March 2001 - openSUSE Security - openSUSE Mailing Lists

xinetd
by Ahmed Mohammad 08 Mar '01

08 Mar '01

Hello, Is there any advantage to using xinetd over inetd? Anyone have any experience with this in 7.0? thankx

10 13

RE: [suse-security] udp 1024 - unknown
by Björn Engels 08 Mar '01

08 Mar '01

>What can be behind netstat -a * udp send-Q 288:1024 >nmap -sU x.com says udp 1024 unknown >- can it be related that tcpdump -i eth0 takes ages to write packet >traffic? 'lsof -Pi | grep 1024' should show you which process is listening on that port. Björn Engels LANWORKS AG

2 1

RE: [suse-security] all network ports in use
by Björn Engels 08 Mar '01

08 Mar '01

>Nevertheless, this doesn't seem to be the problem here. It more or less >looks like this machine has been under attack so that all available >sockets have been used up. In particular, it seems to have been a SYN >flood attack. There is no efficient countermeasure against this other >than >pulling the plug. That's what I think, too, but there are counter measures with kernel 2.4, I think. If I understand /proc/sys/net/ipv4/tcp_synack_retries correctly, you should reduce the value. Or restrict the incoming syn-rate at the firewall or get a firewall that knows "random early drop". (Thanks, Guido Stepken ;-) ) Björn Engels LANWORKS AG

1 0

udp 1024 - unknown
by webmaster 08 Mar '01

08 Mar '01

What can be behind netstat -a * udp send-Q 288:1024 nmap -sU x.com says udp 1024 unknown - can it be related that tcpdump -i eth0 takes ages to write packet traffic? -------------------------- webmaster Kreorg Oktatóközpont Tel/Fax: 321-0031 email: webmaster(a)kreorg.hu

1 0

Re: [suse-security] all network ports in use
by christian.burri＠synecta.ch 08 Mar '01

08 Mar '01

Roman Drahtmueller To: Murat Koc <muratkoc(a)linux.org.tr> <draht(a)suse.d cc: Christian Boxhammer <box(a)theor.geod.uni-bonn.de>, <suse-security(a)suse.com> e> Subject: Re: [suse-security] all network ports in use 08.03.2001 11:46 >> > There is sometimes a problem, logging into our two SuSE 7.0 (SMP) machines. >> > Trying to log in with telnet procudes the following error Message: >> > "telnetd: all network ports in use" >> > In such a case it is not possible to log into the machine for several hours. >> > Is this because of a portscan an anything else? >> > Did anyone have a similar Problem? >> >> Be sure that you compiled the kernel with "Unix98 PTY support" and >> "/dev/pts file system for Unix98 PTYs" options enabled. >> >> or add a line in your /etc/fstab >> >> none /dev/pts devpts mode=0620 0 0 > >The devpts filesystem gets mounted by /sbin/init.d/boot at boot time on >SuSE distributions and are not listed in the fstab. It shouldn't matter if >it shows up there, though. > >Nevertheless, this doesn't seem to be the problem here. It more or less >looks like this machine has been under attack so that all available >sockets have been used up. In particular, it seems to have been a SYN >flood attack. There is no efficient countermeasure against this other than >pulling the plug. <snip> What about SYN cookies? Or would it help to adjust values in /proc/sys/net/ipv4/tcp_syn_retries resp /proc/sys/net/ipv4/ tcp_max_syn_backlog? Or the upstream ISP starts limiting max SYN packets rate? cheers Chr. Burri

2 1

iptables as a firewall
by Grimm, David 08 Mar '01

08 Mar '01

Hello folks, I was wondering if I could get a little advise on firewalls. I'm setting up a webserver, email server, and firewall site (three computers running SUSE). The firewall is going to be hooked up directly to a high speed DSL line...for starters. It's going to have a static IP. The other machines are going to have only the necessary software (Apache on one and SuSE email server II on the other). The firewall is going to sport the 2.4 kernel with the netfilter/iptables patch. The question is: Is it possible to forward traffic to the other two machines (if they have static IP's of there own) using just iptables? Or, do I have to use another tool/ utility? Thanks for any help, DAVID *********************************************************************** This electronic message may contain information that is confidential and/or legally privileged. It is intended only for the use of the individual(s) and entity named as recipients in the message. If you are not an intended recipient of this message, please notify the sender immediately and delete the material from any computer. Do not deliver, distribute or copy this message, and do not disclose its contents or take any action in reliance on the information it contains. Thank you.

2 1

Sorry!!!
by jobhopper Pascal Ehlig 08 Mar '01

08 Mar '01

SORRY! Sorry that i have flooded this list with my isread responsemail. I have forgotten to remove it (now i have killd it)... again sorry... i have get 500 mails for this... shit...... 30Mins to download all isread responses... i think you know i DONT want to do that... Pascal Ehlig

1 0

Re: [suse-security] ipchains-rule to deny a special domain -didn't work :(
by christian.burri＠synecta.ch 07 Mar '01

07 Mar '01

In case u wanted to restrict access from a certain domain name.... ipchains doesnt accept domain names for -s or -d afaik. At least, I couldnt get a rule like ipchains -A input -s *.nz -d 123.123.123.123 -j DENY to work :( .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^

