April 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Reasons for a system to freeze?
by alter ego 20 Apr '01

20 Apr '01

This sounds like my problem! I don't think it has anything to do with reiserfs (as some people suggested earlier), because I am not using reiserfs. I am however running httpd as well. My Kernel Version is 2.4 Markus Roth wrote: > > hello, > don't flame me if i'm wrong, but probably you got the same problem as i > do. i have the same kernel as you (David). > my mail from yesterday and the response from Markus Gaugusch: > > ------------- > > hello, > does somebody knows what's going on? my problem: > on the average twice per week a process remains suddenly > hang on my laptop (SuSE 7.1 / 2.4.0). As soon as I do a ps > or something similar this process hangs too. I straced the ps > command and got following output: > > [snip] > ipc_subcall(0x6, 0x816a308, 0x400, 0xd) = 480 > stat64("/proc/1234", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0 > open("/proc/1234/stat", O_RDONLY) = 7 > read(7, > <unfinished ...> > > It seems that every command hangs (ps, fuser, killall, netstat -ap) > that reads thru the proc file system and tries to open some files > of the process 1234. > > If I try to 'cat' the file /proc/1234/stat the same thing happens. > > I'm am absolutely not sure, but I guess the process > 1234 is httpd (apache 1.3.17 installed). Only if apache is running > this seams to happen. Unfortunately I can't identify the process > because every command I know reads from the proc file system. > > the bad thing is, I can't even reboot my machine because this tries > to terminate the processes and hangs too nor can I unmount my > partitions because they are busy. > > any ideas what this could be or what i should do? > greetings & thanks > markus > > ------------------- > > then Markus Gaugusch wrote: > if you enable "Magic SysRq Key" in kernel and rc.config, you can press > alt+prtscr+s to sync your disks, alt+prtscr+u to remount them readonly > and > alt+prtscr+b to reboot the machine. > > next time this happens to me i will try the hint from Markus Gaugusch > bye markus > > David Henderson wrote: > > > > Roman Drahtmueller wrote: > > > > > Guys, your problem descriptions lack a simple detail: The kernel version. > > > > 2.4.0-64GB-SMP > > > > I cannot use the 2.2.18 kernel since I have multiple PCI buses. I have > > tried using the 2.4.3 kernel from the SuSE source, but I have not had > > the time to fix the other issues (usbmgr, audio, etc...). Thanks and > > sorry!! > > > > Dave H > > > > -- > >

1 0

Dependancies for freeswan rpm?
by Geordon VanTassle 20 Apr '01

20 Apr '01

Anyone know what provides libgmp.so.3? I wanted to install the freeswan RPM, but need libgmp. Also, how can I determine where to get these dependancies in the future? T'anks, Geordon

4 4

snort and ADSL
by Togan Muftuoglu 20 Apr '01

20 Apr '01

Hi everyone, I am using snort that comes with 7.1 and configuring snort to work with pppoe has been a major issue. (OK maybe I am not seeing what I have to do). I have triedwww.vulnerebilites.org to nmap my IP but snort is not capturing anything. Any help is appreciated rp-pppoe is running on my firewall PC and there is masquareding for my home lan I'm starting snort via rcsnort which is /usr/sbin/snort -D -i ppp0 -c /etc/snort/snort-lib and this is my snort-lib # SET THIS VARIABLE TO COVER YOUR OWN NETWORK RANGE!!!! ############################################################################### var HOME_NET 192.168.1.0/24 ############################################################################### # SET THIS VARIABLE TO COVER YOUR OWN EXTERNAL RANGE!!!! ############################################################################### var EXTERNAL_NET [$ppp0_ADDRESS] # set your DNS server IP (or whatever) so you don't show "portscans" from # that address ############################################################################### # SET THIS VARIABLE TO AS IT APPLIES TO YOUR NETWORK!!!! ############################################################################### var DNS_SERVER 192.168.1.2/32 $EXTERNAL_NET/32 -- Togan Muftuoglu

1 0

Re: AW: [suse-security] Bind again
by Hipolito A. Gonzalez M. 20 Apr '01

20 Apr '01

Frank Lederer wrote: > Ok, I had also a bind-problem. I think, it was caused by some missconfigured > win2000-boxes in my lan. I have denied tcp-connections to port 53 from the > lan and now everything seems to work. Maybe this helps. > Regards > Frank > Ok but I'm a ISP, and can't close the 53 port. -- www.geekcode.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ h! r++ y++ ------END GEEK CODE BLOCK------ - A veces creo que hay vida en otros planetas, y a veces creo que no. En cualquiera de los dos casos, la conclusión es asombrosa (Carl Sagan) -----------------------------------------------------------------

