January 2001 - openSUSE Security - openSUSE Mailing Lists

ssl ftp
by Kurt Seifried 05 Jan '01

05 Jan '01

SDSC/GT Secure FTP 1.0.3 http://www.glub.com/products/secureftp/ Secure FTP is a client package that allows for a secure connection to be made to an FTP daemon via SSL. I forget who it was that asked. Kurt Seifried, seifried(a)securityportal.com SecurityPortal - your focal point for security on the 'net

1 0

Re: [slug] Re: ftp/firewall security
by MaD dUCK 04 Jan '01

04 Jan '01

also sprach Tom Stepleton (on Thu, 04 Jan 2001 03:12:06PM -0500): > don't quite get your question, but isn't the problem you're talking about > what modules like ip_masq-ftp are for? I'm not sure this helps since these > modules are for the masquerading aspect of firewalling and not the > blocking aspect, but AFAIK these do pay attention to what's going on on > the protocol level and open ports accordingly. I know I had to load > ip_masq_ftp to get FTP working through my firewall, but I don't know > exactly what you're doing with NAT or much about NAT to beigin with. mh. these modules... now i remember. i read about them at one point in time, all excite about ip_masq_icq.o just so that i can let LAN users use ICQ on the MASQ'd net, but as it turns out, on my 2.2.17 kernel, these modules aren't even necessary: root@albatross ~> lsmod Module Size Used by b1pci 3992 1 (autoclean) b1 16320 0 (autoclean) [b1pci] capidrv 24840 3 (autoclean) kernelcapi 18516 2 (autoclean) [b1pci capidrv] capiutil 22400 0 (autoclean) [capidrv kernelcapi] slip 7856 2 (autoclean) autofs 9120 1 (autoclean) isdnloop 12628 6 (autoclean) isdn 112288 6 (autoclean) [capidrv isdnloop] yet, icq, ftp, irc and other work perfectly fine... i am not sure i know exactly what the purpose of these modules is. sure, ip_masq_quake is needed because quakeworld servers don't work with ports 6xxxx or whatever, and ip_masq_irc simply enables DCC transfers, but just take ip_masq_ftp and i am clueless. look at the following tcpdump output which is everything merlin ever has to say to my computer during an ftp session (until the password prompt), without ip_masq_ftp loaded: root@albatross ~> tcpdump -qi ippp0 src host 130.58.218.7 | grep -v auth 21:39:22.669348 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61822: tcp 0 (DF) 21:39:25.709893 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61822: tcp 69 (DF) 21:39:26.580174 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61822: tcp 0 (DF) 21:39:26.585833 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61822: tcp 36 (DF) sure, no data is transfered, but the point is - these are packets coming into interface ippp0, destined to be demasqueraded, on ports above 60000. if i had blocked 1024 and up, they would have never arrived, and the ftp session would have never been established. now, the same output with ip_masq_ftp loaded: 21:39:53.570288 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61832: tcp 0 (DF) 21:39:56.399793 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61832: tcp 69 (DF) 21:39:57.163834 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61832: tcp 0 (DF) 21:39:57.170270 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61832: tcp 36 (DF) unless i am totally not getting this, the output has two messages: ip_masq_ftp doesn't do anything to facilitate firewalling on the gateway machine, and (2), in only 31 seconds, my LAN made 10 connections to the outside world. no way i can just leave "some" ports open... anyway, i just checked and ip_masq_ftp is to enable active ftp transfers, nothing to do with passive... i don't think there's any way around a stateful firewall... and it's not just ftp: 22:08:25.052026 < merlin.sccs.swarthmore.edu.ssh > pD4B8911C.dip.t-dialin.net.61893: tcp 36 (DF) with an external interface ippp0, ipchains just needs a rule like ipchains -A input -p tcp -d 0/0 1024:65536 -j ACCEPT to work... thanks for your time anyway! martin [greetings from the heart of the sun]# echo madduck@!#:1:s@\@@@.net -- an avocado-tone refrigerator would look good on your resume.

1 0

suggestion for ssh packaging
by Bob Vickers 04 Jan '01

04 Jan '01

Hello, I have 2 suggestions that I believe will increase both security and usability: (1) split the ssh packages into client and server parts (2) have an ssh client installed as default It is absurd that someone who installs an ssh client should find themselves running an ssh server. I would like to see most desktops in the world running an ssh client, but only a tiny minority should be running ssh servers. The current situation could lead to people who have installed ssh so that they can access remote servers securely finding their home computers have been compromised because they unknowingly run an ssh service. The second suggestion is just to make my life easier...part of my job is to explain to people how to install ssh clients on their home machine, and the less they have to do the better. Happy new year, Bob ============================================================== Bob Vickers R.Vickers(a)dcs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

