December 1999 - openSUSE Security - openSUSE Mailing Lists

Re: http log entry
by Martin P. Peikert 08 Dec '99

08 Dec '99

Hello, on one of our boxes - not the webserver - these ports were probed, too, but from another IP-adress. The admin of the gateway told me, that it was 'probably some kid with a new hacker toy'. Martin -- ---------------------------------------------------- Martin Peikert EN 636 Fachgebiet Theoretische Elektrotechnik TU Berlin Sekretariat EN 2 fon 314-23881 fax 314-22284 http://www-tet.ee.tu-berlin.de/peikert/index.html ----------------------------------------------------

1 0

Re: [suse-security] SSH clients
by Security Webmaster OKDesign oHG 07 Dec '99

07 Dec '99

>TeraTerm is a free, open source terminal emulator for Window$. A SSH >plugin is available, however, I have not set it up yet. >http://hp.vector.co.jp/authors/VA002416/teraterm.html Well, I useTTpro and the TTSSH-plugin on my client and it works great. Very easy to set up, you can use pw-authentication, RSA-authentication and rhosts, depending on what the server provides. I can advise it. Of course just IMHO :-) ---Stephan

1 0

Re: [suse-security] ssh-authentication
by Security Webmaster OKDesign oHG 07 Dec '99

07 Dec '99

Hi again, now it works. The problem was, that the homedir of the user had the mods drwxrwxr-x. I changed it to drwxr-xr-x, now it works... Hmm, strange.... How can I manage it that the group has write-access to this directory ? And why does the sshd not allow access when the group has write-access ? Sorry, I don't understand this. Is this part of the security-behaviour of sshd or what ? And can this be changed ? TIA ---Stephan

4 4

ssh-authentication
by Security Webmaster OKDesign oHG 07 Dec '99

07 Dec '99

Hi again, first thanks to all those trying to help. Okay, I checked some things, here is the result: -I checked /etc/sshd_config. Nothing unusual. Allowed is only RSA-Authentication, the rest is left as was. -The machine is connected via router, but that doesn't matter, as I can acces the machine with ssh using _my_ key. I just can't access using the key from the user which should get access. - The file identity.pub was copied to authorized_keys, so this should work. - It was copied being the user itself (via su), so permissions should be correct. - No entries in /etc/sshd_config in the sections AllowHosts and DenyHosts. - I also checked my hosts.allow and hosts.deny - files. Nothing in there what could cause the problem. - BTW: The clock was set wrong on myclient. I forgot to set it correct after making a bios-update. Thanks for the tip. Okay, here are the file-permissions: drwxr-xr-x . drwxrwxr-x .. (it's okay that the group has full access) -rw -r--r-- authorized_keys -rw------- identity -rw-r--r-- identity.pub -rw------- random_seed And this is the message when using ssh -v: Trying RSA authentication with key 'xxx' Remote: Bad file modes for /~_USERDIR_/. / Server refused our key. Permission denied. What comes to my mind: I set up a chroot for ftp-accesses, thats why the dir is set to ~_USERDIR_/. / Maybe this is something important ??? But should not, as the /. / at the end just means that the user cannot escape from his homedir with ftp... Okay, any ideas what is wrong ??? TIA. ---Stephan

1 0

ipchains and napster
by alex medvedev 06 Dec '99

06 Dec '99

hi, thanks for the replies every one! my ipchains rules: # ipchains -L Chain input (policy ACCEPT): target prot opt source destination ports - all ------ anywhere ns.external.org n/a - all ------ anywhere fw.internal.org n/a Chain forward (policy DENY): target prot opt source destination ports MASQ all ------ 192.168.111.0/25 anywhere n/a Chain output (policy ACCEPT): target prot opt source destination ports - all ------ ns.external.org anywhere n/a - all ------ fw.internal.org anywhere n/a the setup: internet --- linux with ipchains ---- win98 with napster people from the internet can see and download my files on win98. -alexm

