August 2000 - openSUSE Security - openSUSE Mailing Lists

Intrusion Detection
by Peter Lange 22 Aug '00

22 Aug '00

hello, a company have to do maintainance-work on a Windows-system in the internal net. Is there a solution with linux that prevend, they go from this system to others? AFAIK Lids just protect the system it run on (host-based). Any hints? Thanks a lot Peter

2 1

Openfirewall something interresting
by Joop Boonen 22 Aug '00

22 Aug '00

Dear all, I found this link for a firewall http://www.openwall.com/ it also has it's own pop server, can you please look into it if this might be better. Security wise it should be certainly better. Than there is another project http://www.lids.org/ it's really great, it's a Linux intrusion detection. Can it please be added to Suse as a package? Regards, Joop Boonen.

2 1

Re: [suse-security] Secure By Default - PLEASE!
by Juergen Ellinger 22 Aug '00

22 Aug '00

Hi folks, in the meantime i'm bored a bit by this thread, although I accept, that the issue is important. So I would put the following for discussion: SuSE should ship their Linux - with all the security holes - as is done always before. So almost all people who want to run linux can easily do it and everything will work what the newbies expect to work on such a system. SuSE then should also ship a tool, which should act as a kind of an interactive tutorial: <example> foreach critcal ip-service do explain to the newbie what the service does explain where the security issues are recommend a security-optimization let the newbie decide, what he wants to do done </example> The goal must be, that the newbie feels sure to know what he does, that he needs not to edit the configuration files by hand (since the newbie usually is afraid about that) and that he has the opportunity to use an undo-button or something like that. Optionally the tool could show, what modifications it does on the configuration files. This way even a dummie can get a more or less secure system, he can deactivate one service now and another tomorrow, just as he has time to study the tutorial... The I-Don't-Care-About-Security-Dummie will find a running system, and last but not least this list could be freed of some freqently repeated questions since the answers can be found within the tutorial. I know, to create such an online-tutorial is a hard thing to implement, but if the work is started now, there could be once shipped a useful version of it, maybe with SuSE 7.1 or 7.2. But even if we have to wait several years for such a tool, it would be worth to do the work. with kind regards Jürgen --------------------------------------------------------------------- Jürgen Ellinger Siemensstraße 44 88250 Weingarten e-mail: ellinger(a)informatik.uni-tuebingen.de ellinger(a)student.uni-tuebingen.de ellinger(a)spohn.rv.bw.schule.de

2 1

Fw: [SECURITY] New version of xlockmore/xlockmore-gl released
by Kurt Seifried 22 Aug '00

