March 2001 - openSUSE Security - openSUSE Mailing Lists

xinetd
by Ahmed Mohammad 08 Mar '01

08 Mar '01

Hello, Is there any advantage to using xinetd over inetd? Anyone have any experience with this in 7.0? thankx

10 13

RE: [suse-security] udp 1024 - unknown
by Björn Engels 08 Mar '01

08 Mar '01

>What can be behind netstat -a * udp send-Q 288:1024 >nmap -sU x.com says udp 1024 unknown >- can it be related that tcpdump -i eth0 takes ages to write packet >traffic? 'lsof -Pi | grep 1024' should show you which process is listening on that port. Björn Engels LANWORKS AG

2 1

RE: [suse-security] all network ports in use
by Björn Engels 08 Mar '01

08 Mar '01

>Nevertheless, this doesn't seem to be the problem here. It more or less >looks like this machine has been under attack so that all available >sockets have been used up. In particular, it seems to have been a SYN >flood attack. There is no efficient countermeasure against this other >than >pulling the plug. That's what I think, too, but there are counter measures with kernel 2.4, I think. If I understand /proc/sys/net/ipv4/tcp_synack_retries correctly, you should reduce the value. Or restrict the incoming syn-rate at the firewall or get a firewall that knows "random early drop". (Thanks, Guido Stepken ;-) ) Björn Engels LANWORKS AG

1 0

udp 1024 - unknown
by webmaster 08 Mar '01

08 Mar '01

What can be behind netstat -a * udp send-Q 288:1024 nmap -sU x.com says udp 1024 unknown - can it be related that tcpdump -i eth0 takes ages to write packet traffic? -------------------------- webmaster Kreorg Oktatóközpont Tel/Fax: 321-0031 email: webmaster(a)kreorg.hu

1 0

Re: [suse-security] all network ports in use
by christian.burri＠synecta.ch 08 Mar '01

08 Mar '01

Roman Drahtmueller To: Murat Koc <muratkoc(a)linux.org.tr> <draht(a)suse.d cc: Christian Boxhammer <box(a)theor.geod.uni-bonn.de>, <suse-security(a)suse.com> e> Subject: Re: [suse-security] all network ports in use 08.03.2001 11:46 >> > There is sometimes a problem, logging into our two SuSE 7.0 (SMP) machines. >> > Trying to log in with telnet procudes the following error Message: >> > "telnetd: all network ports in use" >> > In such a case it is not possible to log into the machine for several hours. >> > Is this because of a portscan an anything else? >> > Did anyone have a similar Problem? >> >> Be sure that you compiled the kernel with "Unix98 PTY support" and >> "/dev/pts file system for Unix98 PTYs" options enabled. >> >> or add a line in your /etc/fstab >> >> none /dev/pts devpts mode=0620 0 0 > >The devpts filesystem gets mounted by /sbin/init.d/boot at boot time on >SuSE distributions and are not listed in the fstab. It shouldn't matter if >it shows up there, though. > >Nevertheless, this doesn't seem to be the problem here. It more or less >looks like this machine has been under attack so that all available >sockets have been used up. In particular, it seems to have been a SYN >flood attack. There is no efficient countermeasure against this other than >pulling the plug. <snip> What about SYN cookies? Or would it help to adjust values in /proc/sys/net/ipv4/tcp_syn_retries resp /proc/sys/net/ipv4/ tcp_max_syn_backlog? Or the upstream ISP starts limiting max SYN packets rate? cheers Chr. Burri

2 1

iptables as a firewall
by Grimm, David 08 Mar '01

08 Mar '01

Hello folks, I was wondering if I could get a little advise on firewalls. I'm setting up a webserver, email server, and firewall site (three computers running SUSE). The firewall is going to be hooked up directly to a high speed DSL line...for starters. It's going to have a static IP. The other machines are going to have only the necessary software (Apache on one and SuSE email server II on the other). The firewall is going to sport the 2.4 kernel with the netfilter/iptables patch. The question is: Is it possible to forward traffic to the other two machines (if they have static IP's of there own) using just iptables? Or, do I have to use another tool/ utility? Thanks for any help, DAVID *********************************************************************** This electronic message may contain information that is confidential and/or legally privileged. It is intended only for the use of the individual(s) and entity named as recipients in the message. If you are not an intended recipient of this message, please notify the sender immediately and delete the material from any computer. Do not deliver, distribute or copy this message, and do not disclose its contents or take any action in reliance on the information it contains. Thank you.

2 1

Sorry!!!
by jobhopper Pascal Ehlig 08 Mar '01

08 Mar '01

SORRY! Sorry that i have flooded this list with my isread responsemail. I have forgotten to remove it (now i have killd it)... again sorry... i have get 500 mails for this... shit...... 30Mins to download all isread responses... i think you know i DONT want to do that... Pascal Ehlig

1 0

Re: [suse-security] ipchains-rule to deny a special domain -didn't work :(
by christian.burri＠synecta.ch 07 Mar '01

07 Mar '01

In case u wanted to restrict access from a certain domain name.... ipchains doesnt accept domain names for -s or -d afaik. At least, I couldnt get a rule like ipchains -A input -s *.nz -d 123.123.123.123 -j DENY to work :( .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^

3 2

Companies Still Running Flawed BIND Software
by Fred A. Miller 07 Mar '01

07 Mar '01

Companies Still Running Flawed BIND Software An Icelandic software and consulting firm tested DNS systems at Fortune 1000 companies and .coms at periodic intervals after the announcement of the flaw in BIND software. After a striking initial drop in the number of sites running insecure versions of BIND, the surge has faded to a trickle. SANS GIAC and CERT/CC have begun receiving reports of successful BIND vulnerability exploits. http://www.computerworld.com/cwi/stories/0,1199,NAV47_STO58302,00.html -- Fred A. Miller Systems Admin. Cornell Univ. Press Services fm(a)cupserv.org

2 1

AW: [suse-security] remote login for root?!
by Schoenwaelder Oliver 07 Mar '01

07 Mar '01

Hi, sorry, you have to edit the sshd config file (/etc/ssh/sshd_config). Change PERMIT_ROOT_LOGIN to NO. Restart sshd and root login is permited. Hth, Oliver -----Ursprüngliche Nachricht----- Von: Andreas Otto [mailto:andreas@noho.co.uk] Gesendet: Mittwoch, 7. März 2001 17:52 An: SuSE-Security Betreff: [suse-security] remote login for root?! Hi , I have always believed that ROOT_LOGIN_REMOTE="no" in /etc/rc.config prevents root from logging in remotely. But a simple: C:\>ssh -l root 192.168.101.99 Password: Last login: Wed Mar 7 15:41:22 2001 from 192.168.101.237 Have a lot of fun... mojox:~ # Tells me that something weird is going on here. Are there any other places I need to check for apart from the two mentioned below? /etc/rc.config: # If you want to allow root logins from other machines, set ROOT_LOGIN_REMOTE # to "yes". # ROOT_LOGIN_REMOTE="no" /etc/ssh/sshd_config: Port 22 #Protocol 2,1 ListenAddress 0.0.0.0 #ListenAddress :: HostKey /etc/ssh/ssh_host_key ServerKeyBits 768 LoginGraceTime 600 KeyRegenerationInterval 3600 PermitRootLogin no # Cheers, Andreas -- Andreas Otto OgilvyInteractive | Floor 2, Canberra House 315 - 317 Regent Street | London W1B 2HS Reception +44 207 299 3434 | Fax +44 207 631 5050 http://www.ogilvy.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-linux-unsubscribe(a)suse.com For additional commands, e-mail: suse-linux-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1