May 2003 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] securing apache / SSL
by Gerhard Stegmann 30 May '03

30 May '03

hi. chkrootkit says 'not infected' except for "bindshell", on port 465, where the tls secured smpt-server sits. so i think it just gets the wrong string. is this correct ? you does not give the option to update this apache/ssl/php-versions, so they're up to date???!??!? thx for comments, gerhard -----Ursprüngliche Nachricht----- Von: Sven 'Darkman' Michels [mailto:sven@darkman.de] Gesendet: Freitag, 30. Mai 2003 15:41 An: suse-security(a)suse.com Betreff: Re: [suse-security] securing apache / SSL hello, Gerhard Stegmann wrote: > hello all. > what exactly has to be done to secure apache ssl on a 8.1 ? > > my config > > apache 1.3.26 > mod_php 4.2.2 > > openssl 0.9.6g > > > it seems as if some guys are able to drop and execute scripts > via apache, and let them execute. the last one executed locally, > but got caught by iptables, while trying to open local ports > and create a connections to a remote host on the following ports [port list] > the next run, it used a different local port, and used the ports > mentioned above the other way around. > any ideas ?? You should stay in touch with online updates of your software. Apache, modssl and php where lately exploitable for remote users (or et least, possible to exploit). mod_ssl exploit is one of the most used at the moment. So check if your Software is up-to-date and if not, use YOU or FOU4S. IF ppl where on your box without your permission (aka crackers/hackers), you need to reinstall that box cause nearly all software could be compromised. Use chkrootkit (www.chkrootkit.org) to check for intruders and rootkits on your box. Regards, Sven -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

packet mangling
by Daniel Santos 30 May '03

30 May '03

Hello all! I have a Suse 8.2 distribution installed on x86 machine. How do I turn off packet mangling on the /sbin/SuSEfirewall script ? Regards, Daniel Santos

1 1

securing apache / SSL
by Gerhard Stegmann 30 May '03

30 May '03

hello all. what exactly has to be done to secure apache ssl on a 8.1 ? my config apache 1.3.26 mod_php 4.2.2 openssl 0.9.6g it seems as if some guys are able to drop and execute scripts via apache, and let them execute. the last one executed locally, but got caught by iptables, while trying to open local ports and create a connections to a remote host on the following ports : DPT=4045 DPT=3306 DPT=682 DPT=2620 DPT=662 DPT=277 DPT=400 DPT=1422 DPT=638 DPT=1462 DPT=555 DPT=1377 DPT=386 DPT=2003 DPT=2034 DPT=498 DPT=766 DPT=680 DPT=1532 DPT=1000 DPT=1349 DPT=803 DPT=335 DPT=1234 DPT=1427 DPT=7326 DPT=612 DPT=129 DPT=395 DPT=798 the next run, it used a different local port, and used the ports mentioned above the other way around. any ideas ?? -----Ursprüngliche Nachricht----- Von: Peter Wiersig [mailto:wiersig-ml@dns.glamus.de] Gesendet: Freitag, 30. Mai 2003 12:38 An: suse-security(a)suse.com Betreff: Re: [suse-security] iptables error Rodel Collado Urani wrote: > > ip_tables.o: init_module: Device or resource busy Check with "lsmod" if a module named "ipchains" is loaded. If so, unload it with "rmmod ipchains" and try again. Peter -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

protecting against webspoofing with iptablerules
by Ruprecht Helms 30 May '03

30 May '03

Hi, how have I to write a or some iptablerules to protect a server against webspoofing. Also interessting to me is the spoofing of ftp. How can I test the rules and which securitytools have implemented the modern attacks. Regards, Ruprecht

1 0

statically linked ps / ls
by Gerhard Stegmann 30 May '03

30 May '03

does anybody have these two ? pleas send them to me. thanks. gerhard -----Ursprüngliche Nachricht----- Von: Peter Wiersig [mailto:wiersig-ml@dns.glamus.de] Gesendet: Freitag, 30. Mai 2003 12:38 An: suse-security(a)suse.com Betreff: Re: [suse-security] iptables error Rodel Collado Urani wrote: > > ip_tables.o: init_module: Device or resource busy Check with "lsmod" if a module named "ipchains" is loaded. If so, unload it with "rmmod ipchains" and try again. Peter -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

iptables error
by Rodel Collado Urani 30 May '03

30 May '03

Blanki would like to ask this problem i encountered three days ago. i have been doin a lot of things to fix this but i still could make it. i even recompile my kernel type k_deflt. i also did search in the internet but i cant find the solutions there. maybe some of you have done this already. thanks! this is the full details of the error... """/lib/modules/2.4.10-4GB/kernel/net/ipv4/netfilter/ip_tables.o: init_module: Device or resource busy Hint: insmod errors can be caused by incorrect module parameters, including invalid IO or IRQ parameters /lib/modules/2.4.10-4GB/kernel/net/ipv4/netfilter/ip_tables.o: insmod /lib/modules/2.4.10-4GB/kernel/net/ipv4/netfilter/ip_tables.o failed /lib/modules/2.4.10-4GB/kernel/net/ipv4/netfilter/ip_tables.o: insmod ip_tables failed iptables v1.2.2: can't initialize iptables table `filter': iptables who? (do you need to insmod?) Perhaps iptables or your kernel needs to be upgraded."""

2 1

OpenCa Configurtation / Installation
by Junge, Stefan 30 May '03

30 May '03

Hi, i want to install / configure openca from rpm sources for suse 8.1. Which packages do i need and is there documation available ? Thanks for help Greetings...... Stefan

1 0

iptables
by Rodel Collado Urani 29 May '03

29 May '03

Blankhello, how do i know if my server has an open port? how? can i use iptables to restrict ports thats open? tnx! ps anyway, i have a problem with my iptables this is one of the errors..."/lib/modules/2.4.10-4GB/kernel/net/ipv4/netfilter/ip_tables.o: init_module: Device or resource busy" i even recompile my kernel k_deflt and still the problem is occuring.

2 1

Samba server running SuSEFirewall2
by Peter á Rógvu 29 May '03

29 May '03

Hey . I am running a samba server for some windows clients, but i also want to secure the server with SuSEFirewall2. What port on the server do I have to open, to let the windows clients access the samba share ? Thanks. -- Vh Peter á Rógvu

3 2

pptpd and Windows XP client?
by Radko L 29 May '03

29 May '03

Hello guys, I want to ask you one question about VPN server. I have installed and configureted an VPN pptpd server and it seems work OK with Windows 2000 client machine but when I tried to connect with XP client machine user are able to log in and everithink seems OK but when tried to load some site by http a fit part of site loaded and nothink else happned at that time in log messages on VPN server I found: kernel: Not enough space to encrypt packet: 1404<1404+4! have you got any idea about that? How do you make work with windows XP client? __________________________________ Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo. http://search.yahoo.com

4 4