October 2000 - openSUSE Security - openSUSE Mailing Lists

proxy for everything
by Philipp Snizek 09 Oct '00

09 Oct '00

Hi all Do you know a proxy which proxies everything? I need ssl, http, nntp, pop, smtp, ftp/ftp-data I have seen falcon from falcon.naw.de (a good one but still very much in development) and DeleGate, which does not convince me very much. Please tell me if you some other thanx Philipp

3 2

SuSE: tmpwatch
by Roman Drahtmueller 09 Oct '00

09 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- Hello, the tmpwatch packages as shipped with SuSE distributions are not vulnerable to the attacks as discussed on security forums, initiated and discovered by zenith parsec <zenith_parsec(a)THE-ASTRONAUT.COM>. The version of tmpwatch that we ship is a bit older than the bleeding edge, but it has proven to do what it says, which is just as important. We did not (silently) fix the problems in the package - the version that we use does not have the features that cause the security problems. Undoubtedly, the utility has its use. But for efficient (temp-watch competes for 100% system resources) and reliable monitoring of directories without any race conditions it would be necessary to have the kernel do the major part of the work. Thanks, Roman. - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOeHtbney5gA9JdPZAQGl5Qf/WDVAqiaioXHfe2UZ9H9ofTX6DnmFbtRx cSGN2ws7MD6/ebUJ06QRVxpnaYe76NDV8tJCk9nV+I2XpLD5fLq+oEIk/0EJ6M5+ 7RXG7FxkxLxRsWUqyHfDGtoHn3H43evWp5QLlaz087YYrpGcD9odOgWMSxs340ex dYJf5/wKnXIX/SxNLbxRuOzyA7RU2FD46i/uzmXNjmVyzolbsNTCn0/LCmToahaA UmqakzKkhJu++13pPfPAks0TTLwbwWOYCiBbQrmdGyu3BB8rqsl/vw72O9O0Ocue e6y75DvqtiFDJlVhf/i7yMqiDW6Vo9J0HU+h/dSI/QdXZUj18pNJ2w== =uWou -----END PGP SIGNATURE-----

1 0

ftp data
by Philipp Snizek 09 Oct '00

09 Oct '00

hello I have some misconfiguration in squid.conf I believe. ftp's so far ok, but what's wrong if ftp-data does not work over squid 2.3? I configured the browser on the client using passive ftp and squid's confiugred the same way. Moreover I have tried ftp by using always_direct ftp. Please help. thank you. Philipp

1 0

Re: [suse-security] passive ftp? active ftp?
by anyware＠wachtler.de 09 Oct '00

09 Oct '00

On Mon, Oct 09, 2000 at 09:34:23AM +0200, Philipp Snizek wrote: > Hello > > Please can somebody tell me the difference between active ftp and passive > ftp? > > thank you > Philipp If you do some ftp then you have a server somewhere in the world and a client program on your system. The servers runs day after day and waits for connections, he 'listens' on a port (usually port 21). The client connects to that port and then the client sends commands, and the server responses if you are lucky. To transfer data (after a get or put command perhaps) they do NOT use this existing connection, they open another one instead. But which of both plays the the server (listening) and which plays the client (connecting) to establisg this second channel? - If the client chooses the 'passive' mode, then he sends a PASV command to the server. The server opens a port for the data connection (usually port 20 I believe) and sends an answer to the client containing the host adresse. The client connects to this adress/port combination. - If the client chooses the 'active' mode, then he creates the listening side of the connection, sends his adress to the server, and the server connects. Since in passive mode the server sends an adress it is able to let the client connect to any other server (gateway) by sending the appropriate adress. Klaus -- ---------------------------------------------------------------------- Klaus Wachtler Breidingstr. 17 D-29614 Soltau Tel. +49-5191-70271, +49-171-4553039 Fax: +49-5191-70272 email AnyWare(a)Wachtler.de http://www.wachtler.de ----------------------------------------------------------------------

