January 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] IPChains Question.
by Widmann Thomas 09 Jan '01

09 Jan '01

Hi ! * Daniel Curry wrote: >I have a windows box behind my IPChains firewall. I need to use the VPN >software for my office from behind the firewall. I have spoken with the VPN >solution provider and they have no information for making their software >work with a linux based firewall. They also told me I need to do not port >forwarding, but instead, I must do protocol forwarding. Does anyone know >how to do this? Can I use IPChains for protocol forwarding? Try using FreeS/WAN. This is an IPSEC/VPN Software for Linux ;-) http://www.freeswan.org This Package is also included in the SuSE Distributions. ciao Thomas

1 0

IPChains Question.
by Daniel Curry 09 Jan '01

09 Jan '01

I have a windows box behind my IPChains firewall. I need to use the VPN software for my office from behind the firewall. I have spoken with the VPN solution provider and they have no information for making their software work with a linux based firewall. They also told me I need to do not port forwarding, but instead, I must do protocol forwarding. Does anyone know how to do this? Can I use IPChains for protocol forwarding? Thanks Daniel Curry.

1 0

problem tunneling via ssh
by linux＠actionbusinesssystems.com 09 Jan '01

09 Jan '01

Howdy. I am having a little problem here. I was able to tunnel vnc and other things via ssh by enabling port-forwarding, but now I can't. About the only thing I can think of is perhaps this ability was nixed after I ran harden_suse. Anyone run up against this before? Thanks :) Joey Kelly System & Network Administrator ActionBusinessSystems.com && Gimme this! Gimme that! Hurry up or I'll knock you flat!

1 0

Re: [suse-security] Intrusion detection?
by Nix 09 Jan '01

09 Jan '01

At 09:25 PM 6/01/2001 +0000, you wrote: >Thomas, >Can you advice us a IDS that dont suck? >I just use Linux at home so I'll probably keep using many things that suck, >at least for try to learning how they suck, but others may need to know >other IDS apps, for corporate use. >http://website.lineone.net/~offthecuff/HIDS.htm >(http://www.networkintrusion.co.uk) > >btw ... also many commercial stuff suck, in this case vulnerability >scanners: http://www.nwc.com/1201/1201f1b1.html IMHO IDS systems are close to worthless. At best they lets you know that you have already been broken into, at worst, they breed a dangerous false sense of security. As a greater percentage of network traffic is being encrypted every day, and an IDS cannot "see" into encrypted traffic, it means that your IDS has a huge blind-spot. This is only going to get worse. Test out any of the IIS exploits if you don't believe me (the unicode exploit is a good example because it works against IIS4 and IIS5) this exploit will sail straight past your IDS without raising a murmur, allow you to execute arbitrary programs on the target machine, and even download the servers Private SSL key. FUN! Cheers -Nix -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking

4 3

AW: [suse-security] spam??
by Stiefenhofer, Marek ECOFIS 09 Jan '01

09 Jan '01

-----Ursprüngliche Nachricht----- Von: Philipp Snizek [mailto:mailinglists@belfin.ch] Gesendet am: Dienstag, 9. Januar 2001 11:42 An: suse-security(a)suse.com Betreff: [suse-security] spam?? Jan 9 11:32:50 mail sendmail[7407]: f09AWoJ07407: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com Jan 9 11:32:52 mail sendmail[7406]: f09AWgJ07404: to=<bdaddy5985(a)aol.com>,<miagi3(a)aol.com>,<kjustin316(a)aol.com>,<kjusticef@aol .com>,<epfoxfire(a)aol.com>,<miagi33362(a)aol.com>, delay=00:00:10, xdelay=00:00:03, mailer=esmtp, pri=282539, relay=yh.mx.aol.com. Someone (solutionsnet.com) seems to be using your mailserver (mail.belfin.ch) to send mail to aol customers. In case you're not mail-provider for solutionsnet.com this is indeed spamming. You should configure/upgrade your sendmail to relay only for certain hosts/domains/ip-ranges. Regards, Marek

