July 2000 - openSUSE Security - openSUSE Mailing Lists

sendmail (expn)
by ksemat＠wawa.eahd.or.ug 23 Jul '00

23 Jul '00

Hi everyone, Sorry to have wasted your time. I have just remembered how to disable the expn and vrfy commands. But thanks for your attention. all the best. reagrds, Noah ksemat(a)eahd.or.ug

1 0

ipchains error - no default routing set up ?!
by Tobias Gasser 22 Jul '00

22 Jul '00

Hello, i'm trying to configure my firewall with the suse firewals-script. I can start the firewall with no errors displayed, but when I do a SuSEfirewall check it tells me that ipchains produced errors (3 times): 'ipchains produced errors no default routing set up' Also I can't get any response from the neither the firewall nor the webserver. The firewall-logfile however shows the refused connections. The IP-Forward-option is enabled in the firewall-setup-file. Before starting the script i tested the routing of the setup, and everything worked. Maybe it's the fault of my unusual setup: internet C A | <____.y.z.153/25____.....______x.y.z.132/25______x.y.z.129/25 x.y.z.133/25 D / / x.y.z.134/25 B (A:firewall, C:admin-comp, B:webserver, D:default gateway) I'm sorry to say that there's no way to change the network (subnets, etc.) - not my fault... Any ideas ? Thank you in advance and sorry for the longish posting ! Tobias

2 1

[suse-security]: OpenSSH
by Timo Schulz 22 Jul '00

22 Jul '00

After I update my ssh version to openssh, I can't connect to the ssh daemon. ( Only local connections work. ) The host is a SuSE/Linux 2.2 box. This is the connection output from ssh: SSH Version OpenSSH-1.2.3, protocol version 1.5. Compiled with SSL. debug: Reading configuration data /etc/ssh/ssh_config debug: ssh_connect: getuid 500 geteuid 0 anon 1 debug: Connecting to myhost.net [xxx.xxx.xxx.xxx] port 22. debug: Connection established. ssh_exchange_identification: Connection closed by remote host debug: Calling cleanup 0x8057380(0x0) So, I take a look at the openssh source and find the error string in sshconnect.c. It seems that the host doesn't send the ident string to the daemon. Does anybody the the reason of this and how to fix it? Thanks in advance, Timo -- Two-a-Day at joesixpack.net www.freenet.de/joesixpack keyid BF3DF9B4

2 1

ncsa_auth
by gerhard.possler＠westernacher.de 21 Jul '00

21 Jul '00

Hi all, Where can I find ncsa_auth ??? regards ------------------------------------------------------------------------ Gerhard Possler "Wer neue Wege geht, braucht starke Partner." Westernacher AG Am Hubengut 3 76149 Karlsruhe, Germany phone: +49-721/9772-0 fax: +49-721/9772-188 http://www.westernacher.de

1 0

SFTP without SSH
by rainhuber＠gmx.net 21 Jul '00

21 Jul '00

Hi, some time ago we had a similar problem but we used scp/openssh for file transfer instead of s-ftp. to get rid of the usual problems with special characters we give our scp user only a restricted shell (smrsh - taken from the sendmail package), with strips all illegal characters for us and gives the user only commands that we define. the only command that he is allowed is a shell script that calls a copy of scp (with the '-t' switch to tell scp to receive a file). here i a quick and dirty howto: 1. create a special user for the scp file transfer with least possible rights 2. get the latest sendmail package and compile it. 3. get, compile and configure the latest openssh package (openssh is optional, our solution should work with every ssh version) 4. cp the smrsh binary from the sendmail package somewhere in your path (i.e. /usr/local/bin) 5. edit /etc/passwd to give your new scp user /usr/local/bin/smrsh as login shell 6. create a dummy directory (the new user must be able to go here, so use: r-xr-xr-x, owner/group root) 7. cp the scp binary in this directory (i.e. as scp.bak) and change the file permissions so that our scp user has only execute rights 8. now go to the directory where the allowed commands for the restricted shell are (/usr/adm/sm.bin is the default dir) and create a shell script named 'scp' that looks like this #!/bin/sh /dummy_directory_with_a_copy_of_scp_binary/scp.bak -t ~ please note the "~" at the end of the line. this allows the user to copy files only in his home directory not somewhere in our system. -> voila, the only thing, the new user can do is copy files with scp into his home directory i hope this helps. if you run into problems or find any security risks using this solution please send me some feedback. ciao Rainer Huber ------------------------- > * bolo(a)lupa.de wrote on Tue, Jul 18, 2000 at 17:42 +0200: > > due to our security policy we can not provide our users with telnet/ftp but > > with ssh/sftp to do their stuff on our servers. Now the question arose wether > > it would be possible to only allow sftp-connections _without_ shell access. The manpage is somewhat imprecise in this matter. The term `shell' should read `interactive shell'. It's a shell's task to look for executables in the system if the executable is called without a slash in the first word of the commandline. This is why sshd starts the login shell, gained from the seventh field of the respective line in /etc/passwd, and leaves this problem up to the shell. Other approaches might impose security risks. Btw, while we're at it: This (login-) shell sources ~/.ssh/config (plus the system-wide one) _without_ creating a new context/subshell (!). What you could do is the following: Try to set the user's login shell to the sftp client program's path. Another option: Set the login shell to a script which contains `exec /path/to/sftp-client options'. If you consider trying either method, you should be aware of what this client is capable of. You may end up having some escape or site exec possibilities. Thanks, Roman Drahtmuller. -- - - | Roman Drahtmuller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nurnberg, Germany (Batman Costume warning label) | - - -- Sent through GMX FreeMail - http://www.gmx.net

