May 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Unwanted guest is trying to relay
by Togan Muftuoglu 16 May '01

16 May '01

* Paul Miles <paul.miles(a)padlondon.com> [010516 01:14]: > Throw away sendmail and install Exim. (http://www.exim.org) > > Exim is so much easier to setup, hence more likely to configure a secure > setup/ Many thanks for the informative answer to my question After checking my logs and reading the sendmail op.txt that was located in the docs directory I do not now think the person was able to do send a mail since SuSE sendmail is compiled with no relay option the unwanted guest could not achieved what he dreamed. -- Togan Muftuoglu

1 0

vanished user accounts?
by Night Watcher 15 May '01

15 May '01

Hi all, i have the following problem on my three suse 7.0 and one 7.1 box, after a while when i wanted to log in under my test account, the message was, cannot switch to homedir (no access or something) i relogged in under my root account and then i wanted to correct this problem, i used midnight commander to look where the directory and user permissions of the /home/test account were, these stuff were correctly displayed: i found out that all the permissions still belonged to user test, this was very strange in my opinion, i thought well that is not right but reinstall might help, so i did that, and then my other three boxes suddenly displayed the same problem, all after 2 to 3 weeks, i am pretty sure that i didn't change the userpermissions on the machines ( i can make an mistake but not on 4 machines :)*) so i am guessing that it's an bug, removing the users and readding them does NOT work, so anyone, can u help me? or someone of the SuSE team : is this correcT? met vriendelijke groeten, with kind regards, Remko JC @ irc.super-chat.nl (tech-Admin) NightWatcher @ irc.grunn.org / irc2.grunn.org (IRCoperator) [DrL] Member [Grunn] Coders [Zyber] /* hope the day after you die is an nice one */ niets uit deze mail mag worden gecopieerd of aan derden gelezen laten worden zonder toestemming van de auteur. al deze emails vallen onder briefgeheim. wetboek van strafrecht. Nothing from this mail may be duplicated of may be read by others then the target name. you need authorization from the owner to duplicate it. these mails are secure and restricted confirming the dutch book of law _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

4 5

pop3 endcodes mail with netscape and suse7.x
by ingo＠cimdata.de 15 May '01

15 May '01

hi list, heare in my brillant english, a question: Wher coud I find some infos over: how I encodes the pop3 protocol (ssh?) so that I coud use encode mail with netscape? I coud'nt find something over it at www.obenssh.org, isint it the right cryptosoftwaere? -- []___¸ ######-\ O_-_-_O-\

3 2

ip_masq_h323
by Togan Muftuoglu 15 May '01

15 May '01

Hi, Suse kernel's do not have the ip_masq_h323 module, although someother distribution do have it. Is there any security reasons that the others have not noticed yet or is it just a preference by SuSE. If I compile it byself will I create headaches for myself if the answer to the first part is by preference. TIA -- Togan Muftuoglu

2 3

ipchains problem ?
by stephane parenton 15 May '01

15 May '01

hi, I have a SuSE 7.0 linux box that runs as DNS, filter and gateway. The filter is quite simple. and I 'experiencing troubles... The public ip adress is 62.161.161.253, and the internal lan is nat'ed and use the 192.168.0.x adresses. The computers from the lan can see almost all the internet except the sites that have ip's beginning with 62.*... What can be the trouble ?.... here's the filter i use. #!/bin/sh echo 1 > /proc/sys/net/ipv4/ip_forward /sbin/ipchains -F forward /sbin/ipchains -P forward DENY route add -net 62.161.161.192 netmask 255.255.255.224 gw 62.161.161.222 tr0:0 route add 192.168.0.3 gw 62.161.161.253 route add default gw 62.161.161.254 /sbin/ipchains -A forward -s 0.0.0.0/0.0.0.0 -d 62.161.161.194/255.255.255.255 -j ACCEPT /sbin/ipchains -A forward -s 0.0.0.0/0.0.0.0 -d 62.161.161.195/255.255.255.255 -j ACCEPT /sbin/ipchains -A forward -s 62.161.161.194/255.255.255.255 -d 0.0.0.0/0.0.0.0 -j ACCEPT /sbin/ipchains -A forward -s 62.161.161.195/255.255.255.255 -d 0.0.0.0/0.0.0.0 -j ACCEPT /sbin/ipchains -A forward -s 192.168.0.0/255.255.0.0 -d 0.0.0.0/0.0.0.0 -j MASQ TIA Stephane Parenton

3 2

Re: [suse-security-announce] SuSE Security Announcement: cron
by Nix 15 May '01

15 May '01

At 10:48 PM 15/05/2001, you wrote: > Sebastian Krahmer has found the bug. It has been fixed by properly > dropping > the privileges before executing the editor. Nice work Sebastian. I've been waiting for the SuSE announcement since I saw your name on bugtraq. Good to see that SuSE's extra auditing pays off. Viel Spaß Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

