May 2001 - openSUSE Security - openSUSE Mailing Lists

suspicious apache-log-entries?
by Daniel Quappe 18 May '01

18 May '01

hi list, got this logs in my apache-logs MANY, MANY times...;-) (>1000) "GET / HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/msword, application/vnd.ms-excel, application/vnd.ms-powerpoint, */*" any ideas about this (hack-attempt)?! greets and bye, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

ping over a masquerading firewall
by Guido 18 May '01

18 May '01

Hello List, I'm trying to build a firewall with ipchains which also should masqerade an internal net. The problem is that I can't ping from inside to the outside. I was able to ping from the inside to the firewall and from the firewall to the outside. If I use a "firewall" like ipchains -F ipchains -P input ACCEPT ipchains -P output ACCEPT ipchains -P forward ACCEPT ipchains -A forward -i $EXTERNAL_INTERFACE -s $INTERN -j MASQ I'm able to ping from inside to outside. In my "real" firewall, I tried it the same way like ssh, which works fine, but ssh has tcp as protokoll and not icmp like ping. My configuration for ssh is the following which works fine ipchains -A input -i $INTERNAL_INTERFACE -p tcp -s $INTERN $SSH_PORTS \ -d $ANYWHERE 22 -j ACCEPT ipchains -A output -i $INTERNAL_INTERFACE -p tcp ! -y -s $ANYWHERE 22 \ -d $INTERN $SSH_PORTS -j ACCEPT ipchains -A output -i $EXTERNAL_INTERFACE -p tcp -s $EXT_IPADDR $UNPRIVPORTS \ -d $ANYWHERE 22 -j ACCEPT ipchains -A input -i $EXTERNAL_INTERFACE -p tcp ! -y -s $ANYWHERE 22 \ -d $EXT_IPADDR $UNPRIVPORTS -j ACCEPT ipchains -A forward -i $EXTERNAL_INTERFACE -p tcp -s $INTERN $SSH_PORTS \ -d $ANYWHERE 22 -j MASQ I don't want to use a general rule like ipchains -A forward -i $EXTERNAL_INTERFACE -s $INTERN -j MASQ, And converting the rule from ssh/tcp to ping/icmp doesn't work. (I think it's also because of sending ICMP 8 and receiving ICMP0) TIA Guido

1 0

copy of passwd ...
by Thorsten Marquardt 18 May '01

18 May '01

Hi, what from etc do I have to copy to a second machine to get all the user-accounts accessable without doing further changes? Thanx Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

5 5

mod_ssl Update for S.u.S.E. Linux 7.0 available?
by Michael Ströder 18 May '01

18 May '01

HI! I'm using S.u.S.E. Linux 7.0. I've downloaded updated RPMs of Apache 1.3.19 and several modules but I can't find a mod_ssl RPM which fits that version of Apache. Am I missing something? Ciao, Michael.

2 4

problems with DoS part II
by Gediminas Grigas [home] 18 May '01

18 May '01

Hello, Thanks to all for responses. That kiddie still abuses my server like 10 queries/sec. It seems like its not proxy`ing - Hes somehow fakes his IP`s, becouse its endless list, and some of those IP`s (~8-10%) basicly does not exists (or does not respond to ping/traceroute; I hardly can belive that somebody closed ICMP and left open proxy or even worse...) So, i made my script to recognize his calls, and exit fast, so damage is now kind of minimal (like 5% of CPU and full logs of trash). However its sad to think that there is not much i can do, except wait when this guy gets bored. Is there ANY chances fight against spoofed IP`s? Its surely one way call, however, server is very vulnerable to this. What if such guy gets on leased line - not on dial-up. He could make 100 calls/second with almost no chance to trace. Is there any tool to block/recognize/delay/check for spoofed IP`s? Maybe those spoofed packets could be logged on he`s ISP`s gw router? (I think i know which ISP`s service he`s using) Still i cant understand why that router routes such packets becouse none of them belongs to that network. I`m not a big expert in routing, but its seems weird to me. Original story was: ----------------------------------------------------------------- Hello, I`m recently under heavy attack from an l33t hax0r kiddie. Hes using lots of proxies to access my banner exchange (i mean real lots - hundrets and hundrets) - he was able to add new hosts faster than i was able to lock them out wit ipchains (like 10 hosts/min or so). So its ended by that i changed input policy to DENY and set ACCEPT only for lithuanian ISP`s (about 40 major subnets). But thats not solution, becouse system is now locked from outside Lithuania. However that kiddie started abusing my exchange from his real IP (an biggest ISP dial-up service). I cannot lock-out this ISP becouse i would lock 10.000 users as well. So i`m forced to monitor whats happening everytime and lock him once in a while, or server load will jump from 0.4 to 10.00 on my P-III 1Ghz host. I connot do anything in legal way - becouse we dont have anything in our law system against "l33t hax0rs", besides that isp has terrible support and monopoly, so it will probably even dont bother to respond to my requests. My question would be - is there an tool which could run with apache to automaticly lock host for some time if it tryies access system more that 10 times per minute or so? Could anybody pass me an idea how to fight against such attacks? On other hand - i remember someone once said that he has an "legal request to ISP against hackers" or so... some nice warning text to send to ISP on detection of intrusion or DoS. Could you please refer me to it? Sorry for my broken english. Hope you got the matter. P.S. Host running SuSE 7.1 with 2.2.x kernel Thanks ---------------------------------------------------------------------- -- Best regards, Gediminas mailto:gedas@kryptis.lt

