April 2001 - openSUSE Security - openSUSE Mailing Lists

Radius and dynamic IP address allocation
by Spiegel Thomas-CTS059 05 Apr '01

05 Apr '01

Hi, we are using the radius daemon (cistron "radiusd") for authentication of dial-in clients accessing through a cisco access server. At the moment we use static IP address assignment. Does anybody know whether the radius server permits IP address pool configuration? The dial-in clients shall get a dynamic assigned IP address from a pool. Thomas Spiegel -------------- Motorola GSD, ANDC Berlin e-mail: thomas.spiegel(a)motorola.com

2 1

O byte mails
by Togan Muftuoglu 05 Apr '01

05 Apr '01

Hi Everyone, From time to time I have been receiving 0 byte emails send by people with domain ending of mine domain rc82.org which are always to undisclosed recipients. I have already placed the following in hosts.deny. Can someone guide me what is going on ? I am using sendmail 8.11.2 that comes with Suse 7.1 SENDMAIL : ALL EXCEPT LOCAL 192.168.1.0/255.255.255.0 TIA -- Togan Muftuoglu Return-Path: toganm(a)pop.vip.sc5.yahoo.com> Received: from localhost (localhost [127.0.0.1]) by isguzar.dyndns.org (8.11.2/8.10.2/SuSE Linux 8.10.0-0.3)\ with ESMTP id f352Lof02700 for <toganm@localhost>; Thu, 5 Apr 2001 05:21:50 +0300 Message-ID: <200104050221.f352Lof02700(a)isguzar.dyndns.org> X-Apparently-To: toganm(a)yahoo.com via web3705 X-Track: 1: 40 Received: from pop.vip.sc5.yahoo.com [216.136.173.10] by localhost with POP3 (fetchmail-5.6.5)\ for toganm@localhost (single-drop); Thu, 05Apr 2001 05:21:50 +0300 (EEST) Received: from usw-sf-fw2.sourceforge.net (EHLO usw-sf-list1.sourceforge.net) (216.136.171.252)\ by mta454.mail.yahoo.com with SMTP; 04 Apr 2001 19:16:59 -0700 (PDT) Received: from host1.suse.com ([202.58.118.3] helo=lists.suse.com) by usw-sf-list1.sourceforge.net\ with smtp (Exim 3.22 #1 (Debian)) id 14kzKS-0004Xu-00 for <toganm(a)users.sourceforge.net>; \ Wed, 04 Apr 2001 19:16:56 -0700 Received: (qmail 2990 invoked by alias); 5 Apr 2001 02:16:39 -0000 Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm Precedence: bulk X-No-Archive: yes list-help: <mailto:suse-security-help@lists.suse.com> list-unsubscribe: <mailto:suse-security-unsubscribe@lists.suse.com> list-post: <mailto:suse-security@suse.com> X-Mailinglist:suse-security Delivered-To: mailing list suse-security(a)lists.suse.com Received: qmail 2983 invoked from network); 5 Apr 2001 02:16:39 -0000 Date: Wed, 4 Apr 2001 22:54:03 +0200 From: Gerharnceñ-.(a)rc82.org To:undisclosed-recipients:; X-Mozilla-Status: 8001 X-Mozilla-Status2: 00000000

1 0

Re: [suse-security] Bind]
by Philippe Wiede 04 Apr '01

04 Apr '01

Thanks Ashley for your discovery! I also had trouble getting any version of Bind 9 to log as it used to log in previous versions (using common logging statements in named.conf). Missing any user reports in corresponding newsgroups I thought I was the only one with this problem! It seems to me that this is a bug in bind 9.xx. Between named restarts, either it logs nothing at all, or only logs lame dns entries, or only logs queries, but always without a trace of logic. And to all of above, Bind 9 truncates its log file each time after each reload. Commenting out category "default" indeed seems to convince Bind 9 to log normally at last. Greets, Philippe Wiede pw(a)megapublic.com Ashley wrote: > > I discoverd (the hard way) in SuSE 7.1 the /etc/named.conf file by default > does not log anything of category 'default', which is basically everything > you are trying to log. Comment out the appropriate line and syslog will > get bind8 messages as it should: > > In /etc/named.conf: > # > # do not be verbose about these problems... > # > logging { > # category default { null; }; ### comment out this line ### > category lame-servers { null; }; > category cname { null; }; > };

