April 2001 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] squid2 acl´s and dynamic IP
by Dirk Ertl 25 Apr '01

25 Apr '01

Hy Peter, thanks for your TIP: It´s Rock and Roll.Work´s fantastico. I think that´s just the way for NT network. So have a good time CU :-)) -----Ursprüngliche Nachricht----- Von: Peter Wiersig [mailto:wiersig@glamus.de] Gesendet: Montag, 23. April 2001 19:39 An: Dirk Ertl Betreff: Re: [suse-security] squid2 acl´s and dynamic IP Hallo Dirk, in den Sourcen von squid (ich glaube 2.1) habe ich mal ein Auth-"Plugin" fuer WinNT-Benutzerauthentifizierung gesehen, es aber nie ausprobiert. Peter Wiersig

1 0

Re: [suse-security] Reasons for a system to freeze?
by David Henderson 25 Apr '01

25 Apr '01

Sven Michels wrote: > alter ego wrote: > >> My Linux box (SuSE 7.1, X, harden_suse) did strange things this morning >> and I wonder if there are some likely explanations or if this could be >> an attack: >> >> - while opening a large mail (about 245 K) with the Netscape Mail >> Client, Netscape stopped responding to user input (window was not >> repainted as well) >> - I tried switching to an open X-Term, but was not able to move the >> focus to that window >> - Switched to another console, logged in and tried killing the netscape >> process -> console ceased accepting input >> - Logged in remotely via ssh, which at first worked, but behaved weirdly >> (keystrokes were not displayed until the next key pressed) - then ssh >> ceased accepting input as well >> - switched the box off (Painful) and rebooted and everything worked >> - checked the log files (also firewall logs - I am behind a corporate >> FW), but could not find anything >> >> While this might not be a security related problem I'd appreciate any >> hints/tips/advice from the experts here. > > > > > Did you test to open the mail again after the reboot? maybe its some > mad code in it? Netscape also has many memleaks .. maybe you've just > read the mail on the wrong day for netscape [;)] i would check the mail > for some mad code. did you see the load of the maschine? I have had this happen several (at least 30-40 times over the past 3 weeks) times. It happens with either Netscape (reading mail or viewing a page) or RealPlayer. Nothing ever gets written to the log (or on console 10) to help point out the problem and when I read the e-mail after a rather painful reboot or return to the web page, no problem whatsoever. This rebooting thing was the main reason I stopped using Windows in 1994. I am very interested in solving this problem, but I have no idea where to begin to look. My guess is that this is security related as there is undoubtedly a memory leak somewhere, and where there is a memory leak, there is an exploit waiting to happen. Any help would be greatly appreciated!!!!!! Dave H System: Intel PIII 733 MHz (SMP, but only one processor installed) multiple PCI buses (2) matrox G400 dual head SuSE 7.1 with harden_suse reiser_fs on /, ext2 on /boot netscape6 and realplayer8 also cannot do a ps after netscape or realplayer hang PS Sorry Sven for sending this straight to you. I had intended to send this to the list. Not enough coffee yet this morning ;^) -- David A. Henderson, M.Sc. G. Cunningham Fellow Interdepartmental Genetics Program Department of Dairy Science 2010 Litton Reaves Hall Virginia Polytechnic Institute and State University Blacksburg, VA 24061 USA Phone: (540)231-4773 Fax: (540)231-5014 mailto://DHenders@VT.Edu http://www.dasc.vt.edu/henderson/dhenderson.html

