May 2001 - openSUSE Security - openSUSE Mailing Lists

copying users/pwd from one box to another
by stephane parenton 28 May '01

28 May '01

hi, I'm running some servers and I would like to change one of the server with another box, that is more "up-to-date" regarding the CPU/Memory/Disk and OS... The old box is run by a RH6.0 and the new one will be a SuSE 7.0... the question is, how can I move all the users if i tell you that i don't want the passwords to be changed... The box existed long before I was here, so i don't know every password (especially our customers password). Is it possible to copy one password file from one box to another in order to keep the same passwords for all the users ?.... and is there a sure way to transfer all users once for all whithout any doubt ?... TIA Stephane Parenton

2 1

RE: [suse-security] copying users/pwd from one box to another
by José Luis Ledesma 28 May '01

28 May '01

Copy /etc/passwd /etc/shadow /etc/group I think that only with that will work, but be careful if your RH6.0 have shadowing or not. Check if in the redhat exists the file /etc/shadow, if doesn't install the shadowing package or put the passwords of shadow in passwd. Regards José Luis Ledesma Technology Dep. _____________________ COMPETITIVENESS Parque Tecnológico del Vallés 08290 Barcelona - Spain http://www.competitiveness.com Tel.: +34 66 986 55 17 Fax: +34 93 582 01 59 -----Original Message----- From: stephane parenton [mailto:sparenton@experia.com] Sent: lunes 28 de mayo de 2001 12:29 To: suse-security(a)suse.com Subject: [suse-security] copying users/pwd from one box to another hi, I'm running some servers and I would like to change one of the server with another box, that is more "up-to-date" regarding the CPU/Memory/Disk and OS... The old box is run by a RH6.0 and the new one will be a SuSE 7.0... the question is, how can I move all the users if i tell you that i don't want the passwords to be changed... The box existed long before I was here, so i don't know every password (especially our customers password). Is it possible to copy one password file from one box to another in order to keep the same passwords for all the users ?.... and is there a sure way to transfer all users once for all whithout any doubt ?... TIA Stephane Parenton --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

FW: [suse-security] OpenSSH on SuSE 6.3 --> 'PAM adding faulty mo dule: /lib/security/pam_pwcheck.so'
by José Luis Ledesma 28 May '01

28 May '01

In the /etc/pam.d/ you have the security libs you use for telnet, ftp, and openssh too. Probably you don't have the file /lib/security/pam_pwcheck.so on your linux. You can copy it from SuSE 7.0, or you can try to modify the openssh pam file... Regards José Luis Ledesma Technology Dep. _____________________ COMPETITIVENESS Parque Tecnológico del Vallés 08290 Barcelona - Spain http://www.competitiveness.com Tel.: +34 66 986 55 17 Fax: +34 93 582 01 59 -----Original Message----- From: Alex Liesch [mailto:aliesch@web.de] Sent: domingo 27 de mayo de 2001 16:54 To: suse-security(a)suse.com Subject: [suse-security] OpenSSH on SuSE 6.3 --> 'PAM adding faulty module: /lib/security/pam_pwcheck.so' Hi! I've updated one of my older linux servers running SuSE 6.3 to openssh (2.3.0p1) from "the" ssh. Now I have the following entries in messages each time a user logs in: May 27 16:47:25 r100 sshd[16621]: PAM unable to dlopen(/lib/security/pam_pwcheck.so) May 27 16:47:25 r100 sshd[16621]: PAM [dlerror: /lib/security/pam_pwcheck.so: cannot open shared object file: No such file or directory] May 27 16:47:25 r100 sshd[16621]: PAM adding faulty module: /lib/security/pam_pwcheck.so What is 'pam_pwcheck.so' for? My SuSE 7.0 box does have one. Yast did not show any unfulfilled dependencies. Alex. -- Alexander Liesch http://www.alexliesch.de/alex/ Lichtwiesenweg 9 Phone: +49 (0)6151 154715 64287 Darmstadt Fax/UMS: +49 (0)1212 5 10309699 Germany GnuPG/PGP-Key: 0xBC985C75 --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

some kind of attack?
by Daniel Quappe 28 May '01

28 May '01

hi list, got this message some minutes ago May 2 12:25:55 server kernel: Packet log: input DENY eth0 PROTO=1 192.168.0.2:3 this.is.my.ip:1 L=88 S=0x00 I=52687 F=0x000 0 T=243 where eth0 is the outbound-interface which is protected by ipchains from ip-spoofing. some kind of attack?! any ideas are appreciated...;-) many thanks in advance, bye, daniel

