October 1999 - openSUSE Security - openSUSE Mailing Lists

Free WebMail-server
by Andreas Achtzehn 23 Oct '99

23 Oct '99

Hi folks! I'd like to install a free WebMail server on a SuSE-6.0-server. It's supposed to handle my users' mail. Is there any program being secure enough to work even on an open web server without a firewall? 1. Do you know any program having these features? (URL...) 2. What about the security issues? Is it possible, for example, to block access by foreign hosts (outside my network)? -- MfG, Andreas ICQ: 26077300 v-Card: http://www.inter-check.de/~achtzehn

1 0

Re: [suse-security] chroot in SSH
by Security Webmaster OKDesign oHG 22 Oct '99

22 Oct '99

>Doing chroot to ssh session would leave the session virtually useless, >as the users then obviously would not have access to any system commands >(as most of them are not in their homedirectories). I would rather >protect the directories & files with normal file access rights. Read >man chmod first. > >-Pete Hi Pete, of course you are right. I didn't mean chroot itself, but something similar that can hold a user in his homedir. To protect the dirs and files with the normal chmod does not have the effect I want. Okay, some more details: The homedir of the users is set to the directories of the virtual domains. I don't want the users to be able to access the directories of the other domains. When doing chmod o-rwx for these directories, even the apache itself cannot acces them and therefore cannot display the content. I hope you know what I mean. Any hints ? -- Stephan

3 2

what�s this?
by Volker Matzken 22 Oct '99

22 Oct '99

hello list, iŽm just looking through my firewall logs and wonder how it can happen, that the hosts of my network do a portscan to outside addresses? as source-addresses there appear valid and not valid ip-adresses of our subnet, all packets ("coming" from port 1080) has the same target. could this be a serious problem, what is it? i use kernel 2.0.36 and iŽve heard about a bug which allows spoofing. could this be a kind of spoofing? and if it is, is there any fix? looking forward for any hints volker -- ---------------------------- byte.box volker matzken fon 06103.2053590 fax 06103.2053333 ----------------------------

1 0

RE: TCP/UDP Port 999
by Stephan Gerling 21 Oct '99

21 Oct '99

Hi everyone Can someone tell me more about Port 999 TCP/UDP RFC 1700 (Assigned Numbers) only means: garcon 999/tcp applix 999/udp puprouter 999 tcp and upd My quest is, what means garcon, applix, puprouter and wich Software use this Ports I found it on an Win 98 PC MFG Stephan Gerling

1 0

Re: [suse-security] default suse webserver
by Chris Reeves 20 Oct '99

20 Oct '99

hello there, Daniele Frijia wrote: > > On Mon, Oct 18, 1999 at 10:31:47PM +0000, Chris Reeves wrote: > > thanks for the reply, > > by online i mean being able to access it. > > Yes, but I wanted to know from _where_ the sdb should be accessable... sorry, i'm being a bit thick here ;-) i meant access to the world, public access, everyone... do you know if there are any particular security holes in the default documentation that people could exploit? as people keep saying, it's probably not a good idea to allow people access to this, so how would i be able to set up apache so that i can access the database from my computer (localhost only), but i can make the rest of the site available to the rest of the world? is that possible? > > i realise that i can permit access to the world, it's just that i was wondering > > whether it was safe to do so, and whether there are any security holes/special > > things to watch out for. > > AFAIK it's not neccesary to permit the access to the sdb. > > Regards, Daniele thanks for any further input you can provide, Chris -- __ _ -o)/ / (_)__ __ ____ __ Chris Reeves /\\ /__/ / _ \/ // /\ \/ / ICQ# 22219005 _\_v __/_/_//_/\_,_/ /_/\_\