1 0

passive ftp? active ftp?
by Philipp Snizek 09 Oct '00

09 Oct '00

Hello Please can somebody tell me the difference between active ftp and passive ftp? thank you Philipp

1 0

strange ftp-scan
by Peter Münster 08 Oct '00

08 Oct '00

Hello, today I got about 50 messages like the following in /var/log/messages: Oct 7 10:11:51 gmv wu.ftpd[14694]: connect from 211.56.234.227 Oct 7 10:11:51 gmv ftpd[14694]: FTP session closed ... and it's still going on! What could be the deeper meaning, when someone it making connections the whole day long? Any hint is appreciated! Peter P.S.: I'm running wu-2.4.2-academ[BETA-18](1) -- Peter Münster http://w3pm.stormloader.com/

8 16

Suggestion to the SuSE security people
by Bo Jacobsen 08 Oct '00

08 Oct '00

Hi there, I have a suggestion to you security guys, that could make life a lot easier for a lot of us out here, and at the same time really make the SuSE security update feature shine, compared to the other linux distributions. I have noticed that since 24/9-00 six updates to SuSE 7.0 has been posted on your security site. At this rate it could turn out to be a very time consuming job having to update Linux all the time. To make this a much easier task, I suggest that you, on top of the usual downloadable update files, make available a gzip file containing all the updates relevant to your latest distribution (7.0 at this moment). Every time a new update is posted you also post a new gzip file that includes all earlier updates AND the new one. This file could be called SU1, SU2... SUn. (SU = Security Update). The gzip file should, besides the .rpm files, include a shell script that could automate all the updates. The script could maybe do something like this: for (first_update to last_update present in the gzip file) do { if (module or program that the updated relates to is installed on the target system) { do_update = false if (this update is older then the one installed) do_update = ask_user_if_ok_to_update () else if (module has not been updated) { if (running update will overwrite config file(s) that the user/system may have edited) { if (do_update = ask_user_if_ok_to_update ()) make copy (.bak) of config file(s) } } if (do_update) run the rmp update } else do_nothing } A procedure like this could really make a difference. Updating could now be almost totally automated, and if SuSE would post an e-mail to this forum when a new update is released, I'm sure a lot of SuSE installations would be updated much more frequently then is the case today. I for one would update our systems a lot more frequently. Lets also say that you put a subject string like "Announce: SuSE security update SU05 is released ...." in the e-mail, and in the Message body a link to the newest update file. Users could then make a filter in their e-mail client that would redirect all mail coming from SuSE containing this subject string, to a high priority mailbox. When the user opens the mail, he just clicks on the link and this baby would rock'n role. Of cause I could write the script my self, but that would not make the downloading easier at all, and here I see a opportunity for SuSE, with very little effort, to really make thinks much more "user friendly". Thanks in advance Bo Jacobsen bjc(a)image.dk

12 19

Re: [suse-security] network options
by Matthias Krawen 07 Oct '00

07 Oct '00

At 22:43 06.10.2000 -0500, you wrote: >Sure you can do that with dhcp. go to www.no-ip.com and register a >subdomain of no-ip.com, download the updater client (works for BTW: Does anybody know some Dynamic-IP Services which is doing this professional with some redundancy ? Thx. Matthias Compositiv EDV- und Kommunikationslösungen, PC-Service Matthias Krawen Peiffersweg 9 22307 Hamburg Tel: 040 / 611 673 - 40 EMail: info(a)compositiv.de Fax: 040 / 611 673 - 41 http://www.compositiv.de

