March 2001 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

Sendmail SMTP AUTH / SSL
by Raffy 02 Apr '01

02 Apr '01

Hey list, On my box I have sendmail running. In order to use SMTP over SSL I run it with stunnel in inetd: smpts stream tcp nowait root /usr/local/sbin/stunnel stunnel -D 3 -p /usr/local/ssl/certs/stunnel.pem -r smtp Further I configured sendmail to use SMTP AUTH. Everything works perfect. But: smpts is on port 465. I configured my clients such that they use that port. So far so good. But now port 25 can still be used to send email. I could block it at the firewall but then I am not able to receive email any more, because other mailservers are talking with me on that port. (right?) Is there a solution that I can use SMTP over SSL and SMTP AUTH? Clients should not be able to connect without SSL or SMPT AUTH! Thanks Raffy

19 31

Bind
by Hipolito A. Gonzalez M. 02 Apr '01

02 Apr '01

I upgrade to the new 8-8.2.3 bind version, but, every morning the daemon "named" is stop. Is any trying to hack me? I have and real ip and I'm making hosting. Thank you. In log nothing appear. -- www.geekcode.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ h! r++ y++ ------END GEEK CODE BLOCK------ - A veces creo que hay vida en otros planetas, y a veces creo que no. En cualquiera de los dos casos, la conclusión es asombrosa (Carl Sagan) -----------------------------------------------------------------

3 3

iptables
by office＠tride.net 02 Apr '01

02 Apr '01

Hello list, does the SuSEfirewall-script support iptables? cu

3 2

bind-update-attempt
by Daniel Quappe 31 Mar '01

31 Mar '01

hi list, in the last weeks i often got the syslog-message that somebody wanted to update my bind-server for somedomain which was of course denied by my bind-system by default. but: are there any problems in the software i have to think about with regard to a worst case scenario...;-) many thanks in advance, bye daniel

3 3

suse enterprise server
by bacano 30 Mar '01

30 Mar '01

hi2all, Regarding the security applications and features included in suse enterprise edition, what it has more than the professional version? Will be available any upgrade from professional to enterprise edition? [ ]'s bacano

1 0

lockdsvc : invalid argument. when loading nfsserver in 2.4.2
by Avi Schwartz 30 Mar '01

30 Mar '01

When starting up the nfsserver under Kernel 2.4.2 I get the error message lockdsvc : invalid argument. Searching the Internet (thanks Google!), I found some messages in the linux-kernel mailing list that there is no need to start rpc.lockd from the init scripts any more when using rhe 2.4.X kernels as it is loaded automatically on mount. I commented out these line from /etc/rc.d/nfsserver: checkproc -n lockd || \ /usr/sbin/rpc.lockd and restarted the NFS server. The error is gone and so far everything seems to work. Two questions: 1) Am I inviting problems by commenting out these lines? Is there a security issue? 2) If they are no longer needed, could SuSE please fix the scripts. Thanks, Avi -- Avi Schwartz Get a Life, avi(a)CFFtechnologies.com Get Linux!

1 0

many nic's
by office 30 Mar '01

30 Mar '01

Hello, how many network cards can i put into my linux box for firewalling? cu

3 2

Re: [suse-security] Ports
by NightWatcher 29 Mar '01

29 Mar '01

On Thu, 29 Mar 2001, you wrote: > I am administering a system that needs access to certain ports, but I do > not want to restrict access to these ports for these programs. The ports > are 5555 and 7000. How do I do this do that it is still secure and won't > create any security holes. > > > thank you, > michael > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com well who do u want to have access to the host (all? or single ips?) when it are single ips u can use the ipchains -I input -p tcp-s thefromip -d yourinternetip portnumber -j ACCEPT and after that ipchains -A input -p -s 0/0 -d urip port -j REJECT.. then only the accepted ips can enter.. otherwise make sure u cant login to that port using telnet etc (like an ftp server wich u can access with telnet and then turn it off( www.dutchriot.com)) hope that u have something about it greetz remko (NightWatcher IRCop(a)irc.quicknet.nl) Security Admin / advisor -------------------------------------------------------

1 0

DNS and Firewall (again) !
by Diogo Bacelar Quintela 29 Mar '01

29 Mar '01

Hello List I have a small network base on private ips and have one masquerading server. I want to specify in TCP options on the other machines the gate way machine as a dns server also.. Some abstraction.. I used to have named doing name caching for that. However now I am trying to use SuSEFirewall (or even by hand) to do that work. I mean.. All trafic from internal machines to firewall 's dns port (53) be automatically redirected (and masqueraded) to one dns server of the ISP (or both of those..) I have a cable connection and a SuSE 7.1 FTP clean installation. I believe it is SuSEfirewall 4.3 and kernel 2.4.2.. Is it possible ? I've looked and firewall's config and there are two non matching option's : port redirection (No private ips) and local port redirection (doesn't work!) TIA Diogo Quintela /------------------------------------------------------------------ || Diogo Bacelar Quintela ||----------------------------------------------------------------- || diogo.quintela(a)netcabo.pt // dbq(a)rnl.ist.utl.pt ||----------------------------------------------------------------- || PGP Public Key || http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x2099755D \------------------------------------------------------------------

1 0

RE: [suse-security] AW: Squid on Firewall?
by Reckhard, Tobias 29 Mar '01

29 Mar '01

> AFAIK you should NEVER use a > proxy etc. on any firewall due to the buffer- > overflow-problem. sorry... > Huh? Get real, man, with that attitude you shouldn't connect anything to an untrusted network, as any application could be susceptible to buffer overflows. And check out the literature on firewalls whenever you have a bit of spare time, I recommend the 2nd edition of 'Building Internet Firewalls' by Chapman, Cooper and Zwicky. Most, if not all, of the firewall people prefer application layer gateways, aka application proxies, over packet filters when constructing firewalls. And I'd much rather have only one application, the proxy, to watch for a compromise than the entire number of client applications.. Cheers, Tobias

5 5

Kernel Backdoor (April Fool's joke)
by Roman Drahtmueller 29 Mar '01

29 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- To those involved in Linux security: The latest release of "Linux-Magazin", a monthly German magazine that focuses on Linux, contains an article by Mirko Dölle about security problems in the Linux kernel. In particular, the article argues that IP packets could be forwarded to the address 208.47.125.33 (there is a PTR record at gary7.nsa.gov, which has an A record back to the same address). Many German Linux users have been calling SuSE support to learn details on how to deal with this problem, not willing to believe that the article is an April Fool's joke on security. None of the claims are correct, which makes a kernel update unnecessary for this particular problem. Now, as inclined readers of security mailing lists may have noticed, there are indeed security problems in the Linux kernel. These problems are no backdoors of any kind, and they are not related to the article mentioned above. In addition, the known kernel security issues are not remotely exploitable, which means that local shell access is needed to take advantage of the weaknesses. The weaknesses allow for a local attacker to gain superuser access to the system. SuSE will provide update packages for the supported distributions 6.3, 6.4, 7.0 and 7.1 shortly that eliminate the known problems. The SuSE kernels are standard kernels, equipped with a set of patches that introduce drivers and many other enhancements to the standard Linux kernel. The update packages are currently being tested and will be available and announced as soon as possible. As an information for those who compile and install their own kernels: The freshly released Linux kernel version 2.2.19 fixes the known issues in the kernel. It should run smoothly on all 6.x SuSE Linux distributions, but please note that 2.2.19 requires update packages for the lvm and/or the raidtools (formerly mdutils) package if lvm (logical volume manager) or the software raid facility of the Linux kernel are used. The lvm package is available for download from our ftp server ftp.suse.com, the raidtools package will follow soon. Regards, Roman Drahtmüller, SuSE Security -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOsM8uney5gA9JdPZAQGnRggAkh+oXciCyj07rUgi0YJ4DEQVYopJRZQw oYFcktCTC/CYXE42ZEkChlMO9UA2Op6kiFyqDnaIKo12C1555CxAJgjszQfAjPCe 1b2kxLNtY0GvibkFHjgJ5BLeh7rM3d7bMoA14HKSNXcHDQIuJEUD0Hh0ENe4fNng qfZNHsd2EIdkjN3ncuQGjqPvy5N+se145OrEUGsOFY5Xb1KajxJhd8SlJ8+VkjTA 5tRi4NvLUZqdk1eKPvcKSkIuuv/rmSSOBEASUr/dEmy4Z8guVNW3qP6jk4HtPjYp 23yTkhZDHaYpCC7S/gMoU3pSrre0nh51W6yQx1oBOqaWZJtLSUJ+2A== =RpeD -----END PGP SIGNATURE-----

1 0

Lion worm with SuSEfirewall blocked?
by Marko Kaening 29 Mar '01

29 Mar '01

Hi, at http://www.sans.org/y2k/lion_protection.htm one can read how to prevent Lion attack using ipchains. Is this already included in the SuSEfirewall 4.4? Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

2 1

Security updates and You
by Togan Muftuoglu 29 Mar '01

29 Mar '01

Hi, I might be wrong in jumping in making an assumption yet when I clicked the location mentioned in the message with the subject [suse-security] Lion worm with SuSEfirewall blocked? I out of curiosity cliked the link to the suse update site mentioned where I have been informed regarding teh apache update with security fix note. 1) Has there been a security announcement for that which I accidently did not noticed. If there was none the package is dated 21 st March meaning a week over so there is something missing. Or alternativle apache 1.3.17 is not vulnarable. 2) patches directory does not have anything regarding apache so if you do an update with YOU you will not get it. I though YOU was for security fixes Sorry if there had been an announcement an I have missed it -- Togan Muftuoglu

1 0

security checking daemons
by Morsal Roudbay 29 Mar '01

29 Mar '01

I have installed several security checking deamons that come with SuSE 7.0. Daily, weekly and monthly reports are all sent to root... Is it possible to somewhere change this setting so it's sent to an email account of mine? Thanks in advance.

3 2

RE: [suse-security] AW: Squid on Firewall?
by Reckhard, Tobias 29 Mar '01

29 Mar '01

> > However, of course you'll have programs running on the packet filter > > as well. First, there's the kernel. Then you've probably got syslogd > > and crond running. > > A DHCP client is more likely. I would not have crond, the only thing ... [large snip] Yeah, whatever. Those are good ideas, Mike, but my point was *that* he'll have software running on a packet filter, not *what* software that is exactly. That's an entirely different and rather large can of beans.. Cheers, Tobias

1 0

Re: [suse-security] dns zone x-fers on tcp 53
by Markus Gaugusch 28 Mar '01

28 Mar '01

> What is the reason for installing pri dns server in a self owned DMZ and sec > dns server at the isp? Convenience - you can manipulate the zones easier. > If the firewall ist not stateful this enables inet users to do dns > probes on tcp 53 and other worse things. why? you can block tcp port 53 for everyone except the ip of the secondary NS. bye Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

2 1

do these log entries document attacks?
by Christian Gorski 28 Mar '01

28 Mar '01

hallo friends of linux does anybody know what i´ve got here, where X.X.X.1 is the box which logs these messages? 1) Mar 27 19:46:38 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4586 X.X.X.1:27374 L=48 S=0x00 I=59472 F=0x4000 T=111 SYN (#42) Mar 27 19:46:38 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4590 X.X.X.255:27374 L=48 S=0x00 I=60496 F=0x4000 T=111 SYN (#42) Mar 27 19:46:38 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4590 X.X.X.255:27374 L=48 S=0x00 I=337 F=0x4000 T=111 SYN (#42) Mar 27 19:46:39 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4590 X.X.X.255:27374 L=48 S=0x00 I=3921 F=0x4000 T=111 SYN (#42) Mar 27 19:46:39 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4590 X.X.X.255:27374 L=48 S=0x00 I=6993 F=0x4000 T=111 SYN (#42) Mar 27 19:46:41 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4586 X.X.X.1:27374 L=48 S=0x00 I=18257 F=0x4000 T=111 SYN (#42) 2) Mar 27 20:26:44 linux kernel: Packet log: input DENY eth0 PROTO=17 212.93.208.240:28432 X.X.X.1:28431 L=29 S=0x00 I=44573 F=0x0000 T=119 (#42) Mar 27 20:26:44 linux kernel: Packet log: input DENY eth0 PROTO=17 212.93.208.240:28432 X.X.X.255:28431 L=29 S=0x00 I=45597 F=0x0000 T=119 (#42) 3) Mar 27 21:38:29 linux kernel: Packet log: input DENY eth0 PROTO=6 207.194.143.211:1002 X.X.X.1:111 L=60 S=0x00 I=38602 F=0x4000 T=49 SYN (#42) Mar 27 21:38:29 linux kernel: Packet log: input DENY eth0 PROTO=6 207.194.143.211:1006 X.X.X.255:111 L=60 S=0x00 I=38606 F=0x4000 T=49 SYN (#42) 4) Mar 28 02:17:11 linux kernel: Packet log: input DENY eth0 PROTO=6 207.18.60.53:2712 X.X.X.1:53 L=60 S=0x00 I=34799 F=0x4000 T=46 SYN (#42) Mar 28 02:17:11 linux kernel: Packet log: input DENY eth0 PROTO=6 207.18.60.53:2716 X.X.X.255:53 L=60 S=0x00 I=34843 F=0x4000 T=46 SYN (#42) Mar 28 02:17:17 linux kernel: Packet log: input DENY eth0 PROTO=6 207.18.60.53:2712 X.X.X.1:53 L=60 S=0x00 I=36023 F=0x4000 T=46 SYN (#42) 5) Mar 28 08:36:18 linux kernel: Packet log: input DENY eth0 PROTO=17 210.104.121.253:55675 X.X.X.1:137 L=78 S=0x00 I=61465 F=0x0000 T=105 (#42) Mar 28 08:36:20 linux kernel: Packet log: input DENY eth0 PROTO=17 210.104.121.253:55675 X.X.X.1:137 L=78 S=0x00 I=61721 F=0x0000 T=105 (#42) Mar 28 08:36:21 linux kernel: Packet log: input DENY eth0 PROTO=17 210.104.121.253:55675 X.X.X.1:137 L=78 S=0x00 I=61977 F=0x0000 T=105 (#42) tia cg

4 4

dns zone x-fers on tcp 53
by Philipp Snizek 28 Mar '01

28 Mar '01

Dear list users, What is the reason for installing pri dns server in a self owned DMZ and sec dns server at the isp? If the firewall ist not stateful this enables inet users to do dns probes on tcp 53 and other worse things. Thank you all for a quick answer, Philipp

2 1

RE: [suse-security] AW: Squid on Firewall?
by Reckhard, Tobias 28 Mar '01

28 Mar '01

Re Daniel. > yes, your are right! getting compromised by a > client applications isn't good indeed...;-) > It sure ain't. :-) > but that wasn't my hint about this topic. > my idea is to separate your system into two > ones: > first you have a hardened firewall-system without > any programm running on it. > second there is a proxy-server behind the wall with > "your" application proxies. > So you mean a pure packet filter when you say 'hardened firewall-system'? I call that a packet filter. :-) Yes, it generally makes sense to have a packet filter as the point of entry to your network. However, there are a couple of possible architectures. Quoting from the book I named: 1. Single-box architectures: screening router, dual-homed host. 2. Screened host architectures 3. Screened subnet architectures 4. Architectures with multiple screened subnets: split-screened subnet, independent screened subnet 5. Variations on firewall architectures If what you're proposing is a packet filter up front and a proxy in the internal network, then you have a screened host architecture. A screened subnet architecture, in which the screened subnet is referred to as a DMZ, is more common in the corporate world. Most Linux home users use a single box, either as a screening router (if they only use ipchains) or, if they're running (some) proxies on the box, as something you could term a hybrid between a screening router and a dual-homed host, or a collapsed DMZ. The latter is the setup described by the initiator of this thread. It is stupid, yes, not to perform packet filtering on a proxy that is part of a firewall system, if you can. However, of course you'll have programs running on the packet filter as well. First, there's the kernel. Then you've probably got syslogd and crond running. Unless you're performing administration from the console only, you'll probably have sshd running. Cheers, Tobias

2 1

SuSE Security Announcement: joe (SuSE-SA:2001:09)
by Thomas Biege 28 Mar '01

28 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: joe Announcement-ID: SuSE-SA:2001:09 Date: Tuesday, March 27th, 2001 17.03 MEST Affected SuSE versions: 6.1, 6.2, 6.3, 6.4, 7.0, 7.1 Vulnerability Type: local privilege escalation Severity (1-10): 3 SuSE default package: yes Other affected systems: all system using joe Content of this advisory: 1) security vulnerability resolved: joe problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information A bug in joe(1), a userfriendly text editor, was found by Christer Öberg of Wkit Security AB a few weeks ago. After starting joe(1) it tries to open its configuration file joerc in the current directory, the users home directory and some other locations. joe(1) doesn't check the ownership of joerc when trying the current directory. An attacker could place a malicious joerc file in a public writeable directory, like /tmp, to execute commands with the privilege of any user (including root), which runs joe while being in this directory. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/ap1/joe-2.8-300.i386.rpm 3140f1eb79eb246ad98f7687de517371 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/joe-2.8-300.src.rpm 0c04bb25b8ae452f1fcdfe11af32e1b6 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/ap1/joe-2.8-304.i386.rpm 2a406de36322fc7bc28aaeca0bbdf54d source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/joe-2.8-304.src.rpm 2aac0d130597d580d96c75d59397958c SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/ap1/joe-2.8-303.i386.rpm 348a5e4a981f76943c77431606e5c3b2 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/joe-2.8-303.src.rpm 9f938aa365460257baf56f5f92f565ee SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/ap1/joe-2.8-302.i386.rpm 236ec54a0251859e1c2c1fc4018b5dae source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/joe-2.8-302.src.rpm 49b638dd238cacc8e99048ee5a8024ea SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/ap1/joe-2.8-302.i386.rpm 094577b41a2ad5baa0d16f4d53378d0e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/joe-2.8-302.src.rpm 78333a2bac40b08db1e54ccaf1380caf SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/ap1/joe-2.8-305.i386.rpm 72fbb78af21f3878f1ae8b8bc87c96f4 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/joe-2.8-305.src.rpm b4fbe27a24bf66d60db45da3c3d13020 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/ap1/joe-2.8-290.sparc.rpm eeb78e413ee0b48d39ccdab29228ae80 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/joe-2.8-290.src.rpm f29199161ffd38f3f26c82b5d21ba89b SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/ap1/joe-2.8-292.sparc.rpm d1d70f58df37de53f05734d90be596fa source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/joe-2.8-292.src.rpm 45091ece9cb66e4f093d07b0386fd2b9 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/ap1/joe-2.8-296.alpha.rpm 85e609519bbfbbc0be5aec7b8de2dffc source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/joe-2.8-296.src.rpm ce623f8a73b1f6395eb9498324cc1e21 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/ap1/joe-2.8-293.alpha.rpm d930c6a2f0757f51f04409946f6152f8 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/joe-2.8-293.src.rpm 0b20e5bd36f0feeaf78cb4815566e982 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/ap1/joe-2.8-293.alpha.rpm 6278e4dd4a42d4e091d1a08e3f617fa2 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/joe-2.8-293.src.rpm 88f428cc9c916b9159dfb54144c7802e SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/ap1/joe-2.8-295.alpha.rpm 3e531066b0495be2261f02ef2d4583f0 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/joe-2.8-295.src.rpm 1d7796f1fad01365e40a944f0db84470 PPC PowerPC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/ap1/joe-2.8-272.ppc.rpm f11094b9f1afeb04786030e3a140ed03 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/joe-2.8-272.src.rpm 4058ea46c9d75976a24a6ac419fc19d5 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/ap1/joe-2.8-274.ppc.rpm c385a2ca601cf9b01ad2d39433d6a872 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/joe-2.8-274.src.rpm b667ea68d356a9582d3696ad68869c69 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/ap1/joe-2.8-273.ppc.rpm 4f6c2c20e961aea4987381d12692af6c source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/joe-2.8-273.src.rpm 8c3ebda871c54afc11a24d80d207c34e ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - We are in the process of preparing update packages for the man package which has been found vulnerable to a commandline format string bug. The man command is installed suid man on SuSE systems. When exploited, the bug can be used to install a different man binary to introduce a trojan into the system. As an interim workaround, we recommend to `chmod -s /usr/bin/man´ and ignore the warnings and errors when viewing manpages. - The file browser MidnightCommander (mc) is vulnerable to unwanted program execution. Updates are currently being built. - Two bugs were found in the text editor vim. These bugs are currently being fixed. - A bufferoverflow in sudo was discovered and fixed RPMs will be available as soon as possible. A exploit was not made public until now. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOsG6aney5gA9JdPZAQEkMAgAiLgKgaIQS9psq0wwl/RJDaXCKwopeKsx meuZexE+iBgCXEeDAYtsbUEgTtHfTZ7XO5VwsIfFD9r8yOoAxWUcCkmIHOTYlRF3 jC4BTN5PkhbY7JymlSaEIreEfgflNWfYY1soaUm0LYy6Q/jDvMYReMh7uiG3wpPw ja8wiLjJ+PZa7OqtCsk9zTLBmFeTHJJ0mYeiy8qD4xASUW+GY6qE9i9naYrZgN9L oEY6DrOy6RERh35+NKMaI21o+yULhxPcV1AUYUndyc4U3OQErNEoLdViU6F39KeB JA9sgxk8iMvtqEyyCWaWJyRahrzo05gBepjUy+DjTovmJGMOhR+VAg== =58ij -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

