August 2000 - openSUSE Security - openSUSE Mailing Lists

Intrusion Detection
by Peter Lange 22 Aug '00

22 Aug '00

hello, a company have to do maintainance-work on a Windows-system in the internal net. Is there a solution with linux that prevend, they go from this system to others? AFAIK Lids just protect the system it run on (host-based). Any hints? Thanks a lot Peter

2 1

Openfirewall something interresting
by Joop Boonen 22 Aug '00

22 Aug '00

Dear all, I found this link for a firewall http://www.openwall.com/ it also has it's own pop server, can you please look into it if this might be better. Security wise it should be certainly better. Than there is another project http://www.lids.org/ it's really great, it's a Linux intrusion detection. Can it please be added to Suse as a package? Regards, Joop Boonen.

2 1

Re: [suse-security] Secure By Default - PLEASE!
by Juergen Ellinger 22 Aug '00

22 Aug '00

Hi folks, in the meantime i'm bored a bit by this thread, although I accept, that the issue is important. So I would put the following for discussion: SuSE should ship their Linux - with all the security holes - as is done always before. So almost all people who want to run linux can easily do it and everything will work what the newbies expect to work on such a system. SuSE then should also ship a tool, which should act as a kind of an interactive tutorial: <example> foreach critcal ip-service do explain to the newbie what the service does explain where the security issues are recommend a security-optimization let the newbie decide, what he wants to do done </example> The goal must be, that the newbie feels sure to know what he does, that he needs not to edit the configuration files by hand (since the newbie usually is afraid about that) and that he has the opportunity to use an undo-button or something like that. Optionally the tool could show, what modifications it does on the configuration files. This way even a dummie can get a more or less secure system, he can deactivate one service now and another tomorrow, just as he has time to study the tutorial... The I-Don't-Care-About-Security-Dummie will find a running system, and last but not least this list could be freed of some freqently repeated questions since the answers can be found within the tutorial. I know, to create such an online-tutorial is a hard thing to implement, but if the work is started now, there could be once shipped a useful version of it, maybe with SuSE 7.1 or 7.2. But even if we have to wait several years for such a tool, it would be worth to do the work. with kind regards Jürgen --------------------------------------------------------------------- Jürgen Ellinger Siemensstraße 44 88250 Weingarten e-mail: ellinger(a)informatik.uni-tuebingen.de ellinger(a)student.uni-tuebingen.de ellinger(a)spohn.rv.bw.schule.de

2 1

Fw: [SECURITY] New version of xlockmore/xlockmore-gl released
by Kurt Seifried 22 Aug '00

