October 2001 - openSUSE Security - openSUSE Mailing Lists

Port behavior
by Kurt Seifried 10 Oct '01

10 Oct '01

By default when a program asks for a port Linux hands it one, starting at 1025 and going into the 5000 range, incrementing by one for each request (i.e. first requets gets 1025, second gets 1026, etc.). So when you do a default port scan first packet goes out from 1025, then 1026, then 1027, etc. You can specify local port used in nmap (i.e. 53, 20, other good choices exist). You can also set ip_local_poort_range. I used to have an article on all this, put it back online at: http://www.seifried.org/security/os/linux/ http://www.seifried.org/security/network/ Kurt Seifried, kurt(a)seifried.org A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://www.seifried.org/security/

1 0

surf-log on firewall
by Wolfgang Schaefer 10 Oct '01

10 Oct '01

hi, is this normal: the outgoing port is switching or is this an port scanner? 10.1.2.1 is the surfing machine and 10.1.1.1 is the gateway with proxy. Oct 9 22:31:00 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.2.1:1061 10.1.1.1:3128 L=48 S=0x00 I= Oct 9 22:31:01 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.2.1:1062 10.1.1.1:3128 L=48 S=0x00 I= Oct 9 22:31:01 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.2.1:1063 10.1.1.1:3128 L=48 S=0x00 I= Oct 9 22:31:01 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.2.1:1064 10.1.1.1:3128 L=48 S=0x00 I= Oct 9 22:31:02 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.2.1:1065 10.1.1.1:3128 L=48 S=0x00 I= Oct 9 22:31:10 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.2.1:1066 10.1.1.1:3128 L=48 S=0x00 I= Oct 9 22:31:42 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:876 10.1.1.1:22 L=60 S=0x00 I=360 Oct 9 22:33:31 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:785 10.1.1.1:22 L=60 S=0x00 I=404 Oct 9 22:37:37 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1247 10.1.1.1:3128 L=60 S=0x00 I= Oct 9 22:37:38 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1248 10.1.1.1:3128 L=60 S=0x00 I= Oct 9 22:37:39 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1249 10.1.1.1:3128 L=60 S=0x00 I= Oct 9 22:37:39 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1250 10.1.1.1:3128 L=60 S=0x00 I= Oct 9 22:37:39 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1251 10.1.1.1:3128 L=60 S=0x00 I= Oct 9 22:37:39 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1252 10.1.1.1:3128 L=60 S=0x00 I= Oct 9 22:37:39 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1253 10.1.1.1:3128 L=60 S=0x00 I= Oct 9 22:37:39 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1254 10.1.1.1:3128 L=60 S=0x00 I= Oct 9 22:37:46 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1255 10.1.1.1:3128 L=60 S=0x00 I= Oct 9 22:38:06 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1256 10.1.1.1:3128 L=60 S=0x00 I= Oct 9 22:47:29 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1272 10.1.1.1:3128 L=60 S=0x00 I= Oct 9 22:47:29 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1273 10.1.1.1:3128 L=60 S=0x00 I= Oct 9 22:47:29 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1274 10.1.1.1:3128 L=60 S=0x00 I= Oct 9 22:47:30 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1275 10.1.1.1:3128 L=60 S=0x00 I= Oct 9 22:47:31 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1276 10.1.1.1:3128 L=60 S=0x00 I= Oct 9 22:47:32 gateway kernel: Packet log: input ACCEPT eth0 PROTO=6 10.1.1.2:1277 10.1.1.1:3128 L=60 S=0x00 I= regard's -- _______________________________ Wolfgang Schaefer Diplom-Ingenieur (FH) Elektronik System- und Netzwerkadministrator Fon +49(7308)818-22 Fax +49(7308)818-65 busse design ulm gmbh Nersinger Str. 18 89275 Elchingen / Ulm, Germany http://www.busse-design-ulm.de _______________________________

2 4

Impact on Linux and SuSE ?
by Matt 09 Oct '01

09 Oct '01

Hi, Would this impact SuSE 7.2 and is there a fix for SuSE ? Regards Matt >From Subject Received Cc Sent Bcc CERT Advisory CERT Advisory CA-2001-27 Fri 10/5/01 10:05 PM Fri 10/5/01 7:52 PM Overview There is a remotely exploitable format string vulnerability in the CDE ToolTalk RPC database service. This vulnerability could be used to crash the service or execute arbitrary code, potentially allowing an intruder to gain root access. This vulnerability is documented in VU#595507. This document is available from: http://www.cert.org/advisories/CA-2001-27.html

4 3

unkown open ports
by Martin Knipper 09 Oct '01

09 Oct '01

Hi there, I tried a "nmap -sT -O localhost". I noticed some unkown open ports on my System with no specific entry to /etc/services and I don´t know why they are open. [...] 603/tcp open unknown 976/tcp open unknown 1018/tcp open unknown 1022/tcp open unknown [...] Doing a netstat -l -n outputs the same. By the way ... how can I close open ports ? Thanx Martin

3 2

Administrativa: bounces
by Roman Drahtmueller 08 Oct '01

08 Oct '01

Hi together, We have received multiple reports about mails to damian_solano(a)ciudad.com.ar that bounce. We know of these, but the address might have been removed from the list already. If not, then the messages originate from a private distribution list, and it might get difficult to track them down since the moron setup that sends the bounces cuts off all useful information. Like usual... Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE GmbH - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -

4 3

Re: [suse-security] Filtering *outgoing* packets...
by Peter Nixon 08 Oct '01

08 Oct '01

On Sat, 6 Oct 2001 11:44:22 -0700 (PDT) Ray Dillinger <bear(a)sonic.net> wrote: > > > On Sat, 6 Oct 2001, Kurt Seifried wrote: > > > >Yes, IPTables can inspect packets. Suggestion: get a recent version and > >check out the "string" keyword. > > Cool! I wasn't aware of that. > > > >> I quizzed him about it yesterday. The packet filter provided by > >> zeroknowledge (which runs on the windows box) has the capabilities > >> to look into the packets and match against regular expressions > >> provided by the operator, and that was the one that lit up when > >> he started media player. > > > >Moot point, ZK is dead. Dead'er then a flat squirrel. > > Rumors of their death have been exaggerated. They no longer provide > the anonymous browsing/pseudonymous email service they were known for, > but they do still provide their firewall software, including the > packet filter. For similar services take a look at COTSE (http://www.cotse.com/) DISCLAIMER: I am a Cotse ...erm... droid.. or something... ie. I do server admin for Cotse, but take no pay for it :-) (Although http://www.susesecurity.com is hosted on Cotse servers) -- Viel Spaß Nix - nix(a)susesecurity.com http://www.susesecurity.com Second .sig appended as a FYI. -- Nix - General Cotse kick-about and Server Admin mailto:nix@cotse.com http://www.cotse.com/nix/ Public Key: http://www.cotse.com/nix/public.asc PGP Key Fingerprint: 0DEA 1009 0182 273A 3120 EA3F 01C7 6C52 DF69 263C The Church of the Swimming Elephant Have you gone to church today?

1 0

RE: [suse-security] Virus scanner to detect macintosh viruses?
by Roger Rossell 08 Oct '01

08 Oct '01

oh good... but how virus scanners can affect my firewall performance? i think it would take several resources, wouldn't it? -----Mensaje original----- De: Rainer Link [mailto:link@suse.de] Enviado el: lunes, 08 de octubre de 2001 11:36 Para: Roger Rossell CC: suse-security(a)suse.com Asunto: RE: [suse-security] Virus scanner to detect macintosh viruses? On Mon, 8 Oct 2001, Roger Rossell wrote: > > ok... > is there any free virus-filtering software?? Well, depends on your definition of "free" :-) Free-of-charge (private use) are H+BEDV AntiVir, Sophos Sweep or Trend FileScanner. Open-Source projects are SignatureDB (Paul Daniels, www.pldaniels.com) or PatternFinder (www.openantivirus.org). Both are not really useable at the moment, but contributions are of course very welcome :-) HTH best regards, Rainer Link -- Rainer Link | SuSE - The Linux Experts link(a)suse.de | Developer of A Mail Virus Scanner (amavis.org) www.suse.de | Founder OpenAntiVirus Project (www.openantivirus.org) -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

RE: [suse-security] Virus scanner to detect macintosh viruses?
by Roger Rossell 08 Oct '01

08 Oct '01

ok... is there any free virus-filtering software?? -----Mensaje original----- De: Ray Dillinger [mailto:bear@sonic.net] Enviado el: viernes, 05 de octubre de 2001 21:11 Para: Roger Rossell CC: suse-security(a)suse.com Asunto: RE: [suse-security] Virus scanner to detect macintosh viruses? On Fri, 5 Oct 2001, Roger Rossell wrote: > >how can virus affect my firewall? >may i consider to install an anti-virus on it? A virus can result in lot of infected windows machines, which will rain packets on your firewall in an attempt to find out whether it's another windows machine they can infect. They may also send malformed packets (the "ping of death", etc) from infected hosts, in an attempt to crash a badly implemented TCP stack. If you have windows machines behind your firewall, you will probably want to install virus-filtering stuff in your firewall to protect them. Bear

2 1

permission failure
by Martin Knipper 08 Oct '01

08 Oct '01

Hi there. I noticed some strange logging in my /var/log/messages. [...] Oct 8 00:52:40 linux kernel: fh_verify: martin/sendmail.cf permission failure, acc=a, error=13 Oct 8 00:52:40 linux kernel: fh_verify: martin/sendmail.orig.cf permission failure, acc=a, error=13 [...] I have never noticed something like this before. It doesn´t appear to come up that often. Actually there are 8 entries like this in my /var/log/messages since beginning of July. I´m using sendmail 8.11 with SuSE 7.0 and AmaVis Perl. I would appreciate some information Regards, Martin Knipper

2 1

SuSEfirewall and 2 webservers in DMZ
by Carlo van Leeuwen 08 Oct '01

08 Oct '01

Hi, I have to servers which I want to put in the DMZ of my firewall whith 3 nics: 1) Web server 2) SuSE eMail Server II with apache web interface Is this possible? I tried different things like portforwarding, but then I can only reach one of them from the outside, inside is no problem. I gave the machines in the DMZ private IP's instead of public IP's, because of routing problems. My config: FW --- 195.85.x.x | | --------- DMZ 192.168.1.x | | LAN 192.168.0.x What is the best way to deal with this. TIA Carlo van Leeuwen. cvleeuwen(a)excapade.nl

2 1