January 2001 - openSUSE Security - openSUSE Mailing Lists

help with ntp
by Philipp Snizek 11 Jan '01

11 Jan '01

Hi all On one box ntp from ntp.org is running well. On the other machine (99% same config) it does not run. here're the errormessages. Can somebody help? ` mail:/ntp-4.0.99k # make install Compiling with GCC now generates lots of new warnings. Don't be concerned. They're just warnings. Don't send bug reports about the warnings, either. Feel free to send patches that fix these warnings, though. cd . \ && CONFIG_FILES=Makefile CONFIG_HEADERS= /bin/sh ./config.status creating Makefile executing commands of default-1 executing commands of default-2 executing commands of default Making install in scripts make[1]: Entering directory `/ntp-4.0.99k/scripts' make[2]: Entering directory `/ntp-4.0.99k/scripts' make[2]: Nothing to be done for `install-exec-am'. make[2]: Nothing to be done for `install-data-am'. make[2]: Leaving directory `/ntp-4.0.99k/scripts' make[1]: Leaving directory `/ntp-4.0.99k/scripts' Making install in include make[1]: Entering directory `/ntp-4.0.99k/include' make[2]: Entering directory `/ntp-4.0.99k/include' make[2]: Nothing to be done for `install-exec-am'. make[2]: Nothing to be done for `install-data-am'. make[2]: Leaving directory `/ntp-4.0.99k/include' make[1]: Leaving directory `/ntp-4.0.99k/include' Making install in ElectricFence make[1]: Entering directory `/ntp-4.0.99k/ElectricFence' make[2]: Entering directory `/ntp-4.0.99k/ElectricFence' make[2]: Nothing to be done for `install-exec-am'. make[2]: Nothing to be done for `install-data-am'. make[2]: Leaving directory `/ntp-4.0.99k/ElectricFence' make[1]: Leaving directory `/ntp-4.0.99k/ElectricFence' Making install in librsaref make[1]: Entering directory `/ntp-4.0.99k/librsaref' for i in desc.c digit.c md2c.c md5c.c nn.c prime.c r_dh.c r_encode.c r_enhanc.c r_keygen.c r_random.c r_stdlib.c rsa.c des.h digit.h md2.h md5.h nn.h prime.h r_random.h rsa.h rsaref.h; do \ case "" in \ '') touch $i ;; \ *) case "$i" in \ *.h) r_dst=./$i ;; \ *) r_dst=$i ;; \ esac ; \ cmp -s ${r_dst} ./../rsaref2/source/$i 2>/dev/null \ || cp ./../rsaref2/source/$i ${r_dst} ;; \ esac ; \ done cd .. \ && CONFIG_FILES=librsaref/Makefile CONFIG_HEADERS= /bin/sh ./config.status creating librsaref/Makefile executing commands of default-1 executing commands of default-2 executing commands of default make[1]: Leaving directory `/ntp-4.0.99k/librsaref' make[1]: Entering directory `/ntp-4.0.99k/librsaref' make[2]: Entering directory `/ntp-4.0.99k/librsaref' make[2]: Nothing to be done for `install-exec-am'. make[2]: Nothing to be done for `install-data-am'. make[2]: Leaving directory `/ntp-4.0.99k/librsaref' make[1]: Leaving directory `/ntp-4.0.99k/librsaref' Making install in libntp make[1]: Entering directory `/ntp-4.0.99k/libntp' source='a_md5encrypt.c' object='a_md5encrypt.o' libtool=no \ depfile='.deps/a_md5encrypt.Po' tmpdepfile='.deps/a_md5encrypt.TPo' \ depmode=gcc /bin/sh ../depcomp \ gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../include -I../librsaref -g -O2 -Wall -Wshadow -Wconversion -Wpointer-arith -Wcast-qual -Wstrict-prototypes -pipe -c -o a_md5encrypt.o `test -f a_md5encrypt.c || echo './'`a_md5encrypt.c In file included from /usr/include/string.h:346, from /usr/include/memory.h:30, from ../include/ntp_string.h:13, from a_md5encrypt.c:20: /usr/include/bits/string2.h: In function `__strsep_g': /usr/include/bits/string2.h:1171: warning: passing