December 2004 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] Default Squirrelmail installation not safe
by Thorsten Hahn 09 Dec '04

09 Dec '04

> the default installation of Squirrelmail in SuSE 9.1 (others versions > ?) is not safe. SuSE 8.2, Squirrel from Web and not SuSE-Packagsystem says: Forbidden You don't have permission to access /squirrelmail/data/ on this server. ------------------------------------------------------------------------ -------- Apache/1.3.27 Server at mail.example.com Port 80 So I think there is no problem. Greetings Thorsten

1 0

Default Squirrelmail installation not safe
by Cleo 08 Dec '04

08 Dec '04

hi, the default installation of Squirrelmail in SuSE 9.1 (others versions ?) is not safe. path installation ---------------- /srv/www/htdocs/squirrelmail/ /srv/www/htdocs/squirrelmail/config/ /srv/www/htdocs/squirrelmail/data/ /srv/www/htdocs/squirrelmail/plugins/ ... The data directory is under the squirrelmail directory and accessible from a navigator for example, if you have un login test, you can view the test.pref in http://www.example.com/squirrelmail/data/test.pref also the address book ( test.abook ) in the README.SuSE or INSTALL files, no information to secure the installation. Solution ( for example ) -------- data directory must be in /var/lib/squirrelmail/data and in config.php $data_dir = /var/lib/squirrelmail/data/'; the directory permissions drwxrwx--- 2 root apache /var/lib/squirrelmail/data Secure others directories ( place config.php and config_local.php file in /etc/squirrelmail for example and create links ) ? Others solutions ? Cleo.

3 3

martian sources and faked ip/mac addresses?
by Kai Schaetzl 08 Dec '04

08 Dec '04

I have some questions regarding the "martian source" iptables messages. I'm getting a lot of messages like this: Dec 7 20:17:44 nx02 kernel: martian source 212.112.233.242 from 127.0.0.1, on dev eth0 Dec 7 20:17:44 nx02 kernel: ll header: 00:01:80:35:86:44:00:02:7e:b0:6f:fc:08:00 in the IP tables log 00:02:7e:b0:6f:fc seems to be the offending remote network card, grepping for that in the log reveals hundreds of different IP no.s sending packets to port 135 (where else ;-) I wonder if the IP no is faked or the MAC? Probability would have it that the IP no.s are faked, I think and it's always the same host? How to find out where that card is? On the other hand it could also be a widespread virus which sends the packets with alway the same faked MAC address. I googled for that address, but it's not mentioned anywhere. That "martian source" warning happens *much* less than those many connects from this MAC address, so I assume there might actually be no connection between the two things. What could be the cause for this? It happens only for two IPs which were added later to the machine and are not from the same subnet. There are actually IP no.s from three subnets on that machine. They seem to work just fine, though. Kai -- Kai Schätzl, Berlin, Germany

2 2

AW: [suse-security] DSL line and local network - is it necessary to use 2 nics ?
by Thorsten Hahn 06 Dec '04

06 Dec '04

> What is the difference between 2 nics setup (one to ADSL modem and other to local network) or 1 nic setup (one to ADSL > modem over PPP and gateway at the same time for connection sharing) from security standpoint ? Rob, it is always better to have physical interfaces, not only for performance, it is easier to configure and if your setup is not perfect, the "whole" may not compromise both sides. With 2 NICs, no one from the inside LAN can reach your Modem, because there is no physical connection. Modems often can be reached via http/telnet from inside. Thorsten

