October 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] UDP Port 6666?
by michael.ryan＠storm.ie 31 Oct '01

31 Oct '01

I'd have a look at the services and processes running on the NT box to see whether there is anything unusual/suspicious. Also, you could run a virus scan to check whether any trojans have infected the machine (given that it's a mail server) Regards, Michael Martin Köhling To: SuSE Security Mailing List <suse-security(a)suse.com> <mk(a)lw1.cc-co cc: mputer.de> Subject: [suse-security] UDP Port 6666? 10/31/2001 12:49 PM Hi! One of our out customer's internet proxy/firewall receives UDP broadcasts (several per minute) from one of their internal servers: Oct 31 12:31:52 proxy01 kernel: Packet log: InLog - eth0 PROTO=17 192.168.1.2:4537 255.255.255.255:6666 L=61 S=0x00 I=56516 F=0x0000 T=128 (#1) 192.168.1.2 is an NT server that's currently only used as a mail server - no active users; is this probably a trojan, or could this be Yet Another Windows Feature(tm)? (According to various info websites the trojans "Dark Connection Inside" and "Netbus" use this port...) Regards, Martin -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Re: [suse-security] SuSEpersonal firewall [Correction]
by Thomas Sjogren 31 Oct '01

31 Oct '01

Correction. My mistake, running nmap against my remote ip gave a wrong answer. When a friend tried it from a external network no ports were shown. /Thomas > On Wednesday 31 October 2001 13:55, you wrote: > > Hi, > > > > short question for understanding: from where did you run nmap? local? > > second server connected to internet interface? > > ran nmap from local against remote ip-adress > > > BTW: Reboot is for Microsoft products. On Linux you can simply start and > > stop services. Reboot is for Kernel changes interesting, not for > > firewalls etc. > > i know, but since stop|start gave the same result i decided to do it the > hard way. -- thomas(a)northernsecurity.net | www.northernsecurity.net PGP: 4315 81B3 9E7F DC00 63DC F1D8 1326 651B AADE 91FC (sourceCode == freeSpeech)

1 0

Syslogd stops logging
by spiekey 31 Oct '01

31 Oct '01

Hello! My Syslog stopped logging since the 19th of October. I can almost swear that it was logging after the 19th of October, cause i would have realised it! It´s not very big at all, i have a few GB left on my HD, so that shouldn´t be a problem, too. I killed and started it again, and i restarted the whole system.....still not logging. I had that problem 2x before. It just comes and goes again. freaky! Thank you! Spiekey

4 3

UDP Port 6666?
by Martin Köhling 31 Oct '01

31 Oct '01

Hi! One of our out customer's internet proxy/firewall receives UDP broadcasts (several per minute) from one of their internal servers: Oct 31 12:31:52 proxy01 kernel: Packet log: InLog - eth0 PROTO=17 192.168.1.2:4537 255.255.255.255:6666 L=61 S=0x00 I=56516 F=0x0000 T=128 (#1) 192.168.1.2 is an NT server that's currently only used as a mail server - no active users; is this probably a trojan, or could this be Yet Another Windows Feature(tm)? (According to various info websites the trojans "Dark Connection Inside" and "Netbus" use this port...) Regards, Martin

1 0

RE: [suse-security] Alternative to NFS
by Stefan Suurmeijer 31 Oct '01

31 Oct '01

Andreas Achtzehn wrote: > >I would have wanted to use NFS/SMB/AFS for backup purposes. So how does >SMB behave when I try to transfer a Unix file? Does it create the file >on the receiving server with the same permissions? What about symlinks? > Backup? You can completely configure the permissions samba uses to create files. Look at man smb.conf and search for force create mode and create mode. You can also either allow or disallow samba users to follow symlinks. --> SNIP >>Ehhh. well since I'm still not sure what the exact question >>is it's hard to answer. you want to transfer files. why not >>use ftp? rsync? nfs? afs? smb? tcfs? etc. What os's is this >>between? MSDOS boxes? two suse machines? uhhhhh? why not use >>IPSec for encrypt it? etc. Ask a real question, get a real answer. >> >Because it's not just plain files, but files, symlinks, device-files, >etc. etc. I don't want to wake up in the morning with a >./init.d/init.d/init.d/init.d/init.d/init.d/init.d/init.d/init.d/init.d/ >[...] > >Regards, Andreas > > Still not clear what exactly you want to do, but as mentioned above, you can disallow the following of symlinks, if that's what your worried about. Next to that you can copy any file you want to with just about exactly the permissions you want to. But if I understand you correctly, you want to copy your entire file-system as a means of backup?? Do you have any compelling reasons for not using normal backup media? If not, go with tapes and save yourself a lot of trouble HTH Stefan

1 0

OT-Re: [suse-security] New kernel 2.2.19 on 6.4 hangs on boot
by Wilko Heyl 31 Oct '01

31 Oct '01

Hy, I have the same Problem with SuSE 7.1 on my notebook. (I use my notebook to test the installations before I make it on my servers) My notebook have the same Via Chipset... Only one harddisk on ide0 and the cdrom on ide1. So I suggest not to install the new kernel on Computers with that Via-Chipset-Boards.. Best Regards Wilko Heyl > I installed the new kernel package for 2.2.19 on my SuSE 6.4 > following each step in the announcement. After rebooting it hangs > during the ide detection. I have two hard disks at ide0, a CD-ROM > and a tape drive at ide1. Usually, I get the following messages at > boot: > VP_IDE VIA vt82 c686a (rev 22) IDE UDMA66 controller von pci00:07.1 > ide0: BM-DMA at 0xd000-0xd007, BIOS settings: hda:DMA, hdb:DMA > ide1: BM-DMA at 0xd008-0xd00f, BIOS settings: hdc:DMA, hdd:pio > And here it hangs for at least 5 minutes (I rebooted then).

