December 1999 - openSUSE Security - openSUSE Mailing Lists

portscanning and high ports
by Chris Reeves 03 Dec '99

03 Dec '99

Hi all, I have been portscanned a number of times recently by the same computer. I've used a combination of nslookup and finger and have the name of the culprit. It is being dealt with. This has prompted me to look even more closely at my firewalling. Ports <1024 are OK, as they are totally blocked, but those >1023 are pretty much open. Although virtually every single service is commented out in inetd.conf, I still want to block and log any connect attempts to 'special' ports. At the moment, these are the high numbered ports I block: 1433 Microsoft SQL 2049 NFS 5432 PostgreSQL 5999:6010 X-Windows 7100 X Font Server 12345:12346 NetBus 31337 Back Orifice I was having a look at the high numbered ports that he was scanning, and was wondering what the significance of these ports was (I couldn't see anything in /etc/services). By the way, the following are the high numbered ports that he tried to scan, have any ideas what they are used for? 5190 5191 5192 5193 5631 5632 5800 5900 8000 8010 8080 9100 25867 31787 33333 And finally, are there any other high numbered ports that you think could be potentially damaging (eg webmin - which port is that on)? Even if I'm not running that service, I would still like to know which ones pose a security threat so that I can block them anyway (in case I'm playing and start webmin, for example, without realilsing it). Is it generally considered safe to open up most high numbered ports? What do the people on these lists do? Do you close them all and open some, or open all and close some (all meaning all ports >1023)? One last question - I keep on coming around to this one every so often. If someone wants to connect to me using ICQ, they connect to a port >1023. I am assuming that ICQ doesn't have a daemon or anything listening on every possible port, so how does it know when another ICQ user is trying to connect? This isn't an ICQ specific question - I'm just using it as an example - it could apply to any remotely opened connection to a port >1023. How is this handled (how does the computer know whether ICQ should handle the connect attempt or whether it should be handled by some other process)? Thanks in advance, Chris -- __ _ -o)/ / (_)__ __ ____ __ Chris Reeves /\\ /__/ / _ \/ // /\ \/ / ICQ# 22219005 _\_v __/_/_//_/\_,_/ /_/\_\

4 4

netatalk-1.4b2+asun2.1.3 and PAM
by Robert Casties 03 Dec '99

03 Dec '99

Hello! I recently found out (the hard way) that the SuSE netatalk package is not compiled to use PAM (although everything else in 6.2 does). As a consequence you are not able to authenticate users e.g. in NIS. I built new packages with proper PAM support (I think). If anyone's interested, drop me a line. Cheers Robert -- Robert Casties --------------------- http://philoscience.unibe.ch/~casties History & Philosophy of Science Tel: +41/31/631-8505 Room: 216 Institute for Exact Sciences Sidlerstrasse 5, CH-3012 Bern Uni Bern (PGP key on homepage: D7 2B DE 64 2D 65 16 A0)

1 1

Re: [suse-security] OpenSSH????????
by Admin 03 Dec '99

03 Dec '99

On Thu, 2 Dec 1999 21:22:06 -0500 (EST), Steve Kirby wrote: >> OpenSSL should work in place of SSLeay, too. > >Thanks! I was in a hurry and flat missed this. I'm not familiar with >OpenSSL. Is there a major difference between OpenSSL and SSLeay that would >make one preferable over the other for the purpose of porting OpenSSH? > OpenSSL is the successor of SSLeay and has some security bugs fixed. SSLeay is not supported/continued anymore... bye Mathias -- eregion.de -- administrative account

1 0

Ports that shouldn't be open
by Deirdre Saoirse 02 Dec '99

02 Dec '99

I'm told this came up recently, but I can't find it in the archives. I have port 719 open (I can see it with nmap), but I have *no* idea what is binding to the port. It's not a port registered with IANA, so something running on a privileged port as root that's not registered makees me paranoid (short trip!). Also, why does SuSE default to having port 6000 open when X is running (and how can I shut this off without a firewall)? Other Linux distros don't do this. -- _Deirdre * http://www.linuxcabal.net * http://www.deirdre.net My three rules for happy living: No Windows, No Java, No Perl. "I'd love to have the green paint concession on the next Matrix movie." -- Rick Moen