2 1

ssh-authtication
by Security Webmaster OKDesign oHG 06 Dec '99

06 Dec '99

Hi folks, umm, I have a small problem. When setting up our server, I tried to get the best security as possible. Maybe I changed some config-file to fit our needs to allow ssh-logins only from specified users.(But I have no idea which file this was :-(( ) Now I want to allow another user to login using ssh. I made ssh-keygen for this user, entered the password, copied identity.pub to authorized_keys in the .ssh-directory. But when trying to login via ssh, servers sends permission denied. What else must be done ? TIA ---Stephan

3 2

napster and ip masquerading
by alex medvedev 06 Dec '99

06 Dec '99

hi, internet ----- suse with masquerading ------- win98 laptop with napster People CAN download stuff from my win98 laptop... even when it is on a private subnet... what the hell? -alexm P.S. for info on napster: www.napster.com

2 1

Re: [suse-security] OpenSSH????????
by Chris Saia 04 Dec '99

04 Dec '99

Lenz Grimmer <grimmer(a)suse.de> writes: > This RPM is not made by SuSE. But we are also working on > it. However, it does not compile cleanly yet... Hm? Interestingly enough, I'm the one that provided Damien with the spec file which he uses to build the SRPM. (There's also a bug in that SRPM in that the symlinks aren't made on the first install -- patch to the spec file is being sent to openssh-unix-dev momentarily.) The actual RPM (well, SRPM) is made by Damien Miller, using my SuSE spec file, rcsshd file and fillin template for rc.config. He doesn't build RPM's for SuSE because his build/packaging system is RedHat, so he can only easily make a SuSE S(ource)RPM. No, this package is not blessed by SuSE, Inc., but I'd be flattered if they considered it. :) I'd love to build and feed Damien SuSE RPM's and SRPM's, except that there's the matter of US Export Laws (on strong encryption), and while I don't think I'd get caught, I'm going to just grumble for now. If you'd rather not grab his source RPM, simply download the whole tar file (openssh-1.2pre15.tar.gz). The SuSE-specific files I generated are sitting in [srcroot]/packages/suse/. Be sure to get the spec patch from the mailing list as the one in pre15 has a bug. -- =============================================================================== csaia(a)wtower.com, WTnet IRC Administrator - http://www.wtower.com/~csaia/ GNU Privacy Guard Public Key information is available at the above URL. ===============================================================================

1 0

[OFF-TOPIC] List dedicated to Netscape Enterprise Server
by Christian Pinheiro 04 Dec '99

04 Dec '99

In the course of configuring and using the Netscape Enterprise Server software, we have discovered that there is no single mailing list dedicated to this complex application, and that the traffic on the "netscape.server" newsgroup is too low to be useful. We would have benefited (and still would benefit) greatly from a list dedicated to the configuration and administration of the Netscape Enterprise Server software, and we believe that others using this software would find such a resource highly useful. Consequently, we have decided to host, on an experimental basis, a list dedicated to discussing problems related to the Netscape Enterprise Server software. We invite all interested in participating to subscribe. To subscribe, please send an e-mail (no subject needed) to: majordomo(a)lists.veritel.com.br with the following text in the first line of the body of the message: subscribe nes-managers-l [<your e-mail address>] Because this list is experimental, we are not, for the moment, hosting archives for the list. (Please note that, aside from being a user of software produced by Netscape, we have no association with Netscape, and this list has not been endorsed by nor has any connection with Netscape.) -- Christian M. C. Pinheiro System Administrator - VeritelNet <pinheiro(a)veritel.com.br>

1 0

OpenSSH????????
by Mr. M 04 Dec '99

04 Dec '99

OpenSSH is a recent project developed by the OpenBSD team - www.openbsd.org Their goal was to create a version of SSH that is not burdened by copyright laws. OpenSSH has been adopted for use by the FreeBSD team and also for Debian GNU/Linux. My question is directed to SuSE. Will this be ported for use with SuSE Linux? Mario For more info check out: www.openssh.org

