January 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] openssh && hardensuse problem
by Armin Schöch 28 Jan '01

28 Jan '01

> I'm using SuSE 7.0 Professional to build a firewall. I've installed the > necessary packages, upgraded to latest release and after running > "harden_suse yes" opensshd just refuses to accept connections, the > following message appears on the logs: > > Jan 27 15:53:32 maestro sshd[887]: refused connect from 192.168.0.100 > (192.168.0.100) Hello Bràulio ! The point with the updated ssh package is, that it is now linked against the tcpwrapper library. This means you have to allow the ssh connection explicitely in /etc/hosts.allow It should work if you put in a line like sshd: 192.168.0.100 There is also an option AllowHosts in /etc/sshd_conf. Look up the syntax with "man sshd". Good luck ! Armin ------------------------------------------------------------------------ Armin Schöch at the office: Institut für Atmosphärenphysik Ziolkowskistr. 10 / 63 Schlossstraße 6 D-18059 Rostock D-18225 Kühlungsborn Tel. +49-(0)381-4005781 Tel. +49-(0)38293-68-102

1 0

Fwd: Do I have a virus on my MBR?
by Graham Hamblin 27 Jan '01

27 Jan '01

Hi This is a copy of a message I have sent to Support at S.u.S.E. and put on here for the information of all. Hope it is of help. I am using S.u.S.E. 7.0 Professional on a PC at home with a modem connection to the internet. If I invoke security in Netscape whatever is showing in the window and invoke Open Page Information there are two windows. In the top one is the page information but in the bottom one is the following text, "Whatchew talkin' 'bout, Willis?" and try as I may I cannot find it or get rid of it. I have re installed over 20 times, used lilo -u and fdisk /MBR in dos, reset my bios to its defaults and even installed Netscape 4.76 but all to no avail.. If I boot and instal direct from the CD without rebooting and initialise Netscape the text is there. I am sorry I only know a little German. Antivir when executed without arguement on a new installation returns "Verzeichnisse 1" so I suspect I have a virus on my master boot sector and I have no idea how to deal with it effectively. I really have been at this problem for nearly three weeks and am absolutely at my wits end and will be absolutely delighted if you can help me. This is only the second time I have asked for help, Roman was kind enough to put me right on the last occasion. Thanking you in anticipation. Graham Hamblin. -- ghamblin(a)btinternet.com S.u.S.E. Linux 7.0 ================== ------------------------------------------------------- -- ghamblin(a)btinternet.com S.u.S.E. Linux 7.0 ==================

5 5

Port 81 - what is it and who uses it?
by suse＠diplan.de 27 Jan '01

27 Jan '01

Hi. Simple question: I wonder what port 81 is for and what service on my DMZ is trying to connect to it. I looked into several firewall books but the problem is they don't have a port number index. Of course I can read from /etc/services: hosts2-ns 81/tcp # HOSTS2 Name Server hosts2-ns 81/udp # HOSTS2 Name Server So what is HOSTS2 and to avoid future simple questions like this one, where can I look for a reference? thanks in advance, Rainer

3 2

Re: Re: man package / SuSe format string vulnerabilities
by bacano 26 Jan '01

26 Jan '01

Hi2all In SuSe 7.0 is the same ... # man -l %x%x%x%x man: 4001ee6cbffff8d40bffff8d0: No such file or directory [ ]'s bacano ----- Original Message ----- From: "syzop" <syz(a)DDS.NL> To: <VULN-DEV(a)SECURITYFOCUS.COM> Sent: Friday, January 26, 2001 3:16 PM Subject: Re: man package / SuSe format string vulnerabilities > confirmed on debian 2.2r2... > tracing in source of man-db-2.3.16 (man-db-2.3.17 [latest I guess] same problem)...: > > -- [src/man.c:752]: > if (!display ((cwd[0]?cwd:NULL), argv, NULL, basename(argv))) { > if ( local_mf ) > error (0, errno, argv); <----- HERE > exit_status = NOT_FOUND; > } > > -- [lib/error.c:80] > error (int status, int errnum, const char *message, ...) > -- [lib/error.c:102 (editted)] > VA_START (args, message); > vfprintf (stderr, message, args); > -- > > Auch :) > > Cya > > Syzop. > > > Joao Gouveia wrote: > > > Hi there, > > > > I'm sorry if this is a known issue, but i didn't find nothing related to > > format strings in this man package. > > Example follows: > > <quote> > > jroberto@spike:~ > cat /etc/issue > > > > Welcome to SuSE Linux 6.3 (i386) - Kernel \r (\l). > > > > jroberto@spike:~ > man -l %x%x%x%x > > man: 0bffff8600bffff85c: No such file or directory > > jroberto@spike:~ > man -V > > man, version 2.3.10, db 2.3.1, July 12th, 1995 (G.Wilford(a)ee.surrey.ac.uk) > > </quote> > > > > AFAIK, suse 7.0 also ships with this 'man'. Can anyone confirm this? > > > > Best regards, > > > > Joao Gouveia > > -------------- > > tharbad(a)kaotik.org >