22 Aug '00

You wanted to know what xlockmore is and why we shouldn't depend on /etc/shadow to be impenetrable? Admitedly SuSE uses klock http://www.suse.de/de/support/security/suse_security_announce_8.txt which had "By typing in a specific key sequence everyone could bypass the password athentication of klock." Kurt Seifried SecurityPortal, your focal point for security on the net http://www.securityportal.com/ ----- Original Message ----- From: "Michael Stone" <mstone(a)justice.loyola.edu> To: <debian-security-announce(a)lists.debian.org> Sent: Wednesday, August 16, 2000 10:31 PM Subject: [SECURITY] New version of xlockmore/xlockmore-gl released > -----BEGIN PGP SIGNED MESSAGE----- > > - ------------------------------------------------------------------------ > Debian Security Advisory security(a)debian.org > http://www.debian.org/security/ Michael Stone > August 16, 2000 > - ------------------------------------------------------------------------ > > Package: xlockmore, xlockmore-gl > Vulnerability type: local exploit > Debian-specific: no > > There is a format string bug in all versions of xlockmore/xlockmore-gl. > Debian 2.1 (slink) installs xlock setgid by default, and this exploit > can be used to gain read access to the shadow file. We recommend > upgrading immediately. > > xlockmore is normally installed as an unprivileged program in Debian 2.2 > (potato) and is not vulnerable in that configuration. xlockmore may be > setuid/setgid for historical reasons or after upgrading from a previous > Debian release; consult README.Debian in /usr/doc/xlockmore or > /usr/doc/xlockmore-gl for information about xlock privileges and how to > disable them. If your local environment requires xlock to be setgid, or > if in doubt, you should upgrade to a fixed package immediately. > > Fixed packages are available in xlockmore/xlockmore-gl 4.12-5 for Debian > 2.1 (slink) and xlockmore/xlockmore-gl 4.15-9 for Debian 2.2 (potato). > > wget url > will fetch the file for you > dpkg -i file.deb > will install the referenced file. > > > Debian GNU/Linux 2.1 alias slink > - -------------------------------- > > Source archives: > http://security.debian.org/dists/slink/updates/source/xlockmore_4.12-5.diff. gz > MD5 checksum: e253bee3472f835e71e23994ead85dcf > http://security.debian.org/dists/slink/updates/source/xlockmore_4.12-5.dsc > MD5 checksum: acbf3f3310edca9ce20f5d4e720f3227 > http://security.debian.org/dists/slink/updates/source/xlockmore_4.12.orig.ta r.gz > MD5 checksum: 110a594d89f3a2758255d0bba0e48217 > Alpha architecture: > http://security.debian.org/dists/slink/updates/binary-alpha/xlockmore-gl_4.1 2-5_alpha.deb > MD5 checksum: d51723c04362213ca6f43d12db479a07 > http://security.debian.org/dists/slink/updates/binary-alpha/xlockmore_4.12-5 _alpha.deb > MD5 checksum: 41878e3ba49152c5049cb9a394a41d14 > Intel ia32 architecture: > http://security.debian.org/dists/slink/updates/binary-i386/xlockmore-gl_4.12 -5_i386.deb > MD5 checksum: 0d5c32ed8a834bb810ba421520f81dea > http://security.debian.org/dists/slink/updates/binary-i386/xlockmore_4.12-5_ i386.deb > MD5 checksum: ca34fd0732d82f2e4d176eb80f828cd8 > Motorola 680x0 architecture: > will be available shortly > Sun Sparc architecture: > http://security.debian.org/dists/slink/updates/binary-sparc/xlockmore-gl_4.1 2-5_sparc.deb > MD5 checksum: 3ccfd6b2893e0e183eb1118c75fd57e4 > http://security.debian.org/dists/slink/updates/binary-sparc/xlockmore_4.12-5 _sparc.deb > MD5 checksum: 002d7712d7be3a943e0b88f9263092b2 > > > Debian GNU/Linux 2.2 alias potato > - --------------------------------- > > Source archives: > http://security.debian.org/dists/potato/updates/main/source/xlockmore_4.15-9 .diff.gz > MD5 checksum: 02f86bd315558ca32ca5a777d009c85f > http://security.debian.org/dists/potato/updates/main/source/xlockmore_4.15-9 .dsc > MD5 checksum: 377a392b2f6c711b5252fbfff822ce99 > http://security.debian.org/dists/potato/updates/main/source/xlockmore_4.15.o rig.tar.gz > MD5 checksum: eceda376ee0a336063a46ec018c83d94 > Alpha architecture: > http://security.debian.org/dists/potato/updates/main/binary-alpha/xlockmore- gl_4.15-9_alpha.deb > MD5 checksum: e620c4e0d3f4ecc7167b9f9897cd3971 > http://security.debian.org/dists/potato/updates/main/binary-alpha/xlockmore_ 4.15-9_alpha.deb > MD5 checksum: 15e4be9f504873789c42ce0f283da707 > Arm architecture: > http://security.debian.org/dists/potato/updates/main/binary-arm/xlockmore-gl _4.15-9_arm.deb > MD5 checksum: bb0f9cfb7a90f73a870ed529b51ef258 > http://security.debian.org/dists/potato/updates/main/binary-arm/xlockmore_4. 15-9_arm.deb > MD5 checksum: e78be3e33bbc1ee68c01bef39be8997d > Intel ia32 architecture: > http://security.debian.org/dists/potato/updates/main/binary-i386/xlockmore-g l_4.15-9_i386.deb > MD5 checksum: aed3a97f49cd0ea1464cefb6ef94b9ac > http://security.debian.org/dists/potato/updates/main/binary-i386/xlockmore_4 .15-9_i386.deb > MD5 checksum: 7a8ac4b5725bf3117b029ba31568817f > Motorola 680x0 architecture: > Will be available shortly > PowerPC architecture: > Will be available shortly > Sun Sparc architecture: > http://security.debian.org/dists/potato/updates/main/binary-sparc/xlockmore- gl_4.15-9_sparc.deb > MD5 checksum: 3507476bbf9e625c06a4f52ffa81a1e8 > http://security.debian.org/dists/potato/updates/main/binary-sparc/xlockmore_ 4.15-9_sparc.deb > MD5 checksum: 9ce55111c3a93744b62eb5f2d2291511 > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.2 (GNU/Linux) > Comment: For info see http://www.gnupg.org > > iQCVAwUBOZtlzQ0hVr09l8FJAQGhqAQArn11m6LbQxYxvrt1VmrrEpCYpSKcCeQd > LptDP6MkaD/8CvQHm7qYDyG/BD90UxkocLEmiRf53DvYYfaKEskyLXfKEoafMJAt > /q4V6PslIP98sz0Q1ddLIq4x+mHgJpmsD69XqjxqNMhK9sqLXpJuSLA1HE08JOD5 > LjEL+J5ISSo= > =qN72 > -----END PGP SIGNATURE----- > > > -- > To UNSUBSCRIBE, email to debian-security-announce-request(a)lists.debian.org > with a subject of "unsubscribe". Trouble? Contact listmaster(a)lists.debian.org > >