7 8

portscanning and high ports
by Chris Reeves 03 Dec '99

03 Dec '99

Hi all, I have been portscanned a number of times recently by the same computer. I've used a combination of nslookup and finger and have the name of the culprit. It is being dealt with. This has prompted me to look even more closely at my firewalling. Ports <1024 are OK, as they are totally blocked, but those >1023 are pretty much open. Although virtually every single service is commented out in inetd.conf, I still want to block and log any connect attempts to 'special' ports. At the moment, these are the high numbered ports I block: 1433 Microsoft SQL 2049 NFS 5432 PostgreSQL 5999:6010 X-Windows 7100 X Font Server 12345:12346 NetBus 31337 Back Orifice I was having a look at the high numbered ports that he was scanning, and was wondering what the significance of these ports was (I couldn't see anything in /etc/services). By the way, the following are the high numbered ports that he tried to scan, have any ideas what they are used for? 5190 5191 5192 5193 5631 5632 5800 5900 8000 8010 8080 9100 25867 31787 33333 And finally, are there any other high numbered ports that you think could be potentially damaging (eg webmin - which port is that on)? Even if I'm not running that service, I would still like to know which ones pose a security threat so that I can block them anyway (in case I'm playing and start webmin, for example, without realilsing it). Is it generally considered safe to open up most high numbered ports? What do the people on these lists do? Do you close them all and open some, or open all and close some (all meaning all ports >1023)? One last question - I keep on coming around to this one every so often. If someone wants to connect to me using ICQ, they connect to a port >1023. I am assuming that ICQ doesn't have a daemon or anything listening on every possible port, so how does it know when another ICQ user is trying to connect? This isn't an ICQ specific question - I'm just using it as an example - it could apply to any remotely opened connection to a port >1023. How is this handled (how does the computer know whether ICQ should handle the connect attempt or whether it should be handled by some other process)? Thanks in advance, Chris -- __ _ -o)/ / (_)__ __ ____ __ Chris Reeves /\\ /__/ / _ \/ // /\ \/ / ICQ# 22219005 _\_v __/_/_//_/\_,_/ /_/\_\

4 4

netatalk-1.4b2+asun2.1.3 and PAM
by Robert Casties 03 Dec '99

03 Dec '99

Hello! I recently found out (the hard way) that the SuSE netatalk package is not compiled to use PAM (although everything else in 6.2 does). As a consequence you are not able to authenticate users e.g. in NIS. I built new packages with proper PAM support (I think). If anyone's interested, drop me a line. Cheers Robert -- Robert Casties --------------------- http://philoscience.unibe.ch/~casties History & Philosophy of Science Tel: +41/31/631-8505 Room: 216 Institute for Exact Sciences Sidlerstrasse 5, CH-3012 Bern Uni Bern (PGP key on homepage: D7 2B DE 64 2D 65 16 A0)

1 1

Re: [suse-security] OpenSSH????????
by Admin 03 Dec '99

03 Dec '99

On Thu, 2 Dec 1999 21:22:06 -0500 (EST), Steve Kirby wrote: >> OpenSSL should work in place of SSLeay, too. > >Thanks! I was in a hurry and flat missed this. I'm not familiar with >OpenSSL. Is there a major difference between OpenSSL and SSLeay that would >make one preferable over the other for the purpose of porting OpenSSH? > OpenSSL is the successor of SSLeay and has some security bugs fixed. SSLeay is not supported/continued anymore... bye Mathias -- eregion.de -- administrative account

1 0

Ports that shouldn't be open
by Deirdre Saoirse 02 Dec '99

02 Dec '99

I'm told this came up recently, but I can't find it in the archives. I have port 719 open (I can see it with nmap), but I have *no* idea what is binding to the port. It's not a port registered with IANA, so something running on a privileged port as root that's not registered makees me paranoid (short trip!). Also, why does SuSE default to having port 6000 open when X is running (and how can I shut this off without a firewall)? Other Linux distros don't do this. -- _Deirdre * http://www.linuxcabal.net * http://www.deirdre.net My three rules for happy living: No Windows, No Java, No Perl. "I'd love to have the green paint concession on the next Matrix movie." -- Rick Moen

