October 2001 - openSUSE Security - openSUSE Mailing Lists

ICQ
by Stefan_Walther＠gehag-dsk.de 23 Oct '01

23 Oct '01

Hi folks, does anyone knows the port for filetranferring via ICQ, I can't get any files from other. But the other way around it works. THX Best Regards, MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

3 2

postfix aliases.db
by Thomas Schweikle 23 Oct '01

23 Oct '01

Hi! It looks like postfix is ignoring aliases.db in some cases. Assume settings in postfix.rc.config: POSTFIX_CREATECF="yes" POSTFIX_RELAYHOST="snoopy.nic.home.net" POSTFIX_NULLCLIENT="no" POSTFIX_MASQUERADE_DOMAIN="" POSTFIX_LOCALDOMAINS="" and aliases like: root: \root, tschweikle(a)fkn.de # Basic system aliases that MUST be present. mailer-daemon: root postmaster: mailer-daemon # General redirections for pseudo accounts in /etc/passwd. daemon: root lp: root news: root uucp: root games: root man: root at: root postgres: root [...] a mail to root should be delivered localy _and_ forwarded to tschweikle(a)fkn.de. In the logs you see: xcnlm03s:/etc # mail -s Test root Test . EOT xcnlm03s:/etc # tail /var/log/mail Oct 23 13:22:51 xcnlm03s postfix/pickup[3508]: 809643EE01: uid=0 from=<root> Oct 23 13:22:51 xcnlm03s postfix/cleanup[3820]: 809643EE01: message-id=<20011023112251.809643EE01(a)xcnlm03s.mm.home.net> Oct 23 13:22:51 xcnlm03s postfix/qmgr[3509]: 809643EE01: from=<root(a)mm.home.net>, size=333, nrcpt=1 (queue active) Oct 23 13:22:51 xcnlm03s postfix/smtp[3822]: 809643EE01: to=<root(a)mm.home.net>, relay=snoopy.nic.home.net[192.168.10.17], delay=0, status=sent (250 Message received: 20011023091948234.AAA246.308(a)xcnlm03s.mm.home.net) Mail will only be delivered to root! Setting POSTFIX_LOCALDOMAINS="" to "localhost mm.home.net" makes postfix respect aliases.db: xcnlm03s:/etc # mail -s test root Test . EOT xcnlm03s:/etc # tail -n 5 /var/log/mail Oct 23 13:28:49 xcnlm03s postfix/local[5926]: 863A13EE01: to=<root(a)mm.home.net>, relay=local, delay=0, status=sent (mailbox) Oct 23 13:28:49 xcnlm03s postfix/cleanup[5924]: A6C923EE02: message-id=<20011023112849.863A13EE01(a)xcnlm03s.mm.home.net> Oct 23 13:28:49 xcnlm03s postfix/local[5926]: 863A13EE01: to=<root(a)mm.home.net>, relay=local, delay=0, status=sent (forwarded as A6C923EE02) Oct 23 13:28:49 xcnlm03s postfix/qmgr[5674]: A6C923EE02: from=<root(a)mm.home.net>, size=495, nrcpt=1 (queue active) Oct 23 13:28:49 xcnlm03s postfix/smtp[5927]: A6C923EE02: to=<tschweikle(a)fkn.de>, relay=snoopy.nic.home.net[192.168.10.17], delay=0, status=sent (250 Message received: 20011023092546406.AAA337.247(a)xcnlm03s.mm.home.net) -- Thomas

1 0

RE: [suse-security] New kernel vulnerabilities
by Björn Engels 23 Oct '01

23 Oct '01

On 10/20/01 2:10 PM Markus Gaugusch wrote: [...] > PS: once more openwall patches made my life easier :) The ptrace bug > can't be exploited with available exploits, because pidof can't find > the pid of suid binaries, that are hidden by the procps patch. And this again brings me to a question that I already wanted to post to the list several times before: Why doesn't SuSE offer an already patched kernel / patched sources in the distribution, e.g. with the OpenWall or the GR-Security Patch ? This would make life easier for a lot of people, I think. I always use the kernel sources from .../people/mantel/next and the SuSE default configuration as starting point for my own kernels, but patching always went wrong because some parts of code is already patched by SuSE. So one would have to use the original sources but then the nice SuSE-enhancements are gone ;) Cheers Bjoern