SuSE Security Announcement: eperl (SuSE-SA:2001:08)
by Thomas Biege 28 Mar '01

28 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: eperl Announcement-ID: SuSE-SA:2001:08 Date: Tuesday, March 27th, 2001 16.00 MEST Affected SuSE versions: 6.3, 6.4, 7.0, 7.1 Vulnerability Type: local and remote compromise Severity (1-10): 6 SuSE default package: no Other affected systems: all system using eperl package Content of this advisory: 1) security vulnerability resolved: eperl problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The ePerl program is a interpreter for the Embedded Perl 5 Language. It's main purpose is to serve as Webserver scripting language for dynamic HTML page programming. Besides this it could also serve as a standalone Unix filter. Fumitoshi Ukai and Denis Barbier have found several potential buffer overflows, which could lead to local privilege escalation if installed setuid (note: it's not installed setuid per default) or to remote compromise. There is currently no efficient measure against the security problems in the eperl perl interpreter other than not using or updating it. SuSE provides update packages for the defective software. SuSE Linux version before 6.3 don't include the eperl package. Download the update package from locations described below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/d2/eperl-2.2.14-206.i386.rpm e613b06d47dcfb7bbcea8c3d0c0e678b source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/eperl-2.2.14-206.src.rpm c58a95f3b8ae757ea4d72f3157e2ea62 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/d1/eperl-2.2.14-203.i386.rpm e66520cc0062e25495941542dd5b1f82 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/eperl-2.2.14-203.src.rpm 34d6682524154c9fb7b5fbec4f4ea82e SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/d1/eperl-2.2.14-203.i386.rpm 4b6a5a89899320a8eeb35c149ae111f5 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/eperl-2.2.14-203.src.rpm 062b14716e52f2649f4380a6a6e4e7f9 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/d1/eperl-2.2.14-202.i386.rpm ba75d7f4a64329a3b5c324b3f0742575 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/eperl-2.2.14-202.src.rpm c7ae001d4668ba3a0524f94429b1e4e6 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/d2/eperl-2.2.14-193.sparc.rpm 9752f8b9df6ac1ffdc68cb4b552d6491 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/eperl-2.2.14-193.src.rpm f09a1ce9288c201ae63e193914fc84ce SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/d1/eperl-2.2.14-191.sparc.rpm 900eddc134215569fc88d11ce14c11f3 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/eperl-2.2.14-191.src.rpm 76aaa0efa8ae1c84b80201f73462fc26 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/d1/eperl-2.2.14-195.alpha.rpm d7b4be8d988f8cd501a33f9d2fb12a07 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/eperl-2.2.14-195.src.rpm b0379287f9078fcd244cc720fad92c4d SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/d1/eperl-2.2.14-195.alpha.rpm 78241206bc1b3927effdb5b1aa4d0ed5 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/eperl-2.2.14-195.src.rpm 325a04ec8c5c3da6b9c2fdf4e2c6c901 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/d1/eperl-2.2.14-194.alpha.rpm 88a09004e5c0c2e6174785207e111318 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/eperl-2.2.14-194.src.rpm a04cfa3e64aac49f6c148992e9a50189 PPC Power PC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/d2/eperl-2.2.14-178.ppc.rpm 3e05c702aca97db476155054d113ff95 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/eperl-2.2.14-178.src.rpm 67849b0c1c053eca482508fe2eac3042 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/d1/eperl-2.2.14-177.ppc.rpm 35584e2f1bcebced98fad2ae241824da source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/eperl-2.2.14-177.src.rpm 98046dce35c4adfba57cc54c018376d7 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/d1/eperl-2.2.14-176.ppc.rpm 9c36bad7ec2e8f6c31307729c7d21bc8 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/eperl-2.2.14-176.src.rpm eeaf1144dd659fe13b6a943bf40bf65b S/390 Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/s390/update/7.0/d1/eperl-2.2.14-182.s390.rpm 416974a30c9c9e435e028f2807e15a51 source rpm: ftp://ftp.suse.com/pub/suse/s390/update/7.0/zq1/eperl-2.2.14-182.src.rpm b14c7d9cbb969cda54b0d9f599f1b5cc ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - We are in the process of preparing update packages for the man package which has been found vulnerable to a commandline format string bug. The man command is installed suid man on SuSE systems. When exploited, the bug can be used to install a different man binary to introduce a trojan into the system. As an interim workaround, we recommend to `chmod -s /usr/bin/man´ and ignore the warnings and errors when viewing manpages. - The file browser MidnightCommander (mc) is vulnerable to unwanted program execution. Updates are currently being built. - Two bugs were found in the text editor vim. These bugs are currently being fixed. - A bufferoverflow in sudo was discovered and fixed RPMs will be available as soon as possible. A exploit was not made public until now. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOsG3GXey5gA9JdPZAQGQtQgAmPBgkp8fCIbo0RJ+mJDa0Zx7W0N8S+Ba LP2tH/cXkW9QPUT5vh1mKbB+LsH6wuG/uv7NG0EMrYHcmy3UFBEFKel4XD4G8XNU BhAKegayEvjYH/OK8q8poVHYdvctrZ00LtfrW7IQkNfCXEVx0ByfaX5w/Qe/GQxQ MWlqdw2klUXpnYZnaYj7mMsdTrc6DrIGdL4uCWozdQcyxGLeh/mQArg4TEdpv7KT OW0LgDgZETo5akS/AwtZn3NE7rh+ZIAUAhPw8iUoK0k6RY+Z+RJa+QFQ+XXv7eHm EXUcUd0wY47j5CROk+g7WzYy92Vn6VVOY63pcbhiv4R8BuPM9WVWJw== =QNk3 -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

Sytem Attack or ?
by Togan Muftuoglu 28 Mar '01

28 Mar '01

Hi everyone Receiving this from the snort can someone explain what the hell is going on I have and ADSL connection on eth1 with dhcp assigned Ip and the lan is on eth0 I am running the snort with -i eth1 as the Daemon with snort-lin defining the HOME_NET 192.168.1.0/24 and EXTERNAL_NET as 212.xxx.xxx.0/22 as outlined with the ifconfig eberything else is left as is. Help is appreciated Mar 27 18:11:49 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61018 -> 195.44.254.18:80 Mar 27 18:12:00 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61019 -> 207.200.86.65:80 Mar 27 18:12:00 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61019 -> 207.200.86.65:80 Mar 27 18:12:02 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61020 -> 207.200.86.65:80 Mar 27 18:12:02 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61020 -> 207.200.86.65:80 Mar 27 18:12:03 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61019 -> 207.200.86.65:80 Mar 27 18:12:08 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61020 -> 207.200.86.65:80 Mar 27 18:12:08 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61020 -> 207.200.86.65:80 Mar 27 18:12:10 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61021 -> 205.188.245.116:80 Mar 27 18:12:10 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61021 -> 205.188.245.116:80 -- Togan Muftuoglu

3 2

Security when compiling App - when do u compile as root or a User
by Steven Thompson 28 Mar '01

28 Mar '01

Hi All When compiling Apps, under which user do you compile the App for security, that does not mess up your system. When do have to compile an App as root? Thanks in advance Steven

3 2

RE: [suse-security] portscannst from many ips to port 16110
by Lewe, Wolfgang 28 Mar '01

28 Mar '01

> Hi there > is there an new trojan whos listening to port 16110??? > > many portscanns at my side in the last two days Hi Rene, It have not to be an new trojan. It can be an older trojan mapped to the port 16110. Regards, Wolfgang

1 0

RE: [suse-security] AW: Squid on Firewall?
by Reckhard, Tobias 28 Mar '01

28 Mar '01

Hi Mike. > > Huh? Get real, man, with that attitude you shouldn't connect anything > > to an untrusted network > > the point is that even if someone exploits a firewall and got root > permissions this person must be the smallest possible threat to the > protected network. > Agreed. You try to reach that point using the principles of least privilege and defence in depth. > If you are logged in as root on a computer that acts as a firewall, > you must not find any way to exploit the internal network: > Let's say you shouldn't. It is impossible to prevent completely. One, perhaps the main point of defence in depth is to give the defender time to realize he's under (partially successful) attack and react to the threat. Firewalling isn't about complete prevention, that's fiction. It's about protection and buying the time you need to be able to protect the soft and juicy insides. > 1) there must not be a ftp client or other tools to download files to > that computer, > 2) there must not be access to a dns server mapping the protected > network thus one must browse the log files to get an idea of the > members of the internal network and make it as hard as possible to > browse files (no editor), > 3) all files should be read only or append only in multiuser mode so > the boot structure cannot be manipulated > 4) the firewall computer should not do anything but filter and > forward traffic > These points all make sense, but they're neither complete nor justified in all situations. > I do not know about squid, but I would put it on a computer behind > the firewall. Even for a 100Mbit network connection any old pentium > 100 (or mac, or sparc, or whatever) with some ram should be able > to handle maximum possible load without problems. Given the fact, > that such a computer will cost less than USD 100,-- so cost should > not be the reason not to have it! > What does your 'firewall' do? Is it a packet filter, perhaps using ipchains? All that does is look at TCP/IP header information. Any exploit against the squid daemon will work regardless of whether it is running on a separate box or the packet filter, provided they're configured the same way. There's no difference between being root on the packet filter or an internal machine with respect to the danger your internal network is in. The only thing that is more difficult if the squid box is internal is that you need to traverse the packet filter to reach the outside, but that's hardly a problem, since you need to allow that box to access 0.0.0.0/0, TCP ports 1-65535 anyhow, not knowing what ports the world's web servers listen on. It does make sense to place the proxy into a DMZ, either off of a third NIC of the packet filter or by using two packet filters, one in front of the proxy and one behind it, separating the DMZ from the Internet and the internal network respectively. It could also make sense to use a non-caching security proxy, such as http-gw from the TIS FWTK, in the DMZ and employ squid in the internal network only. Cheers, Tobias

1 0

DNS and Firewall
by Diogo Bacelar Quintela 28 Mar '01

28 Mar '01

Hello List I have a small network base on private ips and have one masquerading server. I want to specify in TCP options on the other machines the gate way machine as a dns server also.. Some abstraction.. I used to have named doing name caching for that. However now I am trying to use SuSEFirewall (or even by hand) to do that work. I mean.. All trafic from internal machines to firewall 's dns port (53) be automatically redirected (and masqueraded) to one dns server of the ISP (or both of those..) I have a cable connection and a SuSE 7.1 FTP clean installation. I believe it is SuSEfirewall 4.3 and kernel 2.4.2.. Is it possible ? I've looked and firewall's config and there are two non matching option's : port redirection (No private ips) and local port redirection (doesn't work!) TIA Diogo Quintela /------------------------------------------------------------------ || Diogo Bacelar Quintela ||----------------------------------------------------------------- || diogo.quintela(a)netcabo.pt // dbq(a)rnl.ist.utl.pt ||----------------------------------------------------------------- || PGP Public Key || http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x2099755D \------------------------------------------------------------------

1 0

portscannst from many ips to port 16110
by rene marhold 27 Mar '01

27 Mar '01

Hi there is there an new trojan whos listening to port 16110??? many portscanns at my side in the last two days

1 0

IPX firewalling
by nauber＠heidelberg.cs2-informatik.de 27 Mar '01

27 Mar '01

Hello, is it possible to have a firewall controlling both IP and IPX? IP is no problem (at least I think so :-) ), but can someone point me in the right direction to firewall IPX? I know there is nothing like this in the kernel, but is there some kind of program to controll IPX forwarding? TIA. Greetings, Stefan Nauber Administrator Cs2 Informatik GmbH Kurfürstenanlage 3 69115 Heidelberg Germany Tel.: +49 (6221) 6041-0 Fax : +49 (6221) 6041-50

2 1

IP & MAC Filtering
by Matthias Auchmann 27 Mar '01

27 Mar '01

Hi all ! I'd like to make firewall-filtering rules where only IP Packets pass through which meet the following criterias: 1) the IP Source address is in a certain range 2) the last hop (the hop I got the packet from) has to have a certain IP or MAC-address This way I could tell my Linux Box only to accept packages which come from my Cisco-Router (on the same LAN). Any ideas how to do that ? Any help would be appreciated. Greetz Matthias _____ Sent through Master Auchi Mail Systems <http://www.masterauchi.com> - powered by Linux

2 2

openssh new packages?
by Norbert Preining 27 Mar '01

27 Mar '01

Hi there! Is there already an update for the new openssh (2.5.2p2) version which includes various security fixes? Best wishes Norbert -- ciao norb +-------------------------------------------------------------------+ | Norbert Preining http://www.logic.at/people/preining | | University of Technology Vienna, Austria preining(a)logic.at | | DSA: 0x09C5B094 (RSA: 0xCF1FA165) mail subject: get [DSA|RSA]-key | +-------------------------------------------------------------------+

5 9

SUID/SGID after harden_SuSE
by Corvin Russell 27 Mar '01

27 Mar '01

Hello all, I have run harden_suse on my box, and answered "yes" to all its prompts. The following files are still suid/sgid: do all of them need to be? TIA Corvin + -rwsr-x--- 1 root audio 14880 Mar 22 05:34 /bin/eject + -rwsr-xr-x 1 root root 67236 Mar 22 03:51 /bin/mount + -rwsr-xr-x 1 root root 20908 Mar 22 03:52 /bin/ping + -rwsr-xr-x 1 root root 19636 Mar 22 04:04 /bin/ping6 + -rwsr-xr-x 1 root root 22594 Mar 22 03:51 /bin/su + -rwsr-xr-x 1 root root 34568 Mar 22 03:51 /bin/umount + -rwxr-sr-x 1 root shadow 10967 Mar 23 02:26 /opt/kde2/bin/kcheckpass + -rwxr-sr-x 1 root nogroup 82968 Mar 23 02:26 /opt/kde2/bin/kdesud + -rwxr-sr-x 1 root tty 3772 Mar 23 02:26 /opt/kde2/bin/konsole + -rwsr-xr-x 1 root root 5344 Mar 23 02:26 /opt/kde2/bin/konsole_grantpty + -rwsr-x--- 1 root trusted 15501 Mar 22 05:34 /sbin/cardctl + -rwxr-sr-x 1 root shadow 20261 Mar 22 03:50 /sbin/unix_chkpwd + -rws--x--x 1 root root 1773168 Mar 22 04:08 /usr/X11R6/bin/XFree86 + -rwsr-xr-x 1 root root 7560 Mar 22 04:08 /usr/X11R6/bin/Xwrapper + -rwxr-sr-x 1 root tty 95456 Mar 22 04:10 /usr/X11R6/bin/wterm + -rwxr-sr-x 1 root shadow 1119648 Mar 22 04:10 /usr/X11R6/bin/xlock + -rwxr-sr-x 1 root tty 276828 Mar 23 02:14 /usr/X11R6/bin/xterm + -rwsr-x--- 1 root trusted 35868 Mar 22 05:34 /usr/bin/at + -rwsr-x--- 1 root trusted 27032 Mar 22 05:34 /usr/bin/bing + -rwsr-xr-x 1 root shadow 34460 Mar 22 04:46 /usr/bin/chage + -rwsr-xr-x 1 root shadow 28184 Mar 22 04:46 /usr/bin/chfn + -rwsr-xr-x 1 root shadow 26000 Mar 22 04:46 /usr/bin/chsh + -rwsr-x--- 1 root trusted 22560 Mar 22 05:34 /usr/bin/crontab + -rwsr-xr-x 1 root shadow 18360 Mar 22 04:46 /usr/bin/expiry + -rwsr-x--- 1 root trusted 37076 Mar 22 05:34 /usr/bin/gpasswd + -rwsr-xr-x 1 man root 92512 Mar 22 03:50 /usr/bin/man + -rwsr-xr-x 1 root root 21432 Mar 22 03:51 /usr/bin/newgrp + -rwsr-xr-x 1 root shadow 26780 Mar 22 03:51 /usr/bin/passwd + -rwsr-xr-x 1 root root 15544 Mar 22 03:52 /usr/bin/rcp + -rwsr-xr-x 1 root root 11160 Mar 22 03:52 /usr/bin/rlogin + -rwsr-xr-x 1 root root 8304 Mar 22 03:52 /usr/bin/rsh + -rwsr-xr-x 1 root root 85432 Mar 22 03:53 /usr/bin/sudo + -rwsr-x--- 1 root trusted 8856 Mar 22 05:34 /usr/bin/ziptool + -rwsr-xr-x 1 root root 5856 Mar 22 03:50 /usr/lib/pt_chown + -rwxr-sr-x 1 root maildrop 77277 Mar 24 00:06 /usr/sbin/postdrop + -rwsr-s--- 1 root dialout 176288 Mar 22 05:34 /usr/sbin/pppd + -rwsr-s--- 1 root dialout 5324 Mar 23 02:40 /usr/sbin/pppoedsp + -rwsr-xr-x 1 root root 20408 Mar 22 04:04 /usr/sbin/traceroute -- Corvin Russell <corvinr(a)sympatico.ca>

3 2

RE: [suse-security] AW: Squid on Firewall?
by christian.burri＠synecta.ch 27 Mar '01

27 Mar '01

I must agree ;-) .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^ "Reckhard, Tobias" To: SuSE <suse-security(a)suse.de> <Reckhard@sec cc: unet.de> Subject: RE: [suse-security] AW: Squid on Firewall? 27.03.2001 07:44 > AFAIK you should NEVER use a > proxy etc. on any firewall due to the buffer- > overflow-problem. sorry... > Huh? Get real, man, with that attitude you shouldn't connect anything to an untrusted network, as any application could be susceptible to buffer overflows. And check out the literature on firewalls whenever you have a bit of spare time, I recommend the 2nd edition of 'Building Internet Firewalls' by Chapman, Cooper and Zwicky. Most, if not all, of the firewall people prefer application layer gateways, aka application proxies, over packet filters when constructing firewalls. And I'd much rather have only one application, the proxy, to watch for a compromise than the entire number of client applications.. Cheers, Tobias --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

PHP.INI
by ralf.vroomen＠itplus.nl 27 Mar '01

27 Mar '01

Hello people of the list! Just a quick question here: To get BasiliX PHP based webmail (www.basilix.org) running on my SuSE 7 up-to-date box I have to set "safe_mode = Off" in my /etc/httpd/php.ini. Since this sounds like a security risk, is it really? Or doesn't it matter since I'm the only one using php pages and nobody has shell access etc. Thanx in advance and sorry for my poor english. -- Ralf Vroomen.

