August 2000 - openSUSE Security - openSUSE Mailing Lists

problem to login by my isp
by Arndt Groll 21 Aug '00

21 Aug '00

if i try to connect my provider first, i get the following messages Jul 31 14:47:38 Pingu4 kernel: PPP BSD Compression module registered Jul 31 14:47:38 Pingu4 kernel: PPP Deflate Compression module registered Jul 31 14:47:44 Pingu4 kernel: Packet log: input DENY ppp0 PROTO=17 212.7.128.165:53 212.7.133.153:1028 L=169 S=0x00 I=2037 F=0x0000 T=61 (#129) Jul 31 14:48:04 Pingu4 kernel: Packet log: input DENY ppp0 PROTO=17 212.7.128.162:53 212.7.133.153:1028 L=169 S=0x00 I=59406 F=0x0000 T=62 (#129) Jul 31 15:15:43 Pingu4 kernel: Packet log: input DENY ppp0 PROTO=17 212.7.128.165:53 212.7.133.217:1028 L=167 S=0x00 I=31214 F=0x0000 T=61 (#133) if i drive my firewall-script down, then i get a connect and can login after that action i drive my firewall up and can start to work. my firewall deny port 53 pakets (domain) as i saw in the services file, in my firewall itself i have insert the line (by the way: it was already insert by Suse) FW_SERVICES_EXTERNAL_TCP="smtp domain" # Common: smtp domain but it do not work! The firewall deny the pakets like before! Every help will be recommend! Greetings Arndt Groll

2 1

crypt passwords
by Kurt Seifried 21 Aug '00

21 Aug '00

Salts: 4096 (64x64) Passwords input,,1,2,3,4,5,6,7,8,9 a-z,26,106496,2768896,71991296,1871773696,48666116096,1.26532E+12,3.28983E+1 3,8.55356E+14,2.22392E+16 "a-z, A-Z",52,212992,11075584,575930368,29948379136,1.55732E+12,8.09804E+13,4.2109 8E+15,2.18971E+17,1.13865E+19 "a-z, A-Z, 0-9",62,253952,15745024,976191488,60523872256,3.75248E+12,2.32654E+14,1.4424 5E+16,8.94321E+17,5.54479E+19 "a-z, A-Z, 0-9, shift0-9",72,294912,21233664,1528823808,1.10075E+11,7.92542E+12,5.7063E+14,4 .10854E+16,2.95815E+18,2.12987E+20 "a-z, A-Z, 0-9, shift0-9, punctuation",94,385024,36192256,3402072064,3.19795E+11,3.00607E+13,2.82571E+ 15,2.65616E+17,2.49679E+19,2.34699E+21 terrabyte: 1E+12,1E+12,1.06496E-07,2.7689E-06,7.19913E-05,0.001871774,0.048666116,1.265 319018,32.89829448,855.3556565,22239.24707 ,,2.12992E-07,1.10756E-05,0.00057593,0.029948379,1.557315715,80.98041718,421 0.981694,218971.0481,11386494.5 ,,2.53952E-07,1.5745E-05,0.000976191,0.060523872,3.75248008,232.653765,14424 .53343,894321.0725,55447906.49 ,,2.94912E-07,2.12337E-05,0.001528824,0.110075314,7.925422621,570.6304287,41 085.39087,2958148.142,212986666.2 ,,3.85024E-07,3.61923E-05,0.003402072,0.319794774,30.06070876,2825.706623,26 5616.4226,24967943.72,2346986710 So a password of 6 characters using only a-z would require ~1.2 terrabytes to store it, not to bad. A password of 6 characters with a-z, A-Z, 0-9 would require ~230 terrabytes (poetic license taken for database storage/indexes/compression/etc). The moral of the story: you need to protect the password file, since an attacker can glean the salt used from it, reducing their workload considerably (by a factor of 4096). You also need to make users choose strong passwords, if they choose a word you are probably up the creek, taking a dictionary with 4 million words (ie almost all words, names, etc, including foriegn languages) and you can hit a lot of passwords, tests I have seen usually 1-5% of passwords are set to the username, system default, or somehting like "password", meaning an attacker can get their foot in the door easily. The "problem" with crypt is it is relatively "cheap" to run through combinations/etc. MD5 and Blowfish provide a much stronger one way hash and the attacker will need a lot more time to generate a lookup database or brute force them. I.e. it mush less harmful if someone steals the /etc/shadow from my OpenBSD box (which uses blowfish) as opposed to a crypt'ed password file off a SuSE box. Now I need to eat breakfast. Kurt Seifried SecurityPortal, your focal point for security on the net http://www.securityportal.com/