4 6

sshd lets root login! Bug?
by Robert Sweet 25 Apr '01

25 Apr '01

How can we ssh into a box when root login is disabled. We have Marc Heuses New Firewall script running on a 7.1 Suse box using 2.4 kernel. Here are the open ports: Starting nmap V. 2.53 by fyodor(a)insecure.org ( www.insecure.org/nmap/ ) Interesting ports on YaddaYaddaYadda (XXXXXXXXXXX): (The 1516 ports scanned but not shown below are in state: filtered) Port State Service 21/tcp open ftp 22/tcp open ssh 25/tcp closed smtp 53/tcp open domain 80/tcp open http 113/tcp closed auth 123/tcp closed ntp Here is root logged on my friend's box locally and me logged in as root using ssh. root tty1 Apr 21 11:34 root tty2 Apr 21 11:38 root pts/0 Apr 21 11:35 (My.Box.At.Home) root pts/1 Apr 21 11:54 (My.Box.At.Home) Here is the output of /etc/securetty on the bad box: tty1 tty2 tty3 tty4 tty5 tty6 # for devfs: vc/1 vc/2 vc/3 vc/4 vc/5 vc/6 Any help on this one would be appreciated. We have shutdown sshd for now. Thanks -- _ _ __ _____ _____ ___| |_ | '__| / __\ \ /\ / / _ \/ _ \ __| | | _ \__ \\ V V / __/ __/ |_ |_|(_) |___/ \_/\_/ \___|\___|\__| rsweet(a)socal.rr.com "unix soit qui mal y pense."

5 5

Security Problems with Squid 2.2 Stable 5
by Ragucci＠t-online.de 24 Apr '01

24 Apr '01

Hello, I used nessus to check my Squid Proxy. I started the scan in the internal network. Nessus showed me the following vulnerabilities: - The proxy, allows everyone to perform requests against arbitrary ports, like 'GET http://cvs.nessus.org:110'. - The proxy allows the users to perform CONNECT requests like CONNECT http://cvs.nessus.org:23 - It was possible to make IIS use 100% of the CPU by sending it malformed extension data in the URL requested, preventing him to serve web pages to legitimate clients. - The misconfigured proxy accepts requests coming from anywhere. This allows attackers to gain some anonymity when browsing some sensitive sites using your proxy, making the remote sites think that the requests come from your network. - The misconfigured proxy accepts requests coming from anywhere. This allows attackers to gain some anonymity when browsing some sensitive sites using your proxy, making the remote sites think that the requests come from your network. - Information found on port unknown (3128/tcp) The remote web server type is : Squid/2.2.STABLE5 We recommend that you configure your web server to return bogus versions, so that it makes the cracker job more difficult What can I do? I'm running the SuSE_firewall script and I didn't set any ports @ FW_SERVICES_EXTERNAL_TCP. In my opinion nobody from the internet should be able to use my proxy - is that right? And why does nessus shows me informations about an IIS? Finally, how can I return bogus informations to hide my squid-version? Thanx for replies, Mario

4 3

RE: [suse-security] Re: reiserfs known problems
by Reckhard, Tobias 24 Apr '01

24 Apr '01

> Date: Mon, 23 Apr 2001 10:58:17 -0400 > From: Chris Mason <mason(a)suse.com> > To: grimmer(a)suse.de > Subject: RE reiserfs known problems > [snip] > Yes. An updated kernel that can deal with knfsd+reiserfs under 2.4 should > be available soon (today or tomorrow if all goes well in testing). In > general, we haven't really been calling this a security problem, it is > just > that reiserfs doesn't support knfsd at all in 2.4.x right now. > Is that supposed to mean that new RPMs will be made available or 'just' new tarballs at in people/mantel/next on the FTP server? Regards, Tobias

2 1

AW: [suse-security] Security Problems with Squid 2.2 Stable 5
by Thomas Lamy 24 Apr '01

24 Apr '01

One may also note that nessus may generate false positives, as squid indeed does serve pages (with error messages) while trying to connect to forbidden ports. Just my $0.02, Thomas > -----Ursprüngliche Nachricht----- > Von: Steffen Dettmer [mailto:steffen@dett.de] > Gesendet: Dienstag, 24. April 2001 10:15 > An: 'Suse-Security' (E-Mail) > Betreff: Re: [suse-security] Security Problems with Squid 2.2 Stable 5 > > > * Mario Enrico Ragucci wrote on Tue, Apr 24, 2001 at 03:46 +0200: > > - The proxy allows the users to perform > > CONNECT requests like > > CONNECT http://cvs.nessus.org:23 > > Did you use: > > acl SSL_ports port 443 563 > acl Safe_ports port 80 81 85 21 443 563 70 210 1025-65535 > acl CONNECT method CONNECT > > http_access deny !Safe_ports > http_access deny CONNECT !SSL_ports > > otherwise give it a try. > > oki, > > Steffen > > -- > Dieses Schreiben wurde maschinell erstellt, > es trägt daher weder Unterschrift noch Siegel. > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