arg 2 of `__strpbrk_c2' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 3 of `__strpbrk_c2' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 2 of `__strpbrk_c3' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 3 of `__strpbrk_c3' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 4 of `__strpbrk_c3' with different width due to prototype source='adjtime.c' object='adjtime.o' libtool=no \ depfile='.deps/adjtime.Po' tmpdepfile='.deps/adjtime.TPo' \ depmode=gcc /bin/sh ../depcomp \ gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../include -I../librsaref -g -O2 -Wall -Wshadow -Wconversion -Wpointer-arith -Wcast-qual -Wstrict-prototypes -pipe -c -o adjtime.o `test -f adjtime.c || echo './'`adjtime.c source='atoint.c' object='atoint.o' libtool=no \ depfile='.deps/atoint.Po' tmpdepfile='.deps/atoint.TPo' \ depmode=gcc /bin/sh ../depcomp \ gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../include -I../librsaref -g -O2 -Wall -Wshadow -Wconversion -Wpointer-arith -Wcast-qual -Wstrict-prototypes -pipe -c -o atoint.o `test -f atoint.c || echo './'`atoint.c In file included from /usr/include/string.h:346, from /usr/include/memory.h:30, from ../include/ntp_string.h:13, from ../include/ntp_stdlib.h:7, from atoint.c:8: /usr/include/bits/string2.h: In function `__strsep_g': /usr/include/bits/string2.h:1171: warning: passing arg 2 of `__strpbrk_c2' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 3 of `__strpbrk_c2' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 2 of `__strpbrk_c3' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 3 of `__strpbrk_c3' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 4 of `__strpbrk_c3' with different width due to prototype source='atolfp.c' object='atolfp.o' libtool=no \ depfile='.deps/atolfp.Po' tmpdepfile='.deps/atolfp.TPo' \ depmode=gcc /bin/sh ../depcomp \ gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../include -I../librsaref -g -O2 -Wall -Wshadow -Wconversion -Wpointer-arith -Wcast-qual -Wstrict-prototypes -pipe -c -o atolfp.o `test -f atolfp.c || echo './'`atolfp.c In file included from /usr/include/bits/posix1_lim.h:126, from /usr/include/limits.h:30, from /usr/lib/gcc-lib/i486-suse-linux/2.95.2/include/limits.h:117, from /usr/lib/gcc-lib/i486-suse-linux/2.95.2/include/syslimits.h:7, from /usr/lib/gcc-lib/i486-suse-linux/2.95.2/include/limits.h:11, from /usr/include/bits/socket.h:31, from /usr/include/sys/socket.h:34, from ../include/ntp_fp.h:9, from atolfp.c:7: /usr/include/bits/local_lim.h:27: linux/limits.h: No such file or directory In file included from /usr/include/sys/socket.h:34, from ../include/ntp_fp.h:9, from atolfp.c:7: /usr/include/bits/socket.h:295: asm/socket.h: No such file or directory In file included from /usr/include/string.h:346, from /usr/include/memory.h:30, from ../include/ntp_string.h:13, from atolfp.c:8: /usr/include/bits/string2.h: In function `__strsep_g': /usr/include/bits/string2.h:1171: warning: passing arg 2 of `__strpbrk_c2' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 3 of `__strpbrk_c2' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 2 of `__strpbrk_c3' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 3 of `__strpbrk_c3' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 4 of `__strpbrk_c3' with different width due to prototype make[1]: *** [atolfp.o] Error 1 make[1]: Leaving directory `/ntp-4.0.99k/libntp' make: *** [install-recursive] Error 1 mail:/ntp-4.0.99k # TIA very muchos Philipp