4 7

limit MASQ port range
by Andreas Achtzehn 23 Oct '01

23 Oct '01

Dear list readers, out of educational interest and to understand the advanced features of packet filtering in a better way I am trying to build an ipchains based firewall on my own. The basic policy of all rules is to deny traffic. I'd like to build a machine which does masquerading for an internal network but keeps the users ON the machine from running their own servers on TCP or UDP highports. I found no way to differ between a port that is used by the firewall machine for local usage and a port that is used for masquerading a connection from the inside network. This is my basic idea of the firewall. Basic policy: DENY 1. Do masquerading for internal network. 2. Allow SSH connection from internal network. 3. Deny lowport (1-1024) connections to machine. 4. Do forwarding of masqueraded (highport) connections. 5. Deny highport local services. Using /proc/sys/net/ipv4/ip_local_port_range it is possible to limit the range of highports. Is it possible to limit the range of masqueraded ports to a certain scope? I could replace rules 4 and 5 by 4. Deny port 1024-20000 connections. --> local used ports 5. Accept port 20001-65000 connections. --> masqueraded ports Do you have any other idea how to differ between incoming packets for masqueraded connections and incoming packets for local highport services? The packet headers seem to look the same. Regards, Andreas Achtzehn

2 1

Re: [suse-security] ICQ
by Yves Ineichen 22 Oct '01

22 Oct '01

Hi, i habe 2000b... see ICQ->Preferences->Connections->User -not using proxy -> use the following TCP listen prot for incoming events -->From To (define your port range) and thats it yves At 20:30 22.10.01 +0200, you wrote: > >Hi folks, > >does anyone knows the port for filetranferring via ICQ, I can't get any >files from other. But the other way around it works. > >THX > > Best Regards, > MfG. > > Stefan Walther > stefan_walther(a)gehag-dsk.de > dienst.: +4930/89786448 > Funk: +49172/3943961 Yves Ineichen BY demgod http://www.demgod.com

1 0

Iptables lacks 'filter' and 'nat' tables
by Thiemo Kellner 22 Oct '01

22 Oct '01

Hi all, I compiled a kernel and activated the option with compiled in iptables. But now iptables fails with the error that there is neither 'filter' nor 'nat' table. I used a copy of the source folder of the original kernel and have not compiled any modules. Have I overseen an additional option in the kernel compilation? Can I install the lacking tables (SuSE 7.2 i386)? Is there an option in the SuSE config parameter file (yast) I haven't caught? Thx for any help Thiemo -- root weiss, was er tut; wicht weiss es nicht. halb wicht, halb root - geht das gut?

2 3

Arslan iptables
by xcomb xcomb 22 Oct '01

22 Oct '01

Thanks nice online documentation really explains a lot to me!

1 0

Re: [suse-security] My SuSE-Email-Server-II works as an open relayserver
by Klaus Mahling 22 Oct '01

22 Oct '01

Hello, Am Montag, 22. Oktober 2001 um 12:06 schrieben Sie: SM> Roman Drahtmueller wrote: >> It seems there is more involved here: The seems to be some kind of >> story >> in the background. >> Klaus, could you please send your complete main.cf to >> security(a)suse.de? >> Thanks! SM> i saw it on another suse emailserver that he was an open relay, SM> so maybe SM> it would be nice to know what exaclty the problem was .. or not?;) SM> thanks It seems that i don't get all the mails. Here is my main.cf as attachment. Many thanks for any help. It is a big problem for me. When i don't find a quick solution i have to take my server from the net. THX -- Mit freundlichen Grüssen Klaus Mahling mailto:admin@klaus-mahling.de

1 0

Security Hole
by jst 22 Oct '01

22 Oct '01

Hello I'm using Suse Linux 7.2 as Gateway for connecting Internet. Now I've been testing my Gateway with Nessus. And I got this Message back. -- Vulnerability found on port general/tcp It was possible to make the remote server crash using the 'teardrop' attack. A cracker may use this attack to shut down this server, thus preventing your network from working properly. Solution : contact your operating system vendor for a patch. Risk factor : High -- Do's anybody know what Patch I need ore what I can do in this case? Juerg

4 3

is it OK to disable newgrp
by Bob Vickers 22 Oct '01

22 Oct '01

Hello, I was wondering: while SuSE are working on the fixes to these latest kernel problems is it sensible to remove suid privilege from newgrp? What functionality would be lost? I realise that newgrp is not the culprit and that disabling it would not properly fix the problem, but it should be a useful protection against script kiddies. Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

3 2