5 6

Antwort: [suse-security] configuring firewalls with iptables
by Stefan_Walther＠gehag-dsk.de 27 May '01

27 May '01

#!/bin/sh echo "starting firewall" # interfaces EXT="ippp+" # external interface (maybe a tokenring-card or anthing else; point to the internet) INT="eth+" # internal interface (point to your lan) LO="lo" # loopbackinterface # IP-adresses INTIP="192.168.0.1" # your local ip for your lan (internal ip) ANY="0.0.0.0/0" # all other ip's (maybe you need it in further times) # ports PRIVP="0:1023" # priviliged ports UNPRI="1024:65535" # unpriviliged ports # SYNFLOODING echo 1 > /proc/sys/net/ipv4/tcp_syncookies # Source Address Verification on for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > f done # IP-forwarding on echo 1 > /proc/sys/net/ipv4/ip_forward iptables -P INPUT DROP # drop all incoming packets iptables -P OUTPUT DROP # drop all outcoming packets iptables -P FORWARD DROP # drop all forwarded packets iptables -X # delete all userdefined tables iptables -F # flushing tables iptables -t nat -F # flushing nat-tables iptables -t nat -X # deleting userdefined nat-tables # ignore waste coming from your windowslan # netbios (drop it before writing these messages into your firewall-logfile) iptables -A INPUT -i $EXT -p tcp --sport 137:139 -j DROP iptables -A INPUT -i $EXT -p tcp --dport 137:139 -j DROP # droping bootp and tftp connections (if you have thin clients or some boxes booting from a server via bootrom) iptables -A INPUT -p tcp --sport 67:68 -j DROP iptables -A INPUT -p tcp --dport 67:68 -j DROP # no limits for connections comming from your lan (maybe specify some single rules ex.: SSH, DNS, HTTP...) iptables -A INPUT -i $INT -j ACCEPT iptables -A OUTPUT -o $INT -j ACCEPT # no limits for your LOOPBACK-device iptables -A INPUT -i $LO -j ACCEPT iptables -A OUTPUT -o $LO -j ACCEPT # do want to ping from your firewall iptables -A INPUT -p icmp -j ACCEPT iptables -A OUTPUT -p icmp -j ACCEPT iptables -A FORWARD -p icmp -j ACCEPT ########################################################################## # NAT (MASQUERADING) # replace your local-ip from lan with the offical Internet-IP you got from your ISP ########################################################################## echo "NAT" iptables -t nat -A POSTROUTING -o $EXT -j MASQUERADE iptables -A FORWARD -i $EXT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i $EXT -m state --state NEW -j ACCEPT ########################################################################## # DNS # allows you to connect to an DNS-Server of your ISP or other ########################################################################## echo "DNS" iptables -A OUTPUT -o $EXT -p udp --sport 1024:65535 --dport 53 -j ACCEPT iptables -A INPUT -i $EXT -p udp --sport 53 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -o $EXT -p tcp --sport $UNPRI --dport 53 -j ACCEPT iptables -A INPUT -i $EXT -p tcp --sport 53 --dport $UNPRI -j ACCEPT # LOG anything else with setting som prefixes infront of any message in your firewall-log # you should add one of the following line to your syslog.conf in /etc # kern.* /dev/tty11 # most tty11 is unused and you see a blank screen when switching (same tty12) # or/and # kern.* /var/log/firewall # here you write every message comming from the kernel in the file firewall iptables -A INPUT -j LOG --log-prefix "input " iptables -A OUTPUT -j LOG --log-prefix "output " iptables -A FORWARD -j LOG --log-prefix "forward " echo "READY" MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: 030/89786448 Funk: 0172/3943961

