August 1999 - openSUSE Security - openSUSE Mailing Lists

unsuscribe
by Patrick.Kappeler＠t-online.de 23 Aug '99

23 Aug '99

unsuscribe

1 0

Re: [suse-security] ipfwadm on a 6.1
by Dan 23 Aug '99

23 Aug '99

-----Ursprüngliche Nachricht----- Von: Dan Amthor <dan(a)switchboard.de> An: suse-security(a)suse.com <suse-security(a)suse.com> Datum: Montag, 23. August 1999 00:10 Betreff: Re: [suse-security] ipfwadm on a 6.1 > >-----Ursprüngliche Nachricht----- >Von: Niall Cosgrove <wid(a)ook.connect.ie> >An: Dan <wdlists(a)webdirekt.de> >Cc: suse-security(a)suse.com <suse-security(a)suse.com> >Datum: Freitag, 13. August 1999 17:24 >Betreff: Re: [suse-security] ipfwadm on a 6.1 > > >> >>AFAIK under suse 6.1 if you install the 2.2 series kernel, you are >>expected to be using ipchains rather than ipfwadm. the 2.0.36 suse kernel >>will probably give you better milage with ipfwadm > >>Niall (willing to be contradicted) > >I did that, however , with all routes set correctly and IP-Forwarding and >masquerading turned on in the (2.0 !) kernel, I still could nod get from the >local 192-net to the internet. The world-device (Eth1) though was pingable >from the inside. Me no understand. >Are there any other kernel parameters or configs ? > >Dan > > >> >> >>On Fri, 13 Aug 1999, Dan wrote: >> >>> Hi all, >>> when my old ne2000 on the ipfwadm-configured gateway packed in, i thought >it was a good time to upgrade to suse-6.1 and better hardware. however >'ipfwadm' refused to work with 6.1 telling me >>> 'service not available' and the classic 'file not found', even though >ipfwadm was installed by default. >>> i doctored around the kernel a bit , but no change. anybody encountered >that problem ? >>> best >>> dan >>> >> >> >>--------------------------------------------------------------------- >>To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >>For additional commands, e-mail: suse-security-help(a)suse.com >> >

2 1

DoS against wu-2.4.2-academ[BETA-18](1)
by Shinton, Daniel J. 20 Aug '99

20 Aug '99

Since we are talking about DoS attacks (please forgive if this is known), have you ever tried to open a couple dozen TCP connections to wu.ftpd? Use telnet or nmap and connect to port 21 about 40 times or so. Goodbye wu! You will see a message in your /var/log/warn that says: "inetd[127]: ftp/tcp server failing (looping), service terminated" This works against all my SuSE 6.1 boxes. -Dan

6 10

Re: [suse-security] Securing a Firewall
by josh 20 Aug '99

20 Aug '99

Moonshi Mohsenruddin wrote... > Is someone working on HOWTOs to setup a secure SuSE 6.x Linux firewall? It > would be great to have these so that System Administrators could migrate > some if not all of their firewall servers to Linux for an inexpensive > firewalling purposes. > > If there are documentations for this, can someone pls post the urls/links > of the idiot-proof documentations? While this isn't SuSE specific, check out the Linux Admin's Security GUide, available at https://www.seifried.org/lasg, or mirrored on my server, http://www.freek.com/lasg/ josh

1 0

Re: [suse-security] DoS against wu-2.4.2-academ[BETA-18](1)
by Lee Willis 20 Aug '99

20 Aug '99

"Shinton, Daniel J." <DJShinto(a)wcom.net> writes: > Since we are talking about DoS attacks (please forgive if this is known), > have you ever tried to open a couple dozen TCP connections to wu.ftpd? Hmm, you shouldn't be using this version of Wu-FTP anyway it has a large root exploit ... Just FYI, Check Bugtraq or the archive for details Lee. -- I was doing object-oriented assembly at 1 year old ... For some reason my mom insists on calling it "Playing with blocks"

1 0

RE: [suse-security] Securing a Firewall
by Mr. M 20 Aug '99

20 Aug '99

> Is someone working on HOWTOs to setup a secure SuSE 6.x Linux firewall? It > would be great to have these so that System Administrators could migrate > some if not all of their firewall servers to Linux for an inexpensive > firewalling purposes. > Firewalling under 2.2.x kernels is called IPchains. You can read the HOW-TO at: http://metalab.unc.edu/LDP/HOWTO/HOWTO-INDEX.html You may want to look at: http://www.rustcorp.com/linux/ipchains/ Mario