5 7

Secure mounting of filesystems
by Jochen Oster 02 Dec '99

02 Dec '99

Hi, in our department we have the problem to share /usr and /home directories between 4 Linux servers. Unfortunately we have no proper firewall and NFS seems to be a security problem. Could somebody please point me to a free or cheap secure network filesystem? Thanks Jochen Oster -- Sent through Global Message Exchange - http://www.gmx.net

2 1

RE: [suse-security] Ports that shouldn't be open
by Paxton, Michael 02 Dec '99

02 Dec '99

The x server can be started with the -nolisten TCP option can't it? I havent read the rest of this thread so I dont know if this has already been discussed.. Michael. > -----Original Message----- > From: Deirdre Saoirse [SMTP:deirdre@deirdre.net] > Sent: Thursday, December 02, 1999 4:48 PM > To: Daniel L. Donahue > Cc: suse-security(a)suse.com > Subject: Re: [suse-security] Ports that shouldn't be open > > On Wed, 1 Dec 1999, Daniel L. Donahue wrote: > > > On Wed, 1 Dec 1999, Deirdre Saoirse wrote: > > > Also, why does SuSE default to having port 6000 open when X is > running > > > (and how can I shut this off without a firewall)? Other Linux > distros > > > don't do this. > > Actually, i think most distros do this, because xfree86 by > default > > does this. There are two things that I know of you can do; one is > run > > xauth/xhost (read the man pages) and restrict access to your x > server. The > > other is to ipchains deny all packets to that connection. > > NONE of the other distros I've seen show it listening on port 6000! > > And the point is kinda moot: if xhost - means that it's still > listening on > port 6000, the problem isn't solved. > > > I usually use this line, since I don't need remote x > capabilities: > > ipchains -A input -p TCP -i eth0 -s ! localhost -d 0/0 6000 -j DENY > > But this is a firewall. If you'll note, I asked how to do it WITHOUT > a > firewall. > > -- > _Deirdre * http://www.linuxcabal.net * http://www.deirdre.net > My three rules for happy living: No Windows, No Java, No Perl. > "I'd love to have the green paint concession on the next Matrix > movie." > -- Rick Moen > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Firewall logs
by Frank Hart 01 Dec '99

01 Dec '99

Hi, I've been using Marc Heuse's firewall script and it works great. But I found some log entries (actually a lot;-) like: Nov 29 01:26:38 CC6743-a kernel: Packet log: input DENY eth0 PROTO=17 192.168.0.99:138 192.168.0.255:138 L=237 S=0x00 I=57903 F=0x0000 T=64 (#5) As you can see, this is just my local network (the firewall machine itself). Someone told me that Samba, wich I use for accessing my printer, is trying to broadcast at the local network and that the firewall doesn't allow this. I''ve set FW_PROTECT_FROM_INTERNAL= to "no". Do I have to change other settings as well? Maybe I'm wrong, but with version 1.3 of Marc's SuSE Firewall this didn't happen. -- Frank Hart - mailto:frhart@home.nl SuSE Linux - Kernel 2.2.13 on a i586 100 Mhz with 24 Mb RAM

1 0

AW: [suse-security] Possible Hack attack ?
by Stefan Becker 01 Dec '99

01 Dec '99

Hi everybody, There has been alot of talk about portscans. What utility are you using to detect a portscan. Do I NEED a firewall before I can detect a portscan on the machine. Could someone please point me to utility / package to simply detect such a portscan and send a mail to me (the Network Admin). thanks, Stefan Becker LUFA Speyer becker(a)lufa-sp.vdlufa.de > Right. But, as as my log-files show, in many cases an attack follows the port > scan. > > I _always_ contact the gateway admin if I find a port scan, and, in some cases, > they find out that somebody intruded in their systems. > > So I think it is helpful to inform admins about port scans that come from their > systems. It's one way to avoid attacks followed by port scans. > > Regards, > > Martin