SuSE Security Announcement: cron
by Sebastian Krahmer 15 May '01

15 May '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: cron-3.0.1-296 Announcement-ID: SuSE-SA:2001:17 Date: Tuesday, May 15th, 2001 14:30:00 CEST Affected SuSE versions: 7.1 Vulnerability Type: local privilege escalation Severity (1-10): 7 SuSE default package: yes Other affected systems: All UN*X systems using this package Content of this advisory: 1) security vulnerability resolved: crontab problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The crontab program is running setuser-id root and invokes the editor specified in the EDITOR environment variable, usually vi. If crontab discovers that the format of the edited file is incorrect, it executes the editor again but fails to drop its root privileges before. Therefore it is possible to execute arbitrary commands as root. Sebastian Krahmer has found the bug. It has been fixed by properly dropping the privileges before executing the editor. A possible temporary workaround is to remove the suid bit of the /usr/bin/crontab program: chmod -s /usr/bin/crontab. If you change the mode, you should also do so in the files /etc/permissions*. A permanent solution for the problem is to update the cron package from our ftp server. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/a1/cron-3.0.1-297.i386.rpm b51f3331fff5dac8474a51a1e7d22454 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/cron-3.0.1-297.src.rpm 495f7f5df30d28a0c6b078a9773fc799 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/a1/cron-3.0.1-316.sparc.rpm 4db292d0276badc0ae58fd6aeaab64c0 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/cron-3.0.1-316.src.rpm 16facdbbce03d43fa05d540b810d8636 AXP Alpha Platform: The SuSE-7.1 AXP-Alpha Edition does not suffer from this problem. PPC Power PC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/a1/cron-3.0.1-295.ppc.rpm 589e8575bbbee29a07319f5c5ada9bcc source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/cron-3.0.1-295.src.rpm ff747e2aee85a53e3a30827b33383a7d ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - The man program running setuser-id 'man' suffers from format string and bufferoverflow bugs. Updates are currently being built. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Sebastian Krahmer ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOwElIney5gA9JdPZAQHJ+Qf/Z6Q8ofh8j807uLChfv42lCkWmvOCfJLb S4Vg32n3P5oyFcb1J2qHUt+Dv1NlLuGGqsiUlCTNa6xqlt7pWBWQPtyRGnBUGDNh t+VjFBDzILMdIA5A1U25+JtChPXUXYJsvl/KCefoxfXpbiae3J5xqT9lPwe/Djez ZLBdsowmUV7s5lJKUyxrmHhTapLT4ksnunJ5bCmo/z86NMFFGvefeclcEFZ9/q7n rFX48x3vh4psCTJqRVFJoSFAYVfHuXDNuMj59p17JbK3TlVV63rFlk/+zSB+HlnU ddnacjnYfsQhdOhY/QJ68byk/GsusJTbDSHDFobFNgbEVyUmUFC3QQ== =OH6U -----END PGP SIGNATURE-----

3 4

Antwort: Re: [suse-security] Kernel security
by Alexander Schwartz 15 May '01

15 May '01

I think SuSE has the problem that is uses a patched (enhanced) kernel with IPSEC etc. enabled that make it more complicated than necessary. There are distributions like debian who keep things simple and that came up with a recent kernel a long time ago. Using debian, you can update your system with two command (apt-get update / apt-get upgrade) -- never seen that working on a SuSE-machine. Makes administration easy and reduces TOC. Mit freundlichen Grüßen Alexander Schwartz

2 1

Re: [suse-security] Driver Licence
by Alexander Schwartz 15 May '01

15 May '01

Hmm... a driver licencse covers use of cars on normal roads and in cities. But when you "drive" your "box" on the internet, its more like driving in the sahara and rainforest at the same time. A.

1 0

problems with DoS
by Gediminas Grigas [home] 15 May '01

15 May '01

Hello, I`m recently under heavy attack from an l33t hax0r kiddie. Hes using lots of proxies to access my banner exchange (i mean real lots - hundrets and hundrets) - he was able to add new hosts faster than i was able to lock them out wit ipchains (like 10 hosts/min or so). So its ended by that i changed input policy to DENY and set ACCEPT only for lithuanian ISP`s (about 40 major subnets). But thats not solution, becouse system is now locked from outside Lithuania. However that kiddie started abusing my exchange from his real IP (an biggest ISP dial-up service). I cannot lock-out this ISP becouse i would lock 10.000 users as well. So i`m forced to monitor whats happening everytime and lock him once in a while, or server load will jump from 0.4 to 10.00 on my P-III 1Ghz host. I connot do anything in legal way - becouse we dont have anything in our law system against "l33t hax0rs", besides that isp has terrible support and monopoly, so it will probably even dont bother to respond to my requests. My question would be - is there an tool which could run with apache to automaticly lock host for some time if it tryies access system more that 10 times per minute or so? Could anybody pass me an idea how to fight against such attacks? On other hand - i remember someone once said that he has an "legal request to ISP against hackers" or so... some nice warning text to send to ISP on detection of intrusion or DoS. Could you please refer me to it? Sorry for my broken english. Hope you got the matter. P.S. Host running SuSE 7.1 with 2.2.x kernel Thanks -- Best regards, Gediminas Grigas Tel.: (2)226036; (86) 55362 Techninis direktorius Fax.: (2)627986 UAB "Dizaino kryptis" A.Jaksto 9-233, Vilnius, Lietuva 2001 mailto:gedas@kryptis.lt

5 4