October 2000 - openSUSE Security - openSUSE Mailing Lists

Amavis/McAfee VirusScan
by José Carlos Stevenson 21 Oct '00

21 Oct '00

I was using Red Hat 5.1, amavis and McAfee viruscan in one of my clients server. I recently (about 4 or 5 months ago) moved to SuSE 6.4 and I'm having a bad time putting McAfee to work under SuSE. I've contacted Network Associates representatives in Brazil (www.nai.com.br) but they always say they will find an answer and return my calls/email but it never happens. I've installed and old version of viruscan under SuSE and it's running (engine 3) but some new viruses have passed. The package I've downloaded from nai was vlnx407l.tar.Z - I've used the script "install-uvscan" to install it (no problems until now), but when I've tried to run it I received a message "file or directory not found". I'm about to move to RedHat's latest version - against my will. I saw by previus emails on this list that some of you are using Amavis and I'd like to know witch virus scanner you're using and, of couse, if anyone knows how to put McAfee's viruscan working under SuSE. Thanks for your help, best regards, José Carlos Stevenson. ----------------- install-uvscan ----------------- #!/bin/sh ############################################################# # # Company : Network Associates. All Rights Reserved. # Author : M. Lucas # Function : Script to install uvscan # Creation date : 20/04/99 # Shell used : Bourne Shell # ############################################################# # Default installation location default_dir="/usr/local/uvscan" export default_dir # Default install switches switches="--secure -vr" # Displays error messages and quits. # $1 - optional error message. exit_error() { if [ -n "$1" ] then printf "$1\n" fi printf "Installation incomplete\n" exit } # Display usage for the script. # $1 - Script name display_usage() { printf "Usage: $1 [install_dir]\n" printf "\n" printf " install_dir Directory in which to install uvscan\n" printf " Default is $default_dir\n" printf "\n" } # Check whether the correct versions of libraries are installed. # Currently only needed on AIX, where xlC.rte >= 4.0.2.0 check_libs() { if [ "$PLATFORM" = "AIX" ] then XLCRTE_MIN_VER="4.0.2.0" lib_ver=`lslpp -l 'xlC.rte' | grep 'xlC.rte' | awk '{ print $2 }'` lib_num=`echo $lib_ver | awk -F. '{print $1 $2 $3 $4}'` min_ver=`echo $XLCRTE_MIN_VER | awk -F. '{print $1 $2 $3 $4}'` if [ "$lib_num" -lt "$min_ver" ] then printf "Fatal Error. This product requires xlC.rte version $XLCRTE_MIN_VER or later\n" printf " The current version is $lib_ver. The newer version can be\n" printf " downloaded from IBM's ftp site at ftp://service.boulder.ibm.com\n" printf " For more information, see whatsnew.txt\n" return 1 fi return 0 fi } # Asks question, and waits for one of 2 responses # $1 - Question text # $2 - 1st response - default # $3 - 2nd response # Exit Status... # 0 - 1st response chosen # 1 - 2nd response chosen get_yn() { answer="" while [ -z "$answer" ] do printf "$1 [$2]/$3 " read answer # Set the default and take the first letter answer=`echo "${answer:-"$2"}" | cut -c1 | tr [A-Z] [a-z]` [ "$answer" = "$2" ] && return 0 [ "$answer" = "$3" ] && return 1 answer="" done } # Check the directory supplied. If it doesn't exist, create it # $1 - Directory name # Exit status... # 0 - All OK. Exists # 1 - Doesn't exist. User declined to create it. # 2 - Doesn't exist. Can't create. check_dir() { if ls -ad "$1" >/dev/null 2>&1 then : else if get_yn "$1 doesn't exist. Create it?" "y" "n" then if mkdir -p "$1" 2>/dev/null then ret=0 else printf "Failed to create $1\n" ret=2 fi else ret=1 fi fi return $ret } # Make a symbolic link to filename in directory # $1 - filename # $2 - directory # Exit status... # 0 - All