2 1

major security bug in reiserfs (may affect SuSE Linux)
by Dave Woutersen 11 Jan '01

11 Jan '01

Hi all, I Found the following mail-alert in de BUGTRAQ-maillinglist. Can anyone confirm this hole?? Greetings, Dave

4 3

RE: [suse-security] Email behaviour
by Raffy 10 Jan '01

10 Jan '01

> 137/TCP is the NETBIOS Name Service. So the remote mailserver might be > a (misconfigured?) Windows-Box. > > It's nothing dangerous, AFAIK. But is this a thing one can configure or not? I would rather advise that admin to stop doing so than doing nothing. Thanks Raffy

2 1

SuSEfirewall
by Ulrich Schneider 10 Jan '01

10 Jan '01

Hello everybody, my SuSEfirewall version 2.6 (I thinkt it`s 2.6) SuSE Linux 7.0 produced the following messages: root@compulrich:/home/sure > /sbin/SuSEfirewall /sbin/SuSEfirewall: split-brained.: command not found /sbin/SuSEfirewall: host/network.: Datei oder Verzeichnis nicht gefunden /sbin/SuSEfirewall: dmz/intern: Datei oder Verzeichnis nicht gefunden /sbin/SuSEfirewall: addesses!: command not found root@compulrich:/home/sure > Does everone know, why this message appears. I`ver configured the firewall as described in the EXAMPLES file ulrich_schneider(a)uni.de

2 1

Email behaviour
by Raffy 10 Jan '01

10 Jan '01

Whenever I send email to a specific server, the server trys to connect to my server on port 137. Any ides what is going on there? Is that one misconfigured? I mean I could sniff that traffic and see what it is, but does anybody know what it is and why? Thanks Raffy

4 3

RE: [suse-security] Email behaviour
by Raffy 10 Jan '01

10 Jan '01

Its certainly netbios!! > > Whenever I send email to a specific server, the server trys to connect to my > > server on port 137. > > I don't know, but you can see : (for colsfaq) > > 5.7) I'm seeing repeated probes to port xxxx... What does this > mean? > > Here are some lists of port assignments: > > IANA Port Assignments : > http://www.isi.edu/in-notes/iana/assignments/port-numbers - > "Official" port assignment from the Internet Assigned Numbers > Authority. > > Port list at NetworkIce: > http://advice.networkice.com/advice/Exploits/Ports - List of ports > and hyperlinked explanations that includes 'less standard' ports. > > List of Trojans: http://www.tlsecurity.com/trojanh.htm - The most > complete list of trojan ports available. > > Port Search Engine: http://www.cotse.com/cgi-bin/port.cgi - Very > nice search engine for ports, links results to relevant RFC's. > > For a more in depth analysis of what you're seeing, see Robert > Graham's Firewall forensics > FAQ: http://www.robertgraham.com/pubs/firewall-seen.html > > > > Any ides what is going on there? Is that one misconfigured? I > mean I could > > sniff that traffic and see what it is, but does anybody know > what it is and > > why?

2 1

SuSEfirewall and SMTP
by Thorsten Doil 10 Jan '01

10 Jan '01

Hi all! On SuSE 6.4 I am using Marc's SuSEfirewall-4.1. Everything work's fine, if there were not this one and only annoying occurrence when sending mail via SMTP to my ISP. When doing that, ok, in principle it works, but it takes an awful lot of time until mail has left the outbox. I'm using XFMail-1.4.4 and sent mail is queued until I explicitely send it. During this, there is the following message in my /var/log/allmessages (repeated mostly 4 times): Jan 8 23:34:33 take kernel: Packet log: output DENY ppp0 PROTO=1 \ 193.218.216.98:3 193.218.216.10:3 L=88 S=0xC0 I=11620 F=0x0000 T=255 \ (#3) When I stop the firewall before sending mail, it really works fast without any error. 193.218.216.98 is my dynamically assigned IP address and 193.218.216.10 is the address of the ISP's name server. Anyone out there who could give me a small hint what I would have to change in /etc/rc.config.d/firewall.rc.config? TIA Thorsten

1 0

ICQ File Transfers
by Dan Ball 10 Jan '01

10 Jan '01

I'm running the SuSE 6.4 firewall on my server at home, with a small intranet being masqueraded. It works great except for a few internet programs that don't work properly. I disabled most of the server functions to keep it an even tighter firewall, since I don't really need them running anyway. One of the most intriguing questions I have is; how I would get ICQ to be able to do direct file transfers through the firewall? Do I need to enable one of the server functions or setup a proxy server?

