April 2001 - openSUSE Security - openSUSE Mailing Lists

Re: AW: AW: [suse-security] Bind again
by Hipolito A. Gonzalez M. 23 Apr '01

23 Apr '01

Frank Lederer wrote: > Why are you sure that you need tcp to 53? For normal requests udp is enough. > Or am I wrong... Can i close the 53 TCP? Are you sure? -- www.geekcode.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ h! r++ y++ ------END GEEK CODE BLOCK------ - A veces creo que hay vida en otros planetas, y a veces creo que no. En cualquiera de los dos casos, la conclusión es asombrosa (Carl Sagan) -----------------------------------------------------------------

4 3

iptables ip_conntrack_ftp security weakness and SuSE
by Reckhard, Tobias 23 Apr '01

23 Apr '01

Hi all and Roman specifically. As some of you may have already noticed, the FTP connection tracking in iptables/netfilter, the packet filtering code in the 2.4 kernels, is subject to a nasty bug, that, similarly to the Check Point and PIX issues last year, potentially renders the packet filter completely useless as arbitrary connections from an FTP server can be established. Those interested in the details can check out: http://netfilter.samba.org/security-fix/index.html. The netfilter crew have made a patch available that alleviates the issue, but it is for kernel 2.4.3 and not 2.4.2, which is the latest available from and officially supported by SuSE. In the light of this IMHO significant security issue, are SuSE planning on releasing a patched version of a 2.4 kernel anytime soon? I know that you don't recommend 2.4 for production machines yet, but that should not IMHO lead to delays in the distribution of fixes for important security issues such as this. Regards, Tobias Reckhard -- Tobias Reckhard secunet Security Networks AG Tel : +49(6196)95888-42 Mergenthalerallee 77 Fax : +49(6196)95888-88 D-65760 Eschborn E-Mail: reckhard(a)secunet.de

1 0

Re: [suse-security] Reasons for a system to freeze?
by Nick LeRoy 22 Apr '01

22 Apr '01

Hello, again... I think that it all has to do with the Linux kerne's policy of "overcommitment" of VM. There have been *many* long discussions of this on the linux kernel mailing list -- if you want to get *all* of the gory details plus *a lot* more, go do a search for "linux overcommit". The short answer is that the kernel *intentionally* will give applications more virtual memory than really exists. The argument goes that in a great many cases, the application never uses most a lot of that memory. Doesn't make sense? Try this example: "BigApplication" (i.e. emacs or netscape) has allocated 100M of RAM. User does something that causes it to run a sub-process "/bin/ls". BigApplication calls "fork()" and then the child process calls "exec()". If you the kernel *didn't* overcommit, and your didn't have another 100M of VM, the "fork()" would fail, even though several lines of code later the child process exec's "ls" which needs *much less* VM than BigApplication. There are other scenerios, as well, where overcommitment is a *good thing*, but it does have it's downsides, too... The 2.4 kernel has a built-in "out of memory" killer which attempts to kill the process(s) that are sucking the life out of the system. I think that in 2.4.3 it's getting pretty good. I think that the behaviour of Solaris and other kernels is somewhat different -- they don't overcommit, but handle VM in a very different way, but I don't remember the details. Many on the l-k list contend that the Linux way provides better performance, etc., BTW. Later -Nick > On Sun, 22 Apr 2001, Ashley wrote: > > > I would like to see your script. It sounds useful. Perhaps even > > more than $0.02 worth. > > > > On Fri, Apr 20, 2001 at 07:42:32PM +0600, Nick LeRoy wrote: > > > Hello... > > > > > > Just thought I'd add my $0.02 worth in... > > > > > > I *always* run netscape from a script which uses ulimit to set the amount of memory it can get. If I don't, it sometimes sucks the life out of the machine in similar ways by using all memory. With it ulimitted, it dies after a while (when it can't get any more memory), but my system still lives on. I've been doing this for serveral years. > > Hello, > I would like to know, if this is Linux specific, or am I able to crash (or > freeze) any Unix (Solaris for example) just by eating a lot of memory? > Where does this problem come from? When a programm calls a malloc (or > something like that), I think the system should return an error, if there > is not enough memory. It seems that Linux does *not* return an error (or > only too late). > Am I right or wrong? > Regards, Peter > > -- > Peter Münster > <A HREF="http://notrix.net/pm-vcard" TARGET="_new"><FONT COLOR="BLUE">http://notrix.net/pm-vcard</FONT></A> > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > -- Get your free email from www.linuxmail.org Powered by Outblaze

1 0

AW: [suse-security] hex IP Addresses - reading direction [was: fi rewall.log - martian source]
by Thomas Lamy 22 Apr '01

