February 2000 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] FTP = PortScan???
by Admin 16 Feb '00

16 Feb '00

On Wed, 16 Feb 2000 11:00:11 +0100 (CET), Uwe A. P. Wuerdinger wrote: >Are you using wget with passive ftp? no... bye Mathias -- eregion.de -- administrative account

1 0

FTP = PortScan???
by Admin 16 Feb '00

16 Feb '00

Hi, me, too.... Got portscans every weekend, and guess from where? ftp.suse.com! exactly the same time I do some wget on ftp.suse.com, I get portscanned by their ftp server! here's the log: Feb 13 19:17:30 aragorn scanlogd: From 209.144.167.150:20 to 192.168.238.3 ports 3021, 3022, 3023, 3024, 3025, 3026, 3027, 3028, 3029,..., flags ??r??u, TOS 08, TTL 49, started at 19:17:15 But HOW ON EARTH can the portscan get through a masq-gateway? here my ipchains -L output: celebrimbor:~ # ipchains -L -v Chain input (policy ACCEPT: 52530 packets, 19967183 bytes): pkts bytes target prot opt tosa tosx ifname mark outsize source destination ports 0 0 acctin all ------ 0xFF 0x00 ippp0 anywhere anywhere n/a Chain forward (policy ACCEPT: 0 packets, 0 bytes): pkts bytes target prot opt tosa tosx ifname mark outsize source destination ports 0 0 user_msq all ------ 0xFF 0x00 ippp0 eregion.net/24 anywhere n/a 0 0 user_msq all ------ 0xFF 0x00 ippp0 eregion-mobile.net/24 anywhere n/a 0 0 user_msq all ------ 0xFF 0x00 ippp0 loopback/8 anywhere n/a Chain output (policy ACCEPT: 51061 packets, 19526293 bytes): pkts bytes target prot opt tosa tosx ifname mark outsize source destination ports 0 0 acctout all ------ 0xFF 0x00 ippp0 anywhere anywhere n/a Chain user_msq (3 references): pkts bytes target prot opt tosa tosx ifname mark outsize source destination ports 0 0 MASQ all ------ 0xFF 0x00 any anywhere anywhere n/a Chain acctin (1 references): Chain acctout (1 references): that's the setup done by SuSE (/sbin/init.d/masquerade, unchanged except some accounting added) in the 6.2 Oh I think I've got an idea what this could be: nmap, stealth mode, ftp bounce, and it gets through 'cause at exactly that moment I'm doing some large ftp'ing with ftp.suse.com... but why every weekend? or is it really from ftp.suse.com? maybe the host got hacked? bye Mathias -- eregion.de -- administrative account

1 0

Thanks for the info, a newbie learned more about security today.
by Stephen Thompson 15 Feb '00

15 Feb '00

I think i found what the alert was all about. And the setup does actually work believe it or not. It might look clumsy and awful, and not a patch on the SuSEfirewall script, but it was just my first attempts to understand packet filtering. This rule: ipchains -A input -p udp -s ! $INTERNAL -d ! $INTERNAL -j ACCEPT this lets UDP's for ICQ through. My firewall machine has a dynamic ppp address so that isn't on the INTERNAL network. What the rule was saying is allow UDP from an external machine to any other external machine, really meaning allow the dynamic external ppp address to talk to any other external address and vice versa. I know it looks clumsy and basically just awful but it let me send an ICQ UDP packet from my internal machine to the router, and then allowed the router to send it down the ppp link, and allow the reply to the masqued UDP packet back in. I'm not far enough into it to write a more sophisticated rule, hence the note to the list for help. I will use the SuSEfirewall with the suggested input. your assesment of this rule ipchains -A forward -s $INTERNAL -d $INTERNAL -j ACCEPT is right, i shouldn't need to forward the internal networks, they should talk to each other. I just had a problem in the beginning when i didn't. I can't remeber off the top of my head what it was. this rule was a secondary stop for external to internal. ipchains -A forward -s ! $INTERNAL -d $INTERNAL -j REJECT from reading ipchains documentation, a reply to a masqed packet which is demasqued doesnt go through the forward chain. so the masqed reply is not affected by this rule, but the intent was that if someone got through the no SYN block and tried to contact a machine not masqed it would be stopped here. I believe ICQ uses UDP from 4000 upwards. I do have the module ip_masq_ftp running. When really looking into it now, and with your hint where the packets came from, i think they correspond to an ftp started by myself to a server. That looks to have triggered the portscan alert. I was unaware that was the ip address, as i access it with a dns name. seems they dont do a reverse dns lookup, hence the no host, which is what got me suspicious in the first place, well that and about 12 warning lines about being portscanned! >it won't be possible to adressa package to an adress with 192.168.x.x - it >never would find the way to you. it would be only possible to scan that host >from within your net and for this your router must be hacked and the sender >address would not be from outside your network. Thats what I thought, I investigated the router and found no evidence of it being hacked, or even looked at (although i am aware that if they had hacked it they would have removed traces). It all just didnt add up for this newbie and hence the email to the list. I understand a bit more now that I did yesterday. Thanks for the reply Stephan. I have it fixed now. If I've wasted anybody's bandwidth, you have my appologies. Stephen Thompson