3 2

WAY OFFTOPIC! Job Opportunity for Matrix 2 & 3!
by Nix 18 May '01

18 May '01

This has nothing to do with SuSE Security, but this is a post that went to the Sydney Linux Users Group mailing list a few minutes ago. The money is ok but not brilliant, but if there is anyone who wants something VERY cool for their resume, this looks like a load of fun. For reference, Fox Studios is about 5-10 min from central Sydney.... Cheers -Nix >Delivered-To: slug(a)slug.org.au >From: "Steve Cronan" <steve(a)webdev.net.au> >To: <slug(a)slug.org.au> >X-Mailer: Microsoft Outlook Express 5.50.4133.2400 >Subject: [SLUG] Job Opportunity for Matrix 2 & 3! >Sender: slug-admin(a)slug.org.au >X-BeenThere: slug(a)slug.org.au >X-Mailman-Version: 2.0.4 >List-Help: <mailto:slug-request@slug.org.au?subject=help> >List-Post: <mailto:slug@slug.org.au> >List-Subscribe: <http://lists.slug.org.au/listinfo/slug>, > <mailto:slug-request@slug.org.au?subject=subscribe> >List-Id: General Discussions <slug.slug.org.au> >List-Unsubscribe: <http://lists.slug.org.au/listinfo/slug>, > <mailto:slug-request@slug.org.au?subject=unsubscribe> >List-Archive: <http://lists.slug.org.au/archives/slug/> >X-Original-Date: Fri, 18 May 2001 17:16:45 +1000 >Date: Fri, 18 May 2001 17:16:45 +1000 > >Hi Everyone >Been on the list a long time, but never posted! > >I'm currently working at fox studios on the next 2 matrix movies >and I'm looking for someone to assist me. > >It will involve support of a network containing Pc's, Mac's & a couple >Linux servers (Redhat & FreeBSD). >The opportunity to program in php and mysql as well as leaning every >aspect of the movie industry. > >I'm looking for someone with network support, programming and database >experience as well as having the right personality. > >It will be a contract for a year, working 8am-6:30pm at fox studios for >$50-$60K depending on experience. >Its a small IT department so you will have to be very organised! > >Please email me your CV's asap because I'm look to start someone in about >a week. > >Thanks >Steve Cronan > >Digital Assets Manager >Matrix 2 Productions Viel Spaß Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

firewall2
by Alexander Grujic 18 May '01

18 May '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi List :-) I have a problem with firwall2 for iptables. When I run the final Susefirewall2_final start script i get the following error messages : Starting Firewall Initialization: (phase 3 of 3) iptables v1.1.2: Unknown arg `--syn' Try `iptables -h' or 'iptables --help' for more information. iptables v1.1.2: Unknown arg `--sport' Try `iptables -h' or 'iptables --help' for more information. iptables v1.1.2: Unknown arg `--syn' Try `iptables -h' or 'iptables --help' for more information. iptables v1.1.2: Unknown arg `--sport' Try `iptables -h' or 'iptables --help' for more information. iptables v1.1.2: Unknown arg `--syn' Try `iptables -h' or 'iptables --help' for more information. iptables v1.1.2: Unknown arg `--sport' Try `iptables -h' or 'iptables --help' for more information. the manpage says --sport is an alias for --source-port and --syn should be ok too. My firewall2.rc.config is attached to this mail ... it is still under construction but i have no idea what causes the above error messages :-( Help would be appreciated, Ciao, Alex. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7A9G6X1OUiCutGtcRApjuAJ4gc+NhcaOXMh8te7a1201J4nhJAACcDf/p Z/Spv0xcLJOyUDLirkozZ28= =d304 -----END PGP SIGNATURE-----