2 1

cannot ping using firewall
by Pupeno 27 May '01

27 May '01

I download SuSEfirewall 2 because I'm running on kernel 2.4. I installed and configured it (configuration file attached), I don't know why, nobody can ping me and I cannot ping nobody (not even me: 127.0.0.1). >From the internal network, they can telnet me, I can see samba shares on internal computers, fetching mail from internal network works good, but www is very slow!!! Is there any way to just configure iptables, not using this, but using a SuSE compatible way (I know, I can just write a script and put it anywhere and run it at start up, but, when I use a distribution I like doing the things in the distribution way). Thank you. -- Pupeno: pupeno(a)pupeno.com.ar http://www.pupeno.com.ar -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/support/faq and the archives at http://lists.suse.com

1 0

[suse-security] iptables-logging
by da_bug 27 May '01

27 May '01

Hi! With ipchains I could have a rule like this: ipchains -A INPUT ... -j DENY -l <- and because of the "-l" I had log-messages of this rule in my /var/log/messages. How can this be done with iptables? Bye.

4 4

how to close "pending" connections: SYN_RECV
by N. Aust 27 May '01

27 May '01

after being syn flooded two weeks ago I still have nearly two hundred of pending connections ( 'netstat' gives the state: SYN_RECV ) on port 80 of my machine from abusive foreign hosts. Is there a way to close just these pending connections without affecting the "proper" ESTABLISHED ones to port 80 ? Regards, Nick

1 0

Re: [suse-security] WTF ???
by Jörg Mayer 27 May '01

27 May '01

You didn't search the kernel sources, did you? When I search my i386 SuSE 2.4.2 source tree, it looks like this: jmayer@alice:/usr/src/linux > grep -r '\\__U_/' . ./arch/sparc/kernel/traps.c:" \\__U_/\n"); ./arch/sparc64/kernel/traps.c:" \\__U_/\n"); > In my /var/log/firewall I see - > > May 24 08:50:18 sneex kernel: \|/ ____ \|/ > May 24 08:50:18 sneex kernel: "@'/ .. \`@" > May 24 08:50:18 sneex kernel: /_| \__/ |_\ > May 24 08:50:18 sneex kernel: \__U_/ > > What is that ??? -- Jörg Mayer <jmayer(a)loplof.de> Signature fault, brain dumped

1 0

Libraries missing pam.rpm (pam_pwdb.so)
by Alexander Topolanek 27 May '01

27 May '01

Hi, I tried to install Samba 2.2 on my SuSE 7.1, but I cannot log in. The system looks for a /lib/security/pam_pwdb.so, which is missing in the pam.rpm from SuSE. Has anyone ideas or a workaround? I dont want to install a generic pam.rpm and find myself locked out... thanks Alexander Topolanek Propst Peitlstr. 85 2103 Langenzersdorf Austria Phone: +43-2244-33633-633 Fax: +43-2244-33633-55 GSM: +43-676-5702852 email: atopo(a)ocv.org

2 2

Re: [suse-security] diffence between portfw and mfw
by William Preston 27 May '01

27 May '01

Togan Muftuoglu wrote: > > Hi > > What are the main differences between portfw and mfw in ipmasqadm. For > example Marc prefers mfw in the SuSEfirewall script but on the other > hand I have seen scripts were portfw is used only. The only thing I > saw was im portfw you need the specify the protoc also tcp / udp. > > Sorry until my book arrives there will be more questions coming. Ah > yes when it arrives expect more to come :-) > > Have a nice Sunday > > -- > Togan Muftuoglu > I find the packet marking stuff very useful for simplifying things. e.g. if we want 3 clients to see different webservers, then all we have to do is use the one address for any client and add the following rules; ipchains -I $INPUTCHAIN -p tcp -y -s $CLIENTA --dport 80 -m 1 ipchains -I $INPUTCHAIN -p tcp -y -s $CLIENTB --dport 80 -m 2 ipchains -I $INPUTCHAIN -p tcp -y -s $CLIENTC --dport 80 -m 3 ipmasqadm mfw -I -m 1 -r $WEBSERVER1 80 ipmasqadm mfw -I -m 2 -r $WEBSERVER2 80 ipmasqadm mfw -I -m 3 -r $WEBSERVER2 8080 This doesn't provide much security in itself though... ...you still really need password protection etc. It just makes it easier for the clients to find what they're looking for quickly. William

