March 2001 - openSUSE Security - openSUSE Mailing Lists

Suggstion on security
by John Murphy 05 Mar '01

05 Mar '01

I have a cable Internet connection and run it through a Linksys router. This has NAT built in for protection. Of course through this I run DHCP to three other machines in a home network, 1 linux and 2 wins. Is this good enough or do I need to setup a personal firewall besides. I have Suse 7.1 and don't have the personal firewall on as this is the way the auto setup did it through Yast. If I do turn it on will this throw a monkey wrench into the something that is running fine now. I'm a newbie at firewalls and the option of just having it done automatically seemed appealing. But I figured Yast has to be much brighter then me and it had to be a reason. I'm thinking because of the DHCP? John......... -- Contentment is not the fulfillment of what you want, but the realization of how much you already have.

2 1

Re: [suse-security] Secure Syslogd
by christian.burri＠synecta.ch 05 Mar '01

05 Mar '01

Gerd Bitzer <gerd.bitzer@ To: RoMaN SoFt/ LLFB!! <roman(a)madrid.com> tesion.de> cc: suse-security(a)suse.com Subject: Re: [suse-security] Secure Syslogd 02.03.01 08:28 Good morning Roman, "RoMaN SoFt / LLFB!!" wrote: > On Thu, 01 Mar 2001 13:09:13 +0100, you wrote: > > >Hi List, > > > >does anybody know a secure dropin Replacement for the standard syslogd, > >which supports libwrap-style ACL's ? > > Ummm there are several ones (try at securityportal.com: there's at > least an article about that), I don't know if they support libwrapp. > I'd recommend using the standard syslogd with some acl's in your > router since other replacements aren't standard and you won't be able > to, for instance, receive logs from other boxes (routers, switches, > load-balancers, etc). >Hmm, I know the page on securityportal.com, the daemons there are quite >interesting as they implement such things as syslog over tcp or even over >ssl. But thats a little bit oversized for my needs. > > > Standard syslog goes over UDP and not encrypted. It's easy to defeat > if you don't set the aproppiate fw rules (router acl's, eg). I had a > look at some alternatives some time ago but none of them convince me. > Many of them were not mature enough and I decided to leave the > original syslogd. >There's an alternate rpcbind daemon from Vietse Venema which implements such >libwrap based ACL's for RPC, which makes sense in my opinion, but I haven't >found an adequate, simple dropin syslogd :-( what would be a "secure" replacement? why is syslog not secure? answer: because it relies on UDP. Now, you should simply use something that does not rely on UDP to transport log messages. But then, it isnt a drop-in replacement, is it? Thats kinda fsck'd .. What I would do is, block UDP traffic in general (with a few exceptions) at the border router or firewall, so I dont have people sending UDP traffic into my network. If I'd need to carry UDP traffic thru an untrusted network, then I'd rely on VPN technology. But, *at least* I'd block UDP traffic on syslog port at the border routers... And then, I'd ignorantly continue to use standard syslogd :-) Cheers chris >Maybe anybody in this list does have knowledge about such a beast ;-) > > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > ** RoMaN SoFt / LLFB ** > roman(a)madrid.com > http://pagina.de/romansoft > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

bind8 update Problem
by Hans Vokal 05 Mar '01

05 Mar '01

Hallo Nachdem wohl inzwischen alle ihren named upgedated haben komme ich hinterher wie die alte fasnacht... Mein Problem ist, das nach dem update von bind4 auf bind8 nur intern bekannte Rechnernamen aufgelöst werden. Externe Rechnernamen (z.B. www.suse.de) werden nicht aufgelöst. Der Rechner ist übrigens mit SuSE 6.0 bestückt. Die selbe Konfiguration läuft auf einem anderen REchner (auch SuSE 6.0) Problemlos. Der Rechner, der die Probleme macht, hat ein paar Firewall-regeln am laufen, da aber bei bind4 alles klappt, weiß ich nicht ob das relevant ist. Verhält sich der bind8 bei forward-Anfragen anders als bind4 ? Wahrscheinlich bin ich nur blind (aber um jeden Hinweis dankbar) Hans . __________________________________________________________________ Do You Yahoo!? Gesendet von Yahoo! Mail - http://mail.yahoo.de