1 0

Suse SNORT rpm and new rules
by Togan Muftuoglu 26 Mar '01

26 Mar '01

Hi everyone, I have installed the snort.rpm from the 7.1 DVD however on the snort site I have found new rules. After I downloaded the rules file the way they are listed are different than the ones that were provided by the SuSE rpm. Forexample in suse there is a overflow-lib while I could not find the overflow.rules. Where does SuSE get the rules/libs so that When I add rules I will stay compatible in a future update -- Togan Muftuoglu

1 0

AW: Squid on Firewall?
by Philipp Snizek 26 Mar '01

26 Mar '01

> Hi list, and amar, from "Down Under" > > Amarendra GODBOLE wrote: > > > > On Mon, Mar 26, 2001, the greycells of Ron Perry expressed: > > > > > Hi All, > > > > > > Running squid on the firewall. External interface eth0 > > > > > > I've used this redirect before setting up any other chain. > > > This catches all internal traffic to port 80 and redirects to 3128 > > > > > > ipchains -A input -i ! eth0 -p tcp -s 0/0 -d 0/0 80 -j > REDIRECT 3128 > > > > > > It seems I still need to allow connections to port 80 > or/and 3128 from > > > the internal interfaces. > > > > Hi, > > > > AFAIK, the 'REDIRECT' option does not if you are using Squid to > > authenticate. Never checked this out. Raf ? > > > I'm not using squid to authenticate. > > I'm now thinking that I need to ACCEPT port 3128 before I REDIRECT to > port 3128. And the redirect 80 should not be ACCEPTED. > > Any comments? Yes. If you're not sure (as I'm not right now) try to log the packets by denying and logging the rules. messages and firewall logfiles will tell you what you have to do. You can also use tcpdump but better iptraf to analyze your problem. HTH Philipp > TIA > Ron > ronk(a)sunux.com.au >

2 3

SANS Global Incident Analysis Center > Lion Worm
by Joop Boonen 26 Mar '01

26 Mar '01

http://www.sans.org/y2k/lion.htm

2 1

ALERT! A DANGEROUS NEW WORM IS SPREADING ON THE INTERNET
by Fred A. Miller 26 Mar '01

26 Mar '01

ALERT! A DANGEROUS NEW WORM IS SPREADING ON THE INTERNET March 23, 2001 7:00 AM Late last night, the SANS Institute (through its Global Incident Analysis Center) uncovered a dangerous new worm that appears to be spreading rapidly across the Internet. It scans the Internet looking for Linux computers with a known vulnerability. It infects the vulnerable machines, steals the password file (sending it to a China.com site), installs other hacking tools, and forces the newly infected machine to begin scanning the Internet looking for other victims. Several experts from the security community worked through the night to decompose the worm's code and engineer a utility to help you discover if the Lion worm has affected your organization. Updates to this announcement will be posted at the SANS web site, http://www.sans.org -- -- ----/ / _ Fred A. Miller ---/ / (_)__ __ ____ __ Systems Administrator --/ /__/ / _ \/ // /\ \/ / Cornell Univ. Press Services -/____/_/_//_/\_,_/ /_/\_\ fm(a)cupserv.org

5 4

Question about SuSEfirewall 4.4
by Marko Kaening 26 Mar '01

26 Mar '01

Hi, the SuSEfirewall 4.4 seems to work fine with my dial-up connection. But there are still 2 things bothering me: 1) If I call openports then I get something like "ipchains returns errors, no default route defined?" or something like that. What did I wrong at that point? 2) On my comp I have only the start script phase 1/3 (close fw) installed and the stop script (stop fw), since the start 2/3 and 3/3 always throw 'failed' during booting. -> I still didn't get this: as long as I am not yet dialed-up to my provider, why should I call "SuSEfirewall start", meaning why to run those init scripts 2/3 and 3/3??? => As far as I can see everything works well just with half of the init scripts, because when I dial-up the ip-up script contains the necessary call of the firewall script, doesn't it!?! Please respond if I am wrong about that! Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

1 0

SNORT help
by jonathan 25 Mar '01

25 Mar '01

I would like to start using a network analyzer and I heard about snort. Could someone give some advise/opinion and maybe point me in the direction of documentation. I am currently only watching /var/log/messages, but would like to get a better handle on the traffic that is coming to/from my cable modem. TIA

3 2

iptables question
by jonathan 24 Mar '01

24 Mar '01

When I start iptables I get 14 lines of the following message. Iptables is working fine on the other machine, but this one is running 7.1. Could someone help me out here. TIA. iptables: No chain/target/match by that name

1 0

AW: [suse-security] ssh clients for not-so-common OS's
by Thomas Lamy 23 Mar '01

23 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Did you have a look at http://www.freessh.org/ ? Thomas > -----Ursprüngliche Nachricht----- > Von: Yuri Robbers [mailto:yuri@rulbii.leidenuniv.nl] > Gesendet: Donnerstag, 22. März 2001 23:30 > An: suse-security(a)suse.com > Betreff: [suse-security] ssh clients for not-so-common OS's > > > > Hi all, > > I hope this is not off-topic, since it despite being a > security question, > it is not directly SuSE-related. Please send your flames to > me and not to > the list if you think I should not have posted this. Anyway, > here goes... > > Sometimes I have to remotely log into a system (SuSE :o) of > mine from a > machine that doesn't come with ssh. That's why I tend to > carry ssh client > binaries for a number of OS's with me most of the time. I'd > like to add > some more of those to my collection. Does anyone know where > to find or how > to compile ssh binaries on any of these OS's: VMS, DOS, AmigaOS, > Acorn RISC-OS and Mac-OS? For VMS I would be interested in having > an ssh server > too... > > Thanks, > Yuri. > > -------------------------------------------------------------- > ------------ > Yuri Robbers phone : +31-71-527-4966 > > Leiden University fax : +31-71-527-4900 > > Institute for Theoretical Biology email : > robbers(a)rulsfb.leidenuniv.nl > Kaiserstraat 63 > > 2311 GP Leiden PGP 5.0 public key > available: > the Netherlands Check your favourite hkp > server. > -------------------------------------------------------------- > ------------ > > > -------------------------------------------------------------------- > - To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA/AwUBOrrk0EJRmQkE7ThJEQL0bgCg2rfr5O6Wea2Sz2paHnV25nVf1lQAn1Te /7CMXaeAClvYxnlLpGHWgXTY =QZEp -----END PGP SIGNATURE-----

1 0

SuSE 7.0
by Yasholomew Yashinski 23 Mar '01

23 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just playing around with new SuSE 7.0 machine. Check out the default /etc/passwd: root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/bin/bash daemon:x:2:2:daemon:/sbin:/bin/bash lp:x:4:7:lp daemon:/var/spool/lpd:/bin/bash news:x:9:13:News system:/etc/news:/bin/bash uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash games:x:12:100::/var/games:/bin/bash man:x:13:2::/var/cache/man:/bin/bash at:x:25:25::/var/spool/atjobs:/bin/bash postgres:x:26:2:Postgres Database Admin:/var/lib/pgsql:/bin/bash lnx:x:27:27:LNX Database Admin:/usr/lib/lnx:/bin/bash mdom:x:28:28:Mailing list agent:/usr/lib/majordomo:/bin/bash yard:x:29:29:YARD Database Admin:/usr/lib/YARD:/bin/bash wwwrun:x:30:65534:Daemon user for apache:/var/lib/wwwrun:/bin/bash squid:x:31:65534:WWW proxy squid:/var/squid:/bin/bash fax:x:33:14:Facsimile Agent:/var/spool/fax:/bin/bash gnats:x:34:65534:Gnats Gnu Backtracking System:/usr/lib/gnats:/bin/bash adabas:x:36:100:Adabas-D Database Admin:/usr/lib/adabas:/bin/bash amanda:x:37:6:Amanda Admin:/var/lib/amanda:/bin/bash ixess:x:38:29:IXware Admin:/usr/lib/ixware:/bin/bash irc:x:39:65534:IRC Daemon:/usr/lib/ircd:/bin/bash ftp:x:40:2:ftp account:/usr/local/ftp:/bin/bash firewall:x:41:31:firewall account:/var/lib/firewall:/bin/false informix:x:43:34:Informix Database Admin:/usr/lib/informix:/bin/bash named:x:44:44:Nameserver Daemon:/var/named:/bin/bash virtuoso:x:45:100:Virtuoso Admin:/opt/virtuoso-lite:/bin/bash db2fenc1:x:46:46:DB2 Instance UDF user:/usr/lib/db2/db2fenc1:/bin/bash db2inst1:x:47:47:DB2 Instance main user:/usr/lib/db2/db2inst1:/bin/bash db2as:x:48:48:DB2 Administration:/usr/lib/db2/db2as:/bin/bash fnet:x:49:14:FidoNet:/var/spool/fnet:/bin/bash gdm:x:50:15:Gnome Display Manager:/var/lib/gdm:/bin/bash postfix:x:51:51:Postfix:/var/spool/postfix:/bin/false cyrus:x:96:12:User for Imapd:/usr/cyrus:/bin/bash nps:x:53:100:NPS admin:/opt/nps:/bin/bash skyrix:x:54:100:SKYRIX admin:/opt/skyrix/skyrix36:/bin/bash dbmaker:x:55:52:Dbmaker Database Admin:/usr/lib/dbmaker:/bin/bash fixadm:x:56:53:Linux Fincancial Suite Admin:/opt/fsuite/home/fixadm:/bin/ksh fib:x:57:53:Linux Fincancial Suite fib:/opt/fsuite/home/fib:/bin/ksh fixlohn:x:58:53:Linux Fincancial Suite fixlohn:/opt/fsuite/home/fixlohn:/bin/kshoracle:x:59:54:Oracle User:/opt/oracle:/bin/bash mysql:x:60:2:MySQL Database User:/var/mysql:/bin/false dpbox:x:61:56:DpBox User:/var/spool/dpbox:/bin/false ingres:x:62:3:Ingres DataBase administrator:/opt/tngfw/ingres:/bin/bash codadmin:x:63:58:Codine Administrator:/var/lib/codadmin:/bin/bash zope:x:64:2:Zope Server:/var/lib/zope:/bin/false nobody:x:65534:65534:nobody:/var/lib/nobody:/bin/bash Seems to me you'd want as few users as possible, why do they keep adding more? I don't have most of these applications even installed. At least they could create the account only if I installed that package. Cheers, - -- ..Yashy Never attribute to malice what can be adequately explained by Microsoft. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.0 (GNU/Linux) Comment: For info see http://www.gnupg.org iD4DBQE6upr5WUoaUM5QqOURAuseAJjf2OsmBjQLi6mL+Q/clZ1blpPXAKCjOtNS eYRWXOLWkTyD0B/LBwYAqw== =l+c+ -----END PGP SIGNATURE-----

1 0

Re: [suse-security] SuSE Security Announcement: nkitb/nkitserv
by Christopher Mahmood 22 Mar '01

22 Mar '01

>I send the file with a missing signature.. I'm very sorry. :-\ At least this (http://www.microsoft.com/technet/security/bulletin/MS01-017.asp) didn't happen ;) -- -ckm

1 0

7.1-i386-ftp
by Roman Drahtmueller 22 Mar '01

22 Mar '01

Hi together, The 7.1-i386-ftp version is out, finally. We've had problems with some packages before we could release it to the public. The 7.1 ftp version contains some newer packages than the CD version - the security updates have been merged as well as many many bugs have been squished. This time, the ftp version of the distribution is something special: For the first time, there is no seperate German/non-US and a US version any more. The international version contains all crypto packages that usually only the German distribution has. This has been made possible by removing all occurrences of patented cryptographical code and/or substituting it with free code. In the end, it turns out that we can live without commercial code... This particular circumstance leads to an easier update structure of the ftp servers: All 7.1 updates, all distributions, will be available on ftp.suse.com (which is located in Oakland, CA), none on ftp.suse.de (which is in Nürnberg, Germany). Also, not an "official" announcement: Efforts are underway to merge the ftp.suse.de update tree with the ftp.suse.com update tree for the older distributions, too. I'll publically announce it when it is getting time (and this will take some weeks...). Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

10 16

SuSE Security Announcement: pop (SuSE-SA:2001:06)
by Thomas Biege 22 Mar '01

22 Mar '01

Hi, I resend advisory SuSE-SA:2001:06, because of a wrong signature. -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: pop Announcement-ID: SuSE-SA:2001:06 Date: Wednesday, March 21th, 2001 19.19 MEST Affected SuSE versions: 6.1 Vulnerability Type: remote command execution Severity (1-10): 2 SuSE default package: no Other affected systems: all system using the pop package Content of this advisory: 1) security vulnerability resolved: imapd, ipop2d, ipop3d problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The eMail access daemons imapd(8), ipop2d(8) and ipop3d(8) of SuSE 6.1 are vulnerable to several buffer overflows. Due to a misconfiguration these vulnerbilities could be triggered remotely after a user had been authenticated. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/pop-2001.3.21-0.i386.rpm 1277deee87f3d1553ee18ae078d646aa source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/pop-2001.3.21-0.src.rpm ce326335b36e51b6a635b69fc0106911 AXP Alpha Platform: SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/pop-2001.3.21-0.alpha.rpm 33405d29e279795d99853a1235a821f9 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/pop-2001.3.21-0.src.rpm eecd7c9ac81397f9eb7b2bee01a0154d ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - joe (configuration file vulnerability): The problem has been reported on multiple security-related mailing lists. We are about to provide fixed packages. - The game spaceboom (SVGA shoot'em up) has been found vulnerable to multiple vulnerabilities. As a reaction to these bugs, the spaceboom game has been dropped from the distribution. We recommend to deinstall the game from our 6.x and 7.x distribution by using the command `rpm -e space´, or to remove the suid bit from the file /usr/games/SpaceBoom/SpaceBoom using the command `chmod -s /usr/games/SpaceBoom/SpaceBoom´. (Note: removing the suid bit prevents the game from being used by non-root users and from being reinstalled after removal.) - We are in the process of preparing update packages for the man package which has been found vulnerable to a commandline format string bug. The man command is installed suid man on SuSE systems. When exploited, the bug can be used to install a different man binary to introduce a trojan into the system. As an interim workaround, we recommend to `chmod -s /usr/bin/man´ and ignore the warnings and errors when viewing manpages. - The file browser MidnightCommander (mc) is vulnerable to unwanted program execution. Updates are currently being built. - A new nkitb/nkitserv package will be availabe soon. This update adresses bugs in timed, in.ftpd. - New RPMs, that fix' a vulnerbility in the eperl package for SuSE 6.1-7.1 are currently being built. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOrpWCXey5gA9JdPZAQEyxwf+PEmG3VQd59s4IEkNpStXAH6cRqEIAIkh rKXcrukIiBWdj08uNLoiggEgzq7wyUKBQH3thCD3CkolpPM4ViZmiVLAr8uerTmx fP4Vd+m47VeYzcsdhRPPASpnVzgVHyLVxCiOKOM76QK1sOHZhf2jAzQEZbl9G1Mc Z2Jo+4tAtFUPxsp0IN9NmfDezGOLeuXH5eIyp+Sgpw1fMa6Mkpk+Eib6Dc0qnM4H JBqj1WBw539lD2wU8n4N4mM0YdUhzCx179vVJKf9C9XLPdFHUwuyDRR75M/lOH8U dC5eg3QVdDm4bUDxMyDbvJqfxFpzlRt6dsb/vDk7Q6Hepat3plXhdQ== =klWl -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