2 1

Martian sources - firewall problem?
by Andrew Hougie 09 Jan '01

09 Jan '01

I am getting in my logs the following messages every three minutes: Jan 9 21:35:30 server2 kernel: martian source 0101a8c0 for ff[changed], dev eth1 Jan 9 21:35:30 server2 kernel: ll header: ff ff ff ff ff ff 00 a0 24 c7 08 86 08 00 If I've understood correctly from previous SuSE archive messages, 0101a8c0 is hex for IP address 192.168.1.1 and ff7150c6 is hex for xx.yy.zz.255 (IP address changed to protect their anonymity) Again if I've understood correctly the header "11 header" is Destination: ff ff ff ff ff ff = broadcast Source: 00 a0 24 c7 08 86 = sender's MAC address Type: 08 00 (no idea what this means but I assume it does not matter. I have two linux PCs, server1 (SuSE 6.2) and server2 (SuSE 7.0). Both have an external interface on a network connected to a router to "the internet" and have IP addresses xx.yy.zz.a and xx.yy.zz.b. eth1 on server2 is on this network. The external NIC on server1 does have MAC address 00:a0:24:c7:08:86 Both server1 and server2 have internal networks with IP addresses 192.168.1.1 and 192.168.1.6 respectively. So what the message seem to be saying is that the external interface on server2 is receiving packets from the internal interface on server1. This presumably should not happen. It seems to me that there are two possibilities here. First that I have the interface cards on server2 the wrong way round, so that eth1 on server2 with IP address xx.yy.zz.b is connected to the internal network and eth0 with IP address 192.168.1.6 to the external network. How can I test this? I have tried on server2 running > /sbin/arp -a and get server1 (192.168.1.1) at 00:E0:29:2D:CF:51 [ether] on eth0 server1 (xx.yy.zz.a) at 00:A0:24:C7:08:86 [ether] on eth1 workstation (xx.yy.zz.c) at 00:A0:24:C7:09:4F [ether] on eth1 router (xx.yy.zz.254) at 00:30:94:E5:C5:77 [ether] on eth1 and doing the same on server1 I get: server2 (192.168.1.6) at 00:C0:DF:01:C7:C8 [ether] on eth0 server2 (xx.yy.zz.b) at 00:C0:DF:F3:15:D1 [ether] on eth1 workstation (xx.yy.zz.c) at 00:A0:24:C7:09:4F [ether] on eth1 router (xx.yy.zz.254) at 00:30:94:E5:C5:77 [ether] on eth1 That looks to me like they're the right way round. Both servers are running the SuSE firewal script with IP forwarding switched on. So is the second possibility somehow that one server is forwarding packets through to the second? Could this be causing the problem? If so, is there a solution somewhere in firewall.rc.config in one of the two machines (and if so which one, or both). Or can I switch off logging with: echo "0" > /proc/sys/net/ipv4/ip_log_martians and would this cause any security concerns? Many thanks Andrew -- Andrew Hougie, Grinton, Aldenham Grove, Radlett, Hertfordshire, England, WD7 7BW Email: andrew(a)hougie.co.uk WWW: http://www.hougie.co.uk

1 0

RE: [suse-security] ICQ File Transfers
by Widmann Thomas 09 Jan '01

09 Jan '01

Hi ! * Dan Ball wrote: >I'm running the SuSE 6.4 firewall on my server at home, with a small >intranet being masqueraded. It works great except for a few internet >programs that don't work properly. I disabled most of the server >functions to keep it an even tighter firewall, since I don't really need >them running anyway. One of the most intriguing questions I have is; how >I would get ICQ to be able to do direct file transfers through the >firewall? Do I need to enable one of the server functions or setup a >proxy server? Try using the icq_masq kernel modul. ciao Thomas

1 0