5 4

Re: [suse-security] Secure By Default - PLEASE!
by Erwin Zierler - Stubainet 22 Aug '00

22 Aug '00

At 09:20 22.08.00 +0200, <preining(a)logic.at> wrote: >On Tue, 22 Aug 2000, Thomas Biege wrote: >> If people use the tools we deliver with SuSE + their brains (note: we >> don't ship brains with SuSE), then they could get a very secure system >> within a short time of work. > >This is NOT a good idea. Either the default install (and the default >install for most people is `ALL') enables all the services, which IS I have installed SuSE on quite a few machines since version 5.3 for different purposes (webservers, mailservers, firewalls, desktop machines,...) but I _never_ needed or wanted to install ALL :-) >crazy! No idea why identd, and similar have to run on a dialin machine? >Even at the university where I have installed some susis, I alwyas have >to maually shut down all the irrelevant and dangerous services. Services >like telnet can be hacked or exploited very easy! All you have to do is to save all the config files which you are concerned about and make a little tarball. If you are installing the same kind of machines more often it will save you alot of time to use the save-config option ins YAST(2) and you will have your standard installation ready for future installations. Then create your 'standard' inetd.conf and also save it for future installations. >> Hrhr... 'secure by default' nice buzzwords. AFAIK /usr/bin isn't audited >> and neither all the ports are. It's 99% secure as long as you just use the > >Nobody says if you turn of all unnecessary services the system is secure, >but it is MORE secure than standard and at least a pc all the time linked >up to the inet is not as vulnerable as before. This is true to some degree, BUT: 'secure' is a term which one could stretch very far in both directions. I have seen a NT based commercial Firewall machine that runs pcanywhere as a service which made me wonder what most administrators consider 'secure'. After spending several days to figure out firewall concepts and the use of ipchains I came to the conclusion that as soon as you are running ANY service on a machine that is connected (permanantly or temporarily) to the internet you have a potential security hole. The degree of the vulnerability (or security) not only depends on what services you run but also on issues like monitoring, intrusion detection, local users and reading security related mailinglists and websites. >> SuSE 7.0 hast a YaST2 module, that allows the not-so-experienced User to >> modify /etc/inetd.conf in a easy way, to shut inetd off (even YaST1 ask >> for this) or to use a default /etc/inetd.conf. >> In future more security modules will be added to YaST2. > >Thats good news! Hmmm... not sure about that really. If you are serious about configuring i.e. a web-/mail-server, firewall or gateway you should definitely check what is REALLY going on when you change some settings in a dialog box or even in /etc/rc.config. More options in a configuration tool will never give you a more secure system, it only gives you more chances to do it right or wrong. If we really want to talk about security of a Linux distribution we should not discuss the GUI or related issues but rather the potential vulnerabilities and where/how we can avoid them. >> The experienced-power-ueber User uses vi or sed to edit the config-files >> and make their box secure. > >thats true, but there are not only power users! The other way round >would be better: experienced-ueber-drueber-power users can turn on >all the services they need easily and fast! Would be nice for people who run servers only, but there are other folks out there with other needs. Alot of processes on every Un*x system need certain ports for inter-process communication (X is one of them) so turning off everything by default might get many customers upset. And since SuSE is cetainly not interrested in loosing a large customer base I can't imagine they will ever ship their distribution in such a 'secure' but for many people unusable default configuration. >-- >ciao >norb > Regards, Erwin

3 2

kernel 2.2 socket programming
by Heinrich Voggenreiter 22 Aug '00

22 Aug '00

Hello, maybe I'm wrong here. I have a queston on socket programming, I have read in the raw 7 manual page, in Linux 2.2 I can set all IP header fields using IP socket options, dont need a raw socket. Does anybody now what options I must use, maybe somebody have or knows where I can get an example. Best Regards H. Voggenreiter Network Admin / Hostmaster Bezirk Oberbayern Germany