3 3

Re: [suse-security] SSL, SSH and other Crypto stuff
by wilson＠claborn.net 21 Aug '00

21 Aug '00

I got ahold of someone at suse who said to get suse-made RPMs from the German SuSE Mirror: ftp.gwdg.de:/pub/linux/suse/6.4/i386.de/suse/sec1/ (please use a mirror of course :-) But they also said this: "The answer I got back from the tech folks is that it is NOT legal for you to install and use packages containing crypto, except for those that are licensed from RSA." I'm not sure about the "Licensed from RSA" part - I know you have to but certificates for SSl (or something like that ;-) But I _know_ I've seen it written on SuSE's site somewhere that the reason the US CDs don't have Crypto is because, it's the US co that handles international orders, and so they wouldn't be able to ship the "stock" US SuSE distro out of the US with Crypto in it. Personally I think that's totally crazy - if the German Co would handle the International orders, then both the US people and the internationals would be able to have crypto (the ONLY problem I know of is that it's not legal to ship crypto _out_ of the US - I don't think other Countries have a problem importing it - not many anyway). The way it's set up now, both the US customers and the international customers don't get crypto, for no other reason then because SuSE has the US Division handling International orders. Makes me shake my head - is there a lack of CD burners in Germany? :-) Since it's the US that has the silly laws I think it would make a lot more sense to have suse.de handle they international stuff. Maybe Germany has laws that are as screwy as the US, I dunno.. My response + $.02 At 01:26 PM 8/20/2000 -0400, you wrote: >On Fri, 18 Aug 2000, Jonathan Wilson wrote: > > > > > I'm needing a few things like ssh and mod_ssl for SuSE 6.4 - the things > > that are left out of the US version. > > > > I understand that they can't be included with the CD due to _export_ laws, > > but it's ok for me to download them into the US, for use in the US - > right? > > So my question is, where's the proper place to get them from? I Can't find > > them on ftp.suse.com. > > > > (note: I'm looking specifically for the SuSE-made rpms, not just rpms in > > general > > > > SSH and openssh are available in the US for Unix and Win > machines from: > ftp://ftp.cis.fed.gov/pub/ or > ftp://metalab.unc.edu/pub/packages/security/ > There are various tar.gz and rpm files there. > Building ssh from the tarballs is extremely easy. > There is a list of worldwide mirrors for ssh at: > http://www.ssh.com/products/ssh/download.html > There is a licence required for commercial use of ssh. > >I don't understand why SuSE do not have (open)ssh on their US CD's as >the program is freely downloadable in the US and I have to go to metalab >and get it each time I install a new SuSE version. Maybe it's the licence >and not the laws. SuSE guys?? > > I believe openssh, openssl, mod_ssl and ssh are all downloadable > as SuSE rpms from: > ftp://ftp.gwdg.de/pub/linux/suse/6.4/i386.de/suse/sec1/ > >Regards, > > > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] Fwd: CERT Advisory CA-2000-17
by Volker Kuhlmann 20 Aug '00

20 Aug '00

> "No patches issued, but they have said they are working on: > > Netscape > knfsd" > > knfsd aka rpc.statd. So yeah SuSE should be releasing a fix. (ANYTIME NOW! > NO RUSH! ;) Ehm, a (the??) new package appeared on the ftp server on 10 Aug (10 days ago): knfsd-991001-133.i386.rpm (this was in the 6.3 updates) Volker