2 1

memory leak of secumod with SuSE 7.0
by Dorothea Mücke-Herzberg 04 Jan '01

04 Jan '01

Hello, There seems to be a memory leak of secumod with SuSE7.0, at least on my system (Compaq DL380 with Smart Array). The system freezes every few days or so when secumod is enabled. The syslog shows no entries between the time the systems freezes and a reboot. Sometimes I find those type of entries as the last ones: Dec 3 08:00:01 ssc kernel: VM: killing process sh Dec 3 08:04:09 ssc kernel: VM: killing process idled Dec 3 08:15:03 ssc kernel: VM: killing process run-crons This hints towards memory problems (I have 128MB RAM and 128MB swap). No services are running yet (www,mail,dns), just X11. After a reboot one sees a steady increase in memory usage although the system isn't in use at all. Before Christmas I finally disables secumod and since then it is running fine. Has anyone else experienced this problem and know of a solution? (I really would like to run secumod for better security) Cheers, Dorothea

1 0

AW: [suse-security] Intrusion detection?
by Battisti Markus 04 Jan '01

04 Jan '01

i find some tools that works good on my servers at www.psionic.com the portsentry and the logcheck its not a inrusion detection but ist is a portscan detection it guards unused ports ,,, /'^'\ ( o o ) oOOO--(_)--OOOo---------------------- Mit Freundlichen Grüssen/Best Regards proTask Consulting Battisti Markus PGP key available on request This message was sent using 100% recyclable electrons Hi, what are the recommended tools to add to a (dial-up) NAT gateway to detect attacks on that gateway? I am not (yet :->) looking for tools how to detect things after the deed is done, but for some kind of an early warning system (and I am not particularly interested in reading the raw logs emitted by ipchains). http://www.securityfocus.com/ lists a couple of things, but this seems to be just an *unreviewed* long list of tools, with rather unknown quality. TIA Stefan --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

proftpd-1.2.rc2: BUG! passive FTP not working (FIX attachted)
by Steffen Dettmer 04 Jan '01

04 Jan '01

Hi, the package mention above contains a bug concered to passive mode FTP. After upgrading, no passive FTP is possible! I attach a modified SPEC file and the needed patch. HOW TO BUILD: ------------- 1. install the right source rpm (via rpm -i proftpd.spm) 2. overwrite the SPEC file in /usr/src/packages/SPECS/ 3. copy the patch to /usr/src/packages/SOURCES 4. build RPMS (rpm -ba /usr/src/packages/SPECS/proftpd.spec) 5. upgrade to new RPM (rpm -U /usr/src/packages/RPMS/i386proftpd-1.2.0rc2-37.i386.rpm) [sorry for long line] PLEASE NOTE: If you haven't openLDAP installed, you may remove openLDAP support by editing the SPEC file: Change line 68 from: --with-modules=mod_ratio:mod_readme:mod_linuxprivs:mod_ldap \ to: --with-modules=mod_ratio:mod_readme:mod_linuxprivs \ (before STEP 4, or if you get ldap errors with executing step 4; in the latter case edit file and redo step 4 and go on; that seems to be neccesary for SuSE 6.1) Standard disclaimer applies. UNTESTED except a quick test on a SuSE 6.1 but the new patch is a very simple one - but who knows! I wonder why nobody got this problem here before (it's known on proftpd.net...) TECHNICAL NOTE: The spec file got a new release number (37), hope this makes no conflicts. I only added the patch. I have no time to supply a diff of the SPECs right now, but that's what SuSE support is for ;) short in time as always ;) oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.

3 2

postfix
by Faessen Jean-Paul 03 Jan '01

03 Jan '01

Hi to all I wish you all a very good 2001! As descriped in the SuSe-handbook of 7.0 I installed postfix instead of sentmail. Then I also changed my file permissions to secure as described. After this Netscape didn't want to remember the inputs in preferences When logging out or logging in,I was asked for my password.Impossible to put in. Iwas forced to reinstall my system,but now I would like to know what went wrong. Now I'm back on sentmail,no tripwire,no securitysettings in yast... I did never have problems,and to be honest I have nothing to protect but I want to change to cable-connection and there security is a problem. Thanks for helping... Jean-Paul Faessen

2 1

can`t login as root
by icepic 03 Jan '01

03 Jan '01

first a happy new year !! my English is not very good, so i hope that everybody understandt me. My question: I want to login as root on my ftp-serive, but i cannot. The login is incorrect. What is to do to solve the problem

7 7

Re: [suse-security] SuSE Security FAQ
by Nix 03 Jan '01

03 Jan '01

Yes, this was my intended plan, however, I am more than happy to accept sections written by YOU! *hint hint* (anyone who wants credit for writing a major section will receive a listing in a CREDITS file. At least thats what I've been thinking of doing... Thoughts anyone?) -Nix At 10:38 PM 16/12/2000 +0800, you wrote: >I would like to see additional security programs i.e., >snort, Portsentry, SuSEfirewall, etc. Thus people will know >the things to install to beef up security, maybe even >Howto's on setting these up(?). >- -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking

4 3

can`t login as root
by icepic 03 Jan '01

03 Jan '01

jo thx to all @dennis: i think , you cannot use su on ftp-service!!

1 0