April 2001 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] squid2 acl´s and dynamic IP
by Dirk Ertl 26 Apr '01

26 Apr '01

Hy Peter, thanks for your TIP: It´s Rock and Roll.Work´s fantastico. I think that´s just the way for NT network. So have a good time CU :-)) -----Ursprüngliche Nachricht----- Von: Peter Wiersig [mailto:wiersig@glamus.de] Gesendet: Montag, 23. April 2001 19:39 An: Dirk Ertl Betreff: Re: [suse-security] squid2 acl´s and dynamic IP Hallo Dirk, in den Sourcen von squid (ich glaube 2.1) habe ich mal ein Auth-"Plugin" fuer WinNT-Benutzerauthentifizierung gesehen, es aber nie ausprobiert. Peter Wiersig --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Dirk Ertl email: dirk(a)ertl-bln.de handy: +49 1794926359

1 0

[suse-security] nis+
by da_bug 26 Apr '01

26 Apr '01

hi! I want to use a service like nis in my linux-network but I think this is not really secure... (or is it?) Is there a way to use nis+ or something like this with x86-linux-server and linux-clients (I heard there is only a sever-version for sun...) ? bye.

4 4

logins in messages
by Rolf Schmid 26 Apr '01

26 Apr '01

Hello, in erlier versions of SuSE I had all logins via telnet or by the console in /var/log/messages: Apr 25 11:54:22 linux in.telnetd[6815]: connect from r1.sp.de Apr 25 11:54:26 linux login[6816]: ROOT LOGIN on `ttyp0' from `r1.sp.de' Now in SuSE 7.1 I don't get these entries. Does anybody know how to setup this logging ? Best regards Rolf Schmid

2 1

Suse firewall prevents dhcp
by gabriel rivera 26 Apr '01

26 Apr '01

Hello all, I have an internal fileserver that times out when attempting to get an IP from the dhcp server on startup. >From the log of the dhcp server: warhead dhcpd: DHCPDISCOVER from 00:60:67:22:bf:2d via eth1 warhead dhcpd: DHCPOFFER on 192.168.1.4 to 00:60:67:22:bf:2d via eth1 warhead kernel: Packet log: input DENY eth1 PROTO=17 192.168.1.1:67 255.255.255.255:68 L=328 S=0x00 I=58791 F=0x0000 T=64 (#6) A Why is the client host sending a broadcast packet to the bootp port? (I think this is what is happening). It is not configured to use bootp. Even when the firewall is config'd to allow bootp, the problem persists due to the source address of the packet. Any Ideas?? Thanks, Gabriel Rivera

4 3

Cascade FTP Proxy -> FTP Proxy
by Dirk Ertl 25 Apr '01

25 Apr '01

Helo folks, in our network we have a FTP Proxy for outgoing traffic. Now we have to bind a new Subnet with FTP traffic to the Internet. Default is to bind this Subnet with an FTP Proxy SuSE Suite. I´am in trouble to cascade these FTP Proxy´s. How is the right way in /etc/proxy-suite/ftp-proxy.conf? I tried with transparent or with listen on 0.0.0.0. With MagicUser Yes @theotherproxy.com:21 Is someone use Proxy cascade like this? Thank´s for support... Dirk Ertl email: dirk(a)ertl-bln.de handy: +49 1794926359

1 0

AW: [suse-security] squid2 acl´s and dynamic IP
by Dirk Ertl 25 Apr '01

25 Apr '01

Hy Peter, thanks for your TIP: It´s Rock and Roll.Work´s fantastico. I think that´s just the way for NT network. So have a good time CU :-)) -----Ursprüngliche Nachricht----- Von: Peter Wiersig [mailto:wiersig@glamus.de] Gesendet: Montag, 23. April 2001 19:39 An: Dirk Ertl Betreff: Re: [suse-security] squid2 acl´s and dynamic IP Hallo Dirk, in den Sourcen von squid (ich glaube 2.1) habe ich mal ein Auth-"Plugin" fuer WinNT-Benutzerauthentifizierung gesehen, es aber nie ausprobiert. Peter Wiersig

1 0

Re: [suse-security] Reasons for a system to freeze?
by David Henderson 25 Apr '01

