October 2001 - openSUSE Security - openSUSE Mailing Lists

bind hack ?
by Gero Lindenblatt 19 Oct '01

19 Oct '01

Dear Linux-Users, I noticed that my name server is listening to a port that i have not expected (like port 80,25,21,110 etc..). udp 0 0 127.0.0.1:53 0.0.0.0:* 475/named udp 0 0 0.0.0:52810 0.0.0.0:* 31475/named udp 0 :::53 :::* 31475/named what is port 52810 ? yesterday is was another number like 46xxx... Am i hacked ? tia GL _______________________________________________________________________ 1.000.000 DM gewinnen - kostenlos tippen - http://millionenklick.web.de IhrName(a)web.de, 8MB Speicher, Verschluesselung - http://freemail.web.de

2 1

Patches / Sendmail Updates
by Brian Clark 18 Oct '01

18 Oct '01

Greetings, I've installed SuSE 7.2, and as I'm going through the security patches/updates, I get to the two listed for sendmail. The first goes OK, but the second fails: [root@callisto /]% rpm -U ftp://ftp.suse.com/pub/suse/i386/update/7.2/n1/sendmail.rpm Updating etc/rc.config...Done. [root@callisto /]% rpm -U ftp://ftp.suse.com/pub/suse/i386/update/7.2/sec2/sendmail-tls.rpm error: failed dependencies: sendmail conflicts with sendmail-tls-8.11.3-72 sendmail-tls conflicts with sendmail-8.11.3-68 sendmail-tls conflicts with sendmail-8.11.3-68 This is an out-of-the-box Minimal installation of SuSE 7.2. I've been struggling with RPM today (new to SuSE), so I thought I should ask this list before I messed up and installed the wrong packages. -- -Brian Clark | PGP is spoken here: 0xE4D0C7C8 Please, DO NOT carbon copy me on list replies.

2 1

Re: [suse-security] ssh idle?
by Marios Marti 18 Oct '01

18 Oct '01

One more thing, earlier in the morning i was trying to ssh to it but it seemed to be down, now that im using it everything seems to be fine. The info you requested. Thanks in advance. uname -a --> Linux ocean 2.2.18 i686 suse release --> SuSE Linux 7.1 custom kernel --> Dont know what you mean by custom kernel (believe is whether i have compiled it or not, well its the default kernel when i installed the system) route -n --> Destination Gateway Genmask Flags Metric Ref Use Iface 130.88.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 130.88.117.250 0.0.0.0 UG 0 0 0 eth0 Its a default suse linux 7.1 with office installation. The changes i made are: disabled inetd,portmap,added -nolisten tcp in the Xservers file so that the X11 port 6000 is not listening. In other words the only open port left was 22 for ssh. As for ssh the version is 2.9p1-18 i have not changed anything with the configuration.i did the online automatic update which i believe pathced ssh with the 2.9p1 This is the ifconfig output eth0 Link encap:Ethernet HWaddr 00:60:97:B8:AA:C5 inet addr:130.88.117.90 Bcast:130.88.255.255 Mask:255.255.0.0 inet6 addr: fe80::60:97b8:aac5/10 Scope:Link inet6 addr: fe80::260:97ff:feb8:aac5/10 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:232174 errors:0 dropped:0 overruns:0 frame:0 TX packets:12227 errors:0 dropped:0 overruns:0 carrier:0 collisions:492 txqueuelen:100 Interrupt:10 Base address:0x6500 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:3924 Metric:1 RX packets:6104 errors:0 dropped:0 overruns:0 frame:0 TX packets:6104 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 >From: "Kurt Seifried" <listuser(a)seifried.org> >Reply-To: "Kurt Seifried" <listuser(a)seifried.org> >To: "Marios Marti" <mchu6mm3(a)hotmail.com>, <suse-security(a)suse.com> >Subject: Re: [suse-security] ssh idle? >Date: Thu, 18 Oct 2001 03:57:30 -0600 > >Argh. > >Can someone write a faq for the list with things like: > >How do I ask a question? > >Answer: ask the question BUT also give us appropriate information, like: > >uname -a >suse release >custom kernel or? >ifconfig >route -n >what is installed >which version of ssh? how did you configure it? > >etc. > >If you tell an auto mechanic "my car makes a noise" and don't tell him what >kind of noise, or even what kind of car you have he'll probably laugh at >you >(rightly so). > >Kurt Seifried, kurt(a)seifried.org >A15B BEE5 B391 B9AD B0EF >AEB0 AD63 0B4E AD56 E574 >http://www.seifried.org/security/ > > > >----- Original Message ----- >From: "Marios Marti" <mchu6mm3(a)hotmail.com> >To: <suse-security(a)suse.com> >Sent: Thursday, October 18, 2001 3:10 AM >Subject: [suse-security] ssh idle? > > > > Hi > > > > I had this problem before and i dont know how to deal with it. I set up >the > > system which is SuSE Linux 7.1 > > All the ports are closed and the only remote login i accept is for ssh. >The > > problem is that at certain times i ssh to the machine and everything is > > working nicely and at some other time everything goes wrong. The ssh >request > > times out, the system cannot be pinged, and it looks as if it just >shutdown > > byitself. And the worse part is that the machine on the LAN next to it >is > > functioning allright but this isnt as if all the networking services >have > > gone to a deep hypernation. Please any feedback or solution to this >would >be > > appreciated. > > > > Thanks > > > > _________________________________________________________________ > > Get your FREE download of MSN Explorer at >http://explorer.msn.com/intl.asp > > > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

