December 2001 - openSUSE Security - openSUSE Mailing Lists

Re: Have I been hacked
by Hans Körber 06 Dec '01

06 Dec '01

Thanks to all of you, for providing me with the keywords necessary to understand what seams to have happened on my linux machine (nothing). Regards, Hans Körber

1 0

ssh bug
by Dan Am 06 Dec '01

06 Dec '01

Hello, Where is the recent ssh-update for suse 7.0 ? Does not seem to be in the directory ? Anybody have an idea ? TIA Dan

2 1

(OT) ip aliases
by Schoenwaelder Oliver 06 Dec '01

06 Dec '01

Hi, usually I'd say ip aliasing is no problem. We use it on several servers without any problems. But I have a prob with one server in DMZ which I investigated for hours and don't found any reason for it's behaviour. The machine's IP is x.x.x.251 and has some aliases: eth0:0 = .1 (dns.domain.com) eth0:1 (mail.domain.com) eth0:2 (extra.domain.com) I can ping each ip (from same subnet or other nets) except the .1 address, neither by name nor by ip. Doing a tcpdump on this interface shows no icmp packets for this ip, for others there are packets as expected. It doesn't matter whether I have a specifiy host route for each alias or not. And it's not firewall/nat related because it doesn't work with both shut down, too. Ping this ip or name from the server itself works of course. I don't have any idea why this isn't working. Does anybody have one? Thx, Oliver

1 0

Re: [suse-security] Access to some webservers through firewall
by Ralf Ronneburger 06 Dec '01

06 Dec '01

Hi Andreas, thank you very much, now it works! All I've done is to adjust the values of mtu and mru from 1490 to 1492 in /etc/ppp/peers/pppoe. Although my ifconfig told me before, that mtu was set to 1492... Anyway, as I did not have any idea, how to adapt your iptables-rule to my configuration I first tried it without that and it seems to be enough. Now I can surf every site on the internet again, isn't that great! Thank you again for your help! Best regards, Ralf Ronneburger Andreas Baetz wrote: > On Wednesday 05 December 2001 17:39, you wrote: > >>Hallo Andreas, >> >>sorry for replying in private, but I think this is getting a little OT >>for suse-security... >> >>My mtu is set to 1492, as it's supposed to be. This does make sense to >>me, too, because the packages originate from the firewall, as the proxy >>is running there, so it should know, what packages it can accept... Any >>other idea? >> >> > OK, this is what I did: > I have a router with SuSE 7.3. I configured ppp0 with yast2 (textmode) > and ADSL Config module (not TDSL). With this config, the mtu + mru was > set to 1490 (etc/ppp/peers/pppoe I think). I had a iptables script made by my > own. From behind the router, I could access almost all sites, but not gmx.net. > BTW, the site was not accessible from the router, too. > So I captured the packets on ppp0, and on my browser machine. They looked > the same, so forwarding and masq was ok. The packets I got resemble the > ones you got (handshake ok, get request goes out, but no data from server > come in). So i put > "iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu" > as the first forward rule in my firewall script and restartet my firewall. > Nothing. In the pppd debug output I saw they were negotiating mtu to be 1490. > Then I changed the mtu and mru to 1492, killed pppd and restartet smpppd. >>From then on I could access gmx.net, bahn.de etc, also from my browser machine. > The page of gmx.net doesn't show up with all pictures in konqueror, but in > netscape6 it does. I dunno if this has something todo with it. > It seems that default SuSE kernel comes with tcpmss target support enabled. > > If you find another solution, would you please let me know ? > > best regards > > Andreas Baetz > > > ********************************************************************** > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote also confirms that this email message has been scanned > for the presence of computer viruses. > ********************************************************************** > > >

1 0

Did SuSE hack mirror?
by Simon Oliver 05 Dec '01

05 Dec '01

I was having problems downloading files with ! and .. characters in the filename. I can see the potential security hazard where the resultant path might point to a different directory than intended but that would require the '..' to start the filepath or follow a '/' - the regexp below is not that specific. Am I missing something here or was this a lazy hack? Also, what is the potential security problem with files containing an exclamation mark? This question is not rhetorical - I honestly don't know! Finally, can't this be done in the mirror.defaults file so that it can be overridden on a package by package basis? Why isn't it documented in /usr/share/doc/packages/mirror? It took me quite a while to track this down! # important security check - marc(a)suse.de # we don't use an allow list but an deny list because otherwise # we will get problems with umlaute and other stuff. And the # hole is very small anyway. if ( $src_path =~ m/[\\\n;&<>#\`!\$\*\|]/ || $src_path =~ m/\.\. /) { print STDERR "Error: source filename contains illegal ch aracters: \"$src_path\"\n"; next; } -- Simon Oliver