8 7

SuSE Security Announcement - new security tools
by marc＠suse.de 01 Dec '99

01 Dec '99

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Announcement of new security tools from SuSE ______________________________________________________________________________ Please note, that that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ Tools developed by SuSE (all open source) and included in SuSE 6.3 : SuSE FTP Proxy - The first program of the SuSE Proxy Suite. A secure FTP proxy with support for SSL, LDAP, command restriction, active and passive FTP support, and much more. RPM: fwproxy.rpm, fwproxys.rpm (SSL - not in the US version) SuSE Firewall - The new firewall script from SuSE, rewritten from scratch. Autodetection of interface information, masquerading, autoprotection of services, protection from internal networks, fail-close design and easy to configure. RPM: firewals.rpm Harden SuSE - A special script for hardening a SuSE Linux 5.3 - 6.3. By answering 9 questions, the system is reconfigured very tightly. e.g. disabling insecure network services, removing suid/sgid/world-writable permissions which are not critical. RPM: hardsuse.rpm SuSE Secumod - This loadable kernel module enhances the security of the system by adding a symlink/hardlink/pipe protection, procfs protection, trusted path execution and capabilities. RPM: secumod.rpm SuSE Secchk - These are cron scripts which run daily, weekly and monthly to check the security of the system and compare them to the last run. RPM: seccheck.rpm Yast-1 - New administration menu for setting password aging, authentication fail delay and logging of logins + failures. RPM: yast.rpm SuSE auditdisk - Please note that this tool is in beta phase! This tool generates a bootdisk with checksum data and all binaries etc. needed to automaticaly verify file checksums upon booting. This way it can't be subverted by lkm's like a standard e.g. tripwire installation. WWW: http://www.suse.de/~marc - not included on SuSE 6.3 yet Watch out for updates of these tools on our WWW or FTP update sites. Although these are tools developed by SuSE, they (should) work on any Linux distributions with little problems. New tools included in the SuSE Linux distribution (not created by SuSE): FreeS/WAN - IPSEC implementation to build secure VPN tunnels via public networks. RPM: freeswan.rpm (not in the US version) GNU Privacy Guard - A free pgp-like tool for secure (not limited to email) communication. Frontends are also included. RPM: gpg (not in the US version) Nessus - A very good network security scanner! RPM: nessus plus tmpwatch, arpwatch, plug, sslwrap, the newest nmap and more. "Old" packages include: john, saint, cipe, pgp, scanlogd, ssh, tripwire, etc. ______________________________________________________________________________ General information on SuSE Linux: http://www.suse.com You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update for Intel processors ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors or try the following web pages for a list of mirrors: http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/en/support/download/updates/ Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOD8G4Xey5gA9JdPZAQGdHwf9EqxQRsGFv+fONA6F5Aviv2pkf1pua3XM kRAJJcrvpZswnDb2PH3sJBq3YGm9ZXnz0JVhSEDoxuSz1V8GXV5wjh73wBg9YtGR hx6OzgfyFFYFdmJNEB3OpHNFzLmXuX0szrIfifRRcidWQzsPzAL50mtfcmGSZkab 3QHD3tz6oZLxuvQ6BGyie/iua3boza0MeJl2juKNq12VfievhZP6UK8/Y0nLbK2m 2zVqekGZIKfvlPitwCYPzF5Pxn9eh3TTnGDijxWTsMe0XpeakRZcAFte77kv9bNL SQwqA0nUKtoOGXdFVGxrspCbDRMDOKuMryNPo5ljsqpo3fjkfRNYVg== =obl6 -----END PGP SIGNATURE-----

6 5

PGP
by Scott McEachern 01 Dec '99

01 Dec '99

Does anyone know if PGP works with Netscape's Messenger? I was at the pgp site and it listed a lot of mail clients, no Netscape. -- mailto:scott.mceachern@sympatico.ca On the side of the software box, in the "System requirements section", it said "Requires Windows 95 or better." So I installed Linux.

3 2