August 1999 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] NFS Security question
by Michael Salmon 11 Aug '99

11 Aug '99

+----- On Fri, 30 Jul 1999 11:46:05 +0200, "F. Steiner" writes: | Hi, | | we just considered the following problem: Assume that | a file system (let's say home directories of users) | is exported from a server to some other computers | (like in every university for instance). | | Now one comes with his laptop to the university, | plugs one computer off, gives his laptop the ip | of the unplugged computer and creates a user on | his laptop that exists in the university domain | with the identical name and id. | | Now the file system is exported to his laptop, too, | because it has an ip from a university computer, | and then the faker should be able to read and write the | home directory of the user which he created, | because NFS does not check the passwords but only | the user id. | | We tried that and it did work. | This is indeed a huge problem, because it looks | like we cannot prevent any student from doing this, | i.e. installing a user for instance with name and id | of a professor, and then having access to the professors | home directory. | | Has anyone any idea how to prevent this??? | Can NFS be told to check passwords during mounting? | For example, rlogin would not work in the situation | constructed above because it would realize the user | having two different passwords. | But can NFS be told to do that? There are better forms of security in NFS version 3 but I don't think that Linux supports them. /Michael

2 1

suse-security-owner out to lunch?
by Seth R Arnold 11 Aug '99

11 Aug '99

Hello. Please forgive me for sending administrative junk to the mailing list; however, I think the suse-security-owner address is not read by a human, if read at all. Perhaps the list traffic *is* read by an employee at suse that can help us out. Please unsubscribe everyone from interact.de. The constant anti-spam warnings are getting frustrating. They obviously do not want to hear from us. Perhaps we should help them out, and unsubscribe all their users from the list. The user will NEVER see any email from us, since it all goes to a bitbucket. They will assume it has NO TRAFFIC. Which, perhaps, it soon will. I have tried to contact postmaster(a)interact.de, root(a)interact.de, hostmaster(a)interact.de, and since I only know the whois.internic.net and whois.ripe.net whois servers, I have run out of steam for trying to contact their system administrators. Please unsubscribe h7632536(a)est.eupm.upc.es. They no longer exist. Not at all. All emails to postmaster(a)agulla.upc.es (the address suggested in the error email) and postmaster(a)upc.es and postmaster(a)eupm.upc.es as well as root@ and hostmaster@ go unanswered. I will be happy to provide the full emails, complete with full headers, to any that ask -- this email will generate one from both of those two sites. Please don't let me down suse... unsubscribe the users that no longer exist. unsubscribe the users that cannot recieve the list. unsubscribe the users that set vacation but plain forget their medium-traffic mailing lists. If the job is taking too much employee time, I proffer my time for administrating the list, or moderating the list, what have you. Thank you. And sorry to everyone else. -- Seth Arnold | ICQ 3172483 | http://cswww.willamette.edu/~sarnold/ I prosecute unsolicited bulk emails, using the RealTime BlackHole List. You should too. Ask me how, or visit http://maps.vix.com/rbl/

1 0

[suse-security] root
by Casey Bralla 11 Aug '99

11 Aug '99

Sorry, but I'm a heretic. I **LIKE** to log in as root. If I muck it up, great! I'll just have to rebuild it again, and **THAT'S** how I learn all about it. Casey Bralla Chief Nerd In Residence The NerdWorld Organisation http://www.NerdWorld.org LinuxList(a)NerdWorld.org

3 2

SuSE 5.0 and "portmap"?
by Steffen Moser 10 Aug '99

10 Aug '99

Hello, we have got a sendmail-8.9.3 mailserver based on SuSE 5.0. Now I need "rpc portmap" running on this machine because this machine will become a NIS client. Does anybody know if the version of "portmap" which came with SuSE 5.0 has a known security problem? I think that I have heard something quite some time ago, but I am not sure. Will there be any known security hole when I enable "portmap"? Should I look for a newer version? At the moment I am not able to update the whole machine to SuSE 6.1 because there are a lot of things which are manually configured (e.g. "POP before SMTP"). Bye, Steffen

1 0

ipchains = slower speeds
by Chrissy LeMaire 09 Aug '99

09 Aug '99

Hey guys, It seems that IP chains is slowing my news and ftp speeds. ipfwadm's forwarding allowed for the usual speeds..just as if the machine behind the gateway were the actual gateway. Since ipchains came around, news is unreadable, because the speeds are 3 bytes a second. FTP'ing within my network has gone from 1200KB/s to about 8KB/s I got a template from freshmeat.net and saw what might have been the solution, but it hasnt worked: Note that i do have CONFIG_IP_ROUTE_TOS compiled into my kernel. # Set ftp-data for maximum throughput $IPCHAINS -A output -p tcp -d 0/0 ftp-data -t 0x01 0x08 echo -n "." SuSE didnt have an ftp-data in /etc/services... i tried adding one at port 20 ..but it still didnt work. tried putting in nntp and netnews in place of ftp-data and i'm still getting slow butt speeds.. 35 headers in 5 mintues :( Other than that..im in love with ipchains :) Any suggestions? Thanks! Chrissy