1 0

deny an whole country
by rene marhold 20 Apr '01

20 Apr '01

Hello last night i found an list on ripe where to see all countries and ther ip ranges http://www.ripe.net/ripencc/mem-services/general/allocs4.html with an awk script i cut out everything but ips now ips are looking like 212.30/19 original uk.guernsey-telecoms (Guernsey Telecoms) 19980304 212.30/19 ALLOCATED PA command: ipchains -A input -s 212.30/19 -j DENY but in ipchains -L -n the rule is after this step DENY all ------ 212.0.0.0/19 0.0.0.0/0 n/a why where´s there the error??? ---------------- other question, someone now how to expand 212.30/19 with awk to an complete ip like 212.30.0.0/19 into an whole list?? list is like following "194.112.192/18", "212.126.64/19", "212.52.192/19", "213.153.32/19", "195.70.96/19", "194.118.0/19", "194.118.32/19", "194.118.64/18", "194.118.128/17", "62.140.32/19", "212.119.128/19", "62.178/15", "195.34.128/19", "212.17.64/18", "212.186.0/16", "213.47/16", "62.46/15", "195.3.64/18", "212.183/18", "212.183.64/18", "213.33/17", "194.183.128/19", "194.208.0/19", "194.208.32/19", "194.208.64/18", "194.208.128/17", "213.142.32/19", "62.218/16",

3 2

SuSE Security Announcement: hylafax (SuSE-SA:2001:15)
by Thomas Biege 20 Apr '01

20 Apr '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: hylafax Announcement-ID: SuSE-SA:2001:15 Date: Friday, April 20th, 2001 10.26 MEST Affected SuSE versions: [6.1, 6.2,] 6.3, 6.4, 7.0, 7.1 Vulnerability Type: local root compromise Severity (1-10): 7 SuSE default package: no Other affected systems: all systems using hylafax Content of this advisory: 1) security vulnerability resolved: hylafax problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The HylaFax program hfaxd(8c) implements the server part of the HylaFax package. It is started either by inetd(8) or runs in standalone mode. hfaxd(8c) offers three different protocols to process fax jobs. When hfaxd(8c) tries to change to it's queue directory and fails, it prints an error message via syslog by directly passing user supplied data as format string. As long as hfaxd(8c) is installed setuid root, this behavior could be exploited to gain root access locally. As a workaround remove the setuid bit: /bin/chmod u-s /usr/lib/fax/hfaxd or restrict access to trusted users only: /bin/chown root.trusted /usr/lib/fax/hfaxd /bin/chmod 4750 /usr/lib/fax/hfaxd Download the update package from locations described below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n3/hylafax-4.1beta2-251.i386.rpm a3d5d0d5a8977852b02dc9b7352054aa source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/hylafax-4.1beta2-251.src.rpm b5c8877de53db86eabfae932142221d7 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n2/hylafax-4.1beta2-254.i386.rpm 5be3094195a789d83b02d59ab343d7b5 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/hylafax-4.1beta2-254.src.rpm 87ee1d77eea95eac74c6b8355912ad9f SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n2/hylafax-4.1beta2-253.i386.rpm 90a894b8d47a94125992f3a64a6ada44 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/hylafax-4.1beta2-253.src.rpm 7b53ca017efdd9371c9a6207095a8c2f SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n2/hylafax-4.1beta2-252.i386.rpm 340e64a902a2e3f73b7d1771739c5b59 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/hylafax-4.1beta2-252.src.rpm edb05a6191ab7d5533d1d9eb9ef0d255 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n3/hylafax-4.1beta2-218.sparc.… 1449e568071f5fb6080efebb8f2a7a2b source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/hylafax-4.1beta2-218.src.r… bf8c780206da51bc548e9fd4264b9bfc SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n2/hylafax-4.1beta2-218.sparc.… bb265465ea8b84ca31b5c954266daf1d source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/hylafax-4.1beta2-218.src.r… b5bcae601fe056f399fc8696aa156529 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n2/hylafax-4.1beta2-211.alpha.rpm 2ee3176e2b425c494bd37d22f2ea090c source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/hylafax-4.1beta2-211.src.rpm f89c3771432d84a3e7c3ab2f4331d73c SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n2/hylafax-4.1beta2-211.alpha.rpm 5aecfb997867f8f72164f27dc220f95b source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/hylafax-4.1beta2-211.src.rpm 09f1cbb3714dfe75e1aa3ff2a52c13a3 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n2/hylafax-4.1beta2-211.alpha.rpm 39f12bc3f09bab26c60df98a2b52b64e source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/hylafax-4.1beta2-211.src.rpm 6a48eac9982dfca01a1ed904cacfb2c8 PPC PowerPC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n3/hylafax-4.1beta2-164.ppc.rpm a42c7bc70e25a6725d8e2a76870be1d4 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/hylafax-4.1beta2-164.src.rpm 9c064b869fb7c73f453a254b5f3780be SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n2/hylafax-4.1beta2-165.ppc.rpm 81387d514f089a7060bc6dacb15358a8 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/hylafax-4.1beta2-165.src.rpm 35ec2293fb0390cb827935499506ed89 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n2/hylafax-4.1beta2-165.ppc.rpm be20c8f1ef2488c8db711744eab2233b source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/hylafax-4.1beta2-165.src.rpm 4af4d6b8e948b39a1d4040adaad27c0a ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - Updated man RPMs will be available in a few days. - In the past weeks, some security related bugs in the Linux kernel 2.2 and 2.4 were found. An announcement, that addresses this will be released asap. - Samba has serveral security problems, which could lead to local root access. Samba 2.0.8 fixes these problems. New RPMs are currently being built. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOuACUHey5gA9JdPZAQHrdwf/TIjn3G879Q4Vb5im5T7CkHr+YF6pGbp4 NjxEM8j8lSPnXy1iJwYRuSV7UT7Jrcqe2lm008IUMD9xN73ybUjnjiG2dzCYfI52 xYImtlzTiAlaGVHtnPGBBj7K3MOLqCQsgr2FkjJ6/LOsdFrBSa2BNEcl+fy/9n72 2+fZN04hdgpkd9uGrbkZPch0XbYYG5Ij54lM2LKBqZ7RcAgtGToR8nJ/vyMCv9kJ ivPmPX6Jr/CYxw1gKNprpEAV9GiaI70rGDazW7bM9s94LVuEJmOt4bJzVnYzY3wK cz1UAnHZ3MWM8HmYj3Awl4elBmtFpiYJR8tfrc9pyOPSZir78ZvCdA== =KFNn -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 84

