November 2001 - openSUSE Security - openSUSE Mailing Lists

FW: [suse-security] strange log entry
by Michael Appeldorn 07 Nov '01

07 Nov '01

Just not the syslogd is crunching the logfiles but crond with its config file /etc/crontab (suse) does this job regulary, so that this messy can be normal, if you have files like messages07112001.gz in your /var/log Michael -----Original Message----- From: Jan Räther [mailto:jan.raether@zmnh.uni-hamburg.de] Sent: Tuesday, November 06, 2001 4:36 PM To: SuSE Security Subject: [suse-security] strange log entry Hi there, I'm running logcheck-1.1 on a SuSE 7.2 box. Last night i got the following report: Unusual System Events =-=-=-=-=-=-=-=-=-=-= *************** *** WARNING ***: Log file /var/log/messages is smaller than last time checked! *************** This could indicate tampering. should i worry about that? greets, Jan -- Jan Räther Universitaet Hamburg Zentrum für Molekulare Neurobiologie Service-Gruppe EDV Falkenried 94 20251 Hamburg Germany Tel.:040 - 428 - 03 - 6619 Fax.:040 - 428 - 03 - 6621 `When you say "I wrote a program that crashed Windows", people just stare at you blankly and say "Hey, I got those with the system, *for free*".' (By Linus Torvalds) -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Your ideas & opinions: new features for SuSEfirewall2
by marc＠suse.de 06 Nov '01

06 Nov '01

Hi folks, with v2.0 - which will be released within the next 2 days - a stable release is there, all known bugs fixed, no new being reported ... So let's implements some new bugs^H^H^H^Hideas ;-) into SuSEfirewall2 - what functionality is missing? Beware of the rules: 1) no GUI stuff - the GUI is written by a different person 2) should be useful for many people, not just for you 3) should be easy to configure in firewall2.rc.config 4) should be limited to one new FW_... variable in firewall2.rc.config 5) should not hurt security so please send me directly (marc(a)suse.de) your ideas. cc: to this list if you feel like discussing. Greets, Marc -- E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

1 0

Re: [suse-security] SuSEfirewall2 v1.9
by marc＠suse.de 06 Nov '01

06 Nov '01

Hi! > first of all thank you for your good work. But where did you put the SuSEfirewall2 v1.9 tarball? all my betas can be downloaded from http://www.suse.de/~marc/suse Greets, Marc > On 3 Nov 2001 at 13:26, Marc Heuse wrote: > > > Hi folks, > > > > SuSEfirewall v1.9 is now available - with correct version number and > > with all files ;-) > > > > > > background: I forgot to change the version number to 1.8 in the last > > release, after a user reminded me, I repacked it, however because the > > filesystem was full, SuSEfirewall was not in the package ... argh > > sorry for the inconvinience. > > > > Greets, > > Marc > > -- > > E@mail: marc(a)suse.de Function: Security Research and Advisory > > PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" > > Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C > > Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > > > -- Greets, Marc -- E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