3 2

Companies Still Running Flawed BIND Software
by Fred A. Miller 07 Mar '01

07 Mar '01

Companies Still Running Flawed BIND Software An Icelandic software and consulting firm tested DNS systems at Fortune 1000 companies and .coms at periodic intervals after the announcement of the flaw in BIND software. After a striking initial drop in the number of sites running insecure versions of BIND, the surge has faded to a trickle. SANS GIAC and CERT/CC have begun receiving reports of successful BIND vulnerability exploits. http://www.computerworld.com/cwi/stories/0,1199,NAV47_STO58302,00.html -- Fred A. Miller Systems Admin. Cornell Univ. Press Services fm(a)cupserv.org

2 1

AW: [suse-security] remote login for root?!
by Schoenwaelder Oliver 07 Mar '01

07 Mar '01

Hi, sorry, you have to edit the sshd config file (/etc/ssh/sshd_config). Change PERMIT_ROOT_LOGIN to NO. Restart sshd and root login is permited. Hth, Oliver -----Ursprüngliche Nachricht----- Von: Andreas Otto [mailto:andreas@noho.co.uk] Gesendet: Mittwoch, 7. März 2001 17:52 An: SuSE-Security Betreff: [suse-security] remote login for root?! Hi , I have always believed that ROOT_LOGIN_REMOTE="no" in /etc/rc.config prevents root from logging in remotely. But a simple: C:\>ssh -l root 192.168.101.99 Password: Last login: Wed Mar 7 15:41:22 2001 from 192.168.101.237 Have a lot of fun... mojox:~ # Tells me that something weird is going on here. Are there any other places I need to check for apart from the two mentioned below? /etc/rc.config: # If you want to allow root logins from other machines, set ROOT_LOGIN_REMOTE # to "yes". # ROOT_LOGIN_REMOTE="no" /etc/ssh/sshd_config: Port 22 #Protocol 2,1 ListenAddress 0.0.0.0 #ListenAddress :: HostKey /etc/ssh/ssh_host_key ServerKeyBits 768 LoginGraceTime 600 KeyRegenerationInterval 3600 PermitRootLogin no # Cheers, Andreas -- Andreas Otto OgilvyInteractive | Floor 2, Canberra House 315 - 317 Regent Street | London W1B 2HS Reception +44 207 299 3434 | Fax +44 207 631 5050 http://www.ogilvy.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-linux-unsubscribe(a)suse.com For additional commands, e-mail: suse-linux-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

AW: [suse-security] remote login for root?!
by Schoenwaelder Oliver 07 Mar '01

07 Mar '01

Hi, I'm sorry. In fact you are right. Maybe I should have had a look down your mail and notice your sshd config file. Are you using RSA authentication? In that case root login will be ok if RSA succeeds, regardless the value of PermitRootLogin. H THAT h, Oliver -----Ursprüngliche Nachricht----- Von: Andreas Otto [mailto:andreas@noho.co.uk] Gesendet: Mittwoch, 7. März 2001 17:52 An: SuSE-Security Betreff: [suse-security] remote login for root?! Hi , I have always believed that ROOT_LOGIN_REMOTE="no" in /etc/rc.config prevents root from logging in remotely. But a simple: C:\>ssh -l root 192.168.101.99 Password: Last login: Wed Mar 7 15:41:22 2001 from 192.168.101.237 Have a lot of fun... mojox:~ # Tells me that something weird is going on here. Are there any other places I need to check for apart from the two mentioned below? /etc/rc.config: # If you want to allow root logins from other machines, set ROOT_LOGIN_REMOTE # to "yes". # ROOT_LOGIN_REMOTE="no" /etc/ssh/sshd_config: Port 22 #Protocol 2,1 ListenAddress 0.0.0.0 #ListenAddress :: HostKey /etc/ssh/ssh_host_key ServerKeyBits 768 LoginGraceTime 600 KeyRegenerationInterval 3600 PermitRootLogin no # Cheers, Andreas -- Andreas Otto OgilvyInteractive | Floor 2, Canberra House 315 - 317 Regent Street | London W1B 2HS Reception +44 207 299 3434 | Fax +44 207 631 5050 http://www.ogilvy.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-linux-unsubscribe(a)suse.com For additional commands, e-mail: suse-linux-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

remote login for root?!
by Andreas Otto 07 Mar '01

07 Mar '01

Hi , I have always believed that ROOT_LOGIN_REMOTE="no" in /etc/rc.config prevents root from logging in remotely. But a simple: C:\>ssh -l root 192.168.101.99 Password: Last login: Wed Mar 7 15:41:22 2001 from 192.168.101.237 Have a lot of fun... mojox:~ # Tells me that something weird is going on here. Are there any other places I need to check for apart from the two mentioned below? /etc/rc.config: # If you want to allow root logins from other machines, set ROOT_LOGIN_REMOTE # to "yes". # ROOT_LOGIN_REMOTE="no" /etc/ssh/sshd_config: Port 22 #Protocol 2,1 ListenAddress 0.0.0.0 #ListenAddress :: HostKey /etc/ssh/ssh_host_key ServerKeyBits 768 LoginGraceTime 600 KeyRegenerationInterval 3600 PermitRootLogin no # Cheers, Andreas -- Andreas Otto OgilvyInteractive | Floor 2, Canberra House 315 - 317 Regent Street | London W1B 2HS Reception +44 207 299 3434 | Fax +44 207 631 5050 http://www.ogilvy.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-linux-unsubscribe(a)suse.com For additional commands, e-mail: suse-linux-help(a)suse.com

