November 2001 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Let's assume a rootkit on our box
by Richard Clyne 08 Nov '01

08 Nov '01

You could use a live eval version of the linux distribution to get 'safe' copies of the binaries. Richard > -----Original Message----- > From: Michael Appeldorn [SMTP:appeldorn@codixx.de] > Sent: 09 November 2001 13:55 > To: Michael Bailey > Cc: suse-security(a)suse.com > Subject: RE: [suse-security] Let's assume a rootkit on our box > > >I may be reinventing the wheel here but wouldn't it be possible to > put > >'rootkit vulnerable' binaries on a floppy and leave it in the drive > >with the tab set to read only? > > >Then, it should be possible to use uncompromised binaries like ps if > >you're suspicious of those on your hard drive. > >

5 4

RE: [suse-security] Let's assume a rootkit on our box
by Michael Appeldorn 08 Nov '01

08 Nov '01

The qualification of thoose guy's that install rootkits seems not to be the question, but the effect. An installed root-kit by the way, says nothing about the skills off the attacker. If he gained access to your box by an self explored and exploited buffer-overrun he is'nt a script-kid -> please choose : hacker,[white|grey|black]hat. If they prevent to see their activities be installing mechanism like rootkits its harder too seek'em. So my question was initially: Show this really all processes even if a rootkit is installed cd /proc for i in $(ls | grep -E ^[0-9]) ; do cat $i/status | xargs | awk '{printf $4 $7 " " $2 " " $5}'; echo ;done >Hmmm...that's true. >How hard would that be to do? Are these rootkits being used by the kind >of people who would do that or are they closer to the kiddie end of the scale? >cheers, >Mike On Fri, Nov 09, 2001 at 02:54:46PM +0100, Michael Appeldorn wrote: > Thats right so far. But if an attacker realize this copy of > the system-files he may circumvent this protection - e.g. > piping the /dev/fd0 device to somewhere else - and me thinking > everything its still fine. > > Michael Appeldorn > > >I may be reinventing the wheel here but wouldn't it be possible to put > >'rootkit vulnerable' binaries on a floppy and leave it in the drive > >with the tab set to read only? > > >Then, it should be possible to use uncompromised binaries like ps if > >you're suspicious of those on your hard drive. > > >I manage a couple of 'hobby servers' in different countries so this > >would be particularly useful as I cannot always be present to insert > >a floppy. > > >- Mike > > >On Fri, Nov 09, 2001 at 10:22:07AM +0100, Michael Appeldorn wrote: > >> > >> Hi list - lets assume out nightmare :=(_ > >> > >> Last night i saw some forensic analysis by honeynet.org. > >> > >> Often - AWK - after gaining access to remote host a rootkit > >> will be installed (swaping bins like netstat or ps) > >> to hide processes and connections i.g. > >> > >> I did this short lines > >> > >> cd /proc > >> > >> for i in $(ls | grep -E ^[0-9]) ; do cat $i/status | xargs | > >> awk '{printf $4 $7 " " $2 " " $5}'; echo ;done > >> > >> to view all processes in a poor way. > <> > >> Is this a possible way to circumvent the rootkits process > >> hiding or will such kits influence the proc-fs as well. > >> > >> And - if it works - are lists for connections, users and so > >> on post rootkitting trusty too ? > >> > >> Michael Appeldorn :O)_ > >> > >> > >> > >

4 3

RE: [suse-security] Let's assume a rootkit on our box
by Michael Appeldorn 08 Nov '01

08 Nov '01

Thats right so far. But if an attacker realize this copy of the system-files he may circumvent this protection - e.g. piping the /dev/fd0 device to somewhere else - and me thinking everything its still fine. Michael Appeldorn >I may be reinventing the wheel here but wouldn't it be possible to put >'rootkit vulnerable' binaries on a floppy and leave it in the drive >with the tab set to read only? >Then, it should be possible to use uncompromised binaries like ps if >you're suspicious of those on your hard drive. >I manage a couple of 'hobby servers' in different countries so this >would be particularly useful as I cannot always be present to insert >a floppy. >- Mike >On Fri, Nov 09, 2001 at 10:22:07AM +0100, Michael Appeldorn wrote: >> >> Hi list - lets assume out nightmare :=(_ >> >> Last night i saw some forensic analysis by honeynet.org. >> >> Often - AWK - after gaining access to remote host a rootkit >> will be installed (swaping bins like netstat or ps) >> to hide processes and connections i.g. >> >> I did this short lines >> >> cd /proc >> >> for i in $(ls | grep -E ^[0-9]) ; do cat $i/status | xargs | >> awk '{printf $4 $7 " " $2 " " $5}'; echo ;done >> >> to view all processes in a poor way. <> >> Is this a possible way to circumvent the rootkits process >> hiding or will such kits influence the proc-fs as well. >> >> And - if it works - are lists for connections, users and so >> on post rootkitting trusty too ? >> >> Michael Appeldorn :O)_ >> >> >>

2 1

Re: [suse-security] [wu-ftpd-2.6.1] ftpaccess configuration
by buckj 08 Nov '01

08 Nov '01

I`ve read it again and agian, but I only can set permissions to different classes but users. I need two users with different permissions and limits. Is this possible with wu-ftpd??