1 0

Re: [suse-security] NTP Client
by rhoerbe＠netpromote.co.at 21 Jul '00

21 Jul '00

- Setup ntp.conf. Try to find stratum 2 servers as close (ip-wise) as possible. - Refrain from using stratum1 servers. - start the xntp daemon, view /var/log/messages - use "ntpq -c peer" to show the sync status - set the HW-clock from time to time I saw the ntp daemon go nuts on some systems, in this case just run ntpdate timeserver [timeserver ..] from crontab every other hour or so. Less nice, but works too /etc/ntp.conf ## Outside source of synchronized time # European Stratum 1-2 server fartein.ifi.uio.no server err.ee.ethz.ch server ntp.exnet.com server ntp2a.mcc.ac.uk server ntp1.pipex.net # Austrian Stratum 2 server ntp.austria.eu.net server time.cso.net ##local nodes peer other.server.inmydmz ## Miscellaneous stuff driftfile /etc/ntp.drift # path for drift file logfile /var/log/ntp # alternate log file /etc/rc.config: START_XNTPD=yes XNTPD_INITIAL_NTPDATE="lemon.exnet.com" crontab 0 0 1 * * root /sbin/hwclock -w Hope that helps Rainer "Eduardo J. Vega Arguedas" <evega(a)amnet.co.cr> Sent by: suse-security-return-2261-rhoerbe=netpromote.co.at(a)suse.com 21.07.00 00:46 To: suse-security(a)suse.com cc: Subject: [suse-security] NTP Client Hello all.... Does any one know how to set up a NTP client (Network Time Protocol) ? under SuSE 6.4 ? Or if it has any security special issuse ? Thanks --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