1 0

[peter@IFM.LIU.SE: DOS against SuSE's identd]
by Seth R Arnold 19 Aug '99

19 Aug '99

(For those of you that do not know bugtraq. I suggest taking a look at it. It is a moderated full disclosure security mailing list. Archives can be found on www.securityfocus.com (run by the moderator of the list, aleph1 aka elias levy.) It does have more traffic than SuSE-Secuirty, and much of it has nothing to do with whatever it is you are doing. All the same, it is interesting reading.) This is the last message on this subject I am going to forward to SuSE-security from bugtraq. I do sort of imagine this will be the last substantive message on the subject. :) ----- Forwarded message from Peter Eriksson <peter(a)IFM.LIU.SE> ----- Approved-By: aleph1(a)SECURITYFOCUS.COM Delivered-To: bugtraq(a)securityfocus.com X-Authentication-Warning: sharrow.ifm.liu.se: peter set sender to peter(a)sharrow.ifm.liu.se using -f Date: Tue, 17 Aug 1999 10:56:46 +0200 Reply-To: Peter Eriksson <peter(a)IFM.LIU.SE> From: Peter Eriksson <peter(a)IFM.LIU.SE> Subject: DOS against SuSE's identd X-To: bugtraq(a)securityfocus.com To: BUGTRAQ(a)SECURITYFOCUS.COM Hendrik Scholz <hendrik(a)SCHOLZ.NET> writes: >The inetd.conf starts the identd with the options -w -t120 -e. >This means that one identd process waits 120 seconds after >answering the first request to answer later request. >Lets say we start 100 requests in a short period. >Due to the fact that it takes time to answer one request >more identd's will be started each eating up about 900kb >memory and waiting 120 seconds before terminating. >I tested this behaviour on different machines with different >hardware (RAM, Swap, NIC). >Each machine becomes unusable after some seconds. >This bug is in _every_ SuSE Version at least since 4.4. >SuSE seems not to be interested in this bug becaus they >did not answer any of my mails. This bug is probably due to some incompatibility between SuSE's inetd daemons handling of 'stream tcp' & 'wait' servers and the way Pidentd expects it to be handled. The "normal" (as normal as it can be since 'stream tcp wait' normally is not a supported configuration) thing that should happen is that Inetd should start _one_ Pidentd, which then should handle all new requests in sub-processes, which should die immediately after the request has been handled. In the Suse case it seems (my guess) that Inetd keeps on starting new Pidentd's... Anyway, I nowadays _generally_ recommend people to stay away from the "-w" stuff in Pidentd due to the problems with the behaviours of various Inetd implementations... I recommend instead that people get the latest version of Pidentd (version 3.0.7 as of this writing) which uses multithreaded instead of forking subprocesses - this can reduce the load on systems significantly). Pidentd 3.0.7 (and later) can be downloaded from: ftp://ftp.lysator.liu.se/pub/ident/servers Here's the PGP Signature of that file: -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use MessageID: D750KrTMC9lSc8xPJqIOoI5ldgh6QDYj iQCVAwUAN7c0a0GVHk0UMIghAQH7/wP8DV9NyDrPxMfa8lxSRMrGK8/kNSeKU+Z0 G+eX267t7WpjlP3puVchb7lp7zbtYlJhd6jyuxzwFJrGZs6GJGgT8B6vtFYqfYFm 9n5DAylzrTezWYUEkTQpy4UV+w1gVTa7+/qJcbkTm2rJaPaxp11duf0NH9zOhGZG gzfAOgkXMrU= =Mfo4 -----END PGP SIGNATURE----- /Peter (The Pidentd author) ----- End forwarded message ----- -- Seth Arnold | ICQ 3172483 | http://cswww.willamette.edu/~sarnold/ I prosecute unsolicited bulk emails, using the RealTime BlackHole List. You should too. Ask me how, or visit http://maps.vix.com/rbl/

2 3

[jtb@THEO2.PHYSIK.UNI-STUTTGART.DE: XDM Insecurity revisited]
by Seth R Arnold 19 Aug '99

