September 2000 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] scanner
by Toralf Kühn 26 Sep '00

26 Sep '00

try nessus! regards toralf -----Ursprüngliche Nachricht----- Von: Philipp Snizek [mailto:mailinglist@bluewin.ch] Gesendet: Dienstag, 26. September 2000 11:15 An: suse-security(a)suse.com Betreff: [suse-security] scanner Hi all Does anybody know about a more powerful scanner than nmap? I need it to scan my own firewall. Thanx a lot Philipp Snizek --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

4 3

Administrativa: Moderation
by Roman Drahtmueller 26 Sep '00

26 Sep '00

suse-security-readers, I have received the last responses to my request for comments about a moderation of this list by the end of the week before last week. Here are the results of what I've read: 91 people have stated their opinion, where 49 were against moderation and 30 wanted moderation. The rest commented the idea with productive critizism, thereby covering much more than I thought of in the beginning ("What if..."-cases.). The most frequent reasons to vote for a moderation were noise reduction and focussing on the actual subject of the list, thereby minimizing friction that appears if information is posted redundantly. Only one person mentioned spam, but I believe the whole rest considers this self-evident. The most frequent reasons against a moderation were the drastically increased latency of the list. Even if somebody is online who can approve postings in an average time of 30 minutes, the latency is very high, and contributors might watch themselves writing beautiful answers that were redundant because another posting got through before. (Besides, the personnel question on behalf of SuSE wasn't resolved yet, too.) I wouldn't be able to tell how much time would pass until a posting gets approved on weekends. I take it as a compliment that nobody worried about censorship. :-) Sometimes traffic gets more, and it reduces again after a while. Spam was not an issue lately. We've seen very productive postings as well as meaningless comments on the list. Reading the less informative postings is a very fast thing to do once you're used to it: "D". If there aren't any very serious complaints, I'd like to postpone the question about moderation. Maybe we can discuss it again some time in spring 2001. In the meanwhile I hope that the suse-security list will continue (and even improve) to be as informative and productive as it is right now. Thank you all for the responses, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

What does this packet log message mean?
by Sven Schultheiß 26 Sep '00

26 Sep '00

Hello! I build a linux firewall with SuSE linux and ipchains. I've set up rules for FTP and SSH. (Firewall 201.0.0.1, Server wich provides FTP and ssh (also a Linux box)200.0.0.1, local net 192.168.2.0/24) Every time when I try to do ssh or FTP to another host outside my local net, I see in my log files something like: kernel: Packet log: eth1-i DENY eth1 PROTO=6 200.0.0.1:1043 201.0.0.1:113 L=60 S=0x00 I=152 F=0x4000 T=64 SYN (#5) and kernel: Packet log: eth1-o DENY eth1 PROTO=6 201.0.0.1:113 200.0.0.1:1044 L=40 S=0x00 I=888 F=0x0000 T=255 (#2) Does anybody know what causes this traffic? Sven

3 2

Re: [suse-security] scanner
by bacano＠esoterica.pt 26 Sep '00

26 Sep '00

Hi2all If the point is testing your firewall, take a look at this two links: http://www.kyuzz.org/antirez/hping/ http://www.dataprotect.com/bh2000/ [ ]'s bacano --------------------------------------------- Esta mensagem foi enviada usando o WebPOP II. http://www.via-net-works.pt/email