3 2

Martian source
by Corvin Russell 21 Jul '00

21 Jul '00

Hi, I know this suject was brought up first in Jan, then in July again. However, there is nothing in the way of documentation (I think I found about three lapidary lines) to really let one know, as another questioner wanted to, whether this is at all a security issue. Put another way, what is the utility of this obscure kernel function? How are we to use the information so gained? Twice now I have had kernel messages like the following: Jul 20 12:20:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:20:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:22:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:22:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:24:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:24:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:26:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:26:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:26:55 raven kernel: hdd: hdd4 Jul 20 12:28:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:28:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:29:44 raven kernel: hdd: hdd4 Jul 20 12:30:25 raven kernel: hdd: hdd4 Jul 20 12:30:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:30:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:32:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:32:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:34:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:34:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:36:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:36:42 raven kernel: ll header: 45 00 00 28 The first time, I put it down to my accidentally having opened two PPPoE connections at the sime time. Since I don't know the intricacies of these things, I left it at that. This time, however, the messages were interspersed with firewall messages (see below, for the brave/generous). Note that again ppp1 is showing as registered in addition to ppp0, though this time I had not started another PPPoE session by mistake. Additionally, when I terminated the PPPoE session (this should stop all of them) and ran a ps waux, I noticed three other PPPoE processes running, though I had not started them. Everything else is normal, at least in the sense that it has never caused trouble before. Now at the same time you see the firewall logging a bunch of dsl/cable modem user connection attempts (on ports I could not identify). My first intuition is that these are entirely unrelated to the martian messages, but without a true understanding of these things or informative documentation I can't really tell. This is probaly a trivial issue, so sorry for time-wasting. However as it has come up more than once, perhaps someone knowledgeable could provide a little information, for the record, as to how we might evaluate such messages. If there are no such criteria, then I guess I will just disable this logging "feature". Thanks, Corvin Jul 20 12:18:21 raven kernel: IPv6 v0.8 for NET4.0 Jul 20 12:18:21 raven kernel: IPv6 over IPv4 tunneling driver Jul 20 12:18:42 raven kernel: eth0: no IPv6 routers present Jul 20 12:18:42 raven kernel: eth0: no IPv6 routers present Jul 20 12:19:47 raven kernel: pppoe uses obsolete (PF_INET,SOCK_PACKET) Jul 20 12:19:47 raven kernel: registered device ppp0 Jul 20 12:19:53 raven kernel: PPP BSD Compression module registered Jul 20 12:19:53 raven kernel: PPP Deflate Compression module registered Jul 20 12:20:08 raven kernel: eth0: no IPv6 routers present Jul 20 12:20:08 raven kernel: eth0: no IPv6 routers present Jul 20 12:20:13 raven kernel: registered device ppp1 Jul 20 12:20:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:20:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:22:21 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.217.199.49:3407 216.209.63.6$ Jul 20 12:22:23 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.217.199.49:3407 216.209.63.6$ Jul 20 12:22:25 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.217.199.49:3407 216.209.63.6$ Jul 20 12:22:27 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.217.199.49:3407 216.209.63.6$ Jul 20 12:22:29 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.217.199.49:3407 216.209.63.6$ Jul 20 12:22:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:22:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:23:54 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.13.212.96:1045 216.209.63.62$ Jul 20 12:23:56 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.13.212.96:1045 216.209.63.62$ Jul 20 12:24:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:24:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:24:49 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.218.40.71:4042 216.209.63.62$ Jul 20 12:24:52 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.218.40.71:4042 216.209.63.62$ Jul 20 12:24:52 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.218.40.71:4042 216.209.63.62$ Jul 20 12:24:54 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.218.40.71:4042 216.209.63.62$ Jul 20 12:24:56 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.218.40.71:4042 216.209.63.62$ Jul 20 12:24:56 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.14.254.254:2329 216.209.63.6$ Jul 20 12:24:58 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.14.254.254:2329 216.209.63.6$ Jul 20 12:24:59 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.14.254.254:2329 216.209.63.6$ Jul 20 12:25:00 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.14.254.254:2329 216.209.63.6$ Jul 20 12:25:02 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.14.254.254:2329 216.209.63.6$ Jul 20 12:25:18 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.188.39.98:3898 216.209.63.62$ Jul 20 12:25:20 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.188.39.98:3898 216.209.63.62$ Jul 20 12:25:22 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.188.39.98:3898 216.209.63.62$ Jul 20 12:25:24 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.188.39.98:3898 216.209.63.62$ Jul 20 12:25:25 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.217.199.49:4638 216.209.63.6$ Jul 20 12:25:25 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.188.39.98:3898 216.209.63.62$ Jul 20 12:25:28 raven kernel: Packet log: input DENY ppp0 PROTO=17 63.201.90.0:4682 216.209.63.62:$ Jul 20 12:25:28 raven kernel: Packet log: input DENY ppp0 PROTO=17 63.201.90.0:4682 216.209.63.62:$ Jul 20 12:25:28 raven kernel: Packet log: input DENY ppp0 PROTO=17 63.201.90.0:4682 216.209.63.62:$ Jul 20 12:26:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:26:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:26:55 raven kernel: hdd: 98304kB, 196608 blocks, 512 sector size Jul 20 12:26:55 raven kernel: VFS: Disk change detected on device ide1(22,68) Jul 20 12:26:55 raven kernel: hdd: hdd4 Jul 20 12:28:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:28:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:29:42 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.1.233.183:2874 216.209.63.62$ Jul 20 12:29:44 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.1.233.183:2874 216.209.63.62$ Jul 20 12:29:44 raven kernel: VFS: Disk change detected on device ide1(22,68) Jul 20 12:29:44 raven kernel: hdd: hdd4 Jul 20 12:29:46 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.1.233.183:2874 216.209.63.62$ Jul 20 12:29:48 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.1.233.183:2874 216.209.63.62$ Jul 20 12:29:50 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.1.233.183:2874 216.209.63.62$ Jul 20 12:29:58 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.12.158.209:3857 216.209.63.6$ Jul 20 12:30:00 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.12.158.209:3857 216.209.63.6$ Jul 20 12:30:02 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.12.158.209:3857 216.209.63.6$ Jul 20 12:30:04 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.12.158.209:3857 216.209.63.6$ Jul 20 12:30:06 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.12.158.209:3857 216.209.63.6$ Jul 20 12:30:25 raven kernel: VFS: Disk change detected on device ide1(22,68) Jul 20 12:30:25 raven kernel: hdd: hdd4 Jul 20 12:30:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:30:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:32:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:32:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:33:19 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.19.92.38:1214 216.209.63.62:$ Jul 20 12:33:21 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.19.92.38:1214 216.209.63.62:$ Jul 20 12:33:23 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.19.92.38:1214 216.209.63.62:$ Jul 20 12:33:25 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.19.92.38:1214 216.209.63.62:$ Jul 20 12:33:27 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.19.92.38:1214 216.209.63.62:$ Jul 20 12:33:53 raven kernel: Packet log: input DENY ppp0 PROTO=17 164.113.56.203:2642 216.209.63.$ Jul 20 12:34:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:34:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:36:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:36:42 raven kernel: ll header: 45 00 00 28 -- Corvin Russell <corvinr(a)sympatico.ca>

