January 2001 - openSUSE Security - openSUSE Mailing Lists

Martian source
by Togan Muftuoglu 12 Jan '01

12 Jan '01

hi everyone, I had the following info in my log files. IIRC martian source is something it should not come from there but it dit. however I happen to be unable tofind info to understand more about the martian source can someone point me some documentation and in the mean time should I wory about these ? Jan 12 12:49:59 isguzar kernel: martian source 3801a8c0 for 550439d4, dev ppp0 Jan 12 12:49:59 isguzar kernel: ll header: 45 00 03 da Jan 12 12:50:05 isguzar kernel: martian source 3801a8c0 for 550439d4, dev ppp0 Jan 12 12:50:05 isguzar kernel: ll header: 45 00 03 da Jan 12 12:50:27 isguzar kernel: martian source 3801a8c0 for 550439d4, dev ppp0 Jan 12 12:50:27 isguzar kernel: ll header: 45 00 03 da Jan 12 12:50:45 isguzar kernel: martian source 3801a8c0 for 550439d4, dev ppp0 Jan 12 12:50:45 isguzar kernel: ll header: 45 00 03 da Jan 12 12:51:37 isguzar kernel: martian source 3801a8c0 for 550439d4, dev ppp0 Jan 12 12:51:37 isguzar kernel: ll header: 45 00 03 da -- Togan Muftuoglu

1 0

POP3/IMAP with TLS/SSL; UW-IMAP-2000
by Tobias Burnus 11 Jan '01

11 Jan '01

Hi, a) which programs do you recommend for POP3 and IMAP which are capable to do TLS/SSL? I looked at Qualcom's popper, but 3.1 doesn't have it and 4 is to expensive ($300/CPU) and Cyrus IMAP server doesn't seem to support it. I saw that http://www.washington.edu/imap/ has a imap server which seems to support it. Has anyone any experience with it? b) Will SuSE 7.1 include a uw-imap.rpm (UW-IMAP-2000)? Tobias PS: We have still a pop2 server running, is there any program which still requires (or support) it? (If not, we will close a port.) -- This above all: To thine own self be true / And it must follow as the night the day / Thou canst not then be false to any man.

4 3

SuSE Firewall: looking for a control who can connect from internal net to the internet
by Christoph Haas 11 Jan '01

11 Jan '01

Hello! I'm looking for a way to configure my SuSE 7.0-firewall-script (v2.6), that I can control which IP-address is allowed to get through to the internet. If I configure 'FW_MASQUERADE=yes' and 'FW_MASQ_NETS="172.16.0.0/255.255.0.0" ', every machine of the 172.16.x.x-net is able to connect to the internet. But I need to allow certain IP-addresses internet and other IP-addresses of the same (sub)net mustn't be able to do so. If possible it should be configurable in an external file. Any hints? TIA Christoph. ,,, (o o) +--------------------------oOO--(_)--OOo----------------------------+ | Christoph Haas | | Linux User #99546 | | email: christoph(a)haas.net | +-------------------------------------------------------------------+

2 1

wrong date with last command
by dany allard 11 Jan '01

11 Jan '01

I use the last and lastb command to see what accounts have been logged into and to see if there is any unusual logins. The date and time for FTP and console logins are correct, but for telnet and ssh logins the date show up as username pts/3 Thu Jan 1 00:00 is there a way to fix this? did someone change something? using Suse 6.4 thanks Dany Allard

1 0

Re: [suse-security] Deny ippp0, Firewall has blocked!
by uwe_kersten＠t-online.de 11 Jan '01

11 Jan '01

Am Donnerstag, 11. Januar 2001 13:40 schrieben Sie: > Uwe Kersten: > > I am a newbie to this stuff, but I think it was a udp request from port > > 23116 of IP 195.126.154..134 (I looked up RIPE for this address) to > > Port 6970 of my (dyn.) IP. This took about 5 minutes, till it ended. L > > changed between 602 and 611. So what? Should I investigate more > > about this case, what happened, do I have to worry? > > Think. > > You have a dynamic IP. > > What would happen if you get the same number as another user, who tried to > access a resource on another server, and got cut off just before you dialed > in? > > Peter Hi Peter! Dynamic IP is rather relative when you have a flat rate, when you use a dynamic dns service etc. I am a little worried because at the time the firewall blocked I did some e-commerce (bought a Music CD). And I was online with this IP for hours and hours. Strange thing Uwe

1 0

Deny ippp0, Firewall has blocked!
by uwe_kersten＠t-online.de 11 Jan '01

11 Jan '01

Hi Folks! This night I started my first firewall script and no I find something interesting in my log file. I am not sure wether I understand right what has happened. So here is the entry: Jan 11 11:36:15 linux kernel: Packet log: input DENY ippp0 PROTO=17 195.126.154.134:23116 217.0.41.97:6970 L=611 S=0x00 I=33417 F=0x0000 T=119 (#76) I am a newbie to this stuff, but I think it was a udp request from port 23116 of IP 195.126.154..134 (I looked up RIPE for this address) to Port 6970 of my (dyn.) IP. This took about 5 minutes, till it ended. L changed between 602 and 611. So what? Should I investigate more about this case, what happened, do I have to worry? Thanks and regards Uwe

1 0

Traffic Shaping
by Markus Gaugusch 11 Jan '01

11 Jan '01

I'd like to implement a traffic shaper on some of my firewalls to prevent over-use (and to have a useable ssh connection even if all people are downloading like crazy ;-) I read the Advanced Routing Howto, but it's incomplete and some numbers are not explained, so I don't know how to change them for my setup. Has anyone here ever configured a traffic shaper (QoS, iproute2, ...) and can post a script or something to the list? I need it mostly for cable and ISDN connections. Thank you very much Markus Gaugusch -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

2 1

2.4.0 kernel firewalling
by Daniel Curry 11 Jan '01

11 Jan '01

Is there a how to for setting up IPTables? I am testing the 2.4.0 kernel and am interested in setting up IPTables. Directions, links and personal experience/commentaries would be appreciated. Thanks Daniel Curry

3 2

Doorgest.: Re: major security bug in reiserfs (may affect SuSE Linux)
by Dave Woutersen 11 Jan '01

11 Jan '01

More info.....

1 0

RE: [suse-security] Email behaviour
by dg＠pinck.ch 11 Jan '01

11 Jan '01

Raffy wrote: >> 137/TCP is the NETBIOS Name Service. So the remote mailserver might be >> a (misconfigured?) Windows-Box. >> >> It's nothing dangerous, AFAIK. > >But is this a thing one can configure or not? I would rather advise that >admin to stop doing so than doing nothing. It will not help you. What about simply denying NETBIOS? When I put my firewall online, the first probe I always get (within 30s) is 137/TCP NETBIOS. It comes from an address resolving in xyz.BROADCAST.MICROSOFT.it or equivalent (quoting from memory) All the best. -- Denis

1 0