2 2

AW: [suse-security] ipchains = slower speeds
by Achim Gosse 09 Aug '99

09 Aug '99

i have the sma eproblem, too. ftp downstream is ok, but ftp upstream always loses connection and is extremly slow. any hints? achim > > Hey guys, > It seems that IP chains is slowing my news and ftp speeds. ipfwadm's > forwarding allowed for the usual speeds..just as if the > machine behind the > gateway were the actual gateway. Since ipchains came around, news is > unreadable, because the speeds are 3 bytes a second. FTP'ing > within my > network has gone from 1200KB/s to about 8KB/s > I got a template from freshmeat.net and saw what might have been the > solution, but it hasnt worked: > Note that i do have CONFIG_IP_ROUTE_TOS compiled into my kernel. > > # Set ftp-data for maximum throughput > $IPCHAINS -A output -p tcp -d 0/0 ftp-data -t 0x01 0x08 > echo -n "." > > > SuSE didnt have an ftp-data in /etc/services... i tried > adding one at port > 20 ..but it still didnt work. tried putting in nntp and > netnews in place > of ftp-data and i'm still getting slow butt speeds.. 35 > headers in 5 mintues :( > > Other than that..im in love with ipchains :) > > Any suggestions? > > Thanks! > Chrissy > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

uh-oh more!
by Stephen Smith 08 Aug '99

08 Aug '99

************************* new developments already: I just checked a windows box that the linux box masquerades for: and under networking configuration there is no longer a NIC installed! It looks like I'm getting hit there to. Now I'm afraid to reboot that one too! Some slowdown in performance as well. I don't see any processes running there that shouldn't be! Just a few questions. blackbox is the server name, and 192.168.0.2 is a remote computer on my network. I have thousands of these in my /var/log/messages file. What's going on? Every 2 or 3 seconds this entry appears. Aug 6 09:51:18 blackbox popper[2803]: connect from 192.168.0.2 Aug 6 09:51:19 blackbox popper[2804]: connect from 192.168.0.2 Aug 6 09:56:21 blackbox popper[2805]: connect from 192.168.0.2 Aug 6 09:56:22 blackbox popper[2806]: connect from 192.168.0.2 Aug 6 10:01:24 blackbox popper[2831]: connect from 192.168.0.2 Aug 6 10:01:25 blackbox popper[2832]: connect from 192.168.0.2 Aug 6 10:06:27 blackbox popper[2834]: connect from 192.168.0.2 Aug 6 10:06:28 blackbox popper[2835]: connect from 192.168.0.2 Aug 6 10:11:30 blackbox popper[2836]: connect from 192.168.0.2 Aug 6 10:11:31 blackbox popper[2837]: connect from 192.168.0.2 Also was this a successful logon? (below) or an attempt. Aug 5 20:24:21 blackbox login[1195]: ILLEGAL ROOT LOGIN on `ttyp0' from `192.168.0.2' I was looking through the log files because when i ran YAST, no settings were retrieved. Hostname showed as blank, no ethernet cards or IP addresses, everything. (naturally this concerned me) Now I'm afriad to reboot! My rc.config looks perfectly normal though. Where else should I look for some possible foulplay? [5 minutes later] I just rechecked rc.config. (it was fine ten minutes ago) now it's pretty much gone. this is all that is left: LANGUAGE="english" START_INETD="yes" START_PORTMAP="yes" NFS_SERVER="yes" yes that's it. definately not a good time to reboot! as far as I can tell, I'm [root] the only user logged on.

7 6

Re: Ticket [19990731000000298]
by Eric Mosley 08 Aug '99

08 Aug '99

Hi Frank, Does this mean that SuSE does NOT provide security updates to releases other than the current one??? This means that the day you release a new release the previous release is left swinging in the wind... Eric >You wrote: > >> In you patches /updates for SuSE 6.1 you have updates for pine and Samba >> that are strongly recommended. >> >> We have SuSE6.0, do these vulnerabilities exist in 6.0? >> >> If they do, where can we get the updates for 6.1? > >It could be that exist the same vulnerabilities in 6.0. The Problem is: > >6.0 had the kernel 2.0.36, 6.1 has the kernel 2.2.7. These kernels are so >different, that you couldn't use the update patches. >Please download the original packages and compilie your self programs. > > >-- > >regards, > > Your SuSE Support-Team > Frank Lemser (support(a)suse.de) > >------------------------------------------------------------ >SuSE GmbH, Tel: +49-911-7405330 Mo/Do 13-18.00 >Schanzaeckerstr. 10, Fax: +49-911-3206727 >90443 Nuernberg, Email: support(a)suse.de >Germany WWW: http://www.suse.de/Support/sdb >------------------------------------------------------------ >

