October 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] "No such file or directory" within /proc ?
by christian.burri＠synecta.ch 04 Oct '01

04 Oct '01

Hi All! Thanks for your answers. I think it is really the du binary which causes the message, and yea, /proc doesnt really exist on the disk, so "du" is quite pointless anyways. Well I was just worried about some user on that box r00ted it (a lot of ppl from #hacktech have shell on that box, hehe...). Okies Thankie very much again and have a nice day all Cheers Christian Burri

1 0

"No such file or directory" within /proc ?
by christian.burri＠synecta.ch 04 Oct '01

04 Oct '01

Hi List, while doing a "du" in /proc, I get the following error msg: du: `./2220/fd/4': No such file or directory not quite sure, but doesnt "fd" mean a file descriptor? could it be an installed rootkit causing that error msg? Greeets Chr. Burri .-. /v\ L I N U X // \\ >I know KungFu!!< /( )\ ^^-^^

5 4

strange entry in SuSEfirewall v4.8 log
by michael.ryan＠storm.ie 04 Oct '01

04 Oct '01

Oct 2 13:48:57 {my} kernel: IP_MASQ:reverse ICMP: failed checksum from 212.80.177.4! haven't seen this sort of entry before ... does it indicate someone sent me a malformed ping packet?

2 1

restricting user commands
by greg＠space.cfi.co.ug 04 Oct '01

04 Oct '01

Hi all! I would like to restrict the commands that a specific user can use on my linux box. Could someone please tell me the various options available? thanks ---- Greg, Computer Frontiers International ,,, /'^'\ ( o o ) oOOO--(_)--OOOo---------------------- "Just because you're not paranoid, it doesn't mean they are *not* after you!"