1 0

spam?
by Philipp Snizek 09 Jan '01

09 Jan '01

Hi all Can somebody tell me whether my mail server is spammed? Here's an exculusion from my log (which has grown damn quick during the past hours). Jan 9 11:32:50 mail sendmail[7407]: f09AWoJ07407: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com Jan 9 11:32:52 mail sendmail[7406]: f09AWgJ07404: to=<bdaddy5985(a)aol.com>,<miagi3(a)aol.com>,<kjustin316(a)aol.com>,<kjusticef@aol .com>,<epfoxfire(a)aol.com>,<miagi33362(a)aol.com>, delay=00:00:10, xdelay=00:00:03, mailer=esmtp, pri=282539, relay=yh.mx.aol.com. [205.188.157.4], dsn=2.0.0, stat=Sent (OK) Jan 9 11:32:57 mail sendmail[7407]: f09AWoJ07407: from=<cormier24(a)solutionsnets.com>, size=12532, class=0, nrcpts=6, msgid=<rdctqywvs.1fhg8w6ibb0yp(a)mx19.solutionsnets.com>, proto=SMTP, daemon=MTA, relay=[63.57.179.121] Jan 9 11:32:58 mail sendmail[7415]: f09AWwJ07415: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com Jan 9 11:33:00 mail sendmail[7414]: f09AWoJ07407: to=<thhhth(a)aol.com>,<aalyahya(a)aol.com>,<epfp(a)aol.com>,<comishintn(a)aol.com>,< miagi407(a)aol.com>,<kjustin99(a)aol.com>, delay=00:00:10, xdelay=00:00:03, mailer=esmtp, pri=282532, relay=yd.mx.aol.com. [205.188.156.163], dsn=2.0.0, stat=Sent (OK) Jan 9 11:33:05 mail sendmail[7415]: f09AWwJ07415: from=<mikee60079(a)solutionsnets.com>, size=12535, class=0, nrcpts=6, msgid=<rdctqywvs.1fhg8w6ibb0yp(a)mx19.solutionsnets.com>, proto=SMTP, daemon=MTA, relay=[63.57.179.121] Jan 9 11:33:06 mail sendmail[7436]: f09AX6J07436: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com Jan 9 11:33:10 mail sendmail[7434]: f09AWwJ07415: to=<idiot19909(a)aol.com>,<epfpcg(a)aol.com>,<thhi0570(a)aol.com>,<thhhwaack(a)aol.c om>,<kjustin(a)aol.com>,<idiot1983(a)aol.com>, delay=00:00:12, xdelay=00:00:05, mailer=esmtp, pri=282535, relay=xb.mx.aol.com. [64.12.136.89], dsn=2.0.0, stat=Sent (OK) Jan 9 11:33:10 mail sendmail[7391]: f09AWNJ07378: to=<miagi24(a)aol.com>,<aalyahlvr(a)aol.com>,<miagi2330(a)aol.com>,<idiot196(a)aol.c om>,<epfourtish(a)aol.com>,<idiot1836(a)aol.com>, delay=00:00:47, xdelay=00:00:38, mailer=esmtp, pri=282542, relay=xb.mx.aol.com. [64.12.136.89], dsn=2.0.0, stat=Sent (OK) Jan 9 11:33:14 mail sendmail[7436]: f09AX6J07436: from=<mikee60369(a)solutionsnets.com>, size=12531, class=0, nrcpts=6, msgid=<rdctqywvs.1fhg8w6ibb0yp(a)mx19.solutionsnets.com>, proto=SMTP, daemon=MTA, relay=[63.57.179.121] Jan 9 11:33:15 mail sendmail[7441]: f09AXFJ07441: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com TIA Philipp