2 1

Re: [suse-security] Command history
by omicron＠symonds.net 22 Aug '00

22 Aug '00

hi cant get the url . is there any alternative one ? regards cheedu On 16 Aug 2000, brian wrote: > > i've written a script that logs all the commands execurited by a > > user, his terminal, the time, the direcotry... i dont use the bash_history > > but the history itself. now the question is will the history be reliable, > > will it be moreuseful than .bash_history , will it be legal. also > > because the script is execurted as the user itself, i'm forced to append > > the command history to a file which has chattr +a attribute set. so the > > user can put anything in the file. any ideas to make it stealthy ?, btw, > > i'm using prompt_command varialble. > > There have been some good suggestions, though they'd be really easy to > get around (python, perl, running another shell on top of the current > one, etc). I'm not sure how much it logs, but there's a kernel module > (maybe it can be built-in now?) called exec.c, > http://home.xnet.com/~perly/exec.c . > > It logs stuff to kern.info like this: > EXECVE(UID)[PID]: program arg1 arg2 ... argN > > I'm guessing you could set up one of the alternate sysloggers to > sort out different users, etc. > > It works on the kernel level, so it'd be pretty hard to get around. > > -Brian > (patiently awaiting 400 billion I'm-on-vacation messages :) ) > -- ***** cogito cogito ergo cogito sum: i think that i think, therefore i think that i am. --Devils Dictionary --

1 0

back orifice...
by omicron＠pes.edu 22 Aug '00

22 Aug '00

hi what are back orifice and brown orifice.. i hear them so often that i dont know what they are. my apologies if it is a simple question Thanx cheedu -- ***** cogito cogito ergo cogito sum: i think that i think, therefore i think that i am. --Devils Dictionary --

2 2

Re: [suse-security] Command history (fwd)
by max 22 Aug '00

22 Aug '00

a much better thing to do if you really want to snoop on people is to get tty snoop, available at ftp://ftp.innet.be/pub/staff/carl/ttysnoop-0.12d.tar.gz description of ttysnoop: "TTYSnoop allows you to snoop on login tty's through another tty-device or pseudo-tty. The snoop-tty becomes a 'clone' of the original tty, redirecting both input and output from/to it." as far as the moral issues are concerned, your machine is your territory, and as long as that is clear to the users, you can snoop on them all you want. my motd says "this is a production machine. it is constantly monitored. and your presence, as well as all your actions on the system, are logged for security purposes." Max Gribov System Administrator Knowledge Propulsion Laboratories www.kplab.com On Wed, 16 Aug 2000, [ISO-8859-1] Peter M�nster wrote: > On Wed, 16 Aug 2000, Sridhar wrote: > > > i've written a script that logs all the commands execurited by a > > user, his terminal, the time, the direcotry... i dont use the bash_history > > but the history itself. now the question is will the history be reliable, > > will it be moreuseful than .bash_history , will it be legal. also > > because the script is execurted as the user itself, i'm forced to append > > the command history to a file which has chattr +a attribute set. so the > > user can put anything in the file. any ideas to make it stealthy ?, btw, > > i'm using prompt_command varialble. > > Hello cheedu (or Sridhar), > I don't know if this is legal, but some little thoughts about the other > points: > - a webcam behind the terminal (hidden of course) is also a very good > choice ;) > - who will read /tmp/comlog, you have already enough in /var/log > - if someone gets root and forgot to look into the environment (HISTFILE > etc), the you can get him just by his .bash_histfile. If he is > not too bad, he will delete his traces, all. > - you can execute commands also via a lot of applications (X-clients etc), > that don't leave traces like in histfile etc > > R�sum�: don't do it, it's not useful, and nobody likes the "Big Brother" > > Cheers, Peter > > -- > Peter M�nster > http://w3pm.stormloader.com/ > > *** Sign now: http://petition.eurolinux.org/ *** > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

2 1

how do i learn how to hack - for security checking
by tk dev 22 Aug '00

22 Aug '00

hi all i'm going to connect my server to the internet. b4 i do that, can anyone recommend to me some good firewalls- that's also easy to configure? anyway,how do i check that my server is secure enough? any hints or reference is much appreciated. thanks in advance. tk ===== 0Oo~~:o) Smile! You'r Alive!!! Q:What's peacefulness? A:What's confusion? Peacefulness is the end of confusion. o.0.Oo.o May there be peace in every step we take :o):tk __________________________________________________ Do You Yahoo!? Yahoo! Mail � Free email you can access from anywhere! http://mail.yahoo.com/