12 22

Hi @ll -----> I have problems with my firewall
by Rüdiger H 03 Oct '01

03 Oct '01

On my server a 2.4 kernel with an iptables firewall is running. I have already set up a few rules but there are still problems downloading my emails. It takes about 15 seconds to look if there's mail, without firewall it only takes half a second. Another problem is that i can reach neither an internal nor an external pc using ssh. When my firewall is up I can't use the nfs drive. Who can help me solving these problems??? #! /bin/bash --login ### Verweis auf den befehl! ### iptables=/usr/sbin/iptables ### Regelketten loeschen! ### iptables -F iptables -t nat -F iptables -X ### Module fuer connection tracking laden ### modprobe ip_tables modprobe ip_conntrack modprobe ip_conntrack_ftp ### Angabe des Interfaces! ### DEV_EXT=eth0 lan=192.168.77.0/24 dns=195.34.133.11 ### Loopback freigabe! ### iptables -A OUTPUT -o lo -j ACCEPT iptables -A INPUT -i lo -j ACCEPT ### FTPconnectiontracking TCP ### iptables -A INPUT -p tcp --sport 1024:65535 --dport ftp -j ACCEPT iptables -A INPUT -p tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -p TCP --sport 1024:65535 --dport ftp -j ACCEPT iptables -A OUTPUT -p TCP --sport 1024:65535 --dport 1024:65535 -j ACCEPT ### DNSconnectiontracking TCP ### iptables -A INPUT -p tcp --sport 0:65535 --dport domain -j ACCEPT iptables -A INPUT -p tcp --sport 0:65535 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -p tcp --sport 0:65535 --dport domain -j ACCEPT iptables -A OUTPUT -p tcp --sport 0:65535 --dport 1024:65535 -j ACCEPT ### DNSconnectiontracking UDP ### iptables -A INPUT -p udp --sport 0:65535 --dport domain -j ACCEPT iptables -A INPUT -p udp --sport 0:65535 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -p udp --sport 0:65535 --dport domain -j ACCEPT iptables -A OUTPUT -p udp --sport 0:65535 --dport 1024:65535 -j ACCEPT ### FTPserver TCP freigabe! ### iptables -A INPUT -p TCP --dport 21 -j ACCEPT iptables -A OUTPUT -p TCP --sport 21 -j ACCEPT ### FTPserver UDP freigabe! ### iptables -A INPUT -p UDP --dport 21 -j ACCEPT iptables -A OUTPUT -p UDP --sport 21 -j ACCEPT ### FTPserver TCP Rückkanal freigabe! ### #iptables -A INPUT -p TCP --dport 20 -j ACCEPT #iptables -A OUTPUT -p TCP --sport 20 -j ACCEPT ### FTPserver UDP Rückkanal freigabe! ### #iptables -A INPUT -p UDP --dport 20 -j ACCEPT #iptables -A OUTPUT -p UDP --sport 20 -j ACCEPT ### SSHserver TCP freigabe! ### iptables -A INPUT -p TCP --dport 22 -j ACCEPT iptables -A OUTPUT -p TCP --sport 22 -j ACCEPT ### SSHserver UDP freigabe! ### iptables -A INPUT -p UDP --dport 22 -j ACCEPT iptables -A OUTPUT -p UDP --sport 22 -j ACCEPT ### MAILserver TCP freigabe! ### iptables -A INPUT -p TCP --dport 25 -j ACCEPT iptables -A OUTPUT -p TCP --sport 25 -j ACCEPT ### MAILserver UDP freigabe! ### iptables -A INPUT -p UDP --dport 25 -j ACCEPT iptables -A OUTPUT -p UDP --sport 25 -j ACCEPT ### DNSconnectiontracking TCP ### iptables -A INPUT -p tcp --sport 0:65535 --dport 25 -j ACCEPT iptables -A INPUT -p tcp --sport 0:65535 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -p tcp --sport 0:65535 --dport 25 -j ACCEPT iptables -A OUTPUT -p tcp --sport 0:65535 --dport 1024:65535 -j ACCEPT ### DNSconnectiontracking UDP ### iptables -A INPUT -p udp --sport 0:65535 --dport 25 -j ACCEPT iptables -A INPUT -p udp --sport 0:65535 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -p udp --sport 0:65535 --dport 25 -j ACCEPT iptables -A OUTPUT -p udp --sport 0:65535 --dport 1024:65535 -j ACCEPT ### DNSserver TCP freigabe! ### iptables -A INPUT -p TCP --dport 53 -j ACCEPT iptables -A OUTPUT -p TCP --sport 53 -j ACCEPT ### DNSserver UDP freigabe! ### iptables -A INPUT -p UDP --dport 53 -j ACCEPT iptables -A OUTPUT -p UDP --sport 53 -j ACCEPT ### WEBserver TCP freigabe! ### iptables -A INPUT -p TCP --dport 80 -j ACCEPT iptables -A OUTPUT -p TCP --sport 80 -j ACCEPT ### WEBserver UDP freigabe! ### iptables -A INPUT -p UDP --dport 80 -j ACCEPT iptables -A OUTPUT -p UDP --sport 80 -j ACCEPT ### POP3server TCP freigabe! ### iptables -A INPUT -p TCP --dport 110 -j ACCEPT iptables -A OUTPUT -p TCP --sport 110 -j ACCEPT ### POP3server UDP freigabe! ### iptables -A INPUT -p UDP --dport 110 -j ACCEPT iptables -A OUTPUT -p UDP --sport 110 -j ACCEPT ### XNTPserver TCP freigabe! ### iptables -A INPUT -p TCP --dport 123 -j ACCEPT iptables -A OUTPUT -p TCP --sport 123 -j ACCEPT ### POP3server UDP freigabe! ### iptables -A INPUT -p UDP --dport 123 -j ACCEPT iptables -A OUTPUT -p UDP --sport 123 -j ACCEPT ### XNTPconnectiontracking TCP ### iptables -A INPUT -p tcp --sport 1024:65535 --dport ntp -j ACCEPT iptables -A INPUT -p tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -p TCP --sport 1024:65535 --dport ntp -j ACCEPT iptables -A OUTPUT -p TCP --sport 1024:65535 --dport 1024:65535 -j ACCEPT ### XNTPconnectiontracking TCP ### iptables -A INPUT -p udp --sport 1024:65535 --dport ntp -j ACCEPT iptables -A INPUT -p udp --sport 1024:65535 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -p UDP --sport 1024:65535 --dport ntp -j ACCEPT iptables -A OUTPUT -p UDP --sport 1024:65535 --dport 1024:65535 -j ACCEPT ### NFSserver TCP freigabe! ### iptables -A INPUT -p TCP --dport 2049 -j ACCEPT iptables -A OUTPUT -p TCP --sport 2049 -j ACCEPT ### NFSserver UDP freigabe! ### iptables -A INPUT -p UDP --dport 2049 -j ACCEPT iptables -A OUTPUT -p UDP --sport 2049 -j ACCEPT ### NFSconnectiontracking TCP ### iptables -A INPUT -p tcp --sport 1024:65535 --dport 2049 -j ACCEPT iptables -A INPUT -p tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -p TCP --sport 1024:65535 --dport 2049 -j ACCEPT iptables -A OUTPUT -p TCP --sport 1024:65535 --dport 1024:65535 -j ACCEPT ### NFSconnectiontracking UdP ### iptables -A INPUT -p udp --sport 1024:65535 --dport 2049 -j ACCEPT iptables -A INPUT -p udp --sport 1024:65535 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -p UDP --sport 1024:65535 --dport 2049 -j ACCEPT iptables -A OUTPUT -p UDP --sport 1024:65535 --dport 1024:65535 -j ACCEPT ### Alles wird gesperrt! ### iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP Is there any german support? Thanx for your help Rüdiger H