1 0

spam??
by Philipp Snizek 09 Jan '01

09 Jan '01

Hi all Can somebody tell me whether my mail server is spammed? Here's an exculusion from my log (which has grown damn quick during the past hours). Jan 9 11:32:50 mail sendmail[7407]: f09AWoJ07407: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com Jan 9 11:32:52 mail sendmail[7406]: f09AWgJ07404: to=<bdaddy5985(a)aol.com>,<miagi3(a)aol.com>,<kjustin316(a)aol.com>,<kjusticef@aol .com>,<epfoxfire(a)aol.com>,<miagi33362(a)aol.com>, delay=00:00:10, xdelay=00:00:03, mailer=esmtp, pri=282539, relay=yh.mx.aol.com. [205.188.157.4], dsn=2.0.0, stat=Sent (OK) Jan 9 11:32:57 mail sendmail[7407]: f09AWoJ07407: from=<cormier24(a)solutionsnets.com>, size=12532, class=0, nrcpts=6, msgid=<rdctqywvs.1fhg8w6ibb0yp(a)mx19.solutionsnets.com>, proto=SMTP, daemon=MTA, relay=[63.57.179.121] Jan 9 11:32:58 mail sendmail[7415]: f09AWwJ07415: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com Jan 9 11:33:00 mail sendmail[7414]: f09AWoJ07407: to=<thhhth(a)aol.com>,<aalyahya(a)aol.com>,<epfp(a)aol.com>,<comishintn(a)aol.com>,< miagi407(a)aol.com>,<kjustin99(a)aol.com>, delay=00:00:10, xdelay=00:00:03, mailer=esmtp, pri=282532, relay=yd.mx.aol.com. [205.188.156.163], dsn=2.0.0, stat=Sent (OK) Jan 9 11:33:05 mail sendmail[7415]: f09AWwJ07415: from=<mikee60079(a)solutionsnets.com>, size=12535, class=0, nrcpts=6, msgid=<rdctqywvs.1fhg8w6ibb0yp(a)mx19.solutionsnets.com>, proto=SMTP, daemon=MTA, relay=[63.57.179.121] Jan 9 11:33:06 mail sendmail[7436]: f09AX6J07436: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com Jan 9 11:33:10 mail sendmail[7434]: f09AWwJ07415: to=<idiot19909(a)aol.com>,<epfpcg(a)aol.com>,<thhi0570(a)aol.com>,<thhhwaack(a)aol.c om>,<kjustin(a)aol.com>,<idiot1983(a)aol.com>, delay=00:00:12, xdelay=00:00:05, mailer=esmtp, pri=282535, relay=xb.mx.aol.com. [64.12.136.89], dsn=2.0.0, stat=Sent (OK) Jan 9 11:33:10 mail sendmail[7391]: f09AWNJ07378: to=<miagi24(a)aol.com>,<aalyahlvr(a)aol.com>,<miagi2330(a)aol.com>,<idiot196(a)aol.c om>,<epfourtish(a)aol.com>,<idiot1836(a)aol.com>, delay=00:00:47, xdelay=00:00:38, mailer=esmtp, pri=282542, relay=xb.mx.aol.com. [64.12.136.89], dsn=2.0.0, stat=Sent (OK) Jan 9 11:33:14 mail sendmail[7436]: f09AX6J07436: from=<mikee60369(a)solutionsnets.com>, size=12531, class=0, nrcpts=6, msgid=<rdctqywvs.1fhg8w6ibb0yp(a)mx19.solutionsnets.com>, proto=SMTP, daemon=MTA, relay=[63.57.179.121] Jan 9 11:33:15 mail sendmail[7441]: f09AXFJ07441: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com TIA Philipp

1 0

IRC daemons and security
by Stefan Suurmeijer 09 Jan '01

09 Jan '01

Hi, I was wondering if anyone on this list could point me to a site with a comparison between IRC daemons, specifically WRT security and performance issues. Of course any info any of you have yourself would be welcome too. TIA Stefan

1 0

RE: [suse-security] The NSA's version of Linux. Open source at th at!
by Nix 09 Jan '01

09 Jan '01

At 04:37 PM 8/01/2001 -0500, you wrote: >Well the announcement came out today so their web site may be swamped. >Try http://currents.net/news/01/01/08/news6.html this has actually been out for almost 2 weeks. If you have a look at Bugtraq archives, you will find that infact a vulnerability has already been found in the code that NSA added.... Nice to see that no-one is perfect :-) -Nix --- Nix - nix(a)susesecurity.com SuSE-Security FAQ Maintainer http://www.susesecurity.com

1 0

RE: [suse-security] The NSA's version of Linux. Open source at th at!
by Jacks, Charles 08 Jan '01

08 Jan '01

Well the announcement came out today so their web site may be swamped. Try http://currents.net/news/01/01/08/news6.html Charles Jacks -----Original Message----- From: Fred A. Miller [mailto:fm@cupserv.org] Sent: Monday, January 08, 2001 16:11 To: Jacks, Charles Subject: Re: [suse-security] The NSA's version of Linux. Open source at that! "Jacks, Charles" wrote: > > Linux security via the nsa. > > http://www.nsa.gov/selinux/ nasa.gov is NOT responding...hmmmmmmm. Fred -- ----/ / _ Fred A. Miller ---/ / (_)__ __ ____ __ Systems Administrator --/ /__/ / _ \/ // /\ \/ / Cornell Univ. Press Services -/____/_/_//_/\_,_/ /_/\_\ fm(a)cupserv.org

1 0