December 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Firewall2 blocks local internet traffic
by Jochen Stärk 30 Dec '01

30 Dec '01

>i have the same problem. the only hint i can give is to stop and start >all instances of >firewall2 ( init, setup and final ) via ip-up in /etc/ppp. Well, that (and what followed) makes me assume they had a reason to include a new ip-up script in their rpm.... if you check the exact name of the firewall2 rpm (rpm-qa | grep firewall) or something aftzer installing and have the files listed (rpm -ql SuSEfirewall2-1.7-25) as you probably know, you see there is a new ip-up in /usr/share/doc/packages/SuSEfirewall2/ip-up ... if you copy that to your /etc/ppp/-directory it will work out just fine. Thanks alot for your quick answer - it made me suspicious about that new ip-up!

3 2

RE: [suse-security] user ***** - am I hacked?
by oxis＠i-campus.de 30 Dec '01

30 Dec '01

Hi, just plug off your linux box from the network ... if the user is still logged in ... have some fun, kick him, U ARE root and secure your linux box .. first kill the daemon or shut down your network or something else!! PS: have a look, wich console the user use .. then u see more ... oXis

1 0

Re: [suse-security] Attack or not?
by johannes.marloth＠t-online.de 30 Dec '01

30 Dec '01

Hi Erwin, * Sun, 30 Dec 2001 11:38:48 +0100 Erwin Zierler wrote: > Hi all, > > I have recently found the following lines in /var/log/messages on one of > my servers running SuSE 7.0, kernel 2.2.16, openssh-2.1.1p1-19: > > Dec 28 09:21:10 server -- MARK -- > ^@^@^@^@^@^@^@^@^@^@^[...] [many many more of this] > Dec 28 14:34:46 server syslogd 1.3-3: restart. I hope that this isn't an attack, as I see it, the server had a systemfailure?! 2 or 3 months ago my system had a kernel panic with the ^@^@.... in the messages-file, so perhaps it's the same.... Perhaps you'll check with find / -mtime 2 what was changed in the last 2 days... HTH Johannes

1 0

Masquerading IPSec through SuSE firewall
by Mark Tinka 29 Dec '01

29 Dec '01

hi list... i have a user with a VPN client, Checkpoint, using the IKE algorithm behind a SuSE 7.2 Pro system with a stock 2.2.19 kernel, being masqueraded to the net using ipchains.... when the user launches SecuRemote, and Checkpoint, he gets authenticated by the remote VPN server... the problem comes when he launches his VPN application, which requires to connect to the remote server on port 23, via the secure connection... but this part of the process fails... my guess is the Linux server is not masquerading the user's encrypted session... in light of this, i decided to enable IPSec and IKE Masquerading in the SuSE kernel sources... there is a patch available on http://www.impsec.org/linux/masquerade/ip_masq_vpn.html which adds the IPSec, PPTP and IKE options to the kernel sources.... when i apply the patch, the patch log file created shows some hunks failed on one of the lines... nonetheless, i go ahead to compile the kernel, and the "make dep" runs ok... when i start the "make bzImage" it runs okay, and then gives some errors after a couple of minutes, when compiling the ip_masq options... i have tried both the old and new 2.2.19 SuSE sources with the same problem.. i don't use the sources from kernel.org because they have always given me problems when compiling on SuSE.. the SuSE lx_sus22 sources are better on SuSE... could the problem be with the patch, or something else... is there another way the IPSec user can be masqueraded..?.. all help appreciated.. thanks.. AKNIT __________________________________________________ Do You Yahoo!? Everything you'll ever need on one web page from News and Sport to Email and Music Charts http://uk.my.yahoo.com

2 2

Local Daily Security for xxx: Changes
by Martin Schichl 29 Dec '01

29 Dec '01

Hallo List! Does anybody know what these entries in the SUSE Security Report mean: OLD: /var/lib/secchk/security-report-daily Sun Dec 23 00:00:02 2001 NEW: /var/lib/secchk/security-report-daily.new Mon Dec 24 00:00:03 2001 * Changes (+: new entries, -: removed entries): - httpd root UDP 193.81.182.39:23284->129.27.2.3:53 - httpd root UDP 193.81.182.39:23285->193.81.13.2:53 - httpd root UDP 193.81.182.39:23286->193.81.182.39:53 - httpd root UDP 193.81.182.39:23361->129.27.2.3:53 - httpd root UDP 193.81.182.39:23362->193.81.13.2:53 + httpd root UDP 193.81.182.39:23796->129.27.2.3:53 + httpd root UDP 193.81.182.39:23806->193.81.13.2:53 + httpd root UDP 193.81.182.39:23807->193.81.182.39:53 + httpd root UDP 193.81.182.39:23856->129.27.2.3:53 + httpd root UDP 193.81.182.39:23857->129.27.2.3:53 + httpd root UDP 193.81.182.39:23858->193.81.13.2:53 + httpd root UDP 193.81.182.39:23859->193.81.182.39:53 Any ideas? ThanX, Martin ----------------------------------------------------------------- DI Martin Schichl SC&C Software, Communication & Consulting GmbH & Co KEG Grottenhofstr. 3, A-8053 Graz Tel. +43/(0)316/265-205, Fax +43/(0)316/265-234 mailto:mschichl@scc.co.at http://scc.co.at