5 7

Secure mounting of filesystems
by Jochen Oster 02 Dec '99

02 Dec '99

Hi, in our department we have the problem to share /usr and /home directories between 4 Linux servers. Unfortunately we have no proper firewall and NFS seems to be a security problem. Could somebody please point me to a free or cheap secure network filesystem? Thanks Jochen Oster -- Sent through Global Message Exchange - http://www.gmx.net

2 1

RE: [suse-security] Ports that shouldn't be open
by Paxton, Michael 02 Dec '99

02 Dec '99

The x server can be started with the -nolisten TCP option can't it? I havent read the rest of this thread so I dont know if this has already been discussed.. Michael. > -----Original Message----- > From: Deirdre Saoirse [SMTP:deirdre@deirdre.net] > Sent: Thursday, December 02, 1999 4:48 PM > To: Daniel L. Donahue > Cc: suse-security(a)suse.com > Subject: Re: [suse-security] Ports that shouldn't be open > > On Wed, 1 Dec 1999, Daniel L. Donahue wrote: > > > On Wed, 1 Dec 1999, Deirdre Saoirse wrote: > > > Also, why does SuSE default to having port 6000 open when X is > running > > > (and how can I shut this off without a firewall)? Other Linux > distros > > > don't do this. > > Actually, i think most distros do this, because xfree86 by > default > > does this. There are two things that I know of you can do; one is > run > > xauth/xhost (read the man pages) and restrict access to your x > server. The > > other is to ipchains deny all packets to that connection. > > NONE of the other distros I've seen show it listening on port 6000! > > And the point is kinda moot: if xhost - means that it's still > listening on > port 6000, the problem isn't solved. > > > I usually use this line, since I don't need remote x > capabilities: > > ipchains -A input -p TCP -i eth0 -s ! localhost -d 0/0 6000 -j DENY > > But this is a firewall. If you'll note, I asked how to do it WITHOUT > a > firewall. > > -- > _Deirdre * http://www.linuxcabal.net * http://www.deirdre.net > My three rules for happy living: No Windows, No Java, No Perl. > "I'd love to have the green paint concession on the next Matrix > movie." > -- Rick Moen > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Firewall logs
by Frank Hart 01 Dec '99

01 Dec '99

Hi, I've been using Marc Heuse's firewall script and it works great. But I found some log entries (actually a lot;-) like: Nov 29 01:26:38 CC6743-a kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.99:138 192.168.0.255:138 L=237 S=0x00 I=57903 F=0x0000 T=64 (#5) As you can see, this is just my local network (the firewall machine itself). Someone told me that Samba, wich I use for accessing my printer, is trying to broadcast at the local network and that the firewall doesn't allow this. I''ve set FW_PROTECT_FROM_INTERNAL= to "no". Do I have to change other settings as well? Maybe I'm wrong, but with version 1.3 of Marc's SuSE Firewall this didn't happen. -- Frank Hart - mailto:frhart@home.nl SuSE Linux - Kernel 2.2.13 on a i586 100 Mhz with 24 Mb RAM

1 0

AW: [suse-security] Possible Hack attack ?
by Stefan Becker 01 Dec '99

01 Dec '99

Hi everybody, There has been alot of talk about portscans. What utility are you using to detect a portscan. Do I NEED a firewall before I can detect a portscan on the machine. Could someone please point me to utility / package to simply detect such a portscan and send a mail to me (the Network Admin). thanks, Stefan Becker LUFA Speyer becker(a)lufa-sp.vdlufa.de > Right. But, as as my log-files show, in many cases an attack follows the port > scan. > > I _always_ contact the gateway admin if I find a port scan, and, in some cases, > they find out that somebody intruded in their systems. > > So I think it is helpful to inform admins about port scans that come from their > systems. It's one way to avoid attacks followed by port scans. > > Regards, > > Martin