OK. Link exists # 1 - Doesn't exist. User declined to create it. # 2 - Doesn't exist. Can't create link. # 3 - Doesn't exist. Directory not there to place it into make_link() { name=`basename $1` if get_yn "Do you want a link to $name placed in $2" "y" "n" then if check_dir $2 then : else return 3 fi if ls -ad "$2/$name" >/dev/null 2>&1 then if get_yn "$2/$name already exists. Overwrite?" "y" "n" then rm -f "$2/$name" 2>/dev/null fi fi if ls -ad "$2/$name" >/dev/null 2>&1 then printf "Cannot overwrite $2/$name\n" return 2 fi if ln -s "$1" "$2/$name" 2>/dev/null then return 0 fi printf "Cannot write to $2\n" return 2 else return 1 fi } # Sets up the necessary environment variables so the shared lib can be found. # $1 - Installation directory set_up_environment() { if [ "$PLATFORM" = "SunOS" -o "$PLATFORM" = "SCO_SV" ] then LD_LIBRARY_PATH=$LD_LIBRARY_PATH:"$1" export LD_LIBRARY_PATH elif [ "$PLATFORM" = "HP-UX" ] then SHLIB_PATH=$SHLIB_PATH:"$1" export SHLIB_PATH fi } # Old files which may be left over from previous versions oldfiles="libSunFindVirus.so ufindvir findviru.drv find.drv names.drv repair.drv" # Database files driverfiles="scan.dat names.dat clean.dat messages.dat license.dat" # Supporting files otherfiles="readme.txt unx47uag.pdf reseller.txt license.txt" # Program name programname="uvscan" # The uninstaller uninstall="uninstall-uvscan" # Determine the platform and set library name if required PLATFORM=`uname -s` export PLATFORM case $PLATFORM in "SunOS") libraryname="libsunfv.so" ;; # Solaris "HP-UX") libraryname="libhpxfv.sl" ;; # HP-UX "SCO_SV") libraryname="libscofv.so" ;; # SCO Openserver "Linux") libraryname="" ;; # Linux "AIX") libraryname="libaixfv.a" ;; # AIX "FreeBSD")libraryname="" ;; # BSD *) exit_error "Unknown platform. Unable to install." esac allfiles="$programname $libraryname $driverfiles $uninstall $otherfiles" # Get the path which install-uvscan was executed from. runpath=`dirname $0` # If there is more than one argument, complain. if [ $# -gt 1 ] then display_usage `basename $0` exit_error fi if check_libs then : else exit_error fi # Set install_dir to default if dir not supplied as argument install_dir="${1:-$default_dir}" if check_dir "$install_dir" then : else exit_error fi if [ -d "$install_dir" ] then if [ -w "$install_dir" ] then # Delete any out of date files for file in $oldfiles do chmod 777 "$install_dir/$file" 2>/dev/null rm -f "$install_dir/$file" 2>/dev/null done if [ "$install_dir" != "$runpath" ] then # Copy new stuff into installation directory for file in $allfiles do chmod 777 "$install_dir/$file" 2>/dev/null rm -f "$install_dir/$file" 2>/dev/null cp "$runpath/$file" "$install_dir" 2>/dev/null done fi else exit_error "Cannot write to $install_dir" fi else exit_error "$install_dir exists, but is not a directory" fi # Initialise variables correct="" # Check all files exist for current in $allfiles do if [ ! -f "$install_dir/$current" ] then correct="NO!!" printf "$current is missing ...\n" elif cmp "$install_dir/$current" "$runpath/$current" >/dev/null 2>&1 then : else correct="NO!!!" printf "$current is not correct...\n" fi done if [ -z "$correct" ] then # Set file permissions for file in $driverfiles $otherfiles do chmod 444 "$install_dir/$file" done for file in $programname $libraryname $uninstall do chmod 555 "$install_dir/$file" done make_link "$install_dir/$programname" "/usr/local/bin" if [ -n "$libraryname" ] then if make_link "$install_dir/$libraryname" "/usr/local/lib" then : else printf "\n" printf "You may need to set up your environment so the system\n" printf "knows where to find $libraryname\n" printf "\n" set_up_environment "$install_dir" fi fi # Execute install run "$install_dir/$programname" $switches $HOME else exit_error fi

