April 2000 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Turning of services
by tschweikle＠FIDUCIA.de 06 Apr '00

06 Apr '00

fd-l-s-s(a)daidalos.informatik.unibw-muenchen.de: > On Thu, Apr 06, 2000 at 10:52:26AM +0200, Francisco M. Marzoa Alonso wrote: >> how to deactivate them if i need, but i cant find how to put out 113 >> (auth), 443 (https) and 514 (shell ?). >> > 443: Look at /etc/http/httpd.conf > There is a section for https, you have do disable and reload apache > config (possible via sh /sbin/init.d/apache reload ) > > 514 maybe syslog. syslog is udp. He didn't scan for open udp ports. AFAIK you have to give an option to portscan to do so ... -- Thomas

2 1

Turning of services
by Francisco M. Marzoa Alonso 06 Apr '00

06 Apr '00

I've just installed a SuSE63 in a new machine and i'm trying to leave it just with the essentials services, doing a portscan this is the result: fmmarzoa@vivaldi:~ > portscan 192.168.66.251 192.168.66.251 22 23 80 113 139 443 514 # Well, i want port 22 (ssh), 23 (telnet), 80 (http) and 139 (netbios - sorry, it should serve files to windows clients :/) active, and i know how to deactivate them if i need, but i cant find how to put out 113 (auth), 443 (https) and 514 (shell ?). I've travelled through /etc/inetd.conf and /etc/rc.services trying to find an answer for my question but... may m I turning blind? -- Francisco M. Marzoa Alonso Nuevo Mundo - Dpto. Informático ICQ#: 62850923 Henri Dunant, 19 - 28036 Madrid tfno: +34 91 343 18 40 ext. 207 España / Spain fax: +34 91 350 28 45

3 4

Re: [suse-security] Turning of services
by tschweikle＠FIDUCIA.de 06 Apr '00

06 Apr '00

fmmarzoa(a)vivaldi.nuevomundo.es: > I've just installed a SuSE63 in a new machine and i'm trying to leave it > just with the essentials services, doing a portscan this is the result: > > fmmarzoa@vivaldi:~ > portscan 192.168.66.251 > 192.168.66.251 > 22 > 23 > 80 > 113 > 139 > 443 > 514 > # > > Well, i want port 22 (ssh), 23 (telnet), 80 (http) and 139 (netbios - uses ports 137, 138, 139 of wich you will only see 139 if no user is connected and the other two only with some luck. But all three are neccessary. > sorry, it should serve files to windows clients :/) active, and i know > how to deactivate them if i need, but i cant find how to put out 113 > (auth), 443 (https) and 514 (shell ?). 80,443: apache with ssl. Turn of ssl for apache. This will close port 443. 113: You have identd running? rcidentd stop, then deactivate it in rc.config 514: This is in inetd.conf. Search for 'shell'. Comment it out, then rcinetd reload. > I've travelled through /etc/inetd.conf and /etc/rc.services trying to find an > answer for my question but... may m I turning blind? inetd.conf, xinetd.conf, rc.config, *and* ps axuf you should look at... -- Thomas

1 0

AW: [suse-security] Turning of services
by Bauer, Juergen 06 Apr '00

06 Apr '00

hello folks, >Von: Francisco M. Marzoa Alonso [mailto:fmmarzoa@idecnet.com] >Gesendet am: Donnerstag, 6. April 2000 10:52 >An: SuSE Security >Betreff: [suse-security] Turning of services > >I've just installed a SuSE63 in a new machine and i'm trying >to leave it >just with the essentials services, doing a portscan this is the result: > >fmmarzoa@vivaldi:~ > portscan 192.168.66.251 >192.168.66.251 >22 >23 >80 >113 >139 >443 >514 ># > >Well, i want port 22 (ssh), 23 (telnet), 80 (http) and 139 (netbios - >sorry, it should serve files to windows clients :/) active, and i know >how to deactivate them if i need, but i cant find how to put out 113 >(auth), 443 (https) and 514 (shell ?). port 113: /sbin/init.d/identd stop , or in rc.config start_ident=no, i think it is a good idea to disable this service ;-) port 514 is "shell" in /etc/inetd.conf instead of portscan do just netstat -ln or netstat -l > > >I've travelled through /etc/inetd.conf and /etc/rc.services trying to find an answer for my question but... may m I turning blind? > >-- >Francisco M. Marzoa Alonso >Nuevo Mundo - Dpto. Informático ICQ#: 62850923 >Henri Dunant, 19 - 28036 Madrid tfno: +34 91 343 18 40 ext. 207 >España / Spain fax: +34 91 350 28 45