1 0

Re: [suse-security] ipchains-rule to deny a special domain
by Martin Peikert 07 Mar '01

07 Mar '01

Martin Peikert <martin.peikert(a)innominate.com> wrote: > > Try > "ipchains -I input 1 -d xxx.y..." > instead of > "ipchains -A input -d xxx.y..." > Oops - meant output, not input. MArtin -- martin.peikert(a)innominate.com innominate AG the linux architects tel: +49-30-308806-0 fax: -77 http://www.innominate.com

7 7

Re[4]: [suse-security] ipchains-rule to deny a special domain -now works! :-)
by da_bug 07 Mar '01

07 Mar '01

hi! Now it works! ;-) THANX!! I did it this way: I flushed the old rules and reloaded everthing (checked that the deny-rule is over the allow-rules). This rule did it: ipchains -I input 1 -p tcp -s 0/0 -d domain-ip -j DENY ..and as soon as I have time I'll read the Howto's,manpages and RFC's.. ;-) (In the end one of the last biggest problems in technology is that your lifetime is limited...) bye & thanx again...

1 0

Redirect ftp traffic to an IIS4 ftp server
by Ka Kit Yick 07 Mar '01

07 Mar '01

Hi all, I'm using SuSE 6.4 with firewals-2.0-12. I need to redirect outside ftp traffic to an internal iis4 ftp server. Let said that the external address of the firewall is 12.34.56.80 and the address of the internal ftp server is 172.20.0.80. I use Rinetd to redirect the traffic with the following line : 12.34.56.80 20 172.20.0.80 20 12.34.56.80 21 172.20.0.80 21 I try to connect to the server using CuteFTP. In PASV mode, it says "Connection data socket..." but it never get through. And in active mode, it says "500 Invalide PORT Command". I know that in rinetd manual, it says that rinetd cannot redirect ftp traffic because it uses more than one socket. Is there any solution, without changing to whole thing? Thanks Ka Kit Yick

2 1

[Fwd: Re: [suse-security] ipchains-rule to deny a special domain]
by Hipolito A. Gonzalez M. 07 Mar '01

07 Mar '01

da_bug wrote: > hi! > > I want to deny the client-computers behind my router to access some > special domains/ip-addresses in the internet. > I tried something like "ipchains -A input -d xxx.yyy.zzz.xxx -p tcp -j > DENY" and "ipchains -A input -s xxx.yyy.zzz.xxx -p tcp -j > DENY" but it didn't work... > What can I do to deny access? > > bye. you have an error -s is: the source of the petition. is you networks is 192.168.0.0 with netmask 255.255.255.0 you need to put it in the -s (if you want to block all your networks, or the specific IP) and the -d is for the destination, por example, if you want to stop the conections to hotmail, make a lot of ping to www.hotmail.com and copy all IP of hotmail, for example, if hotmail is: 100.100.100.1 .2 .3 .4 .5 and .6 yuou need to put: ipchains -A input -s 192.168.0.0/0 -d 100.100.100.1 -p TCP -j DENY ipchains -A input -s 192.168.0.0/0 -d 100.100.100.1 -p UDP -j DENY and repeat it all times for each IP of the destination (until .6 in this example) If you need more help, write. PD: Excuse for my bad english -- www.geekcode.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ h! r++ y++ ------END GEEK CODE BLOCK------ - A veces creo que hay vida en otros planetas, y a veces creo que no. En cualquiera de los dos casos, la conclusión es asombrosa (Carl Sagan) -----------------------------------------------------------------D: Excuse for my bad english -- www.geekcode.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ h! r++ y++ ------END GEEK CODE BLOCK------ - A veces creo que hay vida en otros planetas, y a veces creo que no. En cualquiera de los dos casos, la conclusión es asombrosa (Carl Sagan) -----------------------------------------------------------------

1 0

[suse-security] ipchains-rule to deny a special domain
by da_bug 07 Mar '01

07 Mar '01

hi! I want to deny the client-computers behind my router to access some special domains/ip-addresses in the internet. I tried something like "ipchains -A input -d xxx.yyy.zzz.xxx -p tcp -j DENY" and "ipchains -A input -s xxx.yyy.zzz.xxx -p tcp -j DENY" but it didn't work... What can I do to deny access? bye.

4 5

Re: [suse-security] SMTP antiSpam proxy ???
by christian.burri＠synecta.ch 07 Mar '01

07 Mar '01

Okies =) Thank all you nice ppl for the info :) I will definately have a closer look at obtuse smtpd (neat since it seems to do xactly what I need and cuz it comes with SuSE on CD :) and AMAVIS (maybe I can get them to work together??). Thanks again and cheers Chr. Burri .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^

1 0

Ack, sendmail and firewall script
by Matthew Johnson 07 Mar '01

07 Mar '01

Thought it would take an hour to do, I was wrong! Anyone here having problems with 7.1 Firewall script? Mine comes up as a failure on all 3 runs, but I only get a warning on startup about DNS service not running, but it works. Anyone else get this? Matt

