December 2001 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] SuSE Security Announcement: wuftpd (SuSE-SA:2001:043)
by carlos＠keysoft.pt 02 Dec '01

02 Dec '01

Jus't to say that I also didn't see the suse-security announce. I'm subscribed to both lists and always archive the announcements from suse-security (shorter subject) - I'm (I was:) still waiting for the suse-security announcement so that it could be archived. Carlos > -----Original Message----- > From: cwe(a)bph.ruhr-uni-bochum.de [mailto:cwe@bph.ruhr-uni-bochum.de] > Sent: sexta-feira, 30 de Novembro de 2001 18:12 > To: abien(a)gmx.net; draht(a)suse.de > Cc: suse-security(a)suse.com > Subject: Re: RE: [suse-security] SuSE Security Announcement: wuftpd > (SuSE-SA:2001:043) > > > 30.11.2001 19:00:16, Roman Drahtmueller <draht(a)suse.de> wrote: > > >Actually no... I've seen it running through. It was sent to > >suse-security-announce at Wed, 28 Nov 2001 23:55:25 +0100 (MET), to > >suse-security at Wed, 28 Nov 2001 23:58:18 +0100 (MET), and > to bugtraq at > >Wed, 28 Nov 2001 23:59:42 +0100 (MET). We usually wait until > we see our > >own posting from -announce until we send it off to > suse-security, later > >other addresses, including bugtraq. > > > >Roman. > > > Hi, > well I didn't get it and I can't find it on the list archive > > http://lists2.suse.com/archive/suse-security/2001-Nov/ > > but maybe I am too stupid... > > Christoph > -- > .-. Ruhr-Universitaet Bochum > /v\ L I N U X Lehrstuhl fuer Biophysik > // \\ >Penguin Computing< c/o Christoph Wegener > /( )\ Gebaeude ND 04/Nord > ^^-^^ D-44780 Bochum, GERMANY > > Tel: +49 (234) 32-25754 Fax: +49 (234) 32-14626 > mailto:cwe@bph.ruhr-uni-bochum.de http://www.bph.ruhr-uni-bochum.de > > > > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

4 4

Re: [suse-security] firewall log entries
by Robert Rottscholl 02 Dec '01

02 Dec '01

SoulPatrol wrote: > Hallo Robert, > > Am Saturday, December 01, 2001, 6:23:38 PM, schriebst du: > > > > >>michael.ryan(a)storm.ie wrote: >> > >>>I just noticed the following entries in my firewall log: >>> >>>Nov 23 19:44:11 kore kernel: Packet log: input DENY eth0 PROTO=6 >>>192.168.1.4:22 >>>a.b.c.d:22 L=40 S=0x00 I=16126 F=0x0000 T=246 SYN (#3) >>>Nov 23 19:47:21 kore kernel: Packet log: input DENY eth0 PROTO=6 >>>192.168.1.4:22 >>>a.b.c.d:22 L=40 S=0x00 I=28824 F=0x0000 T=246 SYN (#3) >>>Nov 23 19:47:58 kore kernel: Packet log: input DENY eth0 PROTO=6 >>>192.168.1.4:22 >>>a.b.c.d:22 L=40 S=0x00 I=9754 F=0x0000 T=246 SYN (#3) >>>Nov 23 19:51:35 kore kernel: Packet log: input DENY eth0 PROTO=6 >>>192.168.1.4:22 >>>a.b.c.d:22 L=40 S=0x00 I=38173 F=0x0000 T=246 SYN (#3) >>> >>>eth0 is the external i/f ... does this indicate ssh connection attempts >>>with spoofed IP source addresses? >>>(I do have a machine on reserved IP address 192.168.1.4 but it can only >>>establish connections to the firewall via eth1) >>> >>>TIA >>>Michael >>> >>> >>> >>> >>Hi Michael, >> > > >>you should enable ROUTE VERIFICATION >>---snap---- >> > echo >> "1" /proc/sys/net/ipv4/conf/<device>/rp_filter ^ | | What's that good for? See "http://www.netcologne.de/~meberg/netfilter/Packet-Filtering-HOWTO.txt" near the end you find the description. Ciao ;-) Robert > >>--end of snap-- >> > >>Ciao ;-) >> > >>Robert Rottscholl - DE >> > >

