openSUSE Security

Download

security@lists.opensuse.org

November 2000

186 participants
177 discussions

NOQUEUE: HELO/EHLO attack?
by Volker Tanner 01 Nov '00

01 Nov '00

Dear list members, as we only run a dial up mailserver I'm not very experienced with security issues. So it got me by surprise to find this in my /var/log/mail: Oct 31 17:15:50 kbsvr07x sendmail[26682]: NOQUEUE: h-62.96.138.42.user.addcom.de [62.96.138.42] (may be forged): HELO/EHLO attack? Oct 31 17:15:51 kbsvr07x sendmail[26682]: NOQUEUE: Null connection from h-62.96.138.42.user.addcom.de [62.96.138.42] (may be forged) What does it mean? I run tripwire regularly, it does not show anything unusual, neither do my other logfiles. Normally I have the mailserver connecting our ISP at this time to fetch mail, so the dial-up connection was correctly initiated. Dial in is disabled. I ran nslookup at the given address, the hostname fits it, the information in whois database don't tell me anything I can find useful. Thank you for the answers Greetings VOlker

1 0

Re: [suse-security] preventing login screen emulation?
by Volker Kuhlmann 01 Nov '00

01 Nov '00

> The last that comes into my mind is a small script or program that runs > started by init and that kills all non-root (and possibly others) programs > on the machine. It could be bound to ctrl-alt-del like the following > (/etc/inittab): Hmmmm. There goes multi-user... :-(( (I mean someone could have legitimate processes running wihtout terminal.) > Personally, I dislike the ctrl-alt-del thing. It seems to me that it > should teach people that rebooting just like in old DOS times isn't really > necessary any more and that there has been some progress since color TV > was invented. That's a good one to add to "quotable quotes" :-) Volker

2 1