August 1999 - openSUSE Security - openSUSE Mailing Lists

uh-oh!
by Stephen Smith 16 Aug '99

16 Aug '99

Just a few questions. blackbox is the server name, and 192.168.0.2 is a remote computer on my network. I have thousands of these in my /var/log/messages file. What's going on? Every 2 or 3 seconds this entry appears. Aug 6 09:51:18 blackbox popper[2803]: connect from 192.168.0.2 Aug 6 09:51:19 blackbox popper[2804]: connect from 192.168.0.2 Aug 6 09:56:21 blackbox popper[2805]: connect from 192.168.0.2 Aug 6 09:56:22 blackbox popper[2806]: connect from 192.168.0.2 Aug 6 10:01:24 blackbox popper[2831]: connect from 192.168.0.2 Aug 6 10:01:25 blackbox popper[2832]: connect from 192.168.0.2 Aug 6 10:06:27 blackbox popper[2834]: connect from 192.168.0.2 Aug 6 10:06:28 blackbox popper[2835]: connect from 192.168.0.2 Aug 6 10:11:30 blackbox popper[2836]: connect from 192.168.0.2 Aug 6 10:11:31 blackbox popper[2837]: connect from 192.168.0.2 Also was this a successful logon? (below) or an attempt. Aug 5 20:24:21 blackbox login[1195]: ILLEGAL ROOT LOGIN on `ttyp0' from `192.168.0.2' I was looking through the log files because when i ran YAST, no settings were retrieved. Hostname showed as blank, no ethernet cards or IP addresses, everything. (naturally this concerned me) Now I'm afriad to reboot! My rc.config looks perfectly normal though. Where else should I look for some possible foulplay? [5 minutes later] I just rechecked rc.config. (it was fine ten minutes ago) now it's pretty much gone. this is all that is left: LANGUAGE="english" START_INETD="yes" START_PORTMAP="yes" NFS_SERVER="yes" yes that's it. definately not a good time to reboot! as far as I can tell, I'm [root] the only user logged on.

2 1

ipchains | ftp problem
by Achim Gosse 16 Aug '99

16 Aug '99

hi there, i have some probs about ftp and ipchains. my ipchains rules for ftp connections: ipchains -A input -p tcp -s 0/0 20 -d $LOCALNET -j ACCEPT ipchains -A output -p tcp -s $LOCALNET -d 0/0 20 -j ACCEPT ipchains -A input -p tcp -s 0/0 21 -d $LOCALNET -j ACCEPT ipchains -A output -p tcp -s $LOCALNET -d 0/0 21 -j ACCEPT ftp downstream works fine, but ftp upstream often loses connection and is terrible slow? any hints? thanks in advance achim achim Gosse mailto:achim.gosse@nasa20.com n.a.s.a.2.0 gmbh http://www.nasa20.com borselhof borselstr. 16c 22765 hamburg speak.+49.40.39888288 fax.+49.40.39888299 icq.#3139144 cell.+49.177.3180433 registered linux user #122734

1 0

Re: [suse-security] ipfwadm on a 6.1
by Dan 13 Aug '99

13 Aug '99

Mark, thanks, that really helped. The box is a gateway between internal net and internet,mainly masquerading,but I do have some filters especially on the input side,. I think I 'll work that out. again, tkuvm dan -----Ursprüngliche Nachricht----- Von: Mark Lutz <luma(a)nikocity.de> An: Dan <wdlists(a)webdirekt.de> Cc: suse-security(a)suse.com <suse-security(a)suse.com> Datum: Freitag, 13. August 1999 18:49 Betreff: Re: [suse-security] ipfwadm on a 6.1 >* Dan <wdlists(a)webdirekt.de> writes: >> 'ipfwadm' refused to work with 6.1 telling me 'service not >> available' and the 'file not found', > >First thing after updating the kernel is to read >"/usr/src/linux/Documentation/Changes". There it says: > >| As of 2.1.102, the IP firewalling code has been replaced; ipfwadm >| will no longer work. You need to obtain "ipchains," available from >| http://www.rustcorp.com/linux/ipchains/ , and use that instead of >| ipfwadm. > >You'll find "ipchains" in series "n". After you have installed it, you >should read "/usr/doc/packages/ipchains/HOWTO.txt". > >You might be able to use "/sbin/ipfwadm-wrapper" and keep your "old" >scripts. But I am sure SuSE offers ipchains scripts. So mabye you can >just rename "/sbin/init.d/firewall" and "/sbin/init.d/masquerade" and >reinstall the firewall and ipchains packages. > >Do you use firewalling at all? If it's just masquerading you are >concered with add/change these lines in "/sbin/init.d/masquerade" > ># the "old" lines are commented out, i.e., "#" ># IPFWADM="/sbin/ipfwadm" >IPFWADM="/sbin/ipchains" > ># START ># the next line is new and you don't want to miss it! >echo 1 > /proc/sys/net/ipv4/ip_forward > ># ${IPFWADM} -F -a accept -P all -S $i -D 0/0 -m -W ${MSQ_DEV} >${IPFWADM} -A forward -j MASQ -p all -s $i -d 0/0 -i ${MSQ_DEV} > ># STOP ># ${IPFWADM} -F -d accept -P all -S $i -D 0/0 -m -W ${MSQ_DEV} >${IPFWADM} -D forward -j MASQ -p all -s $i -d 0/0 -i ${MSQ_DEV} > ># LIST ># ${IPFWADM} -lFnex >${IPFWADM} -L forward -n -v -x > >#${IPFWADM} -lMnex >${IPFWADM} -L -M -n -v -x > >As you can see, I simply translated the old ipfwadm rules to ipchains >rules. Hope I didn't make any mistake. > >Hope that helps > >-- >Mark Lutz >Accept German and English >