25 Apr '01

Sven Michels wrote: > alter ego wrote: > >> My Linux box (SuSE 7.1, X, harden_suse) did strange things this morning >> and I wonder if there are some likely explanations or if this could be >> an attack: >> >> - while opening a large mail (about 245 K) with the Netscape Mail >> Client, Netscape stopped responding to user input (window was not >> repainted as well) >> - I tried switching to an open X-Term, but was not able to move the >> focus to that window >> - Switched to another console, logged in and tried killing the netscape >> process -> console ceased accepting input >> - Logged in remotely via ssh, which at first worked, but behaved weirdly >> (keystrokes were not displayed until the next key pressed) - then ssh >> ceased accepting input as well >> - switched the box off (Painful) and rebooted and everything worked >> - checked the log files (also firewall logs - I am behind a corporate >> FW), but could not find anything >> >> While this might not be a security related problem I'd appreciate any >> hints/tips/advice from the experts here. > > > > > Did you test to open the mail again after the reboot? maybe its some > mad code in it? Netscape also has many memleaks .. maybe you've just > read the mail on the wrong day for netscape [;)] i would check the mail > for some mad code. did you see the load of the maschine? I have had this happen several (at least 30-40 times over the past 3 weeks) times. It happens with either Netscape (reading mail or viewing a page) or RealPlayer. Nothing ever gets written to the log (or on console 10) to help point out the problem and when I read the e-mail after a rather painful reboot or return to the web page, no problem whatsoever. This rebooting thing was the main reason I stopped using Windows in 1994. I am very interested in solving this problem, but I have no idea where to begin to look. My guess is that this is security related as there is undoubtedly a memory leak somewhere, and where there is a memory leak, there is an exploit waiting to happen. Any help would be greatly appreciated!!!!!! Dave H System: Intel PIII 733 MHz (SMP, but only one processor installed) multiple PCI buses (2) matrox G400 dual head SuSE 7.1 with harden_suse reiser_fs on /, ext2 on /boot netscape6 and realplayer8 also cannot do a ps after netscape or realplayer hang PS Sorry Sven for sending this straight to you. I had intended to send this to the list. Not enough coffee yet this morning ;^) -- David A. Henderson, M.Sc. G. Cunningham Fellow Interdepartmental Genetics Program Department of Dairy Science 2010 Litton Reaves Hall Virginia Polytechnic Institute and State University Blacksburg, VA 24061 USA Phone: (540)231-4773 Fax: (540)231-5014 mailto://DHenders@VT.Edu http://www.dasc.vt.edu/henderson/dhenderson.html

4 6

sshd lets root login! Bug?
by Robert Sweet 25 Apr '01

25 Apr '01

How can we ssh into a box when root login is disabled. We have Marc Heuses New Firewall script running on a 7.1 Suse box using 2.4 kernel. Here are the open ports: Starting nmap V. 2.53 by fyodor(a)insecure.org ( www.insecure.org/nmap/ ) Interesting ports on YaddaYaddaYadda (XXXXXXXXXXX): (The 1516 ports scanned but not shown below are in state: filtered) Port State Service 21/tcp open ftp 22/tcp open ssh 25/tcp closed smtp 53/tcp open domain 80/tcp open http 113/tcp closed auth 123/tcp closed ntp Here is root logged on my friend's box locally and me logged in as root using ssh. root tty1 Apr 21 11:34 root tty2 Apr 21 11:38 root pts/0 Apr 21 11:35 (My.Box.At.Home) root pts/1 Apr 21 11:54 (My.Box.At.Home) Here is the output of /etc/securetty on the bad box: tty1 tty2 tty3 tty4 tty5 tty6 # for devfs: vc/1 vc/2 vc/3 vc/4 vc/5 vc/6 Any help on this one would be appreciated. We have shutdown sshd for now. Thanks -- _ _ __ _____ _____ ___| |_ | '__| / __\ \ /\ / / _ \/ _ \ __| | | _ \__ \\ V V / __/ __/ |_ |_|(_) |___/ \_/\_/ \___|\___|\__| rsweet(a)socal.rr.com "unix soit qui mal y pense."

5 5

Security Problems with Squid 2.2 Stable 5
by Ragucci＠t-online.de 24 Apr '01

24 Apr '01

Hello, I used nessus to check my Squid Proxy. I started the scan in the internal network. Nessus showed me the following vulnerabilities: - The proxy, allows everyone to perform requests against arbitrary ports, like 'GET http://cvs.nessus.org:110'. - The proxy allows the users to perform CONNECT requests like CONNECT http://cvs.nessus.org:23 - It was possible to make IIS use 100% of the CPU by sending it malformed extension data in the URL requested, preventing him to serve web pages to legitimate clients. - The misconfigured proxy accepts requests coming from anywhere. This allows attackers to gain some anonymity when browsing some sensitive sites using your proxy, making the remote sites think that the requests come from your network. - The misconfigured proxy accepts requests coming from anywhere. This allows attackers to gain some anonymity when browsing some sensitive sites using your proxy, making the remote sites think that the requests come from your network. - Information found on port unknown (3128/tcp) The remote web server type is : Squid/2.2.STABLE5 We recommend that you configure your web server to return bogus versions, so that it makes the cracker job more difficult What can I do? I'm running the SuSE_firewall script and I didn't set any ports @ FW_SERVICES_EXTERNAL_TCP. In my opinion nobody from the internet should be able to use my proxy - is that right? And why does nessus shows me informations about an IIS? Finally, how can I return bogus informations to hide my squid-version? Thanx for replies, Mario

4 3

RE: [suse-security] Re: reiserfs known problems
by Reckhard, Tobias 24 Apr '01

24 Apr '01

> Date: Mon, 23 Apr 2001 10:58:17 -0400 > From: Chris Mason <mason(a)suse.com> > To: grimmer(a)suse.de > Subject: RE reiserfs known problems > [snip] > Yes. An updated kernel that can deal with knfsd+reiserfs under 2.4 should > be available soon (today or tomorrow if all goes well in testing). In > general, we haven't really been calling this a security problem, it is > just > that reiserfs doesn't support knfsd at all in 2.4.x right now. > Is that supposed to mean that new RPMs will be made available or 'just' new tarballs at in people/mantel/next on the FTP server? Regards, Tobias

2 1