2 1

Re: [suse-security] Turning of services
by Francisco M. Marzoa Alonso 06 Apr '00

06 Apr '00

Thank u Alan :) I've a firewall in that machine with ipchains too, but we're a bit paranoid here X) Let me see apache config files... hummmmmm... ## ## SSL Support ## ## When we also provide SSL we have to listen to the ## standard HTTP port (see above) and to the HTTPS port ## <IfDefine SSL> Listen 80 Listen 443 </IfDefine> This seems really to have anything to see with that... Well now, i can suppouse if i comment that line (Listen 443) the SSL server that's listen at this port will be out, but... it should be a better manner but i cant found were SSL is really *Defined*, should i recompile apache perhaps? Any hint to do the things as right as possible will be very wellcomed. Thanks again, Alan, and the rest of the list :) "Wood, Alan" wrote: > Hi Francisco, > > Well, the place to look for https is in your web browser (Apache I guess). > Look for key words like secure, SSL and as you could guess - https :-) It > will definitely be this that is opening this port. Sorry, but I do not know > much about Apache configuration. > > If you really can't find the way to turn off the rest, then you could try > to > use ipchains to block access to them. Not ideal, but I would expect it > to do the trick. > > Alan > > > I've just installed a SuSE63 in a new machine and i'm trying to leave it > > just with the essentials services, doing a portscan this is the result: > > > > fmmarzoa@vivaldi:~ > portscan 192.168.66.251 > > 192.168.66.251 > > 22 > > 23 > > 80 > > 113 > > 139 > > 443 > > 514 > > # > > > > Well, i want port 22 (ssh), 23 (telnet), 80 (http) and 139 (netbios - > > sorry, it should serve files to windows clients :/) active, and i know > > how to deactivate them if i need, but i cant find how to put out 113 > > (auth), 443 (https) and 514 (shell ?). > > > > > > I've travelled through /etc/inetd.conf and /etc/rc.services trying to find > > an answer for my question but... may m I turning blind? > > > > -- > > Francisco M. Marzoa Alonso > > Nuevo Mundo - Dpto. Informatico ICQ#: 62850923 > > Henri Dunant, 19 - 28036 Madrid tfno: +34 91 343 18 40 ext. 207 > > Espana / Spain fax: +34 91 350 28 45 > > > > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > -- Francisco M. Marzoa Alonso Nuevo Mundo - Dpto. Informático ICQ#: 62850923 Henri Dunant, 19 - 28036 Madrid tfno: +34 91 343 18 40 ext. 207 España / Spain fax: +34 91 350 28 45

1 0

SuSE Security Announcement - kreatecd
by marc＠suse.de 05 Apr '00

05 Apr '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: kreatecd < 0.3.8b Date: Wed, 5 Apr 2000 20:00:12 GMT Affected SuSE versions: 6.4 Vulnerability Type: local root compromise SuSE default package: no Other affected systems: all unix systems using kreatecd ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description kreatecd is a KDE tool used to burn cd-roms. An exploitable buffer overflow was found in this tool. 2. Impact Local users may gain root privilige. 3. Solution Update the package from our FTP server, or remove the suid bit from this tool. ("chmod u-s /opt/kde/bin/kreatecd") ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: 742ed57b8bfb022d4e3755e417612272 ftp://ftp.suse.com/pub/suse/axp/update/6.4/kpa1/kreatecd-0.3.8b-0.alpha.rpm 09cbe9a08cf2b0d5d5d0b1963c3edbcd ftp://ftp.suse.com/pub/suse/i386/update/6.4/kpa1/kreatecd-0.3.8b-0.i386.rpm e59c71fa6ae5cf59af9aa1bdce89b015 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/kpa1/kreatecd-0.3.8b-0.ppc.rpm ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update for Intel processors ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/patches/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are sent to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOOucPney5gA9JdPZAQH4Tgf/fH0SmQlfvdhowia3LXKFeoTOA5EMn027 ldofK35EZLui4KpBwyxBvdGZXG1fBpCaO3SackdNxD1PzfTJk7ykjch9vmaD2Zq8 lbGoHqF1y823GzSvPu5VXaY2M3W8HbxWFGnc/Yh/v7ST6x0FVJAoFMImVkdWS7gZ TaEtyBeZBSTvcV/fzA7m3tFqoaCbCMWJTKBj9ENM4u8wM8GrCT+JQa6r/BzBb3VF QzAs6/dA/3PPc5k3qd7Zaf/9z6K6OMJaMoIr21w67D9M2XYb2luUlyjyrd1H3MGU iodDDcVYRUsGNBlDjTI42XdFXpgNWH6QtIbmjBsT6x/MdkeOTDlpMg== =2H9o -----END PGP SIGNATURE-----