1 0

pam_opie and ssh
by Diegmann Björn 26 Jan '01

26 Jan '01

Hi, I have set up sshd to authenticate via pam_opie. When logging in with a secure shell the challenge is only displayed AFTER authentication. any ideas?? thanks bjoern some details: SuSE 7.0/OpenSSH_2.3.0 # This is ssh server systemwide configuration file. Port 22 #Protocol 2,1 ListenAddress 0.0.0.0 #ListenAddress :: HostKey /etc/ssh/ssh_host_key ServerKeyBits 768 LoginGraceTime 600 KeyRegenerationInterval 3600 PermitRootLogin no # # Don't read ~/.rhosts and ~/.shosts files IgnoreRhosts yes # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication #IgnoreUserKnownHosts yes StrictModes yes X11Forwarding yes X11DisplayOffset 10 PrintMotd yes KeepAlive yes # Logging SyslogFacility AUTH LogLevel INFO #obsoletes QuietMode and FascistLogging RhostsAuthentication no # # For this to work you will also need host keys in /etc/ssh_known_hosts RhostsRSAAuthentication no # RSAAuthentication yes # To disable tunneled clear text passwords, change to no here! PasswordAuthentication yes PermitEmptyPasswords no # Uncomment to disable s/key passwords #SkeyAuthentication no KbdInteractiveAuthentication yes # To change Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #AFSTokenPassing no #KerberosTicketCleanup no # Kerberos TGT Passing does only work with the AFS kaserver #KerberosTgtPassing yes CheckMail no UseLogin no

1 0

AW: [suse-security] Password Authentication
by Stiefenhofer, Marek ECOFIS 26 Jan '01

26 Jan '01

Use pam_ldap. I don't know whether it is included in the suse 7.0 distribution. http://www.padl.com/pam_ldap.html kind regards, Marek

2 1

Password Authentication
by Phillip D. Beal 26 Jan '01

26 Jan '01

Hey, How can I make a SuSE 7.0 Professional System authenticate a user with an ldap server that is running on a remote system? I have a small secure system running an ldap server from an internal network, and I want all the systems to authenticate the users with the ldap database. I know the ldap database can be used for this, but how can I make a SuSE 7.0 system use the database? Thanks, -- Phillip Beal ___ _ _ Electrical and Computer Engineering | _ ) ___ __ _| |___ _ _ ___| |_ pdbeal(a)louisville.edu | _ \/ -_) _` | |_ /_| ' \/ -_) _| http://www.bealz.net/ |___/\___\__,_|_/__(_)_||_\___|\__|

1 0

SuSE Security Announcement: shlibs/glibc (SuSE-SA:2001:01)
by Roman Drahtmueller 26 Jan '01

