December 2000 - openSUSE Security - openSUSE Mailing Lists

a little service question
by Dustin Huptas 09 Dec '00

09 Dec '00

Hello, I have the following services running: Port State Service 21/tcp open ftp 22/tcp open ssh 80/tcp open http 111/tcp open sunrpc 113/tcp open auth 510/tcp open fcp 513/tcp open login 514/tcp open shell 515/tcp open printer 973/tcp open unknown 1024/tcp open kdm 3306/tcp open mysql I do need ftp, ssh, http and mysql in any case. But I don´t know about the other services. I remotely administer this server which is housed at my ISPs place. Does anyone know the other services and if I can disable them? Additionally I need to know hwo to secure the "needed" services. Any help is appreciated and many thanks in advance! btw. I already use tcpd to wrap the most of the services. Rgds Dustin

2 1

TIS FWTK
by Christian Lox 08 Dec '00

08 Dec '00

Hi everyone! Does anyone use the TIS Firewall Toolkit? Before installing I would like to hear advice from the experts! It seems quite old to me?! Christian

3 2

Re: [suse-security] Firewall 4.0
by r.maurizzi＠gvs.it 08 Dec '00

08 Dec '00

> FW_FORWARD_MASQ_TCP="195.10.11.0/29,10.96.1.110,1548" > Is there anyone else who had this problem? Actually, yes. I have a line that says (hand-wrapped): FW_FORWARD_MASQ_TCP="0.0.0.0/0,192.168.10.6,25 0.0.0.0/0,192.168.10.6,1352 0.0.0.0/0,192.168.10.3,80 0.0.0.0/0,192.168.10.3,443 0.0.0.0/0,192.168.10.6,81" Now, all the forwardings DO works, EXCEPT for port 1532. ipchains rules are Ok, but I had to specify an explicit forwarding rule using portfw module to have the system forwarding this port (don't know anything of th mfw module used in the script). Ciao, Roberto

2 1

RE: [suse-security] a little service question
by "Plüm, Rüdiger, MTC-SWW" 08 Dec '00

08 Dec '00

Hello, [..cut..] > Also, you will need to enable apache (httpd) in /etc/rc.config > > This will give you everything you said you require with the > exception of MySQL. > I am not an sql guru, but I'm 99% sure that you don't need to have it > listening on > the network if you are going to be accessing it from localhost. > If it does need to be listening on a network port, you should > be able to > tell it to > listen on 127.0.0.1 only. You are right. If you need only connections to localhost you can set the option skip-networking in the [mysqld] section of /etc/my.cnf Restart mysql after that and you are done. MySQL will then use the UNIX domain Socket /tmp/mysql.sock for IPC only. > Of course you will need to follow the MySQL docs on how to > configure it > securely > with password etc. > > Once you have done all this (it should take you about 15 min > except for MySQL > which may take you a few minutes more) reboot the machine > just to check that > everything works and is set to startup etc, then do a nmap > (or a netstat -nat) [..cut..] Regards Rüdiger Plüm -- Rüdiger Plüm Mannesmann TeleCommerce Department: Web Engineering, MTC-SWW Phone: +49 2102 97 21 58 Fax: +49 2102 97 12 08 Email: ruediger.pluem(a)it-mannesmann.de Address: Rehhecke 50, D-40885 Ratingen

