April 2001 - openSUSE Security - openSUSE Mailing Lists

nss vs. pam
by Egan 23 Apr '01

23 Apr '01

Can anyone explain the interaction between nss vs. pam? I just discovered the nss_db package and it looks like what I need, more than pam. I want to create a system account for every user, but I want to avoid linear search lookups in a large plaintext /etc/passwd file. It looks like nss_db might solve that problem. Since I don't care about external authentication, can I remove pam, to speed things up?

1 0

Re: [suse-security] Reasons for a system to freeze?
by Nick LeRoy 23 Apr '01

23 Apr '01

Hello... Just thought I'd add my $0.02 worth in... I *always* run netscape from a script which uses ulimit to set the amount of memory it can get. If I don't, it sometimes sucks the life out of the machine in similar ways by using all memory. With it ulimitted, it dies after a while (when it can't get any more memory), but my system still lives on. I've been doing this for serveral years. -Nick > > > While this might not be a security related problem I'd appreciate any > > > hints/tips/advice from the experts here. > > > > Did you test to open the mail again after the reboot? maybe its some > > mad code in it? Netscape also has many memleaks .. maybe you've just > > read the mail on the wrong day for netscape ;) i would check the mail > > for some mad code. did you see the load of the maschine? > > > > I tried opening the mail (cautiously) and it worked fine ... hmmm. It's > a php-general-list-digest, so it does contain code snippets. > > I was not able to see the machine load. I tried top, but the command did > not produce any output. This was about the same time, my ssh died. -- Get your free email from www.linuxmail.org Powered by Outblaze

6 6

Re: reiserfs known problems
by Lenz Grimmer 23 Apr '01

23 Apr '01

Hi, here the answer from our ReiserFS guy. Bye, LenZ -- ------------------------------------------------------------------ Lenz Grimmer SuSE GmbH mailto:grimmer@suse.de Schanzaeckerstr. 10 http://www.suse.de/~grimmer/ 90443 Nuernberg, Germany There's no future in time travel. ---------- Forwarded message ---------- Date: Mon, 23 Apr 2001 10:58:17 -0400 From: Chris Mason <mason(a)suse.com> To: grimmer(a)suse.de Subject: RE reiserfs known problems -------------------------------- On Monday, April 23, 2001 03:38:09 PM +0200 Gerhard den Hollander <gerhard(a)jasongeo.com> wrote: > I understand from reading through the Reiserfs mailinglists that the > combination of reiserfs and knfsd causes problems. > > I am expereicneing these problems on one of my machines. > > Bascially what happens is that the combo knfsd/reiserfs causes the inode > table to screw up, meaning that entire directories appear to be totally > gone from the disk. > > Now this may not be considered a security issue, but it's hurting the > security of my machine rather badly ;) .. > > I checked the suse website, but doidn't find any updates for this. > > is an update for Suse 7.1 / kernel 2.4 being considered for this ? > Yes. An updated kernel that can deal with knfsd+reiserfs under 2.4 should be available soon (today or tomorrow if all goes well in testing). In general, we haven't really been calling this a security problem, it is just that reiserfs doesn't support knfsd at all in 2.4.x right now. -chris

1 0

reiserfs known problems ?
by Gerhard den Hollander 23 Apr '01

23 Apr '01

I understand from reading through the Reiserfs mailinglists that the combination of reiserfs and knfsd causes problems. I am expereicneing these problems on one of my machines. Bascially what happens is that the combo knfsd/reiserfs causes the inode table to screw up, meaning that entire directories appear to be totally gone from the disk. Now this may not be considered a security issue, but it's hurting the security of my machine rather badly ;) .. I checked the suse website, but doidn't find any updates for this. is an update for Suse 7.1 / kernel 2.4 being considered for this ? Currently listening to: The Tea Party - The Halcyon Days (Live-Ottawa) () Gerhard, [@jasongeo.com] == The Acoustic Motorbiker == -- __O I spoke about wings ... You just flew =`\<, I wondered, I guessed and I tried ... You just knew (=)/(=) I sighed ... And you swooned I saw the crescent ... You saw the whole of the moon

