August 2000 - openSUSE Security - openSUSE Mailing Lists

autorpm and latest secure files
by Rhys Davies 09 Aug '00

09 Aug '00

I used autorpm to update all flies it could come up with for my 6.2 installation. It all worked fine - very nice indeed, though it has got some way to go in terms of usability for people who do not want to invest a lot of time in these things. If it could be made to function like "Windows Update" it would become a sure fire winner. Maybe I missed the readme file. It maybe needs a dumbo's mode of operation / advanced mode. splitting updates into "critical / nice to have" such that one does not have to research too much. It copied a few files to ".newrpm", (or something like that) which I had to undo to preserve my config settings. ... I do not think much of it doing that. Does it produce a report of files changed at the end or did I miss that ? but after a reboot I got the char-major-4 error which I fixed in conf.modules, by setting it's Alias from "serial" to "off" BUT my biggest problem is that I am still getting: modprobe: Can't locate module eth0 modprobe: Can't locate module eth1 and also there is no sign of ppp0 in the output of ifconfig KDM no longer works. I've read the mail sent to root about changes required to make it work, but with no luck There appear to be no other module load problems during a restart. My question's: 1) What has been changed for my network cards not to be found ? 2) What do I need to do to fix this ? 3) Is there anything else I need to do to get KDM going again ? loosing the network is a very big headache at the moment. Rhys.

2 1

Re: [suse-security] SuSE security reputation, etc..
by dproc＠dol.net 09 Aug '00

09 Aug '00

On Sat, 05 Aug 2000, JF wrote: > > But they can only login as you the USER. They can never sniff the > > root password, as your "su root" password is always encrypted. > > This is how I understand it. > Even though the root passwd is encrypted on the box it is still sent > accross the wire in plain text, therefore sniffable. > Maybe you cam to the thread ot of sequence? What I meant was, during an SSH session, the su root password is encrypted across the wire. Pretty much the only places it is plaintext are the keyboard driver and login/pam. But my point was that if your user password is sniffed from a POP session, then leet can sprinkle your path with trojans, which might sniff your su password and steal it. Thats all. dproc

6 8

new version of SCSLog
by Thomas Biege 09 Aug '00

09 Aug '00

Hi ppl, I released a new version (2.1) of SCSLog, my systemcall logging module. I just cut some parts from the README file to show you what's new. --- README --- SCSLog provides you with the ability to log security relevant system calls like: - socketcall() + connect() + accept() + shutdown() - chmod() + make a file setuid + make a file setgid + make a file world-writeable - open() + create world-writeable files + create file without O_EXCL - symlink() - setuid() - setgid() - setreuid() - setregid() This informations should help you to track down security violations. Some nice features of this tool =============================== If you want to make SCSLog unremoveable/invisible, then load SCSUnrmv/SCSHide with parameter module=<modulesname>. # insmod scsunrmv.o modules="scslog" # rmmod scsunrmv # insmod scshide.o modules="scslog" # rmmod scshide If you want to make it persistent _and_ invisible you should 1) insmod scsunrmv.o and 2) insmod scshide.o _not_ vice versa! USAGE ===== scslog.o: logsocket={0,1} -> log socketcall() logchown={0,1} -> log chown() logopenww={0,1} -> log open() - world-writeable files logopenexcl={0,1} -> log open() - open file w/o O_EXCL flag (could lead to sym link attacks) logsymlink={0,1} -> log symlink() logsetuid={0,1} -> log setuid() logsetgid={0,1} -> log setgid() logsetreuid={0,1} -> log setreuid() logsetregid={0,1} -> log setregid() scshide.o: module="<string>" -> module to hide messages={0,1} -> log just error and syscall messages scsunrmv.o: module="<string>" -> module to make persistent messages={0,1} -> log just error and syscall messages --- README --- You'll find SCSLog 2.1 at http://www.suse.de/~thomas I would be happy if you test it and send me your bugreports and improvements. TIA. Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

RE: [suse-security] SuSE firewall and VPN
by Ulrich Breckel 09 Aug '00

09 Aug '00

Hi Rudi, > I try to set up my firewall to forward a PPTP-Client to my internal > PPTP-Server. I use SuSEfirewall-3.0 with the following settings in > firewall.rc.config: > > FW_Route=yes > FW_Masquerade=yes > FW_Masq_Nets="internal_net" > FW_Forward_IP="external_net,pptp-host,47" > FW_Forward_Masq_TCP="external_net,pptp-host,1723" > > and > ipfwd for masq ip-protocol 47 > > In syslog I get an accept message on the external interface, > but there is > nothing else happening (pptp client says "no answer"). > > Any help is appreciated. perhaps the following link will help http://www.wolfenet.com/~jhardin/ip_masq_vpn.html bye Uli

