December 2001 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Connecting firewall directly to router ...
by Reckhard, Tobias 05 Dec '01

05 Dec '01

> I read the man page for arp. It says that the kernel does > automagic arp if a > route exists between the subnets. Did you also do 'man 7 arp'? That page says that the interface in question has to have proxy arp enabled. It's a sysctl thing, check /proc/sys/net/ipv4/conf/<IF>/proxy_arp. Cheers Tobias

3 2

Compiling Sendmail 8.12.1
by Fiorenza Meini 05 Dec '01

05 Dec '01

Hi there! First of all I have a machine with SusE Linux 7.3 Professional. For security reason I'd like to install the latest version of Sendmail but I didn't find any rpm package for it in the SuSE Web Site; for this I downloaded the source of Sendmail and I'm trying to compile it. I got errors while compiling makemap, probably due to DB library. Has anyone compiled Sendmail 8.12.1, and its modules, without errors? Thanks Regards Fiorenza

1 0

Offtopic (maybe): Proposal for school network
by Christoph Pernsteiner 05 Dec '01

05 Dec '01

Hello, my name is Christoph and I attend a business school. Our school administrator formed a working group for network and computer related problems. Our first task is to review the existing security system and to improve it or create a new one. I worked on a new network design for the school network, and I first created a draft. The First version of the draft can be downloaded from http://www.festlinfo.at/schoolnetwork.jpg. Would somebody be so kind and make comments on it or critisize it because I want to improve it. I know a little bit about computer security and I want to learn more. I excuse for being off topic, but I wanted some experts to review the draft. Have a nice day, Christoph Pernsteiner -- Black holes are where god divided by zero.

6 13

RE: [suse-security] linux virus scanner
by Thomas Schmidt 05 Dec '01

05 Dec '01

Hi, I prefer the Trendmicro Viruswall. With this software could you protect your entire network behind the linux system. > -----Original Message----- > From: Jochen Kaechelin [mailto:jk@wa-p.de] > Sent: Tuesday, December 04, 2001 3:55 PM > To: maillist > Cc: suse-security(a)suse.com > Subject: Re: [suse-security] linux virus scanner > > > Am Dienstag, 4. Dezember 2001 15:43 schrieben Sie: > > Hi folks > > I´m searching for a virus scanner for my linux firewall to scan > > http,ftp and smtp traffic for known viruses. > > I know amavis but he only scans emails. > > Any links or tipps for me? > > regards > > > > Björn Berger > > > > > > <----------------------------------> > > Björn Berger > > > > INVENIT Consulting GmbH > > Riehler Str. 36, 50668 Köln > > > > Tel. / Fax : 0221-77530.0 / .190 > > Internet : http://www.invenit.de > > <----------------------------------> > > > http://www.hbedv.de // AntiVir > -- > WA-P: Programmierung - Beratung - Hosting > Stuttgarter Strasse 3 - D-73033 Goeppingen > Tel. 07161 - 92 95 94 Fax 07161 - 1 36 01 > http://internet.wa-p.de - jk(a)wa-p.de > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

proftpd and append command
by Jacobo González Simón 04 Dec '01

04 Dec '01

Hi all, I have a box runing suse 7.2 and proftpd 1.2.2rc2-12 and i have a problem whith APPEND command. ftp:> dir -rw-rw---- 1 518 reg 86 Jun 25 11:23 pp -rw-rw---- 1 518 reg 43 Jun 25 11:00 pp1 ftp> append pp pp1 ftp>dir -rw-rw---- 1 518 reg 86 Jun 25 11:23 pp -rw-rw---- 1 518 reg 86 Jun 25 11:23 pp1 and both files are the same, does anybody have an idea? I have a directive AllowStoreRestart on in my proftpd.conf Thanks and soory for may poor english. Jacobo