2 1

Ipchains and fragments(-packets)
by RoMaN SoFt / LLFB!! 20 Oct '00

20 Oct '00

Hi. I'm reading ipchains-howto and have some questions... - I've compiled 2.2.17 kernel and set the appropiated options for firewall implementation. But.. I couldn't see any "IP: always defragment" option. :-?? I think it's an old option, isn't it?? (it sounds familiar to me when using 2.0.x kernels). - If I choose a default restricting policy (-P deny), which is the more secure one, how could I handle fragmented packets? I mean, let's suppose all packets are denied (my default chain policy), and now I want to permit web access. Apart from adding a normal accept-rule to manage this (-p tcp -d 0/0 80, for example, and the reverse-path), would I have to add a fragment-specific rule (-f) in addition to the first one??? Because it would be a little tedious. Isn't there any tricky way of avoiding this? I've thought of using the above kernel option (which would avoid managing with fragments), but I haven't found on 2.2.17 (maybe it's enabled by default?). Thanks. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4 3

Nameserver Attacks?
by Ulrich Windl 20 Oct '00

20 Oct '00

Hi, does anyone know of current nameserver attacks in Germany. I had starnge error messages for uni-paderborn.de, t-online.de, and our local campus. (message "host not found"). Regards, Ulrich Example: ...uni-paderborn.de>... Host unknown (Name server: ws-han1.win-ip.dfn.de.: host not found)

2 1

Limitng root access
by Andres Tarallo 20 Oct '00

20 Oct '00

I've been working with FreeBSD and recently with Trustix Secure Linux; in both systems I've found a nice feature: the only users who're allowed to su root are the mebers of the root group. I haven't found how to do this in SuSE (currently working with SuSE 6.3 and 6.4, and switching to SuSE 7.0 soon), is this possible? Thanks in advance, Andres Tarallo

5 6

ipchains masq vs firewall
by Peter ten Have 19 Oct '00

19 Oct '00

Hello, I had a discussion about safety of a gateway. Right now I'm using SuSEfirewall without masquerading but with proxy's. From a security point of view, what is recommended: 1) no masquerading, use of proxy's (squid, irc-gw & plug-gw) 2) as in Marc's example: ipchains -A forward -j MASQ -i eth1 or 3) ipchains -P forward DENY; ipchains -A forward -s 192.168.10.0/24 -j MASQ ; echo 1 > /proc/sys/net/ipv4/ip_forward As i understand ipmasq does do the job transparent while with some proxy's connecting is a 2 step process. -Peter-

1 0

Online Article about Securing Webservers
by marc＠suse.de 19 Oct '00

19 Oct '00

Hi, at http://www.suse.de/security is now an article available about how to secure a webserver in german and english, including a step-by-step description. Have a lot of fun! Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

1 0

Logging Samba Connection Attempts
by dsoper＠oregon.uoregon.edu 19 Oct '00

19 Oct '00

Hi all, I've got a couple of samba servers running and some unauthorized users have been attempting to log in. Is there a way to get samba to log the IP addresses from bad login attempts. I can't find any advice on this in the docs. Cheers, Dennis -- Dennis Soper dsoper(a)oregon.uoregon.edu Network Supervisor Phone: 541.346.2286 Facilities Services Fax: 541.346.2299 The University of Oregon 1276 University of Oregon Eugene, OR 97403

2 1

Limiting root access
by Andrés Tarallo 19 Oct '00

19 Oct '00

First of all, I want to thank all of you for your answers; with your gidance and a little investigation in the man pages I've found that the file that allows to modify the su(1) behaviour is /etc/suauth; Bye Andres

1 0

Port 54321
by Togan Muftuoglu 19 Oct '00

19 Oct '00

Hi every one, I had a log entry for the belowing. I have checked the www.portsdb.org and gound that this port is called as Schoolbus Trojan. Is there a way to ensure myself that I do not provide acces to this trojan and how can I block this port while using SuSEfirewall 3.3 Packet log: input ACCEPT ppp0 PROTO=6 212.252.97.161:2513 212.57.4.152:54321 L=48 S=0x00 I=58894 F=0x4000 T=120 SYN (#44) Oct 19 14:08:38 isguzar kernel: Packet log: input ACCEPT ppp0 PROTO=6 212.252.97.161:2513 212.57.4.152:54321 L=48 S=0x00 I=58894 F=0x4000 T=120 SYN (#44) Thanks Togan Muftuoglu

1 0

Full OpenLDAP installation
by Oliver Grube (＠work) 19 Oct '00

19 Oct '00

Hello, regarding to the openLDAP documentation on www.openldap.org, I have to install openSSL, heimdal or MIT kerberos, Cyrus's sasl and BerkleyDB. Two of these I've found on the SuSE-7 (openssl and berkleyDB). I've compiled the other sources and installed them to my system before running ./configure for openLDAP. Everything is installed correctly and make test also runs fine. But as I want to add an LDIF to the sldapd, it asks me for the password (ok...) and then shows: ldap_sasl_interactive_bind_s: No such object. Any ideas? Greetinx, Oliver Grube ******************************************** iT_SEC - enabling trusted ebusiness ******************************************** iT_SEC Deutschland GmbH Dünner Straße 247, 41066 Mönchengladbach Telefon: 02161/6897-0, Fax: -199 http://www.de.it-sec.com Wir freuen uns auf Ihren Besuch auf der infosecurity 2000 in Frankfurt vom 31.10.- bis 2.11.2000, Halle 6 Systems 2000 in München vom 6.11.-10.11.2000 Halle C3. 121

2 1