1 0

Would like more Security Packages : sendmail 8.11, INN 2.3.0, snort 1.6.3, nessus 1.0.4
by maillist.suse-security＠news.alcatel.fr 21 Aug '00

21 Aug '00

Hi, I like SuSe as a Network linux distribution but I really think that network and security packages should be updated more often : I would like to find RPM (or at least .spec files) for sendmail 8.11, INN 2.3.0, snort 1.6.3, nessus 1.0. and also for programs such as saint, netsaint, maildrop. I'm sure I'm not the only one who needs all that stuff. SL/

1 0

Command history
by Sridhar 21 Aug '00

21 Aug '00

hi i've written a script that logs all the commands execurited by a user, his terminal, the time, the direcotry... i dont use the bash_history but the history itself. now the question is will the history be reliable, will it be moreuseful than .bash_history , will it be legal. also because the script is execurted as the user itself, i'm forced to append the command history to a file which has chattr +a attribute set. so the user can put anything in the file. any ideas to make it stealthy ?, btw, i'm using prompt_command varialble. here's the script.. #!/bin/sh COMM=`history 1| awk '{ for(i=2;i<=NF;i++) { printf "%s ",$i } }'` echo "`date`:`tty`:$USER:$PWD:$COMM" >> /tmp/comlog should i make /etc/profile.local exec only ? cheers cheedu

6 6

sending and receiving secure smtp mail (encryption)
by Steven Thompson 21 Aug '00

21 Aug '00

Hi I would like to know what is the best method of sending and receiving encrypted smtp mail using Postfix, as the mail server. Thanks in advance Steven Thompson

2 1

LIDS & OPENWALL Combo kernel patch
by Steven Thompson 21 Aug '00

21 Aug '00

Hi SuSE recommends recompiling your kernel with the OpenWall Patch for firewall servers. Which is better LIDS or OpenWall or a Combination of both patches. Will the LIDS or OpenWall break any Apps in SuSE 6.4 PS Is there a good Linux Networking Mailing list with support for Advanced IP routing. Thanks in advance Steven Thompson

2 1

RE: [suse-security] LIDS & OPENWALL Combo kernel patch
by Steven Thompson 21 Aug '00

21 Aug '00

-----Original Message----- From: Roman Drahtmueller [mailto:draht@suse.de] Sent: 21 August 2000 05:05 To: Steven Thompson Cc: security(a)suse.de Subject: Re: [suse-security] LIDS & OPENWALL Combo kernel patch > > Hi > > SuSE recommends recompiling your kernel with the OpenWall Patch for firewall > servers. Who said that? # Copyright (c) 1999,2000 SuSE GmbH Nuernberg, Germany. All rights reserved. # # Author: Marc Heuse <marc(a)suse.de>, 1999,2000 # Please contact me directly if you find bugs. # # If you have problems getting this tool configures, please read this file # carefuly and take also a look into /usr/doc/packages/firewals/EXAMPLES ! # # /etc/rc.config.d/firewall.rc.config # # for use with /sbin/SuSEfirewall version 2.1 # # ------------------------------------------------------------------------ # # PLEASE NOTE THE FOLLOWING: # # Just by configuring these settings and using the SuSEfirewall you are # not secure per se! There is *not* such a thing you install and hence you # are safed from all (security) hazards. # # To ensure your security, you must also: # # * Secure all services you are offering to untrusted networks (internet) # You can do this by using software which has been designed with # security in mind (like postfix, apop3d, ssh), setting these up without # misconfiguration and praying, that they have got really no holes. # SuSEcompartment can help in most circumstances to reduce the risk. # * Do not run untrusted software. (philosophical question, can you trust # SuSE or any other software distributor?) # * Harden your server(s) with the harden_suse package/script # * Recompile your kernel with the openwall-linux kernel patch # (former secure-linux patch, from Solar Designer) www.openwall.com # * Check the security of your server(s) regulary # * If you are using this server as a firewall/bastion host to the internet # for an internal network, try to run proxy services for everything and # disable routing on this machine. # * If you run DNS on the firewall: disable untrusted zone transfers and # either don't allow access to it from the internet or run it split-brained. # # Good luck! # # Yours, # SuSE Security Team > Which is better LIDS or OpenWall or a Combination of both patches. > Will the LIDS or OpenWall break any Apps in SuSE 6.4 > > PS Is there a good Linux Networking Mailing list with support for Advanced > IP routing. > > Thanks in advance > > Steven Thompson > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