4 3

AW: [suse-security] squid: timeout in SENT_PASV state
by Philipp Snizek 03 Oct '01

03 Oct '01

Hi Bastian Thank you for answering. I already started to believe noone ever will answer my request. As you say it was a misconfigured FW not accepting pasv ftp on high ports. I found out after I slept over it one night. Thank you Philipp > -----Ursprüngliche Nachricht----- > Von: Bastian.Epting(a)helaba.de [mailto:Bastian.Epting@helaba.de] > Gesendet: Dienstag, 2. Oktober 2001 17:16 > An: mailinglists(a)belfin.ch > Betreff: AW: [suse-security] squid: timeout in SENT_PASV state > > > Hi Philipp, > > may be a misconfigured firewall, which not recognize FTP - > PORT command. > > Greetings > > Bastian Epting > > > -----Ursprüngliche Nachricht----- > Von: Philipp Snizek [mailto:mailinglists@belfin.ch] > Gesendet: Samstag, 29. September 2001 21:38 > An: suse-security(a)suse.com > Betreff: [suse-security] squid: timeout in SENT_PASV state > > > > Hi all, > > please can somebody tell me what to do against this. Is this > a ftp server > that is not accepting pasv > ftp? Or is it a misconfigured squid? > > Sep 29 21:23:54 gate squid[406]: ftpTimeout: timeout in > SENT_PASV state > Sep 29 21:24:18 gate squid[406]: ftpTimeout: timeout in > SENT_PASV state > Sep 29 21:24:41 gate squid[406]: ftpTimeout: timeout in > SENT_PASV state > Sep 29 21:29:03 gate squid[406]: ftpTimeout: timeout in > SENT_PASV state > > > Thank you all, > > Philipp > > > > > > > > > > > > > > > > > > > > > > > > > ************************************************************** > ****************** > Bitte nutzen Sie die E-Mail-Verbindung mit uns > ausschliesslich zum Informationsaustausch. > Wir koennen auf diesem Wege keine rechtsgeschaeftlichen > Erklaerungen (Auftraege etc.) > entgegennehmen. Der Inhalt dieser Nachricht ist vertraulich > und nur fuer den angegebenen > Empfaenger bestimmt. Jede Form der Kenntnisnahme oder > Weitergabe durch Dritte ist unzulaessig. > Sollte diese Nachricht nicht fur Sie bestimmt sein, so bitten > wir Sie, sich mit uns per E-Mail oder > telefonisch in Verbindung zu setzen. > > Please use your E-mail connection with us exclusively for the > exchange of information. We do not > accept legally binding declarations (orders, etc.) by this > means of communication. The contents > of this message is confidential and intended only for the > recipient indicated. Taking notice of this > message or disclosure by third parties is not permitted. In > the event that this message is not intended > for you, please contact us via E-mail or phone. > > > Landesbank Hessen-Thueringen Girozentrale > ************************************************************** > ****************** >