1 0

Re: [suse-security] Reasons for a system to freeze?
by Nick LeRoy 23 Apr '01

23 Apr '01

> Hi! > > On Sun, 22 Apr 2001, Nick LeRoy wrote: > > > I've been asked by several people for my Netscape script. So, I'll post it here. It's *very* simple, so don't expect too much. > > > > #! /bin/bash > > LIMIT=164000 > > killall -9 netscape > > ulimit -m $LIMIT -v $LIMIT -d $LIMIT > > ulimit -a > > nice -2 netscape & > > Any reason you don't execute the SuSE-supplied "Netscape" wrapper > script in the last line? > (Just curious...) Honestly.... I wrote this script long before I'd ever tried SuSE. -Nick -- Get your free email from www.linuxmail.org Powered by Outblaze

1 0

machine hangs!
by semat 23 Apr '01

23 Apr '01

I am running SuSE linux 6.4 on a 500 MHZ processor 128MB RAM and 128MB swap. Problem: Everyday this machine suddenly does some sort of hang. I suddenyl cannot ssh to it it times out, same thing with services from inetd like ftp. I even tried to enable telnet but it also times out. At this point people can still browse pages from this machien and all the pages are fine but any cgi script does not execute with the message: The server encountered an internal error or misconfiguration and was unable to complete your request. Upon rebooting the server these problems always go away and it functions again properly and then later starts the same behaviour. I have failed to find evidence of a break in in my logs and I am running all the latest upgraded packages for security fixes. The only services available to the world are dns bind 8.2.3-REL apache 1.3.19 openssh latest from the suse site ftp vsftpd-0.0.15 ALl other ports are closed by an ipchains firewall. The kernel is patched with solar designers secure_linux patch, LIDS is installed and snort and a whole array of IDSes.

2 2

[suse-security] adress rewriting, sendmail 8.11.0
by Robert Rinnberger 23 Apr '01

23 Apr '01

Hello, I try to setup address rewriting with /etc/mail/genericstable and /etc/mail/virtusertable on my mail-relay with sendmail 8.11.0. I have an internal host, which has configured as SENDMAIL-RELAY my mail-relay, the variable FROM-HEADER is empty. My mail-relay is connected to the Internet, the FROM-HEADER ist set to "mydomain". I've configured a file genericstable and virtusertable like this. /etc/mail/genericstable: usr1(a)host1.mydomain usr1@mydomain /etc/mail/virtusertable: usr1@mydomain usr1(a)host1.mydomain The problem ist, if I send a mail from the internal host to the internet, the from-address is not rewrited, but if I send a mail from the Internet to "usr1@mydomain" the address is rewrited to usr1(a)host1.mydomain. All internal mail from usr1(a)host1.mydomain to usr2(a)host2.mydomain should not be rewrited. The address rewriting works only for incoming mail, not for outgoing. Any ideas? Thanks, Robert

1 0

Re: [suse-security] Reasons for a system to freeze?
by Nick LeRoy 23 Apr '01

23 Apr '01

Ashley & SuSE Security bunch.. I've been asked by several people for my Netscape script. So, I'll post it here. It's *very* simple, so don't expect too much. -Nick #! /bin/bash LIMIT=164000 killall -9 netscape ulimit -m $LIMIT -v $LIMIT -d $LIMIT ulimit -a nice -2 netscape & > I would like to see your script. It sounds useful. Perhaps even > more than $0.02 worth. > > > On Fri, Apr 20, 2001 at 07:42:32PM +0600, Nick LeRoy wrote: > > Hello... > > > > Just thought I'd add my $0.02 worth in... > > > > I *always* run netscape from a script which uses ulimit to set the amount of memory it can get. If I don't, it sometimes sucks the life out of the machine in similar ways by using all memory. With it ulimitted, it dies after a while (when it can't get any more memory), but my system still lives on. I've been doing this for serveral years. > > > > -Nick > > > > > > > While this might not be a security related problem I'd appreciate any > > > > > hints/tips/advice from the experts here. > > > > > > > > Did you test to open the mail again after the reboot? maybe its some > > > > mad code in it? Netscape also has many memleaks .. maybe you've just > > > > read the mail on the wrong day for netscape ;) i would check the mail > > > > for some mad code. did you see the load of the maschine? > > > > > > > > > > I tried opening the mail (cautiously) and it worked fine ... hmmm. It's > > > a php-general-list-digest, so it does contain code snippets. > > > > > > I was not able to see the machine load. I tried top, but the command did > > > not produce any output. This was about the same time, my ssh died. > > > > -- > > > > Get your free email from www.linuxmail.org > > > > > > Powered by Outblaze > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > > -- > -ashley > > One of these days I'm going to completely organize my life. > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > -- Get your free email from www.linuxmail.org Powered by Outblaze