2 1

Re: [suse-security] Re: supplied firewall package robustness
by Jason P. Stanford 19 Aug '00

19 Aug '00

Who are you calling paranoid??? :) BTW, this begs another question. If I notice "strange things" happening, should I notify someone? Ie. I keep getting pings, scans and connects to ports 21,23,53 (ftp,telnet,dns, none of which are used on my system) from the same 4-5 locations. Should I attempt to notify someone in those domains? I would suspec that in those domains, some non-hardened linux install has been compromised and is being used as a base for "recon" scans. Or am I just being paranoid and jumping the gun? Also, since I'm such a newbie to network security what are other good sources of hard data, info, etc? Thanks. -Jason --- Hubert Mantel <mantel(a)suse.de> wrote: > Hi, > > On Fri, Aug 18, Jason P. Stanford wrote: > > > I have taken a recent and deep interest in network security since > installing > > SuSE 6.4 and OpenBSD on some spare machines in my lab. Of late I have > noticed a > > lot of (possibly) suspicious activity, which probably shouldn't be too > > suspicious in a university setting. However, I am wondering just how robust > and > > "impervious" the firewal package supplied with SuSE is? > > I only have ssh listening (on default port 22) through the firewall and a > > test web server on port 8080 (under my regular user uid and gid with no > > scripting or cgi by default). All other running daemons/servers are blocked > > (assumedly) by the firewall. > > Also, everything is deactivated in /etc/inetd.conf. /etc/hosts.deny is > set to > > ALL: ALL and /etc/hosts.allow is set to sshd: ALL. That's it. Am I pretty > safe, > > or should I still be paranoid? BTW, the machine is not acting as a router > or > > NATS box. It is standalone only. > > Given the firewall is setup properly, it sounds quite good. But even with > the best firewall, you should always be paranoid. Only the paranoid will > survive ;) > > > -Jason > -o) > Hubert Mantel Goodbye, dots... /\\ > _\_v > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > __________________________________________________ Do You Yahoo!? Yahoo! Mail � Free email you can access from anywhere! http://mail.yahoo.com/

2 1

why is /usr/bin/passwd in /etc/shells
by Thorsten Stoelk 19 Aug '00

19 Aug '00

hi, can somebody tell me why there is /usr/bin/passwd in the /etc/shells? -- HosHy

5 4

Re: [suse-security] SLL + Apache how to?
by Francisco M. Marzoa Alonso 19 Aug '00

19 Aug '00

Roman Drahtmueller wrote: > > Ok then, Would you please try this in your system? > > > > rpm -qf /usr/lib/apache/libssl.so > > > > That's to see what package owns that file, because on my system that one > > doesn't exist and it wasn't installed with openssl package, but an > > /usr/lib/libssl.so.0 was installed so I change the related apache > > configuration directives in order to point to /usr/lib/llibssl.so.0 instead > > of the missing /usr/lib/apache/libssl.so > > The package you need is called "mod_ssl", not openssl. Why don't you > install it? Hmmmmmmm... seems like my SuSE 6.4 don't wear none mod_ssl package, this is from YaST list of 'all series and packages': mod_php4 4.0b4pl1-24 1.6 M n modcontr 1.0.7-74 327.5 K n Not mod_ssl available... so... are you sure that /usr/lib/apache/libssl.so comes with that package? if the answer is afirmative, where can i found it? It surely returns to you the name of the rpm package from which that library was installed. Thanks a lot and excuse me if i'm disturbing very much :/ -- Francisco M. Marzoa Alonso Loyalt-e Commerce, S.A. System Administrator & Po. de la Chopera, 29 Software Developer 28760 - Madrid - España/Spain e-mail: fmmarzoa(a)loyalt-e.com Phone: +34 914 841 068 Powered by LiNUX! Fax: +34 916 613 954