2 1

RE: [suse-security] problems with DoS part II
by Reckhard, Tobias 18 May '01

18 May '01

> Is there ANY chances fight against spoofed IP`s? > Not really on your side, unfortunately. You can exclude large portions of the possible IPv4 address space as they are reserved -- there's a list on the same FTP site as the definitive assigned port listings, but I'm not sure how accurate it actually is.. -- but the attacker can still pick valid IP addresses at will that you don't want to simply deny access to your server. The only real way to stop spoofing is for everyone to perform egress filtering to stop spoofed packets from leaving one's network. If I've got 1.2.3.4/24 assigned to me, then only packets with a source address of 1.2.3.0 through 1.2.3.255 should be allowed to leave my network (actually those two probably shouldn't, but anything between them should). This is something ISPs should do as well and that's where you could perhaps succeed. > Its surely one way > call, however, server is very vulnerable to this. > What if such guy gets on leased line - not on dial-up. He could make > 100 calls/second with almost no chance to trace. > What if he uses a DDoS with many well-connected zombies? You are right, you are experiencing a real problem. But unfortunately, you can't solve it on your end, you need the cooperation of his ISP, I'm afraid. > Is there any tool to block/recognize/delay/check for spoofed IP`s? > Well, if they're not actually assigned or are unused at the time, they won't respond to the SYN/ACK packet your server sends back to it and the connection will time out after a while. However, this causes resource consumption on your server, as the half-open connection is kept in the TCP state table until the timeout expires. Perhaps that timeout can be reduced. However I'm not sure if that is your problem or if the packets are saturating your link to your ISP. In the latter case, there's nothing you can do. The packets would need to be dropped before they reach your suspectedly small pipe, i.e. at his ISP or at your's. Of these two, only his ISP can effectively (and easily, for the matter) identify the spoofed packets, so that's the natural point where the operation should take place. > Maybe those spoofed packets could be logged on he`s ISP`s gw router? (I > think i know which ISP`s service he`s using) > If his ISP is using Cisco routers, then a simple ACL (access control list) such as: access-list 1 permit 10.20.30.0 0.255.255.255 interface BRI0 ip access-group 1 in would allow the subnet 10.20.30.0/24, which I assume him to have, into the router and the implicit deny rule would drop anything else. > Still i cant understand why that router routes such packets becouse > none of them belongs to that network. > I`m not a big expert in routing, but its seems weird to me. > It's very unfortunate from a security point of view and the only argument against the egress filtering on their border routers (or those that border their 'peering transit zones') is the hit in performance associated with access lists. However, people like your friend can happily abuse the absence of filtering and create illegal packets that cause load on the ISP's equipment as well... Good luck Tobias

1 0

Re: [suse-security] SuSE Security Announcement: kernel (SuSE-SA:2001:18) (fwd)
by Roman Drahtmueller 17 May '01

17 May '01

---------- Forwarded message ---------- From: Roman Drahtmueller <draht(a)suse.de> To: Jacobo González Simón <jacobo(a)tyc.es> Date: Thu, 17 May 2001 22:21:41 +0200 (MEST) Subject: Re: [suse-security] SuSE Security Announcement: kernel (SuSE-SA:2001:18) > > Where is lvm-0.9.1_beta4-12.i386.rpm ?. I have suse 7.0 and i can´t find > it. I only can find lvm-0.8-0.i386.rpm at > ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1. It's in the same directory as the kernel RPMs. ftp://ftp.suse.com/pub/suse/i386/update/7.0/kernel/2.2.19 > > Thanks > You're welcome. Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

1 0

[suse-security] Open Port
by Markus Kohli 16 May '01

16 May '01

Hi List! I just ran a "nmap -sS localhost", and what I got was the following: Starting nmap V. 2.53 by fyodor(a)insecure.org ( www.insecure.org/nmap/ ) Interesting ports on localhost (127.0.0.1): (The 1519 ports scanned but not shown below are in state: closed) Port State Service 22/tcp open ssh 80/tcp open http 631/tcp open unknown 6000/tcp open X11 Nmap run completed -- 1 IP address (1 host up) scanned in 0 seconds Now my question: what is that port 631 -> unknown. What could this be? Is it something I should take care of, or is it "normal"? Thanks in advance! Markus P.S: Have a look @ www.handybutler.ch __________________________________________________________________________ I believe the technical term is "Oops!"

4 3