22 Aug '00

You wanted to know what xlockmore is and why we shouldn't depend on /etc/shadow to be impenetrable? Admitedly SuSE uses klock http://www.suse.de/de/support/security/suse_security_announce_8.txt which had "By typing in a specific key sequence everyone could bypass the password athentication of klock." Kurt Seifried SecurityPortal, your focal point for security on the net http://www.securityportal.com/ ----- Original Message ----- From: "Michael Stone" <mstone(a)justice.loyola.edu> To: <debian-security-announce(a)lists.debian.org> Sent: Wednesday, August 16, 2000 10:31 PM Subject: [SECURITY] New version of xlockmore/xlockmore-gl released > -----BEGIN PGP SIGNED MESSAGE----- > > - ------------------------------------------------------------------------ > Debian Security Advisory security(a)debian.org > http://www.debian.org/security/ Michael Stone > August 16, 2000 > - ------------------------------------------------------------------------ > > Package: xlockmore, xlockmore-gl > Vulnerability type: local exploit > Debian-specific: no > > There is a format string bug in all versions of xlockmore/xlockmore-gl. > Debian 2.1 (slink) installs xlock setgid by default, and this exploit > can be used to gain read access to the shadow file. We recommend > upgrading immediately. > > xlockmore is normally installed as an unprivileged program in Debian 2.2 > (potato) and is not vulnerable in that configuration. xlockmore may be > setuid/setgid for historical reasons or after upgrading from a previous > Debian release; consult README.Debian in /usr/doc/xlockmore or > /usr/doc/xlockmore-gl for information about xlock privileges and how to > disable them. If your local environment requires xlock to be setgid, or > if in doubt, you should upgrade to a fixed package immediately. > > Fixed packages are available in xlockmore/xlockmore-gl 4.12-5 for Debian > 2.1 (slink) and xlockmore/xlockmore-gl 4.15-9 for Debian 2.2 (potato). > > wget url > will fetch the file for you > dpkg -i file.deb > will install the referenced file. > > > Debian GNU/Linux 2.1 alias slink > - -------------------------------- > > Source archives: > http://security.debian.org/dists/slink/updates/source/xlockmore_4.12-5.diff. gz > MD5 checksum: e253bee3472f835e71e23994ead85dcf > http://security.debian.org/dists/slink/updates/source/xlockmore_4.12-5.dsc > MD5 checksum: acbf3f3310edca9ce20f5d4e720f3227 > http://security.debian.org/dists/slink/updates/source/xlockmore_4.12.orig.ta r.gz > MD5 checksum: 110a594d89f3a2758255d0bba0e48217 > Alpha architecture: > http://security.debian.org/dists/slink/updates/binary-alpha/xlockmore-gl_4.1 2-5_alpha.deb > MD5 checksum: d51723c04362213ca6f43d12db479a07 > http://security.debian.org/dists/slink/updates/binary-alpha/xlockmore_4.12-5 _alpha.deb > MD5 checksum: 41878e3ba49152c5049cb9a394a41d14 > Intel ia32 architecture: > http://security.debian.org/dists/slink/updates/binary-i386/xlockmore-gl_4.12 -5_i386.deb > MD5 checksum: 0d5c32ed8a834bb810ba421520f81dea > http://security.debian.org/dists/slink/updates/binary-i386/xlockmore_4.12-5_ i386.deb > MD5 checksum: ca34fd0732d82f2e4d176eb80f828cd8 > Motorola 680x0 architecture: > will be available shortly > Sun Sparc architecture: > http://security.debian.org/dists/slink/updates/binary-sparc/xlockmore-gl_4.1 2-5_sparc.deb > MD5 checksum: 3ccfd6b2893e0e183eb1118c75fd57e4 > http://security.debian.org/dists/slink/updates/binary-sparc/xlockmore_4.12-5 _sparc.deb > MD5 checksum: 002d7712d7be3a943e0b88f9263092b2 > > > Debian GNU/Linux 2.2 alias potato > - --------------------------------- > > Source archives: > http://security.debian.org/dists/potato/updates/main/source/xlockmore_4.15-9 .diff.gz > MD5 checksum: 02f86bd315558ca32ca5a777d009c85f > http://security.debian.org/dists/potato/updates/main/source/xlockmore_4.15-9 .dsc > MD5 checksum: 377a392b2f6c711b5252fbfff822ce99 > http://security.debian.org/dists/potato/updates/main/source/xlockmore_4.15.o rig.tar.gz > MD5 checksum: eceda376ee0a336063a46ec018c83d94 > Alpha architecture: > http://security.debian.org/dists/potato/updates/main/binary-alpha/xlockmore- gl_4.15-9_alpha.deb > MD5 checksum: e620c4e0d3f4ecc7167b9f9897cd3971 > http://security.debian.org/dists/potato/updates/main/binary-alpha/xlockmore_ 4.15-9_alpha.deb > MD5 checksum: 15e4be9f504873789c42ce0f283da707 > Arm architecture: > http://security.debian.org/dists/potato/updates/main/binary-arm/xlockmore-gl _4.15-9_arm.deb > MD5 checksum: bb0f9cfb7a90f73a870ed529b51ef258 > http://security.debian.org/dists/potato/updates/main/binary-arm/xlockmore_4. 15-9_arm.deb > MD5 checksum: e78be3e33bbc1ee68c01bef39be8997d > Intel ia32 architecture: > http://security.debian.org/dists/potato/updates/main/binary-i386/xlockmore-g l_4.15-9_i386.deb > MD5 checksum: aed3a97f49cd0ea1464cefb6ef94b9ac > http://security.debian.org/dists/potato/updates/main/binary-i386/xlockmore_4 .15-9_i386.deb > MD5 checksum: 7a8ac4b5725bf3117b029ba31568817f > Motorola 680x0 architecture: > Will be available shortly > PowerPC architecture: > Will be available shortly > Sun Sparc architecture: > http://security.debian.org/dists/potato/updates/main/binary-sparc/xlockmore- gl_4.15-9_sparc.deb > MD5 checksum: 3507476bbf9e625c06a4f52ffa81a1e8 > http://security.debian.org/dists/potato/updates/main/binary-sparc/xlockmore_ 4.15-9_sparc.deb > MD5 checksum: 9ce55111c3a93744b62eb5f2d2291511 > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.2 (GNU/Linux) > Comment: For info see http://www.gnupg.org > > iQCVAwUBOZtlzQ0hVr09l8FJAQGhqAQArn11m6LbQxYxvrt1VmrrEpCYpSKcCeQd > LptDP6MkaD/8CvQHm7qYDyG/BD90UxkocLEmiRf53DvYYfaKEskyLXfKEoafMJAt > /q4V6PslIP98sz0Q1ddLIq4x+mHgJpmsD69XqjxqNMhK9sqLXpJuSLA1HE08JOD5 > LjEL+J5ISSo= > =qN72 > -----END PGP SIGNATURE----- > > > -- > To UNSUBSCRIBE, email to debian-security-announce-request(a)lists.debian.org > with a subject of "unsubscribe". Trouble? Contact listmaster(a)lists.debian.org > >