SuSE Security Announcement: nkitb/nkitserv
by Thomas Biege 22 Mar '01

22 Mar '01

Hi, I send the file with a missing signature.. I'm very sorry. :-\ Damn, I need coffee... -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: nkitb/nkitserv Announcement-ID: SuSE-SA:2001:07 Date: Thursday, March 22th, 2001 19.06 MEST Affected SuSE versions: 6.1, 6.2, 6.3, 6.4, 7.0, 7.1 Vulnerability Type: remote denial-of-service Severity (1-10): 4 SuSE default package: yes: in.ftpd, no: timed Other affected systems: all system using in.ftpd (OpenBSD port) or timed Content of this advisory: 1) security vulnerability resolved: timed, in.ftpd problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information Two parts of the nkitb/nkitserv package are vulnerable to security related bugs. in.ftpd(8): A one-byte bufferoverflow was discovered in the OpenBSD port of the FTP daemon in.ftpd(8) several weeks ago. This bug could just be triggered by authenticated users, which have write access. This bug is believed to not be exploitable under Linux. However, we prefer to provide a fixed update package to make sure that the daemon is on the safe side. in.ftpd(8) will be invoked by inetd(8) and is activated by default. timed(8): The time server daemon timed(8), which is started at boot time, tries to synchronize the local host time with the time of other machines on the local area network. A bug in timed(8) was reported by the FreeBSD Security Officer, that could be triggered remotely to crash the time server daemon. For SuSE 6.1-6.4 in.ftpd and timed were part of nkitb. Users of SuSE 7.0 need to download the nkitserv package for both in.ftpd and timed. The bug in in.ftpd is fixed in SuSE 7.1, so nkitserv for SuSE 7.1 just includes a new version of timed(8). Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/nkitserv-2001.3.16-0.i386.rpm c4313f92a36916f0eba0b8837c9c0c81 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/nkitb-2001.3.16-1.src.rpm ec452523fa25c8aed962fbd3349d1f3d SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/nkitserv-2001.3.16-0.i386.rpm 02772824805c6c4293bd1750d7bda6d3 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/nkitb-2001.3.16-1.src.rpm 5d301edc1b1ec9111572815aace33984 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/nkitb-2001.3.16-1.i386.rpm 842dea179cc449c4af25accf0c3f38ec source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/nkitb-2001.3.16-1.src.rpm c099e7c1194b7706100453a89433b59c SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/nkitb-2001.3.16-0.i386.rpm 768a636df4731cd8efd181aa2eaf2e60 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/nkitb-2001.3.16-0.src.rpm b705425c4c3cb70ebf9cd1345c92104a SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/nkitb-2001.3.16-0.i386.rpm cbae31148c79c91a1443f79ee1ba34d3 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/nkitb-2001.3.16-0.src.rpm d287c01d35d00756ecbf8da04556037c SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/nkitb-2001.3.16-0.i386.rpm 5f45ade69a9e8c2756e671c4a6e3522a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/nkitb-2001.3.16-0.src.rpm 62b969c4e666f3ea71b6ce6b31762718 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n1/nkitserv-2001.3.16-0.sparc.… 142329dcae76a1603c0d84836192e357 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/nkitb-2001.3.16-0.src.rpm 5bd9123cecba6ddd42cc965c599f383e SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/nkitserv-2001.3.16-0.sparc.… 07ed33c76c7ae2df5b877003b254944d source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/nkitb-2001.3.16-0.src.rpm 66ba7b71624f636e24e2d628c8f06e81 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/nkitserv-2001.3.16-0.alpha.rpm 5fcf177588788eb069bdb69332046d23 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/nkitb-2001.3.16-0.src.rpm c27ed3bf0c293eaa77fe5a8fa960e95d SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/nkitb-2001.3.16-0.alpha.rpm 385fa60c0c216f1d9e61afd52d37df93 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/nkitb-2001.3.16-0.src.rpm 5ba60084740c9be9f89a729e2d21a77c SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/nkitb-2001.3.16-0.alpha.rpm 8a9e207a77e3c7f954e8faa91954f7aa source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/nkitb-2001.3.16-0.src.rpm 53f8a03feacc7fb81b92a726c8e81d21 SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/nkitb-2001.3.16-0.alpha.rpm 359a3432f73220cecd42ba0b365d5e06 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/nkitb-2001.3.16-0.src.rpm e0ccf6395312f9c33518f5f083c9d51f PPC PowerPC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n1/nkitserv-2001.3.16-0.ppc.rpm 37bf5a963bc93215084b5634e864479c source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/nkitb-2001.3.16-0.src.rpm c31af637f58d9b43db542657b02bc772 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/nkitserv-2001.3.16-1.ppc.rpm ddc1dcfb94ba90f3cbdf395f89dd3b84 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/nkitb-2001.3.16-1.src.rpm 2fa9c58b871248172285a64107e3be7c SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/nkitb-2001.3.16-0.ppc.rpm 1dc4c831b5f6bd344ab8f511497b3fa5 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/nkitb-2001.3.16-0.src.rpm 5529e5f63e2391ab1669efa0a8c33b57 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - joe (configuration file vulnerability): The problem has been reported on multiple security-related mailing lists. We are about to provide fixed packages. - The game spaceboom (SVGA shoot'em up) has been found vulnerable to multiple vulnerabilities. As a reaction to these bugs, the spaceboom game has been dropped from the distribution. We recommend to deinstall the game from our 6.x and 7.x distribution by using the command `rpm -e space´, or to remove the suid bit from the file /usr/games/SpaceBoom/SpaceBoom using the command `chmod -s /usr/games/SpaceBoom/SpaceBoom´. (Note: removing the suid bit prevents the game from being used by non-root users and from being reinstalled after removal.) - We are in the process of preparing update packages for the man package which has been found vulnerable to a commandline format string bug. The man command is installed suid man on SuSE systems. When exploited, the bug can be used to install a different man binary to introduce a trojan into the system. As an interim workaround, we recommend to `chmod -s /usr/bin/man´ and ignore the warnings and errors when viewing manpages. - The file browser MidnightCommander (mc) is vulnerable to unwanted program execution. Updates are currently being built. - New RPMs, that fix' a vulnerbility in the eperl package for SuSE 6.1-7.1 are currently being built. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOrpHQ3ey5gA9JdPZAQEWXwf/TwIX3tVUM4l32z6efEOdiLPNe0FmdImz kgFkyWX+aDSLIVvhoqjpfr7DjD0p2Run9d1BjdLoTGqUgFZf+WR5yZWUbR94+5wN ahaoKWHMGGxHxynrbr+YnlOFyKH1Zv3HqFbsY/KTrVSsWCsbqsqs1wd8ePVG/El9 oODwYHDBlMHGu+tXRqXAMhxGgrlMw5Id2fQEXVXvQu6/OJjqjzeRDHCA05vw/lZK hK0vAPbU3UKHkgbHLmA1kKyqMIYJZcSWDngv6IOWrS/5MyoswL8sWcda+7Z3omyL 885DLHrszKcnH2mYzVeVV/ZYE2u711dhVRn+FEHIxukNty0un6rLaQ== =aQ3n -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

SuSE Security Announcement: nkitb/nkitserv
by Thomas Biege 22 Mar '01

22 Mar '01

______________________________________________________________________________ SuSE Security Announcement Package: nkitb/nkitserv Announcement-ID: SuSE-SA:2001:07 Date: Thursday, March 22th, 2001 19.06 MEST Affected SuSE versions: 6.1, 6.2, 6.3, 6.4, 7.0, 7.1 Vulnerability Type: remote denial-of-service Severity (1-10): 4 SuSE default package: yes: in.ftpd, no: timed Other affected systems: all system using in.ftpd (OpenBSD port) or timed Content of this advisory: 1) security vulnerability resolved: timed, in.ftpd problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information Two parts of the nkitb/nkitserv package are vulnerable to security related bugs. in.ftpd(8): A one-byte bufferoverflow was discovered in the OpenBSD port of the FTP daemon in.ftpd(8) several weeks ago. This bug could just be triggered by authenticated users, which have write access. This bug is believed to not be exploitable under Linux. However, we prefer to provide a fixed update package to make sure that the daemon is on the safe side. in.ftpd(8) will be invoked by inetd(8) and is activated by default. timed(8): The time server daemon timed(8), which is started at boot time, tries to synchronize the local host time with the time of other machines on the local area network. A bug in timed(8) was reported by the FreeBSD Security Officer, that could be triggered remotely to crash the time server daemon. For SuSE 6.1-6.4 in.ftpd and timed were part of nkitb. Users of SuSE 7.0 need to download the nkitserv package for both in.ftpd and timed. The bug in in.ftpd is fixed in SuSE 7.1, so nkitserv for SuSE 7.1 just includes a new version of timed(8). Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/nkitserv-2001.3.16-0.i386.rpm c4313f92a36916f0eba0b8837c9c0c81 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/nkitb-2001.3.16-1.src.rpm ec452523fa25c8aed962fbd3349d1f3d SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/nkitserv-2001.3.16-0.i386.rpm 02772824805c6c4293bd1750d7bda6d3 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/nkitb-2001.3.16-1.src.rpm 5d301edc1b1ec9111572815aace33984 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/nkitb-2001.3.16-1.i386.rpm 842dea179cc449c4af25accf0c3f38ec source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/nkitb-2001.3.16-1.src.rpm c099e7c1194b7706100453a89433b59c SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/nkitb-2001.3.16-0.i386.rpm 768a636df4731cd8efd181aa2eaf2e60 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/nkitb-2001.3.16-0.src.rpm b705425c4c3cb70ebf9cd1345c92104a SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/nkitb-2001.3.16-0.i386.rpm cbae31148c79c91a1443f79ee1ba34d3 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/nkitb-2001.3.16-0.src.rpm d287c01d35d00756ecbf8da04556037c SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/nkitb-2001.3.16-0.i386.rpm 5f45ade69a9e8c2756e671c4a6e3522a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/nkitb-2001.3.16-0.src.rpm 62b969c4e666f3ea71b6ce6b31762718 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n1/nkitserv-2001.3.16-0.sparc.… 142329dcae76a1603c0d84836192e357 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/nkitb-2001.3.16-0.src.rpm 5bd9123cecba6ddd42cc965c599f383e SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/nkitserv-2001.3.16-0.sparc.… 07ed33c76c7ae2df5b877003b254944d source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/nkitb-2001.3.16-0.src.rpm 66ba7b71624f636e24e2d628c8f06e81 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/nkitserv-2001.3.16-0.alpha.rpm 5fcf177588788eb069bdb69332046d23 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/nkitb-2001.3.16-0.src.rpm c27ed3bf0c293eaa77fe5a8fa960e95d SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/nkitb-2001.3.16-0.alpha.rpm 385fa60c0c216f1d9e61afd52d37df93 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/nkitb-2001.3.16-0.src.rpm 5ba60084740c9be9f89a729e2d21a77c SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/nkitb-2001.3.16-0.alpha.rpm 8a9e207a77e3c7f954e8faa91954f7aa source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/nkitb-2001.3.16-0.src.rpm 53f8a03feacc7fb81b92a726c8e81d21 SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/nkitb-2001.3.16-0.alpha.rpm 359a3432f73220cecd42ba0b365d5e06 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/nkitb-2001.3.16-0.src.rpm e0ccf6395312f9c33518f5f083c9d51f PPC PowerPC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n1/nkitserv-2001.3.16-0.ppc.rpm 37bf5a963bc93215084b5634e864479c source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/nkitb-2001.3.16-0.src.rpm c31af637f58d9b43db542657b02bc772 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/nkitserv-2001.3.16-1.ppc.rpm ddc1dcfb94ba90f3cbdf395f89dd3b84 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/nkitb-2001.3.16-1.src.rpm 2fa9c58b871248172285a64107e3be7c SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/nkitb-2001.3.16-0.ppc.rpm 1dc4c831b5f6bd344ab8f511497b3fa5 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/nkitb-2001.3.16-0.src.rpm 5529e5f63e2391ab1669efa0a8c33b57 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - joe (configuration file vulnerability): The problem has been reported on multiple security-related mailing lists. We are about to provide fixed packages. - The game spaceboom (SVGA shoot'em up) has been found vulnerable to multiple vulnerabilities. As a reaction to these bugs, the spaceboom game has been dropped from the distribution. We recommend to deinstall the game from our 6.x and 7.x distribution by using the command `rpm -e space´, or to remove the suid bit from the file /usr/games/SpaceBoom/SpaceBoom using the command `chmod -s /usr/games/SpaceBoom/SpaceBoom´. (Note: removing the suid bit prevents the game from being used by non-root users and from being reinstalled after removal.) - We are in the process of preparing update packages for the man package which has been found vulnerable to a commandline format string bug. The man command is installed suid man on SuSE systems. When exploited, the bug can be used to install a different man binary to introduce a trojan into the system. As an interim workaround, we recommend to `chmod -s /usr/bin/man´ and ignore the warnings and errors when viewing manpages. - The file browser MidnightCommander (mc) is vulnerable to unwanted program execution. Updates are currently being built. - New RPMs, that fix' a vulnerbility in the eperl package for SuSE 6.1-7.1 are currently being built. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

1 0

SuSE Security Announcement: impad
by Thomas Biege 22 Mar '01

22 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: pop Announcement-ID: SuSE-SA:2001:06 Date: Wednesday, March 21th, 2001 19.19 MEST Affected SuSE versions: 6.1 Vulnerability Type: remote command execution Severity (1-10): 2 SuSE default package: no Other affected systems: all system using the pop package Content of this advisory: 1) security vulnerability resolved: omap, ipop2d, ipop3d problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The eMail access daemons impad(8), ipop2d(8) and ipop3d(8) of SuSE 6.1 are vulnerable to several buffer overflows. Due to a misconfiguration these vulnerbilities could be triggered remotely after a user had been authenticated. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/pop-2001.3.21-0.i386.rpm 1277deee87f3d1553ee18ae078d646aa source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/pop-2001.3.21-0.src.rpm ce326335b36e51b6a635b69fc0106911 AXP Alpha Platform: SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/pop-2001.3.21-0.alpha.rpm 33405d29e279795d99853a1235a821f9 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/pop-2001.3.21-0.src.rpm eecd7c9ac81397f9eb7b2bee01a0154d ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - joe (configuration file vulnerability): The problem has been reported on multiple security-related mailing lists. We are about to provide fixed packages. - The game spaceboom (SVGA shoot'em up) has been found vulnerable to multiple vulnerabilities. As a reaction to these bugs, the spaceboom game has been dropped from the distribution. We recommend to deinstall the game from our 6.x and 7.x distribution by using the command `rpm -e spaceŽ, or to remove the suid bit from the file /usr/games/SpaceBoom/SpaceBoom using the command `chmod -s /usr/games/SpaceBoom/SpaceBoomŽ. (Note: removing the suid bit prevents the game from being used by non-root users and from being reinstalled after removal.) - We are in the process of preparing update packages for the man package which has been found vulnerable to a commandline format string bug. The man command is installed suid man on SuSE systems. When exploited, the bug can be used to install a different man binary to introduce a trojan into the system. As an interim workaround, we recommend to `chmod -s /usr/bin/manŽ and ignore the warnings and errors when viewing manpages. - The file browser MidnightCommander (mc) is vulnerable to unwanted program execution. Updates are currently being built. - A new nkitb/nkitserv package will be availabe soon. This update adresses bugs in timed, in.ftpd (and rwhod). - A vulnerbility, that exists in the eperl package for SuSE 6.1-7.1 are currently being built. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOronNHey5gA9JdPZAQHNtwf+JRiIV2do5UeA7+YG3hc0f+RVP3ZAHqM9 u7Pb/2oK9yb6AQrrc2PSJeY1WKMqYGDGAs1RtMuRYykgFux3vFnVsmmZ6/BUKKwz Ziz8uMe6BwUt3BZZiYwQQTLxEPBTJXxQpY6nF4rNhzVsecUCXM6LFBggkyV9Yd05 Vk3D+bvkkLHlJss5CFG3CITxJGi54MfqIyxab0aapu+723sxRu07MLXsmi1p3lL9 HJpVDr7OM07Sc2Sla3jjq+BiZk8R9SoZUzezn8imSmzXtKpCqZdxdv322weju7Gr LXQuC0QfnX/Du0w0Ko3ayZK0VXe+8VDdg3DA2UUZdOmBkBPTeqUDVg== =nRUf -----END PGP SIGNATURE-----

1 0

sleep() weaknesses
by Sebastian Krahmer 22 Mar '01

22 Mar '01

hi, I just uploaded paper about remote password guessing (and why sleep(x) is not enough to protect) with help of threads and other tricks. Its avail at www.cs.uni-potsdam.de/homepages/students/linuxer/tad.tar.gz It includes sample-program for high guessing-rates and a benchmark-server if you don't want (can) to use your ISP's pop3d. :) regards, Sebastian

1 0

Marc's SuSEfirewall 4.4 together with 'kppp' ???
by Marko Kaening 22 Mar '01

22 Mar '01

Hi, thanks to the hints on this list it wasn't a problem at all to install the new firewall scripts from Marc. I still have 2 questions: 1) If I start the firewall as root with /sbin/SuSEfirewall everything works just fine if there is a ppp connection to my provider to which I dial-up from time to time. BUT, I like to use the program 'kppp' for dialing since it gives me good accounting information is easy to use and so on... So, I prefer this solution instead of wvdial. THE PROBLEM is that the firewall gets only started with the ip-up script which is executed by wvdial BUT NOT by kppp, since kppp manages everything itself. If I want to call SuSEfirewall as a normal user it doesn't work, of course... 2) >From my experiments in 1) I concluded that the firewall startup-scripts only work if a connection via, say, ppp was already established. So what about my dial-up connection. I boot my machine and during that process the firewall starts to build-up, BUT since I am not connected yet, since I only want to surf or read emails for a short time, the firewall isn't properly installed... Maybe these questions are stupid, especially the latter (I am quite sure that I didn't understand the functionality of those init scripts), but I hope someone could help me! Should be a common problem though. Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

2 4

Question about Sync and ack
by rene.marhold 22 Mar '01

22 Mar '01

Hello, can sombody explain me how to use ack and sync in firewalls?? i connt find there any good information about it thx DJMAD

3 2

Re: [suse-security] smtp_auth
by Simon Dittlmann 22 Mar '01

22 Mar '01

Hello, how do I configure smtp_auth? cu simon d.

2 1

RE: [suse-security] SASL and sendmail-tls
by Raffy 22 Mar '01

22 Mar '01

> >Mar 21 15:07:44 off sendmail[7326]: error: > safesasl(/usr/lib/sasl/Sendmail.conf) >failed: No such file or directory > > >Mar 21 15:07:44 off sendmail[7326]: error: safesasl(/etc/sasldb) > failed: No such >file or directory > > Where are these files to be found? sasldb you have to create. I guess it was saslpasswd which creates it. For the sendmail.conf file, I have it and it includes one line: pwcheck_method: PAM > But why is available only PLAIN LOGIN and ANONYMOUS, is it because I > am missing the files above? Either you go and change your sendmail.cf file or you are changing the m4-file to: TRUST_AUTH_MECH(`LOGIN PLAIN')dnl define(`confAUTH_MECHANISMS', `LOGIN PLAIN')dnl replace LOGIN PLAIN by the methods you want! Hope this helps Raffy -- Raffael Marty security.raffy.ch

2 1

RE: [suse-security] Sendmail SMTP AUTH / SSL
by Reckhard, Tobias 22 Mar '01

22 Mar '01

> > firewall it on the local machine, Linux has firewalling capabilities > (ipchains > > in 2.2, iptables in 2.4). > > No no, that's not the point. I could do that. But I thought that other > mailservers (for example yours) is talking to my mailserver on that port > 25. > Isn't that right? So if I block that port, I won't receive any mails any > more! > You can block access to port 25 for specific source IP addresses and specific interfaces with ipchains (and very probably with iptables, too, but I haven't used it myself yet). Sort of as in the following example, where: MAILSERV = mail server's IP address LOCALNET = local network that is only to be allowed SMTP over SSL ipchains -A input -p tcp -s ! $LOCALNET -d $MAILSERV 25 -j ACCEPT ipchains -A output -p tcp -s $MAILSERV 25 -d ! %LOCALNET ! -y -j ACCEPT ipchains -A input -p tcp -s $LOCALNET -d $MAILSERV 465 -j ACCEPT ipchains -A output -p tcp -s $MAILSERV 465 -d $LOCALNET ! -y -j ACCEPT ipchains -A input -l -j DENY ipchains -A output -l -j DENY HTH Tobias

1 0

ftp/http problems with masquerading
by Stephan Beirer 22 Mar '01

22 Mar '01

Hi List, I have a problem with our masquerading firewall: I use the same configuration on two different machines which route for two networks (one SuSE 7.0 kernel 2.2.16 connected to a isdn device and one SuSE 7.1 kernel 2.2.18 acting as ADSL router). The script (which is called by ip-up) is taken from an article in the german computer magazine "ct" (24/00). On both machines it works quite fine except for two problems: http: Some websites can't be accessed on Windows98 machines. I don't think it's the MTU problem, I once set it to the correct value [unfortunately I can't check this right now] and most websites can be shown ftp: Some servers make problems: Either the download always hangs at the last few (kilo)bytes or the ftp server fails to open the data connection (login is possible but connection hangs when doing a "ls").It seems to be a problem with masquerading: in my logfiles I can see that ipchains denies incoming connections from port 20 of the remote ftpserver. The module ip_masq_ftp is loaded and it works without any problems for many other servers. It would be nice if someone could give me some hints.. thanks && bye: stephan -------------------------------------------------------------------------- Stephan Beirer Immanuelkirchstrasse 12 10405 Berlin System Administration tel +49_30_443509000 fax +49_30_443509001 MicroDiscovery GmbH mail beirer(a)microdiscovery.com Bioinformatics Solutions http://www.microdiscovery.com

5 5

Strange firewall log entries
by SlavaU 22 Mar '01

22 Mar '01

Hi All! I have thousands(!!!) of such entries in logfile on my internet router linux box. 1. Packet log: output DENY ippp0 PROTO=1 [My ISDN Dynamic IP]:3 [ISP_DNS_IP]:3 L=56 S=0x00 I=11521 F=0x0000 T=127 (#3) Port 3 means "compressnet". Could/should I allow this compressnet (and how?) or just to disable loggging? 2. Packet log: input DENY ippp0 PROTO=1 [Some Inet IP]:8 [My ISDN Dynamic IP]:0 L=15 00 S=0x00 I=45898 F=0x4000 T=252 (#161) What is the Port 8, which is missing from /etc/services and what to do with that? Thanks, Slava.

