April 2001 - openSUSE Security - openSUSE Mailing Lists

Re: AW: [suse-security] HArdenSuSE for 7.1???
by Sven Michels 14 Apr '01

14 Apr '01

Hi, first another mail: > # Harden SuSE Linux 6.0 - 7.1, Perl Script by Marc Heuse <marc(a)suse.de> # > ^^^^^there we got it !! It *DOES* support SuSE Linux 7.1 :-)))) jup, marc announced it about ~1 week ago on the list. > ATTENTION: there seems to be a possible bug (or did i misconfigure > harden_suse)?? > After running harden_suse no remote login to my machine was possible. The > fault can be found in /etc/hosts.deny > > cat /etc/hosts.deny > ALL: ALL EXCEPT localhost > ^^^^^^ *UNCOMMENT* this entry, otherwise it won't be possible to log in > using ssh or telnet this is imho a bad idea. harden_suse should _harden_ a suse box. This means to secure this box a little bit more. The way you should go is to permit what itsn't espeacialy allowed. So just add a sshd : yourremotehost : ALLOW to the /etc/hosts.allow to login remote to the box. This protects you a little bit against buffer overflows in deamons. If you check some security archives you'll find an exploit against sshd. But this doesn't work if you protect your sshd via tcpd wrapper ;-) regards -- intraDAT AG http://www.intradat.com

1 0

Bind again
by Hipolito A. Gonzalez M. 14 Apr '01

14 Apr '01

I put the bind in extended loged and nothing bad appear. Nobody is doing transfer but the bind shutdown sometimes. I not only the person with this problem. What's happening? I think that another person here too is with this problem, who is working in the bind in suse? Help me. Thank you

2 1

Samba
by office 14 Apr '01

14 Apr '01

Hello, why is UDP-port 138:139 visible for the world when running SuSEfirewall? How can i prevent this? cu

2 1

Re: [suse-security] trojan question
by Harold ! 13 Apr '01

13 Apr '01

Currently IP-MasQ As I am on a dial-up and only have one external (dymanically assigned IP addy) THe server that actas as proxy is still running drake 7.2 but will be migrated to SuSE shortly. If ya diecide to use IP masq there's a wonderful little utility available to guides you through setup called pm firewall. Lemme know if yacan't find It as I' can email it to ya. Harold >From: Ashley <ashleyg(a)dnai.com> >To: suse-security(a)suse.com >Subject: Re: [suse-security] trojan question >Date: Thu, 12 Apr 2001 15:04:22 -0700 >MIME-Version: 1.0 >Received: from [202.58.118.3] by hotmail.com (3.2) with ESMTP id >MHotMailBC9FE20B007F4004325BCA3A7603127F0; Thu Apr 12 23:04:59 2001 >Received: (qmail 16912 invoked by alias); 13 Apr 2001 06:04:35 -0000 >Received: (qmail 16905 invoked from network); 13 Apr 2001 06:04:35 -0000 >From suse-security-return-6637-ambrosius1972 Thu Apr 12 23:05:52 2001 >Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm >Precedence: bulk >X-No-Archive: yes >list-help: <mailto:suse-security-help@lists.suse.com> >list-unsubscribe: <mailto:suse-security-unsubscribe@lists.suse.com> >list-post: <mailto:suse-security@suse.com> >X-Mailinglist: suse-security >Delivered-To: mailing list suse-security(a)lists.suse.com >Message-ID: <20010412150421.A23452(a)rose.ashnet> >Mail-Followup-To: suse-security(a)suse.com >References: <000001c0c350$c4dc0f10$b400000a(a)host.belfin.com> ><00d501c0c3a0$738a48c0$3200030a(a)seifried.org> >User-Agent: Mutt/1.3.12i >In-Reply-To: <00d501c0c3a0$738a48c0$3200030a(a)seifried.org>; from >listuser(a)seifried.org on Thu, Apr 12, 2001 at 04:32:25PM -0600 > > > >I'm starting to explore proxies. I'm curious which application level >proxies >you are using. > > > > >On Thu, Apr 12, 2001 at 04:32:25PM -0600, Kurt Seifried wrote: > > Simple: > > > > If your firewall is like mine then only packets going out to port 25, >port 80, > > etc are allowed, thus a trojan is less likely to be able to connect out >(since > > they use ports like 31337 and so on). Plus since my firewall runs >application > > level proxies for www/ftp, email, etc about the only protocol I allow my > > internal machines to do outbound is 22 (ssh), which makes keeping tabs >on what > > is going on very easy. > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > >-- >-ashley > > One of these days I'm going to completely organize my life. > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

