February 2001 - openSUSE Security - openSUSE Mailing Lists

IP_ALWAYS_DEFRAG - Settings in /proc/*
by Steven Thompson 21 Feb '01

21 Feb '01

Hi All What is the possible setting for the following and what do they mean: /proc/sys/net/ipv4/ip_always_defrag I know "0" disables and "1" enables. What does the value "6" mean for the above setting? Where can I find a list explaining the meaning of the different settings? Thanks in advance Steven

3 2

strange Packet Deny's
by Jan Räther 20 Feb '01

20 Feb '01

Hi there, today i found the following in my logs: Feb 20 14:17:37 router kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=339 S=0x00 I=92 F=0x0000 T=128 (#33) what does that mean after all, something to be scared about? This message apears nearly every hour (sometimes more, sometimes less)... any idea's? Jan [?][!] newtention technologies gmbh // rathausallee 72-76 // 22846 norderstedt mailto: jan(a)newtention.de // http://www.newtention.de phone: 040-5 54 45 89 - 3 // mobil: 0178-4777948 // fax: 040-5 54 45 89 - 9 ----- Broadcast message from root: System going down at 1:45 this afternoon for disk crashing.

2 2

[suse-security] kernel: keyboard: unrecognized scancode
by AndriusD＠labas.com 20 Feb '01

20 Feb '01

one day I found my suse box console filled with messy characters and not responding. I had to reboot it switching it off/on what I found in my logs where repeated messages like this: .......................... kernel: keyboard: unrecognized scancode (6b) - ignored kernel: keyboard: unrecognized scancode (65) - ignored last message repeated 2 times keyboard: unrecognized scancode (64) - ignored kernel: keyboard: unrecognized scancode (6b) - ignored last message repeated 4 times kernel: keyboard: unrecognized scancode (65) - ignored ................................ kernel: keyboard: Too many NACKs -- noisy kbd cable? kernel: keyboard: Too many NACKs -- noisy kbd cable? ............................... what could be the cause of this? and is there something to worry about? thank you, _________ andriusd(a)labas.com

3 2

Re: [suse-security] rpm gpgp key
by Volker Kuhlmann 20 Feb '01

20 Feb '01

> suse cd, or oddly enough the suse website (imagine that). > > http://www.suse.de/en/support/security/index.html Yes thanks for making fun at my expense, I did actually check the web site and couldn't find anything. Still can't. (Of course it's on the 7.1 CDs, but I haven't got any.) I should have mentioned that the suse security team key on that page is not the one: > rpm -Kvv ssh-1.2.27-220.i386.rpm D: New Header signature D: Signature size: 156 D: Signature pad : 4 D: sigsize : 160 D: Header + Archive: 450623 D: expected size : 450623 ssh-1.2.27-220.i386.rpm: MD5 sum OK: 517365d17ca1475e06addc76d1e30bff gpg: Warning: using insecure memory! gpg: Signature made Thu 15 Feb 2001 23:43:43 NZDT using DSA key ID 9C800ACA gpg: Can't check signature: public key not found The rpm is signed with a key ID of 9C800ACA, the key on that web page has Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> which isn't quite the same. A search on the web site for "gpg key" doesn't show anything either. Sorry Kurt... :-) Volker

6 11

PAM stability
by Stefan Suurmeijer 20 Feb '01

20 Feb '01

Hi list, I'm currently looking into future e-mail solutions for our university. We would like to use external authentication databases (LDAP in all probability) for user authentication. To me it seems that PAM is the best way to go to get all software to authenticate via any means you might want to, but none of the two solutions that we are testing so far support it. When I asked them why, one of the manufacturers replied that they had so far not included PAM support because all current PAM implementations were buggy in multi-threaded environments and tended to crash when working with large numbers of users. While I strongly doubt this statement, I have to admit I have yet to test PAM in an environment with as many users as our mailserver will have (~25,000 users). I am wondering if anybody on this list is using PAM on their SuSE boxes (or any other *NIX environment) for authentication (mail/ftp/whatever) with this number of users, or has had any negative experiences with this number of users and PAM. TIA Stefan