1 0

ipfwadm on a 6.1
by Dan 13 Aug '99

13 Aug '99

Hi all, when my old ne2000 on the ipfwadm-configured gateway packed in, i thought it was a good time to upgrade to suse-6.1 and better hardware. however 'ipfwadm' refused to work with 6.1 telling me 'service not available' and the classic 'file not found', even though ipfwadm was installed by default. i doctored around the kernel a bit , but no change. anybody encountered that problem ? best dan

4 6

ipfwadm on a 6.1
by Dan 13 Aug '99

13 Aug '99

Hi all, when my old ne2000 on the ipfwadm-configured gateway (5.3)packed in, i thought it was a good time to upgrade to 6.1 and better hardware. however 'ipfwadm' refused to work with 6.1 telling me 'service not available' and the 'file not found', even though ipfwadm had been installed by default. i doctored around the kernel a bit , but no change. anybody encountered that problem ? best dan

2 1

Re: [suse-security] ipfwadm on a 6.1
by Lee Willis 13 Aug '99

13 Aug '99

"Dan" <wdlists(a)webdirekt.de> writes: > Hi all, when my old ne2000 on the ipfwadm-configured gateway > (5.3)packed in, i thought it was a good time to upgrade to 6.1 and > better hardware. however 'ipfwadm' refused to work with 6.1 telling me > 'service not available' and the 'file not found', even though ipfwadm > had been installed by default. i doctored around the kernel a bit , > but no change. anybody encountered that problem ? best dan AFAIK SuSE 6.1 uses the Linux 2.2 series of kernels. Under these ipfwadm is obselete, you should use ipchains instead. Check /usr/doc/ipchains-x.x.x HTH Lee. -- I was doing object-oriented assembly at 1 year old ... For some reason my mom insists on calling it "Playing with blocks"

1 0

Re: [suse-security] SuSE manual
by Peter Münster 13 Aug '99

13 Aug '99

On Fri, 13 Aug 1999, Juri Haberland wrote: > > Hello, > > try "sshd: ALL" ! > > Cheers, Peter > > > > Or: > sshd sshdfwd-X11 : ALL > to also allow X11 forwarding. I don't know why, but with only "sshd: All", X11 forwarding works automagically too here. But in theory you should be right, I think... What could be the error in reasoning? Peter -- ******************************************* URL: http://gmv.spm.univ-rennes1.fr/~peter/ *******************************************

1 0

SuSE manual
by Mark Lutz 13 Aug '99

13 Aug '99

Yesterday I received SuSE 6.2. I just wanted to point out that chapter 18 "Security is a matter of trust" is well worth reading. Quite some questions on this list could simply be answered by reading this chapter. The chapter also mentions "tripwire" and "logsurfer". Here my (poor) translation of "18.4 Allgemeine Hinweise" 18.4 General Notes 1. The user "root" should only be logged in for administrative work. For the every day work at your computer a user account should be created. 2. Avoid using "telnet", "rlogin" or even "rsh". 3. Instead use "ssh", if you have to work remotely. 4. Deactivate all net sevices that you don't need. 5. Keep security relevant packages up-to-date, e.g., the packages "bind", "sendmail" and "ssh". 6. Remove suid and sgid bits from all files in the system that ordinary users don't necessarily need for work. 7. Check the log files on a regular basis. Again, please read this chapter. SuSE: Great idea to put the FAQ on the CD-ROM cover! That might help to reduce traffic on the Linux newsgroups. Thanks!

3 2

root
by HARDY.BOEHM＠LHSYSTEMS.COM 12 Aug '99

12 Aug '99

Hi Folks! Would someone please explain to me, why I shouldn't use my system as root but as a "normal" user instead? I think I got the principle from some posts, but I want to make sure I get it right... So please use the Version for 3-Year-Olds :-) BYe...Hardy

9 11

Re: [suse-security] NFS Security question
by earendil7＠juno.com 12 Aug '99

12 Aug '99

On Wed, 11 Aug 1999 09:10:11 +0200 (MEST) Ralf Eisinger <rei(a)ihs.uni-stuttgart.de> writes: >Check the MAC Adress of every of your client. If that changes, there >will be an >intruder. (You have to hope, that the hacker doesnŽt change his MAC >before >...) > >You can export from every client a "special" directory with root >permissions. >There you can "hide" a file. If you couldnŽt access it, you kick your >nfsd or >change your export table. > >if you do this every minute, there will be only a little change for >hacking in >that way, BUT ... I'm out of my league here, but isn't there a way to export encrypted files as filesystems? I know that one can mount files as filesystems with the right kernel options. How about doing it as an export to everyone (i.e., exporting NFS that has one encrypted filesystem)? dan ___________________________________________________________________ Get the Internet just the way you want it. Free software, free e-mail, and free Internet access for a month! Try Juno Web: http://dl.www.juno.com/dynoget/tagj.

1 0