1 0

SuSE Security Announcement - gpm
by marc＠suse.de 05 Apr '00

05 Apr '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: gpm < 1.18.1 Date: Wed, 5 Apr 2000 19:46:46 GMT Affected SuSE versions: all Vulnerability Type: execute commands with privilege SuSE default package: yes Other affected systems: all linux systems using gpm ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description gpm is a cut and paste utility and mouse server for virtual consoles. The gpm-root command, which is part of the gpm package, allows local users to define menus and commands to be executed on mouse events. When a command is executed via gpm, the group id 0 priviliged is not dropped. 2. Impact Local users may gain access to group id 0 and hence may modify files owned and writable by the gid 0. 3. Solution Update the package from our FTP server. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: (For SuSE 6.0, please use the 6.1 updates) d71e12148aa501395bdf2a1192fa93de ftp://ftp.suse.com/pub/suse/axp/update/6.1/ap1/gpm-1.18.1-44.alpha.rpm 1c20f45f754f9391c2b6c5b449f5ce42 ftp://ftp.suse.com/pub/suse/axp/update/6.3/ap1/gpm-1.18.1-44.alpha.rpm 814b6fd854780f205de12889589ce8a2 ftp://ftp.suse.com/pub/suse/i386/update/5.3/ap1/gpm-1.18.1-44.i386.rpm c492bd85ec34d8e177d0e22b67b1c5bc ftp://ftp.suse.com/pub/suse/i386/update/6.1/ap1/gpm-1.18.1-44.i386.rpm a13f34f522acf560f7a4e5754ca0d85b ftp://ftp.suse.com/pub/suse/i386/update/6.2/ap1/gpm-1.18.1-44.i386.rpm ec64fd1187373f48c02922eb71ae2f7a ftp://ftp.suse.com/pub/suse/i386/update/6.3/ap1/gpm-1.18.1-45.i386.rpm 0564749dce51690719a3eb1be8514f03 ftp://ftp.suse.com/pub/suse/i386/update/6.4/ap1/gpm-1.18.1-44.i386.rpm 8feb9a4a65af7e966f3fef4588b8bc5b ftp://ftp.suse.com/pub/suse/ppc/update/6.3/ap1/gpm-1.18.1-44.ppc.rpm 8a273a5c227ef077ae6ac34dc8284afb ftp://ftp.suse.com/pub/suse/ppc/update/6.4/ap1/gpm-1.18.1-48.ppc.rpm ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/i386/update for Intel processors ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html Our webpage for patches: http://www.suse.de/patches/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are sent to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOOuazHey5gA9JdPZAQEegAgAgn0kGktclzk+ODD4RH1M1bIz+vAfhCMI GpgsM4EkevX6y+TWcQxoNxgMBoJDkRJfmmig3Yh7U/ytFE+DNKjUPkB9pJeBKjJX 2JLoJrg/Q7rSz/MwAzcdrtYLbrrT915LefszVnPZkMEs8Sis0kf2tLQrmQElsP7p qe0tliP/WKJ3SvDS+oJZdjX0Uvcw20Sxh62LxnHXKLRctYuLopxuel7YR6YVvGlB 1O8cP2qtYGZ5F58yICURdQ9IOkDepFMhsJFo9hc2900p5HI3xQUdU7eH7gZXRiTY S8qHwbqmnUkSZXMPKArb0s5/qObbyhyZTXMPFLTwMio3JWK0ZMn6fQ== =u6Mc -----END PGP SIGNATURE-----

1 0

RE: [suse-security] Cracking passwd file on suse systems
by Wood, Alan 05 Apr '00

05 Apr '00

Unfortunately so, a good reason to make every reasonable attempt to stop the wrong people getting at the file in the first place........ Alan > ---------- > From: Carsten Schmitz[SMTP:c.schmitz@kps.de] > Sent: 05 April 2000 12:47 > To: suse-security(a)suse.com > Subject: Re: [suse-security] Cracking passwd file on suse systems > > Hello... > > >> > >> I want to check the passwd-file for insecure passwords. > >> Is there a way to do this easily? > > > I think that SuSE carries in its distributions some tools for this, you > > can > > try "john the ripper" for example that i think comes directly with SuSE; > > You > > can search on www.linuxapps.com or another utility search engine anyway. > > >> User just have pop-access to their accounts, no telnet, so forcing the > >> user > >> to change the password from time to time is not possible. > > > Thank you for your quick answer. Yes.. John the Ripper was the right > tool... > I was horrified how easily it finds out the passwords... > > Greetings, > > Carsten > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