1 0

SuSE firewall and VPN
by CompuTel Technik 09 Aug '00

09 Aug '00

Hi everyone, I try to set up my firewall to forward a PPTP-Client to my internal PPTP-Server. I use SuSEfirewall-3.0 with the following settings in firewall.rc.config: FW_Route=yes FW_Masquerade=yes FW_Masq_Nets="internal_net" FW_Forward_IP="external_net,pptp-host,47" FW_Forward_Masq_TCP="external_net,pptp-host,1723" and ipfwd for masq ip-protocol 47 In syslog I get an accept message on the external interface, but there is nothing else happening (pptp client says "no answer"). Any help is appreciated. Rudi

1 0

rpc.statd exploit
by Volker Kuhlmann 09 Aug '00

09 Aug '00

Is SuSE (6.3) vulnerable to the recently published rpc.statd exploit? If so, how can I secure my system short-term? I kind of need NFS... Volker

3 2

SuSE 6.4 and mod_ssl
by Frank O'Yanco 09 Aug '00

09 Aug '00

Hi! Where can I find it? I not found it in ftp.suse.com neither SuSE 6.4 CDs. -- Frank O'Yanco Age of The Penguin -=- SuSE Linux 6.2 -=- http://andromeda.pmmf.hu

2 1

Re: [SLE] FYI- Netscape 4.4 -4.7 [Serious Java Security BUG]
by Eduardo Carriles 09 Aug '00

