July 1999 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

multi-services server securing
by Gediminas Grigas 16 Aug '00

16 Aug '00

Hello there, I feel erroneusly (?) secure after .host.denyed in.telnetd and in.sshd from everywhere except one pc, which is denying all exept keyboard. I belive that if i can keep hosts.deny and hosts.allow files safe, and from time to time patch most actual security holes i`ll be conditionaly safe. Em i wrong? Probably I do. I just cant imaginate how system can be cracked in lower stage, so that is my problem. I heard that inetd is very insecure, and some peoples using tcpd (or soundlike). I run harden_suse, but was forced to answer 8/10 to no, as my server should provide a lot of public services, and have world writible directories as well. And thats right - this script was developed not for systems like mine one. However i`ll run SuSE-firewall-3.0 script, to make my system even stronger. But thats all. I dont know what can i do else. I should keep folowing services open: httpd; smptd; pop3d; ftpd; snmpd; named; inetd; sshd; nscd. So if you know how to keep them at minimal risk, or know some holes at those, i would be very gratefull for any info and/or tips. I dont ask to do work for me - link to good manual would be nice too. By the way i have SuSE 6.3 (2.2.13). Thanks in advice. Sincerely Yours, Gediminas Grigas mailto:gedas@kryptis.lt

5 5

ssh-authtication
by Security Webmaster OKDesign oHG 06 Dec '99

06 Dec '99

Hi folks, umm, I have a small problem. When setting up our server, I tried to get the best security as possible. Maybe I changed some config-file to fit our needs to allow ssh-logins only from specified users.(But I have no idea which file this was :-(( ) Now I want to allow another user to login using ssh. I made ssh-keygen for this user, entered the password, copied identity.pub to authorized_keys in the .ssh-directory. But when trying to login via ssh, servers sends permission denied. What else must be done ? TIA ---Stephan

3 2

NFS Security question
by F. Steiner 17 Aug '99

17 Aug '99

Hi, we just considered the following problem: Assume that a file system (let's say home directories of users) is exported from a server to some other computers (like in every university for instance). Now one comes with his laptop to the university, plugs one computer off, gives his laptop the ip of the unplugged computer and creates a user on his laptop that exists in the university domain with the identical name and id. Now the file system is exported to his laptop, too, because it has an ip from a university computer, and then the faker should be able to read and write the home directory of the user which he created, because NFS does not check the passwords but only the user id. We tried that and it did work. This is indeed a huge problem, because it looks like we cannot prevent any student from doing this, i.e. installing a user for instance with name and id of a professor, and then having access to the professors home directory. Has anyone any idea how to prevent this??? Can NFS be told to check passwords during mounting? For example, rlogin would not work in the situation constructed above because it would realize the user having two different passwords. But can NFS be told to do that? Thx for any help! Best, Frank -- Frank Steiner mailto:steiner@informatik.rwth-aachen.de http://www-i2.informatik.rwth-aachen.de/steiner/

10 9

CGI-scan
by belial 01 Aug '99

01 Aug '99

hi Today i downloaded CGI-scanner and scanned my PC(SuseLinux 6.0).The scanner founds only one bug: Searching for test-cgi : Found!! Can somebody tell me how does this bug work and what would a cracker do to gain access. And how can i fix this bug? Th@nx Christian

10 10

Re: [suse-security] nessus output
by earendil7＠juno.com 31 Jul '99

31 Jul '99

On Thu, 29 Jul 1999 17:39:03 +0100 (IST) Eric Mosley <ericm(a)iol.ie> writes: >Hi, > >I recently ran nessus and it gave me some information like this ... > >On this machine, there is an X11-Server that grants access >without authentification. That means a hacker is able to sniff >every keystroke that is typed on the X11-Server (or get a copy of the >victims screen). >Solution: use MIT-Cookies, xauth. > >How do I get rid of this and stil use X11. Is using MIT-Cookies, xauth a >real big change?? > >Also, can I comment out in inetd.conf telnet shell and login and still >start a new xterm? > >Thanks for you thoughts, > >Eric If you don't need or want to export your x server to any other machines, I think you can configure xhost to not accept any connections at port 6000 from anywhere other than the localhost. I did that with my suse 6.1 box, and I no longer get an open port 6000 in any scans I do (nessus, nmap, etc.). Look at man xhost. I'm not positive, but with this setup, a box will not be compromised *because* of X, but could be manipulated to setup up X to export. Course, at that point, the box is already compromised anyway... dan ___________________________________________________________________ Get the Internet just the way you want it. Free software, free e-mail, and free Internet access for a month! Try Juno Web: http://dl.www.juno.com/dynoget/tagj.