Re: [suse-security] Recursive Shellscript
by Andreas Siegert 24 Apr '01

24 Apr '01

Quoting Christopher Mahmood (ckm(a)interearth.com) on Mon, Apr 23, 2001 at 06:57:53PM +0200: > * Andreas Siegert (afx(a)atsec.com) [010423 03:02]: > > This is a security hole if you ask me. Especially when seeing a non privileged > > user process eating up resources quickly. That should not happen, even without > > explicit ulimits. > > No, it's an admin error. There's no reason that the kernel should > assume it's smarter than you. Of course the admin should set limits. But a kernel going bonkers over run-away processes is a kernel error, not an admin error. > > > AIX had the same problem some yaers ago, then the changed the algorithm for > > killing processes in that situation and nowadays it seems to be killing the > > offender most of the time. > > If that's correct then this sounds like one more reason not to run > AIX. Well, at least AIX doesn't kill random processes but the ones causing the problem. One more reason to run AIX IMNSHO. cheers afx -- atsec information security GmbH Phone: +49-89-44249830 Steinstrasse 68 Fax: +49-89-44249831 D-81667 Muenchen, Germany WWW: www.atsec.com May the Source be with you!

1 0

ftp
by Anders Johansson 24 Apr '01

24 Apr '01

Hi, I got this in my log Apr 23 10:15:48 mymachine wu.ftpd[13697]: connect from 62.2.87.42 (62.2.87.42) Apr 23 10:15:49 mymachine ftpd[13697]: USER anonymous Apr 23 10:15:49 mymachine ftpd[13697]: PASS guest(a)here.com Apr 23 10:15:49 mymachine ftpd[13697]: CWD /pub/ Apr 23 10:15:49 mymachine ftpd[13697]: MKD 010423101604p Apr 23 10:15:49 mymachine ftpd[13697]: CWD /public/ Apr 23 10:15:49 mymachine ftpd[13697]: CWD /pub/incoming/ Apr 23 10:15:50 mymachine ftpd[13697]: CWD /incoming/ Apr 23 10:15:50 mymachine ftpd[13697]: CWD /_vti_pvt/ Apr 23 10:15:50 mymachine ftpd[13697]: CWD / Apr 23 10:15:50 mymachine ftpd[13697]: MKD 010423101605p Apr 23 10:15:50 mymachine ftpd[13697]: CWD /upload/ after which the person disappeared. Is there an exploit here that I'm unaware of? I couldn't find anything on either cert.org of securityfocus.com. Or is it just someone looking for a place to store warez? Am I being paranoid? :) Regards Anders

2 1

harden-suse for 7.1
by Togan Muftuoglu 24 Apr '01

24 Apr '01

Hi everyone, I was just going to apply harden-suse-3.2 for my firewall machine but I thought before shouting for possible help I go and ask some questions. When I read the actuall script I saw that it needs the /usr/share/doc/pam/md5.config directory to exist. Since I was low on space I had deleted all the man pages and /usr/share/doc/ directories it was good to know it is needed. Are there any other specific files to be present -- Togan Muftuoglu

1 0

VPN with cipe or freeswan?
by Thorsten Marquardt 24 Apr '01

24 Apr '01

Hi, I need to build a VPN connection to a win nt based partner network. If i'm right this could be done with cipe and freeswan. Which package is recommendet? Who do I havce to configure firewall.rc.config? My System Kernel 2.2.18 ipchains 1.3.9-217 SuSEfirewall 4.3-3 Thanks in advance Thom - ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

5 8

Re: [suse-security] hex IP Addresses - reading direction [was: firewall.log - martian source]
by Eilert Brinkmann 24 Apr '01