3 3

SuSEfirewall2 - new ALPHA version
by marc＠suse.de 06 Mar '01

06 Mar '01

Hi folks, by luck I was able to make the fixes for SuSEfirewall2 at once instead of having them lying around for some days as I thought it would take half an hour ago ... so here is v0.4: v0.4 06.03.01 ALPHA * Changed the START_FW variable to START_FW2 so you can have installed both SuSEfirewall(1) and SuSEfirewall2 in parallel without problems * Fixed a bug in INSTALL where the K99 stop script was incorrectly symlinked. * Fixed a bug in the masquerading. should work now. (thanks to jboonen(a)worldonline.nl) * Fixed dumb warnings and typos * Fixed a bug in FW_FORWARD for tcp and udp (for both bug reports thanks to christian.esser(a)gmx.de> you can find it at http://www.suse.de/~marc/SuSE.html Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

1 0

SuSEfirewall2 - first ALPHA
by marc＠suse.de 06 Mar '01

06 Mar '01

For the desperate: SuSEfirewall2 v0.3 is available for testing from www.suse.de/~marc It installs without problem with a SuSEfirewall(1) installation, the only variable shared is the START_FW variable (well, with the result that both firewall will try to start when booting ;-) please note: due my current network probs at home I could not make real tests. so everyone who can check features, and if possible send me a fix for something which is not working - that would be great!! Q: What changed from SuSEfirewall(1) to SuSEfirewall2 A: Many things. Most important: it uses iptables (which is especially for 2.4 kernels) instead of ipchains. Visible changes: New commandline option "debug" which prints out the iptables commands, great to print the rules, and them modify them for you liking! Added the new options: FW_ALLOW_CLASS_ROUTING - allow routing between interfaces of the same class, e.g. two internal networks FW_ALLOW_FW_BROADCAST - allow broadcast packets to reach the firewall FW_ALLOW_PING_EXT - allow the internal/dmz to ping the internet FW_SERVICE_AUTODETECT - autodetect START_{NAMED,SMB,DHCPD} and DHCLIENT Renamed some variables, removed some, changed syntax (small changes) All forward,masquerading,trust definitions can now be very global or very fine-grained as you need it The logging looks different - hell this is iptables :-( It takes a bit longer to create the complex ruleset :-( Invisible changes: A packet has to traverse much less rules, so packet processing is faster Stateful packet checking is present now (thanks to the 2.4 kernel) More intelligent ICMP filtering and identd rejection Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

3 9

Re: AW: [suse-security] bind8 update Problem
by Hans Vokal 06 Mar '01

06 Mar '01

--- Alexander Bien <abien(a)gmx.net> schrieb: > > Wenn du an antworten interessiert ist .. solltest du beachten das die suse > list auf englisch läuft .. Oops! so sorry. But thankss for the help anyway bind8 runs now smoothly. cu Hans __________________________________________________________________ Do You Yahoo!? Gesendet von Yahoo! Mail - http://mail.yahoo.de

1 0

IMAP Server II and security updates
by Martin Sckopke 06 Mar '01

06 Mar '01

Hi all, I've got a question regarding the SuSE-IMAP-Server II. Do all security related updates apply to this version of SUSE, too? Did anyone upgrade SuSE-EMail Server to SuSE 7.1? Did anyone upgrade to Kernel > 2.4 (i.e. 2.4.2.SuSE-5 ?) Thanks a lot for your help, Martin -- GiS - Gesellschaft fuer integrierte Systemplanung mbH Martin Sckopke Tel. +49-6201-503-74 Junkersstr. 2 Fax +49-6201-503-66 D-69469 Weinheim m.sckopke(a)gis-systemhaus.de

5 7

RE: [suse-security] IMAP Server II and security updates
by rfertig＠telebel.net 06 Mar '01

06 Mar '01

Hi Björn. > I upgraded my ("ordinary", not IMAP-Server) SuSE 7.1 to 2.4.2.SuSE-5. > But after installing the new Kernel (compiled with the same settings > as the pre-built 2.4.0), some modules didn't load anymore - just a > silly message is being shown : > "Kernel version mismatch - module was built for kernel 2.4.2-4GB while > this is kernel 2.4.2." > > At home I had a similar problem, but the other way around: > "... module was built for kernel 2.4.2 while this is kernel 2.4.2-4GB" I've got the same message when I try to insmod a patched networkdriver (modul is 2.4.0, kernel 2.4.0-4GB). The only way I found to get things work (except insmod -f) was to modify the Makefile and comment out all ifdef-lines (and related) in the section "Test for Highmen support" and only leave the line HIGHMEMVERSION="-4GB" It seems to me, that there is an error in the Makefile or in .config but since I'm not verry familar with these things I didn't found it. However, this all isn't security-related, but someome at SuSE should take a look at this (I already send a mail to the support). Bye, Rene

1 0

ssh, warnings
by Joerg Henner 06 Mar '01

06 Mar '01

Hi, i'm having these messages occur with fw:~ # rpm -qa|grep -i ssh openssh-2.3.0p1-0 ---[cute here]--- Mar 5 15:16:26 fw sshd[1343]: WARNING: /etc/ssh/primes does not exist, using old prime ---[cute here]--- System is an SuSE 6.4 Any Hints ? Greetings, -- Jörg Henner Fon: +49 (7 11) 2 85 19 05 LiHAS - Servicebuero Stuttgart Fax: +49 (7 11) 5 78 06 92 Adrian Reyer & Jörg Henner GbR Mail: lihas(a)lihas.de Linux, Netzwerke, Consulting & Support http://lihas.de/