1 0

ssh/rsync
by Ashley 12 Apr '01

12 Apr '01

I finally got bugzilla working at my job. I had to learn about mysql and apache to get anywhere, so it took me days. I'm working now on backup for the bugs database. I would like set up a cron job to use rsync over ssh to backup a dump of the bugs database to a backup host. What I don't understand is how to deal with passphases in a shell script. Or is there a better way to go about this? Any ideas? -- -ashley One of these days I'm going to completely organize my life.

5 4

trojan question
by Philipp Snizek 12 Apr '01

12 Apr '01

Hi list users, who synchronizes with whom? the trojan client with the trojan server or the server with the client? I'd say since it must be analogue to all tcp connections the client syncs with the server, but I'm not sure whether it really works like this in the special (?) trojan case. I do not have enough background information to be sure. I already checked O'Reilly's Building internet firewalls but I cannot find there anthing covering this topic. thanx in advance Philipp

6 10

Current ftpd "glob" vulnerability
by Lutz Jaenicke 12 Apr '01

12 Apr '01

Hi! it seems the security people must work 24/7 these days. Yesterday http://www.cert.org/advisories/CA-2001-07.html was published with respect to a "glob" vulnerability in ftpd. While the *BSD people already made some announcements, SuSE did not send out an announcement, yet. (Nothing popped up at wu-ftpd.org, too) For the ntp-vulnerability at least a "shut id down alert" was sent out soon. Therefore I decided to play safe and disabled ftpd yesterday evening... Best regards, Lutz -- Lutz Jaenicke Lutz.Jaenicke(a)aet.TU-Cottbus.DE BTU Cottbus http://www.aet.TU-Cottbus.DE/personen/jaenicke/ Lehrstuhl Allgemeine Elektrotechnik Tel. +49 355 69-4129 Universitaetsplatz 3-4, D-03044 Cottbus Fax. +49 355 69-4153

6 8

Port-Scans
by Dominic Burger 12 Apr '01

12 Apr '01

Hallo Liste, da ich in der letzten Zeit vermehrt in dieser Liste gelesen habe, daß es häufig zu Port-Scans bei neu entdeckten Bugs in div. Software kommt, möchte ich auf meinem LinuxRechner(SuSE 6.4, Server im LAN, Gateway zum I-Net) per ipchains die gefährdeten Ports blocken; außerdem soll das System immun gegen BO2K,... Attacken sein. Wo finde ich eine Sammlung oder Literatur darüber, um welche Ports es ich bei BO2K... handelt, wo darüber, welche Bugs welche Ports unsicher machen ? (in /etc/services und /etc/protocols habe ich schon nachlesen, aber es gibt ja immer neue Bugs und BO2K-Abkömmlinge) Vielen Dank für eure Bemühungen Dominic Burger

7 7

Re: [suse-security] SuSE Security Announcement: vim/gvim (SuSE-SA :2001:12)
by r.maurizzi＠gvs.it 12 Apr '01

12 Apr '01

> Now this is funny (well, not really) > I would expect that YOU (Yast Online Update) would find this security > update (as well as the previously posted xntpd, mc &c &c) but it doesn't. Well, mine found the updated list, and downloaded the packages for mc and vim. It wasn't able to DL the xntpd update however, Y.O.U. got a "file not found" error. Which ftp server did you use? I had to use ftp.suse.com because on th others all I got was "file not found" errors for either the update list or the packages... Maybe the mirrors still have to syncronize themselves, with the exception of xntpd (that's NOT available even on ftp.suse.com) Ciao, Roberto.

4 4

RE: [suse-security] blackjack
by Nisbach, Thomas 12 Apr '01

12 Apr '01

Just one remark: If you want to know which process made network-connections, try 'netstat -ap'. You must be root to use the option '-p'. It's a relatively new feature. Thomas

1 0