2 1

Re: [suse-security] Filter verstopft ?
by Andreas Fiesser 20 Feb '01

20 Feb '01

Sven Schultheiß schrieb: > Hi Andreas. English is spoken on this list! Hi Sven. Ah well ... didn't think about it. I considered it quite amazing, your response being very fast and consisted not just of a flame as it is a good tradition on the Net but on the contrary translated my lines and provided a link to the solution of the problem, too. > I dont think that your firewall blocks anything I really hope this is not the case ! ;) > it seems to me that you > have set the wrong mtu on your router. I couldn't imagine that the router dropped some packages while most other get through. After insmoding this module I get thos sites all right. Maybe slow (www.chip.de/...) but they show up eventually. How come that withput this module some sites gave full speed dsl, the majority was at least as fast as ISDN or modem but some servers don't deliver http to me at all while they are still being pingable. And why isn't this module installed along with pppoed.rpm in the first place ? I suspected the filter to stop some strange packets to enter the router with which the servers would check my client for infos. My junkbuster produces similar efects sometimes. Then the webserver spots me filtering out his ads and denies delivering stuff to me. One of them even asked me to disable the ad-filter. Thanks a lot Andreas

1 0

Re: [suse-security] Filter verstopft ?
by Christian Bohn 20 Feb '01

20 Feb '01

Hi! das Problem kann auch am DSL-routing selbst liegen. Hast du das KernelModul mssclampfw geladen? Ohne dieses Modul funktionieren manche Verbindungen nicht richtig (z.B. auch die letsbuyit-Seite) Bei www.club-nokia.de konnte ich das Problem reproduzieren, deine anderen Beispiele hab ich jetzt probiert aber ich denke, daß es daran liegt. bye Christian Bohn ----- Original Message ----- From: "Andreas Fiesser" <fiesser(a)gmx.net> To: "Security SuSE" <suse-security(a)suse.com> Sent: Monday, February 19, 2001 7:11 PM Subject: [suse-security] Filter verstopft ? > Hi Liste ! > > Ich habe hier eine SuSE 7.0, die mir den DSL-Router und > SuSE-Firewall macht. > > Das funktioniert soweit ganz gut, bis auf einige Seiten, die sich > auf den Clients nicht abrufen lassen, wenn ich per Masquerading > surfe. > www.club.nokia.de, www.ron.de, www.landau.de, um nur einige > Beispiele zu nennen. > > Ich kann die anpingen, aber ich bekomme scheinbar keine Web-Seiten > geliefert. > > > Auf dem Router habe ich jetzt den JunkBuster gestartet und die > Clients dafür konfiguriert. So klappts dann mit den oben genannten > Sites. > > Irgendwie fängt der Firewall oder das Masquerading was ab, sodaß die > Verbindungen verhungern, wenn ich nicht mit dem Proxy surfe. > Da der Router eher etwas schwachbrüstig ist, möchte ich eigentlich > aber lieber keinen Proxy einsetzen. > > Kann mir jemand sagen, wo das hier hängt ? > > > Gruß > Andreas > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 1