SSL, SSH and other Crypto stuff
by wilson＠claborn.net 21 Aug '00

21 Aug '00

Howdy, I'm needing a few things like ssh and mod_ssl for SuSE 6.4 - the things that are left out of the US version. I understand that they can't be included with the CD due to _export_ laws, but it's ok for me to download them into the US, for use in the US - right? So my question is, where's the proper place to get them from? I Can't find them on ftp.suse.com. (note: I'm looking specifically for the SuSE-made rpms, not just rpms in general Thanks, JW

8 8

Popper verbosity
by Jürgen Bloß 21 Aug '00

21 Aug '00

Hi. How can I stop the popper from logging every user access, even when the user did only check to see if there were any new mails. This seems hardly the kind of information that needs to be logged every time... Bye, Jürgen -- "Soap and education are not as sudden as a massacre, but they are more deadly in the long run." - Mark Twain

2 1

Netscape 4.75
by Stefan Suurmeijer 21 Aug '00

21 Aug '00

Hi all, has anybody seen/heard any confirmation from Netscape that the new release (4.75) has plugged the java security hole?? Through all this I have heard absolutely nothing from Netscape, either on Bugtraq or their web pages, no acknowledgement of the vulnerability, no news no nothing. In my book this makes them an early frontrunner for worst vulnerability handling of the year. Stefan

7 7

supplied firewall package robustness
by Jason P. Stanford 21 Aug '00

21 Aug '00

I have taken a recent and deep interest in network security since installing SuSE 6.4 and OpenBSD on some spare machines in my lab. Of late I have noticed a lot of (possibly) suspicious activity, which probably shouldn't be too suspicious in a university setting. However, I am wondering just how robust and "impervious" the firewal package supplied with SuSE is? I only have ssh listening (on default port 22) through the firewall and a test web server on port 8080 (under my regular user uid and gid with no scripting or cgi by default). All other running daemons/servers are blocked (assumedly) by the firewall. Also, everything is deactivated in /etc/inetd.conf. /etc/hosts.deny is set to ALL: ALL and /etc/hosts.allow is set to sshd: ALL. That's it. Am I pretty safe, or should I still be paranoid? BTW, the machine is not acting as a router or NATS box. It is standalone only. -Jason __________________________________________________ Do You Yahoo!? Send instant messages & get email alerts with Yahoo! Messenger. http://im.yahoo.com/

6 7

Re: [suse-security] problem to login by my isp
by Eilert Brinkmann 21 Aug '00

21 Aug '00

"Arndt Groll" <agroll(a)nsg.de> wrote: > Jul 31 14:47:44 Pingu4 kernel: Packet log: input DENY ppp0 PROTO=17 > 212.7.128.165:53 212.7.133.153:1028 L=169 S=0x00 I=2037 F=0x0000 T=61 (#129) [...] > my firewall deny port 53 pakets (domain) as i saw in the services file, in my > firewall itself i have insert the line (by the way: it was already insert by > Suse) > > FW_SERVICES_EXTERNAL_TCP="smtp domain" # Common: smtp domain > > but it do not work! The firewall deny the pakets like before! PROTO=17 means UDP, not TCP (that's protocol 6). So you have to permit incoming *UDP* packets from port 53. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0

problem to login by my isp
by Arndt Groll 21 Aug '00

21 Aug '00

if i try to connect my provider first, i get the following messages Jul 31 14:47:38 Pingu4 kernel: PPP BSD Compression module registered Jul 31 14:47:38 Pingu4 kernel: PPP Deflate Compression module registered Jul 31 14:47:44 Pingu4 kernel: Packet log: input DENY ppp0 PROTO=17 212.7.128.165:53 212.7.133.153:1028 L=169 S=0x00 I=2037 F=0x0000 T=61 (#129) Jul 31 14:48:04 Pingu4 kernel: Packet log: input DENY ppp0 PROTO=17 212.7.128.162:53 212.7.133.153:1028 L=169 S=0x00 I=59406 F=0x0000 T=62 (#129) Jul 31 15:15:43 Pingu4 kernel: Packet log: input DENY ppp0 PROTO=17 212.7.128.165:53 212.7.133.217:1028 L=167 S=0x00 I=31214 F=0x0000 T=61 (#133) if i drive my firewall-script down, then i get a connect and can login after that action i drive my firewall up and can start to work. my firewall deny port 53 pakets (domain) as i saw in the services file, in my firewall itself i have insert the line (by the way: it was already insert by Suse) FW_SERVICES_EXTERNAL_TCP="smtp domain" # Common: smtp domain but it do not work! The firewall deny the pakets like before! Every help will be recommend! Greetings Arndt Groll