3 3

WG: ASSISTANCE....
by Marco Maier 06 Nov '01

06 Nov '01

Oh please. It is really curious. I worked for some time in Togo in a small internet-cafe. Over there I've heard a lot of things and I saw really a lot of emails passing through which were quite the same as this one. Many nigerians who pretended to have arrived to flee from Nigeria with an amount of some million US-$ in their case and that they are now looking for someone in Europe or America to transfer this money into a safe country, promising 10% of the money to the person who would help them. It was about 50 mails like this per day to business-men and even priests. The idea behind this is that the victime opens an account in the 'save country' and communicates the account-number and password to the person in africa. Of course you need to pay a little amount of money transfered to the account just to open it. Now, instead of transfering the big amount of money to the account, they just take of the little sum of money out. Unfortunately there are quite a many of naive peoples. So please Odili, stop your very very old cheat and don't fill up some usefull mailings-list with your tales! Marco -----Ursprüngliche Nachricht----- Von: odili williams [mailto:odili_williams400@yahoo.co.uk] Gesendet: Montag, 5. November 2001 23:49 An: odili_williams400(a)yahoo.co.uk Betreff: ASSISTANCE.... FROM: MR. ODILI WILLIAMS E-MAIL: odili_williams400(a)yahoo.co.uk BUSINESS PROPOSITION: Dear Sir / Madam, I know this will reach you as a surprise, need not to worry as we are using the only secured and confidential medium available to seek for foreign assistance / partnership in a business transaction which is of mutual benefit. I work in the Auditing Department of the First Atlantic Bank, Lagos-Nigeria, which I have served as an auditor and accountant for eighteen years. Presently I am the head of the Auditing Department. It is the tradition of the First Atlantic Bank to audit all dormant accounts at least once in five years. During the course of this exercise, it was discovered that an account containing the sum of USD$18.5 Million (Eighteen Million, Five Hundred Thousand United States Dollars) belonging to a foreign businessman, Engineer Peter Heindrich, who died five years ago in a ghastly air crash involving a Nigerian carrier, ADC Airline, is yet to be collected as none of his relatives has come forward for the claim. At this discovery, the auditing department then reported its findings to the Board of Directors, who after series of meetings has no choice other than to follow the Federal Government of Nigeria directive on unclaimed funds. Nigerian financial law clearly states that if an account remains dormant for a period of five years, six month notification should be given to the account owner after which the fund will be declared UNCLAIMABLE and then transferred into a trust fund solely operated by the Federal Government. In other similar circumstances, there has been cases where funds transferred to the Federal Government Trust Fund were either misused or stolen by senior government officers. This will definitely not be any different since the same government who could not account for the previous funds are still the same people hoping to manage this one. Having this in mind, myself and four other top management staffs of this bank has decided to secretly scout for any foreign businessman who will assist us in the transfer of the said sum. If you agree to work with us as a team, we will furnish you with all that is required for the transfer to be effected while you will stand as a cousin / next of kin of late Engineer Peter Heindrich. The First Atlantic Bank is quite ready to hand over the fund to anyone who can come forward with proofs of genuine relationship with the deceased. My colleagues and I have access to the archives of late Peter Heindrich, we will provide you with all that you need to know. Also since we are working at top positions here at the banks head office, endorsing approvals in your favour will not be a problem as long as our direct involvement in this transaction is not mentioned to anybody. We heard from some reliable sources that some members of the board of directors are working to see that the fund is declared unclaimable because the First Atlantic bank stands to retain for itself the interest that may have accrue for the five years period the money was dormant. We on our part really want to trace any relative of the deceased but time is not on our side since the six months notification as stated in the constitution is fast eating up. At the successful transfer of the fund to your account, you will retain for yourself 30% of the total amount, 10% of the total amount shall be set aside to cover all expenses that may be incurred during the course of transfer. My colleagues and I shall retain the balance 60%. I wish to on behalf of my colleagues state categorically that this transaction is 100% risk free as long as you stick to our instructions. If anything goes wrong along the line, it can be easily traced to us since the file of the deceased has been termed classified by the bank. Myself and my colleagues (who are also involved in this deal) are among the privileged few who has any knowledge about the fund. Bearing this in mind, we have therefore put in place all machinery that will bring this transaction to a successful completion. This we can 100% guarantee. If this proposal is okay by you and you do wish to take advantage of the trust we hope to bestow on you, then kindly get to me immediately through my confidential e-mail as stated above . Please provide me with your most confidential telephone and fax numbers where I can reach you immediately. Awaiting your urgent response. Yours truly, MR. ODILI WILLIAMS. NOTE: THIS TRANSACTION SHOULD BE TREATED WITH UTMOST CONFIDENTIALITY. __________________________________________________ Do You Yahoo!? Everything you'll ever need on one web page from News and Sport to Email and Music Charts http://uk.my.yahoo.com