3 5

Re: [suse-security] Offtopic (maybe): Proposal for school network
by Thomas Sjogren 05 Dec '01

05 Dec '01

> <going into technical details> > Proxy > Fine. And now you make the proxy a Linux box running Squid http/ftp proxy. > It's easy to set up, it's not Windows and >therefore it's more secure. > Not Windows and therefore it's more secure? You wish... Neither Win or Linux is a secure- out-of-the-box OS. ThereŽs no such thing and if youŽre thinking youŽre safe just because youŽre using Linux then you got a lot of reading to do. /Thomas

2 1

proftpd question
by Felipe Blanco 05 Dec '01

05 Dec '01

Hi all. Maybe anybody here knows how to do what i want in proftpd All user that gets into the ftp,is chrooted into the own dir,so anybody can get out of the public dir of the user. I have a group that dont want to be chrooted. so i put the following config in proftpd DefaultRoot ~/public_html users,!staff So users from staff dont have a chroot. The users from this group can explore the directory tree. I want to know if there is any way to make that the users from the group staff can only view the /home dir,and cant go into the source tree of the fs. So .. i want to make another chroot to the users of the group staff into the /home dir. I am trying to ignore virtual hosts. If its possible i want to make this without setup any virtual hosts. Thanx

2 2

Access to some webservers through firewall
by Ralf Ronneburger 05 Dec '01

05 Dec '01

Hello! I have configured my firewall with iptables to basically let in only answers on my requests, which works fine at about 95% of all webservers. But when I'm trying to access some sites my firewall blocks the answers like this: Nov 26 10:04:18 internet kernel: DROP-TCP IN=ppp0 OUT= MAC= SRC=213.83.13.35 DST=222.82.183.145 LEN=1490 TOS=0x00 PREC=0x00 TTL=54 ID=8559 DF PROTO=TCP SPT=80 DPT=1789 WINDOW=15972 RES=0x00 ACK URGP=0 which is correct, because I was trying to contact www.bahn.de (213.83.12.10). I think that they have a load balancer who sent me to that ip-address, but as my firewall did not open a connection there it blocks the packages. Any ideas what I can do about that? By the way, I had the same problem with suse-firewall, too. Best regards, Ralf Ronneburger

3 5

RE: [suse-security] Access to some webservers through firewall
by Reckhard, Tobias 05 Dec '01

05 Dec '01

One thing you could try is to play around with the TCP keepalive options in /proc/sys/net/ipv4 Cheers Tobias

1 0

RE: [suse-security] Connecting firewall directly to router ...
by Reckhard, Tobias 05 Dec '01

05 Dec '01

Disclaimer: I haven't tried any of this myself. > > I got it to work (with help) by doing a 'arp -i eth0 -s > xxx.xxx.xxx.xxx > > 00:00:00:00:00:00 pub Where eth0 is the outside if and > xxx.xxx.xxx.xxx is > > the outside IP address. And of cause the correct MAC address of that > > interface. But it dident work before I added a route!!!! > 'route add -host > > xxx.xxx.xxx.xxx eth1' Where eth1 is the inside of my firewall. > > I've tried several things to get this to work. Does my DMZ > have to have > public IPs for this to work? There is no inherent difference between publiv and private IP addresses. RFC 1918 just reserves a part of the entire address space and forbids its use in the public Internet. > I've done this : > iptables -t nat -A PREROUTING -p tcp --dport 80 -d > 66.8.45.171 -j DNAT > --to-destination 192.168.1.171:80 > arp -i eth0 -s 66.8.45.171 00:01:02:50:B8:9E pub > echo "1" > /proc/sys/net/ipv4/conf/eth0/proxy_arp > > This didn't work. I still get arp requests for 66.8.45.171 > from the router at > 66.8.45.161, but my firewall (66.8.45.162) does not answer them. > > I tried to add a route for 66.8.45.171 to route via 192.168.1.1 (DMZ > interface). Umm.. I think you've got the order wrong. IMHO and from reading the man pages, you should do either: 1. echo 1 > /proc/sys/net/ipv4/ip_forward 2. echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp maybe 3. route add -host 192.168.1.171 dev eth1 I don't think step 3 is meant to be necessary. Or, e.g. if ip_forward is zero, you could do: 1. arp -i eth0 -s 66.8.45.171 <MAC of firewall's eth0> pub You may have got the MAC address wrong, if you're still seeing ARP requests going unanswered. Though the Linux box should be responding nevertheless (so the ARP requests would in fact be answered), it's just that the corresponding MAC address doesn't exist on the LAN segment. Cheers Tobias

1 0