2 1

crypt passwords
by Kurt Seifried 21 Aug '00

21 Aug '00

Salts: 4096 (64x64) Passwords input,,1,2,3,4,5,6,7,8,9 a-z,26,106496,2768896,71991296,1871773696,48666116096,1.26532E+12,3.28983E+1 3,8.55356E+14,2.22392E+16 "a-z, A-Z",52,212992,11075584,575930368,29948379136,1.55732E+12,8.09804E+13,4.2109 8E+15,2.18971E+17,1.13865E+19 "a-z, A-Z, 0-9",62,253952,15745024,976191488,60523872256,3.75248E+12,2.32654E+14,1.4424 5E+16,8.94321E+17,5.54479E+19 "a-z, A-Z, 0-9, shift0-9",72,294912,21233664,1528823808,1.10075E+11,7.92542E+12,5.7063E+14,4 .10854E+16,2.95815E+18,2.12987E+20 "a-z, A-Z, 0-9, shift0-9, punctuation",94,385024,36192256,3402072064,3.19795E+11,3.00607E+13,2.82571E+ 15,2.65616E+17,2.49679E+19,2.34699E+21 terrabyte: 1E+12,1E+12,1.06496E-07,2.7689E-06,7.19913E-05,0.001871774,0.048666116,1.265 319018,32.89829448,855.3556565,22239.24707 ,,2.12992E-07,1.10756E-05,0.00057593,0.029948379,1.557315715,80.98041718,421 0.981694,218971.0481,11386494.5 ,,2.53952E-07,1.5745E-05,0.000976191,0.060523872,3.75248008,232.653765,14424 .53343,894321.0725,55447906.49 ,,2.94912E-07,2.12337E-05,0.001528824,0.110075314,7.925422621,570.6304287,41 085.39087,2958148.142,212986666.2 ,,3.85024E-07,3.61923E-05,0.003402072,0.319794774,30.06070876,2825.706623,26 5616.4226,24967943.72,2346986710 So a password of 6 characters using only a-z would require ~1.2 terrabytes to store it, not to bad. A password of 6 characters with a-z, A-Z, 0-9 would require ~230 terrabytes (poetic license taken for database storage/indexes/compression/etc). The moral of the story: you need to protect the password file, since an attacker can glean the salt used from it, reducing their workload considerably (by a factor of 4096). You also need to make users choose strong passwords, if they choose a word you are probably up the creek, taking a dictionary with 4 million words (ie almost all words, names, etc, including foriegn languages) and you can hit a lot of passwords, tests I have seen usually 1-5% of passwords are set to the username, system default, or somehting like "password", meaning an attacker can get their foot in the door easily. The "problem" with crypt is it is relatively "cheap" to run through combinations/etc. MD5 and Blowfish provide a much stronger one way hash and the attacker will need a lot more time to generate a lookup database or brute force them. I.e. it mush less harmful if someone steals the /etc/shadow from my OpenBSD box (which uses blowfish) as opposed to a crypt'ed password file off a SuSE box. Now I need to eat breakfast. Kurt Seifried SecurityPortal, your focal point for security on the net http://www.securityportal.com/

3 3

Re: [suse-security] SSL, SSH and other Crypto stuff
by wilson＠claborn.net 21 Aug '00