4 4

RE: [suse-security] New users, how?
by Wayne, Steven L SSI-TSEA-353 08 Aug '99

08 Aug '99

>-----Original Message----- >From: cogNiTioN [mailto:cognition@bigfoot.com] >Sent: 03 August 1999 01:20 >Cc: suse-security(a)suse.com >Subject: Re: [suse-security] New users, how? > > >On Mon, 2 Aug 1999, Jan Theofel wrote: > >> useradd > >Thanks to everyone who pointed out this command. (and I >thought _Linux in a NUTSHELL_ had all the answers!) > "Running Linux" has most of the answers, with both you should be pretty well covered. Steven. -- If a man stands in the middle of the forest speaking and there is no woman around to hear him....Is he still wrong?

6 6

Mini-FAQ: antivirus software for Linux, v1.6, 08/05/1999
by Rainer Link (CE1 SS99 krm) 08 Aug '99

08 Aug '99

FYI, I wrote a small patch for AMaViS 0.2.0-pre6 to work together also with KasperskyLab AvpDaemon(Client) and F-Secure AntiVirus. It can be found at www.ce.is.fh-furtwangen.de/~link/security/amavis-patch.html -----BEGIN PGP SIGNED MESSAGE----- Mini-FAQ: "antivirus software for Linux" Version: 1.6 Maintainer: Rainer Link Release date: 08/05/1999 http://rainer.w3.to/ 1. About this mini-FAQ This mini-FAQ informs you about currently available antivirus software for Linux. 2. Overview All listed products do not only search for known Linux-viruses (such as Staog or Bliss), but also for known viruses for DOS/Windows, macro viruses or Trojan Horses. According to the producers, the Linux-version of their av-software uses the same scanning engine as it is used at the Windows-version. Only "Linux-native" av-software is written down here. 2.1 DataFellows F-Secure Antivirus for Linux Producer/Developer: DataFellows, Finland Platform: Intel Download: http://www.datafellows.com/anti-virus/prodinfo/ Version: 4.04 (build 1240) Size: approx. 1.6 MB Contact: Anti-Virus-Sales(a)datafellows.com Pricing: <unknown> Comments: According to Ari Hypponen a trial copy is not available yet on the web site. 2.2.1 H+B EDV AntiVir/X Producer/Developer: H+B EDV Datentechnik GmbH, Tettnang, Germany Platfom: Intel Download: http://www.hbedv.com/ Version: 5.18.3.3, 30 June 1999 Size (compressed): approx. 0,8 MB contact person: Martin Ritter <mritter(a)antivir.de> Pricing: AntiVir/X is freeware for private use, but it is recommended to register the software via eMail. For commercial use, please contact H+B EDV Comments: TkAntVir, a GUI written witk Tcl/Tk is available from www.geiges.de/sebastian/ 2.2.2 H+B EDV AVGuard/Linux Producer/Developer: H+B EDV Datentechnik GmbH, Tettnang, Germany Platfom: Intel Download: ftp://ftp.antivir.de/antivir/english/beta/avlguard Version: 0.3 beta Size (compressed): approx. 100 KByte contact person: Martin Ritter <mritter(a)antivir.de> Pricing: <unknown> Comments: AVGuard/Linux provides resident, on-access virus-protection. Currently it works only with kernel 2.0.36/37. Needs AntiVir/X 2.3 NAI Netshield (uvscan) for Unix (Linux) Producer/Developer: Network Associates, USA Platform: Intel Download: <Eval version not available> Version: 4.0.3 (licensed version) Size (compressed): approx. 2.4 MB contact person: support(a)nai.com, sales(a)nai.com Pricing: should be part of the "Total Virus Defense", please ask their sales team. Comment: Customers of NAI can download it from the FTP-area for registered customers. 2.4 Sophos Sweep for Linux Producter/Developer: Sophos UK / Sophos US Platform: Intel, Alpha Download: http://www.sophos.com/downloads/ Version: 3.24, August 1999 Size (compressed): approx. 1 MB contact person: support(a)sophos.com Pricing: In Germany it is freeware for private use, but it is recommended to register it by email, phone or fax. For commercial use please ask the sales team (sales(a)sophos.com) Comment: A Technology Preview of the upcoming version is available at http://research.sophos.com/ - it comes with a new scanning eninge and the ability to scan in compressed archive files. 