1 0

Re: [suse-security] SMTP antiSpam proxy ???
by andreas.baetz＠herma.de 05 Mar '01

05 Mar '01

Andreas Siegert wrote: >Quoting Nix (suse(a)nix.hispeed.com) on Mon, Mar 05, 2001 at 02:54:24AM +0100: >> This is exactly what Obtuse SMTPD was designed to do. It is on the SuSE cd's >> Check out www.obtuse.com for more info. >I stopped using it. It does not handle Mailer Daemon Bounces with <> Addresses >propperly. If that means it doesn't accept bounces and denies them, you could use something like this in your smtpd-check-rules: # handle mail from: <> # outgoing messages allow:(your internal net):/^$/:ALL # incoming messages allow:ALL:/^$/:ALL@(your mail domain) This works for me. Andreas Baetz ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

1 0

SuSE Security Announcement: cups
by Sebastian Krahmer 05 Mar '01

05 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: cups Announcement-ID: SuSE-SA:2001:05 Date: Monday, March 5th, 2001 13:10:13 MET Affected SuSE versions: 7.1 Vulnerability Type: local/remote root compromise Severity (1-10): 5 SuSE default package: no Other affected systems: All UN*X-systems using cups < 1.1.6. Content of this advisory: 1) security vulnerability resolved: cups problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information CUPS is an implementation of the Internet Printing Protocol (IPP) and is used as an alternative to the lpr and LPRng packages. The CUPS package aims to be a comprehensive printing solution for UN*X-systems. In SuSE-7.1 distribution, the cups package is not used by any configuration utilities unless the admin has decided to configure the package manually. The cups package has been introduced in the SuSE-7.1 distribution; enhanced support for future releases of the SuSE Linux distribution is planned. A SuSE-internal security audit conducted by Sebastian Krahmer and Thomas Biege revealed several overflows as well as insecure file handling. These bugs have been fixed by adding length-checks and securing the file-access. For a temporary workaround, remove the suid-bit from the 'lppasswd' program. Make sure nobody from outside your network can access the CUPS-server running on port 631. Allowing access to this port from outside is a bad idea regardless whether or not the used version is vulnerable. No remote-exploits are known yet. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/d3/cups-devel-1.1.6-13.i386.rpm 23c6484952ab0c1de81e2db38bcd3afc SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/cups-1.1.6-13.i386.rpm 812e0c47dcfe508eb9e8ccb38165b6d7 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/cups-1.1.6-13.src.rpm 204cea2ad6a61293c191e70a2cacdc82 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: Effective Monday, March 19 2001, five weeks after the release of the new SuSE-7.1 distribution, SuSE will discontinue support for the SuSE-linux distributions SuSE-6.0 SuSE-6.1 and SuSE-6.2. SuSE puts much effort into adding security improvements (patches) to the software instead of publishing a new version; the same program with a fix for a specific problem promises to work just as reliable as the original version from the distribution, whereas new versions introduce new functionality which changes the behaviour. In some cases however, especially if the security leak is based on problematic design decisions or when the fix(es) are fairly large, the only reasonable fix for a security problem is to update to a newer version of the software. These newer versions tend to become incompatible with our older distribution releases because of missing features in the operating system environment. This forces us to focus on the distributions of a newer release date. The remaining distributions SuSE-6.3, SuSE-6.4, SuSE-7.0 and SuSE-7.1 for the Intel i386, AXP Alpha, SPARC as well as PPC Power PC platforms will continue to be supported for a two-year period after the release of the respective distribution. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Sebastian Krahmer ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOqODeXey5gA9JdPZAQHRYQf/aNhY+lHrkpmWlxGtQI29qetDlIuqVbvQ jUb4jm6vMvYJrFwzhtZ9XpWWYECDiqQjhy9KwmkkaVBrDTtbboNuQ+Wqq93zLzTD t1uXxGqb3p847p3OtoxZXR9ZUxxB+tn6MS2CGUZVDA+TaYgUD9DW1eb9+z0t5ehN 2cdYZqvAp22BasIdXGlFSvCJ4oBqXT9HmqBk8Q+FS7ZzT0VKvOmXShqv5bWOPRj+ XwuuiPdPGc9Ykwp8lcoymU2Y8b62MASEVYsFT4rynMxrDSfNUaEPXTAhc2RPM9vn +BgXrT0rfUiPkRWQTNpokp93TO3v8cOFgw0keeLcYRbP1nk36Ng03w== =BWbh -----END PGP SIGNATURE-----