5 4

Re: [suse-security] Secure By Default - PLEASE!
by Erwin Zierler - Stubainet 22 Aug '00

22 Aug '00

At 09:20 22.08.00 +0200, <preining(a)logic.at> wrote: >On Tue, 22 Aug 2000, Thomas Biege wrote: >> If people use the tools we deliver with SuSE + their brains (note: we >> don't ship brains with SuSE), then they could get a very secure system >> within a short time of work. > >This is NOT a good idea. Either the default install (and the default >install for most people is `ALL') enables all the services, which IS I have installed SuSE on quite a few machines since version 5.3 for different purposes (webservers, mailservers, firewalls, desktop machines,...) but I _never_ needed or wanted to install ALL :-) >crazy! No idea why identd, and similar have to run on a dialin machine? >Even at the university where I have installed some susis, I alwyas have >to maually shut down all the irrelevant and dangerous services. Services >like telnet can be hacked or exploited very easy! All you have to do is to save all the config files which you are concerned about and make a little tarball. If you are installing the same kind of machines more often it will save you alot of time to use the save-config option ins YAST(2) and you will have your standard installation ready for future installations. Then create your 'standard' inetd.conf and also save it for future installations. >> Hrhr... 'secure by default' nice buzzwords. AFAIK /usr/bin isn't audited >> and neither all the ports are. It's 99% secure as long as you just use the > >Nobody says if you turn of all unnecessary services the system is secure, >but it is MORE secure than standard and at least a pc all the time linked >up to the inet is not as vulnerable as before. This is true to some degree, BUT: 'secure' is a term which one could stretch very far in both directions. I have seen a NT based commercial Firewall machine that runs pcanywhere as a service which made me wonder what most administrators consider 'secure'. After spending several days to figure out firewall concepts and the use of ipchains I came to the conclusion that as soon as you are running ANY service on a machine that is connected (permanantly or temporarily) to the internet you have a potential security hole. The degree of the vulnerability (or security) not only depends on what services you run but also on issues like monitoring, intrusion detection, local users and reading security related mailinglists and websites. >> SuSE 7.0 hast a YaST2 module, that allows the not-so-experienced User to >> modify /etc/inetd.conf in a easy way, to shut inetd off (even YaST1 ask >> for this) or to use a default /etc/inetd.conf. >> In future more security modules will be added to YaST2. > >Thats good news! Hmmm... not sure about that really. If you are serious about configuring i.e. a web-/mail-server, firewall or gateway you should definitely check what is REALLY going on when you change some settings in a dialog box or even in /etc/rc.config. More options in a configuration tool will never give you a more secure system, it only gives you more chances to do it right or wrong. If we really want to talk about security of a Linux distribution we should not discuss the GUI or related issues but rather the potential vulnerabilities and where/how we can avoid them. >> The experienced-power-ueber User uses vi or sed to edit the config-files >> and make their box secure. > >thats true, but there are not only power users! The other way round >would be better: experienced-ueber-drueber-power users can turn on >all the services they need easily and fast! Would be nice for people who run servers only, but there are other folks out there with other needs. Alot of processes on every Un*x system need certain ports for inter-process communication (X is one of them) so turning off everything by default might get many customers upset. And since SuSE is cetainly not interrested in loosing a large customer base I can't imagine they will ever ship their distribution in such a 'secure' but for many people unusable default configuration. >-- >ciao >norb > Regards, Erwin

3 2

kernel 2.2 socket programming
by Heinrich Voggenreiter 22 Aug '00

22 Aug '00

Hello, maybe I'm wrong here. I have a queston on socket programming, I have read in the raw 7 manual page, in Linux 2.2 I can set all IP header fields using IP socket options, dont need a raw socket. Does anybody now what options I must use, maybe somebody have or knows where I can get an example. Best Regards H. Voggenreiter Network Admin / Hostmaster Bezirk Oberbayern Germany