19 Aug '99

I checked the Xaccess file on a SuSE 6.0 machine near me -- and though I do not know exactly what the thing does, the comments in the file lead me to believe that the poster is correct... check yours! :) vi `locate Xaccess` ----- Forwarded message from Jochen Bauer <jtb(a)THEO2.PHYSIK.UNI-STUTTGART.DE> ----- Approved-By: aleph1(a)SECURITYFOCUS.COM Delivered-To: BUGTRAQ(a)SECURITYFOCUS.COM Mail-Followup-To: BUGTRAQ(a)SECURITYFOCUS.COM X-Mailer: Mutt 0.95.4i Date: Wed, 18 Aug 1999 12:26:20 +0200 Reply-To: Jochen Bauer <jtb(a)THEO2.PHYSIK.UNI-STUTTGART.DE> From: Jochen Bauer <jtb(a)THEO2.PHYSIK.UNI-STUTTGART.DE> Subject: XDM Insecurity revisited X-To: BUGTRAQ(a)SECURITYFOCUS.COM To: BUGTRAQ(a)SECURITYFOCUS.COM On Wed, 26 Nov 1997 Eric Augustus (augustus(a)stic.net) posted a message on BUGTRAQ about the fact, that the default Xaccess file allows XDMCP connections from any host. As you know, this can be used to get a login screen on any host and therefore get around access control mechanisms like tcpwrapper and root login restriction to the console. However, this warning seemed to have little effect as (at least) Digital Unix 4.0E, SuSE Linux 6.1 and Red Hat Linux 6.0 are still (1.5 years later) shipped with this default Xaccess file. It is somehow ironic that e.g. SuSE now uses tcpwrappers by default on most TCP services in it's distribution and describes the use of tcpwrappers in the manual in a special chapter about security, but fails to close (or even mention) that way to circumvent login restrictions. By the way, If you think that using the cryptographically secured remote management channels with access limited to authorized hosts on your AltaVista Firewall under Digital Unix is the only way of doing remote administration of the firewall, then you should take a close look at your Xaccess file ;-) -- Jochen Bauer ************************************************************ *Network Security Team * *Computer Center of the University of Stuttgart * *Germany * * * *Email: jtb(a)theo2.physik.uni-stuttgart.de * * jochen.bauer(a)rus.uni-stuttgart.de * * * *PGP Public Key: * * http://www.theo2.physik.uni-stuttgart.de/jtb.html * ************************************************************ ----- End forwarded message ----- -- Seth Arnold | ICQ 3172483 | http://cswww.willamette.edu/~sarnold/ I prosecute unsolicited bulk emails, using the RealTime BlackHole List. You should too. Ask me how, or visit http://maps.vix.com/rbl/

2 1

Re: [suse-security] [jtb@THEO2.PHYSIK.UNI-STUTTGART.DE: XDM Insecurity revisited]
by Lutz Pressler 19 Aug '99

19 Aug '99

Seth R Arnold <sarnold(a)willamette.edu> wrote: > I checked the Xaccess file on a SuSE 6.0 machine near me -- and though I do > not know exactly what the thing does, the comments in the file lead me to > believe that the poster is correct... > ----- Forwarded message from Jochen Bauer <jtb(a)THEO2.PHYSIK.UNI-STUTTGART.DE> ----- > Date: Wed, 18 Aug 1999 12:26:20 +0200 > From: Jochen Bauer <jtb(a)THEO2.PHYSIK.UNI-STUTTGART.DE> > Subject: XDM Insecurity revisited > To: BUGTRAQ(a)SECURITYFOCUS.COM > On Wed, 26 Nov 1997 Eric Augustus (augustus(a)stic.net) posted a message > on BUGTRAQ about the fact, that the default Xaccess file allows XDMCP > connections from any host. As you know, this can be used to get a > login screen on any host and therefore get around access control > mechanisms like tcpwrapper and root login restriction to the console. > However, this warning seemed to have little effect as (at least) > Digital Unix 4.0E, SuSE Linux 6.1 and Red Hat Linux 6.0 are still > (1.5 years later) shipped with this default Xaccess file. It is somehow > ironic that e.g. SuSE now uses tcpwrappers by default on most TCP > services in it's distribution and describes the use of tcpwrappers in > the manual in a special chapter about security, but fails to close (or > even mention) that way to circumvent login restrictions. [...] You can modify the starproc call in the "start)" section of /sbin/init.d/xdm to read startproc $DISPLAYMANAGER -udpPort 0 || return=$rc_failed xdm/kdm isn't listening for XDMCP requests then. Maybe that could be an rc.config option (something like USE_XDMCP). I'll suggest it to SuSE developers. Regards, Lutz -- _ | Lutz Pressler | Tel: ++49-551-3700002 |_ |\ | | Service Network GmbH | FAX: ++49-551-3700009 ._|ER | \|ET | Hannah-Vogt-Strasse 1 | mailto:lp@SerNet.DE Service Network | D-37085 Goettingen | http://www.SerNet.DE/

1 0

Re: [suse-security] ssh-forwarding
by Peter Münster 19 Aug '99

19 Aug '99

On Fri, 13 Aug 1999, Juri Haberland wrote: > I have no idea. > I just tried it on a SuSE 5.3 and on a SuSE 6.1 system and couldn't get X11 > forwarding to work without "sshdfwd-X11" in hosts.allow. > Maybe you have not ALL:ALL in your hosts.deny? Ok, I have it: (I also use Susi 6.1 and ALL:ALL in hosts.deny) There is another line in my hosts.allow allowing all local connections, so forwarded ssh-connections too: ALL: 127.0.0.1, 129.20.79.55 Hope, this helps "dproc" too! Peter

2 1