1 0

SMTP antiSpam proxy ???
by christian.burri＠synecta.ch 05 Mar '01

05 Mar '01

Hello List! Im in desperate need for an SMTP proxy. Well, not just another proxy, it needs basically to do this: - Listen on external interface, port 25 - If mail arrives, check the DESTINATION address of the delivered email and verify that against a list of valid destination addresses - If the RCPT TO is valid* (in "allowed" list), then the proxy should relay the mail to an internal server - If RCPT TO is not a valid* one (e.x. spam_victimXY(a)hotmail.com), then it should drop the mail and close the spammer's connection. Is there such a program? I can imagine one could do that as a netfilter module...its a shame I cant code in C. :( The other approach I can think of would be AMAVIS maybe? That would be neat too, then it would have integrated virus protection. So, can AMAVIS do *exactly as I need (described above) ? Or is there some simpler solution (the more simple, the better because this is for a packet filter, that y I tought of a netfilter module) that would provide me with the needed features? help and ty :) Chris Burri jun. Systems & Network Engineer Synecta Informatik AG Zwinglistrasse 3 CH-9000 St. Gallen .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^ * valid and not valid: if a site has an email server and hosts domains on it, then one can say that an email, coming in on the external public IP of the site should have an email address that ends in one of the domains the site actually hosts, unless the mail was either sent in error, or it is a spam MAIL (some corporate level groupware servers are notoriously vulnerable to SPAM under certain conditions). Example for Site "dontlikespam.org" : If mail comes in on external interface, with an RCPT TO of "sales(a)dontlikespam.org", then it should be passed thru. If mail comes in on external interface, with an RCPT TO of "john.doe(a)dontlikespam.org", then it should be passed. If mail comes in on external interface, with an RCPT TO of "somebody(a)hotmail.com", then it should be blocked, and the connection that feeds the mail shall be dropped. in the "allow" list, there would be one entry like "dontlikespam.org" The RCPT TO must be checked strictly. Means, relay(a)hotmail.com% @dontlikespam.org must not circumvent it. Maybe there should be a keyword in the config file to disable (default is on) strict checking. Outgoing mail comes from internal interface and will not be tested. Externals connecting from remote sites either use dial-up and thus come from internal interface, or they use a VPN and thus wont appear on the external interface either.

5 5

Get rid of kdeinit port?
by uwe_kersten＠t-online.de 03 Mar '01

03 Mar '01

Hi all, after shutting down the x-server port I am looking for a way to skip networking for kde2. After starting kde2 I have a high port open that belongs to kdeinit. How can I tell kde not to open this port? Thanx in advance Uwe -- ------------------------------------------------------- Uwe Kersten E-Mail: uwe.kersten(a)online.de Live long and prosper! -------------------------------------------------------

3 2

ssl slow
by Andreas Fiesser 03 Mar '01

03 Mar '01

Hi! Yesterday I ran - for the first time ever - HardenSuSE on my router-box. I read the description on Marc's page as far as "run HardenSuSE yes" and went for it. I'm a practical type of guy, you see. :} When all those funny lines scrolled by, I wondered if this was really wise ... Well, I got all things up again and the box seems still doing what it is supposed to. A lot safer no, I figure. The only thing that gives me a pain is that the output of my ssl client (putty on Win2K), which I use most of the time to manage the Linux box via LAN, got rather slow. Before HardenSuSE screen output was about twice as fast. This is anoying when I youse mc, yast and such stuff. It's not really a life threatening issue but perhaps someone here could tell me what I could do about it to get it as fast as before ? ... Andreas