21 Aug '00

I got ahold of someone at suse who said to get suse-made RPMs from the German SuSE Mirror: ftp.gwdg.de:/pub/linux/suse/6.4/i386.de/suse/sec1/ (please use a mirror of course :-) But they also said this: "The answer I got back from the tech folks is that it is NOT legal for you to install and use packages containing crypto, except for those that are licensed from RSA." I'm not sure about the "Licensed from RSA" part - I know you have to but certificates for SSl (or something like that ;-) But I _know_ I've seen it written on SuSE's site somewhere that the reason the US CDs don't have Crypto is because, it's the US co that handles international orders, and so they wouldn't be able to ship the "stock" US SuSE distro out of the US with Crypto in it. Personally I think that's totally crazy - if the German Co would handle the International orders, then both the US people and the internationals would be able to have crypto (the ONLY problem I know of is that it's not legal to ship crypto _out_ of the US - I don't think other Countries have a problem importing it - not many anyway). The way it's set up now, both the US customers and the international customers don't get crypto, for no other reason then because SuSE has the US Division handling International orders. Makes me shake my head - is there a lack of CD burners in Germany? :-) Since it's the US that has the silly laws I think it would make a lot more sense to have suse.de handle they international stuff. Maybe Germany has laws that are as screwy as the US, I dunno.. My response + $.02 At 01:26 PM 8/20/2000 -0400, you wrote: >On Fri, 18 Aug 2000, Jonathan Wilson wrote: > > > > > I'm needing a few things like ssh and mod_ssl for SuSE 6.4 - the things > > that are left out of the US version. > > > > I understand that they can't be included with the CD due to _export_ laws, > > but it's ok for me to download them into the US, for use in the US - > right? > > So my question is, where's the proper place to get them from? I Can't find > > them on ftp.suse.com. > > > > (note: I'm looking specifically for the SuSE-made rpms, not just rpms in > > general > > > > SSH and openssh are available in the US for Unix and Win > machines from: > ftp://ftp.cis.fed.gov/pub/ or > ftp://metalab.unc.edu/pub/packages/security/ > There are various tar.gz and rpm files there. > Building ssh from the tarballs is extremely easy. > There is a list of worldwide mirrors for ssh at: > http://www.ssh.com/products/ssh/download.html > There is a licence required for commercial use of ssh. > >I don't understand why SuSE do not have (open)ssh on their US CD's as >the program is freely downloadable in the US and I have to go to metalab >and get it each time I install a new SuSE version. Maybe it's the licence >and not the laws. SuSE guys?? > > I believe openssh, openssl, mod_ssl and ssh are all downloadable > as SuSE rpms from: > ftp://ftp.gwdg.de/pub/linux/suse/6.4/i386.de/suse/sec1/ > >Regards, > > > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] Fwd: CERT Advisory CA-2000-17
by Volker Kuhlmann 20 Aug '00

20 Aug '00

> "No patches issued, but they have said they are working on: > > Netscape > knfsd" > > knfsd aka rpc.statd. So yeah SuSE should be releasing a fix. (ANYTIME NOW! > NO RUSH! ;) Ehm, a (the??) new package appeared on the ftp server on 10 Aug (10 days ago): knfsd-991001-133.i386.rpm (this was in the 6.3 updates) Volker

2 1

Re: [suse-security] Re: supplied firewall package robustness
by Jason P. Stanford 19 Aug '00

19 Aug '00

Who are you calling paranoid??? :) BTW, this begs another question. If I notice "strange things" happening, should I notify someone? Ie. I keep getting pings, scans and connects to ports 21,23,53 (ftp,telnet,dns, none of which are used on my system) from the same 4-5 locations. Should I attempt to notify someone in those domains? I would suspec that in those domains, some non-hardened linux install has been compromised and is being used as a base for "recon" scans. Or am I just being paranoid and jumping the gun? Also, since I'm such a newbie to network security what are other good sources of hard data, info, etc? Thanks. -Jason --- Hubert Mantel <mantel(a)suse.de> wrote: > Hi, > > On Fri, Aug 18, Jason P. Stanford wrote: > > > I have taken a recent and deep interest in network security since > installing > > SuSE 6.4 and OpenBSD on some spare machines in my lab. Of late I have > noticed a > > lot of (possibly) suspicious activity, which probably shouldn't be too > > suspicious in a university setting. However, I am wondering just how robust > and > > "impervious" the firewal package supplied with SuSE is? > > I only have ssh listening (on default port 22) through the firewall and a > > test web server on port 8080 (under my regular user uid and gid with no > > scripting or cgi by default). All other running daemons/servers are blocked > > (assumedly) by the firewall. > > Also, everything is deactivated in /etc/inetd.conf. /etc/hosts.deny is > set to > > ALL: ALL and /etc/hosts.allow is set to sshd: ALL. That's it. Am I pretty > safe, > > or should I still be paranoid? BTW, the machine is not acting as a router > or > > NATS box. It is standalone only. > > Given the firewall is setup properly, it sounds quite good. But even with > the best firewall, you should always be paranoid. Only the paranoid will > survive ;) > > > -Jason > -o) > Hubert Mantel Goodbye, dots... /\\ > _\_v > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > __________________________________________________ Do You Yahoo!? Yahoo! Mail � Free email you can access from anywhere! http://mail.yahoo.com/

2 1