December 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] open relay qmail
by Zoran Cvetkovic 13 Dec '01

13 Dec '01

Yes, in most parts. It's quite a long time gone since i used qmail. I do not remember the file extensions and pathes, but i do remember what I wrote. Take a look at Bernsteins pages under http://cr.yp.to Regards Zoran Cvetkovic abaesche(a)worklab.de wrote: > > hi zoran, > > das heißt, ich muß den tcpserver installieren, im file /etc/smtp > die IP-Adressen angeben die den mta benutzen dürfen, das > ganze mit tcprules ein .cdb file erzeuge und dann das ganze mit > tcpserver aktivieren. > armin > > |---------+----------------------------> > | | Zoran Cvetkovic | > | | <Zoran.Cvetkovic@| > | | aixigo.de> | > | | Sent by: | > | | zcvetkovic@aixigo| > | | .de | > | | | > | | | > | | 13.12.2001 15:52 | > | | | > |---------+----------------------------> > >--------------------------------------------------------------------------------------------------------------| > | | > | To: abaesche(a)worklab.de | > | cc: suse-security(a)suse.de | > | Subject: Re: [suse-security] open relay qmail | > >--------------------------------------------------------------------------------------------------------------| > > Hello, > > in qmail you usually need to use rcpthosts in combination with > bernsteins tcpserver that invokes the qmail-smtpd, and sets a > environment var according to the calling ip. > > Only both will solve your "adding a valid domainnamet in MAil From:" > relay problem. > > Kindly Regards. > > abaesche(a)worklab.de wrote: > > > > hi all, > > > > i´ve a problem with our qmail-server. it´s listed at ordb.org as open > > relay. :( > > my problem with this is, that i have configured my rcpthosts that only > our > > domains > > could use this server as mta. but it´s easy to take one of these domains > an > > add > > it to "mail from:". Now I use the control-file relaymailfrom to specify > the > > email > > addresses to use this mta. but now when i start qmail-showctl at the end > of > > the output I get this. > > relaymailfrom: I have no idea what this file does. > > anyone an idear? > > thanks > > armin > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > -- > aixigo AG - financial training, research and technology > Schloß-Rahe-Straße 15, 52072 Aachen, Germany > fon: +49 (0)241 936737-70, fax: +49 (0)241 936737-99 > eMail: Zoran.Cvetkovic(a)aixigo.de, web: http://www.aixigo.de -- aixigo AG - financial training, research and technology Schloß-Rahe-Straße 15, 52072 Aachen, Germany fon: +49 (0)241 936737-70, fax: +49 (0)241 936737-99 eMail: Zoran.Cvetkovic(a)aixigo.de, web: http://www.aixigo.de

1 0

SuSE Firewall & Reverse Masquerading
by Alexander Reach 13 Dec '01

13 Dec '01

Hello, I want to do reverse masquerading with the SuSE firewall. I know, that I can use the switch FW_FORWARD_MASQ_* to do this. The Syntax is "Source IP / Destination IP / Destination Port". The Problem is, that I want to redirect to more than one Computer in my local DMZ. How can I do it with this firewall ? Greetings, Alexander

1 0

Re: [suse-security] Juniper SMTPD
by Daniel Nilsson 13 Dec '01

13 Dec '01

All, Could someone try to explain why postfix is a better choice for an SMTP gateway then a recent version of sendmail ? Since we are using sendmail on all other machine in the organization, why would I choose postfix on the SMTP gateway ? Thanks Daniel Nilsson > Rainer Link wrote: > >>On Wed, 28 Nov 2001, Christoph Wegener wrote: >> >>>>I'd recommend to use postfix as SMTP gateway. >>>> >>>So I would I now... ;)) Do you think the solution mentioned in the >>>German Linux-Magazin >>>in June this year by Micheal Wiesmer is favourable?!? >>> >> >>You mean http://www.linux-magazin.de/ausgabe/2001/06/Amavis/amavis.html, >>yes? :-) (it's a very well written article, btw :)) >> >>Well, amavis-perl/amavisd works very well with postfix (for obvious >>reasons, as Lars and myself use only/mainly postfix). amavisd is faster, >>as forking a child is faster than creating a new perl process for every mail. >>For speed reasons I'd suggest to use a virus scanning daemon, such as >>Kaspersky kavdaemon or Sophie for Sophos Sweep. Please see the amavis-user >>ML archive for details here. >> >>Alternatives are i.e. avcheck, which was "designed" for use with >>kavdaemon or H+BEDV AntiVir, Trend InterScan VirusWall or Sophos new >>SMTP-scanner (the latter ones can all be configured to use postfix >>content_filter method, i.e. listening on port 10025 to receive the mails >>from postfix and >>sending non-infected mails back to to postfix via port >>10026). But I haven't tried out the new Sophos product with postfix yet. >> >>HTH >> >>best regards, >>Rainer Link >> >