1 0

Help Desk Horror!
by Fred A. Miller 20 Oct '99

20 Oct '99

Help Desk Horror These are stories from help desks around the country. At 3:37 a.m. on a Sunday, I had just looked at the clock to determine my annoyance level, when I received a frantic phone call from a new user of a Macintosh Plus. She had gotten her entire family out of the house and was calling from her neighbor's. She had just received her first system error and interpreted the picture of the bomb on the screen as a warning that the computer was going to blow up. ---------------------------------------- Tech Support: "I need you to right-click on the Open Desktop." Customer: "Ok." Tech Support: "Did you get a pop-up menu?" Customer: "No." Tech Support: "Ok. Right click again. Do you see a pop-up menu?" Customer: "No." Tech Support: "Ok, sir. Can you tell me what you have done up until this point?" Customer: "Sure, you told me to write 'click' and I wrote 'click'." (At this point I had to put the caller on hold to tell the rest of the tech support staff what had happened. I couldn't, however, stop from giggling when I got back to the call.) Tech Support: "Ok, did you type 'click' with the keyboard?" Customer: "I have done something dumb, right?" ---------------------------------------- One woman called Dell's toll free line to ask how to install the batteries in her laptop. When told that the directions were on the first page of the manual the woman replied angrily, "I just paid $2,000 for this damn thing, and I'm not going to read the book." ---------------------------------------- Customer: "I received the software update you sent, but I am still getting the same error message." Tech Support: "Did you install the update?" Customer: "No. Oh, am I supposed to install it to get it to work?" ---------------------------------------- Customer: "I'm having trouble installing Microsoft Word." Tech Support: "Tell me what you've done." Customer: "I typed 'A:SETUP'." Tech Support: "Ma'am, remove the disk and tell me what it says." Customer: "It says '[PC manufacturer] Restore and Recovery disk'." Tech Support: "Insert the MS Word setup disk." Customer: "What?" Tech Support: "Did you buy MS word?" Customer "No..." ---------------------------------------- Tech Support: "Ok, in the bottom left hand side of the screen, can you see the 'OK' button displayed?" Customer: "Wow. How can you see my screen from there?" ---------------------------------------- Customer: "Uhh...I need help unpacking my new PC." Tech Support: "What exactly is the problem?" Customer: "I can't open the box." Tech Support: "Well, I'd remove the tape holding the box closed and go from there." Customer: "Uhhhh...ok, thanks...." ---------------------------------------- Customer: "I'm having a problem installing your software. I've got a fairly old computer, and when I type 'INSTALL', all it says is 'Bad command or file name'." Tech Support: "Ok, check the directory of the A: drive--go to A:> \ and type 'dir'." Customer reads off a list of file names, including 'INSTALL.EXE'. Tech Support: "All right, the correct file is there. Type 'INSTALL' again." Customer: "Ok." (pause) "Still says 'Bad command or file name'." Tech Support: "Hmmm. The file's there in the correct place -- it can't help but do something. Are you sure you're typing I-N-S-T-A-L-L and hitting the Enter key?" Customer: "Yes, let me try it again." (pause) "Nope, still 'Bad command or file name'." Tech Support: (now really confused) "Are you sure you're typing I-N-S-T-A-L-L and hitting the key that says 'Enter'?" Customer: "Well, yeah. Although my 'N' key is stuck, so I'm using the 'M' key...does that matter? ---------------------------------------- At our company we have asset numbers on the front of everything. They give the location, name, and everything else just by scanning the computer's asset bar-code or using the number beneath the bars. Customer: "Hello. I can't get on the network." Tech Support: "Ok. Just read me your asset number so we can open an outage." Customer: "What is that?" Tech Support: "That little bar-code on the front of your computer." Customer: "Ok. Big bar, little bar, big bar, big bar . . ." ---------------------------------------- And the best for last!!!! Customer: "I got this problem. You people sent me this install disk, and now my A: drive won't work." Tech Support: "Your A drive won't work?" Customer: "That's what I said. You sent me a bad disk, it got stuck in my drive, now it won't work at all." Tech Support: "Did it not install properly? What kind of error messages did you get?" Customer: "I didn't get any error message. The disk got stuck in the drive and wouldn't come out. So I got these pliers and tried to get it out. That didn't work either." Tech Support: "You did what sir?" Customer: "I got these pliers, and tried to get the disk out, but it wouldn't budge. I just ended up cracking the plastic stuff a bit." Tech Support: "I don't understand sir, did you push the eject button?" Customer: "No, so then I got a stick of butter and melted it and used a turkey baster and put the butter in the drive, around the disk, and that got it loose. Then I used the pliers and it came out fine. I can't believe you would send me a disk that was broke and defective." Tech Support: "Let me get this clear. You put melted butter in your A: drive and used pliers to pull the disk out?" At this point, I put the call on the speaker phone and motioned at the other techs to listen in. Tech Support: "Just so I am absolutely clear on this, can you repeat what you just said?" Customer: "I said I put butter in my A: drive to get your crappy disk out, then I had to use pliers to pull it out." Tech Support: "Did you push that little button that was sticking out when the disk was in the drive, you know, the thing called the disk eject button?" Silence. Tech Support: "Sir?" Customer: "Yes." Tech Support: "Sir, did you push the eject button?" Customer: "No, but you people are going to fix my computer, or I am going to sue you for breaking my computer?" Tech Support: "Let me get this straight. You are going to sue our company because you put the disk in the A: drive, didn't follow the instructions we sent you, didn't actually seek professional advice, didn't consult your user's manual on how to use your computer properly, instead proceeding to pour butter into the drive and physically rip the disk out?" Customer: "Ummmm." Tech Support: "Do you really think you stand a chance, since we do record every call and have it on tape?" Customer: (now rather humbled) "But you're supposed to help!" Tech Support: "I am sorry sir, but there is nothing we can do for you. Have a nice day." -- ----/ / _ Fred A. Miller ---/ / (_)__ __ ____ __ Systems Administrator --/ /__/ / _ \/ // /\ \/ / Cornell Univ. Press Services -/____/_/_//_/\_,_/ /_/\_\ fm(a)cupserv.org