8 7

SuSE Security Announcement - new security tools
by marc＠suse.de 01 Dec '99

01 Dec '99

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Announcement of new security tools from SuSE ______________________________________________________________________________ Please note, that that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ Tools developed by SuSE (all open source) and included in SuSE 6.3 : SuSE FTP Proxy - The first program of the SuSE Proxy Suite. A secure FTP proxy with support for SSL, LDAP, command restriction, active and passive FTP support, and much more. RPM: fwproxy.rpm, fwproxys.rpm (SSL - not in the US version) SuSE Firewall - The new firewall script from SuSE, rewritten from scratch. Autodetection of interface information, masquerading, autoprotection of services, protection from internal networks, fail-close design and easy to configure. RPM: firewals.rpm Harden SuSE - A special script for hardening a SuSE Linux 5.3 - 6.3. By answering 9 questions, the system is reconfigured very tightly. e.g. disabling insecure network services, removing suid/sgid/world-writable permissions which are not critical. RPM: hardsuse.rpm SuSE Secumod - This loadable kernel module enhances the security of the system by adding a symlink/hardlink/pipe protection, procfs protection, trusted path execution and capabilities. RPM: secumod.rpm SuSE Secchk - These are cron scripts which run daily, weekly and monthly to check the security of the system and compare them to the last run. RPM: seccheck.rpm Yast-1 - New administration menu for setting password aging, authentication fail delay and logging of logins + failures. RPM: yast.rpm SuSE auditdisk - Please note that this tool is in beta phase! This tool generates a bootdisk with checksum data and all binaries etc. needed to automaticaly verify file checksums upon booting. This way it can't be subverted by lkm's like a standard e.g. tripwire installation. WWW: http://www.suse.de/~marc - not included on SuSE 6.3 yet Watch out for updates of these tools on our WWW or FTP update sites. Although these are tools developed by SuSE, they (should) work on any Linux distributions with little problems. New tools included in the SuSE Linux distribution (not created by SuSE): FreeS/WAN - IPSEC implementation to build secure VPN tunnels via public networks. RPM: freeswan.rpm (not in the US version) GNU Privacy Guard - A free pgp-like tool for secure (not limited to email) communication. Frontends are also included. RPM: gpg (not in the US version) Nessus - A very good network security scanner! RPM: nessus plus tmpwatch, arpwatch, plug, sslwrap, the newest nmap and more. "Old" packages include: john, saint, cipe, pgp, scanlogd, ssh, tripwire, etc. ______________________________________________________________________________ General information on SuSE Linux: http://www.suse.com You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update for Intel processors ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors or try the following web pages for a list of mirrors: http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/en/support/download/updates/ Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOD8G4Xey5gA9JdPZAQGdHwf9EqxQRsGFv+fONA6F5Aviv2pkf1pua3XM kRAJJcrvpZswnDb2PH3sJBq3YGm9ZXnz0JVhSEDoxuSz1V8GXV5wjh73wBg9YtGR hx6OzgfyFFYFdmJNEB3OpHNFzLmXuX0szrIfifRRcidWQzsPzAL50mtfcmGSZkab 3QHD3tz6oZLxuvQ6BGyie/iua3boza0MeJl2juKNq12VfievhZP6UK8/Y0nLbK2m 2zVqekGZIKfvlPitwCYPzF5Pxn9eh3TTnGDijxWTsMe0XpeakRZcAFte77kv9bNL SQwqA0nUKtoOGXdFVGxrspCbDRMDOKuMryNPo5ljsqpo3fjkfRNYVg== =obl6 -----END PGP SIGNATURE-----

6 5

PGP
by Scott McEachern 01 Dec '99

01 Dec '99

Does anyone know if PGP works with Netscape's Messenger? I was at the pgp site and it listed a lot of mail clients, no Netscape. -- mailto:scott.mceachern@sympatico.ca On the side of the software box, in the "System requirements section", it said "Requires Windows 95 or better." So I installed Linux.

3 2