3 2

SuSEfirewall configuration help
by Matt 27 May '01

27 May '01

SuSEfirewall config... Please could someone send me an example of one with the following settings enabled please.. I use SAMBA, telnet, rlogin, ftp and vnc, ping, traceroute on 3 my machines 192.168.0.2 (SuSE 7.0, 192.168.0.3 (SuSE 6.4) and use my win2000 box to work on (192.168.0.1). these are all on eth0 with win2000 used to dialup on. I would like to set up 192.168.0.2 as my gateway/router but at the moment I have configured my win2000 box. However whilst setting up SuSEfirewall my system hung on the firewall first run initialisation. I can neither login or do anything on reboot. I could login in single user mode but I don't know how to do that ant directions ? Regards Matt

1 0

Download problem
by Luis José Fabbiani B. (SOPORTE) 27 May '01

27 May '01

Hi list, I tried to download for two week the k_deflt-2.2.19-11.i386.rpm kernel and it's impossible. I tried with two path: ftp://ftp.suse.com/pub/suse/i386/update/7.0/kernel/RPMs/ And ftp.suse.com/pub/suse/i386/update/7.0/kernel/2.2.19/ How can I get that ? Are there other way? Thanks! LF

3 2

diffence between portfw and mfw
by Togan Muftuoglu 26 May '01

26 May '01

Hi What are the main differences between portfw and mfw in ipmasqadm. For example Marc prefers mfw in the SuSEfirewall script but on the other hand I have seen scripts were portfw is used only. The only thing I saw was im portfw you need the specify the protoc also tcp / udp. Sorry until my book arrives there will be more questions coming. Ah yes when it arrives expect more to come :-) Have a nice Sunday -- Togan Muftuoglu

2 1

WTF ???
by Bill Jones 26 May '01

26 May '01

In my /var/log/firewall I see - May 24 08:50:18 sneex kernel: \|/ ____ \|/ May 24 08:50:18 sneex kernel: "@'/ .. \`@" May 24 08:50:18 sneex kernel: /_| \__/ |_\ May 24 08:50:18 sneex kernel: \__U_/ What is that ??? I have suse-sparc, 64-bit, Ultra 10; I am running the Standard 2.4.2 kernel. Thx; -Sneex- :] ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1

2 1

Finding out what shared libs are used by a programm?
by Thomas Schweikle 26 May '01

26 May '01

Hallo ! How can I fast find out what shared libraries a given program uses? -- Thomas

2 1

convert ips from inet to ip's of my intranet/isp, iptables and nat?
by Ramon Acedo 25 May '01

25 May '01

Hello, we'd like a good way of allowing trusted ip's from the internet to use some services that we have in our intranet. We need to simulate that certain ip's of the inet seem to be ip's assigned by our ISP to access to some services that only are allowed the users conected to our ISP The first idea was to use a gateway with some iptables rules: iptables -t nat -A POSTROUTING -s "trusted_ip" -o eth0 -j SNAT --to 1.2.3.4 for change the incoming ip's and for returning: iptables -t nat -A PREROUTING -s 1.2.3.4 -i eth0 -j DNAT --to "trusted_ip" So if we ping the "trusted_ip" from the intranet we get answer and if we ping the 1.2.3.4 from the trusted ip we get answer too. Note that the intranet is not an actual intranet becuse it has well-known-to-the-internet ip's -we've got a little ISP- But this limit us because the "trusted_ip" must have as default gateway the box that has the iptables rules. As the trusted ips are dynamic addresses from inet wich are trusted just for some time and then removed from the iptables rules, so it is not possible to make everyone to change its default gateway just for access to our intranet for a while. With the system I mentioned before we got some troubles with ftp's, as I said we could ping from each side of the gateway/firewall to each other, but when I connected to a ftp server of my intranet with a client from outside and the ip converted with iptables, we could login but not make data transfers, the ftp after login opens the port 20 with the client to establish the data connection, I think it shouldnt have any problem but the client complains about bind or network reaching or something I cant remenber -sorry :) - May be there is another way of doing it, but we NEED to change the source ip's because in the intranet we have lots of services that validate just for the IP's of the intranet, and it is very difficult to make dynamic ips validations.