1 0

AW: [suse-security] ssh-Attack?
by Gottschalch Christian 06 Dec '04

06 Dec '04

Use puplic-key only, and the sick feeling is gone ;-D Thers also an other Thread in this List with same Topic "SSH password attacks" enJoY dA SuN haVe fUn > -----Ursprüngliche Nachricht----- > Von: joao marka [mailto:joao@kildare.com.br] > Gesendet: Donnerstag, 2. Dezember 2004 13:09 > An: Kai Pfeiffer; suse-security(a)suse.com > Betreff: Re: [suse-security] ssh-Attack? > > > howdy! > > I´ve seen the same ssh tryes in one server´s log in wich i´ve > got better > luck than others... > it seems to be a password list used by scriptkiddies... > it is probably available for download... > even the timing match with the logs i´ve seen! > > take it back! give him some fun. > > > > Hello list, > > > > in my logs I found the appended entries. My question is, > what is the > > intention > > of this guy. I don't understand, why he uses a few > loginnames many times > > and > > others only one time. There is no account on my box which > matches to one > > of > > the tested loginnames. > > > > Another thing. I get this userlist (exactly the same names > in the same > > order) > > from many different IPs. > > > > Any hints? > > > > regards > > > > Kai Pfeiffer > > > > > > Dec 1 11:02:54 mybox sshd[14251]: Illegal user patrick from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:55 mybox sshd[14253]: Illegal user patrick from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:55 mybox sshd[14265]: Illegal user rolo from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:56 mybox sshd[14267]: Illegal user iceuser from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:56 mybox sshd[14269]: Illegal user horde from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:56 mybox sshd[14271]: Illegal user cyrus from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:56 mybox sshd[14273]: Illegal user www from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:56 mybox sshd[14277]: Illegal user matt from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:57 mybox sshd[14279]: Illegal user test from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:57 mybox sshd[14281]: Illegal user test from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:57 mybox sshd[14283]: Illegal user test from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:57 mybox sshd[14285]: Illegal user test from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:57 mybox sshd[14287]: Illegal user www-data from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:57 mybox sshd[14291]: Illegal user operator from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:57 mybox sshd[14293]: Illegal user adm from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:58 mybox sshd[14295]: Illegal user apache from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:58 mybox sshd[14297]: Illegal user irc from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:58 mybox sshd[14299]: Illegal user irc from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:58 mybox sshd[14301]: Illegal user adm from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:58 mybox sshd[14309]: Illegal user jane from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:58 mybox sshd[14311]: Illegal user pamela from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:02:59 mybox sshd[14323]: Illegal user cosmin from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:04 mybox sshd[14397]: Illegal user cip52 from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:04 mybox sshd[14399]: Illegal user cip51 from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:05 mybox sshd[14403]: Illegal user noc from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:05 mybox sshd[14413]: Illegal user webmaster from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:05 mybox sshd[14415]: Illegal user data from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:06 mybox sshd[14417]: Illegal user user from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:06 mybox sshd[14419]: Illegal user user from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:06 mybox sshd[14421]: Illegal user user from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:06 mybox sshd[14423]: Illegal user web from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:06 mybox sshd[14425]: Illegal user web from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:06 mybox sshd[14427]: Illegal user oracle from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:06 mybox sshd[14429]: Illegal user sybase from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:06 mybox sshd[14431]: Illegal user master from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:07 mybox sshd[14433]: Illegal user account from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:07 mybox sshd[14435]: Illegal user backup from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:07 mybox sshd[14437]: Illegal user server from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:07 mybox sshd[14439]: Illegal user adam from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:07 mybox sshd[14441]: Illegal user alan from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:07 mybox sshd[14443]: Illegal user frank from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:08 mybox sshd[14445]: Illegal user george from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:08 mybox sshd[14447]: Illegal user henry from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:08 mybox sshd[14449]: Illegal user john from > > ::ffff:xxx.xxx.xxx.xxx > > Dec 1 11:03:09 mybox sshd[14461]: Illegal user test from > > ::ffff:xxx.xxx.xxx.xxx > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

AW: [suse-security] Where to Deploy Trend Micro viruswall?
by Thorsten Hahn 06 Dec '04

06 Dec '04

> I was wondering where to put a Trend Micro Viruswall in my network. > My basic setup follows below. SOHO Dear Invalid Addr3ss, I think this is a realname-list, no name - no answer. I don´t know what you want exactly, but I think it´s ok to put the Viruswall between "Firewall"/Router and your LAN, so you have to use the proxy. Internet | | Cable Modem | | Firewall/Router | | Viruswall Proxy (http, ftp) Viruswall Mailscanner | | Switch / | \ / | \ Linux | XP | Print Server | | Printer Sincerly, Thorsten Hahn --- Satori ITcom GmbH t.hahn_remove_(a)satori-itcom.net

2 1

Firewall Run Level?
by Invalid Addr3ss 06 Dec '04

06 Dec '04

Hey All I was wondering which run level to run a firewall/router? Run level 2 or 4. This will be a internet connected, (practice box). tksysv or ntsysv? Should I use the SuSEfirewall2, or write my own iptables? All advise will help. Thanks, Invalind Addr3ss -- Q) What do you get when you mix a spammer with a hacker? A) A Spacker

3 2

DSL line and local network - is it necessary to use 2 nics ?
by Robert Rozman 06 Dec '04

06 Dec '04

Hi, sorry for dummy security question... What is the difference between 2 nics setup (one to ADSL modem and other to local network) or 1 nic setup (one to ADSL modem over PPP and gateway at the same time for connection sharing) from security standpoint ? Regards, Rob.

2 1

Boot failure after Kernel update
by Stefan Proels 05 Dec '04

05 Dec '04

Dear list, I've installed the latest kernel patches (announced last Wednesday) today on several machines and one of them fails to boot now. We probably won't have physical access to this machine until Monday so I currently have no idea what happened or where the boot process stops. The machine in questions is running SuSE 9.0. Another SuSE 9.0 machine, one SuSE 9.1 and three SuSE 9.2 machines did not show this problem and booted up fine after the update. The working 9.0 machine is basically identically configured as the failing one but has different hardware. The working machine has a single P4 CPU, 1 GB RAM and a single 160 GB parallel ATA disk. The failing machine has 2 Xeons, 4 GB RAM and 4 S-ATA disks, 160 GB each, in a RAID 0+1 attached to a 3ware Escalade RAID Controller. Both machines are running reiserfs and a SMP kernel. In case anybody else has experienced this problem any information about it would be appreciated so that we can get up the machine again as quickly as possible on Monday. Best regards, Stefan

4 5

Where to Deploy Trend Micro viruswall?
by Invalid Addr3ss 05 Dec '04

05 Dec '04

2 1