1 0

I get bootp broadcasts from my dsl-uplink
by Andreas Fiesser 04 Dec '01

04 Dec '01

Hello List, since 2-3 weeks my packet-filter gets bombed permanently by TDSL's router. The IP which ifconfig ppp0 names after P-t-P: About 10-20 times a minute I get the following: ------------------------------------------------------------- FEBRUAR:/etc/rc.config.d # tcpdump dst host 255.255.255.255 -i ppp0 Kernel filter, protocol ALL, datagram packet socket tcpdump: listening on ppp0 17:26:25.789070 xxx.xxx.xxx.xxx.bootpc > 255.255.255.255.bootps: xid:0x88866502 ether 0:d0:ba:70:50:ab [|bootp] ------------------------------------------------------------- My questions : How can I stop those lines in /var/log/messages and /var/log/firewall ? But only those regarding these broadcasts. Is there a way to shield my box from inbound packets so that pppoed's DOD can take it offline when there is no outbound traffic ? The same issue apears with the usual scans on 80, 1214 and the other common ports. SuSEfirewall2 blocks them out but pppd regards them as traffic and keeps the connection alive. I called T-Online's "hotline" Person A: yes, there are problems with dsl in my area. I should wait a few days. Me: But ... Person A: those packets are normal. They are the answers from tho webservers I surf to. Me: But it's only this box and this is yours. [... please hold the line ...] Person B: (Chef) Person B: your firewall is WAY TOO tight. Losen the rulesets and you don't see those packets no more. Me: Where is the point of a filter then ? Person B: those packets are neccesary so that the router can spot if my box goes offline Me: but due to those packets my box can't go offline by itself Person B: no problem ... tdsl kicks you anyway after 24 h Me: ARGHL ! !! !!! My proposal, the router shouldn't ask the clients (the customers) via constant bootstrap requests, was ruled out as nonsense. Currently my SuSEfirewall2 settings are like this : though I'd rather have DROP_CRIT at YES ------------------------------------------------------------- FW_LOG_DROP_CRIT="no" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" ------------------------------------------------------------- Shouldn't those broadcast be ignored anyway ? ------------------------------------------------------------- FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" ------------------------------------------------------------- Here a few lines of my /var/log/messages ------------------------------------------------------------- Dec 4 17:23:34 FEBRUAR kernel: SuSE-FW-UNALLOWED-TARGETIN=ppp0 OUT= MAC= SRC=xxx.xxx.xxx.xxx DST=255.255.255.255 LEN=604 TOS=0x00 PREC=0x00 TTL=255 ID=54221 PROTO=UDP SPT=68 DPT=67 LEN=584 Dec 4 17:23:37 FEBRUAR kernel: SuSE-FW-UNALLOWED-TARGETIN=ppp0 OUT= MAC= SRC=xxx.xxx.xxx.xxx DST=255.255.255.255 LEN=604 TOS=0x00 PREC=0x00 TTL=255 ID=54417 PROTO=UDP SPT=68 DPT=67 LEN=584 Dec 4 17:23:40 FEBRUAR kernel: SuSE-FW-UNALLOWED-TARGETIN=ppp0 OUT= MAC= SRC=xxx.xxx.xxx.xxx DST=255.255.255.255 LEN=604 TOS=0x00 PREC=0x00 TTL=255 ID=54613 PROTO=UDP SPT=68 DPT=67 LEN=584 -------------------------------------------------------------