1 0

routing problems at dmz host
by Marco Ahrendt 03 Mar '01

03 Mar '01

hi all, I use the following network topology: Internet | (official IP) Router1 (192.168.1.1) | | eth0 (192.168.1.2) eth0 (official IP) Router2/Firewall eth2(192.168.1.3) --- DMZ eth1 (official IP) eth0:1 (192.168.1.4) | | Local Network (official IPs) The official Network consists of a Subnet with 16 IP adresses. The router/fw is an p133 which uses kernel 2.4.2 and iptables. The DMZ (yes, its not a really DMZ :) is one host, running a www server, a mail server and some other daemons. Default gateway for DMZ is 192.168.1.3 (eth2 on FW) how you can see. The problem is, linux uses the first IP (?), which it can use for the fastest hop and therefor, if I ping the internet, the router1 can't forward the internal IP to the net. If I use ping -I OFFICIAL_IP internet, everything works fine! I installed the package "iproute" but I can't set up the routing with this. There is no manpage and the howto is little bit short. :) Is it possible to give the system an other IP (official) than the internal IP which linux uses as default ? Same problem occurs on the FW host. Second problem: How can I accept dhcp in iptables ? Can I use connection tracking ? Someone telled me, dhcp isn't using protocols like tcp or udp so how do I have to filter/accept them ? Last thing :) : iptables is messing up my messagelog. I wrote a script where I can define a loglevel at first what should I add do syslogd.conf if I want to write all firewall-msgs to /var/log/firewall for example ? The ULOG option is more complicated so I think adding a rule to syslogd is easier. thx for any help ! Marco -- Marco Ahrendt phone : +49-341-98-474-0 adconsys AG fax : +49-341-98-474-59 Karl-Liebknecht-Str. 19 email : marco.ahrendt(a)adconsys.de 04107 Leipzig/Germany gnupg key at www.aktex.net/marco_work.asc

2 3

Re: Version of firewals.rpm for 2.4.x
by marc＠suse.de 02 Mar '01

02 Mar '01

Hi, > Do you have a version of firewals.rpm for the 2.4.x kernels? I'm > currently running suse 7.0, but until I upgrade to 7.1 I'd like to use > the latest kernel. Are there also user space tools that I need to get? 1) it is not recommended to use the 2.4 kernel for security purposes yet. 2) the 2.4 kernel supports old ipchains-based scripts like susefirewall if they are kernel-2.4 aware (get susefirewall v4.3 from www.suse.de/~marc) 3) susefirewall2 will be for the 2.4 kernel. first alpha end of this week Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

3 2

Re: [suse-security] Re: FW
by marc＠suse.de 02 Mar '01

02 Mar '01

>> > > (As I understand then IPtables make an improvement in the >> > > "memory" when compared with the stateless IPchains. Is this a >> > > good reason for skipping IPchains and start IPtables.....?) >> > > > you have the option to keep track of connection states. this is >> > an improvement, yes, however not a big one in my opinion >> > Really? Linux users might not be that aware (yet). I myself >> only learned about the benefits _because_ I did run a stateful >> packet filter (most things I stumble upon pass by unnoticed by >> Linux friends). >> Think of all those bloody bastards trying to penetrate your >> filter by using source ports like 20, 53, 80, and the like. thats why I say it's a small improvement. you prevent that people scan ports they should not. but where else is the added security? they can't connect to the services they cleverly found by their stealth scan ... (talking about simple "protection" by source port filtering - this is just stupid to rely on :-) Thats exactly the reason why the AUTOPROTECTING feature exists in SuSEfirewall (which is sadly something no other firewalling script has got ... I can only encourage people to cut'n paste ...) >> And no, the "established" keyword cannot really count as an >> answer. What's the point in passing packets based on a flag the >> outside(!) sets? You don't believe in sources you want to >> protect yourself against in the first place, do you? > Again, waht happens with packets without a SYN flag > where there is no connection for them? Yes they can be used for scanning, > but if you have a problem beeing scanned, then you have too many exposed > systems anyway. yep Andi - I'm of the same opinion ... >> means of Linux and ipchains. I never would like to go back to >> stateless filters (read: I *gladly* spend the memory and cpu >> cycles on the functionality). And yes, it's just one aspect and >> has to be seen in combination with *all* the other possible >> hurdles and obstacles one sets up for the bad guys. But why not >> use the possibilities given? >Well, all the stateful systems I have seen so far had interesting bugs >(check for PIX and FW-1 state engine bugs in the bugtraq archives). >This is an added complexity in the code, which increases the chance for >implementation bugs. hmm why am I replying to andi's mail? I can only 100% agree. I think there was only one bug in the ipfwadm code, and I can not remember a bug in the cisco ACL code, and there was none in the AIX filtering code. However, ip_filter had one or two bugs as well (agreed, not much) and commercial ones much much more - just because complexity is bad for security. this is proven since the 1970s, so keep security always as simple as possible. better chain several simple security mechanisms - thats the best solution. ipfwadm and ipchains were simple. iptables is not simple at all - hell when I wrote SuSEfirewall2, I had to test stuff how iptables/kernel actually work because the documentation is incomplete. Therefore I recommend not to use iptables until we can call 2.4 stable and tested. not before 2.4.10 or something. but that depends on the security level you want to have >Knowing Marc and his experience, I guess he can confirm that from real life >audits... Although I think the functionality of stateful filters can be very >useful, I am not rushing out to replace prooven systems with it. an additional problem with stateful filters is that people think they have no a magic bullet for security and then rely on stateful firewalls as a single line of defense. The best firewall setup is still and will still be in 5 years from now: <external-router-with-static-ACLs>--<Application-Gateway-Firewall>--<internal-router-with-static-ACLs> | DMZ-1 (more interfaces for more DMZ's) and putting your e-commerce systems into different security layers in the DMZs. lessons learned: time changes technology. it does not change concepts.