4 3

strange NIC behaviour?
by Philipp Snizek 21 Mar '01

21 Mar '01

Dear list users, I know, this here is more HW than security related; but still maybe something for the SuSE people: I'm setting up a PC with 3 eths. This PC should become a bridge where an ipchains filter runs on. The NICs are: 1 x ne2k-pci 1 x 3c59x 1 x 3c90x 1. The 3c905C-TX card does not run with 3c90x module. 2. Starting 3c59x module it recognizes both 3Com Cards as 3c59x and starts them. 3. Into Yast configuration I put eth0 = 3c59x, eth1 = ne2k-pci while the 3c90x is built into pci slot but not loaded. When restarting the network daemon linux sees eth0=3c59x and eth1=3c59x while ne2k-pci is not loaded. Please anybody help me before I replace one 3Com eth with an intel etherexpress which will cost me another CHF 100.00 Thanx a lot Philipp

5 6

RE: [suse-security] Sendmail SMTP AUTH / SSL
by Raffy 21 Mar '01

21 Mar '01

> > On my box I have sendmail running. In order to use SMTP over SSL I run it > > with stunnel in inetd: > > > > smpts stream tcp nowait root /usr/local/sbin/stunnel stunnel -D > > 3 -p /usr/local/ssl/certs/stunnel.pem -r smtp > > > > Further I configured sendmail to use SMTP AUTH. Everything works perfect. > > > > But: smpts is on port 465. I configured my clients such that they use that > > port. So far so good. But now port 25 can still be used to send email. I > > could block it at the firewall but then I am not able to receive email any > > more, because other mailservers are talking with me on that port. (right?) > > > > Is there a solution that I can use SMTP over SSL and SMTP AUTH? Clients > > should not be able to connect without SSL or SMPT AUTH! > > firewall it on the local machine, Linux has firewalling capabilities (ipchains > in 2.2, iptables in 2.4). No no, that's not the point. I could do that. But I thought that other mailservers (for example yours) is talking to my mailserver on that port 25. Isn't that right? So if I block that port, I won't receive any mails any more! Raffy

2 1

SASL and sendmail-tls
by Egan 21 Mar '01

21 Mar '01

>Mar 21 15:07:44 off sendmail[7326]: error: safesasl(/usr/lib/sasl/Sendmail.conf) >failed: No such file or directory >Mar 21 15:07:44 off sendmail[7326]: error: safesasl(/etc/sasldb) failed: No such >file or directory Where are these files to be found? >Mar 21 15:07:44 off sendmail[7326]: NOQUEUE: connect from root@localhost >Mar 21 15:07:44 off sendmail[7326]: TLS: file CertFile missing >Mar 21 15:07:44 off sendmail[7326]: SASL: available mech=PLAIN LOGIN ANONYMOUS, >allowed mech=GSSAPI KERBEROS_V4 DIGEST-MD5 CRAM-MD5 This is why it's not working, the intersection of available and allowed is null. But why is available only PLAIN LOGIN and ANONYMOUS, is it because I am missing the files above? Egan

1 0

Capi4Linux and capi4hylafax
by Technik NIT 21 Mar '01

21 Mar '01

Hello, world I had a problem with my Hylafax-server on SuSe7.0 I had installed my Fritz!Classic with the drivers from AVM-Homepage(capi4linux and capi4hylafax). But now when i change my i4l to AVM B1 PCI and want to restart it i get the error message: /dev/isdninfo no such file or dir. And the ippp0 device could not be found in /proc/net/dev The rci4l_hardware starts and capiinit also. But the isdnlog in kernel messages didn't recognize any incoming-ring and no outgoing calls are made. My hylafax-client on win9x tells me that the fax had successfully be send, but didn't really work!

2 1

SuSEfirewall runlevel errors at bootup
by Pao Sayaovang 21 Mar '01

21 Mar '01

Hello List: I have been monitoring the post to see if the SuSEfirewall run level scripts had been fixed. I'm was running SuSEfirewall version 4.3.x and upgraded to 4.4 yesterday without the run level error going away. This is just a annoyance and not a big problem as my firewall is running perfectly fine. Sorry If I had missed the posting on this fix but I've looked at all the previous postings and could not find the applied solution. Previous email listing ---------------------------------------------------------------------------- -- A customer had bought the new SuSE Linux. I saw there were lots of changes... e.g. the fiewall script "SuSEfirewall". It runs three times. On the installation we have the following problem: the first time the firewall script runs the Network is not up so we only get an error message. Can someone tell me if this is normal or how I can fix this. Since I didn't get the subscription-update until now - I don't have anything here to make experiments or to read... Thanx for any hint. Christian ___________________________________ Pao Sayaovang Systems Analyst - Telecom Admin Weyco Group, Inc. DID(414) 908~1813 Fax(414) 908~1913 psayang(a)weycogroup.com

1 0

SuSEfirewall 4.3-3 and dial-up connections
by Thorsten Stoelk 21 Mar '01

21 Mar '01

hi, I installed the SuSEfirewall 4.3-3 and set it up with an ISDN card as ext. device. On startup, the firewall protects the given ip (192.168.0.1). When I dial in (kinternet) no connections can be made. So I added /etc/ip-up.local witch includes: /sbin/SuSEfirewall2 start now everything works. Is it ok or may I get get into trouble? Thanx Thorsten

2 2

SuSEfirewall refuses to work after nameservers are definded (was: Bei Nutzung von...)
by Thorsten Büker 21 Mar '01

21 Mar '01

Hi! I have to apologize for the german-only mail I sent a couple of minutes before. A subscriber of this list informed me, that this mailing-list is lead in English. I'm sorry I didn't know this, I found the address in a German SuSE-manual. Nevertheless I seek and hope for your help ;-) The firewall on our freshly installed box runs fine as long as no nameservers are defined. I'm talking about the nameservers of our provider, we don't run named on our machine. After defining two nameservers using Yast, the command dr-gonzo:/etc/rc.config.d # rcSuSEfirewall restart delivers Starting Firewall Initialization: (phase 3 of 3) and stops. If the firewall is started during a reboot it stops after phase2. Without nameservers in /etc/resolve.conf it is possible to restart the firewall: dr-gonzo:/etc/rc.config.d # rcSuSEfirewall restart Starting Firewall Initialization: (phase 3 of 3) Warning: No nameservers in /etc/resolv.conf! done We configured the firewall as desribed in the manual, I have no idea, what might be wrong. Maybe these variables can help you: FW_SERVICES_EXTERNAL_TCP="www smtp domain" FW_SERVICES_EXTERNAL_UDP="domain" FW_SERVICES_EXTERNAL_IP="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="dns" FW_SERVICE_DNS="no" Do you have the right hint for us? Thanks a lot and kind regards from Cologne, Thorsten

2 1

Bei Nutzung von Nameservern bleibt SuSEfirewall hängen
by Thorsten Büker 20 Mar '01

20 Mar '01

Hallo! Nachdem ich im Handbuch, der SDB und bei einer - zugegeben zügigen - Suche in deja nichts finden konnte, wende ich mich an Euch. Ich hoffe, Ihr könnt mir helfen. Die Firewall auf unserem neu-installierten Rechner läuft tadellos, lediglich im Zusammenhang mit unseren Nameservern haben wir ein Problem. Es geht lediglich um die Abfrage von externen Nameservern, wir haben selbst keinen named laufen. Nachdem die Nameserver mittels YaST eingerichtet sind, bleibt ein dr-gonzo:/etc/rc.config.d # rcSuSEfirewall restart nach der Ausgabe von Starting Firewall Initialization: (phase 3 of 3) ohne Meldung hängen. Wird die Firewall im Rahmen eines Neustart initialisiert, so hängt sie sich bereits bei Phase 2 auf und es hilft nur der Umweg über eine Bootdisk. Nach dem Weg-Kommentieren der Nameserver in /etc/resolve.conf geschieht das folgende: dr-gonzo:/etc/rc.config.d # rcSuSEfirewall restart Starting Firewall Initialization: (phase 3 of 3) Warning: No nameservers in /etc/resolv.conf! done Gemäss den Hinweisen im Handbuch ist die Firewall wie folgt konfiguriert, ich hoffe, ich habe die entscheidenden Variablen getroffen. FW_SERVICES_EXTERNAL_TCP="www smtp domain" FW_SERVICES_EXTERNAL_UDP="domain" FW_SERVICES_EXTERNAL_IP="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="dns" FW_SERVICE_DNS="no" Habt Ihr einen Tipp, was ich noch ändern muss? Vielen Dank, Gruss aus Köln, Thorsten

1 0

squid <--> raptor
by Thomas Hartmann 20 Mar '01

20 Mar '01

Hallo Leute, habe auf einer Suse 7.0 Box squid installiert. Diese muß durch einer Firewallbox hindurch. Deshalb habe ich in meiner Config einen cache_peer - Parent-Eintrag vorgenommen. Auch habe ich mit never direct all versucht keinen direkt zugriff zuzulassen. Wenn ich jetzt mit einem Client versuche eine Seite aufzurufen, muß ich ca. 5 minuten warten bis die seite kommt (ohne Bilder) und jedes weitere bild dauert dann auch wieder so lange? Ein strace zeigt: dns - anfragen werden sofort aufgelöst, dann versucht squid direkt den web-server zu erreichen, geht aber nicht wegen der firewall! Kann squid nicht gleich die Raptor-box auf Port 80 anfragen? Was muß ich da tun? Gruss Thomas

1 0

popper
by Nix 20 Mar '01

20 Mar '01

Does anyone know of a way to stop popper from doing ident and reverse dns lookups everytime someone connects? I can't seem to find any info on how to do it in the usual places. It takes insufferably long to connect to pop3 on a server I have just built. For ident I have configured my firewall to reject instead of drop, (it's a FW-1 box) but it doesn't seem to speed up connections any. I some instances the connections are coming through up to 5 firewalls, some NATed, some private addresses, and some public. (also via IPsec connections) Obviously not all of these addresses have reverse dns set, So I think that is the problem. (it may not be.. is there any other known reason for popper to be VERY slow to connect?) Any ideas? --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

7 8

netfilter documentation
by Greisberger Christophe 20 Mar '01

20 Mar '01

Do anyone know a detailed documentation on netfilter? I read the HOWTOs on http://netfilter.filewatcher.org/ but it didn't helped me much. I want to setup masq+firewall+port forwarding. So if anyone could send me a sample config script that's doing that, it = would help me much. Thanks! -- Christophe Greisberger Zenon-Media GmbH Phone: +49 (7852) 9133 / 34 Fax : +49 (7852) 9133 / 35

3 2

Starting SuSefirewall 4.4
by Dietmar Strasdat 20 Mar '01

20 Mar '01

Hello Listuser, after updating my SuSE 7.0 Kernel 2.2.16 with Marcs firewall 4.4 the first service SuSEfirewall_init fails. I dont know why, cause the rel 4.2 works fine. In init.d/rc2.d SuSEfirewall_init starts with kerneld as S01... Any hints? -- Best regards, Dietmar mailto:earthmate@gmx.net

4 3

RE: [suse-security] Router with NAT <-> SW-Firewall <-> HW-Firewa ll
by Reckhard, Tobias 20 Mar '01

20 Mar '01

> (a) What is a router with NAT for ? > It provides access to a network for machines with IP addresses that are unknown on that network by mapping the original source sockets to sockets on the NAT gateways interface connected to the network that access is desired to. > - is there the posibility of dialing in via internet > The NAT gateway is connected to the Internet, so it can be accessed normally. It should not be possible to directly access machines in the network behind the NAT gateway (from the Internet's point of view). However, it could be possible to hijack TCP sessions or fool the NAT engine. This has happened with UDP in the past. > - in which area is a router better / worse than a simple paket-filter > SW-firewall with masquerating (NAT) > You need to be more specific. The feature list of Linux boxes is very long and Cisco routers have a large set of features as well. Linux has ipchains (stateless) and iptables (stateful) for packet filtering, IP Masquerading is stateful per definition. Cisco routers have three types of access control lists ('basic', extended and reflexive), one of which is stateful, and there exists a 'firewall feature set' (CBAC) that can perform some inspection of some protocols. Ciscos also have NAT support. Linux is more extensible, but more work initially. > (b) A software firewall (SuSE-firewall) is only a paket-filtering aspect. > > - what is missing ? is it enough ? > You don't have any application-level inspection. I try to use application proxies wherever I can, they give you protection an order of magnitude higher than packet filters. Of course, it always depends on how much you trust your machines' TCP/IP stacks. Those are protected by proxies, but usually not by packet filters (well, making a Linux router defragment all packets does give some protection). > (c) what supports a hardware firewall instead of an software firewall ? > > - why is it better than a software firewall ? (is it really better ?) > There is no such thing as a hardware firewall. All firewalls are combinations of hardware and software. Cheers, Tobias

1 0

firewall and dns
by Thorsten Marquardt 19 Mar '01

19 Mar '01

Hi, I'm in trouble with firewals-2.6-33 and ipchains-1.3.9-173 (SuSE7.0). I like to run bind9 on the firewall and this are the settings from /etc/rc.config.g/firewall.rc.config: FW_DEV_WORLD="ippp0" #FW_DEV_WORLD_ippp0="192.168.2.99 255.255.255.255" # e.g. for exernal interface ippp0 FW_DEV_INT="eth0" FW_DEV_INT_eth0="192.168.0.4 255.255.255.0" # e.g. for internal interface eth0 FW_DEV_DMZ="" #FW_DEV_DMZ_eth1="192.168.1.1 255.255.255.0" # e.g. for dmz interface eth1 FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.0.0/24" FW_MASQ_DEV="$FW_DEV_WORLD" # e.g. "ippp0" or "$FW_DEV_WORLD" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_GLOBAL_SERVICES="yes" # "yes" is a good choice FW_SERVICES_EXTERNAL_TCP="smtp domain" # Common: smtp domain FW_SERVICES_EXTERNAL_UDP="domain" # Common: domain FW_SERVICES_DMZ_TCP="smtp domain" # Common: smtp domain FW_SERVICES_DMZ_UDP="domain syslog" # Common: domain syslog FW_SERVICES_INTERNAL_TCP="ssh smtp domain www 3128" # Common: ssh smtp domain FW_SERVICES_INTERNAL_UDP="domain" # Common: domain FW_TRUSTED_NETS="" FW_SERVICES_TRUSTED_TCP="" # Common: ssh FW_SERVICES_TRUSTED_UDP="" # Common: syslog time ntp FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" # Common: "ftp-data" (sadly!) FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # Common: "dns" FW_SERVICE_DNS="yes" # if yes, FW_SERVICES_*_TCP needs to have port 53 FW_SERVICE_DHCLIENT="no" # if you use dhclient to get an ip address FW_SERVICE_DHCPD="no" # set to "yes" if this server is a DHCP server FW_SERVICE_SAMBA="no" # set to "yes" if this server uses samba as client FW_FORWARD_TCP="" FW_FORWARD_UDP="" FW_FORWARD_MASQ_TCP="" FW_FORWARD_MASQ_UDP="" FW_REDIRECT_TCP="" FW_REDIRECT_UDP="" FW_LOG_DENY_CRIT="yes" FW_LOG_DENY_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_MASQ_MODULES="autofw cuseeme ftp irc mfw portfw quake raudio user vdolive" But starting the firewall-script leads to this errors- Starting Firewall Initialization: (final run) /sbin/ipchains: invalid port/service `1024 blackjack 1024 blackjack 1024 blackjack 1024 blackjack 1024 blackjack' specified Try `/sbin/ipchains -h' or '/sbin/ipchains --help' for more information. Whats going wrong? Yours Thom -- Experience is directly proportional to the value of equipment destroyed. -- Carolyn Scheppner ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://www.pzt.de -------------------------------------------------------------------

1 0

Where to find a good intro to ipchains for a dial-up linux box ?
by Marko Kaening 19 Mar '01

19 Mar '01

Hi, much is read about ipchains in this list. I know there are also howtos about this subject, sure. But maybe somebody could give me a hint concerning a good introduction to how to set-up a firewall using ipchains with SuSE? Unfortunately I found only manuals which explain how to firewall bigger networks, but I have a single host which I connect from time to time to the net. So I think setting-up such a thing should be a lot easier. BUT how? Any help welcome. Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

7 7

smtp_auth
by Simon Dittlmann 19 Mar '01

19 Mar '01

Hello, where can I finde information about smtp_auth? thanks. cu, sd

2 1

Re:who are logged in ?
by omicron 19 Mar '01

19 Mar '01

hi i installed whowatch, and while it is better than anything i've seen it still does not tell me about ftp, pop,etc. Surely the OS knows who are logged in and all i've to do is get the info from the OS . But how ? regards omicron -- ****** omicron Mail:omicron@omicron.dyndns.org (Sridhar N) www:omicron.symonds.net pubkeys:omicron.symonds.net/pubkeys C O G I T O E R G O S U M ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2

network interface problem
by jonathan 17 Mar '01

17 Mar '01

I just loaded 7.1 and a recomplied the 2.4 kernel (with ipmasq and iptables support) and I am getting an error message for my second network interface. I can do in ifconfig and the interface is up but here is the message from /var/log/messages: Mar 17 19:14:43 lucky kernel: NETDEV WATCHDOG: eth1: transmit timed out Mar 17 19:14:43 lucky kernel: eth1: Transmit timed out, status fc124010, CSR12 00000000, resetting... I am using Linksys cards, I am having no problems with them on other systems and tried replacing the card. Any help / ideas would be greatly appreciated. TIA

1 0

SuSEfirewall2 and 2.4 help needed, PLEASE
by jonathan 17 Mar '01

17 Mar '01

I am trying to get the new firewall2-0.5 to work with kernel2.4 that came with SuSE7.1. I have the firewall config file set but the init, start and final run scripts fail on boot up. Could someone please tell me what options I need to have set in the kernel to use iptables. This box will serve as a firewall and ipmasq box from my home network to my cable ISP. I have been able to get previous versions of the SuSEfirewall scripts to work great with IPChains, but the new iptables is a different story. Any help/comments would be greatly appreciated. TIA

1 0

all network ports in use
by Christian Boxhammer 17 Mar '01

17 Mar '01

Hi, There is sometimes a problem, logging into our two SuSE 7.0 (SMP) machines. Trying to log in with telnet procudes the following error Message: "telnetd: all network ports in use" In such a case it is not possible to log into the machine for several hours. Is this because of a portscan an anything else? Did anyone have a similar Problem? Christian Boxhammer -- Linux is like a Wigwam.. No Windows, no Gates, and Apache inside