2 1

Re: [suse-security] Command history
by omicron＠symonds.net 22 Aug '00

22 Aug '00

hi cant get the url . is there any alternative one ? regards cheedu On 16 Aug 2000, brian wrote: > > i've written a script that logs all the commands execurited by a > > user, his terminal, the time, the direcotry... i dont use the bash_history > > but the history itself. now the question is will the history be reliable, > > will it be moreuseful than .bash_history , will it be legal. also > > because the script is execurted as the user itself, i'm forced to append > > the command history to a file which has chattr +a attribute set. so the > > user can put anything in the file. any ideas to make it stealthy ?, btw, > > i'm using prompt_command varialble. > > There have been some good suggestions, though they'd be really easy to > get around (python, perl, running another shell on top of the current > one, etc). I'm not sure how much it logs, but there's a kernel module > (maybe it can be built-in now?) called exec.c, > http://home.xnet.com/~perly/exec.c . > > It logs stuff to kern.info like this: > EXECVE(UID)[PID]: program arg1 arg2 ... argN > > I'm guessing you could set up one of the alternate sysloggers to > sort out different users, etc. > > It works on the kernel level, so it'd be pretty hard to get around. > > -Brian > (patiently awaiting 400 billion I'm-on-vacation messages :) ) > -- ***** cogito cogito ergo cogito sum: i think that i think, therefore i think that i am. --Devils Dictionary --

1 0

back orifice...
by omicron＠pes.edu 22 Aug '00

22 Aug '00

hi what are back orifice and brown orifice.. i hear them so often that i dont know what they are. my apologies if it is a simple question Thanx cheedu -- ***** cogito cogito ergo cogito sum: i think that i think, therefore i think that i am. --Devils Dictionary --

2 2

Re: [suse-security] Command history (fwd)
by max 22 Aug '00

22 Aug '00

a much better thing to do if you really want to snoop on people is to get tty snoop, available at ftp://ftp.innet.be/pub/staff/carl/ttysnoop-0.12d.tar.gz description of ttysnoop: "TTYSnoop allows you to snoop on login tty's through another tty-device or pseudo-tty. The snoop-tty becomes a 'clone' of the original tty, redirecting both input and output from/to it." as far as the moral issues are concerned, your machine is your territory, and as long as that is clear to the users, you can snoop on them all you want. my motd says "this is a production machine. it is constantly monitored. and your presence, as well as all your actions on the system, are logged for security purposes." Max Gribov System Administrator Knowledge Propulsion Laboratories www.kplab.com On Wed, 16 Aug 2000, [ISO-8859-1] Peter M�nster wrote: > On Wed, 16 Aug 2000, Sridhar wrote: > > > i've written a script that logs all the commands execurited by a > > user, his terminal, the time, the direcotry... i dont use the bash_history > > but the history itself. now the question is will the history be reliable, > > will it be moreuseful than .bash_history , will it be legal. also > > because the script is execurted as the user itself, i'm forced to append > > the command history to a file which has chattr +a attribute set. so the > > user can put anything in the file. any ideas to make it stealthy ?, btw, > > i'm using prompt_command varialble. > > Hello cheedu (or Sridhar), > I don't know if this is legal, but some little thoughts about the other > points: > - a webcam behind the terminal (hidden of course) is also a very good > choice ;) > - who will read /tmp/comlog, you have already enough in /var/log > - if someone gets root and forgot to look into the environment (HISTFILE > etc), the you can get him just by his .bash_histfile. If he is > not too bad, he will delete his traces, all. > - you can execute commands also via a lot of applications (X-clients etc), > that don't leave traces like in histfile etc > > R�sum�: don't do it, it's not useful, and nobody likes the "Big Brother" > > Cheers, Peter > > -- > Peter M�nster > http://w3pm.stormloader.com/ > > *** Sign now: http://petition.eurolinux.org/ *** > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

2 1

how do i learn how to hack - for security checking
by tk dev 22 Aug '00

22 Aug '00

hi all i'm going to connect my server to the internet. b4 i do that, can anyone recommend to me some good firewalls- that's also easy to configure? anyway,how do i check that my server is secure enough? any hints or reference is much appreciated. thanks in advance. tk ===== 0Oo~~:o) Smile! You'r Alive!!! Q:What's peacefulness? A:What's confusion? Peacefulness is the end of confusion. o.0.Oo.o May there be peace in every step we take :o):tk __________________________________________________ Do You Yahoo!? Yahoo! Mail � Free email you can access from anywhere! http://mail.yahoo.com/

1 0