3 2

Secure Syslogd
by Gerd Bitzer 02 Mar '01

02 Mar '01

Hi List, does anybody know a secure dropin Replacement for the standard syslogd, which supports libwrap-style ACL's ? Thanx in advance

3 3

suse firewall - Mar 1 15:02:03 bigapple kernel: Packet log: output DENY ppp0 PROTO=1 195.186.133.129:3 195.132.143.170:3 L=88 S=0xC0 I=42977 F=0x0000 T=255 (#3)
by Olivier Mueller 01 Mar '01

01 Mar '01

Hello, Little thing probably, but I've not managed to solve it yet, reading ipchains docs. I have DSL and I am using pppoed. I installed a minimal susefirewall set of rules, and everything seems to work nicely. Just a little thing: when I try to connect to external hosts via ssh, I get about 3-4 such lines in my logs, and it takes really long to connect (5-10 seconds) : Mar 1 14:58:49 bigapple kernel: Packet log: output DENY ppp0 PROTO=1 195.186.133.129:3 195.186.1.111:3 L=214 S=0xC0 I=42750 F=0x0000 T=255 (#3) Mar 1 15:01:21 bigapple kernel: Packet log: output DENY ppp0 PROTO=1 195.186.133.129:3 195.139.143.170:3 L=88 S=0xC0 I=42872 F=0x0000 T=255 (#3) The funny thing is that when I connect to an old suse server (suse 6.x), it works directely. So that must be something with openssh/old-ssh. Any idea of what I could change to allow these icpm packets to come in ? Tried a few things, but not yet found the right line to comment. Regards & Thanks, Olivier -- _________________________________________________________________ Olivier Mueller - om(a)8304.ch - PGPkeyID: 0E84D2EA - Switzerland qmail projects: http://omail.omnis.ch - http://webmail.omnis.ch

2 5

proftpd-update
by Daniel Quappe 01 Mar '01

01 Mar '01

hey list, a few minutes ago i update my proftpd-package to rc3. now i always get the follwoing error-message with a "cnnection failed" response. syslog: "... unable to set uid to -2, current uid: 65534" i searched proftpd.org, but did not find anything about it. anybody out there got the same problems?! many thanks in advance, greets, daniel

2 4

inetd Segmentation fault
by Nix 01 Mar '01

01 Mar '01

:/etc # inetd -d Segmentation fault Has anyone seen this before?? this is a SuSE 7.0 box. Nothing special about it. I currently have xinetd installed also, but its switched off... I was going to use xinetd instead, but it doesn't seem to hand the originating IP address of connections through to the processes it spawns!!??!! :-( At least not with Obtuse smtpd.. I have deleted inted.conf and rpm-e inetd then rpm -i inted.rpm with the rpm file from ftp://ftp.suse.com/pub/suse/i386/current/suse/n1/ Can anyone off some suggestions?? --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

5 6

unknown log entry
by Andre Pietsch 01 Mar '01

01 Mar '01

I have a channel boundling isdn connect with a flatrate. Now i got several entry into the /var/log/messages like: kernel: ippp: MP, stepping over missing frame: 31551 What does it mean? pitschi real_pitschi(a)gmx.de

1 0