October 2001 - openSUSE Security - openSUSE Mailing Lists

SuSEfirewall2 v1.8
by marc＠suse.de 28 Oct '01

28 Oct '01

Hi Folks, SuSEfirewall2 v1.8 will be available in some minutes at www.suse.de/~marc/suse Changes: * fixed bug for 172.16.0.0/12 detection at the internal network * added patch for a better logging output Known problems with SuSEfirewall2 v1.7 on SuSE 7.3: ip-up script does not call SuSEfirewall2. Install the aaa_base.rpm update from the ftp servers. If you installed it from the .tar.gz of my homepage, you are not affected. Greets, Marc -- E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

1 0

komisches Kommando in der History (SuSE 7.2)
by Thomas Ruch 28 Oct '01

28 Oct '01

Hallo allerseits, ich habe folgendes komische Kommando in meiner History (nicht als root) gefunden: PROMPT_COMMAND='pwd>&6;kill -STOP $$' Abgesehen davon, dass ich mich nicht erinnern kann dieses Kommando eingegeben zu haben, kann mir mal jemand erklären, was dieses Kommando tut? Danke für Infos Thomas

4 4

SuSeFirewall 2
by xcomb xcomb 27 Oct '01

27 Oct '01

Hi all i forgot you sent once link to download SuSeFirewall 2 please would you send it again i appriciate

2 1

Iptables: howto reject syn-scan and the others
by Praise 27 Oct '01

27 Oct '01

Hi Lists, I have set up my own iptables rules, when I portscan myself with nmap -sT I see all my ports closed. When I try to portscan myself with nmap -sS or other scan types I see my ports "filtered" I would like to see them "closed", but it looks like I need to reject those packets not only with icmp-port-unreachable but with tcp packets (reading nmap man page). How can I reject packets with tcp packets as reply? Praise

2 1

PingPong script
by spiekey 27 Oct '01

27 Oct '01

Hey Linux Gurus! I´m kinda new in this, but i am trying my best and i think i am making good improvements. I wrote that "PingPong" script and i thought that i might be a nice tool. It calls you when one of your servers/hosts are down. I can even ping 10 different host with it, and i will alway get the message to my mobile phone. All u need is a ISDN Card ;) What do you think? It might be a poor coding style, but HEY, it works ;) Regards Spiekey ============================================================================== #!/bin/sh egal=1 #internal/test #Tel_nr="53" Tel_nr="xxx1xx9x3xxx6xx7" var_xxserver=-4 # well, i needed a loop so i made one up which will never come ;P until [ $egal = 2 ]; do ############## 192.168.10.1 ################## if ping -c 3 -w 10 -s 1 -i 30 192.168.x.x 1> /dev/null 2> /dev/null ; then echo "`date` it's ping 192.168.x.x (xxserver)" # don´t flood my logs sleep 60 else var_xxserver=$[var_xxserver+4] var_timer_xxserver=$[var_xxserver * 60] sleep $var_timer_xxserver if ping -c 3 -w 10 -s 1 -i 30 192.168.x.xx 1> /dev/null 2> /dev/null ; then echo "`date` it's ping 192.168.xx.x (xxserver)" else echo "`date` =====> Server is down, lets call the admin, hehe. I was sleeping for $var_timer_xxserver" # try to call my mobile until u get thought ot the device is free i=1; until [ $i = 2 ]; do if /usr/local/tools/ivcall/ivcall 98 $Tel_nr < /usr/local/tools/ivcall/xxserver.wav > /dev/null then i=$[$i+1] fi done sleep 10 fi fi done exit ==============================================================================

3 2

Firewall problems
by Rüdiger H 27 Oct '01

27 Oct '01

hi! 3 days ago I've written an email to you. thanks for your help! everything worked fine, except the nfs. I opened the ports 2049 and 111 completely, but I still get this error message: mount: RPC: Wartezeit abgelaufen ("waiting time expired") I tried to log everything blocked by the firewall, but it didn't work. I don't find the log file of iptables nor in /var/log/messages. These things I've already tried: 1) iptables -N no-conns-from-eth0 iptables -A no-conns-from-eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A no-conns-from-eth0 -m state --state NEW -i ! eth0 -j ACCEPT iptables -A no-conns-from-eth0 -i $DEV_EXT -m limit -j LOG --log-prefix "Bad packet from eth0:" iptables -A no-conns-from-eth0 -i ! $DEV_EXT -m limit -j LOG --log-prefix "Bad packet not from eth0:" iptables -A no-conns-from-eth0 -j DROP iptables -A INPUT -j no-conns-from-eth0 iptables -A FORWARD -j no-conns-from-eth0 2) iptables -N my_drop iptables -A my_drop -p ICMP -j LOG --log-prefix "DROP-ICMP " iptables -A my_drop -p UDP -j LOG --log-prefix "DROP-UDP " iptables -A my_drop -p TCP -j LOG --log-prefix "DROP-TCP " iptables -A my_drop -j DROP 3) iptables -A INPUT -i $DEV_EXT -f -j LOG --log-prefix "IPTABLES FRAGMENTS:" iptables -A INPUT -i $DEV_EXT -f -j DROP 4) iptables -N logdrop iptables -A logdrop -j LOG iptables -A logdrop -j DROP iptables -j logdrop can anybody tell me where I can find the log files? answers in german would be very helpful, but many thanks to all!!! Rüdiger H