1 0

nessus output
by Eric Mosley 30 Jul '99

30 Jul '99

Hi, I recently ran nessus and it gave me some information like this ... On this machine, there is an X11-Server that grants access without authentification. That means a hacker is able to sniff every keystroke that is typed on the X11-Server (or get a copy of the victims screen). Solution: use MIT-Cookies, xauth. How do I get rid of this and stil use X11. Is using MIT-Cookies, xauth a real big change?? Also, can I comment out in inetd.conf telnet shell and login and still start a new xterm? Thanks for you thoughts, Eric

6 7

SSL in C++?
by Dennis 29 Jul '99

29 Jul '99

Hi, Are there any SSL librarys written in C++ or any C++ wrappers for SSLeay/OpenSSL? (An iostream-like library would be the best.) Thanks in advance, Dennis Stachowicz

1 0

Re: [suse-security] nessus output
by Michael Bausch 29 Jul '99

29 Jul '99

hi all, SuSE 6.0 provides a solution for MIT-Cookies in conjunction with startx almost out of the box. one just has to find (!) and activate it. from /etc/skel/.xserverrc.secure (in package aaa_skel-98.12.10-0.rpm): # move this file to ~/.xserverrc, if you don't want to allow # everybody to get access to your X-Server copying /etc/skel/.xserverrc.secure to /usr/X11R6/lib/X11/xinit/xserverrc istaead of to ~/.xserverrc enables MIT-Cookies for all users of the system. (SuSE: why not doing this in the default installation?) btw: there is a startx-related local security issue. when you fire up X11 using startx, xlock the screen and walk away, someone with access to the keyboard could just switch back to the text console, background the startx process, kill the xlock process and thus gain full access to your Xsession. this can be prevented by using something like (startx &); exit instead of startx. michael ------------------------------------------------------------------------------- Michael Bausch Arbeitsbereich Funktionalanalysis // Mathematisches Institut // Uni Tuebingen miba(a)michelangelo.mathematik.uni-tuebingen.de +49 7071 29-78566 -------------------------------------------------------------------------------

1 0

any major suse 6.1 security flaws? with the 2.2.7 kernel?
by steganos 29 Jul '99

29 Jul '99

i just recently upgraded my suse6.1 with the 2.2.5 kernel to 6.1 with the 2.2.7 kernel, and was wondering if theres any major security flaws with it? i was using rh6.0 and was getting hacked all the time, so i got smarter and switched to suse and havent been hacked yet....I just hope that suse6.2 doesnt become bloated like rh6 did and increase their price on it if i order online or purchase it in the store? be sure to stop by irc-2.mit.edu:6667 #linux and say hey to everyone. for those who still use rh, version 5.2 with the 2.2.9 kernel is pretty good and secure......L8tr

1 0

passwd
by Dieter M�ller 29 Jul '99

29 Jul '99

Hello, I already sent this message a few days ago, but I didn't saw it on the list, if I only missed it I have to say sorry in advance. I need a one-time-password authentication system which allows me to log in via an untrusted terminal, p.ex via telnet from win-xy. The problem is that I can't disable telnet on my pc thince I still need it to log in from my secure network. The very best would be a telnet-alike protocol which allows to choose between giving a normal or a one-time password. Dieter _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com

10 10

problems with passwd
by Jean Luc Laborde 29 Jul '99

29 Jul '99

1 0

Secure-Linux extensions for Kernel 2.2.x?
by Markus Gaugusch 28 Jul '99

28 Jul '99

Hi there! Maybe you've heard about the secure-linux-patches for kernel versions 2.0.x, which hide foreign processes from normal users. Only root can see all processes running. Has anyone of you found the equivalent (proc-fs patches, etc.) for the 2.2.x series?? TIA Markus ____________________________________ Markus Gaugusch m.gaugusch(a)xpoint.at ICQ-ID: 11374583 [www.mirabilis.com] *** *** *** Hi! I'm a .signature virus! *** *** *** Copy me into your .signature file to help me spread!

1 0

Re: [suse-security] passwd
by Michael Salmon 28 Jul '99

28 Jul '99

+----- On Tue, 27 Jul 1999 03:17:02 PDT, Dieter "Müller" writes: | Hello, | | I already sent this message a few days ago, but I didn't saw it on the | list, if I only missed it I have to say sorry in advance. | | I need a one-time-password authentication system which allows me to log | in via an untrusted terminal, p.ex via telnet from win-xy. | The problem is that I can't disable telnet on my pc thince I still need | it to log in from my secure network. | | The very best would be a telnet-alike protocol which allows to choose | between giving a normal or a one-time password. You could try s-key or opie (which is derived from s-key). With s-key you generate 100 passwords that you use in turn. I believe that s-key can be broken if enough passwords are collected but I am unsure of the details. Another alternative is kerberos but that is probably an overkill, as I guess that you aren't a US resident you will need to fetch it from KTH in Stockholm. Sorry no URL's. /Michael