1 0

Suggstion on security
by John Murphy 05 Mar '01

05 Mar '01

I have a cable Internet connection and run it through a Linksys router. This has NAT built in for protection. Of course through this I run DHCP to three other machines in a home network, 1 linux and 2 wins. Is this good enough or do I need to setup a personal firewall besides. I have Suse 7.1 and don't have the personal firewall on as this is the way the auto setup did it through Yast. If I do turn it on will this throw a monkey wrench into the something that is running fine now. I'm a newbie at firewalls and the option of just having it done automatically seemed appealing. But I figured Yast has to be much brighter then me and it had to be a reason. I'm thinking because of the DHCP? John......... -- Contentment is not the fulfillment of what you want, but the realization of how much you already have.

2 1

Re: [suse-security] Secure Syslogd
by christian.burri＠synecta.ch 05 Mar '01

05 Mar '01

Gerd Bitzer <gerd.bitzer@ To: RoMaN SoFt/ LLFB!! <roman(a)madrid.com> tesion.de> cc: suse-security(a)suse.com Subject: Re: [suse-security] Secure Syslogd 02.03.01 08:28 Good morning Roman, "RoMaN SoFt / LLFB!!" wrote: > On Thu, 01 Mar 2001 13:09:13 +0100, you wrote: > > >Hi List, > > > >does anybody know a secure dropin Replacement for the standard syslogd, > >which supports libwrap-style ACL's ? > > Ummm there are several ones (try at securityportal.com: there's at > least an article about that), I don't know if they support libwrapp. > I'd recommend using the standard syslogd with some acl's in your > router since other replacements aren't standard and you won't be able > to, for instance, receive logs from other boxes (routers, switches, > load-balancers, etc). >Hmm, I know the page on securityportal.com, the daemons there are quite >interesting as they implement such things as syslog over tcp or even over >ssl. But thats a little bit oversized for my needs. > > > Standard syslog goes over UDP and not encrypted. It's easy to defeat > if you don't set the aproppiate fw rules (router acl's, eg). I had a > look at some alternatives some time ago but none of them convince me. > Many of them were not mature enough and I decided to leave the > original syslogd. >There's an alternate rpcbind daemon from Vietse Venema which implements such >libwrap based ACL's for RPC, which makes sense in my opinion, but I haven't >found an adequate, simple dropin syslogd :-( what would be a "secure" replacement? why is syslog not secure? answer: because it relies on UDP. Now, you should simply use something that does not rely on UDP to transport log messages. But then, it isnt a drop-in replacement, is it? Thats kinda fsck'd .. What I would do is, block UDP traffic in general (with a few exceptions) at the border router or firewall, so I dont have people sending UDP traffic into my network. If I'd need to carry UDP traffic thru an untrusted network, then I'd rely on VPN technology. But, *at least* I'd block UDP traffic on syslog port at the border routers... And then, I'd ignorantly continue to use standard syslogd :-) Cheers chris >Maybe anybody in this list does have knowledge about such a beast ;-) > > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > ** RoMaN SoFt / LLFB ** > roman(a)madrid.com > http://pagina.de/romansoft > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

bind8 update Problem
by Hans Vokal 05 Mar '01

05 Mar '01

Hallo Nachdem wohl inzwischen alle ihren named upgedated haben komme ich hinterher wie die alte fasnacht... Mein Problem ist, das nach dem update von bind4 auf bind8 nur intern bekannte Rechnernamen aufgelöst werden. Externe Rechnernamen (z.B. www.suse.de) werden nicht aufgelöst. Der Rechner ist übrigens mit SuSE 6.0 bestückt. Die selbe Konfiguration läuft auf einem anderen REchner (auch SuSE 6.0) Problemlos. Der Rechner, der die Probleme macht, hat ein paar Firewall-regeln am laufen, da aber bei bind4 alles klappt, weiß ich nicht ob das relevant ist. Verhält sich der bind8 bei forward-Anfragen anders als bind4 ? Wahrscheinlich bin ich nur blind (aber um jeden Hinweis dankbar) Hans . __________________________________________________________________ Do You Yahoo!? Gesendet von Yahoo! Mail - http://mail.yahoo.de

1 0

Re: [suse-security] SMTP antiSpam proxy ???
by andreas.baetz＠herma.de 05 Mar '01

05 Mar '01

Andreas Siegert wrote: >Quoting Nix (suse(a)nix.hispeed.com) on Mon, Mar 05, 2001 at 02:54:24AM +0100: >> This is exactly what Obtuse SMTPD was designed to do. It is on the SuSE cd's >> Check out www.obtuse.com for more info. >I stopped using it. It does not handle Mailer Daemon Bounces with <> Addresses >propperly. If that means it doesn't accept bounces and denies them, you could use something like this in your smtpd-check-rules: # handle mail from: <> # outgoing messages allow:(your internal net):/^$/:ALL # incoming messages allow:ALL:/^$/:ALL@(your mail domain) This works for me. Andreas Baetz ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