1 0

Updated openssh loads ipv6?
by Frank Steiner 08 Dec '00

08 Dec '00

Hi, after installing the new openssh package, the ipv6 module is suddenly loaded. And from time to time I find those warnings: Dec 6 11:47:06 listrac sshd[3195]: Accepted rsa for ROOT from 134.245.252.95 port 913 Dec 6 11:47:06 listrac kernel: IPv6 v0.8 for NET4.0 Dec 6 11:47:06 listrac kernel: IPv6 over IPv4 tunneling driver Dec 6 11:47:06 listrac sshd[3205]: Accepted rsa for ROOT from 134.245.252.95 port 702 Dec 6 11:47:26 listrac kernel: eth0: no IPv6 routers present Dec 6 11:47:27 listrac kernel: eth0: no IPv6 routers present I'm using the latest 2.2.16 kernel from 7.0 on a SuSE 6.4 system and never explicitely changed any settings to activate ipv6. Should openssh load the ipv6? What's it needed for in this context? And why do I get the error messages about the non-existent routers? Sorry if this is maybe not a security issue, but as it seems to be caused by the new openssh, I first ask here :-) Best regards, Frank -- Dipl.-Inform. Frank Steiner mailto:fst@informatik.uni-kiel.de Lehrstuhl f. Programmiersprachen mailto:fsteiner@web.de CAU Kiel, Olshausenstraße 40 Phone: +49 431 880-7265, Fax: -7613 D-24098 Kiel, Germany http://www.informatik.uni-kiel.de/~fst/

2 1

netstat-output
by Martin Geigl 08 Dec '00

08 Dec '00

Hi all, had an attack attempt a few days ago via the kstatd, but it seemed to me it wasn't successfull. I did an netstat -p to check and got the following: (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) But I was root! My question now is, is this a standard comment of netstat or is there a "hidden" program running, which even root can't see (e.g. some trojan horse)? Thanks in Advance Martin -- ------------------------------------- Martin Geigl Universitaet Greifswald Institut fuer Physik Domstr. 10a 17489 Greifswald Tel.: +49-3834-864756 Fax: +49-3834-864701 -------------------------------------

11 12

chroot
by Ralf Koch 07 Dec '00

07 Dec '00

Hi. First of all: Thank you for your answers to my question relating the security of a chrooted environment. I just called the provider of the system working with the descripted chroot jail. He told me that inside the jail theres only one program with suid root bit set, namely crontab. No UID/GID is changed during "chrooting" and all programs inside the jail are unchanged copies. So every process executed from inside the jail runs chrooted too with its normal rights. Based on these statements, he estimates his system secure. My knowledge of hacking is quite small so i can't decide if he's wrong. There is another solution of locking a user in a private environment by starting some tasks delusioning a complete hardware environment with own IP and running a second complete Linux inside this environment (seem to be very complex, but works pretty nice). IMHO the safer solution. If a hacker tries to break up these tasks he cuts his own (virtual) kernel and (for my personal view) will be cut off from the connection immediately. Am I wrong? * * Ralf 'coko' Koch * mailto:info@formel4.de * --- Computers are like air conditioners: They stop working properly if you open windows.

3 3

Re: [suse-security] netstat-output
by Raffy 07 Dec '00

07 Dec '00

> Is there any easy way totrick someone by making a replaced file have the same md5 sum by adding in > useless bits at the end or something? md5 is a cryptographic hash function. These functions do exactly have the property that no two messages (files) should have to the same checksum. [All cryptopeople, please excuse my loose argumentation. I know, I should argument on things like preimage resistance and collosion resistance. I like to put it the easy way here!] It would take you an aweful long time to find two files which map to the same hashvalue. Especially it might not be possible to pad a file with anything to get the same values! See Handbook of Applied Cryptography for further details about hashfunctions and MD5 in general. Cheers Raffy

1 0

RE: [suse-security] chroot
by Raffy 07 Dec '00

07 Dec '00

> I'm looking for some assistance (another pair of eyes, so to speak) to help > me figure out how to get BIND chrooted and split-brained. The "HOWTO" that > I found (Dave Ranch's TrinityOS doc) is more for RedHat and derivatives, rather than SUSE. Any ideas? Yes. I did it for SUSE. BUT! I used version 8.2.2p5 not the newest version. If anybody is interested, I wrote a little script which does all the steps necessary to get the thing going. There might be some work necessary to adapt the script in some details, but it should give a fair overview of how it works. Tell me if you want the script... Cheers Raffy PS: What is split-brained?