9 10

SuSEfirewall*
by marc＠suse.de 17 Mar '01

17 Mar '01

Hi folks, SuSEfirewall-4.4 and SuSEfirewall2-0.5 are active now (available at http://www.suse.de/~marc/SuSE.html) if you installed the official SuSEfirewall-4.3 rpm - it is nearly the same as v4.4.tar.gz, however the rpm is not for SuSE 6.x machines, the .tar.gz works fine. Only minor fixed vor v0.5 please: if something is not working for you (and it is not a configuration error ...) please report to me! send me "SuSEfirewall status; grep ^FW /etc/rc.config.d/firewall*" and about harden_suse: the v3.1 is available for some time now, the official rpm update will be out the next days. Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

2 2

What does this mean
by Togan Muftuoglu 16 Mar '01

16 Mar '01

This is what I just had in my logs redirect from 3A90108/eth1 to D55FF0FC88 ignored .PATH =D49CC45A ->D550FC8, tos 00 eth1 is connected to ADSL and after this message for like 5 minutes I could not ping anything except the ADSL gateway What does this mean and where I can get more information TIA -- Togan Muftuoglu --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com ----- End forwarded message ----- -- Togan Muftuoglu

1 0

What does this mean
by Togan Muftuoglu 16 Mar '01

16 Mar '01

This is what I just had in my logs redirect from 3A90108/eth1 to D55FF0FC88 ignored .PATH =D49CC45A ->D550FC8, tos 00 eth1 is connected to ADSL and after this message for like 5 minutes I could not ping anything except the ADSL gateway What does this mean and where I can get more information TIA -- Togan Muftuoglu

1 0

Router with NAT <-> SW-Firewall <-> HW-Firewall
by DI H. Arnold 16 Mar '01

16 Mar '01

Hello ! I have seen, it is an english list ! I want to know the differences between a router with NAT, a software firewall and hardware firewall. Maybe one of you have some links to an web-page or article. I read the book "Linux Firewall from R. Ziegler" an therefore I known the strategie of paket-filtering. (a) What is a router with NAT for ? - is there the posibility of dialing in via internet - in which area is a router better / worse than a simple paket-filter SW-firewall with masquerating (NAT) (b) A software firewall (SuSE-firewall) is only a paket-filtering aspect. - what is missing ? is it enough ? (c) what supports a hardware firewall instead of an software firewall ? - why is it better than a software firewall ? (is it really better ?) thanks Harald

1 0

Router mit NAT <-> SW-Firewall <-> HW-Firewall
by DI H. Arnold 16 Mar '01

16 Mar '01

Liebe Gemeinde ! Ich versuche mich gerade in den Bereich "Sicherheit" einzuarbeiten und suche Unterlagen oder einen Vergleich zu folgende Schutzarten: Anmerkung: mein Grundwissen ist das Verstandnis der SuSE- Firewall aus Theorie (Bucher "Linux Firewall, R. Ziegler" als Paketfilter) und Praxis. (a) Was deckt ein Router mit NAT (masquerading) ab ? - kann ich mich dann uberhaupt von "drau?en" einwahlen ? - was kann ein Router mehr oder weniger als die SusE-FW ? (b) Welchen Schutz bietet eine LINUX-Firewall (ist ja nur Paketfilter) - altbekannte Thematik aus Buchern (c) eine richtige Hardware-Firewall - was kann eine HW-Firewall mehr als eine SW-Firewall (SuSE) lg Harald

1 0

strange fw log entry
by Michael Keyl 15 Mar '01

15 Mar '01

hi, I have just found the following lines in the log file of my firewall: Mar 14 17:45:06 linux sshd[8830]: Server listening on 0.0.0.0 port 22. Mar 14 18:27:30 keyl kernel: Packet log: input DENY eth0 PROTO=6 134.169.85.76:47157 0.0.0.0:0 L=40 S=0x00 I=43008 F=0x4000 T=1 (#38) Mar 15 11:02:35 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=359 S=0x00 I=1 F=0x4000 T=60 (#38) Mar 15 11:02:35 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=2 F=0x4000 T=60 (#38) Mar 15 11:02:37 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=359 S=0x00 I=3 F=0x4000 T=60 (#38) Mar 15 11:02:41 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=4 F=0x4000 T=60 (#38) Mar 15 12:15:41 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=400 S=0x00 I=1 F=0x4000 T=60 (#38) Mar 15 12:15:42 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=2 F=0x4000 T=60 (#38) Mar 15 12:15:43 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=400 S=0x00 I=3 F=0x4000 T=60 (#38) Mar 15 12:15:47 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=4 F=0x4000 T=60 (#38) Mar 15 17:02:45 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=333 S=0x00 I=1 F=0x4000 T=60 (#45) Mar 15 17:02:46 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=2 F=0x4000 T=60 (#45) Mar 15 17:02:48 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=333 S=0x00 I=3 F=0x4000 T=60 (#45) Mar 15 17:02:52 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=4 F=0x4000 T=60 (#45) Can anybody explain me what is going on there? Bye, Michael

3 2

problem mit spam und inflex
by Wolfgang Schäfer 14 Mar '01

14 Mar '01

Hi an ALLE, ich setze SuSE 6.3/6.4 ein! Ein firewall mit proxy, einen mailserver usw. Der firewall-Rechner leitet die mails direkt an den mailserver-Rechner weiter. Der mailserver läuft jetzt mit sendmail 8.11.0 von SuSE. Soweit ist das ganze spam-sicher. Wenn ich aber inflex benutzen will hab ich ein open relay! Was tun? Soll ich auf dem firewall noch einen mail2-server aufbauen, der dann spam-sicher ist und alle mails an den eigentlichen mail-server weiterleitet, oder gibt es andere scanner die auch Dateitypen filtern? Gruss -- _______________________________ Wolfgang Schaefer Diplom-Ingenieur (FH) Elektronik Systemadministrator Fon +49-(0)7308-818-22 Fax +49-(0)7308-818-65 busse design ulm gmbh Nersinger Str. 18 89275 Elchingen / Ulm, Germany http://www.busse-design-ulm.de _______________________________

3 2

Re: [suse-security] Obtuse SMTPD problem
by andreas.baetz＠herma.de 14 Mar '01

14 Mar '01

nix wrote: >I have a problem with the version of Obtuse SMTPD that is >precompiled with SuSE 7.0 >It does not seem to be able to resolve names of connections >even though they do have reverse DNS. >Mar 13 16:14:19 mayhem smtpd[3775]: No reverse mapping for address 9.9.9.9 (0) >Mar 13 16:14:19 mayhem smtpd[3775]: SMTP HELO from UNKNOWN(9.9.9.9) as Let's suppose your smtpd runs chrooted in /var/spool/smtpd. Did you check that the lib files for name resolution are present in /var/spool/smtpd/lib ? There should be at least libnss_dns.so.2 and libnss_files.so.2 (for SuSE 6.3, don't know for 7.0). Also check that the files /var/spool/smtpd/etc/nsswitch.conf, /var/spool/smtpd/etc/resolv.conf /var/spool/smtpd/etc/hosts are present and have the right contents. Andreas Baetz ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

2 1

Update to Apache 1.3.17-0 (SuSE 6.3)
by Holger-Schmidt＠arcor.net 13 Mar '01

13 Mar '01

Hi all, while using SuSE 6.3 I updated the Apache to Version 1.3.17-0 from FTP-Server. After updating the packages on our systems I 've got an error message while restarting the apache with "rcapache restart": rcapache: /etc/rc_status: no such command or file There is no file /etc/rc_status. For what is it ? Do I need it ? After removing this program call out of the startup script, the restart works. Hope somebody can answer my question. Bye Holger

2 1

Ipchains log messages
by Christian Bohn 13 Mar '01

13 Mar '01

Hi! my ipchains is producing the following output in the logfiles: Mar 13 15:35:32 clint kernel: Packet log: input DENY eth0 PROTO=1 aaa.aaa.aaa.aaa:8 bbb.bbb.bbb.bbb:0 L=84 S=0x00 I=11654 F=0x0000 T=57 (#792) I wonder why I get this messages because the IP-Adress bbb.bbb.bbb.bbb is none of mine! (but its in the same subnet) Its very annoying because Host aaa.aaa.aaa.aaa is sending ICMPs to bbb.bbb.bbb.bbb for several hours now, and my logfile is growing quite big... bye Christian

3 3

Re: I would like to be on your mailing list
by Roman Drahtmueller 13 Mar '01

13 Mar '01

> Subject: I would like to be on your mailing list > > I have just purchased SuSe Linux 7.1 Professional and would like to be > added to the security mailing list > > My e-mail address is: CharleeChinks(a)aol.com > > Thank you Please go to http://www.suse.de/en/support/mailinglists/index.html and subscribe yourself. Thank you, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

TLS and Sendmail
by Nix 13 Mar '01

13 Mar '01

Has anyone else successfully configured TLS on sendmail in SuSE 7.1? I have installed the sendmail-tls package from the sec section, but I can't find any ttls related doco anywhere. There is certainly nothing in /usr/share/doc/packages/sendmail that relates to it. Help Anyone? Do i need to configure certificates etc? I assume I do, but nothing seems to exist to describe how.. Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

2 1

Obtuse SMTPD problem
by Nix 13 Mar '01

13 Mar '01

I have a problem with the version of Obtuse SMTPD that is precompiled with SuSE 7.0 It does not seem to be able to resolve names of connections even though they do have reverse DNS. For instance, here are some logs where there is an SMTP connection initiated from 9.9.9.9 which resolves to the.gov (Names/IPs have been changed) As you can see from the 5th line, SMTPD does not actually managed to resolve the IP to a name. This limits some of the rules that you can use with SMTPD and makes it less useful. Is there an easy way to fix this?? Mar 13 16:14:19 mayhem smtpd[3775]: smtpd running in Paranoid mode Mar 13 16:14:19 mayhem smtpd[3775]: No reverse mapping for address 9.9.9.9 (0) Mar 13 16:14:19 mayhem smtpd[3775]: SMTP HELO from UNKNOWN(9.9.9.9) as "the.gov" Mar 13 16:14:19 mayhem smtpd[3775]: mail from <daffy.duck(a)the.gov> Mar 13 16:14:19 mayhem smtpd[3775]: smtp connection from UNKNOWN(a)UNKNOWN(9.9.9.9) MAIL FROM: <daffy.duck(a)the.gov> RCPT TO: <bugs.bunny(a)mydomain.com>, allowed by line 49 of /etc/smtpd_check_rules Mar 13 16:14:19 mayhem smtpd[3775]: Recipient <bugs.bunny(a)mydomain.com> Mar 13 16:14:19 mayhem smtpd[3775]: Received 6236 bytes of message body from UNKNOWN(9.9.9.9) Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

RE: [suse-security] Dynamic routgin
by Björn Engels 13 Mar '01

13 Mar '01

Give this a try (I'm not good in scripting, but it works for me): #!/bin/bash GW1="192.168.10.4" GW2="19.18.31.18" TEST=$GW1 echo "Setting default gw to $GW1" route add default gw $GW1 route -n echo Starting gateway test ... while true ; do echo "GW1: $GW1, GW2: $GW2, testing $TEST" ping $TEST -c 1 > /dev/null 2>&1 # $? returns 1 if host if [ $? = 1 ] ; then echo Gateway is down, resetting routes ... route del default gw $GW1 route add default gw $GW2 route -n if [ $TEST=$GW1 ] ; then TEST=$GW2 else TEST=$GW1 fi echo "Now testing $TEST" fi done

3 2

who are logged in ?
by omicron 12 Mar '01

12 Mar '01

hi all w, who, finger commands tell me who are all logged in _and_ alloted tty's. if a person uses ssh -T , or rsh, then i cannot find out on the fly without examining the logs. same goes for ftp too. If i want to watch the users logged in then , there really are few options to me ... closely examine the log files ( i put "*.* /dev/tty12" in my syslog.conf), checking the ps tree often but they dont help much. In short, i want the wtmp record to be written if there is logins in the below given categories. i think it might be to do with pam, but i really dont know much of pam usage, and i'm at a loss. So is there any single tool which tells the logins in the foll protocols.. 1> telnet / ssh logins with pty allocation as in normal who 2> ssh, rsh logins without pty allocation 3> ftp , preferably with the files being transferred 4> pop3 or is this too much to ask ? i dont mind if such a tool is su-only ,or requires priv mode. anything will do as long as i get the above ... regards omicron -- ****** omicron Mail:omicron@omicron.dyndns.org (Sridhar N) www:omicron.symonds.net pubkeys:omicron.symonds.net/pubkeys C O G I T O E R G O S U M ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

5 4

Personal Firwall vs. SuSEfirewall
by Ernst Koch 12 Mar '01

12 Mar '01

Do I need both Personal Firewall and SuSEfirewall or is Personal Firewall enough for a single box only connected to the internet? Regards Ernst -- Sent through GMX FreeMail - http://www.gmx.net

2 1

Why apache-1.3.17 ... leads to probs with .htaccess
by Gerd Aschemann 12 Mar '01

12 Mar '01

What is the reason to upgrade to Apache-1.3.17 with SuSE 7.0? I have been looking into the page with current fixes for SuSE 7.0 http://www.suse.de/de/support/download/updates/70_i386.html recently and found that Apache needs to be fixed. So I applied the recommended rpms (besides Apache some of the modules: - mod_php4-4.0.4pl1-19 - mod_perl-1.24-74 - modcontr-1.0.7-154 ) and all went ok. But today one of my users claimed that pages with .htaccess are no longer accessible. I investigated the problem and found that the respective Apache child process aborts with a segmentation fault ... Any ideas? I could not find a reason why to upgrade to 1.3.17 (I do not read the Apache mailing lists). Regards, -- Gerd Aschemann --- Veröffentlichen heißt Verändern (Carmen Thomas)

4 6

compartment and bind8
by Björn Engels 11 Mar '01

11 Mar '01

Hi ! I am running the latest bind8 rpm package from SuSE and I want to put it into a chrooted environment with Marc's "compartment". I am wondering if it is safer if I run bind as user root, but chrooted, or if I run it normally, but as user named. Removing the caps option and adding --user named --group named does not work, because the server isn't allowed to bind to ports < 1024. So what to do ? Björn

4 3

Dynamic routgin
by SUSE Mailing list 11 Mar '01

11 Mar '01

Does anyone know how to config route tables for dynamic routing. I would like to set 2 default gateways and if nobmer 1 is unavalible, system would use second one. Thanx, Tic Pavlin Neosystems Slovenia

2 1

Mail-Attachments
by Christian Erpelding 11 Mar '01

11 Mar '01

Hi there, I want to filter out some mail-attachments on our mailserver for security reasons. Any attachments ending with .vbs, .exe, .com and so on should be bounced when they come from a remote host and are addressed to a local user. We use SuSE 7.1 (Kernel 2.2.18), Sendmail 8.11 and Amavis 0.1.2 with avplinux as virusscanner. The incoming mails are fetched by fetchmail using pop3 as protocol. (Fetchmail is running as root and fetches all incoming mails for our domain) Any ideas how to create such filter rules? Thanks in advance, Christian --- MfG, Chr. Erpelding ce-data datentechnik erpelding(a)ce-data.de

4 3

firewall rule for talk
by Marco Ahrendt 09 Mar '01

09 Mar '01

hi list, is it possible to accept the "talk" application in any way? I tried to -j ACCEPT the udp port but talk isn't really using these ports for chatting. only the first packets are over udp 518 for example. then the client (remote) sends a new packet (syn) with totally different ports. does anyone has a solve? marco -- Marco Ahrendt phone : +49-341-98-474-0 adconsys AG fax : +49-341-98-474-59 Karl-Liebknecht-Str. 19 email : marco.ahrendt(a)adconsys.de 04107 Leipzig/Germany gnupg key at www.aktex.net/marco_work.asc

2 4

AW: [suse-security] Mail-Attachments
by Payreder Roman 09 Mar '01

09 Mar '01

Hi, i just use Postfix and the procmail-security script (html-trap.procmail) which can rename such files, so that the arent executable anymore. It works fine for me. Besides, it also filters rename the javascript,... tags in HTML Mails: http://www.impsec.org/email-tools/procmail-security.html br, Roman

1 0

Secumod
by Richard 09 Mar '01

09 Mar '01

Dear All Just out of curiosity I've installed secumod 1.6a from the 7.0 RPMs under sec1 on the CDs. The docs tell me to do 'insmod secumod.o' to start secumod but when I do that I get "secumod.o: No such file or directory" printing out on the screen on my SuSE 7.0 system. I can also see that there's a list of options such as "insmod secumod.o [OPTION]=[OPTION]". They don't work either. I think there might be a newer version but the problem is the lack of documents to give more detail about what to do with this package. Marc's done some really nice work with this but it's hard to figure it out without some help. Thanks Richard

6 12

xinetd
by Ahmed Mohammad 08 Mar '01

08 Mar '01

Hello, Is there any advantage to using xinetd over inetd? Anyone have any experience with this in 7.0? thankx

10 13

RE: [suse-security] udp 1024 - unknown
by Björn Engels 08 Mar '01

08 Mar '01

>What can be behind netstat -a * udp send-Q 288:1024 >nmap -sU x.com says udp 1024 unknown >- can it be related that tcpdump -i eth0 takes ages to write packet >traffic? 'lsof -Pi | grep 1024' should show you which process is listening on that port. Björn Engels LANWORKS AG

2 1

RE: [suse-security] all network ports in use
by Björn Engels 08 Mar '01

08 Mar '01

>Nevertheless, this doesn't seem to be the problem here. It more or less >looks like this machine has been under attack so that all available >sockets have been used up. In particular, it seems to have been a SYN >flood attack. There is no efficient countermeasure against this other >than >pulling the plug. That's what I think, too, but there are counter measures with kernel 2.4, I think. If I understand /proc/sys/net/ipv4/tcp_synack_retries correctly, you should reduce the value. Or restrict the incoming syn-rate at the firewall or get a firewall that knows "random early drop". (Thanks, Guido Stepken ;-) ) Björn Engels LANWORKS AG

1 0

udp 1024 - unknown
by webmaster 08 Mar '01

08 Mar '01

What can be behind netstat -a * udp send-Q 288:1024 nmap -sU x.com says udp 1024 unknown - can it be related that tcpdump -i eth0 takes ages to write packet traffic? -------------------------- webmaster Kreorg Oktatóközpont Tel/Fax: 321-0031 email: webmaster(a)kreorg.hu

1 0

Re: [suse-security] all network ports in use
by christian.burri＠synecta.ch 08 Mar '01

08 Mar '01

Roman Drahtmueller To: Murat Koc <muratkoc(a)linux.org.tr> <draht(a)suse.d cc: Christian Boxhammer <box(a)theor.geod.uni-bonn.de>, <suse-security(a)suse.com> e> Subject: Re: [suse-security] all network ports in use 08.03.2001 11:46 >> > There is sometimes a problem, logging into our two SuSE 7.0 (SMP) machines. >> > Trying to log in with telnet procudes the following error Message: >> > "telnetd: all network ports in use" >> > In such a case it is not possible to log into the machine for several hours. >> > Is this because of a portscan an anything else? >> > Did anyone have a similar Problem? >> >> Be sure that you compiled the kernel with "Unix98 PTY support" and >> "/dev/pts file system for Unix98 PTYs" options enabled. >> >> or add a line in your /etc/fstab >> >> none /dev/pts devpts mode=0620 0 0 > >The devpts filesystem gets mounted by /sbin/init.d/boot at boot time on >SuSE distributions and are not listed in the fstab. It shouldn't matter if >it shows up there, though. > >Nevertheless, this doesn't seem to be the problem here. It more or less >looks like this machine has been under attack so that all available >sockets have been used up. In particular, it seems to have been a SYN >flood attack. There is no efficient countermeasure against this other than >pulling the plug. <snip> What about SYN cookies? Or would it help to adjust values in /proc/sys/net/ipv4/tcp_syn_retries resp /proc/sys/net/ipv4/ tcp_max_syn_backlog? Or the upstream ISP starts limiting max SYN packets rate? cheers Chr. Burri

2 1

iptables as a firewall
by Grimm, David 08 Mar '01

08 Mar '01

Hello folks, I was wondering if I could get a little advise on firewalls. I'm setting up a webserver, email server, and firewall site (three computers running SUSE). The firewall is going to be hooked up directly to a high speed DSL line...for starters. It's going to have a static IP. The other machines are going to have only the necessary software (Apache on one and SuSE email server II on the other). The firewall is going to sport the 2.4 kernel with the netfilter/iptables patch. The question is: Is it possible to forward traffic to the other two machines (if they have static IP's of there own) using just iptables? Or, do I have to use another tool/ utility? Thanks for any help, DAVID *********************************************************************** This electronic message may contain information that is confidential and/or legally privileged. It is intended only for the use of the individual(s) and entity named as recipients in the message. If you are not an intended recipient of this message, please notify the sender immediately and delete the material from any computer. Do not deliver, distribute or copy this message, and do not disclose its contents or take any action in reliance on the information it contains. Thank you.