1 0

Fwd: SUSEconfig weakens Postfix chroot security
by JW 04 Dec '01

04 Dec '01

Hello, I hope it is appropriate to forward this to the list. Since it is SuSE specific I'll assume it is o.k. It was sent to BugTraq this morning and I have not seen mention of it here yet. I sincerely hope SuSE releases a fix for this, distributed through YOU. Just thought at the very least it should be brought to the attention of the people subscribed to this list. >Mailing-List: contact bugtraq-help(a)securityfocus.com; run by ezmlm >List-Id: <bugtraq.list-id.securityfocus.com> >From: Matthias Andree <matthias.andree(a)stud.uni-dortmund.de> >To: bugtraq(a)securityfocus.com >Subject: SUSEconfig weakens Postfix chroot security >User-Agent: Mutt/1.3.22.1i > >### INTRODUCTION > >Postfix is a mail transfer agent for UNIX-like systems written by Wietse >Venema. "Postfix attempts to be fast, easy to administer, and secure, >while at the same time being sendmail compatible enough to not upset >existing users." (quote from http://www.postfix.org/) > >SuSE Linux is a Linux distribution, which the vendor claims as being the >most comprehensive, stable and secure operating system on the market >(http://www.suse.de/en/index.html). SuSE Linux ships - among a lot of >other packages - with Postfix and Sendmail. > > >### SUMMARY OF THE ISSUE > >SuSEconfig sets up the chroot for Postfix insecurely. It gives away >system libraries and configuration files to the user that Postfix >processes in the chroot jail run as, this is not a security issue in >itself, but it weakens one of the security barriers that chroot is >supposed to impose. > >SuSEconfig also tampers with the permissions in Postfix' mail submission >directories, which can prevent Postfix from cleaning up after itself, >leading to filled disks and making tracking local malicious users more >difficult. > > >### SCOPE > >SuSE Linux systems that use a SuSE Postfix RPM: > >I cannot do research on all the SuSEconfig.postfix versions out there, >so if you run a different version than any of those shown below, check >out yourself with "grep chown /sbin/conf.d/SuSEconfig". For the -63 RPM >mentioned below, this yields: > > chown -R postfix /var/spool/postfix/* > >I suspect that all Postfix RPMs that SuSE packaged before December 2001 >have this weak spot. > >--- AFFECTED SUSE RPMS > > (I only list here versions that I checked personally.) > > unconditionally: > postfix-19991231pl08-26 (SuSE 7.0 CD) > postfix-19991231pl13-3 (ftp.suse.com update area for 7.0) > postfix-20010228-4 (ftp.suse.com update area for 7.1) > > if POSTFIX_CHROOT="yes": > postfix-20010228pl04-20 (SuSE 7.3 CD) > > if POSTFIX_CHROOT="yes" and POSTFIX_CREATECF="yes": > postfix-20010228pl04-63 (ftp.suse.com update area for 7.3) > >--- UNAFFECTED > > * SuSE Linux systems that run other mail transfer agents than Postfix > are unaffected. > > * SuSE Linux systems that run a manually installed copy of Postfix > (from source of from another RPM maintainer) and that have properly > removed SuSE's RPM (particularly, /sbin/conf.d/SuSEconfig.postfix* > must have been erased) are also unaffected. > > >### "VENDOR" (MAINTAINER) STATUS > >DATE OF CONTACT: 2001-11-28 13:41:10 (UTC) > >1. The Software itself is unaffected. I thank Wietse Venema who helped > finding the bug and showed it is not a problem with Postfix or the > Postfix default installation. > >2. The Packager who provided the configuration script: I contacted > security(a)suse.de and choeger(a)suse.de by email about the problems > below on 2001-11-28 (last Wednesday) at 13:41 UTC, I asked them to > respond within 120 hours, and offered to wait longer with announcing > this problem publically in case they have reasons to defer that. > > My mail was received by