22 Apr '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Steffen Dettmer [mailto:steffen@dett.de] wrote: > * Hella.Breitkopf(a)varetis.de wrote on Fri, Apr 20, 2001 at > 20:16 +0200: > > mash(a)myfuckingnet.com on Thu, Apr 19, 2001 at 10:41 +0200 > > had found the martians in his log files: > > >> Apr 18 12:04:38 server kernel: martian source > > >> c799fea9 for c799fea9, dev eth0 > > > > Steffen Dettmer <steffen(a)dett.de> > > had some perl code to decode this: > > * Hella.Breitkopf(a)varetis.de wrote on Fri, Apr 20, 2001 at 20:16 > +0200 had thesis about that: > > > [THESIS 1] > > So are there two possibilities to write hex IP addresses > and the found > > "martians" > > in the log files are written backwards (right to left) > > I think that's it, and that's why the scripts is like is it. I > wrote it when I got a martian from 192.168.1.255. But maybe this > came from 255.1.168.192 - but this looks not familar... But I > have never confirmed hat or whatever. The script may be wrong. > Look at the kernel sources if unsure. > > > I haven't found any prove for one of these thesises - but would > > be very interested in resources proving one of the two. > *** > *Steffen Dettmer* proved that the address logs are done in network > byte order > > But back to security. You told: > > > ff ff fe a9 is in my universe (if read from left to right) = > > 255.255.254.169 > > which makes me assume that 169.254.255.255 is not. A whois shows > quickly: > > Netname: LINKLOCAL > > hum! Such a funny thing. But who should recognize LINKLOCAL in > hex and network byte order! :) funny :) :) > > So maybe there's some Win host getting bored and sending junk... > To learn more about link local, use your favorite search engine. > I've forgotten the story. > > As I told, check for move laptops and such things. > I did not find the right RFC, but at least Microsoft and Apple dynamically assign 169.254/16 IP addresses to DHCP clients when their DHCP-requests time out (they call it "Plug-And-Play Networking"). Just my $0.02 Thomas -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA/AwUBOuHYnUJRmQkE7ThJEQKZoACgweEGeVjJdaDLpmfQrHUasWDCcPsAnRYG JtI4Nzzynh3H9ixHWZmGRXl4 =hkib -----END PGP SIGNATURE-----

2 1

snort doesn't see nmap ack scans?
by Philipp Snizek 21 Apr '01

21 Apr '01

Dear list-users, I suspect Snort 1.7 not to see nmap ack scans. But I'm not sure about that. These are the snort rules I run (pretty much, I know): #include local.rules include /snortrules/exploit.rules include /snortrules/scan.rules include /snortrules/finger.rules include /snortrules/ftp.rules include /snortrules/telnet.rules include /snortrules/smtp.rules include /snortrules/rpc.rules include /snortrules/rservices.rules include /snortrules/backdoor.rules include /snortrules/dos.rules include /snortrules/ddos.rules #include dns.rules #include netbios.rules #include sql.rules include /snortrules/web-cgi.rules include /snortrules/web-coldfusion.rules include /snortrules/web-frontpage.rules include /snortrules/web-misc.rules include /snortrules/web-iis.rules include /snortrules/icmp.rules include /snortrules/misc.rules #include policy.rules #include info.rules #include virus.rules This is the test I've been doing: I'd be interested in identifying nmap os fingerprints with snort. I could find out nmap os fingerprint test 1 - 7 but cannot get further with nmap test 4 and 6: Apr 20 13:21:59 212.232.168.184:53180 -> 212.232.168.180:22 SYN *2****S* RESERVEDBITS nmap test 1 is a tcp syn packet to an open Port. Apr 20 13:21:59 212.232.168.184:53181 -> 212.232.168.180:22 NULL ******** nmap test 2 is a tcp null packet to an open port Apr 20 13:21:59 212.232.168.184:53182 -> 212.232.168.180:22 NMAPID **U*P*SF nmap test 3 sends a combination of urgent, push, syn und fin to an open port where is snort's ack rule for nmap test 4 (tcp ack to an open port)? Apr 20 13:21:59 212.232.168.184:53184 -> 212.232.168.180:1 SYN ******S* This is nmap test 5 sending a syn to a closed port where is snort's ack rule for nmap test 6 (tcp ack to a closed port)? Apr 20 13:21:59 212.232.168.184:53186 -> 212.232.168.180:1 XMAS **U*P**F nmap test 7 sending a tcp combination of urgent, push and fin to a closed port I hope somebody of you has got an answer on how to make Snort see ack scans. Thanx Philipp

2 1

hex IP Addresses - reading direction [was: firewall.log - martian source]
by Hella.Breitkopf＠varetis.de 21 Apr '01