AW: [suse-security] Anti-Portscan tool
by Thomas Lamy 19 Feb '01

19 Feb '01

> Von: Boris Lorenz [mailto:bolo@lupa.de] > Gesendet: Montag, 19. Februar 2001 12:39 > An: suse-security(a)suse.com > Betreff: RE: [suse-security] Anti-Portscan tool > > > > On 18-Feb-01 Thomas Lamy wrote: > > Hi all, > > > > I think of installing a tool, which automatically blocks > port scanners at > > the gateway for a specific time (perhaps one day). > > There are numerous tools out to achieve that. Portsentry > (www.psionic.com/abacus/portsentry) is just one of them. I've heard binary (very extreme) opinions about it; some like it, some "hate" it. > Basically it's a > rather esoteric discussion wether to actively block incoming > portscans, say via > route-dropping, or to properly configure your firewall and > some intrusion > detection tools in order to let the admin know what's going > on, without active > blocking. Currently I have a (basic) firewall script running, which blocks nasty ports and spoofing on the whole net, and does thorough port filtering on the servers. As this is at a small ISP, I can't do the "default policy deny" thing (at least not on the dialup subnet). I get real large logs from that script every night, and see the "usual" network scans, service probes (mail/squid abuse etc). For some time I used to write a mail to the respective network admins, but after all I found I should have spent my time on other things. :-( > > For a more complete approach you may visit www.snort.org. > Snort is an intrusion > detection/monitoring software, which, together with tools > like Guardian (also > on www.snort.org), can be used to monitor, log and drop. Well, I tried snort on (but not guardian) from SuSE 7.0 on a friend's machine, and it logged all kind of dns lookups, which were ok in my opinion. Had a look at their support section, but found no (real) solution. I think it's time to spend some time with it... > > Another good place to look for tools of that kind would be > the linux tools > section of www.securityfocus.com, or start research about > intrusion detection on > www.securityportal.com. > I'll look there. > > The problem with such configurations is that you may have > some non-hostile routes get dropped because of an anal > portsentry-/snort-setup. On the other hand, dropping routes from most script kiddies or > win-trojan-scanners may have some "psychological effects", but after dropping the > (dynamically assigned) IP address of such a kiddie he or she may hang up and dialin > again, thus getting an other IP address from his/her peer, and the scanning > begins anew. This fills up your logfiles and may indeed lead to a denial-of-service > in the worst case, but doesn't do any good. This is the reason I want to block for only a certain amount of time (calculated from my old log files). Sure this wouldn't keep me from being DoS'ed, but it keeps the kiddies out. > > Finally, if you drop routes from experienced black hats he or > she may feel > invited to have a second look into your network and to dig > deeper into the bag > of tricks, especially if you use portsentry's doubtful > "feature" where a > (probably offending) banner can be spit out after a denied > connection attempt. Good point. > If you plan to set up intrusion/portscan detection systems > you should not use > any pro-active retaliation (route droppings, etc.) for a > while, say a couple of > months or so. During this period, carefully watch the output > of these tools and > finally make a decision wether to switch to active dropping > based on these data. Yep, as I already stated, I have as much as 2 year's logfiles of portscans etc. And as usual, every new "feature" is looked at with special care. > > > > > TIA, > > Thomas > > --- > Boris Lorenz <bolo(a)lupa.de> > System Security Admin *nix - *nux -- 6 x 9 = 42

2 1

Filter verstopft ?
by Andreas Fiesser 19 Feb '01

19 Feb '01

Hi Liste ! Ich habe hier eine SuSE 7.0, die mir den DSL-Router und SuSE-Firewall macht. Das funktioniert soweit ganz gut, bis auf einige Seiten, die sich auf den Clients nicht abrufen lassen, wenn ich per Masquerading surfe. www.club.nokia.de, www.ron.de, www.landau.de, um nur einige Beispiele zu nennen. Ich kann die anpingen, aber ich bekomme scheinbar keine Web-Seiten geliefert. Auf dem Router habe ich jetzt den JunkBuster gestartet und die Clients dafür konfiguriert. So klappts dann mit den oben genannten Sites. Irgendwie fängt der Firewall oder das Masquerading was ab, sodaß die Verbindungen verhungern, wenn ich nicht mit dem Proxy surfe. Da der Router eher etwas schwachbrüstig ist, möchte ich eigentlich aber lieber keinen Proxy einsetzen. Kann mir jemand sagen, wo das hier hängt ? Gruß Andreas

1 0

ssh, kernel updates
by Roman Drahtmueller 19 Feb '01

19 Feb '01

Hi, just a brief heads-up: There will be updates for ssh (and probably also the kernel) later today to address the latest security problems with ssh. Stay tuned. Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

12 29