1 0

SuSE Security Announcement: cups
by Sebastian Krahmer 05 Mar '01

05 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: cups Announcement-ID: SuSE-SA:2001:05 Date: Monday, March 5th, 2001 13:10:13 MET Affected SuSE versions: 7.1 Vulnerability Type: local/remote root compromise Severity (1-10): 5 SuSE default package: no Other affected systems: All UN*X-systems using cups < 1.1.6. Content of this advisory: 1) security vulnerability resolved: cups problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information CUPS is an implementation of the Internet Printing Protocol (IPP) and is used as an alternative to the lpr and LPRng packages. The CUPS package aims to be a comprehensive printing solution for UN*X-systems. In SuSE-7.1 distribution, the cups package is not used by any configuration utilities unless the admin has decided to configure the package manually. The cups package has been introduced in the SuSE-7.1 distribution; enhanced support for future releases of the SuSE Linux distribution is planned. A SuSE-internal security audit conducted by Sebastian Krahmer and Thomas Biege revealed several overflows as well as insecure file handling. These bugs have been fixed by adding length-checks and securing the file-access. For a temporary workaround, remove the suid-bit from the 'lppasswd' program. Make sure nobody from outside your network can access the CUPS-server running on port 631. Allowing access to this port from outside is a bad idea regardless whether or not the used version is vulnerable. No remote-exploits are known yet. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/d3/cups-devel-1.1.6-13.i386.rpm 23c6484952ab0c1de81e2db38bcd3afc SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/cups-1.1.6-13.i386.rpm 812e0c47dcfe508eb9e8ccb38165b6d7 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/cups-1.1.6-13.src.rpm 204cea2ad6a61293c191e70a2cacdc82 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: Effective Monday, March 19 2001, five weeks after the release of the new SuSE-7.1 distribution, SuSE will discontinue support for the SuSE-linux distributions SuSE-6.0 SuSE-6.1 and SuSE-6.2. SuSE puts much effort into adding security improvements (patches) to the software instead of publishing a new version; the same program with a fix for a specific problem promises to work just as reliable as the original version from the distribution, whereas new versions introduce new functionality which changes the behaviour. In some cases however, especially if the security leak is based on problematic design decisions or when the fix(es) are fairly large, the only reasonable fix for a security problem is to update to a newer version of the software. These newer versions tend to become incompatible with our older distribution releases because of missing features in the operating system environment. This forces us to focus on the distributions of a newer release date. The remaining distributions SuSE-6.3, SuSE-6.4, SuSE-7.0 and SuSE-7.1 for the Intel i386, AXP Alpha, SPARC as well as PPC Power PC platforms will continue to be supported for a two-year period after the release of the respective distribution. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Sebastian Krahmer ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOqODeXey5gA9JdPZAQHRYQf/aNhY+lHrkpmWlxGtQI29qetDlIuqVbvQ jUb4jm6vMvYJrFwzhtZ9XpWWYECDiqQjhy9KwmkkaVBrDTtbboNuQ+Wqq93zLzTD t1uXxGqb3p847p3OtoxZXR9ZUxxB+tn6MS2CGUZVDA+TaYgUD9DW1eb9+z0t5ehN 2cdYZqvAp22BasIdXGlFSvCJ4oBqXT9HmqBk8Q+FS7ZzT0VKvOmXShqv5bWOPRj+ XwuuiPdPGc9Ykwp8lcoymU2Y8b62MASEVYsFT4rynMxrDSfNUaEPXTAhc2RPM9vn +BgXrT0rfUiPkRWQTNpokp93TO3v8cOFgw0keeLcYRbP1nk36Ng03w== =BWbh -----END PGP SIGNATURE-----

1 0

SMTP antiSpam proxy ???
by christian.burri＠synecta.ch 05 Mar '01

05 Mar '01

Hello List! Im in desperate need for an SMTP proxy. Well, not just another proxy, it needs basically to do this: - Listen on external interface, port 25 - If mail arrives, check the DESTINATION address of the delivered email and verify that against a list of valid destination addresses - If the RCPT TO is valid* (in "allowed" list), then the proxy should relay the mail to an internal server - If RCPT TO is not a valid* one (e.x. spam_victimXY(a)hotmail.com), then it should drop the mail and close the spammer's connection. Is there such a program? I can imagine one could do that as a netfilter module...its a shame I cant code in C. :( The other approach I can think of would be AMAVIS maybe? That would be neat too, then it would have integrated virus protection. So, can AMAVIS do *exactly as I need (described above) ? Or is there some simpler solution (the more simple, the better because this is for a packet filter, that y I tought of a netfilter module) that would provide me with the needed features? help and ty :) Chris Burri jun. Systems & Network Engineer Synecta Informatik AG Zwinglistrasse 3 CH-9000 St. Gallen .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^ * valid and not valid: if a site has an email server and hosts domains on it, then one can say that an email, coming in on the external public IP of the site should have an email address that ends in one of the domains the site actually hosts, unless the mail was either sent in error, or it is a spam MAIL (some corporate level groupware servers are notoriously vulnerable to SPAM under certain conditions). Example for Site "dontlikespam.org" : If mail comes in on external interface, with an RCPT TO of "sales(a)dontlikespam.org", then it should be passed thru. If mail comes in on external interface, with an RCPT TO of "john.doe(a)dontlikespam.org", then it should be passed. If mail comes in on external interface, with an RCPT TO of "somebody(a)hotmail.com", then it should be blocked, and the connection that feeds the mail shall be dropped. in the "allow" list, there would be one entry like "dontlikespam.org" The RCPT TO must be checked strictly. Means, relay(a)hotmail.com% @dontlikespam.org must not circumvent it. Maybe there should be a keyword in the config file to disable (default is on) strict checking. Outgoing mail comes from internal interface and will not be tested. Externals connecting from remote sites either use dial-up and thus come from internal interface, or they use a VPN and thus wont appear on the external interface either.