2 1

Sorry!!!
by jobhopper Pascal Ehlig 08 Mar '01

08 Mar '01

SORRY! Sorry that i have flooded this list with my isread responsemail. I have forgotten to remove it (now i have killd it)... again sorry... i have get 500 mails for this... shit...... 30Mins to download all isread responses... i think you know i DONT want to do that... Pascal Ehlig

1 0

Re: [suse-security] ipchains-rule to deny a special domain -didn't work :(
by christian.burri＠synecta.ch 07 Mar '01

07 Mar '01

In case u wanted to restrict access from a certain domain name.... ipchains doesnt accept domain names for -s or -d afaik. At least, I couldnt get a rule like ipchains -A input -s *.nz -d 123.123.123.123 -j DENY to work :( .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^

3 2

Companies Still Running Flawed BIND Software
by Fred A. Miller 07 Mar '01

07 Mar '01

Companies Still Running Flawed BIND Software An Icelandic software and consulting firm tested DNS systems at Fortune 1000 companies and .coms at periodic intervals after the announcement of the flaw in BIND software. After a striking initial drop in the number of sites running insecure versions of BIND, the surge has faded to a trickle. SANS GIAC and CERT/CC have begun receiving reports of successful BIND vulnerability exploits. http://www.computerworld.com/cwi/stories/0,1199,NAV47_STO58302,00.html -- Fred A. Miller Systems Admin. Cornell Univ. Press Services fm(a)cupserv.org

2 1

AW: [suse-security] remote login for root?!
by Schoenwaelder Oliver 07 Mar '01

07 Mar '01

Hi, sorry, you have to edit the sshd config file (/etc/ssh/sshd_config). Change PERMIT_ROOT_LOGIN to NO. Restart sshd and root login is permited. Hth, Oliver -----Ursprüngliche Nachricht----- Von: Andreas Otto [mailto:andreas@noho.co.uk] Gesendet: Mittwoch, 7. März 2001 17:52 An: SuSE-Security Betreff: [suse-security] remote login for root?! Hi , I have always believed that ROOT_LOGIN_REMOTE="no" in /etc/rc.config prevents root from logging in remotely. But a simple: C:\>ssh -l root 192.168.101.99 Password: Last login: Wed Mar 7 15:41:22 2001 from 192.168.101.237 Have a lot of fun... mojox:~ # Tells me that something weird is going on here. Are there any other places I need to check for apart from the two mentioned below? /etc/rc.config: # If you want to allow root logins from other machines, set ROOT_LOGIN_REMOTE # to "yes". # ROOT_LOGIN_REMOTE="no" /etc/ssh/sshd_config: Port 22 #Protocol 2,1 ListenAddress 0.0.0.0 #ListenAddress :: HostKey /etc/ssh/ssh_host_key ServerKeyBits 768 LoginGraceTime 600 KeyRegenerationInterval 3600 PermitRootLogin no # Cheers, Andreas -- Andreas Otto OgilvyInteractive | Floor 2, Canberra House 315 - 317 Regent Street | London W1B 2HS Reception +44 207 299 3434 | Fax +44 207 631 5050 http://www.ogilvy.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-linux-unsubscribe(a)suse.com For additional commands, e-mail: suse-linux-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

AW: [suse-security] remote login for root?!
by Schoenwaelder Oliver 07 Mar '01

07 Mar '01

Hi, I'm sorry. In fact you are right. Maybe I should have had a look down your mail and notice your sshd config file. Are you using RSA authentication? In that case root login will be ok if RSA succeeds, regardless the value of PermitRootLogin. H THAT h, Oliver -----Ursprüngliche Nachricht----- Von: Andreas Otto [mailto:andreas@noho.co.uk] Gesendet: Mittwoch, 7. März 2001 17:52 An: SuSE-Security Betreff: [suse-security] remote login for root?! Hi , I have always believed that ROOT_LOGIN_REMOTE="no" in /etc/rc.config prevents root from logging in remotely. But a simple: C:\>ssh -l root 192.168.101.99 Password: Last login: Wed Mar 7 15:41:22 2001 from 192.168.101.237 Have a lot of fun... mojox:~ # Tells me that something weird is going on here. Are there any other places I need to check for apart from the two mentioned below? /etc/rc.config: # If you want to allow root logins from other machines, set ROOT_LOGIN_REMOTE # to "yes". # ROOT_LOGIN_REMOTE="no" /etc/ssh/sshd_config: Port 22 #Protocol 2,1 ListenAddress 0.0.0.0 #ListenAddress :: HostKey /etc/ssh/ssh_host_key ServerKeyBits 768 LoginGraceTime 600 KeyRegenerationInterval 3600 PermitRootLogin no # Cheers, Andreas -- Andreas Otto OgilvyInteractive | Floor 2, Canberra House 315 - 317 Regent Street | London W1B 2HS Reception +44 207 299 3434 | Fax +44 207 631 5050 http://www.ogilvy.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-linux-unsubscribe(a)suse.com For additional commands, e-mail: suse-linux-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

remote login for root?!
by Andreas Otto 07 Mar '01

07 Mar '01

Hi , I have always believed that ROOT_LOGIN_REMOTE="no" in /etc/rc.config prevents root from logging in remotely. But a simple: C:\>ssh -l root 192.168.101.99 Password: Last login: Wed Mar 7 15:41:22 2001 from 192.168.101.237 Have a lot of fun... mojox:~ # Tells me that something weird is going on here. Are there any other places I need to check for apart from the two mentioned below? /etc/rc.config: # If you want to allow root logins from other machines, set ROOT_LOGIN_REMOTE # to "yes". # ROOT_LOGIN_REMOTE="no" /etc/ssh/sshd_config: Port 22 #Protocol 2,1 ListenAddress 0.0.0.0 #ListenAddress :: HostKey /etc/ssh/ssh_host_key ServerKeyBits 768 LoginGraceTime 600 KeyRegenerationInterval 3600 PermitRootLogin no # Cheers, Andreas -- Andreas Otto OgilvyInteractive | Floor 2, Canberra House 315 - 317 Regent Street | London W1B 2HS Reception +44 207 299 3434 | Fax +44 207 631 5050 http://www.ogilvy.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-linux-unsubscribe(a)suse.com For additional commands, e-mail: suse-linux-help(a)suse.com

1 0

Re: [suse-security] ipchains-rule to deny a special domain
by Martin Peikert 07 Mar '01

07 Mar '01

Martin Peikert <martin.peikert(a)innominate.com> wrote: > > Try > "ipchains -I input 1 -d xxx.y..." > instead of > "ipchains -A input -d xxx.y..." > Oops - meant output, not input. MArtin -- martin.peikert(a)innominate.com innominate AG the linux architects tel: +49-30-308806-0 fax: -77 http://www.innominate.com

7 7

Re[4]: [suse-security] ipchains-rule to deny a special domain -now works! :-)
by da_bug 07 Mar '01

07 Mar '01

hi! Now it works! ;-) THANX!! I did it this way: I flushed the old rules and reloaded everthing (checked that the deny-rule is over the allow-rules). This rule did it: ipchains -I input 1 -p tcp -s 0/0 -d domain-ip -j DENY ..and as soon as I have time I'll read the Howto's,manpages and RFC's.. ;-) (In the end one of the last biggest problems in technology is that your lifetime is limited...) bye & thanx again...

1 0

Redirect ftp traffic to an IIS4 ftp server
by Ka Kit Yick 07 Mar '01

07 Mar '01

Hi all, I'm using SuSE 6.4 with firewals-2.0-12. I need to redirect outside ftp traffic to an internal iis4 ftp server. Let said that the external address of the firewall is 12.34.56.80 and the address of the internal ftp server is 172.20.0.80. I use Rinetd to redirect the traffic with the following line : 12.34.56.80 20 172.20.0.80 20 12.34.56.80 21 172.20.0.80 21 I try to connect to the server using CuteFTP. In PASV mode, it says "Connection data socket..." but it never get through. And in active mode, it says "500 Invalide PORT Command". I know that in rinetd manual, it says that rinetd cannot redirect ftp traffic because it uses more than one socket. Is there any solution, without changing to whole thing? Thanks Ka Kit Yick

2 1

[Fwd: Re: [suse-security] ipchains-rule to deny a special domain]
by Hipolito A. Gonzalez M. 07 Mar '01

07 Mar '01

da_bug wrote: > hi! > > I want to deny the client-computers behind my router to access some > special domains/ip-addresses in the internet. > I tried something like "ipchains -A input -d xxx.yyy.zzz.xxx -p tcp -j > DENY" and "ipchains -A input -s xxx.yyy.zzz.xxx -p tcp -j > DENY" but it didn't work... > What can I do to deny access? > > bye. you have an error -s is: the source of the petition. is you networks is 192.168.0.0 with netmask 255.255.255.0 you need to put it in the -s (if you want to block all your networks, or the specific IP) and the -d is for the destination, por example, if you want to stop the conections to hotmail, make a lot of ping to www.hotmail.com and copy all IP of hotmail, for example, if hotmail is: 100.100.100.1 .2 .3 .4 .5 and .6 yuou need to put: ipchains -A input -s 192.168.0.0/0 -d 100.100.100.1 -p TCP -j DENY ipchains -A input -s 192.168.0.0/0 -d 100.100.100.1 -p UDP -j DENY and repeat it all times for each IP of the destination (until .6 in this example) If you need more help, write. PD: Excuse for my bad english -- www.geekcode.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ h! r++ y++ ------END GEEK CODE BLOCK------ - A veces creo que hay vida en otros planetas, y a veces creo que no. En cualquiera de los dos casos, la conclusión es asombrosa (Carl Sagan) -----------------------------------------------------------------D: Excuse for my bad english -- www.geekcode.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ h! r++ y++ ------END GEEK CODE BLOCK------ - A veces creo que hay vida en otros planetas, y a veces creo que no. En cualquiera de los dos casos, la conclusión es asombrosa (Carl Sagan) -----------------------------------------------------------------

1 0

[suse-security] ipchains-rule to deny a special domain
by da_bug 07 Mar '01

07 Mar '01

hi! I want to deny the client-computers behind my router to access some special domains/ip-addresses in the internet. I tried something like "ipchains -A input -d xxx.yyy.zzz.xxx -p tcp -j DENY" and "ipchains -A input -s xxx.yyy.zzz.xxx -p tcp -j DENY" but it didn't work... What can I do to deny access? bye.

4 5

Re: [suse-security] SMTP antiSpam proxy ???
by christian.burri＠synecta.ch 07 Mar '01

07 Mar '01

Okies =) Thank all you nice ppl for the info :) I will definately have a closer look at obtuse smtpd (neat since it seems to do xactly what I need and cuz it comes with SuSE on CD :) and AMAVIS (maybe I can get them to work together??). Thanks again and cheers Chr. Burri .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^

1 0

Ack, sendmail and firewall script
by Matthew Johnson 07 Mar '01

07 Mar '01

Thought it would take an hour to do, I was wrong! Anyone here having problems with 7.1 Firewall script? Mine comes up as a failure on all 3 runs, but I only get a warning on startup about DNS service not running, but it works. Anyone else get this? Matt

3 3

SuSEfirewall2 - new ALPHA version
by marc＠suse.de 06 Mar '01

06 Mar '01

Hi folks, by luck I was able to make the fixes for SuSEfirewall2 at once instead of having them lying around for some days as I thought it would take half an hour ago ... so here is v0.4: v0.4 06.03.01 ALPHA * Changed the START_FW variable to START_FW2 so you can have installed both SuSEfirewall(1) and SuSEfirewall2 in parallel without problems * Fixed a bug in INSTALL where the K99 stop script was incorrectly symlinked. * Fixed a bug in the masquerading. should work now. (thanks to jboonen(a)worldonline.nl) * Fixed dumb warnings and typos * Fixed a bug in FW_FORWARD for tcp and udp (for both bug reports thanks to christian.esser(a)gmx.de> you can find it at http://www.suse.de/~marc/SuSE.html Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

1 0

SuSEfirewall2 - first ALPHA
by marc＠suse.de 06 Mar '01

06 Mar '01

For the desperate: SuSEfirewall2 v0.3 is available for testing from www.suse.de/~marc It installs without problem with a SuSEfirewall(1) installation, the only variable shared is the START_FW variable (well, with the result that both firewall will try to start when booting ;-) please note: due my current network probs at home I could not make real tests. so everyone who can check features, and if possible send me a fix for something which is not working - that would be great!! Q: What changed from SuSEfirewall(1) to SuSEfirewall2 A: Many things. Most important: it uses iptables (which is especially for 2.4 kernels) instead of ipchains. Visible changes: New commandline option "debug" which prints out the iptables commands, great to print the rules, and them modify them for you liking! Added the new options: FW_ALLOW_CLASS_ROUTING - allow routing between interfaces of the same class, e.g. two internal networks FW_ALLOW_FW_BROADCAST - allow broadcast packets to reach the firewall FW_ALLOW_PING_EXT - allow the internal/dmz to ping the internet FW_SERVICE_AUTODETECT - autodetect START_{NAMED,SMB,DHCPD} and DHCLIENT Renamed some variables, removed some, changed syntax (small changes) All forward,masquerading,trust definitions can now be very global or very fine-grained as you need it The logging looks different - hell this is iptables :-( It takes a bit longer to create the complex ruleset :-( Invisible changes: A packet has to traverse much less rules, so packet processing is faster Stateful packet checking is present now (thanks to the 2.4 kernel) More intelligent ICMP filtering and identd rejection Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

3 9

Re: AW: [suse-security] bind8 update Problem
by Hans Vokal 06 Mar '01

06 Mar '01

--- Alexander Bien <abien(a)gmx.net> schrieb: > > Wenn du an antworten interessiert ist .. solltest du beachten das die suse > list auf englisch läuft .. Oops! so sorry. But thankss for the help anyway bind8 runs now smoothly. cu Hans __________________________________________________________________ Do You Yahoo!? Gesendet von Yahoo! Mail - http://mail.yahoo.de

1 0

IMAP Server II and security updates
by Martin Sckopke 06 Mar '01

06 Mar '01

Hi all, I've got a question regarding the SuSE-IMAP-Server II. Do all security related updates apply to this version of SUSE, too? Did anyone upgrade SuSE-EMail Server to SuSE 7.1? Did anyone upgrade to Kernel > 2.4 (i.e. 2.4.2.SuSE-5 ?) Thanks a lot for your help, Martin -- GiS - Gesellschaft fuer integrierte Systemplanung mbH Martin Sckopke Tel. +49-6201-503-74 Junkersstr. 2 Fax +49-6201-503-66 D-69469 Weinheim m.sckopke(a)gis-systemhaus.de

5 7

RE: [suse-security] IMAP Server II and security updates
by rfertig＠telebel.net 06 Mar '01

06 Mar '01

Hi Björn. > I upgraded my ("ordinary", not IMAP-Server) SuSE 7.1 to 2.4.2.SuSE-5. > But after installing the new Kernel (compiled with the same settings > as the pre-built 2.4.0), some modules didn't load anymore - just a > silly message is being shown : > "Kernel version mismatch - module was built for kernel 2.4.2-4GB while > this is kernel 2.4.2." > > At home I had a similar problem, but the other way around: > "... module was built for kernel 2.4.2 while this is kernel 2.4.2-4GB" I've got the same message when I try to insmod a patched networkdriver (modul is 2.4.0, kernel 2.4.0-4GB). The only way I found to get things work (except insmod -f) was to modify the Makefile and comment out all ifdef-lines (and related) in the section "Test for Highmen support" and only leave the line HIGHMEMVERSION="-4GB" It seems to me, that there is an error in the Makefile or in .config but since I'm not verry familar with these things I didn't found it. However, this all isn't security-related, but someome at SuSE should take a look at this (I already send a mail to the support). Bye, Rene

1 0

ssh, warnings
by Joerg Henner 06 Mar '01

06 Mar '01

Hi, i'm having these messages occur with fw:~ # rpm -qa|grep -i ssh openssh-2.3.0p1-0 ---[cute here]--- Mar 5 15:16:26 fw sshd[1343]: WARNING: /etc/ssh/primes does not exist, using old prime ---[cute here]--- System is an SuSE 6.4 Any Hints ? Greetings, -- Jörg Henner Fon: +49 (7 11) 2 85 19 05 LiHAS - Servicebuero Stuttgart Fax: +49 (7 11) 5 78 06 92 Adrian Reyer & Jörg Henner GbR Mail: lihas(a)lihas.de Linux, Netzwerke, Consulting & Support http://lihas.de/

1 0

Suggstion on security
by John Murphy 05 Mar '01

05 Mar '01

I have a cable Internet connection and run it through a Linksys router. This has NAT built in for protection. Of course through this I run DHCP to three other machines in a home network, 1 linux and 2 wins. Is this good enough or do I need to setup a personal firewall besides. I have Suse 7.1 and don't have the personal firewall on as this is the way the auto setup did it through Yast. If I do turn it on will this throw a monkey wrench into the something that is running fine now. I'm a newbie at firewalls and the option of just having it done automatically seemed appealing. But I figured Yast has to be much brighter then me and it had to be a reason. I'm thinking because of the DHCP? John......... -- Contentment is not the fulfillment of what you want, but the realization of how much you already have.