1 0

AW: [suse-security] scanner
by Bauer, Juergen 26 Sep '00

26 Sep '00

hi philipp, to test your new firewall config you can also use firewalk. http://www.packetfactory.net/firewalk/ by, jb -----Ursprüngliche Nachricht----- Von: Kurt Seifried [mailto:listuser@seifried.org] Gesendet: Dienstag, 26. September 2000 11:42 An: Toralf Kühn; 'Philipp Snizek'; suse-security(a)suse.com Betreff: Re: [suse-security] scanner ok a serious reply: Title: Network based security scanners KBTAG: URL: http://www.securityportal.com/lskb/10000050/.html Date created: 17/07/2000 Date modified: Date removed: Authors(s): Kurt Seifried seifried(a)securityportal.com Topic: Network based security scanners Keywords: Network Summary: Scanning networks for problems is a quick way to build up a list of problems that need fixing, and for tracking the "health" of your network. Intrusion scanners are one evolutionary step up from network scanners. These software packages will actually identify vulnerabilities, and in some cases allow you to actively try and exploit them. If your machines are susceptible to these attacks, you need to start fixing things, as any attacker can get these programs and use them. More information: Nessus Nessus is relatively new but is fast shaping up to be one of the best intrusion scanning tools. It has a client/server architecture, the server currently runs on Linux, FreeBSD, NetBSD and Solaris, clients are available for Linux, Windows and there is a Java client. Communication between the server and client is ciphered for added security all in all a very slick piece of code. Nessus supports port scanning, and attacking, based on IP addresses or host name(s). It can also search through network DNS information and attack related hosts at your bequest. Nessus is relatively slow in attack mode, which is hardly surprising. However it currently has over 200 attacks and a plug-in language so you can write your own. Nessus is available from http://www.nessus.org/. Saint Saint is the sequel to Satan, a network security scanner made (in)famous by the media a few years ago (there were great worries that bad people would take over the Internet using it). Saint also uses a client/server architecture, but uses a www interface instead of a client program. Saint produces very easy to read and understand output, with security problems graded by priority (although not always correctly) and also supports add-in scanning modules making it very flexible. Saint is available from: http://www.wwdsi.com/saint/. Cheops While not a scanner per se, it is useful for detecting a hosts OS and dealing with a large number of hosts quickly. Cheops is a "network neighborhood" on steroids, it builds a picture of a domain, or IP block, what hosts are running and so on. It is extremely useful for preparing an initial scan as you can locate interesting items (HP printers, Ascend routers, etc) quickly. Cheops is available at: http://www.marko.net/cheops/. Ftpcheck / Relaycheck Two simple utilities that scan for ftp servers and mail servers that allow relaying, good for keeping tabs on naughty users installing services they shouldn't (or simply misconfiguring them), available from: http://david.weekly.org/code/. SARA Security Auditor's Research Assistant (SARA) is a tool similar in function to SATAN and Saint. SARA supports multiple threads for faster scans, stores it's data in a database for ease of access and generates nice HTML reports. SARA is free for use and is available from: http://home.arc.com/sara/. BASS BASS is the "Bulk Auditing Security Scanner" allows you to scan the internet for a variety of well known exploits. It was basically a proof of concept that the Internet is not secure. You can get it from: http://www.securityfocus.com/data/tools/network/bass-1.0.7.tar.gz Title: Network host scanning KBTAG: kben10000058 URL: http://www.securityportal.com/lskb/10000050/kben10000058.html Date created: 17/07/2000 Date modified: 24/08/2000 Date removed: Authors(s): Kurt Seifried seifried(a)securityportal.com Topic: Network host scanning Keywords: Network Summary: There are a number of tools to scan remote systems and identify whether they are connected or not, what OS they are running, and which services. More information: Network scanners Network scanners are run from a host and pound away on other machines, looking for open services. If you can find them, chances are an attacker can to. These are generally very useful for ensuring your firewall works. Strobe Strobe is one of the older port scanning tools, quite simply it attempts to connect to various ports on a machine(s) and reports back the result (if any). It is simple to use and very fast, but doesn't have any of the features newer port scanners have. Strobe is available for almost all distributions as part of it, or as a contrib package, the source is available at: ftp://suburbia.net/pub/. Nmap Nmap is a newer and much more fully-featured host scanning tool. It features advanced techniques such as TCP-IP fingerprinting, a method by which the returned TCP-IP packets are examined and the host OS is deduced based on various quirks present in all TCP-IP stacks. Nmap also supports a number of scanning methods from normal TCP scans (simply trying to open a connection as normal) to stealth scanning and half-open SYN scans (great for crashing unstable TCP-IP stacks). This is arguably one of the best port scanning programs available, commercial or otherwise. Nmap is available at: http://www.insecure.org/nmap/index.html. There is also an interesting article available at: http://raven.genome.washington.edu/security/nmap.txt on nmap and using some of it's more advanced features. Rnmap Remote nmap (Rnmap) is a pair of client and server programs which allow for various authorised clients to run their port scans from a centralised server. http://rnmap.sourceforge.net/ Network Superscanner http://members.tripod.de/linux_progz/ Portscanner Portscanner is a nice little portscanner (surprise!) that has varying levels of outputs making it easy to use in scripts and by humans. It's OpenSource and free to use, you can get it at: http://www.ameth.org/~veilleux/portscan.html. Queso Queso isn't a scanner per se but it will tell you with a pretty good degree of accuracy what OS a remote host is running. Using a variety of valid and invalid tcp packets to probe the remote host it checks the response against a list of known responses for various operating systems, and will tell you which OS the remote end is running. You can get Queso from: http://www.apostols.org/projectz/queso/. spidermap spidermap is a set of Perl scripts to help automate scans and make them more selective. You can get it from: http://www.secureaustin.com/spidermap/. --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

AW: [suse-security] Suse-Firewall is too secure
by Stiefenhofer, Marek ECOFIS 26 Sep '00