1 0

[suse-security] firewall.log - martian source
by mash＠myfuckingnet.com 20 Apr '01

20 Apr '01

I found these lines on my firewall.log, i would be thanked if somebody can explain me more less what happened here?... its on the internal network... SuSEfirewall 4.3 kernel 2.2.4 ... Apr 18 12:04:38 server kernel: martian source c799fea9 for c799fea9, dev eth0 Apr 18 12:04:38 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 06 Apr 18 12:05:48 server kernel: martian source c799fea9 for c799fea9, dev eth0 Apr 18 12:05:48 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 06 Apr 18 12:05:54 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:54 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:54 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:54 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:54 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:54 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:55 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:55 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:55 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:55 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:55 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:55 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:55 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:55 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:55 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:55 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:55 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:55 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 Apr 18 12:05:56 server kernel: martian source c799fea9 for fffffea9, dev eth0 Apr 18 12:05:56 server kernel: ll header: ff ff ff ff ff ff 00 02 44 1c 1e a0 08 00 See you on the son... Tomás

3 2

Strange behaviour ssh on 7.1 (RSA) ?
by Maarten van den Berg 20 Apr '01

20 Apr '01

Hi, I've found that I can no longer login using RSA challenge to an openssh server running on SuSE 7.1... Anyone else observed the same ? I've been checking and double-checking everything: filepermissions, server config, upgrading, running sshd in debug mode, but I can't find anything wrong. Of course my ssh-agent etc. is configured correctly. Needless to say, this is the only server I have problems with, out of a couple dozens, and coincidentally it is also the only machine running 7.1 Here are three sessions, the first is the wrong one, the second is for comparison only (and to reach machine #3). The third is from the other machine, back to the one that has the problem. The 'server' is running SuSE 7.1, both clients 7.0. Note that it doesn't matter which 7.0 machine I use to connect from; the sshd on the 7.1 machine invariably rejects it. "apoc": running 7.1, kernel 2.4.3 "morpheus": running 7.0 kernel 2.2.16-SMP "trinity": running 7.0 kernel 2.2.16 maarten@morpheus:~ > ssh -v apoc SSH Version OpenSSH_2.3.0p1, protocol versions 1.5/2.0. Compiled with SSL (0x0090581f). debug: Reading configuration data /etc/ssh/ssh_config debug: Applying options for * debug: Seeding random number generator debug: ssh_connect: getuid 500 geteuid 0 anon 0 debug: Connecting to apoc [x.x.x.x] port 22. debug: Seeding random number generator debug: Allocated local port 796. debug: Connection established. debug: Remote protocol version 1.99, remote software version OpenSSH_2.3.0p1 debug: no match: OpenSSH_2.3.0p1 debug: Local version string SSH-1.5-OpenSSH_2.3.0p1 debug: Waiting for server public key. debug: Received server public key (768 bits) and host key (1024 bits). debug: Host 'apoc' is known and matches the RSA host key. debug: Seeding random number generator debug: Encryption type: 3des debug: Sent encrypted session key. debug: Installing crc compensation attack detector. debug: Received encrypted confirmation. debug: Trying RSA authentication via agent with 'maarten@morpheus' debug: Server refused our key. debug: RSA authentication using agent