February 2000 - openSUSE Security - openSUSE Mailing Lists

[philemon@spin.de: Bitte weiterleiten (was: fwd: (MAILER-DAEMON@suse.com) failure notice)]
by Rolf Haberrecker 24 Feb '00

24 Feb '00

----- Forwarded message from Benjamin Pflugmann <philemon(a)spin.de> ----- Hi. Ich wollte nur auf eine 'Fehlauslegung' des MySQL-Bugs hinweisen. Da die ACL von MySQL auch den Host beinhalten, von dem aus ein User kommt, muss man entweder einen Account finden, der fuer die ganze Welt freigeschaltet ist, oder Zugriff auf einen der in der ACL gelisteten Hosts haben. Sprich: Auf unserem eigenen Server koennten nur lokale User den Service missbrauchen, da er kein User mit einem remote host in den ACL vorkommt. Und lokalen Zugriff haben nur vertrauenswuerdige Leute. Der Bug ist also - entsprechende Einstellungen gemaess allgemeiner Systemsicherheit vorausgesetzt - zwar gravierend, aber nur halb so schlimm, wie es auf den ersten Blick scheinen mag. Die entsprechende Empfehlung sollte IMHO also sein - vorausgesetzt man traut den Anwedern, die Shell-Zugriff auf den Server haben - alle Accounts abzuschalten, die Zugriff von non-trustet remote hosts erlauben. Tschuess, Benjamin. PS: Ich bin mit TcX in keiner Weise verbunden, ausser dass ich ein reger Nutzer von MySQL bin und spreche in diesem Fall auch nicht im Namen der SPiN GbmH. --=20 Benjamin Pflugmann aka Philemon philemon(a)spin.de Developer, Guestbook Project Manager voice: +49 941 94 65 939 SPiN GmbH http://www.spin.de fax: +49 941 94 65 938 =3D=3D=3D=3D=3D=3D=3D Web design - Java chats - Guestbooks - Java/CGI codin= g =3D=3D=3D=3D=3D=3D=3D --xesSdrSSBC0PokLI Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v0.9.5 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE4sZFjmTjUS0P7KdYRAUtRAJ9un0yTedSXimfnphsXb4t5J4qWjgCgrP94 tkjnJk1u1vRsefIyH3gnEHE= =YOQS -----END PGP SIGNATURE----- --xesSdrSSBC0PokLI-- ----- End forwarded message ----- -- Mit freundlichen Gruessen, Rolf Haberrecker Leiter Business Partner Programm SuSE GmbH, Tel: +49-911-7405331 Schanzaeckerstr. 10, Fax: +49-911-7417755 90443 Nuernberg, Email: rolf(a)suse.de Germany WWW: http://www.suse.com/

8 8

Cron test -x /usr/lib/secchk/security-control.sh && /usr/lib/secchk/security-control.sh daily &]
by Till Rotter 23 Feb '00

23 Feb '00

Hi Everybody! Today I got this message from cron: -------- Original Message -------- Subject: Cron <root@nn2> test -x /usr/lib/secchk/security-control.sh && /usr/lib/secchk/security-control.sh daily & ... /usr/lib/secchk/security-daily.sh: line 189: 15398 Segmentation fault /bin/csh -f -s >/dev/null 2>&1 <<end-of-csh source $i /bin/ls -ldcg \$path > $TMP1 end-of-csh /usr/lib/secchk/security-daily.sh: line 189: 15414 Segmentation fault /bin/csh -f -s >/dev/null 2>&1 <<end-of-csh source $i /bin/ls -ldcg \$path > $TMP1 end-of-csh Can anybody tell me what this means? Has someone modified the script? Thanks for Your Help, Greets, Till Rotter

2 1

Re: [suse-security] Re: [Security - intern] Ihr PGP-Key
by marc＠suse.de 22 Feb '00

22 Feb '00

Hi, > Do you know, please, if there is a SuSE RPM for PGP encryption ? official suse rpm´s for crypto stuff can be found on german mirrors, e.g. ftp://ftp.gwdg.de/pub/linux/suse/6.3/i386.de/suse/sec1 Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

Re: [Security - intern] Ihr PGP-Key
by marc＠suse.de 22 Feb '00

22 Feb '00

Hi, > Sehr geehrte Damen und Herren, > welchen nicht-elektronischen Weg bietet SUSE > an, um seinen Public-PGP-Key zu beglaubigen? the fingerprint of our public key can be found in our linux handbook as a footnote at the end of the chapter "Security" (oder "Sicherheit" in Deutsch) Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