26 Sep '00

Hi, you can't assign the IP-Adress x.y.z.255 to a host. In most cases this is the broadcast address of the network x.y.z/24. The log messages indicates a deny for broadcasting to port 138 - which is usually NETBIOS-Datagrams. Broadcasting is a common mechanism to send IP-Packets to all hosts in a certain network. As far as I know, NETBIOS uses broadcasts to build the browsing lists, elect the master browser and so on... I'm not very common to SuSE-Firewall but the log message indicates the denial of NETBIOS-Broadcasts - which is not a bad idea - as most people don't want to let NETBIOS through their Firewalls. The question is - indicates this log message the event, where the machine hangs - or was it just coincidence? Which service generates NETBIOS-Traffic (SAMBA?)... Kind regards Marek Stiefenhofer (Team Network Services / Security) ECOFIS Wirschaftsinformationen GmbH Tel.: (02 31) 75 45-1 17 FAX : (02 31) 75 45-2 22 e-mail: m.stiefenhofer(a)ecofis.de Wir sind vom 6. bis 10. November auf der SYSTEMS 2000. Vereinbaren Sie einen Termin oder kommen Sie einfach spontan vorbei. ECOFIS GmbH: Halle B3 113/214 | ComNetMedia AG: Halle B3 314 Besuchen Sie auch unseren neuen Online-Dienst: http://www.alleco.de -----Ursprüngliche Nachricht----- Von: Martin Mielke [mailto:martinm@people-com.com] Gesendet am: Dienstag, 26. September 2000 09:58 An: 'Christian Kuhn'; suse-security(a)suse.com Betreff: RE: [suse-security] Suse-Firewall is too secure Hallo, [snip] > When rebooting (with rescue disk, changing FW_START in > /etc/rc.config) without firewall, but with masquerading, everything > worked fine. After manually starting firewall, i found in log a > deny for 192.168.2.2:138 (what is the firewall) to > 192.168.2.255:138, what i do not understand. > do you have a .255 IP address??? bad thing indeed! Surelly there is something like '(#n)' (without the qotes) in /var/log/messages, where 'n' is the number of the rule that caused the log message. Please, post the complete error message line... MfG, Martin --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

RE: [suse-security] Suse-Firewall is too secure
by Martin Mielke 26 Sep '00

26 Sep '00

Hallo, [snip] > When rebooting (with rescue disk, changing FW_START in > /etc/rc.config) without firewall, but with masquerading, everything > worked fine. After manually starting firewall, i found in log a > deny for 192.168.2.2:138 (what is the firewall) to > 192.168.2.255:138, what i do not understand. > do you have a .255 IP address??? bad thing indeed! Surelly there is something like '(#n)' (without the qotes) in /var/log/messages, where 'n' is the number of the rule that caused the log message. Please, post the complete error message line... MfG, Martin

2 1

Lost rules!?!?
by Martin Mielke 26 Sep '00

26 Sep '00

Dear all, our firewall runs just fine under SuSE 6.4 but since some days ago it has a strange behaviour. On a Solaris 8 box there's a cronjob running every 5-10 minutes to download some stuff via FTP. The ip_masq_ftp module is loaded, the ftp and ftp-data ports are MASQueraded and it's possible to have a normal ftp session with remote sites... BUT for some reason, it seems that the rules "freeze" somehow. In that state, a simple 'ls' produces an error, the ftp-data never reaches its end and a lot of ftp sessions are stuck in the process' table. The most important is that there are not rejected/denied packets, otherwise they would be logged. Any ideas about what could be going on??? Thanks, Martin

1 0

RE: [suse-security] stateful inspection for ipchains
by Bauer, Juergen 26 Sep '00

26 Sep '00

hi folks, some time ago i ownloaded spf (stateful packet filter) for ipchains from freshmeat: http://freshmeat.net/projects/spf/ i never had the time to test it. has somebody experience with this package ??? by, jb -----Ursprüngliche Nachricht----- Von: Philipp Snizek [mailto:mailinglist@bluewin.ch] Gesendet: Dienstag, 26. September 2000 08:34 An: suse-security(a)suse.com Betreff: [suse-security] stateful inspection for ipchains Wichtigkeit: Hoch Hi2all does there exist a package which supports stateful inspection for ipchains ? If yes, where? thanx Philipp --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

RE: [suse-security] stateful inspection for ipchains
by Philipp Snizek 26 Sep '00

26 Sep '00

Hi Juergen Thanks a lot. this is what I wanted to know - Philipp hi folks, some time ago i ownloaded spf (stateful packet filter) for ipchains from freshmeat: http://freshmeat.net/projects/spf/ i never had the time to test it. has somebody experience with this package ??? by, jb -----Ursprüngliche Nachricht----- Von: Philipp Snizek [mailto:mailinglist@bluewin.ch] Gesendet: Dienstag, 26. September 2000 08:34 An: suse-security(a)suse.com Betreff: [suse-security] stateful inspection for ipchains Wichtigkeit: Hoch Hi2all does there exist a package which supports stateful inspection for ipchains ? If yes, where? thanx Philipp

1 0