March 2001 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] remote login for root?!
by Schoenwaelder Oliver 07 Mar '01

07 Mar '01

Hi, I'm sorry. In fact you are right. Maybe I should have had a look down your mail and notice your sshd config file. Are you using RSA authentication? In that case root login will be ok if RSA succeeds, regardless the value of PermitRootLogin. H THAT h, Oliver -----Ursprüngliche Nachricht----- Von: Andreas Otto [mailto:andreas@noho.co.uk] Gesendet: Mittwoch, 7. März 2001 17:52 An: SuSE-Security Betreff: [suse-security] remote login for root?! Hi , I have always believed that ROOT_LOGIN_REMOTE="no" in /etc/rc.config prevents root from logging in remotely. But a simple: C:\>ssh -l root 192.168.101.99 Password: Last login: Wed Mar 7 15:41:22 2001 from 192.168.101.237 Have a lot of fun... mojox:~ # Tells me that something weird is going on here. Are there any other places I need to check for apart from the two mentioned below? /etc/rc.config: # If you want to allow root logins from other machines, set ROOT_LOGIN_REMOTE # to "yes". # ROOT_LOGIN_REMOTE="no" /etc/ssh/sshd_config: Port 22 #Protocol 2,1 ListenAddress 0.0.0.0 #ListenAddress :: HostKey /etc/ssh/ssh_host_key ServerKeyBits 768 LoginGraceTime 600 KeyRegenerationInterval 3600 PermitRootLogin no # Cheers, Andreas -- Andreas Otto OgilvyInteractive | Floor 2, Canberra House 315 - 317 Regent Street | London W1B 2HS Reception +44 207 299 3434 | Fax +44 207 631 5050 http://www.ogilvy.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-linux-unsubscribe(a)suse.com For additional commands, e-mail: suse-linux-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

remote login for root?!
by Andreas Otto 07 Mar '01

07 Mar '01

Hi , I have always believed that ROOT_LOGIN_REMOTE="no" in /etc/rc.config prevents root from logging in remotely. But a simple: C:\>ssh -l root 192.168.101.99 Password: Last login: Wed Mar 7 15:41:22 2001 from 192.168.101.237 Have a lot of fun... mojox:~ # Tells me that something weird is going on here. Are there any other places I need to check for apart from the two mentioned below? /etc/rc.config: # If you want to allow root logins from other machines, set ROOT_LOGIN_REMOTE # to "yes". # ROOT_LOGIN_REMOTE="no" /etc/ssh/sshd_config: Port 22 #Protocol 2,1 ListenAddress 0.0.0.0 #ListenAddress :: HostKey /etc/ssh/ssh_host_key ServerKeyBits 768 LoginGraceTime 600 KeyRegenerationInterval 3600 PermitRootLogin no # Cheers, Andreas -- Andreas Otto OgilvyInteractive | Floor 2, Canberra House 315 - 317 Regent Street | London W1B 2HS Reception +44 207 299 3434 | Fax +44 207 631 5050 http://www.ogilvy.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-linux-unsubscribe(a)suse.com For additional commands, e-mail: suse-linux-help(a)suse.com

1 0

Re: [suse-security] ipchains-rule to deny a special domain
by Martin Peikert 07 Mar '01

07 Mar '01

Martin Peikert <martin.peikert(a)innominate.com> wrote: > > Try > "ipchains -I input 1 -d xxx.y..." > instead of > "ipchains -A input -d xxx.y..." > Oops - meant output, not input. MArtin -- martin.peikert(a)innominate.com innominate AG the linux architects tel: +49-30-308806-0 fax: -77 http://www.innominate.com

7 7

Re[4]: [suse-security] ipchains-rule to deny a special domain -now works! :-)
by da_bug 07 Mar '01

07 Mar '01

hi! Now it works! ;-) THANX!! I did it this way: I flushed the old rules and reloaded everthing (checked that the deny-rule is over the allow-rules). This rule did it: ipchains -I input 1 -p tcp -s 0/0 -d domain-ip -j DENY ..and as soon as I have time I'll read the Howto's,manpages and RFC's.. ;-) (In the end one of the last biggest problems in technology is that your lifetime is limited...) bye & thanx again...