Web server security holes ?
by Marc Baaden 05 Apr '00

05 Apr '00

Dear All, I am quite concerned about security, and I think my machine is doing well with respect to all usual services as telnet, FTP, etc... Unfortunately I am not very experienced with web servers, and have the standard features of SuSE 6.3 installed (Apache, I think). On two of my machines I got the following log entries in http.acces_log/ error_log - What does it mean ? - Is it dangerous for the machine ? - Can I further secure my machine ? PS: I do NOT need the machine beeing accessible by external machines in HTTP Thank you for explaining these things to me ... 131.155.14.130 - - [19/Mar/2000:07:09:12 +0100] "POST /cgi-bin/perl HTTP/1.0" 404 281 131.155.14.130 - - [19/Mar/2000:07:09:12 +0100] "POST /cgi-bin/phf?Qname=x%0a/bin/sh+-s%0a HTTP/1.0" 404 280 128.175.13.74 - - [19/Mar/2000:17:43:12 +0100] "GET /cgi-bin/counterfiglet/nc/f=;echo;echo%20{_begin-counterfiglet_};uname%20-a;id;w;echo%20{_end-counterfiglet_};echo HTTP/1.0" 404 376 128.175.13.74 - - [20/Mar/2000:03:46:42 +0100] "POST /cgi-bin/test-cgi HTTP/1.0" 200 482 128.175.13.74 - - [20/Mar/2000:06:07:22 +0100] "POST /cgi-bin/phf?Qname=x%0a/bin/sh+-s%0a HTTP/1.0" 404 280 128.175.13.74 - - [20/Mar/2000:07:02:50 +0100] "GET /cgi-bin/aglimpse/80|IFS=_;CMD=_echo\;echo_id-aglimpse\;uname_-a\;id;eval$CMD; HTTP/1.0" 404 346 128.175.13.74 - - [21/Mar/2000:00:50:01 +0100] "POST /cgi-bin/perl HTTP/1.0" 404 281 128.175.13.74 - - [21/Mar/2000:06:33:15 +0100] "POST /cgi-bin/sh HTTP/1.0" 404 279 128.175.13.74 - - [21/Mar/2000:07:17:24 +0100] "GET /cgi-bin/query?x=%3C%21%2D%2D%23%65%78%65%63%20%63%6D%64%3D%22%2F%75%73%72%2F%62%69%6E%2F%69%64%22%2D%2D%3E HTTP/1.0" 404 282 128.175.13.74 - - [21/Mar/2000:08:32:59 +0100] "GET /%3C%21%2D%2D%23%65%78%65%63%20%63%6D%64%3D%22%2F%75%73%72%2F%62%69%6E%2F%69%64%22%2D%2D%3E/index.html HTTP/1.0" 404 316 [Sun Mar 19 17:43:12 2000] [error] [client 128.175.13.74] script not found or unable to stat: /usr/local/httpd/cgi-bin/counterfiglet [Mon Mar 20 06:07:22 2000] [error] [client 128.175.13.74] script not found or unable to stat: /usr/local/httpd/cgi-bin/phf [Mon Mar 20 07:02:50 2000] [error] [client 128.175.13.74] script not found or unable to stat: /usr/local/httpd/cgi-bin/aglimpse [Tue Mar 21 00:50:01 2000] [error] [client 128.175.13.74] script not found or unable to stat: /usr/local/httpd/cgi-bin/perl [Tue Mar 21 06:33:15 2000] [error] [client 128.175.13.74] script not found or unable to stat: /usr/local/httpd/cgi-bin/sh [Tue Mar 21 07:17:24 2000] [error] [client 128.175.13.74] script not found or unable to stat: /usr/local/httpd/cgi-bin/query [Thu Mar 30 22:34:16 2000] [notice] Apache/1.3.9 (Unix) (SuSE/Linux) mod_perl/1.21 PHP/3.0.12 configured -- resuming normal operations [Thu Mar 30 22:34:16 2000] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) [ Marc Baaden -- Marc Baaden - Labo MSM (UMR 7551) - http://crypt.u-strasbg.fr/marc mailto:baaden@chimie.u-strasbg.fr - FAX (+49) 89 24 43 1 68 68 ICQ# 11466242 - Tel: (+33) 3 88 41 60 86 or (+33) 6 09 84 32 17

8 9

Re: [suse-security] Cracking passwd file on suse systems
by Carsten Schmitz 05 Apr '00

05 Apr '00

Hello... >> >> I want to check the passwd-file for insecure passwords. >> Is there a way to do this easily? > I think that SuSE carries in its distributions some tools for this, you > can > try "john the ripper" for example that i think comes directly with SuSE; > You > can search on www.linuxapps.com or another utility search engine anyway. >> User just have pop-access to their accounts, no telnet, so forcing the >> user >> to change the password from time to time is not possible. Thank you for your quick answer. Yes.. John the Ripper was the right tool... I was horrified how easily it finds out the passwords... Greetings, Carsten

1 0