refused. debug: Trying RSA authentication with key 'maarten@morpheus' debug: Server refused our key. debug: Doing password authentication. maarten@apoc's password: ^C maarten@morpheus:~ > ssh -v trinity SSH Version OpenSSH_2.3.0p1, protocol versions 1.5/2.0. Compiled with SSL (0x0090581f). debug: Reading configuration data /etc/ssh/ssh_config debug: Applying options for * debug: Seeding random number generator debug: ssh_connect: getuid 500 geteuid 0 anon 0 debug: Connecting to trinity [x.x.x.x] port 22. debug: Seeding random number generator debug: Allocated local port 950. debug: Connection established. debug: Remote protocol version 1.99, remote software version OpenSSH_2.3.0p1 debug: no match: OpenSSH_2.3.0p1 debug: Local version string SSH-1.5-OpenSSH_2.3.0p1 debug: Waiting for server public key. debug: Received server public key (768 bits) and host key (1024 bits). debug: Host 'trinity' is known and matches the RSA host key. debug: Seeding random number generator debug: Encryption type: 3des debug: Sent encrypted session key. debug: Installing crc compensation attack detector. debug: Received encrypted confirmation. debug: Trying RSA authentication via agent with 'maarten@morpheus' debug: Received RSA challenge from server. debug: Sending response to RSA challenge. debug: Remote: RSA authentication accepted. debug: RSA authentication accepted by server. debug: Requesting pty. debug: Requesting X11 forwarding with authentication spoofing. debug: Requesting shell. debug: Entering interactive session. Last login: Tue Apr 17 19:51:36 2001 from morpheus Have a lot of fun... maarten@trinity:~ > ssh -v apoc SSH Version OpenSSH_2.3.0p1, protocol versions 1.5/2.0. Compiled with SSL (0x0090581f). debug: Reading configuration data /etc/ssh/ssh_config debug: Seeding random number generator debug: ssh_connect: getuid 500 geteuid 0 anon 0 debug: Connecting to apoc [x.x.x.x] port 22. debug: Seeding random number generator debug: Allocated local port 1012. debug: Connection established. debug: Remote protocol version 1.99, remote software version OpenSSH_2.3.0p1 debug: no match: OpenSSH_2.3.0p1 debug: Local version string SSH-1.5-OpenSSH_2.3.0p1 debug: Waiting for server public key. debug: Received server public key (768 bits) and host key (1024 bits). debug: Host 'apoc' is known and matches the RSA host key. debug: Seeding random number generator debug: Encryption type: 3des debug: Sent encrypted session key. debug: Installing crc compensation attack detector. debug: Received encrypted confirmation. debug: Trying RSA authentication with key 'maarten@trinity' debug: Server refused our key. debug: Doing password authentication. maarten@apoc's password: ^C maarten@trinity:~ > I hope I've somehow overlooked something... If you have any pointers, Thanks in advance... Maarten

3 8

OT: unreadable postings in suse-security]
by Michael Blaesse 20 Apr '01

20 Apr '01

Hallo, Sorry that this posting is not security related. I have sent this message already to Gerd Bitzer, but got no answer. > > Hi, > > I can read only a few of your postings in suse-security with netscape > messenger, e.g. > -Re: [suse-security] ICQ File Transfers > -[suse-security] rc.firewall > > but not the three postings in the FTP daemons thread. They appear as > empty mails. > What is the difference between these mails? > Could you send me the three mails in the FTP daemons thread as privat > mail? One additional unreadable example: Re: [suse-security] Strange portmap package Has anybody else this probleme? Thanks, Michael Blaesse

8 10

IDS article on SuSE's Knowledge Portal
by Thomas Biege 20 Apr '01

20 Apr '01

Hi ppl, an article about Intrusion Detection Systems was released on SuSE's Knowledge Portal (http://portal.suse.de) It's available in englisch and german and is devided in two parts. The second part of the english version should be available in a few days. Thanks to the Portal Team! :-) Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 84

1 0