2 1

Fwd: CERT Advisory CA-2000-17
by Nick Zentena 19 Aug '00

19 Aug '00

I don't see SuSE on the list so I'm not sure if it is a problem for SuSE users or not. So I guess if you are running the problem software to check your versions. Nick ---------- Forwarded Message ---------- Subject: CERT Advisory CA-2000-17 Date: Fri, 18 Aug 2000 17:54:58 -0400 (EDT) From: CERT Advisory <cert-advisory(a)cert.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CERT Advisory CA-2000-17 Input Validation Problem in rpc.statd Original release date: August 18, 2000 Source: CERT/CC A complete revision history is at the end of this file. Systems Affected * Systems running the rpc.statd service Overview The CERT/CC has begun receiving reports of an input validation vulnerability in the rpc.statd program being exploited. This program is included, and often installed by default, in several popular Linux distributions. Please see Appendix A of this document for specific information regarding affected distributions. More information about this vulnerability is available at the following public URLs: * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0666 * http://www.securityfocus.com/bid/1480 I. Description The rpc.statd program passes user-supplied data to the syslog() function as a format string. If there is no input validation of this string, a malicious user can inject machine code to be executed with the privileges of the rpc.statd process, typically root. Intruder Activity The following is an example log message from a compromised system illustrating the rpc.statd exploit occurring: Aug XX 17:13:08 victim rpc.statd[410]: SM_MON request for hostname containing '/': ^D^D^E^E^F ^F^G^G08049f10 bffff754 000028f8 4d5f4d53 72204e4f 65757165 66207473 6820726f 6e74736f 20656d61 746e6f63 696e6961 2720676e 203a272f 00000000000000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000000bffff7 0400000000000000000000000000000000000000000000000bffff7050000bffff70600000000000 00000000000000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000000000000 0000000000000bffff707<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90 ><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90 ><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90>K^<89>v<83> <8D>^( <83> <89>^<83> <8D>^.<83> <83> <83>#<89>^ 1<83> <88>F'<88>F*<83> <88>F<89>F+, <89><8D>N<8D>V<80>1<89>@<80>/bin /sh -c echo 9704 stream tcp nowait root /bin/sh sh -i >> /etc/inetd.conf;killall -HUP inetd If you see log entries similar to those above, we suggest you examine your system for signs of intrusion by following the steps outlined in our Intruder Detection Checklist. If you believe your host has been compromised, please follow our Steps for Recovering From a Root Compromise. Please check our Current Activity page for updates regarding intruder activity. II. Impact By exploiting this vulnerability, local or remote users may be able to execute arbitrary code with the privileges of the rpc.statd process, typically root. III. Solution Upgrade your version of rpc.statd Please see Appendix A of this advisory for more information about the availability of program updates specific to your system. If you are running a vulnerable version of rpc.statd, the CERT/CC encourages you to apply appropriate vendor patches. After making any updates, be sure to restart the rpc.statd service. Disable the rpc.statd service If an update cannot be applied, the CERT/CC recommends disabling the rpc.statd service. We advise proceeding with caution, however, as disabling this process can interfere with NFS functionality. Block unneeded ports at your firewall As a good security practice in general, the CERT/CC recommends blocking unneeded ports at your firewall. This option does not remedy the vulnerability, but does prevent outside intruders from exploiting it. In particular, block port 111 (portmapper), as well as the port on which rpc.statd is running, which may vary. Appendix A. Vendor Information This section contains information provided by vendors for this advisory. We will update this appendix as we receive more information. If you do not see your vendor's name, the CERT/CC did not receive a response from that vendor. Please contact your vendor directly. Berkeley Software Design, Inc. (BSDI) No versions of BSD/OS are vulnerable. Caldera, Inc. Not vulnerable: None of our products ship with rpc.statd Compaq At the time of writing this document, Compaq is currently investigating the potential impact to Compaq's rpc.statd service. Initial tests indicate it is not a potential vulnerability for Compaq supplied software. As further information becomes available Compaq will provide notice of the completion/availability of any necessary patches through AES services (DIA, DSNlink FLASH and posted to the Services WEB page) and be available from your normal Compaq Services Support channel. Debian http://www.debian.org/security/2000/20000719a FreeBSD FreeBSD is not vulnerable to this problem. NetBSD NetBSD 1.4.x and NetBSD 1.5 do not appear to be affected by this problem; all calls to syslog() within rpc.statd take a constant string for the format argument. OpenBSD *Linux* systems running the rpc.statd service! This affects noone else! RedHat http://www.redhat.com/support/errata/RHSA-2000-043-03.html Silicon Graphics, Inc. IRIX rpc.statd is not vulnerable to this security issue. _________________________________________________________________ Authors: John Shaffer, Brian King ______________________________________________________________________ This document is available from: http://www.cert.org/advisories/CA-2000-17.html ______________________________________________________________________ CERT/CC Contact Information Email: cert(a)cert.org Phone: +1 412-268-7090 (24-hour hotline) Fax: +1 412-268-6989 Postal address: CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 U.S.A. CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends. Using encryption We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from http://www.cert.org/CERT_PGP.key If you prefer to use DES, please call the CERT hotline for more information. Getting security information CERT publications and other security information are available from our web site http://www.cert.org/ To be added to our mailing list for advisories and bulletins, send email to cert-advisory-request(a)cert.org and include SUBSCRIBE your-email-address in the subject of your message. * "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office. ______________________________________________________________________ NO WARRANTY Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement. _________________________________________________________________ Conditions for use, disclaimers, and sponsorship information Copyright 2000 Carnegie Mellon University. Revision History August 18, 2000: Initial release -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBOZ2tv1r9kb5qlZHQEQKPhwCfVPCFRgGcLymQ/SiMh1hHr0r1/CkAn04x BWp9xn1wq0xkW49b7dFnHr7l =l/C2 -----END PGP SIGNATURE----- ------------------------------------------------------- -- ----------------------------- Anybody got plans for an ark? -----------------------------