6 8

security-control.sh: COF: command not found
by Frederik Ferner 03 Oct '01

03 Oct '01

Dear list, for a few days now I am getting the above message whenever I run /usr/lib/secchk/security-control.sh. I have tried to find out which command cannot be found but I haven't succeeded so far. I can remember changing anything in my setup. All the programs called from security-control.sh seem to be there... Has anyone seen this message before? Where does it come from? Any ideas where I should look for problems? security-control.sh does still give me output when run by hand but I'm not getting any mails when it is run by cron. Any help will be appreciated. Frederik

1 0

Re: [suse-security] ssh Client port
by J�rg Zimmermann 03 Oct '01

03 Oct '01

Hi Holger, From: "Holger van Lengerich (paderLinx GmbH)" <gimli(a)paderlinx.de> Sent: Wednesday, October 03, 2001 11:40 AM > Maybe you haven't read the whole manpage. Try "man ssh^M/UsePrivilegedPort" > ;-) ssh is the client's manpage, not the server's manpage (sshd). mit freundlichen Grüßen Jörg Zimmermann ------------------------------------------- .xsiteing agentur für netzkommunikation 42117 wuppertal - friedrich-ebert-str. 141b tel: 0202/3097070 - fax: 0202/3097072

1 0

a half frequency of CPU
by puma 03 Oct '01

03 Oct '01

Hi all, I'm sorry for off topic... I've got notebook toshiba 4070, there is CPU 366Mhz Celeron and SuSE 7.1 is running on it. Strange is that linux see only half frequency of CPU: cat /proc/cpuinfo cpu MHz : 184.132 After restart it's 186.something or 183... but always in range about 185Mhz. Has anyone some experiencies with this problem? thanks, tom

2 1

Re: [suse-security] ssh Client port
by christian.burri＠synecta.ch 03 Oct '01

03 Oct '01

i am using SuSE 7.2, OpenSSH_2.9p1, SSH protocols 1.5/2.0. When i connect the ssh-server the client gets a unprivileged port. I want the client to get a port between 1000-1023. How can i do that. I read something about a -p parameter, that let the client use ports greater than 1024, but ssh is running without it. Hi There >From "ssh --help": -P Don't allocate a privileged port. This means the ssh client will allocate a non-priviledged socket (which it does, afaik, anyways when not run as root) for the connection to the SSH server, if I get that straight. But if I understand you right, then you would want it to allocate a socket in the range 1000 to 1023, so that the connection will come from between <client IP:1000> and <clientIP:1023>, goin to <ServerIP:22>..... correct?? :-) I dont think that the -P option will help to solve the problem, as it mite grab any unpriv'd socket. I haven't had a look at the SSH client sources, but I'd guess that there is a something.h file somewhere, in which it reads something similar to UPRIV_PORT_LOW 1024 UPRIV_PORT_HIGH 45000 My guess would be, that, if such definitons exist, and if you would change them accordingly to your needs, that this would solve your problem. hope that will help you somehow :-] cheers chr. burri .-. /v\ L I N U X // \\ >I know KungFu!!< /( )\ ^^-^^

2 1