26 Jan '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: glibc (shlibs) Announcement-ID: SuSE-SA:2001:01 Date: Friday, January 26th, 2001 15:40 MET Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0 Vulnerability Type: local root compromise Severity (1-10): 6 SuSE default package: yes Other affected systems: most Linux/glibc based systems Content of this advisory: 1) security vulnerability resolved: glibc problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information ld-linux.so.2, the dynamical linker, adds shared libraries to the memoryspace of a program to be started. Its flexibility allows for some environment variables to influence the linking process such as preloading shared libraries as well as defining the path in which the linker will search for the shared libraries. Special care must be exercised when runtime-linking setuid- or setgid-binaries: The runtime-linker must not link against user-specified libraries since the code therein would then run with the elevated privileges of the suid binary. The runtime-linker as used in the SuSE distributions ignores the content of the critical environment variables if the specified path begins with a slash ("/"), or if the library file name is not cached (eg it is contained in a path from /etc/ld.so.conf). However, Solar Designer has found out that even preloading glibc- native shared libraries can be dangerous: The code in the user-linked library is not aware of the fact that the binary runs with suid or sgid privileges. Using debugging features of the glibc (and possibly other features) it is possible for a local attacker to overwrite arbitrary files with the elevated privileges of the suid/sgid binary executed. This may lead to a local root compromise. To eliminate these problems, we provide update packages that completely disregard the LD_* variables upon runtime-linking of a binary that has an effective uid different from the caller's userid. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. SPECIAL INSTALL INSTRUCTIONS: ============================== The glibc (the shlibs package) is an intrinsic part of the GNU/Linux operating system since most binary executables are dependent on the shared libraries from that package. For this reason, special care must be taken while updating the shlibs package. After downloading the binary rpm files, make sure that your system is idle by bringing it down to Single User Mode (`init 1´). If this is not applicable for operational reasons, then keep your machine as calm as possible while you perform the update. In particular, make sure that no shell scripts are running during the update. Install the package using the command rpm -Uhv package-rpm-file Do _NOT_ interrupt the operation of the rpm command! After the installation, execute the commands ldconfig # alternatively, use SuSEconfig /sbin/init u # will restart init At this point, the update is done. On low-memory machines a reboot is advisable to free the memory that is used by the old memory-mapped libraries. Note 1: The upcoming SuSE-7.1 distribution is based on glibc-2.2. This distribution is not affected by the security problems in glibc as discussed in security forums. Note 2: The source rpm for the shlibs package is called "libc*.rpm". Multiple binary rpm packages are being generated from this source rpm package. These include: localedb, nssv1, shlibs, timezone. To get a fix for the runtime-linker related security issue (topic of this announcement), it is only necessary to update the shlibs binary rpm package. SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/shlibs-2.1.3-190.i386.rpm 94ccbb80d2841f08f2b7322671d6e7f3 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/libc-2.1.3-190.src.rpm 3d15b6ffff534f0bf705882dbd8a2551 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/shlibs-2.1.3-155.i386.rpm bc03f1a6f32a66958128e9450e355698 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/libc-2.1.3-155.src.rpm e8f2aa8d32122edfbe3c436a52abb847 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/shlibs-2.1.2-48.i386.rpm 8d572332c67b488e5d64a8d4d3274e90 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/libc-2.1.2-48.src.rpm 8e1f861112f4a921ea4c7b5631304ee6 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/shlibs-2.1.1-30.i386.rpm b6b4cfe73e46c5b3bd5b626d68dfa584 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/libc-2.1.1-30.src.rpm 67fcd70b40f145b5f40b86f7254e35be SuSE-6.1 SuSE-6.0 The rpm packages are being produced as this announcement is written. The md5sums for these rpm packages will be provided on the ftp-server, signed with the security(a)suse.de pgp key below. Sparc Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/shlibs-2.1.3-155.sparc.rpm 6b000a6278366c6da4b719d2f62ad7a4 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/libc-2.1.3-155.src.rpm e845606be9c9aca72213e4c5f1f32290 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/a1/shlibs-2.1.3-155.alpha.rpm 2df813e3c08b52e3f914c591efc742d4 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/libc-2.1.3-155.src.rpm 9cb7a6e5981112da6d702916d453b419 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/shlibs-2.1.3-155.alpha.rpm 0636c2cddf131e76c19e154619a65bd8 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/libc-2.1.3-155.src.rpm 39fd3b8e7e4054bc7a333a831e99e6fd SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/shlibs-2.1.2-48.alpha.rpm f9713bc945bf7f98527d2fdfbe756dfb source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/libc-2.1.2-48.src.rpm af2eb3df9d83f8f8ca13526046a3a539 SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/shlibs-2001.1.17-0.alpha.rpm 4a0033c4ec32ef0e79fc1b7a83692738 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/libc-2000.9.5-0.src.rpm 11871baa8279f8c0c79f6c9d95ca531c PPC Power PC Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/shlibs-2.1.3-173.ppc.rpm 8d9d27a8fba22de4df5cd4700a541ad9 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/libc-2.1.3-173.src.rpm 89946b9a2bb7c545a1761a84ebd979ab SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/shlibs-2.1.3-190.ppc.rpm 383bb49a2f6a3e83a9c2ed3eea30dc99 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/libc-2.1.3-190.src.rpm 91ed7087165b74383cddb556abc07402 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: This announcement is followed by a sequence of more announcements to address the ongoing security problems as discussed in public security forums. In particular, there are temporary file races in multiple packages (we collect and address them in a single announcement to keep the noise low), format string bugs, as well as a man-in-the-middle attack in the kdesu program and a single-byte buffer overflow. The next announcenemts will contain more information on these topics. Please stay tuned. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller, SuSE Security. - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOnGNKney5gA9JdPZAQHwWAf+O/xaFgEnMGl1E3NqR/oC6zDB5TelVWil 7Ng4KVr1Ijwodi7CjXAOXdI1SfVt2v64IWKxjpppQdM1F9epNEFCHx2XdLCviBEo EMC8r+KmPICRvfZJUzhJQPszXuLm7SDPTf5fsrWBcQrLnaQ+1eCBqlyCciFqLb3s iZYaxP/NoQh18UuKUVo3lRAzwN7eZwKh4xuwRfmxdB1yBqHloquTKA+JV7kl8SV4 k3PaNO7yC1kkbltkUX/y95hKEhQazh5Il/vK0FyKMHzXYdj8y28kQJKL07Gmwaye Sx3U7QRe9AD1e+IcfPzE6G9n1beaNhKMu+hGfyYXg+5n8lGKp/FTxw== =bcEa -----END PGP SIGNATURE-----

1 0

logcheck
by semat 26 Jan '01

26 Jan '01

Hello everyone, I would like a little help with a problem. I installed logcheck and I have this message from it multiple times: Jan 25 16:15:38 alpha sshd[5838]: debug: Installing crc compesation attack detector I would like to know what this means and whether I have cause to be worried. thanks you.

2 1

Does autorpm for SuSE exist ???
by Marko Kaening 26 Jan '01

26 Jan '01

Hi, I saw that Redhat has a nice tool called autorpm which allows automated updates of the system (for instance in case of security updates). It looks like this tool is not part of SuSE distribution! I personally would like to have such a tool available. So one could run that every morning or so just to be informed which packages were updated on ftp.suse.de for whatever reason and to decide whether an update should be made. Perhaps I am just not well enough informed, in that case I shut up and listen to your advice what to do, otherwise I would be happy to find some support from other users who might have the same wish to make system security a little easier and time-robbing job. What does SuSE think about this? Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

6 8