1 0

Re: [suse-security] netstat-output
by Volker Kuhlmann 07 Dec '00

07 Dec '00

> > To verify an installed package against a RPM, use: > > > > rpm -Vp packagename.rpm > > This of course is trivial for an attacker to circumvent, the RPM database is > not really protected at all. That's why it may be an excellent idea to back up the rpm data base on floppy... > Ok that's a little better but still an attacker can beat it (replace the rpm > binary for example). ... together with the rpm binary (which is statically linked as well for other reasons). While you're at it, storing md5 sums of at least all the files shown by rpm -qal and all files in /etc is a very good idea too. Volker

4 3

Re: [suse-security] chroot
by Raffy 06 Dec '00

06 Dec '00

To this topic I have another question: Does anybody have sendmail running in a chroot environment? I was looking for a HowTo (for bind I found one) or something alike. Nothing. I would appreciate any hints. If no HowTo exists and I get enough info, I would be more than happy to write one... Thanks Raffy

2 1

is it "safe" ?
by Jan Räther 06 Dec '00

06 Dec '00

Hi everybody, I was asking myself how secure is a system when there are no services running on it. I have here a Linux-Box which acts as a Masquerading-Gateway. There a no services running on it, just the Masq-Script as described in the SuSE Support Database (just the Standard). I haven't worked much with Linux, but when no services like WWW or SMTP are running it should be nearly safe or not? Jan Räther [?] [!] newtention technologies gmbh mailto:jan@newtention.de | http://www.newtention.de ----- panic("Tell me what a watchpoint trap is, and I'll then deal with such a beast..."); 2.2.16 /usr/src/linux/arch/arch/sparc/kernel/traps.c

6 6

Re: [suse-security] RPM-Update on all boxes in a LAN
by Roman Drahtmueller 06 Dec '00

06 Dec '00

> Is this announcement still coming? ;-) Yes. Messy... > After updating to openssh-2.3.0p1-0 I'm unable to (s)login to the computer with the > updated package. > I'm getting this error message: > ssh_exchange_identification: Connection closed by remote host > > What does this mean? Do I have to generate a new key with ssh-keygen? Hi Richard, This looks like ssh access is blocked by /etc/hosts.allow,deny (tcp wrapper). > > Many thanks, richard Grüße, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

1 0

AW: [suse-security] a little service question
by Dustin Huptas 06 Dec '00

06 Dec '00

Dear Mr. Bien, I am surprised by this harsh answer of yours. Until now I was convinced that a mailing list concerning security is to be used when someone has a security-related question. If all users on planet earth would be as "smart" as you are (seem to be) then we would not need such things as mailings-lists. There is always a point where man-pages and faq-lists do not seem to answer one´s question and then it is time to ask other users. Or did I get the point wrong? You can be sure that I took the time to find the answer myself but I think it is not useful to reinvent the wheel over and over again (as a german proverb goes, don´t know the english equivalent)! I would appreciate an answer from you and a statement from the list whether I was "allowed" to ask such a "stupid" question or not. Thank you Rgds Dustin Huptas -----Ursprüngliche Nachricht----- Von: Alexander Bien [mailto:abien@gmx.net] Gesendet: Mittwoch, 6. Dezember 2000 14:23 An: Dustin Huptas Betreff: RE: [suse-security] a little service question www.securityfocus.com read it, understand it, feel it.. and please stop posting msgs like "How do i .." to security mailing lists .. Have a nice day.. -- Mit freundlichen Grüßen Alexander Bien -- PIRONET NDH Alexander Bien - Technical Assistant - SBU Services Josef-Lammerting-Allee 14-18, 50933 Cologne - Germany Tel.: +49 (0)172 7760569 - Fax: +49 (0)221 770 2815 mailto:abien@pironet.com - http://www.pironet.com > -----Original Message----- > From: Dustin Huptas [mailto:dustin2010@gmx.de] > Sent: Wednesday, December 06, 2000 2:03 PM > To: suse-security(a)suse.com > Subject: [suse-security] a little service question > > > Hello, > > I have the following services running: > > Port State Service > 21/tcp open ftp > 22/tcp open ssh > 80/tcp open http > 111/tcp open sunrpc > 113/tcp open auth > 510/tcp open fcp > 513/tcp open login > 514/tcp open shell > 515/tcp open printer > 973/tcp open unknown > 1024/tcp open kdm > 3306/tcp open mysql > > I do need ftp, ssh, http and mysql in any case. But I don´t know about the > other services. I remotely administer this server which is housed > at my ISPs > place. Does anyone know the other services and if I can disable them? > Additionally I need to know hwo to secure the "needed" services. > > Any help is appreciated and many thanks in advance! > > btw. I already use tcpd to wrap the most of the services. > > Rgds Dustin > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