24 Apr '01

Hella.Breitkopf(a)varetis.de wrote: > Steffen Dettmer <steffen(a)dett.de> > had some perl code to decode this: > > >to convert hex to IP you may use the following one-liner: > > > >perl -e '$a=shift;{printf "%d.%d.%d.%d\n", > > ("0x" . substr($a,6,2)), > > ("0x" . substr($a,4,2)), > > ("0x" . substr($a,2,2)), > > ("0x" . substr($a,0,2));}' <string> > > > >[this works at least on intel archs] ^^^^^^^^^^^^^^ And that's the point: The output in the logfile is architecture dependent. > [snip] > >fffffea9 = 169.254.255.255 > > Err, and here starts my problem: > ff ff fe a9 is in my universe (if read from left to right) = > 255.255.254.169 > (but a9feffff *is* 169.254.255.255) > The script does it backwards ... These messages are produced by the call printk(KERN_WARNING "martian source %08x for %08x, dev %s\n", saddr, daddr, dev->name); in /usr/src/linux/net/ipv4/route.c, where saddr and daddr are 32-bit integer variables containing the IP addresses in network byte order. But this printk-call interprets them as if they where in host byte order. Therefore, if host byte order and network byte order differ, the bytes of the IP addresses are printed "from right to left". Network byte order is big endian, while host byte order on Intel is little endian, so on an Intel machine the output has the "wrong" order. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org http://www.informatik.uni-bremen.de/~eilert/

2 1

Re: [suse-security] Recursive Shellscript
by Andreas Siegert 24 Apr '01

24 Apr '01

Moin, Quoting Peer-Christoph Mettelem (Peer-Christoph.Mettelem(a)bezreg-muenster.nrw.de) on Mon, Apr 23, 2001 at 09:48:12AM +0200: > Hi, > > I just wrote a shell script which looks like this: > while true > do > $0 > done > > I executed it as normal user and then the following happened: As you can > imagine, very many shells were started (i wasn't able to count them because > the system wasnt responding any more). And then the system started killing > system processes like X and smbd. I got the following output on console 10: > Apr 23 09:11:54 AlBundy kernel: VM: killing process kmail > Apr 23 09:12:52 AlBundy kernel: VM: killing process smbd > Apr 23 09:13:03 AlBundy kernel: VM: killing process smbd > Apr 23 09:13:05 AlBundy kernel: VM: killing process xconsole > Apr 23 09:13:13 AlBundy kernel: VM: killing process X > > The system recovered itself by killing X. That worked because i started the > script from a shell in KDE. But if the script would be started within a > telnet session, it could be more dangerous. > > I don't know if this is a security hole, but it might be. This is a security hole if you ask me. Especially when seeing a non privileged user process eating up resources quickly. That should not happen, even without explicit ulimits. AIX had the same problem some yaers ago, then the changed the algorithm for killing processes in that situation and nowadays it seems to be killing the offender most of the time. Time for a kernel change me thinks. afx -- atsec information security GmbH Phone: +49-89-44249830 Steinstrasse 68 Fax: +49-89-44249831 D-81667 Muenchen, Germany WWW: www.atsec.com May the Source be with you!

4 3

securing a new SuSE 6.4 box
by michael.ryan＠storm.ie 23 Apr '01

23 Apr '01

Hi, I have just completed a default installation of SuSE 6.4 on an old PC. What steps should I now take to tighten the security of this box before I connect it to the big bad internet ;-) ?? (I plan on using it as a ftp server and also perhaps as a web server) Any feedback much appreciated. Michael P.S. I am new to Linux

2 1

SuSE Security FAQ
by John Pinder 23 Apr '01

23 Apr '01

Reposted from a previous post: Nix wrote: >Just a reminder to everyone that we have a Frequently Asked >Questions (FAQ) file at: > >http://www.susesecurity.com/faq/ > >Please check it occasionally (before you post a question) as >there is some useful information there. > >If anyone has some extra sections for the FAQ, please forward >them to me, and I will put them in at my earliest convenience. > >Cheers > >--- >Nix - nix(a)susesecurity.com >http://www.susesecurity.com It sort of occurred to me that this should probably be reposted once in a while. John

1 0

(djbdns + tinydns) vs bind
by stephane parenton 23 Apr '01

23 Apr '01

what is the more secure today between bind 9.1.x and djbdns ?... We're hosting several sites, and planning to extand this activity, and we have 3 linux box (2 of them are to be upgraded and secured...). has anyone played with djbdns and tinydns ? is the installation of djbdns over a bind easy ? regards stephane

2 1

nss vs. pam
by Egan 23 Apr '01

23 Apr '01

Can anyone explain the interaction between nss vs. pam? I just discovered the nss_db package and it looks like what I need, more than pam. I want to create a system account for every user, but I want to avoid linear search lookups in a large plaintext /etc/passwd file. It looks like nss_db might solve that problem. Since I don't care about external authentication, can I remove pam, to speed things up?