5 5

Get rid of kdeinit port?
by uwe_kersten＠t-online.de 03 Mar '01

03 Mar '01

Hi all, after shutting down the x-server port I am looking for a way to skip networking for kde2. After starting kde2 I have a high port open that belongs to kdeinit. How can I tell kde not to open this port? Thanx in advance Uwe -- ------------------------------------------------------- Uwe Kersten E-Mail: uwe.kersten(a)online.de Live long and prosper! -------------------------------------------------------

3 2

ssl slow
by Andreas Fiesser 03 Mar '01

03 Mar '01

Hi! Yesterday I ran - for the first time ever - HardenSuSE on my router-box. I read the description on Marc's page as far as "run HardenSuSE yes" and went for it. I'm a practical type of guy, you see. :} When all those funny lines scrolled by, I wondered if this was really wise ... Well, I got all things up again and the box seems still doing what it is supposed to. A lot safer no, I figure. The only thing that gives me a pain is that the output of my ssl client (putty on Win2K), which I use most of the time to manage the Linux box via LAN, got rather slow. Before HardenSuSE screen output was about twice as fast. This is anoying when I youse mc, yast and such stuff. It's not really a life threatening issue but perhaps someone here could tell me what I could do about it to get it as fast as before ? ... Andreas

1 0

routing problems at dmz host
by Marco Ahrendt 03 Mar '01

03 Mar '01

hi all, I use the following network topology: Internet | (official IP) Router1 (192.168.1.1) | | eth0 (192.168.1.2) eth0 (official IP) Router2/Firewall eth2(192.168.1.3) --- DMZ eth1 (official IP) eth0:1 (192.168.1.4) | | Local Network (official IPs) The official Network consists of a Subnet with 16 IP adresses. The router/fw is an p133 which uses kernel 2.4.2 and iptables. The DMZ (yes, its not a really DMZ :) is one host, running a www server, a mail server and some other daemons. Default gateway for DMZ is 192.168.1.3 (eth2 on FW) how you can see. The problem is, linux uses the first IP (?), which it can use for the fastest hop and therefor, if I ping the internet, the router1 can't forward the internal IP to the net. If I use ping -I OFFICIAL_IP internet, everything works fine! I installed the package "iproute" but I can't set up the routing with this. There is no manpage and the howto is little bit short. :) Is it possible to give the system an other IP (official) than the internal IP which linux uses as default ? Same problem occurs on the FW host. Second problem: How can I accept dhcp in iptables ? Can I use connection tracking ? Someone telled me, dhcp isn't using protocols like tcp or udp so how do I have to filter/accept them ? Last thing :) : iptables is messing up my messagelog. I wrote a script where I can define a loglevel at first what should I add do syslogd.conf if I want to write all firewall-msgs to /var/log/firewall for example ? The ULOG option is more complicated so I think adding a rule to syslogd is easier. thx for any help ! Marco -- Marco Ahrendt phone : +49-341-98-474-0 adconsys AG fax : +49-341-98-474-59 Karl-Liebknecht-Str. 19 email : marco.ahrendt(a)adconsys.de 04107 Leipzig/Germany gnupg key at www.aktex.net/marco_work.asc

2 3

Re: Version of firewals.rpm for 2.4.x
by marc＠suse.de 02 Mar '01

02 Mar '01

Hi, > Do you have a version of firewals.rpm for the 2.4.x kernels? I'm > currently running suse 7.0, but until I upgrade to 7.1 I'd like to use > the latest kernel. Are there also user space tools that I need to get? 1) it is not recommended to use the 2.4 kernel for security purposes yet. 2) the 2.4 kernel supports old ipchains-based scripts like susefirewall if they are kernel-2.4 aware (get susefirewall v4.3 from www.suse.de/~marc) 3) susefirewall2 will be for the 2.4 kernel. first alpha end of this week Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