1 0

sshd (IdleTimeout)
by Dominic Santi 15 Feb '00

15 Feb '00

Hello I would like to increase the IdleTimout up to on or two days. My effort: - in the /etc/sshd_config set the IdleTimeout to 1d (24h, 1440m and 86400) - restart sshd The effect: - after 30 min the connection will be killed. The same effect was occured when the IdleTimeout set to 1 hour. What is my mistake? Please help. regards dominic -- _/ _/_/ dominic santi http://www.interconnective.net _/ _/ interconnective ag _/ _/ gundeldingerstrasse 197 phone +41 61 3 630 630 _/ _/_/ ch-4053 basel fax +41 61 3 630 631

2 1

Re: [suse-security] SuSE Security Announcement - make-3.77
by Volker Kuhlmann 15 Feb '00

15 Feb '00

> sorry, but we are currently very busy auditing and fixing things - the > deadline for suse 6.4 is comming nearer and nearer ... Ok ok - :-) But perhaps you should investigate why this make-3.77 security announcement didn't actually make it to the suse-security-announce list at all! > > I downloaded exactly this rpm from the ftp server on 30 Jan while hunting > > for updates. That was 11 days ago! Now, why is it that the security > > announcement takes this long to appear? > > this was a vulnerability thomas <thomas(a)suse.de> from our Security Team > found during an audit. He made a patch and gave it to our packet maintainer, > who inserted the patch, built the package and made them available on the ftp > server. > However, at the same time, we forwarded the patch to the other linux > vendors, so they can prepare an update as well before our announcement is > released, so that they are not left vulnerable or look bad in comparison. > Thats why the announcement is much later than the availability of the update. > our own security found the vulnerability and informed the other vendors and > gave them time to fix and make an update as available as well. > Thats how we think these things should be handled - however we are open for > proposals to enhance it :-) Fair enough :-) Sounds like a good policy to me in cases like this. Btw is e.g. Red Hat giving you the same kind of time in return? 11 days is a long time though - plenty to scan the suse (and others) ftp server each night and have a quick look for exploitable updates and changes. I think to be safe you'd have to withhold the fixed rpm from the ftp server. > > (and on suse-security-announce it will appear appr 10 hours later than > > on suse-securtiy...) > > thats because ... I don't know ;-) I'd guess there are more people > subscribed to suse-security than to suse-security-announce, and hence ... Hm, I've also heard that the announce list was moderated. Neither explanation is really satisfactory - but the last announcement appeared virtually simultaneously so perhaps the list setup was changed for the better. Who cares as long as it works now. > SuSE takes security issues very serious - as you can see by the manpower put > into this area and security tools made available by SuSE. Glad to hear... Thanks for your reply. Volker

4 3

secchk package / stopping john / help!
by Michael Balzer 14 Feb '00

14 Feb '00

dear fellow admins, dear marc, i installed some suse 6.3 "sec" packages, among others marc's /usr/lib/secchk scripts and john (weak passwd checker). last evening, john used cpu ressources i needed myself, so i tried to kill him, assuming he would listen to my wishes ;-). well, he didn't, but instead started to fork himself over and over again, exiting the father as soon as the child became functional. i consider this a normal hacker/cracker programming technic in order to avoid being killable by just one pid. but i don't consider this a normal behaviour for any program meant to be used for normal system management by an authorized admin. maybe i'm wrong (didn't check the sources), but if so, this is still a serious bug. SECOND. i had to shutdown to stop john from eating up all ressources. now after reboot, most applications (i.e. "ls", "su", "xterm", "xtelnet", "xlogin" ...) refuse to work from a normal user account. "xterm" for example establishes the connection with the X server and then crashes with a bus error. "ls" and "su" immediately crash with a bus error. but all of these work perfectly when running as root, so i guess the security checking scripts damaged some file access rights because they have been stopped before their normal termination. can anyone (marc!?) tell me which files may be corrupted in what way to produce such an effect? i already executed the scripts again, but nothing changed. regards, michael balzer -- b&b computersysteme * kämperheide 10 * 58285 gevelsberg * germany fon +49 2333 913924 * fax +49 2333 913925 * http://www.bbcomp.de