1 0

Re: [suse-security] network options
by Russell Evans 07 Oct '00

07 Oct '00

Cleaned up the grammer, I hope. I hate it when I sound like an idiot. The Cisco 675 will do PAT, port address translation as will as NAT, network address translation. You want to do a, set nat entry add, on the 675 to open a port on the DHCP addressed WAN port. This port will be forwarded to the specified computer's IP address and port. The full command you want to use is, set nat entry add inside_ipaddress port. The inside_ipaddress port is the computer's IP address / port you wish opened. The full command for port fowarding is set nat entry add inside_ipaddress port outside_ipaddress port protocol. By leaving the outside address unspecified, the Cisco 675 will open a port on any address you recieve on the wan port via dhcp. If you specify the address then it will break, if you are ever assigned a new one. To assign a name to your box I would suggest. www.dhs.org. Sign up for a dyn.dhs.org host and then apply the DHCP address that the Cicso 675 has on it's wan0-0 port. Use the command sh nat on the Cisco to get the DHCP address you recieved. cbos#sh nat NAT is currently enabled Inside Global Address set to 216.160.111.159 Inside Local Inside Global Timer Flags Protocol 10.0.0.30: 222 216.160.111.159: 222 0 0x2041 *** 10.0.0.10: 25 216.160.111.159: 25 0 0x2041 *** 10.0.0.10: 22 216.160.111.159: 22 0 0x2041 *** You can see that I have two computers. I have PAT pointing connections for ssh (22) , and SMTP (25), and port 222, which is ssh running on the second host. You can only point one port on the wan interface to one computer / port, so to ssh in the second computer required another port to be opened and the sshd deamon on the that host to listen on port 222. I used 222 because it is easy for me to remember. ssh myhost.dyn.dhs.org 222 There where a few times when I wanted access to my computers when away, where service had been interrupted and I had recieved a new DHCP address. Of course being away from the systems I had no way of know what the address assigned was and myhost.dyn.dhs.org was not pointing to the new address. I had no way to know what to connect to and was locked out. To fix this, I used a script and setup the Cicso 675 to log its syslog to one of my machines. The cisco commands are cbos#set syslog SET SYSLOG requires one of the following arguments disabled Turn off Syslog enabled Turn on Syslog port Set Syslog Port Number remote Set Remote IP Address test Test Syslog server So enable it and use set syslog remote ipaddress to point the logging to your computer. Using yast, it is very easy to setup syslog to accept traffic from other host. System Administration/Change configuration/ look for SYSLOGD_PARAMS and add -r to the options. Now do as root /sbin/init.d/syslog restart, and then on the cisco use the command cbos#set syslog test HELLO, this is cool. To test that this works, use, as root, on the host with syslogd accepting input from the 675 , the command, grep HELLO, /var/log/messages Now every time the cisco picks up a new address it will log this fact to the syslog daemon on your computer. The script will search for the ip address logged in /var/log/messages and if it does not match the current DNS setting at dhs.org it will change them to match. Set up the attached file with the appropraite settings for your dhs.org account. Then set up a cron job as root to run the script every hour or so. It has to be root because only root has access to /var/log/messages. When run, the script will test the current DNS settings of your dyn.dhs.org host on the dhs.org DNS server, if the current ip address of the cisco matches, then logger logs this fact to syslog. If the ipaddress isn't the same, the script updates your settings and logs if it was successful or not. Thank you Russell > I get service through USWest and I believe that I have a Cisco > 675 DSL modem. I'm interested in what you develop for a setup on this... > > Thanks, > Ryan

1 0

Re: [suse-security] network options
by Russell Evans 07 Oct '00

07 Oct '00

USWest DSL and USWest's "cheap / basic" ISP service use the cisco 675 in route mode not bridge mode. What you suggest can only be done in bridge mode. Most ISP's using USWest dsl to deliver service to their customers, use bridge mode because it is easier to setup and support for them. USWest.net uses route mode. Thank you Russell > Sure you can do that with dhcp. go to www.no-ip.com and register a > subdomain of no-ip.com, download the updater client (works for > win/linux/mac) load it up on the firewall and setup port forwarding on the > firewall to forward in your ftp/http/smtp/pop/telnet/ssh whatever > connections. I am doing exactly that - dsl line, linux firewall, three > computers behind the firewall one of which is http/ftp/smtp/pop server. >

1 0