happen until now. Fix the problem and harden the box. > If someone of you experienced with this and could give good advices about > what to do and how i can analyse who logged it would be appreciated. As above - doing a forensic analysis. The're a lot of documents on it. Try e.g. google: forensic analysis honey pot. Put your hard disc into another box and mount the filesystem(s) r/o too examine what logfiles tell you about some actions of the attacker - but normally they should be cleaned. (apache/mailserver logs too) Do a string analysis on the whole disc and search for log-strings with a date entry related to date of attack in order to identify the way attacker became root. > TIA, > istvan Ciao Michael

1 0