Portscan
by Stephen Thompson 22 Feb '00

22 Feb '00

Hi. I am relatively new to the list, and Linux in general. I have tried to find out more about security in man files and a couple of books, trying to make my machines more secure. While i was online yesterday and today I have noticed in my console that I had been portscanned. Sorry for the Spam on this, this is just what they sent. Feb 14 10:57:59 reaper scanlogd: From 216.77.42.93:20 to 192.168.0.51 ports 1764, 1765, 1766, 1767, 1768, 1769, 1770, 1771, 1772, ..., flags ??rp?u, TOS 10, TTL 114, started at 10:57:45 Feb 14 11:21:26 reaper scanlogd: From 216.77.42.93:20 to 192.168.0.51 ports 1800, 1801, 1802, 1803, 1804, 1805, 1806, 1807, 1808, ..., flags ??rp?u, TOS 10, TTL 114, started at 11:21:12 Feb 14 11:30:56 reaper scanlogd: From 216.77.42.93:20 to 192.168.0.51 ports 1819, 1820, 1821, 1822, 1823, 1824, 1825, 1826, 1827, ..., flags ??rp?u, TOS 10, TTL 114, started at 11:30:42 Feb 14 16:28:07 reaper scanlogd: From 216.77.42.93:20 to 192.168.0.51 ports 1902, 1903, 1904, 1905, 1906, 1907, 1908, 1909, 1910, ..., flags ??rp?u, TOS 10, TTL 114, started at 16:27:55 Feb 14 16:50:44 reaper scanlogd: From 216.77.42.93:20 to 192.168.0.51 ports 1925, 1926, 1927, 1928, 1929, 1930, 1931, 1932, 1933, ..., flags ??rp?u, TOS 10, TTL 114, started at 16:50:29 Feb 14 17:02:38 reaper scanlogd: From 216.77.42.93:20 to 192.168.0.51 ports 1976, 1977, 1978, 1979, 1980, 1981, 1982, 1983, 1984, ..., flags ??rp?u, TOS 10, TTL 114, started at 17:02:23 Feb 14 17:33:54 reaper scanlogd: From 216.77.42.93:20 to 192.168.0.51 ports 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, ..., flags ??rp?u, TOS 10, TTL 114, started at 17:33:40 Feb 14 21:03:23 reaper scanlogd: From 216.77.42.93:20 to 192.168.0.51 ports 2052, 2053, 2054, 2055, 2056, 2057, 2058, 2059, 2060, ..., flags ??rp?u, TOS 10, TTL 114, started at 21:03:11 Feb 15 13:42:21 reaper scanlogd: From 216.77.42.93:20 to 192.168.0.51 ports 2120, 2121, 2122, 2123, 2124, 2125, 2126, 2127, 2128, ... Now i have a small linux machine used to masquerade for the machines in our local setup so we can use the internet together. This is my ipchains setup at the moment (I know there is an SuSE packet filter script, I just havent got to grips with it yet :(, but at least im trying to find out the answers) <start of shell script> INTERNAL=192.168.0.0/24 echo -n "Turning on packet filtering:" # Stop all the rules before we set up the new ones echo 0 > /proc/sys/net/ipv4/ip_forward # set the default policy to REJECT /sbin/ipchains -X /sbin/ipchains -F /sbin/ipchains -P input REJECT /sbin/ipchains -P output REJECT /sbin/ipchains -P forward REJECT # Attempt to stop spoofing ipchains -A input -s 192.168.0.0/24 -i ppp0 -j REJECT -l ipchains -A input -s 127.0.0.1 -i ppp0 -j REJECT -l # Set up the input # Allow loopback connections ipchains -A input -s 127.0.0.1 -j ACCEPT # Allow the internal net to the internal net ipchains -A input -s $INTERNAL -d $INTERNAL -j ACCEPT # Allow the internal net to the external net ipchains -A input -s 127.0.0.1 -d ! $INTERNAL -j ACCEPT ipchains -A input -s $INTERNAL -d ! $INTERNAL -j ACCEPT # Allow the external net to the internal net # the active FTP stuff here. ipchains -A input -p tcp -s ! $INTERNAL 20 -j ACCEPT ipchains -A input -p tcp -s ! $INTERNAL 21 -j ACCEPT # Deny all incoming SYN requests on TCP ipchains -A input -p tcp -s ! $INTERNAL ! -y -j ACCEPT ipchains -A input -p udp -s ! $INTERNAL -d ! $INTERNAL -j ACCEPT ipchains -A input -s ! $INTERNAL -d ! $INTERNAL -j REJECT # Set up the forwarding chain # Allow forwarding in the internal net ipchains -A forward -s $INTERNAL -d $INTERNAL -j ACCEPT # Masqurade the internal to the external net ipchains -A forward -s $INTERNAL -d ! $INTERNAL -j MASQ # Masqurade should take care of external to internal # this should stop non masquraded forwarding ipchains -A forward -s ! $INTERNAL -d $INTERNAL -j REJECT # Set up the output rules ipchains -A output -j ACCEPT ipchains -P input REJECT ipchains -P output REJECT ipchains -P forward REJECT echo 1 > /proc/sys/net/ipv4/ip_forward <end of script> All I want the external network to do is send ICQ packets inside. Otherwise stop anything not a reply to a masqed packet. My questions are as follows (and i know they may be foolish): How did the person doing the portscan mannage to send thier packets to my internal machine 192.168.0.51 directly ? (I have noticed a lack of the same activity on the router which is 192.168.0.50 and i thought all my packets would look like they came from there) How can I get more information about the scanner on that host. I have tried to do the usual of host 216.77.42.93 and got no host, I've done a traceroute so I know what machines it goes through. I've tried to telnet to a few ports to see if they have any open to get the name of the place. I just want more information so I can keep tabs on it and mail the admin about the activities. Can anyone give me a few links to places to find out mroe about security in general. Thank you for your patience with this newbie. Stephen Thompson

