December 1999 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] time differences in syslog
by engelbert gruber 09 Dec '99

09 Dec '99

Am Thu, 09 Dec 1999 schrieben Sie: > At 17.00 09/12/1999 +0100, you wrote: > > > >why is the time jumping when yast starts (suse 6.0) > >---- > >Dec 7 15:38:55 host su: (to root) xxx on /dev/ttyp0 > >Dec 7 14:40:01 host YaST[339]: Started the SuSE-Configuration Tool. > >Dec 7 14:40:01 host YaST[339]: Skipping new package checks. > >Dec 7 14:40:01 host YaST[339]: Reading /etc/rc.config and updating the > system... > >Dec 7 14:40:05 host syslog: Executing /sbin/conf.d/SuSEconfig.groff... > >Dec 7 14:40:05 host syslog: Executing /sbin/conf.d/SuSEconfig.perl... > >Dec 7 14:40:05 host syslog: Executing /sbin/conf.d/SuSEconfig.sendmail... > >Dec 7 14:40:07 host syslog: Finished. > >Dec 7 15:41:33 host kernel: > >---- > > As your timezone is +0100, it looks like YaST is logging your BIOS clock > time (did you set it to UTC, didn't you?) instead of localtime ... a YaST bug? GMT="" and in april the lag was 2 hours. anyway I would have thought, that syslog writes the time and not the application. > > Ciao > > > --------------------------------------- > Massimo Ferrario > Inforeti snc > via Pellizzo, 39 - 35100 Padova (Italy) > http://www.inforeti.it -- --- Engelbert Gruber --- SSG Fintl,Gruber,Lassnig A6140 Telfs Untermarkt 9 Tel. ++43-5262-64727 ---

2 1

time differences in syslog
by engelbert gruber 09 Dec '99

09 Dec '99

why is the time jumping when yast starts (suse 6.0) ---- Dec 7 15:38:55 host su: (to root) xxx on /dev/ttyp0 Dec 7 14:40:01 host YaST[339]: Started the SuSE-Configuration Tool. Dec 7 14:40:01 host YaST[339]: Skipping new package checks. Dec 7 14:40:01 host YaST[339]: Reading /etc/rc.config and updating the system... Dec 7 14:40:05 host syslog: Executing /sbin/conf.d/SuSEconfig.groff... Dec 7 14:40:05 host syslog: Executing /sbin/conf.d/SuSEconfig.perl... Dec 7 14:40:05 host syslog: Executing /sbin/conf.d/SuSEconfig.sendmail... Dec 7 14:40:07 host syslog: Finished. Dec 7 15:41:33 host kernel: ---- -- --- Engelbert Gruber --- SSG Fintl,Gruber,Lassnig A6140 Telfs Untermarkt 9 Tel. ++43-5262-64727 ---

1 0

Re: [suse-security] rsh problem
by Wagner, Uwe 09 Dec '99

09 Dec '99

Thanks for your help, now it works. I had to add hostname and username in the user's .rhosts. Uwe --- Uwe Wagner Tel: +49-6224-9713-47 GEF Gesellschaft für EDV-Software mbH Fax: +49-6224-9713-40 Ferdinand-Porsche Str 4a email: Uwe.Wagner(a)gef.de 69181 Leimen http://www.gef.de

1 0

http log entry
by Heiko Degenhardt 09 Dec '99

09 Dec '99

Hallo all! My web server was probed on ports 80, 8080 and 3128 (all ports for http/proxies, afaik). The source issued the following command (broken to fit in the Mail): "GET http://www.rusftpsearch.net/ cgi-bin/pst.pl?pstmode=writeip&psthost=195.37.62.127&pstport=80". Can someone please point me to some information for that probe? What were they doing? Has somebody seen the same probe? Does somebody know the server www.rusftpsearch.net (I can't find some information for it). Thank you very much for your help. With kind regards. Heiko.

4 4

Re: [suse-security] rsh problem
by Wagner, Uwe 08 Dec '99

08 Dec '99

I don't have described the problem correctly. The commands rsh cvs-server -l wa date or rsh cvs-server date started as user 'wa' on host sun.gef.de prints out the date. But if I say rsh cvs-server -l ab date the output is permission denied I've made the following entries on cvs-server : in /etc/hosts.equiv sun.gef.de in ab's .rhosts (permissions 600 and owner ab) sun.gef.de If I start as user wa rsh sun -l ab date on host cvs-server, it prints the date. On sun I've made the entry in /etc/hosts.equiv cvs-server + This entry don't work on SuSE linux ? Can somebody help me ? Thanks Uwe --- Uwe Wagner Tel: +49-6224-9713-47 GEF Gesellschaft für EDV-Software mbH Fax: +49-6224-9713-40 Ferdinand-Porsche Str 4a email: Uwe.Wagner(a)gef.de 69181 Leimen http://www.gef.de

2 1

rsh problem
by Wagner, Uwe 08 Dec '99

08 Dec '99

Hi, the following command started on the unix box 'sun' : rsh cvs-server -l wa date reports permision denied The username 'wa' has the same id on both boxes. Without option '-l wa' everything is ok. The host sun.gef.de has an entry in /etc/hosts.equiv on cvs-server. cvs-server is an unix box running SuSE 6.2 sun is an unix box running Solaris Who can help ? thanks uwe --- Uwe Wagner Tel: +49-6224-9713-47 GEF Gesellschaft für EDV-Software mbH Fax: +49-6224-9713-40 Ferdinand-Porsche Str 4a email: Uwe.Wagner(a)gef.de 69181 Leimen http://www.gef.de