2 1

recursive shellscript
by Kurt Seifried 23 Apr '01

23 Apr '01

Same diff. (root/user, when it comes to locally dos'ing a box it doesn't really matter). >No, i was a normal user. That's why i was so surprised. You ran out of file descriptors. etc. this is why you limit users. As for limiting uysers by default as emmerich mentions what are appropriate limits then for users? Some people have small servers, others have large servers. Some people have a LOT of users logged in, some have very few. etc. If you're going to setup a server and give users accounts you can be expected to assume a certain amount of risk. Whether you choose to minimize this risk is largely up to you, the OS vendor can't do it all. Also html email sucks. I apologize for not cutting and pasting, instead I hit reply, and outlook defaulted to replying to the html email as html email. In future I won't bother to respond to html email on this list (which saves me time too =). Kurt Seifried, seifried(a)securityportal.com Securityportal - your focal point for security on the 'net

1 0

Re: [suse-security] Recursive Shellscript
by emm＠eggler.ch 23 Apr '01

23 Apr '01

At Mon, 23 Apr 2001 02:04:45 -0600 , "Kurt Seifried" <listuser(a)seifried.org> wrote: >Let me guess. you did this as root. Oh my god, surprise surprise. <seifried-mode> let me guess. you haven't read the original posting ("I executed it as normal user [...]"). </seifried-mode> ;-) to me, this behaviour (which i did not try to reproduce and therfor i'm not sure it really is like described) is a security-problem. it means, any normal user can __very__ easily stop any machine he or she wants to. the limits kurt talks about should be activated by default. --emmerich > >Learn about imposing limits via PAM. (hint: www.sysadminmag.com).=20 > >Kurt Seifried, seifried(a)securityportal.com >Securityportal - your focal point for security on the 'net > > > > ----- Original Message -----=20 > From: Peer-Christoph Mettelem=20 > To: suse-security=20 > Sent: Monday, April 23, 2001 1:48 AM > Subject: [suse-security] Recursive Shellscript > > > Hi, > > =20 > > I just wrote a shell script which looks like this: > > while true > > do > > $0 > > done > > =20 > > I executed it as normal user and then the following happened: As you = >can imagine, very many shells were started (i wasn't able to count them = >because the system wasn't responding any more). And then the system = >started killing system processes like X and smbd. I got the following = >output on console 10: > > Apr 23 09:11:54 AlBundy kernel: VM: killing process kmail > > Apr 23 09:12:52 AlBundy kernel: VM: killing process smbd > > Apr 23 09:13:03 AlBundy kernel: VM: killing process smbd > > Apr 23 09:13:05 AlBundy kernel: VM: killing process xconsole > > Apr 23 09:13:13 AlBundy kernel: VM: killing process X > > =20 > > The system recovered itself by killing X. That worked because i = >started the script from a shell in KDE. But if the script would be = >started within a telnet session, it could be more dangerous. > > =20 > > I don't know if this is a security hole, but it might be. > > =20 > > My system: > > SuSE 7.0 (kernel 2.2.18) > > Lots of updates and patches installed > > PII 350 MHz > > 320 MB RAM > > =20 > > Peer-Christoph Mettelem > > BezRegMS (NRW, Germany) > > Software developer (trainee) > > =20 > > PS.: This is my first mail to the mailing list. Sorry if it's OT or = >something... > >

1 0