1 0

Re: [suse-security] Finding out what shared libs are used by a programm?
by Nick LeRoy 25 May '01

25 May '01

Hello... > Hallo ! > > How can I fast find out what shared libraries a given program uses? Use ldd. For example: $ldd /bin/ls libc.so.6 => /lib/libc.so.6 (0x4001b000) /lib/ld-linux.so.2 => lib/ld-linux.so.2 (0x40000000) -Nick -- Get your free email from www.linuxmail.org Powered by Outblaze

1 0

Securing 7.1
by Geoffrey T. Sanders 25 May '01

25 May '01

Have noticed that there is not a hardsuse.rpm package for the 'current' sec1 directory, but one exists for the 7.0 version. Have there been changes in 7.1 to negate the need for this package? If not, would I still be able to implement the hardsuse.rpm and seccheck.rpm packages on 7.1? Thanks in advance. G. Sanders San Diego, CA

3 2

weird request from port 53 to 2049
by Togan Muftuoglu 25 May '01

25 May '01

Hi, can someone give me any reason why a nameserver would make a request to 2049 which is nfs Packet log: input DENY ppp0 PROTO=17 212.156.4.20:53 212.156.196.114:2049 L=137 S=0x00 I=5423 F=0x0000 T=27 (#39) Packet log: input DENY ppp0 PROTO=17 212.156.4.20:53 212.156.196.114:2049 L=137 S=0x00 I=5574 F=0x0000 T=27 (#39) Packet log: input DENY ppp0 PROTO=17 212.156.4.20:53 212.156.196.114:2049 L=137 S=0x00 I=5738 F=0x0000 T=27 (#39) -- Togan Muftuoglu

7 14

Detect a portscan attac
by patric illi 25 May '01

25 May '01

Cheers List ! I am thinking about a solution to disallow access to my server for all those who have made a portscan. I would like to insert their IP's into the /etc/host.deny file. Does anybody know a way how to detect whether someone does a portscan ? would be kind ! cheers & thx in advanced patric illi

4 3

Kernel update packages not gpg signed?
by Muralito 25 May '01

25 May '01

Hi. Kernel update packages lx_sus22-2.2.19.SuSE-25.i386.rpm and lx_doc22-2.2.19.SuSE-25.i386.rpm are not gpg signed. Is this right? Thanks, Muralito

2 1

2.4 kernel is dropping tcp connections
by Kaupo Palo 24 May '01

24 May '01

Does anybody have an idea why under kernel 2.4.x I am experiencing dropping of TCP connections. (No packet filters). With packet captures I saw that my computer send out SYN, I get back SYN-ACK and then my computer responds with RST. Some hosts can regularly be connected, some are regularly dropped although occasionally the connection is established. It never happened with 2.2.x kernel. I am using the suse kernel 2.4.2 currently (2.4.0 had the same problem). The packet contents didn't reveal anything suspicious to my mind. The SYN-ACK packets looked quite similar in both cases. Does anybody have an idea? Kaupo -- Kaupo Palo, Evotec OAI, Instituudi tee 11, Harku EE76902, Estonia E-mail: palo(a)ebi.ee______________________Phone & Fax: 372-6560601

2 1

secure connection with IPSEC etc.
by Guido Tschakert 24 May '01

24 May '01

Hello list I have to connect two lan's via ISDN. Certainly the connection should be secure. I think about a linux-box in each lan with ISDN-cards, which act as routers with a VPN-connection beetween them. Now I am looking for some information about these things (ISDN, VPN and how to bring them together). So I want you to ask which kind of VPN-implemantation (CIPE, FREESWAN) would you use or maybe you can tell me some sources of information about this. I've already gone through the HOWTO's and the Manual-pages. TIA Guido PS: I'm sorry that this is not a"real" question. Maybe you can sent me the information directly and not via the list. -- ----------------- Guido Tschakert SRC GmbH, SysAd -----------------

2 1

Question about Local Daily Security check
by Markus Gaugusch 24 May '01

24 May '01

Hello List! I often get these entries in my security check (secchk.rpm): * Changes (+: new entries, -: removed entries): - kerstin:/home on /misc/khome type nfs (rw,Ì×ÿ¿|Øÿ¿¸Øÿ¿kerstin:/home,addr=192.168.10.1) + kerstin:/home on /misc/khome type nfs (rw,¬×ÿ¿\Øÿ¿¸lØÿ¿kerstin:/home,addr=192.168.10.1) I'm using autofs (from /etc/auto.misc): khome -fstype=nfs kerstin:/home Any idea, why I get those weird characters? thank you Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

1 0