1 0

Re: [suse-security] Reasons for a system to freeze?
by Nick LeRoy 23 Apr '01

23 Apr '01

Hello... Just thought I'd add my $0.02 worth in... I *always* run netscape from a script which uses ulimit to set the amount of memory it can get. If I don't, it sometimes sucks the life out of the machine in similar ways by using all memory. With it ulimitted, it dies after a while (when it can't get any more memory), but my system still lives on. I've been doing this for serveral years. -Nick > > > While this might not be a security related problem I'd appreciate any > > > hints/tips/advice from the experts here. > > > > Did you test to open the mail again after the reboot? maybe its some > > mad code in it? Netscape also has many memleaks .. maybe you've just > > read the mail on the wrong day for netscape ;) i would check the mail > > for some mad code. did you see the load of the maschine? > > > > I tried opening the mail (cautiously) and it worked fine ... hmmm. It's > a php-general-list-digest, so it does contain code snippets. > > I was not able to see the machine load. I tried top, but the command did > not produce any output. This was about the same time, my ssh died. -- Get your free email from www.linuxmail.org Powered by Outblaze

6 6

Re: reiserfs known problems
by Lenz Grimmer 23 Apr '01

23 Apr '01

Hi, here the answer from our ReiserFS guy. Bye, LenZ -- ------------------------------------------------------------------ Lenz Grimmer SuSE GmbH mailto:grimmer@suse.de Schanzaeckerstr. 10 http://www.suse.de/~grimmer/ 90443 Nuernberg, Germany There's no future in time travel. ---------- Forwarded message ---------- Date: Mon, 23 Apr 2001 10:58:17 -0400 From: Chris Mason <mason(a)suse.com> To: grimmer(a)suse.de Subject: RE reiserfs known problems -------------------------------- On Monday, April 23, 2001 03:38:09 PM +0200 Gerhard den Hollander <gerhard(a)jasongeo.com> wrote: > I understand from reading through the Reiserfs mailinglists that the > combination of reiserfs and knfsd causes problems. > > I am expereicneing these problems on one of my machines. > > Bascially what happens is that the combo knfsd/reiserfs causes the inode > table to screw up, meaning that entire directories appear to be totally > gone from the disk. > > Now this may not be considered a security issue, but it's hurting the > security of my machine rather badly ;) .. > > I checked the suse website, but doidn't find any updates for this. > > is an update for Suse 7.1 / kernel 2.4 being considered for this ? > Yes. An updated kernel that can deal with knfsd+reiserfs under 2.4 should be available soon (today or tomorrow if all goes well in testing). In general, we haven't really been calling this a security problem, it is just that reiserfs doesn't support knfsd at all in 2.4.x right now. -chris

1 0

reiserfs known problems ?
by Gerhard den Hollander 23 Apr '01

23 Apr '01

I understand from reading through the Reiserfs mailinglists that the combination of reiserfs and knfsd causes problems. I am expereicneing these problems on one of my machines. Bascially what happens is that the combo knfsd/reiserfs causes the inode table to screw up, meaning that entire directories appear to be totally gone from the disk. Now this may not be considered a security issue, but it's hurting the security of my machine rather badly ;) .. I checked the suse website, but doidn't find any updates for this. is an update for Suse 7.1 / kernel 2.4 being considered for this ? Currently listening to: The Tea Party - The Halcyon Days (Live-Ottawa) () Gerhard, [@jasongeo.com] == The Acoustic Motorbiker == -- __O I spoke about wings ... You just flew =`\<, I wondered, I guessed and I tried ... You just knew (=)/(=) I sighed ... And you swooned I saw the crescent ... You saw the whole of the moon