6 5

Apache 1.3.14 on Suse
by webmaster 06 Dec '00

06 Dec '00

Hi out there, Reading "little security" grumblings out there I am very careful :-)) - since Apache is indirectly related to sec issues only I remember an Apache-Php4 thread being on a few weeks ago, and as if Roman had promised to turn opensource version into a Suse rpm of Apache1.3.14 . I might looked for it at a wrong place but what I saw was 1.3.9. that does not go with php4. I have downloaded from rpmfind.net an 1.3.14 binary, but let me ask the list about its possible sec holes before installing it. /-------------------------/ Antal Leisen webmaster(a)kreorg.hu Kreorg Educational Center Budapest, Hungary

1 0

chroot
by Ralf Koch 06 Dec '00

06 Dec '00

Hi. I've just a short question: Does anybody know how secure it is to chroot users in a small piece of my server tree? We want users to login via ssh and work on a webserver (test scripts etc.). They shouldn't see each other even they shouldn't know if they are on a real server or in a virtual space that seems and behave in most cases like a server. To point it out: Is there a possibility to break up the chrooted environment or is it safe to let them login ? Thanks in advance * * Ihr Formel4-Team * mailto:info@formel4.de * --- Viren machen auch etwas Nützliches, z.B. Windows löschen.

5 4

RE: [suse-security] chroot
by Dave Woutersen 06 Dec '00

06 Dec '00

Also HI! Is there a "good" doc about creating a chroot jail? I prefer UNIX independent documentation because I work with different UNIX platforms. Mostly SUN by the way. Thanks, Dave >>> Boris Lorenz <bolo(a)lupa.de> 6-12-00 12:47:42 >>> Hi, if a compiler and certain programs are missing in a chroot jail it can be considered reasonably safe. A possible way for an attacker to break out of such a jail is to abuse setuid programs such as (older) versions of perl (which is likely to exist on a webserver for cgi-scripts), or to exploit known vulnerabilities of other binaries which reside in the chroot'ed area. There are numerous exploits for other chroot'ed environments for services such as ftp (see http://www.securityfocus.com/archive/1/12962) but I doubt wether these can be adjusted to your situation. Anyway, take a close look on what you put in the chroot area. There's some paper discussing ways of escaping the chroot jail under http://www.bpfh.net/simes/computing/chroot-break.html which is quite informative. Boris <bolo(a)lupa.de> --- On 05-Dec-00 Ralf Koch wrote: > Hi. > > I've just a short question: Does anybody know how secure it is to > chroot users in a small piece of my server tree? > > We want users to login via ssh and work on a webserver (test scripts > etc.). They shouldn't see each other even they shouldn't know if they > are on a real server or in a virtual space that seems and behave in > most cases like a server. To point it out: Is there a possibility to > break up the chrooted environment or is it safe to let them login ? > > Thanks in advance > > * > * Ihr Formel4-Team > * mailto:info@formel4.de [...] --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Firewall 4.0
by Schulz, Wolfgang 06 Dec '00

06 Dec '00

Hello! I still have no new about the problem I had with the 4.0 Firewall script. Therefore I put the question again. Although it is not a good idea I want to forward a connection made on the internet side of the firewall to a special port on an internal server. We are using private IP addresses internally. I want to allow only connection from a small subnet 195.10.11.0/29 and I used FW_FORWARD_MASQ_TCP FW_FORWARD_MASQ_TCP="195.10.11.0/29,10.96.1.110,1548" I tried afterwards to connect to this port - there is a connection but it seems that nothing is forwarded to the internal machine. Is there anyone else who had this problem? What could be wrong? Thanks Wolfgang