3 2

ipchains and nat
by stephane parenton 18 Oct '01

18 Oct '01

Hi, I have a gateway between 2 internal networks that seem to work quite good so far. it's on a SuSE 7.0. I added a printer on the network2 and want to nat an adress so the network1 can see the network2 printer as if it was a network1 printer... (in fact the driver of the printer doesn't recognize the printer because it is on another network...). but there's surely something wrong in my cfg.... here it is : #!/bin/sh echo 1 > /proc/sys/net/ipv4/ip_forward cat /proc/modules | grep ip_masq > /tmp/ipmapp$$ while read LINE do set $LINE none none none if [ "$1" != "none" ] then /sbin/rmmod $1 fi done < /tmp/ipmapp$$ rm -f /tmp/ipmapp$$ /sbin/ipchains -F input /sbin/ipchains -P input ACCEPT /sbin/ipchains -F output /sbin/ipchains -P output ACCEPT /sbin/ipchains -F forward /sbin/ipchains -P forward DENY /sbin/ipchains -A forward -j MASQ -s network2.ip.adress.0/24 -d 0.0.0.0/0 ip route add nat network1.ip.adress.printer via network2.ip.adress.printer >From the gateway, I can ping the printer with the network2 adress, but I don't ping the printer with the network1 adress. Anybody sees where is my mistake ? TIA Stephane

2 1

AW: [suse-security] Finger Port
by Peer Stefan 18 Oct '01

18 Oct '01

do you run suse personal firewall? if so, bring it down. or do you use filters? test it with either iptables -L or ipchains -L have a look at /etc/hosts.deny and /etc/hosts.allow, whether you allow finger for any other hosts than localhost too. (in etc/hosts.allow: finger: XXX.XXX.XXX.XXX to allow finger from XXX.XXX.XXX.XXX) regards, Stefan PS: don't allow finger for the internet, since it provides some useful information to compromise your system. -----Ursprüngliche Nachricht----- Von: Glenn Hancock [mailto:ghancock@mindspring.com] Gesendet: Donnerstag, 18. Oktober 2001 15:36 An: Suse Security Email Group Betreff: [suse-security] Finger Port I am trying to learn Linux and am new to the OS. I have installed with default installation and am now trying to figure a few things out. I want to use the finger server port 79 in order to test some things and then would like to disable it again. I have added necessary information to services, and to inetd.conf related to the man tables. I have rebooted. I can run finger locally but not from another computer on the network directed to my Linux box. I also try to look at processes running and I don't see inetd running. Is there something I have to do in order to get finger and telnet to operate because I haven't been able to find anything in your help files. Thanks, Glenn Hancock -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