1 0

Re: [suse-security] Reasons for a system to freeze?
by Nick LeRoy 23 Apr '01

23 Apr '01

> Hi! > > On Sun, 22 Apr 2001, Nick LeRoy wrote: > > > I've been asked by several people for my Netscape script. So, I'll post it here. It's *very* simple, so don't expect too much. > > > > #! /bin/bash > > LIMIT=164000 > > killall -9 netscape > > ulimit -m $LIMIT -v $LIMIT -d $LIMIT > > ulimit -a > > nice -2 netscape & > > Any reason you don't execute the SuSE-supplied "Netscape" wrapper > script in the last line? > (Just curious...) Honestly.... I wrote this script long before I'd ever tried SuSE. -Nick -- Get your free email from www.linuxmail.org Powered by Outblaze

1 0

machine hangs!
by semat 23 Apr '01

23 Apr '01

I am running SuSE linux 6.4 on a 500 MHZ processor 128MB RAM and 128MB swap. Problem: Everyday this machine suddenly does some sort of hang. I suddenyl cannot ssh to it it times out, same thing with services from inetd like ftp. I even tried to enable telnet but it also times out. At this point people can still browse pages from this machien and all the pages are fine but any cgi script does not execute with the message: The server encountered an internal error or misconfiguration and was unable to complete your request. Upon rebooting the server these problems always go away and it functions again properly and then later starts the same behaviour. I have failed to find evidence of a break in in my logs and I am running all the latest upgraded packages for security fixes. The only services available to the world are dns bind 8.2.3-REL apache 1.3.19 openssh latest from the suse site ftp vsftpd-0.0.15 ALl other ports are closed by an ipchains firewall. The kernel is patched with solar designers secure_linux patch, LIDS is installed and snort and a whole array of IDSes.

2 2

[suse-security] adress rewriting, sendmail 8.11.0
by Robert Rinnberger 23 Apr '01

23 Apr '01

Hello, I try to setup address rewriting with /etc/mail/genericstable and /etc/mail/virtusertable on my mail-relay with sendmail 8.11.0. I have an internal host, which has configured as SENDMAIL-RELAY my mail-relay, the variable FROM-HEADER is empty. My mail-relay is connected to the Internet, the FROM-HEADER ist set to "mydomain". I've configured a file genericstable and virtusertable like this. /etc/mail/genericstable: usr1(a)host1.mydomain usr1@mydomain /etc/mail/virtusertable: usr1@mydomain usr1(a)host1.mydomain The problem ist, if I send a mail from the internal host to the internet, the from-address is not rewrited, but if I send a mail from the Internet to "usr1@mydomain" the address is rewrited to usr1(a)host1.mydomain. All internal mail from usr1(a)host1.mydomain to usr2(a)host2.mydomain should not be rewrited. The address rewriting works only for incoming mail, not for outgoing. Any ideas? Thanks, Robert

1 0

Re: [suse-security] Reasons for a system to freeze?
by Nick LeRoy 23 Apr '01

23 Apr '01

Ashley & SuSE Security bunch.. I've been asked by several people for my Netscape script. So, I'll post it here. It's *very* simple, so don't expect too much. -Nick #! /bin/bash LIMIT=164000 killall -9 netscape ulimit -m $LIMIT -v $LIMIT -d $LIMIT ulimit -a nice -2 netscape & > I would like to see your script. It sounds useful. Perhaps even > more than $0.02 worth. > > > On Fri, Apr 20, 2001 at 07:42:32PM +0600, Nick LeRoy wrote: > > Hello... > > > > Just thought I'd add my $0.02 worth in... > > > > I *always* run netscape from a script which uses ulimit to set the amount of memory it can get. If I don't, it sometimes sucks the life out of the machine in similar ways by using all memory. With it ulimitted, it dies after a while (when it can't get any more memory), but my system still lives on. I've been doing this for serveral years. > > > > -Nick > > > > > > > While this might not be a security related problem I'd appreciate any > > > > > hints/tips/advice from the experts here. > > > > > > > > Did you test to open the mail again after the reboot? maybe its some > > > > mad code in it? Netscape also has many memleaks .. maybe you've just > > > > read the mail on the wrong day for netscape ;) i would check the mail > > > > for some mad code. did you see the load of the maschine? > > > > > > > > > > I tried opening the mail (cautiously) and it worked fine ... hmmm. It's > > > a php-general-list-digest, so it does contain code snippets. > > > > > > I was not able to see the machine load. I tried top, but the command did > > > not produce any output. This was about the same time, my ssh died. > > > > -- > > > > Get your free email from www.linuxmail.org > > > > > > Powered by Outblaze > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > > -- > -ashley > > One of these days I'm going to completely organize my life. > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > -- Get your free email from www.linuxmail.org Powered by Outblaze