1 0

Redirect ftp traffic to an IIS4 ftp server
by Ka Kit Yick 07 Mar '01

07 Mar '01

Hi all, I'm using SuSE 6.4 with firewals-2.0-12. I need to redirect outside ftp traffic to an internal iis4 ftp server. Let said that the external address of the firewall is 12.34.56.80 and the address of the internal ftp server is 172.20.0.80. I use Rinetd to redirect the traffic with the following line : 12.34.56.80 20 172.20.0.80 20 12.34.56.80 21 172.20.0.80 21 I try to connect to the server using CuteFTP. In PASV mode, it says "Connection data socket..." but it never get through. And in active mode, it says "500 Invalide PORT Command". I know that in rinetd manual, it says that rinetd cannot redirect ftp traffic because it uses more than one socket. Is there any solution, without changing to whole thing? Thanks Ka Kit Yick

2 1

[Fwd: Re: [suse-security] ipchains-rule to deny a special domain]
by Hipolito A. Gonzalez M. 07 Mar '01

07 Mar '01

da_bug wrote: > hi! > > I want to deny the client-computers behind my router to access some > special domains/ip-addresses in the internet. > I tried something like "ipchains -A input -d xxx.yyy.zzz.xxx -p tcp -j > DENY" and "ipchains -A input -s xxx.yyy.zzz.xxx -p tcp -j > DENY" but it didn't work... > What can I do to deny access? > > bye. you have an error -s is: the source of the petition. is you networks is 192.168.0.0 with netmask 255.255.255.0 you need to put it in the -s (if you want to block all your networks, or the specific IP) and the -d is for the destination, por example, if you want to stop the conections to hotmail, make a lot of ping to www.hotmail.com and copy all IP of hotmail, for example, if hotmail is: 100.100.100.1 .2 .3 .4 .5 and .6 yuou need to put: ipchains -A input -s 192.168.0.0/0 -d 100.100.100.1 -p TCP -j DENY ipchains -A input -s 192.168.0.0/0 -d 100.100.100.1 -p UDP -j DENY and repeat it all times for each IP of the destination (until .6 in this example) If you need more help, write. PD: Excuse for my bad english -- www.geekcode.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ h! r++ y++ ------END GEEK CODE BLOCK------ - A veces creo que hay vida en otros planetas, y a veces creo que no. En cualquiera de los dos casos, la conclusión es asombrosa (Carl Sagan) -----------------------------------------------------------------D: Excuse for my bad english -- www.geekcode.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ h! r++ y++ ------END GEEK CODE BLOCK------ - A veces creo que hay vida en otros planetas, y a veces creo que no. En cualquiera de los dos casos, la conclusión es asombrosa (Carl Sagan) -----------------------------------------------------------------

1 0

[suse-security] ipchains-rule to deny a special domain
by da_bug 07 Mar '01

07 Mar '01

hi! I want to deny the client-computers behind my router to access some special domains/ip-addresses in the internet. I tried something like "ipchains -A input -d xxx.yyy.zzz.xxx -p tcp -j DENY" and "ipchains -A input -s xxx.yyy.zzz.xxx -p tcp -j DENY" but it didn't work... What can I do to deny access? bye.

4 5

Re: [suse-security] SMTP antiSpam proxy ???
by christian.burri＠synecta.ch 07 Mar '01

07 Mar '01

Okies =) Thank all you nice ppl for the info :) I will definately have a closer look at obtuse smtpd (neat since it seems to do xactly what I need and cuz it comes with SuSE on CD :) and AMAVIS (maybe I can get them to work together??). Thanks again and cheers Chr. Burri .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^

1 0

Ack, sendmail and firewall script
by Matthew Johnson 07 Mar '01

07 Mar '01

Thought it would take an hour to do, I was wrong! Anyone here having problems with 7.1 Firewall script? Mine comes up as a failure on all 3 runs, but I only get a warning on startup about DNS service not running, but it works. Anyone else get this? Matt

3 3

SuSEfirewall2 - new ALPHA version
by marc＠suse.de 06 Mar '01

06 Mar '01

Hi folks, by luck I was able to make the fixes for SuSEfirewall2 at once instead of having them lying around for some days as I thought it would take half an hour ago ... so here is v0.4: v0.4 06.03.01 ALPHA * Changed the START_FW variable to START_FW2 so you can have installed both SuSEfirewall(1) and SuSEfirewall2 in parallel without problems * Fixed a bug in INSTALL where the K99 stop script was incorrectly symlinked. * Fixed a bug in the masquerading. should work now. (thanks to jboonen(a)worldonline.nl) * Fixed dumb warnings and typos * Fixed a bug in FW_FORWARD for tcp and udp (for both bug reports thanks to christian.esser(a)gmx.de> you can find it at http://www.suse.de/~marc/SuSE.html Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

1 0