1 0

modssl: SSLSessionCache dbm
by Lukas Feiler 02 Dec '01

02 Dec '01

I can't get my SSLSessionCache working! I am running SuSE 7.2 Pro; Apache/1.3.20 mod_ssl/2.8.4 OpenSSL/0.9.6b mod_jk PHP/4.0.6 configured shm is not supported so I am using dbm: SSLSessionCache dbm:/var/log/httpd/MAIN/ssl/ssl_cache SSLSessionCacheTimeout 300 but no cache-files get created. It tried it successfully with an other machine that I configed nearly exactly the same (I am running SuSE 7.2 Pro; Apache/1.3.20 mod_ssl/2.8.4 OpenSSL/0.9.6a mod_jk PHP/4.0.6 ; httpd.conf, ssl, DNS, ...) - OpenSSL/0.9.6a instead of OpenSSL/0.9.6b anyone an idea?? Please help me! regards Lukas

1 0

sendmail problem
by Marios amrti 02 Dec '01

02 Dec '01

Hi i know this doesnt have much to do with security but i ve been trying to figure it out for a few days now and all i get is dead ends. I have been configuring sendmail with varius ways and still im not able to send anything. when i send the mail i get this output: rewrite:map dequote not found rewrite:map mailertable not found rewrite:map mailertable not found rewrite:map mailertable not found /root/dead.letter....saved in /root/dead.letter mailerdaemon...saved message in /var/log/dead letter im using sendmail 8.11.2-34 Please help this is starting to get on my head.... Thanks

1 0

firewall log entries
by michael.ryan＠storm.ie 01 Dec '01

01 Dec '01

I just noticed the following entries in my firewall log: Nov 23 19:44:11 kore kernel: Packet log: input DENY eth0 PROTO=6 192.168.1.4:22 a.b.c.d:22 L=40 S=0x00 I=16126 F=0x0000 T=246 SYN (#3) Nov 23 19:47:21 kore kernel: Packet log: input DENY eth0 PROTO=6 192.168.1.4:22 a.b.c.d:22 L=40 S=0x00 I=28824 F=0x0000 T=246 SYN (#3) Nov 23 19:47:58 kore kernel: Packet log: input DENY eth0 PROTO=6 192.168.1.4:22 a.b.c.d:22 L=40 S=0x00 I=9754 F=0x0000 T=246 SYN (#3) Nov 23 19:51:35 kore kernel: Packet log: input DENY eth0 PROTO=6 192.168.1.4:22 a.b.c.d:22 L=40 S=0x00 I=38173 F=0x0000 T=246 SYN (#3) eth0 is the external i/f ... does this indicate ssh connection attempts with spoofed IP source addresses? (I do have a machine on reserved IP address 192.168.1.4 but it can only establish connections to the firewall via eth1) TIA Michael

2 1

Fw: tcb scheme implemented for Owl
by Peter Nixon 01 Dec '01

01 Dec '01

Is SuSE looking at using this system anytime soon? -- Viel Spaß Nix - nix(a)susesecurity.com http://www.susesecurity.com Begin forwarded message: Date: Thu, 15 Nov 2001 22:56:58 +0100 From: Rafal Wojtczuk <nergal(a)owl.openwall.com> To: announce(a)lists.openwall.com Subject: tcb scheme implemented for Owl Hello, You may have noticed that recently a new package named "tcb" has been added to Owl-current. It features the new implementation of pam_unix module and the new method of storing password hashes. The interesting point is if you invest your time in reading tcb(5) and tcb_convert(8) man pages, you will be able to configure your Owl system so that many utilities can run with low privileges. Most notably, passwd(1) does not need to be suid root. Currently, new features are disabled by default. Soon during install time one will be given a choice between the old shadowed passwords scheme and the new tcb scheme. Meanwhile, we encourage you to test new tcb features and share with owl-users(a)lists.openwall.com the experience gained. You may also be interested that on 23-25th November there will be held a Linux conference, which will feature a talk on Owl. The event is named JWGL (http://www.7bulls.com/JWGL) it is held near Warsaw, Poland. It is the fourth edition of the conference which focuses on professional Linux and GNU software appliances. The event is mostly local (the speeches are given in Polish), but if you want to meet Richard Stallman personally, this is the occasion :) The JWGL Owl talk will cover amongst others: - Owl security and design concepts - software developed for the needs of Owl - generic methods to improve software security (examples from Owl) - the tcb scheme: the "least privilege" rule in flesh

1 0