2 1

recursive shellscript
by Kurt Seifried 23 Apr '01

23 Apr '01

Same diff. (root/user, when it comes to locally dos'ing a box it doesn't really matter). >No, i was a normal user. That's why i was so surprised. You ran out of file descriptors. etc. this is why you limit users. As for limiting uysers by default as emmerich mentions what are appropriate limits then for users? Some people have small servers, others have large servers. Some people have a LOT of users logged in, some have very few. etc. If you're going to setup a server and give users accounts you can be expected to assume a certain amount of risk. Whether you choose to minimize this risk is largely up to you, the OS vendor can't do it all. Also html email sucks. I apologize for not cutting and pasting, instead I hit reply, and outlook defaulted to replying to the html email as html email. In future I won't bother to respond to html email on this list (which saves me time too =). Kurt Seifried, seifried(a)securityportal.com Securityportal - your focal point for security on the 'net

1 0

Re: [suse-security] Recursive Shellscript
by emm＠eggler.ch 23 Apr '01

23 Apr '01

At Mon, 23 Apr 2001 02:04:45 -0600 , "Kurt Seifried" <listuser(a)seifried.org> wrote: >Let me guess. you did this as root. Oh my god, surprise surprise. <seifried-mode> let me guess. you haven't read the original posting ("I executed it as normal user [...]"). </seifried-mode> ;-) to me, this behaviour (which i did not try to reproduce and therfor i'm not sure it really is like described) is a security-problem. it means, any normal user can __very__ easily stop any machine he or she wants to. the limits kurt talks about should be activated by default. --emmerich > >Learn about imposing limits via PAM. (hint: www.sysadminmag.com).=20 > >Kurt Seifried, seifried(a)securityportal.com >Securityportal - your focal point for security on the 'net > > > > ----- Original Message -----=20 > From: Peer-Christoph Mettelem=20 > To: suse-security=20 > Sent: Monday, April 23, 2001 1:48 AM > Subject: [suse-security] Recursive Shellscript > > > Hi, > > =20 > > I just wrote a shell script which looks like this: > > while true > > do > > $0 > > done > > =20 > > I executed it as normal user and then the following happened: As you = >can imagine, very many shells were started (i wasn't able to count them = >because the system wasn't responding any more). And then the system = >started killing system processes like X and smbd. I got the following = >output on console 10: > > Apr 23 09:11:54 AlBundy kernel: VM: killing process kmail > > Apr 23 09:12:52 AlBundy kernel: VM: killing process smbd > > Apr 23 09:13:03 AlBundy kernel: VM: killing process smbd > > Apr 23 09:13:05 AlBundy kernel: VM: killing process xconsole > > Apr 23 09:13:13 AlBundy kernel: VM: killing process X > > =20 > > The system recovered itself by killing X. That worked because i = >started the script from a shell in KDE. But if the script would be = >started within a telnet session, it could be more dangerous. > > =20 > > I don't know if this is a security hole, but it might be. > > =20 > > My system: > > SuSE 7.0 (kernel 2.2.18) > > Lots of updates and patches installed > > PII 350 MHz > > 320 MB RAM > > =20 > > Peer-Christoph Mettelem > > BezRegMS (NRW, Germany) > > Software developer (trainee) > > =20 > > PS.: This is my first mail to the mailing list. Sorry if it's OT or = >something... > >

1 0