3 4

Firewall-troubles & SUSE 6.4
by Franky GOETHALS 20 Jul '00

20 Jul '00

Hello all, Since i while i've remarked the following lines in my firewall-log : Jul 18 21:40:11 penguin dhcpcd[109]: sending DHCP_REQUEST for 213.224.69.28 to 195.130.132.18 Jul 18 21:40:11 penguin kernel: Packet log: input DENY eth0 PROTO=17 195.130.132.18:67 213.224.69.28:68 L=330 S=0x00 I=60193 F=0x4000 T=252 (#127) Jul 18 21:40:11 penguin dhcpcd[109]: DHCP_ACK received from (195.130.132.18) Does anyone can help me ? I appears to be in the 'critical' messages for the firewall. I would like to allow these requests through my firewall, but i didn't succeed. I'm trying to configure it with YAST & FW_- variables in the configuration-file. Thanks in advance, Franky. -- =================================== GOETHALS Franky Driegaaienstraat 104 B-9100 SINT-NIKLAAS B E L G I E Tel./Fax : 32 - (0)3 / 776.10.09 GSM : 32 - (0)478 / 21.40.94 franky.goethals(a)pandora.be ===================================

2 1

Re: [SLE] Firewall-troubles & SUSE 6.4
by Eduardo Carriles 20 Jul '00

20 Jul '00

Hi again Franky, First meat!! ---- SEE: [Linux Magazine | DEPARTMENTS | BEST DEFENSE] (Paul Russell's) (My preferred one!!) http://www.linux-mag.com/depts/bestdefense.html ALSO see, the embedded on above article, from [Linux Magazine] (also): (A very detailed REF) [ipchains: Packet Filtering for Linux 2.2] (Paul Russell's also) http://www.linux-mag.com/1999-05/bestdefense_01.html ---- Then explanations!! ---- I will cross post to [suse-security] (suse-security(a)suse.com) also, because i think there is much better the focal point for your query!! =:`) ANYWAY, also because it's a much interesting question (this of FireWalling), to me and the general audience. Look there also for possible answers, it's very complete. I'm not much literate on Kernel ipchains, BUT one thing i know for sure is that on the (it will be, hope soon!!) Kernel 2.4, this will change substantially. This is a major reason because i'm waiting it anxiously!! =8`) It will appear the new functionality of "Netfilter" which is designed and maintained by Paul Russell, if i'm not in mistake. This radically changes Firewall management on Linux, and makes it much easier. WORTH A LOOK!! I do not answer you directly to your proposed query and SuSE 6.4 issue, but i think it's worth drinking from sources, thought!! =:`) ---- HTH Best regards, Eduardo Carriles [-- Better a smile than a flame --] (Long time SuSE-Linux [prefered distro] user). [-- Se me nota mucho? --] [-- Have a lot of fun...] ---- Franky GOETHALS wrote: > Hello all, > > Since i while i've remarked the following lines in my firewall-log : > > Jul 18 21:40:11 penguin dhcpcd[109]: sending DHCP_REQUEST for 213.224.69.28 to > 195.130.132.18 > Jul 18 21:40:11 penguin kernel: Packet log: input DENY eth0 PROTO=17 > 195.130.132.18:67 213.224.69.28:68 L=330 S=0x00 I=60193 F=0x4000 T=252 (#127) > Jul 18 21:40:11 penguin dhcpcd[109]: DHCP_ACK received from (195.130.132.18) > > Does anyone can help me ? I appears to be in the > 'critical' messages for the firewall. > > I would like to allow these requests through my firewall, but i didn't > succeed. I'm trying to configure it with YAST & FW_- variables in the > configuration-file. > > Thanks in advance, > > Franky. > > -- > =================================== > GOETHALS Franky > Driegaaienstraat 104 > B-9100 SINT-NIKLAAS > B E L G I E > > Tel./Fax : 32 - (0)3 / 776.10.09 > GSM : 32 - (0)478 / 21.40.94 > franky.goethals(a)pandora.be > ===================================

1 0

ssh for SuSE 6.4
by Tristan Burton 20 Jul '00

20 Jul '00

Can someone tell me where to find ssh either on my disks or on the SuSE website. One place on the website says that it is part of series sec but it's not one of the listed packages for sec. Thanks -- Tristan Burton Mechanical Engineering Department Stanford University tburton(a)snarf.stanford.edu

6 5