3 2

Re: [suse-security] Re: Port 113?
by Chris Reeves 20 Oct '99

20 Oct '99

hello all, sorry about taking a while to respond. Daniele Frijia wrote: > > On Mon, Oct 18, 1999 at 10:37:38PM +0000, Chris Reeves wrote: > > > No, don´t open 113 at all. > > > > i have to allow incoming connections on 113 to be able to access a proxy > > server. > > is that a major problem? > > It's not a bug and not a feature. > But you can turn off this service, 'cause it's neccessary. > > Regards, Daniele i couldn't get the proxy server to work without opening this port. i figured out that it needed to be opened when i found (in /var/log/messages) that the proxy was sending packets to my port 113 (which were being denied). Markus Schaber wrote: > > On Tue, 19 Oct 1999, Markus Schaber wrote: > > > > > > But I guess it's not wise just to open external connects to port 113 > > > > > of all workstations I do ssh from? > > > > > > > > > No, don´t open 113 at all. > > > > > > i have to allow incoming connections on 113 to be able to access a proxy > > > server. > > > is that a major problem? > > > > You could use hosts.allow and hosts.deny or your firewall rules > > to just open 113 for the proxy, and shut it down for the other > > ports. > ^^^^^^ > Sorry, should read "hosts". > -- > Markus Schaber -- http://www.schabi.de/ -- ICQ# 22042130 yes, i've only allowed connections from the proxy server (using ipchains). thanks for your time, Chris -- __ _ -o)/ / (_)__ __ ____ __ Chris Reeves /\\ /__/ / _ \/ // /\ \/ / ICQ# 22219005 _\_v __/_/_//_/\_,_/ /_/\_\

1 0

Re: [suse-security] logging]
by kelly marchock 20 Oct '99

20 Oct '99

Hello all, I would like to know if it is possible to configure SuSE to log all messages who they are from and who they are going to as well as attachments that are sent with them and store them in a specified file? K. Marchock

2 1

[jochen@teg-me.de: [suse-security] Firewall with SuSE 6.2]
by Andreas Siegert 20 Oct '99