3 2

Re: [suse-security] Re: FW
by marc＠suse.de 02 Mar '01

02 Mar '01

>> > > (As I understand then IPtables make an improvement in the >> > > "memory" when compared with the stateless IPchains. Is this a >> > > good reason for skipping IPchains and start IPtables.....?) >> > > > you have the option to keep track of connection states. this is >> > an improvement, yes, however not a big one in my opinion >> > Really? Linux users might not be that aware (yet). I myself >> only learned about the benefits _because_ I did run a stateful >> packet filter (most things I stumble upon pass by unnoticed by >> Linux friends). >> Think of all those bloody bastards trying to penetrate your >> filter by using source ports like 20, 53, 80, and the like. thats why I say it's a small improvement. you prevent that people scan ports they should not. but where else is the added security? they can't connect to the services they cleverly found by their stealth scan ... (talking about simple "protection" by source port filtering - this is just stupid to rely on :-) Thats exactly the reason why the AUTOPROTECTING feature exists in SuSEfirewall (which is sadly something no other firewalling script has got ... I can only encourage people to cut'n paste ...) >> And no, the "established" keyword cannot really count as an >> answer. What's the point in passing packets based on a flag the >> outside(!) sets? You don't believe in sources you want to >> protect yourself against in the first place, do you? > Again, waht happens with packets without a SYN flag > where there is no connection for them? Yes they can be used for scanning, > but if you have a problem beeing scanned, then you have too many exposed > systems anyway. yep Andi - I'm of the same opinion ... >> means of Linux and ipchains. I never would like to go back to >> stateless filters (read: I *gladly* spend the memory and cpu >> cycles on the functionality). And yes, it's just one aspect and >> has to be seen in combination with *all* the other possible >> hurdles and obstacles one sets up for the bad guys. But why not >> use the possibilities given? >Well, all the stateful systems I have seen so far had interesting bugs >(check for PIX and FW-1 state engine bugs in the bugtraq archives). >This is an added complexity in the code, which increases the chance for >implementation bugs. hmm why am I replying to andi's mail? I can only 100% agree. I think there was only one bug in the ipfwadm code, and I can not remember a bug in the cisco ACL code, and there was none in the AIX filtering code. However, ip_filter had one or two bugs as well (agreed, not much) and commercial ones much much more - just because complexity is bad for security. this is proven since the 1970s, so keep security always as simple as possible. better chain several simple security mechanisms - thats the best solution. ipfwadm and ipchains were simple. iptables is not simple at all - hell when I wrote SuSEfirewall2, I had to test stuff how iptables/kernel actually work because the documentation is incomplete. Therefore I recommend not to use iptables until we can call 2.4 stable and tested. not before 2.4.10 or something. but that depends on the security level you want to have >Knowing Marc and his experience, I guess he can confirm that from real life >audits... Although I think the functionality of stateful filters can be very >useful, I am not rushing out to replace prooven systems with it. an additional problem with stateful filters is that people think they have no a magic bullet for security and then rely on stateful firewalls as a single line of defense. The best firewall setup is still and will still be in 5 years from now: <external-router-with-static-ACLs>--<Application-Gateway-Firewall>--<internal-router-with-static-ACLs> | DMZ-1 (more interfaces for more DMZ's) and putting your e-commerce systems into different security layers in the DMZs. lessons learned: time changes technology. it does not change concepts.

3 2

Secure Syslogd
by Gerd Bitzer 02 Mar '01

02 Mar '01

Hi List, does anybody know a secure dropin Replacement for the standard syslogd, which supports libwrap-style ACL's ? Thanx in advance

3 3

suse firewall - Mar 1 15:02:03 bigapple kernel: Packet log: output DENY ppp0 PROTO=1 195.186.133.129:3 195.132.143.170:3 L=88 S=0xC0 I=42977 F=0x0000 T=255 (#3)
by Olivier Mueller 01 Mar '01

01 Mar '01

Hello, Little thing probably, but I've not managed to solve it yet, reading ipchains docs. I have DSL and I am using pppoed. I installed a minimal susefirewall set of rules, and everything seems to work nicely. Just a little thing: when I try to connect to external hosts via ssh, I get about 3-4 such lines in my logs, and it takes really long to connect (5-10 seconds) : Mar 1 14:58:49 bigapple kernel: Packet log: output DENY ppp0 PROTO=1 195.186.133.129:3 195.186.1.111:3 L=214 S=0xC0 I=42750 F=0x0000 T=255 (#3) Mar 1 15:01:21 bigapple kernel: Packet log: output DENY ppp0 PROTO=1 195.186.133.129:3 195.139.143.170:3 L=88 S=0xC0 I=42872 F=0x0000 T=255 (#3) The funny thing is that when I connect to an old suse server (suse 6.x), it works directely. So that must be something with openssh/old-ssh. Any idea of what I could change to allow these icpm packets to come in ? Tried a few things, but not yet found the right line to comment. Regards & Thanks, Olivier -- _________________________________________________________________ Olivier Mueller - om(a)8304.ch - PGPkeyID: 0E84D2EA - Switzerland qmail projects: http://omail.omnis.ch - http://webmail.omnis.ch

2 5

proftpd-update
by Daniel Quappe 01 Mar '01

01 Mar '01

hey list, a few minutes ago i update my proftpd-package to rc3. now i always get the follwoing error-message with a "cnnection failed" response. syslog: "... unable to set uid to -2, current uid: 65534" i searched proftpd.org, but did not find anything about it. anybody out there got the same problems?! many thanks in advance, greets, daniel

2 4

inetd Segmentation fault
by Nix 01 Mar '01

01 Mar '01

:/etc # inetd -d Segmentation fault Has anyone seen this before?? this is a SuSE 7.0 box. Nothing special about it. I currently have xinetd installed also, but its switched off... I was going to use xinetd instead, but it doesn't seem to hand the originating IP address of connections through to the processes it spawns!!??!! :-( At least not with Obtuse smtpd.. I have deleted inted.conf and rpm-e inetd then rpm -i inted.rpm with the rpm file from ftp://ftp.suse.com/pub/suse/i386/current/suse/n1/ Can anyone off some suggestions?? --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

5 6

unknown log entry
by Andre Pietsch 01 Mar '01

01 Mar '01

I have a channel boundling isdn connect with a flatrate. Now i got several entry into the /var/log/messages like: kernel: ippp: MP, stepping over missing frame: 31551 What does it mean? pitschi real_pitschi(a)gmx.de

1 0