6 8

MySQL 3.22.32 released (fwd)
by L. Sassaman 14 Feb '00

14 Feb '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 What's the ETA on getting a SuSE rpm for this? __ L. Sassaman System Administrator | "All of the chaos Technology Consultant | Makes perfect sense..." icq.. 10735603 | pgp.. finger://ns.quickie.net/rabbi | --Joe Diffie - ---------- Forwarded message ---------- Date: Mon, 14 Feb 2000 16:37:45 +0100 From: Jonas Eriksson <je(a)SEKURE.NET> To: BUGTRAQ(a)SECURITYFOCUS.COM Subject: MySQL 3.22.32 released (fwd) - -- Jonas Eriksson je(a)sekure.net - ---------- Forwarded message ---------- Date: Mon, 14 Feb 2000 15:02:46 +0200 (EET) From: Michael Widenius <monty(a)monty.pp.sci.fi> Reply-To: monty(a)tcx.se To: announce(a)lists.mysql.com Subject: MySQL 3.22.32 released Hi! MySQL 3.22.32 fixes a couple of possible security holes in MySQL 3.22 and we strongly recommend everyone to upgrade to them. Changes in release 3.22.32 - -------------------------- * Fixed problem when storing numbers in timestamps. * Fix problem with timezones that has half hour offsets. * `mysqlhotcopy' - fast on-line hot-backup utility for local *MySQL* databases. By Tim Bunce. * New more secure `mysqlaccess'; Thanks to Steve Harvey for this. * Fixed security problem in the protocol regarding password checking. * Fixed problem that affected queries that did arithmetic on GROUP functions. * Fixed a bug in the `ISAM' code when delating rows on tables with packed indexes. 3.23.x will be released within a couple of days (We only have to check that the new CHECK and REPAIR commands works properly before doing a release) Note that if you get a file not found error when trying to download, this just means that the mirror you are using is not yet up to date; In this case wait a couple of hours and try again. Regards, Monty -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.1 (GNU/Linux) Comment: OpenPGP Encrypted Email Preferred. iD8DBQE4qEnhPYrxsgmsCmoRAkmjAKDTDKsIcUp591Xwok8vfTcqMSLBfgCgmpk9 2OZLKlPI0d7EBnWEY+fUFVM= =x5Q9 -----END PGP SIGNATURE-----

1 0

Re: [suse-security] SuSE Security Announcement - make-3.77
by Volker Kuhlmann 14 Feb '00

14 Feb '00

May I ask some inconvenient(?) questions: > SuSE Security Announcement > > Package: make-3.77-44 and earlier > Date: Wed Feb 9 17:28:43 CET 2000 > Update the package from our FTP server. > e5eee118d92e61d4b17b3bef112760af ftp://ftp.suse.com/pub/suse/i386/update/6.3/d1/make-3.78.1-2.i386.rpm I downloaded exactly this rpm from the ftp server on 30 Jan while hunting for updates. That was 11 days ago! Now, why is it that the security announcement takes this long to appear? (and on suse-security-announce it will appear appr 10 hours later than on suse-securtiy...) This has *never* happened to me while I was using Red Hat. Or are they just hiding updated rpms from their ftp server until after the announcement goes out? Not that the compile-date in their rpms dated more than a day back, usually. One could argue that this security problem is not very serious - but does SuSE handle all security issues like this one? Volker

3 2

Re: [SLE] Tar!
by Webdirekt Sysop 14 Feb '00

14 Feb '00

Rusty wrote: > What gives with SuSE? Is ther some secret? Information in > the 6.3 > manual is nonexistant. tar --help | more :-? dan

1 0

Re: [suse-security] SuSE Security Announcement - make-3.77
by marc＠suse.de 12 Feb '00

12 Feb '00

Hi folks, sorry, but we are currently very busy auditing and fixing things - the deadline for suse 6.4 is comming nearer and nearer ... > I downloaded exactly this rpm from the ftp server on 30 Jan while hunting > for updates. That was 11 days ago! Now, why is it that the security > announcement takes this long to appear? this was a vulnerability thomas <thomas(a)suse.de> from our Security Team found during an audit. He made a patch and gave it to our packet maintainer, who inserted the patch, built the package and made them available on the ftp server. However, at the same time, we forwarded the patch to the other linux vendors, so they can prepare an update as well before our announcement is released, so that they are not left vulnerable or look bad in comparison. Thats why the announcement is much later than the availability of the update. > (and on suse-security-announce it will appear appr 10 hours later than > on suse-securtiy...) thats because ... I don't know ;-) I'd guess there are more people subscribed to suse-security than to suse-security-announce, and hence ... >This has *never* happened to me while I was using Red Hat. Or are >they just hiding updated rpms from their ftp server until after the >announcement goes out? Not that the compile-date in their rpms dated >more than a day back, usually. > >One could argue that this security problem is not very serious - but >does SuSE handle all security issues like this one? our own security found the vulnerability and informed the other vendors and gave them time to fix and make an update as available as well. Thats how we think these things should be handled - however we are open for proposals to enhance it :-) SuSE takes security issues very serious - as you can see by the manpower put into this area and security tools made available by SuSE. Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0