2 1

ssh port fwrd problem after update
by andrius 29 Dec '01

29 Dec '01

hi, After updating from OpenSSH_2.3.0p1 to OpenSSH_2.9.9p2 server (SuSE 7.0) is denying port forwarding requests. I am using TTSSH client utility (win) for connecting to remote mysql server SuSE Linux 7.0 (mysqld listening to inface 127.0.0.1 port 3306). SSH session is established, all works fine, but as soon as I try to connect to forwarded port on my local machine, I see in remote server's logs: debug1: channel 0: new [127.0.0.1] debug1: channel 0: not connected: Connection refused All worked/works fine with OpenSSH_2.3.0p1 version though :-? Tried using sshd_config.rpmnew without any positive result. Could it be mysql misconfiguration or sshd problem? thank you, Andrius

1 0

Re: [suse-security] Re: ICMP
by johannes.marloth＠t-online.de 29 Dec '01

29 Dec '01

Hi John, * Sat, 29 Dec 2001 12:27:25 +0100 "john" wrote: > eth0: PCnet/PCI 79C970 at 0x7000, 00 80 5f 5a 1d 17 assigned IRQ 3. > pcnet32.c:v1.25kf 26.9.1999 tsbogend(a)alpha.franken.de > eth1: 3c509 at 0x300 tag 1, 10baseT port, address 00 60 97 e4 95 53, IRQ > 10. <<<!!!! > 3c509.c:1.16 (2.2) 2/3/98 becker(a)cesdis.gsfc.nasa.gov. <<<<!!!! [...] > eth1: Setting Rx mode to 1 addresses. <<<!!! > > So, eth1 is a 3C509 and here it says IRQ10, but IRQ 10 is taken up > by the SCSI controller. > I assign IRQ9 to eth1 later on (should be done via initrd, I believe) : > > modules.conf:options 3c509 irq=9 > > But I also have : > conf.modules:options 3c509 irq=9 > > which one is the right one (conf.modules/modules.conf???) I don't know which kernel you are using, but in the newer version of SuSE conf.modules is only a symlink to modules.conf, which is the right file for you! As far as I know it, 3Com cards have a problem with IRQs other than 10, so try to reconfigure your SCSI card (jumper etc.) initrd doesn't help you is this case because the 3c509 module is loaded after the SCSI card Bios... HTH -Johannes

1 0

[suse-security] Re: ICMP
by johannes.marloth＠t-online.de 29 Dec '01

29 Dec '01

Hi JohnvD and all other, > kernel: IP_MASQ:reverse ICMP: failed checksum from 195.64.6.130! I'd like to know if 195.64.6.130 is your IP? Surely?! > Dec 28 00:10:33 zwiffelzwaffel kernel: IP_MASQ:reverse ICMP: failed checksum from 213.7.32.37! It seems that your masquerading fails for 213.7.32.37. Another point can be the masquerading and/or forwarding set (misconfigured?). Maybe also an attack is possible.... But if I read: > Dec 28 12:17:51 zwiffelzwaffel kernel: eth1: Setting Rx mode to 1 addresses. Two years ago (something around this :) i got the same message and after five days the nic 'died'.... Perhaps try to deactivate all unnecessary masquerading modules & rules. If you have another netcard, maybe the replacement works... Hope you get it solved, Johannes

2 2

ICMP
by JohnvD 29 Dec '01

29 Dec '01

Hello all, Sometimes I get this in my logfile : kernel: IP_MASQ:reverse ICMP: failed checksum from 195.64.6.130! Dec 28 00:10:33 zwiffelzwaffel kernel: IP_MASQ:reverse ICMP: failed checksum from 213.7.32.37! Dec 28 12:17:51 zwiffelzwaffel kernel: eth1: Setting Rx mode to 1 addresses. I am not sure how to interpret this, because , as yet, I don't know enough about ICMP. What is happening here, is it serious ? The kernel puts it also in /var/log/warn, so... anyway, thanks in advance for any response.... JohnvD

1 0

timeout nuisance
by Dan Am 28 Dec '01

28 Dec '01

hello list, my terminal timeout has been set to 1h, by harden-suse I think. I donot wat to undo all, but only change the timeout, as my sessions and all children timeout all the time. Someone know where to adjust that ? $TIMEOUT is empty. /etc/login.defs does not have it. Regards Dan

2 2