mail.suse.de[213.95.15.193] as queue-ID > 0B7BC1E535 at that day, 13:41:10 UTC, but I got no reply, and no new > Postfix RPM had appeared at ftp.suse.com until 14:00 UTC today, > 2001-12-03. > >I can no longer withhold this information from the public; with the >public release I hope to avoid that other users run into the problems >described below. > > >### ISSUE ### > >--- WEAKNESSES IN SUSECONFIG.POSTFIX > >These explanations refer to the postfix-20010228pl04-63 RPM for SuSE >Linux 7.3 i386, as found on ftp.suse.com, unless otherwise stated. > >1. (security) (applies to all versions listed AFFECTED above) SuSEconfig > gives away the files it places in the etc/*, lib/*, usr/* chroot > environment to the user that is to be jailed there. In the unlikely > event that a bug in a Postfix daemon (no such bugs are known to me at > this time) allows a break-in, the attacker can replace any lib/* file > and screw up royally. > > The chroot rationale is to set up a controlled, small, working > environment for a process without special privileges. The additional > security this can provide is undermined when the process that is run > in the chroot can change that "controlled" environment. > > I therefore recommend that the chroot libraries and configuration > files belong to the privileged root user and be configured to mode > 755 or 644 so that in no event the process kept in the chroot can > tamper with the libraries and files. > >2. SuSEconfig.postfix' chroot setup code contains the line > > chown -R postfix /var/spool/postfix/* > > This constitues a race against Postfix daemons (no matter if the > Postfix system is running or stopped). > > When a mail is injected by means of Postfix' /usr/sbin/sendmail > compatibility program (no matter if that calls upon postdrop itself), > the injected mail file belongs to the user running the sendmail > compatibility program. > > When SuSEconfig runs (on systems that have a configuration option to > use chroot, this needs to be "yes") and a local mail injection goes > wrong at the same time, the injecting daemon (sendmail or postdrop) > can no longer remove the broken mail file. This can get nasty if the > injected mail is large, because Postfix can no longer remove the file > that it rejected as "too large". Filled disks may result. > > Also, after this chown command has completed, it is more difficult to > figure out which user has injected the offending mail if malice is > suspected. > >--- STRANGENESS IN PACKAGING UPDATES > >3. SuSE have included the essence of Postfix-20010228-patch07 and > patch08, but stuck with -pl04 otherwise, omitting patch05 and > patch06. The rationale why SuSE chose to not simply update to the > latest bugfix level which does not add features or change documented > behaviour is unexplained and remains unclear. (Please note that since > the release of Postfix-20010228, Postfix-19991231 is unmaintained in > favor of the 20010228 official non beta stable release.) > > >### ACKNOWLEDGEMENTS > > I thank these persons for their help with this issue: > > W. Z. Venema - for helping to find the bug > C. Ludwig - for proofreading this announcement > R. Hildebrandt - for proofreading this announcement > > >### ORIGINATOR/COPYRIGHT/LICENSE/WARRANTIES > >(C) 2001 by Matthias Andree. > >Permission is granted to copy and/or distribute this document under the >terms of the GNU Free Documentation License, Version 1.1 or any later >version published by the Free Software Foundation; with the Invariant >Sections being THE WHOLE DOCUMENT (each section is invariant). No Front- >or Back-Cover Texts are provided. The GNU Free Documentation License is >available at http://www.gnu.org/licenses/fdl.html. ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

