January 2001 - openSUSE Security - openSUSE Mailing Lists

SuSEfirewall version for Linux 6.3
by dproc 21 Jan '01

21 Jan '01

Which is the latest stable (non-beta) version of Marc's script that is compatible with SuSE 6.3 ? I ask because the latest in the updates directory for 6.3 is version 2.1. The 7.0 distro has version 2.6 and Volker K. has packaged version 3.2 for the contribs directory. So I am confused. dproc

1 1

re proc info
by webmaster 21 Jan '01

21 Jan '01

Ralf, try http://www.bb-zone.com/Proc/index.html Antal

1 0

Re: [SLE] Re: AW: [suse-security] Why does sendmail deny relaying?
by Garry Smith 21 Jan '01

21 Jan '01

Hi John, I tried the dot notation you mentioned. That's fixed it. Thanks very much. As for Postfix, I think you might be right :-) regards Garry john wrote: > > I've just had the same problem as you. Upgraded from 6.3 to 7.0 and mail > relaying broke, despite having an unchanged relay-domains. Having battled > with this for hours and out of a willingness to try ANYTHING I added my > internal domain to relay-domains in dot notation -- hey presto it worked. > > Oh, I also commented out the Privacy line you mentioned to get rid of those > messages too ... why is the default behaviour of sendmail now to DNS lookup > every bloody system that mail comes in on? > > This is the last straw .. I have disliked sendmail for some time now because > you have you reach sendmail-guru status before you can even start to fiddle > with anything that lives outside of rc.config ... time do dump [that] > garbage into the bit bucket and learn me some Postfix. > > John > > -----Original Message----- > From: garry(a)suse.com [mailto:garry@suse.com]On Behalf Of Garry Smith > Sent: 17 January 2001 14:19 > To: suse-linux-e(a)suse.com > Cc: suse-linux-security(a)suse.com; garry.smith(a)computer.org > Subject: [SLE] Re: AW: [suse-security] Why does sendmail deny relaying? > > Hi, > > uname -a : Linux homer 2.2.16-SMP #1 SMP Wed Aug 2 20:01:21 GMT 2000 > i686 unknown > sendmail version: starting daemon (8.10.2): SMTP+queueing@00:30:00 > (from mail log) > > I also have a problem with relaying in sendmail. > I would like machines from domain a, b and c to be able to use my mail > server (SuSE Linux 7.0 Pro) to send mails to any other domain. > > Initially I inserted domains a, b,and c into /etc/mail/relay-domains. > This allowed me to pass on mails from remote clients to one of the > listed domains. > > Sending a mail to a domain not listed causes the following error to > appear in the sender's mail client: > > An error occurred while sending mail > The mail server responded: > 5.7.1 <Garry.Smith(a)computer.org>... Relaying denied. IP name lookup > failed [x.x.x.x] Please check the message recipients and try again. > > My log mail log file shows: > Jan 17 12:40:08 homer sendmail[18328]: starting daemon (8.10.2): > SMTP+queueing@0 > 0:30:00 > Jan 17 12:40:08 homer sendmail[18328]: daemon could not open control > socket /var > /run/sendmail.control: Group writable directory > Jan 17 12:41:23 homer sendmail[18347]: f0HCfML18347: ruleset=check_rcpt, > arg1=<G > arry.Smith(a)computer.org>, relay=[x.x.x.x], reject=550 5.7.1 > <Garry.Smith@ > computer.org>... Relaying denied. IP name lookup failed [x.x.x.x] > Jan 17 12:41:23 homer sendmail[18347]: f0HCfML18347: > from=<Garry.Smith@computer. > org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, > relay=[x.x.x.x] > > I have since removed the entries for /etc/mail/relay-domains. > I have also commented out the sendmail.cf authentification warning entry > as described in one on the recent related mails on this. > # privacy flags > > > O PrivacyOptions=needmailhelo,novrfy,noexpn,noetrn,noverb > > > > and restarted sendmail > > I followed the instructions below and added domains A,B and C to > access.db ie: > a-sub-domain.a-domain ACCEPT > > I then ran the Makefile and restarted sendmail. > I still get the relay error listed above. The only way I can seem to > get round this is if I add domains A,B and C back into > /etc/mail/relay-domains file. > > However, while I can then use my mail server to relay mail to those > domains, I cannot relay to other un-listed domains. > > How can I specify that domains A,B and C are allowed to use my mail > server to relay messages to any other domain on the Internet? > I must be missing something fundamental here, but can't think what? > > Many thanks in advance > regards > > Garry > > Roman Drahtmueller wrote: > > > > > > > > If you put in access.db > > > 212.121.144.197 ACCEPT > > > > > > it will work. > > > > Yes, and don't forget to hash the plaintextfile. Use the Makefile that > > I've put in the attachment. Place it in /etc/mail, go there and type make. > > Little gift from the 7.1 sendmail package... > > > > > > > > Philipp > > > > Thanks, > > Roman. > > -- > > - - > > | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | > > SuSE GmbH - Security Phone: // not enable user to fly." > > | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | > > - - > > > > ------------------------------------------------------------------------ > > Name: Makefile > > Makefile Type: Plain Text (TEXT/PLAIN) > > Encoding: BASE64 > > Description: Makefile for /etc/mail > > > > ------------------------------------------------------------------------ > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > -- > To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com > For additional commands send e-mail to suse-linux-e-help(a)suse.com > Also check the FAQ at http://www.suse.com/support/faq