5 4

Re: [suse-security] I forgot my root password
by Sven Michels 26 Oct '01

26 Oct '01

> Hi, > I have a SuSE 7.1 box with 2.4.7 kernel. > I forgot my root password (yes, i am an idiot). > How can I make to reset it? > > I have tried to boot as "lilo: linux single" but anyway he asks me > for the root password. lilo: linux init=/bin/sh should give you the rootshell, mount / -n -o remount,rw to mount / writeable, than passwd and set a new password, mount / -n -o remount,ro afther that and you should be able after reboot to login with your new password. > I have tried too boot with a CDrom but with same result. If you boot with the cd, you boot only your system. You can boot a rescue system and mount the root partition to edit your /etc/shadow, but that is more complicated. Have fun, Sven

4 3

Re: [suse-security] SuSE Security Announcement: kernel (SuSE-SA:2001:036)
by James Bliss 26 Oct '01

26 Oct '01

In the same directory as the kernel is located. it is a kernel-source... file. 10/26/01 11:55:48 AM, Jeremy Buchmann <jeremy(a)wellsgaming.com> wrote: >Does anyone know where we can get the source tarballs/RPMS for these >fixed kernels? > >--Jeremy > >On Friday, October 26, 2001, at 09:44 AM, Roman Drahtmueller wrote: > >> On Fri, 26 Oct 2001, Roman Drahtmueller wrote: >> >>> From: Roman Drahtmueller <draht(a)suse.de> >>> To: suse-security(a)suse.de >>> Date: Fri, 26 Oct 2001 18:30:36 +0200 (MEST) >>> Subject: [suse-security] SuSE Security Announcement: kernel >>> (SuSE-SA:2001:036) >>> >>> -----BEGIN PGP SIGNED MESSAGE----- >> >> ...there has been a "noticeable" delay of this announcement. More about >> this during the days of the next week. >> >> Happy updating! I think we have very good kernels again this time. >> >> Roman. >> -- >> - >> - >> | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to >> see, | >> SuSE GmbH - Security Phone: // you need vision!" >> | Nürnberg, Germany +49-911-740530 // Maxi Jazz, >> Faithless | >> - >> - >> >> >> -- >> To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >> For additional commands, e-mail: suse-security-help(a)suse.com >> >> > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

control a program
by Peter Schanbacher 26 Oct '01

26 Oct '01

hi list, is there any possibility to watch what exactly a program/process is doing? I want to know what files are written by one process. MfG Peter

6 5

8 char passwd length (yes, I know)
by Brian Clark 26 Oct '01

26 Oct '01

Greetings, I think I'm too stupid to figure this out, but I've never *had* to figure this out before. :-) I'm trying to up the password length greater than 8. I checked the archives, which lead me to /etc/login.defs concerning PASS_MAX_LEN: # Ignored if the "md5" option is given to the pam_pwcheck module. No idea what that is. So then the archives led me to the configuration files in /etc/pam.d and then found the documentation in /usr/share/doc/packages/pam/modules. So.. % egrep pam_pwcheck /etc/pam.d/* chfn:password required /lib/security/pam_pwcheck.so nullok chsh:password required /lib/security/pam_pwcheck.so nullok login:password required /lib/security/pam_pwcheck.so nullok use_cracklib other:password required /lib/security/pam_pwcheck.so use_cracklib passwd:password required /lib/security/pam_pwcheck.so nullok use_cracklib sshd:password required pam_pwcheck.so sshd.rpmsave:password required /lib/security/pam_pwcheck.so use_cracklib >From what I gather, I need to enable md5 for some or all of those. Which ones? And do I just add the string md5 after the rest of the `module-arguments'? All of them? Do I only need to add md5 to the pam_pwcheck module, or the others in each configuration file also? The docs mention `bigcrypt'. Should I still use md5? % man -k bigcrypt bigcrypt: nothing appropriate. I already have two or three users on the system other than root, so when this is set up correctly, should I just get the users to run passwd again to reset the longer-than-8-passwords? Sorry if I sound silly, but I'm seriously confused. I can't believe this isn't enabled by default. :-\ Thanks, -- -Brian Clark | PGP is spoken here: 0xE4D0C7C8 Please, DO NOT carbon copy me on list replies.

7 15