ssh idle?
by Marios Marti 18 Oct '01

18 Oct '01

Hi I had this problem before and i dont know how to deal with it. I set up the system which is SuSE Linux 7.1 All the ports are closed and the only remote login i accept is for ssh. The problem is that at certain times i ssh to the machine and everything is working nicely and at some other time everything goes wrong. The ssh request times out, the system cannot be pinged, and it looks as if it just shutdown byitself. And the worse part is that the machine on the LAN next to it is functioning allright but this isnt as if all the networking services have gone to a deep hypernation. Please any feedback or solution to this would be appreciated. Thanks _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

5 6

Re: [suse-security] port security
by Mauricio Latorre 18 Oct '01

18 Oct '01

Use a firewall to avoid packets from Internet to ports 6000 and 1024. Restrict the IPs that can login at SSH (port 22) <hub4asc0 ----- Original Message ----- From: "Marios Marti" <mchu6mm3(a)hotmail.com> Date: Tuesday, October 16, 2001 8:34 am Subject: [suse-security] port security > Hi > I have cut down the number of ports open to 3 > 22 SSH > 1024 kdm (when a user is logged on) > 6000 X11 > > I was wondering if these ports are secure enough and if not if > there is > anyway to secure them. > As far as the kdm open port that would be closed most of the time. > > Also if there is anything else i should be thinking about except > port > security i.e remote exploitation of the system > > Thanks > > > _________________________________________________________________ > Get your FREE download of MSN Explorer at > http://explorer.msn.com/intl.asp > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

2 1

tcp-wrapper-/-logs
by da_bug 17 Oct '01

17 Oct '01

Hi! Has Suse 7.2 or 7.3 in the default-install a tcp-wrapper running? If so which one? ..and how can I generally find out if there is a wrapper or something like this running? ..and where is the log-file? (I didn't find one... like /var/log/secure as in many distributions) Thanks & Bye ;-)

1 0

Re: [suse-security] Sendmail
by Alex Levit 17 Oct '01

17 Oct '01

Make sure you have imap.rpm package installed, seems like it is not installed or the path to POP3 server in your inetd.conf is wrong Alex ----- Original Message ----- From: spiekey To: suse-security(a)suse.com Sent: Tuesday, October 16, 2001 1:47 AM Subject: [suse-security] Sendmail Hello! I set up my sendmail as desciped at http://doc.thepenguin.de/sendmail/index_dr.htm i have the pop and smtp enabeled in /etc/services /etc/inetd.conf when i do a nmap onto my box i can see that smtp is open, but no pop, how come? Sendmail is running and i restarted it each time i changes something (as i did with suseconfig) I get this error: The connection to the server has failed. Account: '192.168.10.53', Server: '192.168.10.53', Protocol: POP3, Port: 110, Secure(SSL): No, Socket Error: 10061, Error Number: 0x800CCC0E Can someone help me? Thank you Spiekey

1 0

Re: [suse-security] Sendmail
by Markus Gaugusch 16 Oct '01

16 Oct '01

> I set up my sendmail as desciped at > http://doc.thepenguin.de/sendmail/index_dr.htm > i have the pop and > smtp enabeled in /etc/services /etc/inetd.conf > when i do a nmap onto > my box i can see that smtp is open, but no pop, how come? > Sendmail > is running and i restarted it each time i changes something (as i did > with suseconfig) > I get this error: > The connection to the server > has failed. Account: '192.168.10.53', \ > Server: '192.168.10.53', > Protocol: POP3, Port: 110, \ > Secure(SSL): No, Socket Error: 10061, > Error Number: 0x800CCC0E You are using Outlook? (do yourself a favor and try to get another program - at least for security). Which server are you connecting to? 192.168.10.53? or is this your local addres? You mixed up POP3 (fetching mails) with SMTP (sending mails). Do you want to use SSL for sending and receiving? Is it your server, that handles the mails or is it your provider? Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \ Linux 2.4.12-grsec-1.8.2 * Now playing Live - Deep Enough

1 0