2.5 Trend Micro InterScan VirusWall for Linux Producer/Developer: Trend Micro, USA Platform: Intel Download: http://www.antivirus.com/products/isvw/linuxbeta.htm Version: 3.0 beta Size (compressed): approx. 5 MB contact person: <unknown> Pricing: <unkonwn> Comments: InterScan VirusWall was developed for RedHat 5.2, so for other distributions, you have to change some scripts. The release version (3.01) will be developed for RedHat 6.0 2.6 AMaViS - A Mail Virus Scanner Developer: Christian Bricart, Juergen Quade, Mogens Kjaer Platform: Intel Download: http://www.aachalon.de/AMaViS/amavis.html Version: 0.2-pre6 Size (compressed): approx. 100 KB contact person: Christian Bricart <shiva(a)aachalon.de> Pricing: Freeware Comments: AMaViS is not really a virus scanner, but a tool for sendmail to check attachments for viruses using H+B EDV AntiVir/X, NAI NetShield, Dr Solomon's AVTK for SCO Unix, Sophos Sweep or Kaspersky Lab AVP. 2.7 CyberSoft VFind Security ToolKit (VSTK) for Linux Developer: CyberSoft Inc., United States Platform: Intel Download: an evaluation copy is available upon request Version: Current VSTK147 Size (compressed): approx. 1 MB Contact: sales(a)cyber.com Pricing: see http://www.cyber.com/products/masterprice.html Comments: The VFind Security ToolKit is a suite of computer security and antivirus tools. 2.8.1 Kaspersky Lab AntiViral Toolkit Pro (AVP) for Linux Developer: Kaspersky Lab, Russia Platform: Intel Download: http://www.kasperskylab.ru/eng/products/eval.html Version: 3.0 - beta 3 (build 130) Size (compressed): 161 KB Contact: sales(a)avp.ru or sales(a)avp.com Pricing: free of charge (according to press release) Comments: beta version are free of charge; needs antivirus databese files 2.8.2 Kaspersky Lab AntiViral Toolkit Pro (AVP) Daemon for Linux Developer: Kaspersky Lab, Russia Platform: Intel Download: http://www.kasperskylab.ru/eng/products/eval.html Version: 3.0 - beta 2 Size (compressed): 189 KB Contact: sales(a)avp.ru or sales(a)avp.com Pricing: <unknown> Comments: needs the antivirus database files 2.8.3 Kaspersky Lab AntiViral Toolkit Pro (AVP) Monitor for Linux Developer: Kaspersky Lab, Russia Platform: Intel Download: http://www.kasperskylab.ru/eng/products/eval.html Version: Beta 1 (AVP Monitor) Size (compressed): 20 KB Contact: sales(a)avp.ru or sales(a)avp.com Pricing: GPL Comments: AVP Monitor is a patch for kernel 2.2.x series, it needs AVP Daemon. 3. Contacting the author If you have questions, critics or if you find an error in this document, please write to av-linux(a)w3.to - Thanks! My thoughts about server-based virusprotection for Linux-servers can be found at http://av-linux-project.w3.to/ 4. Distribution of this document This document may be distributed freely via eMail, in Newsgroups or be put on a web-site, if it is garantied that it is not altered in any way. If you put this mini-faq on your web-site, I would be pleased if you put a link to http://av-linux.w3.to/ on your site, too. (c) by Rainer Link, 08/05/1999 - All rights reserved. All information in this document are provided "as it is". There is no warranty, that it is faultless or that all (known) products are listed. All trademarks are respected. Please apologize any misspellings for the reason that English is not my native-language. http://av-linux.w3.to/ -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use Charset: noconv iQEVAwUBN6nF/I/GwcC6Q9mVAQH5ugf/eapMwa2PHtiQBkwKAateoMDXAZivLSDY UGD2PH3Li+gWiW0f1DOC1eczXXxXXjxOd4X9e1Jnen2cKS9nnzZ48/kHkoi47AgG ivTFCt1791tGifN3EueZBqCGkbE+plRMfjJw2iM4DIPxkOdnvffzWh5Oxsm/iirg DpR8rqHb3pRFEehKfI3ZfH+SoxTWHDE6iVC8k7UagxvNgELBJIsy4ZF7jPiHJaLm 1zf8N3D2oxYT3omFPl+2oyDNTxlwqXPstPLyZ4LUJp54t6pKv50kOCNUXctX2cA5 4pMQ0UN+8fMVEhSx1bD0gBWMdX397ltKSq6Gcv/gA+MZLfWgjLW25A== =jpN/ -----END PGP SIGNATURE----- -- Rainer Link, eMail: linkra(a)fh-furtwangen.de, WWW: http://rainer.w3.to/ Student of Communication Engineering/Computer Networking, University of Applied Sciences,Furtwangen,Germany,http://www.ce.is.fh-furtwangen.de/

1 0