09 Aug '00

Hi (un- named) "sds07", Thanks a lot for the tip!! =`:) Hi friends All: ____________________________________________ [++ JAVA related exploit ahead ++] If you got a Netscape browser running you better disable/close Java till further notice... [Or trust sites that you frequent] (All platforms, thought??) (does no affect _winie_??) (does not affect _moz5/nscp6-pre2_??) [WARN] Just: Edit/Preferences/Advanced and disable: "Enable Java" Act ASAP. You are Warned!! ---- On Tue, 8 Aug 2000 10:06:07 -0400 sds07(a)health.state.ny.us wrote: > No flames, please. Just an FYI! > Netscape bug... > http://dailynews.yahoo.com/h/ap/20000807/tc/netscape_bug_2.html ---- No need to, just more (a lot more indeed): ____________________________________________ [INFO/TRACE of search documentation procedure performed] ** From using bottom Search box = "netscape" on "Slashdot: News for nerds, stuff that matters" URL: http://www.slashdot.org/ ** gives: "Slashdot: Search netscape" URL: http://slashdot.org/search.pl?query=netscape ** And then clicking on link: "Java Security Hole Makes Netscape Into Web Server by Hemos on Saturday August 05, @10:22PM EDT" URL: http://slashdot.org/article.pl?sid=00/08/06/0222241&mode=thread ** gives: "Slashdot | Java Security Hole Makes Netscape Into Web Server" URL: http://slashdot.org/article.pl?sid=00/08/06/0222241&mode=thread ** which notes: [Posted by Hemos (1) on Saturday August 05, @10:22PM from the big-and-bad dept. Baldrson (2) and other folks as well write: "Dan Brumleve is at it again with Brown Orifice (3). In this episode, our fearless grey hat (4) opens a security hole in the Web's foundation that makes Napster (5) look positively tame by comparison. Be careful with this, kids. It turns your Netscape Web browser into a Web server that can serve up your entire file system to any other Web browser."] [clicks] (1) "Hemos" URL: http://hemos.net (2) "Baldrson" URL: mailto:jabowery@netcom.com (3) "Brown Orifice" URL: http://www.brumleve.com/BrownOrifice/ (4) "grey hat" URL: http://slashdot.org/comments.pl?sid=00/07/27/1343236&cid=310 (5) "Napster" URL: http://www.napster.com/ [clicks expanded] (3) "Brown Orifice HTTPD Homepage" URL: http://www.brumleve.com/BrownOrifice/ ## ---- On a nutshell ---- ** Test Orifice On-Line URL: (same) http://www.brumleve.com/BrownOrifice/ ** Test BOHTTPD Spy ("see a list of links to browsers currently running BOHTTPD") URL: http://www.brumleve.com/BrownOrifice/BOHTTPD_spy.cgi ** Download ("get a copy of the Brown Orifice site and source code"): URL: http://www.brumleve.com/BrownOrifice/BOHTTPD_download.cgi ## ---- ------------- ---- (4) "Articles: Security Through Obscurity A GOOD Thing?" URL: http://slashdot.org/comments.pl?sid=00/07/27/1343236&cid=310 ** which key notes: "Give Grey Hats the Right Incentives" [end clicks] ____________________________________________ [COMMENTS] I have not got time / intentions to test "Brown Orifice", hope some body will do and post results. Note the (4) key on: //Dan Brumleve, the developer of DBarter (a) (which won the Hackers Conference prize for "best work in progress" last year (b)) was quite young when he discovered his first Netscape exploit Tracker (c). Netscape subsequently gave credit for finding the "Tracker" hole to a guy from Bell Labs."//, and consequences... URL (again): http://slashdot.org/comments.pl?sid=00/07/27/1343236&cid=310 (a) See [DBarter - Financial Infrastructure for the Internet] URL: http://www.dbarter.com/ (b) See Dan showing won price on hand (JPG), at his page: URL: http://www.dbarter.com/images/dan.jpg (c) See The Tracker Bug / Security Update on Netscape as of AUGUST 4, 1997: URL: http://home.netscape.com/security/notes/previous/tracker.html [INMHO] It is a matter of who tries harder. [SALT ] Or a "grain of it", as Lenz wrote on one of his numerous posts, He helping as ever: "Yes, I totally agree. Automated updating should be taken with a grain of Salt :)" See Lenz's post on "Re: [suse-security] SuSE security reputation, etc.." at: URL: http://lists.suse.com/archives/suse-security/2000-Aug/0088.html [HEAVY SALT] Fiuuu, it is available (BOHTTPD) to general public, source included, just waiting for some idiot to borrow it, enhance it, spread gargage on the Net, maybe learn some Java on the process, and who knows... Java performing. A Saga on it's own. ____________________________________________ [GRINS, GRRR's and more] Although i'm a Netscape® Communicator 4.74 128bits user, as you can see on: Headers/All: [X-Mailer: Mozilla 4.74 [en] (Win95; U)] (procedure if you use Netscape also). Through which i usually post. (3Com ADSL HomeConnect PCI 3CP3617, lack to support Linux, problem related!! GRRRR...) Cannot use my SuSE Linux to post directly to Net through ADSL, again GRRRR...... [XzFrSk¿?)¿)?$$!$·Arrrrgghhhsh...rumble rumble] ____________________________________________ Too much for one post... (beg your pardon!!) =`8) The War continues... No more for now. -- HTH Best regards, Eduardo Carriles [-- Better a smile than a flame --] (Long time SuSE-Linux [preferred distro] user). [-- Se me nota mucho? -- Notices me much?] [-- Have a lot of fun...]

1 0

SuSEfirewall question
by Jason McDonald 09 Aug '00

09 Aug '00

Hello Everyone, I have recently setup a firewall box using SuSE 6.4, where the interface to the internet (eth0) gets its IP address from a DHCP server and while perusing /var/log/messages I came upon the following entries, which seem to repeat at intervals of between 20 and 90 seconds. Aug 9 13:09:43 wallaby dhclient: DHCPREQUEST on eth0 to 202.12.113.74 port 67 Aug 9 13:09:43 wallaby kernel: Packet log: input DENY eth0 PROTO=17 202.12.113.74:67 202.12.113.21:68 L=339 S=0x00 I=15633 F=0x0000 T=128 (#81) Am I correct in thinking that this means that responses from the DHCP server are being blocked by the firewall? And if so, how do I fix the problem? I already have FW_SERVICE_DHCLIENT="yes" in my /etc/rc.config.d/firewall.rc.config file and cannot think of anywhere else that I need to do anything to permit DHCP to work properly. Any help would be much appreciated, Jason McDonald -- Random Signature #117: Maths and alcohol don't mix -- never drink and derive.

1 0

break-in
by ksemat＠wawa.eahd.or.ug 08 Aug '00

08 Aug '00

Could someone help me out with this I have responded by knocking out imap but there may be other avenues or it may be an innocent thing. This is what I have in my log. Aug 6 15:45:04 alpha imapd[27638]: System break-in attempt, host=infon819.jet.es [195.55.159.51] what other measures should I take? Noah ksemat(a)eahd.or.ug

3 2