1 0

preventing some warnings of the firewal
by Carl Albert Schreiber 05 Dec '00

05 Dec '00

Hello, since I installed my firewall on Suse 7.0 & ipchain & Cable modem I got again and again 2 lines warnings: Dec 1 12:40:57 rosemary kernel: martian source 0100007f for 2da12fd5, dev eth0 Dec 1 12:40:57 rosemary kernel: ll header: ff ff ff ff ff ff 00 01 02 1c 5b b6 08 06 (where 0100007f = 127.0.0.1 & 2da12fd5 = 213.47.161.45) The log files firewal, warn & messages immediatly grow to 200 and more MB, which is pretty enoying. Of course first I look at my pc, but could find anything to stop that With Ksnuffle I found the corresponding info. to that: 11:40:57.794252: 1514: arp who-has 127.0.0.1. -> 213.47.161.45. : 11:40:57.794753: 1514: arp who-has 213.47.161.45. -> chello213047161001.15.univie.teleweb.at. : So now I think in the network of my provider some pc that are missconfigured :(. Can anybody tell my how I can prevent these and only these warnings been written into my log files? With my 6 weeks firewall experince I can't do myself unfortunately. I thank You in advance, Carl

1 0

RPM-Update on all boxes in a LAN
by gtschakert＠gmx.de 05 Dec '00

05 Dec '00

Hi, after reading the last security-announcement I ask myself if there is a tool to update the new rpm automatically to all the boxes in my LAN. What I want to do is the following: I recieve the security-announcement: I decide to install or not and download the rpm. I start a script, which will install the rpm to the boxes of my choice. I don't want to login on every box, install the rpm and go to the next box. I hoped alice would do things like that, but I think alice is only a tool for new installation (and you have to make a floopy-disk or a CD). And I think, some month ago, I have read about a scripting-language for system administrators, but I don't remember where. Anybody, who can help me.

12 16

connections to port 0
by Dpto. Tecnico 05 Dec '00

05 Dec '00

Hi, I have the 4.0firewall, and the firewall log shows a some connections accepted on port 0: Packet log : input ACCEPT eth1 PROTO=1 a.b.c.8 x.y.z.0 L=68 ..... I think it shouldn't be posible since port 0 is reserved.. could this be a misconfuguration in the firewall?? , or even a little bug.... Thks you all! karlos

2 1

RE: [suse-security] Firewall/Virusscanner Conclusion
by ralf.vroomen＠itplus.nl 05 Dec '00

05 Dec '00

>Anyway, it's getting off-topic now and I'll contact >CAI's product manager regarding this issue. Please let us know :) Thanx, Ralf "htmlmail" Vroomen.

1 0

RE: [suse-security] Firewall/Virusscanner Conclusion
by ralf.vroomen＠itplus.nl 05 Dec '00

05 Dec '00

>Are you sure? AVP/Linux (now Kaspersky Lab Anti Virus) was "free" during >the beta test period. But now it's sold like a regular product, at least >here in Germany and if you order it from avp.ru. You're right, my mistake. >Last time I was in >contact with CAI's product manager I was told InouclateIT/Linux is >beta. So, why do you think both are free? Taken from http://antivirus.cai.com/cgi-bin/ipe/connect.cgi : InoculateIT Personal Edition is 100% FREE. I'm not commercial... Reg, Ralf Vroomen

2 1

unknown ports
by Joerg Ruckhaberle 05 Dec '00

05 Dec '00

High, I'm having some broadcast traffic on the ports 135 2301 58085 Any idea what this could be. Thanks in advance -- Jörg Ruckhaberle - Projektleiter - ISB AG Tel: +49 (0)721/82800-0 Karlstraße 52-54 Fax: +49 (0)721/82800-82 76133 Karlsruhe mailto:joerg.ruckhaberle@isb-ka.de Germany http://www.isb-ka.de

2 1

AW: [suse-security] unknown ports
by Stiefenhofer, Marek ECOFIS 05 Dec '00

05 Dec '00

port 2301 is default for Compaqs Insight Manager, that is well-known for different security flaws (rebooting machine, reading files).

1 0