1 0

ICMP with Source Address 192.168.100.83 !
by uwe_kersten＠t-online.de 21 Jan '01

21 Jan '01

Hi all! My Snort tells me this evening about several ICMP packets with source address 192.168.100.83 (my net is 192.168.0.x and 192.168.1.x). They had the signature ICMP TTL Exceeded in Transit. Destination was the IP of my ippp0. This is a dynamic one, but these packets got to different IP numbers on my SuSE 7 Box. So what, I am quiet new in this business, do I have to worry, what is this all about? Any idea? Regards Uwe

2 1

Apache Log - rusftpsearch is back
by Ulrich Klenk 20 Jan '01

20 Jan '01

Hello all, found this one in an Apache access-log-file: "GET http://www.rusftpsearch.net/cgi-bin/pst.pl?pstmode=writeip&psthost=195.37.62 .127&pstport=80". Can someone please point me to some information for that probe? What were they doing? I found something about this in the list for December 1999, but there are only discussions about rusftpsearch.net.. Greetings, Uli

2 1

re spam relay? Thanks for all!
by webmaster 19 Jan '01

19 Jan '01

Thnaks Antal

1 0

Unauthorized entry?
by Luis José Fabbiani B. (SOPORTE) 19 Jan '01

19 Jan '01

Hi, my server had registry de following entry: Jan 11 06:02:36 cumana in.ftpd[23016]: connect from pedro(a)150.185.69.34 Jan 11 06:02:36 cumana ftpd[23016]: connection from complex.ciens.ucv.ve Jan 11 06:02:37 cumana ftpd[23016]: ANONYMOUS FTP LOGIN FROM complex.ciens.ucv.ve ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P1À1Û1É°FÍ~@1À1ÛC~IÙA°?Í~@ëk^1À1É~M^^A~HF^Df¹ÿ^A°'Í~@1À~M^^ A°=Í~@1À1Û~M^^H~IC^B1ÉþÉ1À~M^^H°^LÍ~@þÉuó1À~HF^I~M^^H°=Í~@þ^N°0þÈ~HF^D1À~HF^ G~Iv^H~IF^L~Ió~MN^H~MV^L°^KÍ~@1À1Û°^AÍ~@è~Pÿÿÿ0bin0sh1..11 Is this message a possible attack? Thanks. Luis.

3 4

AW: [suse-security] passwd
by Stiefenhofer, Marek ECOFIS 19 Jan '01

19 Jan '01

> I don't see any kind of passwd database on SuSE 6.4. /etc/passwd /etc/shadow

11 24

passwd
by Egan 19 Jan '01

19 Jan '01

I don't see any kind of passwd database on SuSE 6.4. How many users can I get in the passwd file before things slow down?

2 1

syslog.conf question
by vladimir m. bondarev 19 Jan '01

19 Jan '01

Hello, suse-security. i have a 3com dialup pool in my network called "ras1500". it logs everything to linux server. all messages by default come to /var/log/messages. how can i make them to log into /var/log/ras. i've tryed to add: ras1500 -/var/log/ras, but received nothing. all messages still log to /var/log/messages another question: how can i log all services (like pop3 and others, except sendmail (it logs to /var/log/mail) to /var/log/services? and the last one: how can i make the logs unable to be edited? i've tryed chattr +a, but then logrotate can't delete old files. Friday, January 19, 2001 -- vladimir m. bondarev, icq uin: 62393277 paradox team web: http://scene.org.ru

1 0