3 3

help!!
by als 22 Feb '00

22 Feb '00

Hi everybody! i installed Suse 6.3 with firewall 1.4. I want to permit the following access through the firewall: www, domain, ftp, smtp and ssh. Then i made some adjustments in "rc.firewall" like : FW_ROUTE="yes" FW_TCP_SERVICES_EXTERNAL="smtp www domain ftp" FW_UDP_SERVICES_EXTERNAL="domain smtp ftp" After starting of firewall i have full access from internal network to internet but there isn't any access from Internet and no mail.... Could someone tell me what should i do? Any help welcome!!! Thanks in advance Als

3 2

what is wrong
by als 22 Feb '00

22 Feb '00

Hi everybody! i installed Suse 6.3 with firewall 1.4. I want to permit the following access through the firewall: www, domain, ftp, smtp and ssh. Then i made some adjustments in "rc.firewall" like : FW_ROUTE="yes" FW_TCP_SERVICES_EXTERNAL="smtp www domain ftp" FW_UDP_SERVICES_EXTERNAL="domain smtp ftp" After starting of firewall i have full access from internal network to internet but there isn't any access from Internet and no mail.... Could someone tell me what should i do? Any help welcome!!! Thanks in advance Als

1 0

newbie-q: shellcommands out of tcpd
by Webdirekt Sysop 22 Feb '00

22 Feb '00

Hi folks, I keep getting : -snip- (messages) Feb 22 10:45:55 `hostname` `process`: error: /etc/hosts.allow, line 1: bad option name: "command" -snip- It does deny access, but: whatever I put into the field appears as "bad option". man-page up and down did not solve it. Any ideas ? Regards dan ----------------------------------------------------------- ~ WEBDIREKT INTERNET SERVICE GMBH ~ ~ the e-business intelligence company ~ ----------------------------------------------------------- ~ Dieselstr. 5 Fon: (+49) 6173 / 9359-88 ~ ~ D-61476 Kronberg Fax: (+49) 6173 / 9359-59 ~ ~ http://www.webdirekt.de mailto:sysop@webdirekt.de ~ -----------------------------------------------------------

2 1

HELP / hacked??? take a look
by Jonathan 22 Feb '00

22 Feb '00

I was looking at the log and came across several lines like this, could some one please tell me what they mean. kernel: packet log input ACCEPT eth1 PROTO=6 209.214.177.19:1111 <my etho>:80 L=48 S=0x00 I=7174 F=0x4000 T=107 SYN (#24) then I have a few lines at the end like kernel: martian source a4060a18 for 0afa04a6, dev eth0 kernel: ll header: ff ff ff ff ff ff 00 e0 29 46 64 5d 08 06 ANY help/insight to this would be greatly appreciated. TIA I am using IPCHAINS, SuSE6.3, kernel 2.2.13, Apache (for my daughters website)

2 1

Re: [suse-security] Blocking well defined protocols for specific users
by Christoph Wegener 22 Feb '00

22 Feb '00

Someone wrote: >Unless I'm mistaken you can go into /etc and add the persons IP address or >host address into hosts.deny or hosts.allow (that right?) and they cant >connect... Well, this would be fine if there will be only a few machines. I want to consider the more general case: Let there be a network of 32 computers. I CANNOT change the users shell to /bin/flase, 'cause the OS/2 pcnfsd's don't work any more with that "shell". So the shell must be some of /etc/shells. Ok, I DON'T want the ordinary users to use telnet, ssh, etc. and tehrefore I am looking for a way to prevent this. Of course I could add every machine to /etc/hosts.deny but that seems a lot of aministration effort for me. So my thought was, to ask for a method toallow only a few users to for example telnet to that box. Again: Any hints are welcome!!! Thanks in advance Christoph Wegener -- Ruhr-Universitaet Bochum Lehrstuhl für Biophysik c/o Christoph Wegener Gebaeude ND 04/Nord D-44780 Bochum, GERMANY Tel: +49(234)32-25754, Fax: +49(234)32-14626 mailto://cwe@bph.ruhr-uni-bochum.de http://www.bph.ruhr-uni-bochum.de __ _ / / (_)__ __ ____ __ / /__/ / _ \/ // /\ \/ / . . . t h e c h o i c e o f a /____/_/_//_/\_,_/ /_/\_\ G N U g e n e r a t i o n . . .

2 1