2 1

Don't panic message from ssh
by Avi Schwartz 13 Dec '01

13 Dec '01

I found the following messages in my logs: Dec 12 18:36:25 coral sshd[7394]: Did not receive identification string from IP. Dec 12 18:36:26 coral sshd[7395]: scanned from IP with SSH-1.0-SSH_Version_Mapper. Don't panic Should I or shouldn't I panic? Thanks, Avi -- Avi Schwartz avi(a)CFFtechnologies.com "I have to share the credit. I invented it, but Bill made it famous." - IBM engineer Dave Bradley describing the control-alt-delete reboot sequence

2 1

Something one can do against an IP beeing used for attacks?
by Rowald Kade 13 Dec '01

13 Dec '01

Hi there, found lots of this in my log: Dec 9 14:58:50 encoco sshd[27696]: connect from root@IP Dec 9 14:58:50 encoco sshd[27696]: log: Connection from IP port 3756 Dec 9 14:58:50 encoco sshd[27696]: log: Could not reverse map address IP. Dec 9 14:59:00 encoco sshd[27696]: fatal: Local: crc32 compensation attack: network attack detected I have changed IP in above. Something one can do against this IP beeing used for attacks? Or, uncover the person behind? regards Rowald

2 1

Bandwidth Bar Permission Problem
by Robert Rottscholl 12 Dec '01

12 Dec '01

Dear List, my problem is that I'm connected through an DialUp Connection. I set up a Bandwidth Bar which can be accessed through my webserver. The setup is done automatic by the ip-up script. The Bandwidth bar creates two files with the group dialup and user root (when called through ip-up in other ways its the group/user who called the programm). The webserver (called through PHP) hasn't got access to these files because only the owner can (600) read them. These Files are created every 15 second's. My question is: Is it save to change the group of the ip-up script in that way that it creates the default right's to 644? Or what would you do? Thank's a lot Robert Rottscholl - DE

1 0

[suse-security] getting mad connecting to (x)ntpd
by UKlaus-Mailinglistenaccount 12 Dec '01

12 Dec '01

Dear colleagues, i wonder if suse took some sophisticated measures to prevent the xntpd from being contacted by clients :-| I configured the server connecting to two "outside" servers as time sources. These connections work fine (shown with "ntpq -p"). The local source was left untouched. Now, if i try to "netdate" to this timeserver from a (linux) client, i immediately get the message "connection refused". Here's the ntpd.conf, maybe i've missed sth? Thanx a lot for your patience Uli server 127.127.1.0 # local clock (LCL) fudge 127.127.1.0 stratum 10 # LCL is unsynchronized server 192.53.103.104 prefer server 212.19.48.35 driftfile /etc/ntp.drift # path for drift file logfile /var/log/ntp # alternate log file logconfig =all

3 2

Re: [suse-security] getting mad connecting to (x)ntpd
by Ulrich Klaus (listaccount) 12 Dec '01

12 Dec '01

Hi all, > please use the command ntpdate for connecting ntp-server(s) > and have a look at: > http://www.eecis.udel.edu/~ntp/ntp_spool/html/build.htm THAT was my mistake. I confess, i didn't know that netdate uses a different port. Very sorry for bothering you! Uli || Ulrich Klaus, ICQ# 136970884, YM uklaus

1 0

RE: [suse-security] getting mad connecting to (x)ntpd
by Reckhard, Tobias 12 Dec '01

12 Dec '01

> Maybe it is compiled with tcp-wrapper support like many other > services. > In this case have a deep look into > /etc/hosts.allow and /etc/hosts.deny > I didn't verify that though... No, ntpd typically isn't linked against tcp-wrappers. I've never seen such a beast and the SuSE RPMs definitely aren't. However, since Guido says that netdate uses a different protocol and port, that's the reason UKlaus is looking for. ntpd listens on UDP port 123 and if no other daemon (or inetd-spawned program) is on UDP port 37, you'll get a connection refused error. Cheers Tobias

1 0

RE: [suse-security] getting mad connecting to (x)ntpd
by Reckhard, Tobias 12 Dec '01

12 Dec '01

Dear colleagues, > i wonder if suse took some sophisticated measures to prevent > the xntpd from > being contacted by clients :-| No. > I configured the server connecting to two "outside" servers > as time sources. > These connections work fine (shown with "ntpq -p"). The local > source was > left untouched. Now, if i try to "netdate" to this timeserver > from a (linux) > client, i immediately get the message "connection refused". > Here's the ntpd.conf, maybe i've missed sth? > > Thanx a lot for your patience > Uli > > > > server 127.127.1.0 # local clock (LCL) > fudge 127.127.1.0 stratum 10 # LCL is unsynchronized > > server 192.53.103.104 prefer > server 212.19.48.35 > > driftfile /etc/ntp.drift # path for drift file > > logfile /var/log/ntp # alternate log file > logconfig =all This looks pretty normal, though I'd probably remove the 'prefer' statement (with lack of a reason not to) and the local clock statement, which does more harm than good quite often (I believe to have observed that the sync to UTC is lost faster when the link to the NTP servers is lost with an LCL driver active, if the LCL isn't synched externally). Are you sure 'netdate' which I don't know, uses NTP? I only know of ntpdate.. Cheers Tobias

2 1