4 3

strange log entry
by Jan R�ther 06 Nov '01

06 Nov '01

Hi there, I'm running logcheck-1.1 on a SuSE 7.2 box. Last night i got the following report: Unusual System Events =-=-=-=-=-=-=-=-=-=-= *************** *** WARNING ***: Log file /var/log/messages is smaller than last time checked! *************** This could indicate tampering. should i worry about that? greets, Jan -- Jan Räther Universitaet Hamburg Zentrum für Molekulare Neurobiologie Service-Gruppe EDV Falkenried 94 20251 Hamburg Germany Tel.:040 - 428 - 03 - 6619 Fax.:040 - 428 - 03 - 6621 `When you say "I wrote a program that crashed Windows", people just stare at you blankly and say "Hey, I got those with the system, *for free*".' (By Linus Torvalds)

2 1

AW: [suse-security] sftp without without a valid shell?
by Bitzer,Gerd 06 Nov '01

06 Nov '01

Hi, would a shellscript like the following also do the work: ---------- #!/bin/sh # # ftponly shell # trap "/bin/echo Sorry; exit 0" 1 2 3 4 5 6 7 10 15 # IFS="" Admin=access(a)host.some.domain System=`/usr/ucb/hostname`@`/usr/bin/domainname` # /bin/echo /bin/echo "********************************************************************" /bin/echo " You are NOT allowed interactive access to $System." /bin/echo /bin/echo " User accounts are restricted to ftp and web access." /bin/echo /bin/echo " Direct questions concerning this policy to $Admin." /bin/echo "********************************************************************" /bin/echo # # C'ya # exit 0 ---------- -----Ursprüngliche Nachricht----- Von: Andreas Rittershofer [mailto:andreas@rittershofer.de] Gesendet am: Dienstag, 6. November 2001 14:05 An: suse-security(a)suse.com Betreff: Re: [suse-security] sftp without without a valid shell? On 6 Nov 01, at 10:39, Thorsten Marquardt wrote: > I like to offer some customers a kind off sftp account but to deny any > login to this accounts. So I thought about having /bin/false as shell in > /etc/passwd but this prevents sftp to. What can I do? Install a dummy-shell. mfg ar -- mailto:andreas@rittershofer.de http://www.rittershofer.de PGP-Public-Key http://www.rittershofer.de/ari.htm -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

AW: [suse-security] iptables in Suse 7.1
by Bitzer,Gerd 06 Nov '01

06 Nov '01

Hello All, thanks for this insight. To make a short summary, the ftp vulnerability is in the kernel code of iptables, not in the admin utilities which are in the package. Then only the statement in the mail I quoted was misleading. I suspected this, but wanted to have clarification. Thanks -----Ursprüngliche Nachricht----- Von: Roman Drahtmueller [mailto:draht@suse.de] Gesendet am: Dienstag, 6. November 2001 11:34 An: Bitzer,Gerd; alex(a)kel-tek.com Cc: suse-security(a)suse.de; Marc Heuse Betreff: Re: [suse-security] iptables in Suse 7.1 > > > >Also your'e using the old iptables wich has ftp vulnerabilty in it. > >Donload an update from SuSE to iptables-1.2.1a-37 or download > >and compile the latest from netfilter.samba.org > > > > This statement leads me to a question. I'm using 7.1, which shipped with an > old > iptables-1.1.2. Suse never released an updated RPM for this old iptable > release for 7.1 > > Does the iptables-1.1.2 from 7.1 have this ftp vulnerabilty or not ? > Can I use the iptables-1.2.1a-53 from 7.2 with 7.1 ? > > If the iptables-1.1.2 from 7.1 has this ftp vulnerabilty, why wasn't there > ever an update of this package released ? > > Having a look at netfilter.samba.org I see that meanwhile iptables 1.2.4 is > released, and a lot of bugs have been fixed even since 1.2.1a, but no > updates are issued in the update tree on ftp.suse.com. > > Now I'm a little bit worried. Can I leave all untouched, can I use the > 1.2.1a from 7.2 or do I have to build my own package ? Who can shed some > light over this questions ? > > TIA Please see http://lists2.suse.com/archive/suse-security/2001-Sep/0504.html Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE GmbH - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -

1 0

iptables in Suse 7.1
by Bitzer,Gerd 06 Nov '01

06 Nov '01

Hi list, -----Ursprüngliche Nachricht----- Von: Alex Levit [mailto:alex@kel-tek.com] Gesendet am: Montag, 5. November 2001 08:24 An: suse-security(a)suse.com <mailto:suse-security@suse.com> Cc: marc(a)suse.de <mailto:marc@suse.de> Betreff: Re: [suse-security] SuSEfirewall2 v1.9 [ ... ] > > >Also your'e using the old iptables wich has ftp vulnerabilty in it. >Donload an update from SuSE to iptables-1.2.1a-37 or download >and compile the latest from netfilter.samba.org > This statement leads me to a question. I'm using 7.1, which shipped with an old iptables-1.1.2. Suse never released an updated RPM for this old iptable release for 7.1 Does the iptables-1.1.2 from 7.1 have this ftp vulnerabilty or not ? Can I use the iptables-1.2.1a-53 from 7.2 with 7.1 ? If the iptables-1.1.2 from 7.1 has this ftp vulnerabilty, why wasn't there ever an update of this package released ? Having a look at netfilter.samba.org I see that meanwhile iptables 1.2.4 is released, and a lot of bugs have been fixed even since 1.2.1a, but no updates are issued in the update tree on ftp.suse.com. Now I'm a little bit worried. Can I leave all untouched, can I use the 1.2.1a from 7.2 or do I have to build my own package ? Who can shed some light over this questions ? TIA

2 1

Re: AW: [suse-security] [Flame] A Disservice to the Linux Community
by Roman Drahtmueller 06 Nov '01

06 Nov '01

> > Very interesting debate, it's the first time I'm noticing that opensource > > devoted people agree with the meaning of Microsoft: > > http://www.heise.de/newsticker/data/lab-18.10.01-000/ > I think so, too. The particular bug, that has been found is not really > severe, as far as I understood it (you have to guess a 24bit syncookie). > I don't think that there was anything that spoke against full disclosure. > What SuSE did was _maybe_ good from commercial side, but absolutely not > from free and open source side. > This makes me a bit sad :( I'm sad, too. Some bug gets known by person X at a time A. X reports the bug to person Y, a kernel developer, at time B. Y has a fix at time C and communicates it to the distributors of the software. At time C, often in coordination with X and Y, the bug propagates through the security channels, along with the fix. If you cannot live with the fact that the time differences between A, B and C are non-zero, then you should begin programming your own operating system. And, more important, you should better not disclose the sources to anybody, because they might report some security bug. This is how it works, and it has proven to be successful over the last 6 years. So where is the problem? > Markus Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE GmbH - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -

2 1

RE: [suse-security] [Flame] A Disservice to the Linux Community
by Reckhard, Tobias 06 Nov '01

06 Nov '01

> Very interesting debate, it's the first time I'm noticing that opensource > devoted people agree with the meaning of Microsoft: > http://www.heise.de/newsticker/data/lab-18.10.01-000/ > I think that's taking it a bit too far. There is a little agreement between a part of the open source community and Microsoft that information on security vulnerabilities need not necessarily fulfil their maximum blessing when revealed to the general public the very moment they're discovered. However, from what I remember of the MS article, Microsoft would rather have people never release vulnerability information as long as there's no vendor fix *and* a method of deployment to almost all 'customers'. That, of course, shows the direction MS wants to take and it's exactly what full disclosure is set to prevent: vendors keeping vulnerabilities secret, not doing anything about them and denying their existence until it is proven otherwise. This is very much different from 'responsible' conduct with security vulnerability information. See Bruce Schneier's good article from last September on the window of exposure and full disclosure at: http://www.counterpane.com/crypto-gram-0009.html#1. Cheers, Tobias

2 1