2 3

Lindose Virus in Linux? Lion Worm?
by John P Carroll 04 Apr '01

04 Apr '01

From: Woody's Office Watch <wow-robot(a)woodyswatch.com> Date: Wed, 4 Apr 2001 12:35:01 -0400 Subject: Woody's OFFICE Watch #6.17 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 10. IN VIRUS VERITAS From my favorite virus curmudgeon, Rob Rosenberger, http://www.vmyths.com Do you use Eudora instead of Outlook? Beware. A hacker can silently install software on your PC if you merely open an email. Do you use Linux instead of Windows? Beware. The "Lion" worm -- yet another variant of the "Ramen" worm -- can install itself on your system. It will send your password file to the People's Repubic of China, among other things. Do you use Linux AND Windows? Beware. The "Lindose" virus can pollinate itself across both operating system platforms. Do you use Netscape instead of Internet Explorer? Beware. Do you use Notes instead of Exchange? Beware. Do you use Macintosh instead of Windows? Beware. Do you use... Well, you get the hint. I almost feel sorry for non-Microsoft users at a time like this. Almost. For example, consider the plight of ActionAid. A story in The Register (http://www.theregister.co.uk/content/8/17629.html) says the poverty relief group is on the verge of switching to Linux "as a way of avoiding the viruses that continuously assault its Windows PCs." ActionAid's IT director, Kerry Scott, apparently believes Linux will give his charity the "'virus free' computing" it so desperately needs. When I read the story, I thought to myself, "what about the Ramen worm?" Now Scott will need to fret about the Lion worm and the Lindose virus. Tomorrow he'll need to fret about something else. This leads me to an important point. You can't blame your security problems on the operating system you use, or on the email software you use, or on the browser you use. Switching to another operating system or email package or browser causes a bunch of headaches -- and it still doesn't solve your real problem. Your real problem is the Internet iself. No matter how unique you make your computer, you negate it the instant you hook up to the ultra-common Internet. ActionAid can't blame Microsoft for the network cable snaking out of their boxes. Scott must unplug everything if he truly wants to reduce his virus nightmare. Our computers grow more common every day. Windows may be the most common operating system now, but something will replace it someday. Linux? Java? The web browser itself? Who knows. But whatever comes next will bring with it even more commonality. The Internet iself is the true 'common' threat. Blaming Microsoft for today's virus problem is like blaming one cloud for the damage of a hurricane. What will you blame tomorrow? So smile the next time someone says "you're a fool for using Windows and Outlook." Tell them, "I use Microsoft products just to avoid those dangerous Linux worms and Macintosh viruses." ________________________________________________________________ GET INTERNET ACCESS FROM JUNO! Juno offers FREE or PREMIUM Internet access for less! Join Juno today! For your FREE software, visit: http://dl.www.juno.com/get/tagj.

2 1

RE: [suse-security] Bind
by Raffy 04 Apr '01

04 Apr '01

> Isn't bind chroot'ed in 7.1? If so, named wouldn't have access to > the /dev/log socket so it wouldn't make sense to have any entries in > /etc/syslogd.conf for it. Proper chrooting will create a new logging device (socket) in the chroot environment. Then just start syslog with the new socket (option -a) and it will log perfectly! > I guess I should get around to installing 7.1 someday ;) Just update your bind! Thanks Raffy

2 1

martian source trouble
by rene.marhold 04 Apr '01

04 Apr '01

since the last 3 days following messages Apr 3 07:05:30 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 3 07:45:59 mail kernel: martian source 0100007f for 0c21bad4, dev eth1 Apr 3 07:52:00 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 3 11:53:22 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 3 13:44:13 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 3 15:27:45 mail kernel: martian source c6e9fea9 for c6e9fea9, dev eth0 Apr 3 15:27:53 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:53 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:53 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:53 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:53 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:53 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:54 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:54 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:54 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 15:27:55 mail kernel: martian source c6e9fea9 for fffffea9, dev eth0 Apr 3 18:13:38 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 3 19:32:07 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 3 20:39:31 mail kernel: martian source 0100007f for 0c21bad4, dev eth1 Apr 3 21:10:36 mail kernel: martian source 0100007f for 4c38bad4, dev eth1 Apr 4 04:17:31 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 4 06:06:43 mail kernel: martian source 0100007f for fe6111d4, dev eth1 Apr 4 07:26:26 mail kernel: martian source 0100007f for 0c21bad4, dev eth1 no topology change in internal lan (same hardware) is this an hacker??? or an hardware defect from somewhere???

2 1

Re: [suse-security] martian source trouble
by rene.marhold 04 Apr '01

04 Apr '01

Sorry i´ve forgotten, eth0 is my internal eth and eth1 is externally ----- Original Message ----- From: "Andrés Tarallo" <atarallo(a)chasque.apc.org> To: "rene.marhold" <rene(a)mail.marhold.net> Sent: Wednesday, April 04, 2001 4:26 PM Subject: Re: [suse-security] martian source trouble > "rene.marhold" wrote: > > > > since the last 3 days following messages > > > > Apr 3 07:05:30 mail kernel: martian source 0100007f for fe6111d4, dev eth1 > > Apr 3 07:45:59 mail kernel: martian source 0100007f for 0c21bad4, dev eth1 > > Apr 3 07:52:00 mail kernel: martian source 0100007f for fe6111d4, dev eth1 > > There's a computer in your network that haves a wrong address; what's > called "Martian address" > > Bye > Andres >

1 0

Antwort: [suse-security] dns zone x-fers on tcp 53
by Stefan_Walther＠gehag-dsk.de 04 Apr '01

04 Apr '01

hi, you do not need to install the pri dns in the dmz. you can install your pri dns in your lan and communicate through the dmz with the sec dns at your isp. you only need the ip of your sec dns at the isp and set the rules(chains or tables: ipchains or iptables) at your firewalls that only the pri dns (ip-address) can communicate with the sec dns (also ip-address required) at your isp and the other way around. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: 030/89786448 Funk: 0172/3943961

1 0

harden_suse
by Ralf Freisinger 03 Apr '01

03 Apr '01

Hello All, i've some probs with the harden_suse package! First after installing this package the sshd don't run any more, there are no keys left! Further, it isn't possible to connect squid on any port it will be configured! Unfortunately i can not remove harden_suse because the undo script in etc isn't left, don't no why?? i wanted to secure the firewall an configure a transparent proxy with squid -> no chance! Any ideas? Thanks Ralf PS: i'm using an SuSE 2.4.2 Kernel

1 0

secumod
by Ralf Freisinger 03 Apr '01

03 Apr '01

Hallo all, i've installed the secumod packet, but there is no module called secumod.o. Is there someone out there who can tell me where i can find this module. I've tried to recompile the Kernel, with secumod enabled, but there isn't any option to enable this in the Kernel. Greetings Ralf

5 4