2 1

SSH clients
by Massimiliano Hofer 08 Dec '99

08 Dec '99

Hi, I happily used ssh for a while, but I have to allow access to a Linux box from various other clients and many of them run on Windows. Does anyone know if there is some porting of OpenSSH (or similar) for Windows or MacOS? -- Bye, /\/\ / Admin of SiLink |char*p="char*p=%c%s%c;main(){printf(p, (/\/\)ax. SysOp of Ade BBS |34,p,34);}";main(){printf(p,34,p,34);}

9 8

RE: [suse-security] rsh problem
by Adrian Bellini 08 Dec '99

08 Dec '99

Hi All again Jsut to clarify -- I was reading my Solaris reader list when I answered the last.... I thought I was talking to a Sun user !!! I'm not really compleately embarrased !!!! Sorry Ade -----Original Message----- From: Wagner, Uwe To: 'suse-security(a)suse.com' Sent: 12/8/99 8:30 AM Subject: [suse-security] rsh problem Hi, the following command started on the unix box 'sun' : rsh cvs-server -l wa date reports permision denied The username 'wa' has the same id on both boxes. Without option '-l wa' everything is ok. The host sun.gef.de has an entry in /etc/hosts.equiv on cvs-server. cvs-server is an unix box running SuSE 6.2 sun is an unix box running Solaris Who can help ? thanks uwe --- Uwe Wagner Tel: +49-6224-9713-47 GEF Gesellschaft für EDV-Software mbH Fax: +49-6224-9713-40 Ferdinand-Porsche Str 4a email: Uwe.Wagner(a)gef.de 69181 Leimen http://www.gef.de -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

RE: [suse-security] rsh problem
by Adrian Bellini 08 Dec '99

08 Dec '99

Hi What is the kerbos situation ?? the -l option changes it to a rlogin authentication, If you can - look am the SuSe man page (sorry for that !) it might differ from Sun (I normally work with SuSE !!!). Ade -----Original Message----- From: Wagner, Uwe To: 'suse-security(a)suse.com' Sent: 12/8/99 8:30 AM Subject: [suse-security] rsh problem Hi, the following command started on the unix box 'sun' : rsh cvs-server -l wa date reports permision denied The username 'wa' has the same id on both boxes. Without option '-l wa' everything is ok. The host sun.gef.de has an entry in /etc/hosts.equiv on cvs-server. cvs-server is an unix box running SuSE 6.2 sun is an unix box running Solaris Who can help ? thanks uwe --- Uwe Wagner Tel: +49-6224-9713-47 GEF Gesellschaft für EDV-Software mbH Fax: +49-6224-9713-40 Ferdinand-Porsche Str 4a email: Uwe.Wagner(a)gef.de 69181 Leimen http://www.gef.de -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] http log entry
by Admin 08 Dec '99

08 Dec '99

On Wed, 08 Dec 1999 10:00:30 +0100, Heiko Degenhardt wrote: > >Hallo all! > >My web server was probed on ports 80, 8080 and 3128 >(all ports for http/proxies, afaik). > >The source issued the following command (broken to fit >in the Mail): >"GET http://www.rusftpsearch.net/cgi-bin/pst.pl?pstmode=writeip&psthost=195.37.6…". > >Can someone please point me to some information for that probe? >What were they doing? >Has somebody seen the same probe? >Does somebody know the server www.rusftpsearch.net >(I can't find some information for it). Post the source adress from whichthe request came... this is what whoius knows about rusftpsearch.net: aragorn:~ # whois -h whois.networksolutions.com rusftpsearch.net The Data in Network Solutions' WHOIS database is provided by Network Solutions for information purposes, and to assist persons in obtaining information about or related to a domain name registration record. Network Solutions does not guarantee its accuracy. By submitting a WHOIS query, you agree that you will use this Data only for lawful purposes and that, under no circumstances will you use this Data to: (1) allow, enable, or otherwise support the transmission of mass unsolicited, commercial advertising or solicitations via e-mail (spam); or (2) enable high volume, automated, electronic processes that apply to Network Solutions (or its systems). Network Solutions reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy. Registrant: EA CO. (RUSFTPSEARCH-DOM) BARLACHSTRASSE 16 BAVARIA, INGOLSTADT 85053 DE Domain Name: RUSFTPSEARCH.NET Administrative Contact, Technical Contact, Zone Contact: Hertziger, Brian (SNX5) SAN(a)ID.RU 1-414-329-8511 Billing Contact: Hertziger, Brian (SNX5) SAN(a)ID.RU 1-414-329-8511 Record last updated on 27-Oct-1999. Record created on 05-Aug-1999. Database last updated on 7-Dec-1999 16:53:53 EST. Domain servers in listed order: NS1.BLUEGRAVITY.COM 207.254.128.2 NS2.BLUEGRAVITY.COM 207.254.128.3 -- eregion.de -- administrative account

2 1