2 1

Re: [suse-security] Secure Syslogd
by christian.burri＠synecta.ch 05 Mar '01

05 Mar '01

Gerd Bitzer <gerd.bitzer@ To: RoMaN SoFt/ LLFB!! <roman(a)madrid.com> tesion.de> cc: suse-security(a)suse.com Subject: Re: [suse-security] Secure Syslogd 02.03.01 08:28 Good morning Roman, "RoMaN SoFt / LLFB!!" wrote: > On Thu, 01 Mar 2001 13:09:13 +0100, you wrote: > > >Hi List, > > > >does anybody know a secure dropin Replacement for the standard syslogd, > >which supports libwrap-style ACL's ? > > Ummm there are several ones (try at securityportal.com: there's at > least an article about that), I don't know if they support libwrapp. > I'd recommend using the standard syslogd with some acl's in your > router since other replacements aren't standard and you won't be able > to, for instance, receive logs from other boxes (routers, switches, > load-balancers, etc). >Hmm, I know the page on securityportal.com, the daemons there are quite >interesting as they implement such things as syslog over tcp or even over >ssl. But thats a little bit oversized for my needs. > > > Standard syslog goes over UDP and not encrypted. It's easy to defeat > if you don't set the aproppiate fw rules (router acl's, eg). I had a > look at some alternatives some time ago but none of them convince me. > Many of them were not mature enough and I decided to leave the > original syslogd. >There's an alternate rpcbind daemon from Vietse Venema which implements such >libwrap based ACL's for RPC, which makes sense in my opinion, but I haven't >found an adequate, simple dropin syslogd :-( what would be a "secure" replacement? why is syslog not secure? answer: because it relies on UDP. Now, you should simply use something that does not rely on UDP to transport log messages. But then, it isnt a drop-in replacement, is it? Thats kinda fsck'd .. What I would do is, block UDP traffic in general (with a few exceptions) at the border router or firewall, so I dont have people sending UDP traffic into my network. If I'd need to carry UDP traffic thru an untrusted network, then I'd rely on VPN technology. But, *at least* I'd block UDP traffic on syslog port at the border routers... And then, I'd ignorantly continue to use standard syslogd :-) Cheers chris >Maybe anybody in this list does have knowledge about such a beast ;-) > > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > ** RoMaN SoFt / LLFB ** > roman(a)madrid.com > http://pagina.de/romansoft > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

bind8 update Problem
by Hans Vokal 05 Mar '01

05 Mar '01

Hallo Nachdem wohl inzwischen alle ihren named upgedated haben komme ich hinterher wie die alte fasnacht... Mein Problem ist, das nach dem update von bind4 auf bind8 nur intern bekannte Rechnernamen aufgelöst werden. Externe Rechnernamen (z.B. www.suse.de) werden nicht aufgelöst. Der Rechner ist übrigens mit SuSE 6.0 bestückt. Die selbe Konfiguration läuft auf einem anderen REchner (auch SuSE 6.0) Problemlos. Der Rechner, der die Probleme macht, hat ein paar Firewall-regeln am laufen, da aber bei bind4 alles klappt, weiß ich nicht ob das relevant ist. Verhält sich der bind8 bei forward-Anfragen anders als bind4 ? Wahrscheinlich bin ich nur blind (aber um jeden Hinweis dankbar) Hans . __________________________________________________________________ Do You Yahoo!? Gesendet von Yahoo! Mail - http://mail.yahoo.de

1 0

Re: [suse-security] SMTP antiSpam proxy ???
by andreas.baetz＠herma.de 05 Mar '01

05 Mar '01

Andreas Siegert wrote: >Quoting Nix (suse(a)nix.hispeed.com) on Mon, Mar 05, 2001 at 02:54:24AM +0100: >> This is exactly what Obtuse SMTPD was designed to do. It is on the SuSE cd's >> Check out www.obtuse.com for more info. >I stopped using it. It does not handle Mailer Daemon Bounces with <> Addresses >propperly. If that means it doesn't accept bounces and denies them, you could use something like this in your smtpd-check-rules: # handle mail from: <> # outgoing messages allow:(your internal net):/^$/:ALL # incoming messages allow:ALL:/^$/:ALL@(your mail domain) This works for me. Andreas Baetz ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

1 0

SuSE Security Announcement: cups
by Sebastian Krahmer 05 Mar '01

05 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: cups Announcement-ID: SuSE-SA:2001:05 Date: Monday, March 5th, 2001 13:10:13 MET Affected SuSE versions: 7.1 Vulnerability Type: local/remote root compromise Severity (1-10): 5 SuSE default package: no Other affected systems: All UN*X-systems using cups < 1.1.6. Content of this advisory: 1) security vulnerability resolved: cups problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information CUPS is an implementation of the Internet Printing Protocol (IPP) and is used as an alternative to the lpr and LPRng packages. The CUPS package aims to be a comprehensive printing solution for UN*X-systems. In SuSE-7.1 distribution, the cups package is not used by any configuration utilities unless the admin has decided to configure the package manually. The cups package has been introduced in the SuSE-7.1 distribution; enhanced support for future releases of the SuSE Linux distribution is planned. A SuSE-internal security audit conducted by Sebastian Krahmer and Thomas Biege revealed several overflows as well as insecure file handling. These bugs have been fixed by adding length-checks and securing the file-access. For a temporary workaround, remove the suid-bit from the 'lppasswd' program. Make sure nobody from outside your network can access the CUPS-server running on port 631. Allowing access to this port from outside is a bad idea regardless whether or not the used version is vulnerable. No remote-exploits are known yet. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/d3/cups-devel-1.1.6-13.i386.rpm 23c6484952ab0c1de81e2db38bcd3afc SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/cups-1.1.6-13.i386.rpm 812e0c47dcfe508eb9e8ccb38165b6d7 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/cups-1.1.6-13.src.rpm 204cea2ad6a61293c191e70a2cacdc82 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: Effective Monday, March 19 2001, five weeks after the release of the new SuSE-7.1 distribution, SuSE will discontinue support for the SuSE-linux distributions SuSE-6.0 SuSE-6.1 and SuSE-6.2. SuSE puts much effort into adding security improvements (patches) to the software instead of publishing a new version; the same program with a fix for a specific problem promises to work just as reliable as the original version from the distribution, whereas new versions introduce new functionality which changes the behaviour. In some cases however, especially if the security leak is based on problematic design decisions or when the fix(es) are fairly large, the only reasonable fix for a security problem is to update to a newer version of the software. These newer versions tend to become incompatible with our older distribution releases because of missing features in the operating system environment. This forces us to focus on the distributions of a newer release date. The remaining distributions SuSE-6.3, SuSE-6.4, SuSE-7.0 and SuSE-7.1 for the Intel i386, AXP Alpha, SPARC as well as PPC Power PC platforms will continue to be supported for a two-year period after the release of the respective distribution. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Sebastian Krahmer ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOqODeXey5gA9JdPZAQHRYQf/aNhY+lHrkpmWlxGtQI29qetDlIuqVbvQ jUb4jm6vMvYJrFwzhtZ9XpWWYECDiqQjhy9KwmkkaVBrDTtbboNuQ+Wqq93zLzTD t1uXxGqb3p847p3OtoxZXR9ZUxxB+tn6MS2CGUZVDA+TaYgUD9DW1eb9+z0t5ehN 2cdYZqvAp22BasIdXGlFSvCJ4oBqXT9HmqBk8Q+FS7ZzT0VKvOmXShqv5bWOPRj+ XwuuiPdPGc9Ykwp8lcoymU2Y8b62MASEVYsFT4rynMxrDSfNUaEPXTAhc2RPM9vn +BgXrT0rfUiPkRWQTNpokp93TO3v8cOFgw0keeLcYRbP1nk36Ng03w== =BWbh -----END PGP SIGNATURE-----

1 0

SMTP antiSpam proxy ???
by christian.burri＠synecta.ch 05 Mar '01

05 Mar '01

Hello List! Im in desperate need for an SMTP proxy. Well, not just another proxy, it needs basically to do this: - Listen on external interface, port 25 - If mail arrives, check the DESTINATION address of the delivered email and verify that against a list of valid destination addresses - If the RCPT TO is valid* (in "allowed" list), then the proxy should relay the mail to an internal server - If RCPT TO is not a valid* one (e.x. spam_victimXY(a)hotmail.com), then it should drop the mail and close the spammer's connection. Is there such a program? I can imagine one could do that as a netfilter module...its a shame I cant code in C. :( The other approach I can think of would be AMAVIS maybe? That would be neat too, then it would have integrated virus protection. So, can AMAVIS do *exactly as I need (described above) ? Or is there some simpler solution (the more simple, the better because this is for a packet filter, that y I tought of a netfilter module) that would provide me with the needed features? help and ty :) Chris Burri jun. Systems & Network Engineer Synecta Informatik AG Zwinglistrasse 3 CH-9000 St. Gallen .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^ * valid and not valid: if a site has an email server and hosts domains on it, then one can say that an email, coming in on the external public IP of the site should have an email address that ends in one of the domains the site actually hosts, unless the mail was either sent in error, or it is a spam MAIL (some corporate level groupware servers are notoriously vulnerable to SPAM under certain conditions). Example for Site "dontlikespam.org" : If mail comes in on external interface, with an RCPT TO of "sales(a)dontlikespam.org", then it should be passed thru. If mail comes in on external interface, with an RCPT TO of "john.doe(a)dontlikespam.org", then it should be passed. If mail comes in on external interface, with an RCPT TO of "somebody(a)hotmail.com", then it should be blocked, and the connection that feeds the mail shall be dropped. in the "allow" list, there would be one entry like "dontlikespam.org" The RCPT TO must be checked strictly. Means, relay(a)hotmail.com% @dontlikespam.org must not circumvent it. Maybe there should be a keyword in the config file to disable (default is on) strict checking. Outgoing mail comes from internal interface and will not be tested. Externals connecting from remote sites either use dial-up and thus come from internal interface, or they use a VPN and thus wont appear on the external interface either.

5 5

Get rid of kdeinit port?
by uwe_kersten＠t-online.de 03 Mar '01

03 Mar '01

Hi all, after shutting down the x-server port I am looking for a way to skip networking for kde2. After starting kde2 I have a high port open that belongs to kdeinit. How can I tell kde not to open this port? Thanx in advance Uwe -- ------------------------------------------------------- Uwe Kersten E-Mail: uwe.kersten(a)online.de Live long and prosper! -------------------------------------------------------

3 2

ssl slow
by Andreas Fiesser 03 Mar '01

03 Mar '01

Hi! Yesterday I ran - for the first time ever - HardenSuSE on my router-box. I read the description on Marc's page as far as "run HardenSuSE yes" and went for it. I'm a practical type of guy, you see. :} When all those funny lines scrolled by, I wondered if this was really wise ... Well, I got all things up again and the box seems still doing what it is supposed to. A lot safer no, I figure. The only thing that gives me a pain is that the output of my ssl client (putty on Win2K), which I use most of the time to manage the Linux box via LAN, got rather slow. Before HardenSuSE screen output was about twice as fast. This is anoying when I youse mc, yast and such stuff. It's not really a life threatening issue but perhaps someone here could tell me what I could do about it to get it as fast as before ? ... Andreas

1 0

routing problems at dmz host
by Marco Ahrendt 03 Mar '01

03 Mar '01

hi all, I use the following network topology: Internet | (official IP) Router1 (192.168.1.1) | | eth0 (192.168.1.2) eth0 (official IP) Router2/Firewall eth2(192.168.1.3) --- DMZ eth1 (official IP) eth0:1 (192.168.1.4) | | Local Network (official IPs) The official Network consists of a Subnet with 16 IP adresses. The router/fw is an p133 which uses kernel 2.4.2 and iptables. The DMZ (yes, its not a really DMZ :) is one host, running a www server, a mail server and some other daemons. Default gateway for DMZ is 192.168.1.3 (eth2 on FW) how you can see. The problem is, linux uses the first IP (?), which it can use for the fastest hop and therefor, if I ping the internet, the router1 can't forward the internal IP to the net. If I use ping -I OFFICIAL_IP internet, everything works fine! I installed the package "iproute" but I can't set up the routing with this. There is no manpage and the howto is little bit short. :) Is it possible to give the system an other IP (official) than the internal IP which linux uses as default ? Same problem occurs on the FW host. Second problem: How can I accept dhcp in iptables ? Can I use connection tracking ? Someone telled me, dhcp isn't using protocols like tcp or udp so how do I have to filter/accept them ? Last thing :) : iptables is messing up my messagelog. I wrote a script where I can define a loglevel at first what should I add do syslogd.conf if I want to write all firewall-msgs to /var/log/firewall for example ? The ULOG option is more complicated so I think adding a rule to syslogd is easier. thx for any help ! Marco -- Marco Ahrendt phone : +49-341-98-474-0 adconsys AG fax : +49-341-98-474-59 Karl-Liebknecht-Str. 19 email : marco.ahrendt(a)adconsys.de 04107 Leipzig/Germany gnupg key at www.aktex.net/marco_work.asc

2 3

Re: Version of firewals.rpm for 2.4.x
by marc＠suse.de 02 Mar '01

02 Mar '01

Hi, > Do you have a version of firewals.rpm for the 2.4.x kernels? I'm > currently running suse 7.0, but until I upgrade to 7.1 I'd like to use > the latest kernel. Are there also user space tools that I need to get? 1) it is not recommended to use the 2.4 kernel for security purposes yet. 2) the 2.4 kernel supports old ipchains-based scripts like susefirewall if they are kernel-2.4 aware (get susefirewall v4.3 from www.suse.de/~marc) 3) susefirewall2 will be for the 2.4 kernel. first alpha end of this week Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

3 2

Re: [suse-security] Re: FW
by marc＠suse.de 02 Mar '01

02 Mar '01

>> > > (As I understand then IPtables make an improvement in the >> > > "memory" when compared with the stateless IPchains. Is this a >> > > good reason for skipping IPchains and start IPtables.....?) >> > > > you have the option to keep track of connection states. this is >> > an improvement, yes, however not a big one in my opinion >> > Really? Linux users might not be that aware (yet). I myself >> only learned about the benefits _because_ I did run a stateful >> packet filter (most things I stumble upon pass by unnoticed by >> Linux friends). >> Think of all those bloody bastards trying to penetrate your >> filter by using source ports like 20, 53, 80, and the like. thats why I say it's a small improvement. you prevent that people scan ports they should not. but where else is the added security? they can't connect to the services they cleverly found by their stealth scan ... (talking about simple "protection" by source port filtering - this is just stupid to rely on :-) Thats exactly the reason why the AUTOPROTECTING feature exists in SuSEfirewall (which is sadly something no other firewalling script has got ... I can only encourage people to cut'n paste ...) >> And no, the "established" keyword cannot really count as an >> answer. What's the point in passing packets based on a flag the >> outside(!) sets? You don't believe in sources you want to >> protect yourself against in the first place, do you? > Again, waht happens with packets without a SYN flag > where there is no connection for them? Yes they can be used for scanning, > but if you have a problem beeing scanned, then you have too many exposed > systems anyway. yep Andi - I'm of the same opinion ... >> means of Linux and ipchains. I never would like to go back to >> stateless filters (read: I *gladly* spend the memory and cpu >> cycles on the functionality). And yes, it's just one aspect and >> has to be seen in combination with *all* the other possible >> hurdles and obstacles one sets up for the bad guys. But why not >> use the possibilities given? >Well, all the stateful systems I have seen so far had interesting bugs >(check for PIX and FW-1 state engine bugs in the bugtraq archives). >This is an added complexity in the code, which increases the chance for >implementation bugs. hmm why am I replying to andi's mail? I can only 100% agree. I think there was only one bug in the ipfwadm code, and I can not remember a bug in the cisco ACL code, and there was none in the AIX filtering code. However, ip_filter had one or two bugs as well (agreed, not much) and commercial ones much much more - just because complexity is bad for security. this is proven since the 1970s, so keep security always as simple as possible. better chain several simple security mechanisms - thats the best solution. ipfwadm and ipchains were simple. iptables is not simple at all - hell when I wrote SuSEfirewall2, I had to test stuff how iptables/kernel actually work because the documentation is incomplete. Therefore I recommend not to use iptables until we can call 2.4 stable and tested. not before 2.4.10 or something. but that depends on the security level you want to have >Knowing Marc and his experience, I guess he can confirm that from real life >audits... Although I think the functionality of stateful filters can be very >useful, I am not rushing out to replace prooven systems with it. an additional problem with stateful filters is that people think they have no a magic bullet for security and then rely on stateful firewalls as a single line of defense. The best firewall setup is still and will still be in 5 years from now: <external-router-with-static-ACLs>--<Application-Gateway-Firewall>--<internal-router-with-static-ACLs> | DMZ-1 (more interfaces for more DMZ's) and putting your e-commerce systems into different security layers in the DMZs. lessons learned: time changes technology. it does not change concepts.

3 2

Secure Syslogd
by Gerd Bitzer 02 Mar '01

02 Mar '01

Hi List, does anybody know a secure dropin Replacement for the standard syslogd, which supports libwrap-style ACL's ? Thanx in advance

3 3

suse firewall - Mar 1 15:02:03 bigapple kernel: Packet log: output DENY ppp0 PROTO=1 195.186.133.129:3 195.132.143.170:3 L=88 S=0xC0 I=42977 F=0x0000 T=255 (#3)
by Olivier Mueller 01 Mar '01

01 Mar '01

Hello, Little thing probably, but I've not managed to solve it yet, reading ipchains docs. I have DSL and I am using pppoed. I installed a minimal susefirewall set of rules, and everything seems to work nicely. Just a little thing: when I try to connect to external hosts via ssh, I get about 3-4 such lines in my logs, and it takes really long to connect (5-10 seconds) : Mar 1 14:58:49 bigapple kernel: Packet log: output DENY ppp0 PROTO=1 195.186.133.129:3 195.186.1.111:3 L=214 S=0xC0 I=42750 F=0x0000 T=255 (#3) Mar 1 15:01:21 bigapple kernel: Packet log: output DENY ppp0 PROTO=1 195.186.133.129:3 195.139.143.170:3 L=88 S=0xC0 I=42872 F=0x0000 T=255 (#3) The funny thing is that when I connect to an old suse server (suse 6.x), it works directely. So that must be something with openssh/old-ssh. Any idea of what I could change to allow these icpm packets to come in ? Tried a few things, but not yet found the right line to comment. Regards & Thanks, Olivier -- _________________________________________________________________ Olivier Mueller - om(a)8304.ch - PGPkeyID: 0E84D2EA - Switzerland qmail projects: http://omail.omnis.ch - http://webmail.omnis.ch

2 5

proftpd-update
by Daniel Quappe 01 Mar '01

01 Mar '01

hey list, a few minutes ago i update my proftpd-package to rc3. now i always get the follwoing error-message with a "cnnection failed" response. syslog: "... unable to set uid to -2, current uid: 65534" i searched proftpd.org, but did not find anything about it. anybody out there got the same problems?! many thanks in advance, greets, daniel

2 4

inetd Segmentation fault
by Nix 01 Mar '01

01 Mar '01

:/etc # inetd -d Segmentation fault Has anyone seen this before?? this is a SuSE 7.0 box. Nothing special about it. I currently have xinetd installed also, but its switched off... I was going to use xinetd instead, but it doesn't seem to hand the originating IP address of connections through to the processes it spawns!!??!! :-( At least not with Obtuse smtpd.. I have deleted inted.conf and rpm-e inetd then rpm -i inted.rpm with the rpm file from ftp://ftp.suse.com/pub/suse/i386/current/suse/n1/ Can anyone off some suggestions?? --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

5 6

unknown log entry
by Andre Pietsch 01 Mar '01

01 Mar '01

I have a channel boundling isdn connect with a flatrate. Now i got several entry into the /var/log/messages like: kernel: ippp: MP, stepping over missing frame: 31551 What does it mean? pitschi real_pitschi(a)gmx.de

1 0