21 Apr '01

mash(a)myfuckingnet.com on Thu, Apr 19, 2001 at 10:41 +0200 had found the martians in his log files: >> Apr 18 12:04:38 server kernel: martian source >> c799fea9 for c799fea9, dev eth0 Steffen Dettmer <steffen(a)dett.de> had some perl code to decode this: >to convert hex to IP you may use the following one-liner: > >perl -e '$a=shift;{printf "%d.%d.%d.%d\n", > ("0x" . substr($a,6,2)), > ("0x" . substr($a,4,2)), > ("0x" . substr($a,2,2)), > ("0x" . substr($a,0,2));}' <string> > >[this works at least on intel archs] [snip] >fffffea9 = 169.254.255.255 Err, and here starts my problem: ff ff fe a9 is in my universe (if read from left to right) = 255.255.254.169 (but a9feffff *is* 169.254.255.255) The script does it backwards ... I know that e.g. AIX is using sometimes hex IP addresses, and all IP addresses I've seen were read from left to right. [THESIS 1] So are there two possibilities to write hex IP addresses and the found "martians" in the log files are written backwards (right to left) OR [THESIS 2] is the script in all cases wrong and should be corrected to: perl -e '$a=shift;{printf "%d.%d.%d.%d\n", ("0x" . substr($a,0,2)), ("0x" . substr($a,2,2)), ("0x" . substr($a,4,2)), ("0x" . substr($a,6,2));}' <string> I haven't found any prove for one of these thesises - but would be very interested in resources proving one of the two. Since this has at least connections with log files one could argue this on topic with security ;-) (otherwise flame me). regards, Hella Breitkopf -- -- -- -- -- hella.breitkopf(a)varetis.de unix administrator technical infrastructure varetis COMMUNICATIONS GmbH

2 1

Mirroring updates directory
by RoMaN SoFt / LLFB!! 20 Apr '01

20 Apr '01

Hello. Let's suppose I want to have a mirror of *all* 6.4 suse updates. I have several SuSE machines and I'm going to set up on each machine an auto-update script which checks for newer packets by ftp'ing to my local mirror. I've created this script: LOCAL=/usr/local/ftp/pub/suse/update wget -m -nH --cut-dirs=4 -P ${LOCAL} ftp://ftp.suse.de/pub/suse/i386/update/6.4 wget -m -nH --cut-dirs=4 -P ${LOCAL} ftp://ftp.suse.com/pub/suse/i386/update/6.4 First I download packets from the German site which if I'm not wrong they are the ones with license/exports problem. Second, I download the rest of the packets from "official" site. Can I trust rpm's not being duplicated on both sites? What's the SuSE's policy about this? I think I'm right but.. Am I missing some important update packets on another directory? I need to be sure I'm not missing rpm's. The script is executed regularly by cron (one time per week is sufficient?). Is there any way of removing old packets from my mirror? This would be avoid a situation like this: -r--r--r-- 1 root root 453985 Aug 29 2000 timezone-2.1.3-150.i386.rpm -r--rw-r-- 1 root root 452109 Jan 25 17:07 timezone-2.1.3-155.i386.rpm Both files are kept in my local mirror. This is unnecessary. Is it safe to delete automatically (I'll write some script lines) the old files? (eg: compare xxx-2.1.3-150.yyy < xxx-2.1.3-155.yyy and remove the first one). Would I break something? TIA =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

8 15

Re: [suse-security] Reasons for a system to freeze?
by Yuri Robbers 20 Apr '01

20 Apr '01

I've had the same problem with several other programs (all non-SuSE; most notably Mathematica), and implemented the same solution... this basically solves the problem, but it's still possible for a malicious user (or a curious user finding the binaries which I renamed DoNotRunThis01 etc.) to run the original program directly (i.e. without the ulimit wrapper script), and crash the machine. Does anyone know whether mozilla has this problem too? It might be a good idea to uninstall netscape and use mozilla instead. That would get rid of the problem for one application at least... Cheers, Yuri. > Hello... > > Just thought I'd add my $0.02 worth in... > > I *always* run netscape from a script which uses ulimit to set the > amount of memory it can get. If I don't, it sometimes sucks the life > out of the machine in similar ways by using all memory. With it > ulimitted, it dies after a while (when it can't get any more memory), > but my system still lives on. I've been doing this for serveral > years. > > -Nick

1 0

Firewall
by Maximiliano A. Benitez 20 Apr '01

20 Apr '01

Howto i config firewall.rc.config in linux suse 7.0 and howto setup ipchains i have two ethernet adapter whit ip public

10 13

Is SuSE offering a RPM for sendmail 8.11.3 ???
by Marko Kaening 20 Apr '01

20 Apr '01

Hi, I would like to use the newest sendmail with authenticated smtp but couldn't find a rpm anywhere on suse. Is somebody planning to create something like that, usable also for a SuSE 6.3??? I tried to compile it myself with BerkeleyDB, sfio + patch, openssl, cyrus-sasl but still don't know whether I might succeed... there are just too many things one needs to know... Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

4 6