1 0

SuSEpersonal firewall
by Thomas Sjogren 31 Oct '01

31 Oct '01

Hi, i modified the personal-firewall script so the output became Chain input (policy ACCEPT): target prot opt source destination ports devchain all ------ anywhere anywhere n/a Chain forward (policy ACCEPT): Chain output (policy ACCEPT): Chain rulchain (1 references): target prot opt source destination ports DENY tcp ------ anywhere anywhere any -> filenet-nch:32800 DENY tcp ------ anywhere anywhere any -> 6000:6255 DENY tcp ------ anywhere anywhere any -> printer DENY tcp ------ anywhere anywhere any -> sunrpc DENY udp ------ <ip> anywhere domain -> any DENY udp ------ <ip> anywhere domain -> any DENY icmp ------ anywhere anywhere redirect REJECT tcp -y--l- anywhere anywhere any -> any Chain devchain (1 references): target prot opt source destination ports rulchain tcp ------ anywhere anywhere any -> telnet Chain maschain (0 references): but still the ports was open: Starting nmap V. 2.53 by fyodor(a)insecure.org ( www.insecure.org/nmap/ ) Interesting ports on bifrost.northernsecurity.net (xxx.xxx.xxx.xxx): (The 1519 ports scanned but not shown below are in state: closed) Port State Service 111/tcp open sunrpc 515/tcp open printer 6000/tcp open X11 32770/tcp open sometimes-rpc3 Nmap run completed -- 1 IP address (1 host up) scanned in 0 seconds what did i do wrong? (yes, this was after rebooting) cheers Thomas -- thomas(a)northernsecurity.net | www.northernsecurity.net PGP: 4315 81B3 9E7F DC00 63DC F1D8 1326 651B AADE 91FC (sourceCode == freeSpeech)

1 0

iptables: No chain/target/match by that name
by spiekey 31 Oct '01

31 Oct '01

Hello! I started to build a little iptables/firewall script. but when i run it i get that error: iptables: No chain/target/match by that name I found helpon the web, but they just say that i need to load a module. Well, why doesn´t it say which module it needs? ### Flush Tables iptables -F FORWARD iptables -F INPUT iptables -F OUTPUT ### default policies iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT iptables -P INPUT DROP ### the local loopback interface (-i lo) is open to all the various types ### of IP packets (-p all). iptables -A INPUT -i lo -p all -j ACCEPT ### Ping iptables -A INPUT -p icmp -j DROP ### Block all Incomming Packets with SYN Flag iptables -A INPUT -p tcp ! --syn -j ACCEPT ### Allow serices iptables -A INPUT -p tcp --dport 22 -j ACCEPT ### Block ANY connections from gateway iptables -A INPUTn -s 192.168.10.3 -j DROP Thank you! Spiekey

2 1

password strangeness in 7.2
by Larry Mills-Gahl 31 Oct '01

31 Oct '01

I may have been looking at this box for too long, but I cannot think of the cause of the password problems that I'm having. Changing my password with passwd left me unable to login via ssh. passwd reported that the password had been changed and the value in /etc/shadow had changed, but I could no longer log in (ssh or ftp) I copied the password field from a 6.4 box and am now able to login again. Could anybody point me in the right direction for troubleshooting this? I'd appreciate it. Thanks Larry Mills-Gahl

2 1

strange firewall problem
by greg＠space.cfi.co.ug 31 Oct '01

31 Oct '01

Hi all! I'm running SuSEfirewall2 and of late it has behaved strangely.... PROBLEM: ******* My firewall is denying access to external browsers and yet it allows access to anyone browsing on the LAN (ie. when one uses the internal ip for the server). The following is an extract of my firewall2.rc.config script: FW_DEV_EXT="eth1" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.1.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="www smtp ssh" FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="www smtp ssh 10000 137:139 3128 ftp" FW_SERVICES_INT_UDP="137:139" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" # FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="" # Beware to use this! FW_FORWARD_MASQ="" # Beware to use this! FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" # FW_ALLOW_PING_EXT="no" Is there anything I could have ommitted?? I know that it is most probably the firewall because when I stop the firewall, the pages on the server are browseable even externally, but with the firewall,here is an output of /var/log/messages obtained when one tries to browse pages on this server externally: Oct 30 10:36:22 space kernel: martian source <server-ip> from <client-ip>, on dev eth1 Oct 30 10:36:25 space kernel: martian source <server-ip> from <client-ip>, on dev eth1 thanks, ---- Greg, Computer Frontiers International ,,, /'^'\ ( o o ) oOOO--(_)--OOOo----------------------

1 0