1 0

ssh crc 32 compensation attack - update
by Boris Lorenz 04 Dec '01

04 Dec '01

Yup, for those who aren't subscribed to Bugtraq, here's a Bugtraq-posting by Niels Provos, who wrote a nice little tool called scanssh. As its name suggests, scanssh is a ssh protocol scanner which helps to identify the version of running ssh demons/servers. It was quite helpful for me in the last couple of weeks when I had to do clean-ups after some successful ssh-crc32 attacks... Have fun, Boris Lorenz <bolo(a)lupa.de> --- -------------------------cut-here---------------------------- List-Id: <bugtraq.list-id.securityfocus.com> List-Post: <mailto:bugtraq@securityfocus.com> List-Help: <mailto:bugtraq-help@securityfocus.com> List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com> List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com> Delivered-To: mailing list bugtraq(a)securityfocus.com Delivered-To: moderator for bugtraq(a)securityfocus.com Received: (qmail 1887 invoked from network); 3 Dec 2001 20:54:47 -0000 Date: Mon, 03 Dec 2001 15:53:22 -0500 Message-Id: <20011203205322.DE8D9207C1(a)citi.umich.edu> X-UIDL: f4cb1e56db2796beec50ed2ecad30598 XFMstatus: 0000 Sender: provos(a)citi.umich.edu From: Niels Provos <provos(a)citi.umich.edu> To: bugtraq(a)securityfocus.com Subject: SSH Vulnerability Scan SSH Vulnerability Scan Vulnerability to CRC32 compensation attack detector exploit ----------------------------------------------------------- In February 2001, Razor Bindview released their "Remote vulnerability in SSH daemon crc32 compensation attack detector" advisory, which outlined a gaping hole in deployed SSH servers that can lead to a remote attacker gaining privileged access: http://razor.bindview.com/publish/advisories/adv_ssh1crc.html In November 2001, Dave Dittrich published a detailed analysis of the "CRC32 compensation attack detector exploit." This exploit is currently widely in use. CERT released Incident Note IN-2001-12: http://staff.washington.edu/dittrich/misc/ssh-analysis.txt http://www.cert.org/incident_notes/IN-2001-12.html At the Center for Information Technology Integration, Niels Provos and Peter Honeyman have been scanning the University of Michigan for vulnerable SSH server software to identify and update vulnerable SSH servers: http://www.citi.umich.edu/ssh/ However, scans of the Internet show that system and security administrators must react and update their SSH servers: http://www.citi.umich.edu/u/provos/ssh/crc32s.png At this writing, over 30% of all SSH servers appear to have the CRC32 bug. A simple solution is to remove support for Version One of the SSH protocol. The majority of servers on the Internet support the SSH v2 protocol. To test whether your network has vulnerable SSH servers, you might use the ScanSSH tool: http://www.monkey.org/~provos/scanssh/ References: "ScanSSH - Scanning the Internet for SSH Servers", Niels Provos and Peter Honeyman, 16th USENIX Systems Administration Conference (LISA). San Diego, CA, December 2001. http://www.citi.umich.edu/techreports/reports/citi-tr-01-13.pdf This information is also available at http://www.citi.umich.edu/u/provos/ssh/ -------------------------cut-here----------------------------

1 0

AW: [suse-security] linux virus scanner
by maillist 04 Dec '01

04 Dec '01

Thanx for your tipps I think TrendMicro Viruswall is what I´m searching for. Regards Björn Berger -----Ursprüngliche Nachricht----- Von: Hans-Joachim Picht [mailto:h.picht@lnxce.net] Gesendet: Dienstag, 4. Dezember 2001 16:12 An: maillist Betreff: Re: [suse-security] linux virus scanner Sie, maillist, schrieben am 04. Dec 2001: > Hi folks > I?m searching for a virus scanner for my linux firewall to scan http,ftp > and smtp traffic for known viruses. > I know amavis but he only scans emails. > Any links or tipps for me? Im kommerziellen Einsatz ist TrendMicro / Viruswall auf diesem Gebiet der Marktfuehrer, hat aber der Anzahl der Clients entsprechend gestaffelte Preise. Mit freundlichen Gruessen, Hans-Joachim Picht -- Hans-Joachim Picht, Consultant <h.picht(a)lnxce.net> Linux Consulting Europe http://www.lnxce.net Vogelhecke 2 D - 35447 Reiskirchen Tel: +491751629201 Fax: +49640862649 Germany

1 0

linux virus scanner
by maillist 04 Dec '01

04 Dec '01

Hi folks I´m searching for a virus scanner for my linux firewall to scan http,ftp and smtp traffic for known viruses. I know amavis but he only scans emails. Any links or tipps for me? regards Björn Berger <----------------------------------> Björn Berger INVENIT Consulting GmbH Riehler Str. 36, 50668 Köln Tel. / Fax : 0221-77530.0 / .190 Internet : http://www.invenit.de <---------------------------------->

4 3