1 0

SuSEfirewall2 and bridge-netfilter
by Norbert Preining 08 Nov '01

08 Nov '01

Hi Marc and all on the list! Short abstract: How to profit from SuSEfirewall2 when having to use a bridge as `gateway/firewall'? Long version: Our institute has put up a packetfilter on a linux-2.2.19 with the bridge-ipchains patches. We have to use a bridge for this (policy of the internat university net that you don't have access to the routers). Since the bridge-ipchains patches work special in the respect that all packets traversing the bridge have to be filtered in the br0 chain no `predesigned' packetfilter could work. Now the bridge-netfilter code is stable (although version number 0.0.2 ;-) and the filtering way has changed so that the packets traversing the bridge are checked in the FORWARD table. Since we want to profit from the good work done on SuSEfirewall2 and the improved filtering options of netfilter and especially because we are - a typical problem of universities - only part time sysadms and primary logicians/mathematicians I want to use SuSEfirewall2 to replace my homegrown ruleset. Now the question: Is this possible at all? Problems I found: The IP address for DEV_INT and DEV_EXT are the same due to being a bridge. I also want to do all the filtering done for the INPUT line for the FORWARD line. Hoping to hear a few suggestions I wish all a good time Best wishes Norbert ----------------------------------------------------------------------- Norbert Preining <preining(a)logic.at> University of Technology Vienna, Austria gpg DSA: 0x09C5B094 ----------------------------------------------------------------------- IBSTOCK (n.) Anything used to make a noise on a corrugated iron wall or clinker-built fence by dragging it along the surface while walking past it. 'Mr Bennett thoughtfully selected a stout ibstock and left the house.' - Jane Austen, Pride and Prejudice, II. --- Douglas Adams, The Meaning of Liff

1 0

ip_masq_irc
by Togan Muftuoglu 08 Nov '01

08 Nov '01

Hi, IIRC there was a security related problem with ip_masq_irc for 2.2.19 kernel back in August. With the new kernel has this problem also been solved ? -- Togan Muftuoglu

1 0

[wu-ftpd-2.6.1] ftpaccess configuration
by buckj 08 Nov '01

08 Nov '01

I`ve a big problem with the configuration of the ftpaccess file. I want to create 2 guestusers with different delete permissions and a limit to enter the server. My ftpaccess looks so in the moment: --------- class accounts guest *class admin real *guestgroup mp3sguestgroup backups realuser ftpadminlimit mp3 1 Any /etc/volllimit backup 3 Any /etc/volldelete no backups delete yes mp3s--------But this doesn`t work. I`ve read this in a tut.Can you say me, what i do wrongPs: I know that wu-ftpd is not very secure, but in the moment i can`t install another one.

2 2

Re: [suse-security] [wu-ftpd-2.6.1] ftpaccess configuration
by buckj 08 Nov '01

08 Nov '01

but how can i do it?

2 1

java2 question
by phil 07 Nov '01

07 Nov '01

downloaded file... 24200K -> .......... .......... .......... .......... .......... [ 99%] 24250K -> .......... .......... .......... .......... .......... [ 99%] 24300K -> .......... [100%] 07:52:37 (2.19 KB/s) - `java2.rpm' saved [24893487] phil@lead:~/000/installed > sux Password: bash-2.05# rpm -Uvh java2.rpm error: failed dependencies: libodbc.so is needed by java2-1.3-69 libodbcinst.so is needed by java2-1.3-69 bash-2.05# rpm -q java2 java2-1.3-46 bash-2.05# Should I force it?

2 3

Transparent Proxy help
by Andreas Niederstadt 07 Nov '01

07 Nov '01

> Hi out there > > I'm new at this list and so I'm asking to pardon me if not being > 'political correct'. My problem is quite simple but obviously not > simple enough. I configured a Box using Suse 7.3 as transparent > firewall using Firewall2 and Squid 2.4 stable beta. This works fine so > far but now I would like to redirect not only http but ftp and https as > well. I tried several kinds of notations to tell squid not only to > listen for port 80 but for 21 and 443 as well. At least I have no Idea > how to type in that instruction correctly into that squid.conf file. If > anybody out there knows how to deal, please let me know. > > thxs > > Andreas Niederstadt > –––––––––––––––––––––––––––––––––––––––––––––––––––––––––––– Niederstadt EDV Service Lettenstrasse 29 D - 79424 Auggen Tel: +49 (0)7631 173715 Fax: +49 (0)7631 173716 E-Mail: adowntown(a)mac.com –––––––––––––––––––––––––––––––––––––––––––––––––––––––––––– >

4 5