2 1

problem?
by semat＠wawa.eahd.or.ug 19 Aug '00

19 Aug '00

I am seeing this message in my logs. Have I got cause to get worried or should I ignore it? Aug 19 11:16:34 alpha ftpd[4485]: mmap(0): Illegal seek Aug 19 11:18:38 alpha ftpd[4526]: mmap(0): Illegal seek Aug 19 11:18:39 alpha ftpd[4526]: mmap(0): Illegal seek

1 0

Re: your link suse-secur. gives 404
by Kurt Seifried 18 Aug '00

18 Aug '00

http://www.securityportal.com/lskb/10000100/kben10000135.html crap, forgot I changed all the links. sigh. time to get sed out. Kurt Seifried SecurityPortal, your focal point for security on the net http://www.securityportal.com/ ----- Original Message ----- From: "wolfgang tinhofer" <suse_list(a)tirolkultur.at> To: "Kurt Seifried" <listuser(a)seifried.org> Sent: Friday, August 18, 2000 2:43 PM Subject: Re: your link suse-secur. gives 404 > > > > Von: "Kurt Seifried" <listuser(a)seifried.org> > > Antworten an: "Kurt Seifried" <listuser(a)seifried.org> > > Datum: Fri, 18 Aug 2000 14:37:25 -0600 > > An: <suse-security(a)suse.com> > > Betreff: Re: [suse-security] why is /usr/bin/passwd in /etc/shells > > > >> hi, > >> > >> can somebody tell me why there is /usr/bin/passwd in the /etc/shells? > >> > >> -- > >> > >> HosHy > > > > http://www.securityportal.com/lskb/articles/kben10000135.html > > > > gives an example of why. > > > > Kurt > > > > > > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > >

1 0