1 0

Help: our system has been hacked...!
by Josef Frohn 28 Jul '99

28 Jul '99

Dear all, I am using Suse5.2 with the according security-patches from the Suse server. We have a valid IP, which means that our server is accessible from the Internet. The server acts as a gateway for a small company network. Now it looks as if our system has been hacked. I had several imapd reports during the last time and it ended up with the following sequence in my /var/log/messages: ---------------------------- Jul 14 13:24:52 server imapd[1819]: connect from root@<IP1> Jul 14 13:25:22 server in.telnetd[1820]: connect from <IP2> Jul 14 13:25:35 server login[1821]: no shadow password for `slovaka' on `ttyp3' from `pool051-max3.ds36-ca-us.dialup.<some-net> Jul 14 13:25:45 server su: (to r00t) slovaka on /dev/ttyp3 -------------------------- I checked with Yast the list of users and found the user "slovaka" and the user r00t (with root permissions!) as well. Besides that I can't see any further changes to the system. How did slovaka/r00t enter my system? How can I find out what he did? The numerical uid of him was the same as my personal account (500), so I can't use the id... I deleted those accounts and forced all users to change their passwords. But who enters the system within seconds once, will be able to do it a 2nd time as well, so how can I close this hole? Nobody uses imap in our group. Wouldn't it be best to stop imapd? I find no entry in rc.config and I don't know how to remove it from the startup scripts (can I just remove the imp<#> lines from /etc/services?) Any hint is appreciated! Josef BTW: I am using a different system to write this email.... -- -- Dr. J. Frohn - S.I.S. GmbH email: frohn(a)sis-gmbh.com Kaiserstr. 100 http:\\www.sis-gmbh.com 52134 Herzogenrath - GERMANY T +49 (0) 2407 96147 -- F +49 (0) 2407 96275 --

18 18

Leafnode problems?
by Nick Zentena 27 Jul '99

27 Jul '99

Hi, I spent some time checking my messages log file last night and noticed a couple of connects to leafnode from outside. Now these connection don't show a username just a IP address. Is there a known problem with leafnode? [I'm running leafnode 1.9.3] I've edited my host.allow/deny files to stop any non-local access but I'm curious. Thanks Nick -- --------------------- Nick Zentena SuSE 6.1 Linux 2.2.10 ---------------------

2 1

AW: [suse-security] Help: our system has been hacked...! (IMAPD-H ACK)
by Wyss Clemens 27 Jul '99

27 Jul '99

Found the following links http://www.lh.umu.se/~bjorn/mhonarc-files/linux-security/msg00652.html http://www.lh.umu.se/~bjorn/mhonarc-files/linux-security/msg01155.html http://www.lh.umu.se/~bjorn/mhonarc-files/linux-security/msg01149.html and there are even more articles on that site (Viel Glück) Clemens -----Ursprüngliche Nachricht----- Von: Josef Frohn [mailto:frohn@sis-gmbh.com] Gesendet am: Montag, 26. Juli 1999 16:12 An: suse-security(a)suse.com Betreff: [suse-security] Help: our system has been hacked...! Dear all, I am using Suse5.2 with the according security-patches from the Suse server. We have a valid IP, which means that our server is accessible from the Internet. The server acts as a gateway for a small company network. Now it looks as if our system has been hacked. I had several imapd reports during the last time and it ended up with the following sequence in my /var/log/messages: ---------------------------- Jul 14 13:24:52 server imapd[1819]: connect from root@<IP1> Jul 14 13:25:22 server in.telnetd[1820]: connect from <IP2> Jul 14 13:25:35 server login[1821]: no shadow password for `slovaka' on `ttyp3' from `pool051-max3.ds36-ca-us.dialup.<some-net> Jul 14 13:25:45 server su: (to r00t) slovaka on /dev/ttyp3 -------------------------- I checked with Yast the list of users and found the user "slovaka" and the user r00t (with root permissions!) as well. Besides that I can't see any further changes to the system. How did slovaka/r00t enter my system? How can I find out what he did? The numerical uid of him was the same as my personal account (500), so I can't use the id... I deleted those accounts and forced all users to change their passwords. But who enters the system within seconds once, will be able to do it a 2nd time as well, so how can I close this hole? Nobody uses imap in our group. Wouldn't it be best to stop imapd? I find no entry in rc.config and I don't know how to remove it from the startup scripts (can I just remove the imp<#> lines from /etc/services?) Any hint is appreciated! Josef BTW: I am using a different system to write this email.... -- -- Dr. J. Frohn - S.I.S. GmbH email: frohn(a)sis-gmbh.com Kaiserstr. 100 http:\\www.sis-gmbh.com 52134 Herzogenrath - GERMANY T +49 (0) 2407 96147 -- F +49 (0) 2407 96275 -- --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0