20 Oct '99

Hi, check out www.suse.de/~marc The SuSEfwirewall 1.1 should be much better than the stuff on the current distribution. cheers afx ----- Forwarded message from Jochen Mader <jochen(a)teg-me.de> ----- Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm X-No-Archive: yes list-help: <mailto:suse-security-help@suse.com> list-unsubscribe: <mailto:suse-security-unsubscribe@suse.com> list-post: <mailto:suse-security@suse.com> X-Mailinglist: suse-security From: Jochen Mader <jochen(a)teg-me.de> Organization: TEG To: suse-security(a)suse.com Date: Sun, 10 Oct 1999 17:00:49 +0200 Subject: [suse-security] Firewall with SuSE 6.2 I'm using SuSE 6.2 with the firewall package version 2.2 and decided to set up a firewall to protect our servers because of the growing number of portscanns and attacks showing up in my logs. I'm totally new to that whole thing and I just don't get it what's wrong. I got an internal net (192.168.0.0/24) and an external net (*.*.*.128/28), they are connected through masquerading (works fine). The thing I'm trying to do is to set up another box protecting the external net. The problem is that I got a router (*.*.*.129) stting in that external net which is handling the connections to the internet, so I have to let all the traffic of the router pass through the firewall. According to the documentation it should be no problem as it is exactly the thing mentioned at the end of it.. So I set up a test-network with 3 PCs that resembles the real network the firewall is supposed to protect: I'M NOT FIREWALLING ANY PORTS NET-MASK: 255.255.255.240 *.*.*.129 (router) | | *.*.*.130 (eth1 on the firewall) *.*.*.131 (eth0 on the firewall) | | *.*.*.132 (a www-server, gateway set to *.*.*.131) IP_FORWARDING is enabled. Everything is running fine. the www-server is able to ping the firewall (both devices), but it is nit able to ping the router nor is the firewall and all packages coming from the router are dropped due to the spoof-protection. Now I set FW_ROUTER in rc.config to *.*.*.129. I thought that from now on I should be able to ping the router from the www-server (or was I wrong) or from the firewall. But when I started a ping from the firewall or the www-server they don't get any reply. Now when I start a ping from the router to the firewall or the www-server they also don't return, but I get a log entry that the packages have been accepted. Please help me, cause I got no idea of what I'm doing wrong. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com ----- End forwarded message ----- -- SuSE Muenchen GmbH Phone: +49-89-42769-0 Stahlgruberring 28 Fax: +49-89-42017701 D-81829 Muenchen, Germany May the Source be with you!

3 2

RE: [suse-security] Firewall with SuSE 6.2]
by "Schäfer, Axel" 20 Oct '99

20 Oct '99

Hi Jochen, let me get this right: you want to have all computers (friend and enemy) on the same subnet? Well, if you want to do that, you have to pass all traffic through the firewall using proxies. But since all of your PC's are on the same net, they know each other "well" and they can adress every PC directly. You must use subnets, but you can probably do it with just changing the subnet mask from 255.255.255.0 to what every you want, for example 255.255.255.x (see Networking-HOWTO on this one). But remember: you have to have the firewall stand between (!) the freinds and the enemies! Axel > -----Original Message----- > From: Jochen Mader [mailto:jochen@teg-me.de] > Sent: Friday, October 15, 1999 3:14 PM > To: suse-security(a)suse.com > Subject: Re: [suse-security] Firewall with SuSE 6.2] > > > >Hi, > >check out www.suse.de/~marc > >The SuSEfwirewall 1.1 should be much better than the stuff > on the current > >distribution. > >cheers > >afx > > Thanx to afx for that link, > but the real problem is still there. Has anybody any idea how > to do the > following: > I got a network with 16 hosts on one side of the firewall > (exactly those are > the hosts I want to protect) and one host from that network > (the router) has to > be on the other side of the firewall, cause that's where evil > traffic is > coming from. > My question is: Is it possible to do WITHOUT subnetting? > I tried almost everything but it still doesnt't work: > I can ping both devices of the firewall from the hosts on the > inside, I can > ping both devices of the firewall from the router and I can > ping the internal > hosts and the router from the firewall, but I can't ping an > internal host from > the router or the router from an internal host > (spoof-protection is disabled). > > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0