May 2001 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] stateful and dynamic inspection
by Reckhard, Tobias 09 May '01

09 May '01

> does ipchains support stateful inspection and dynamic filtering in kernel > 2.2.18? > No, the 2.2.x kernel packet filtering code (configured by ipchains) is not stateful. Note that the term "stateful inspection" belongs to the company Check Point, makers of the Firewall-1 line of products, so nothing besides Check Point's software supports "stateful inspection", strictly speaking. > whats about kernel 2.4.x and iptables? > Yes, the 2.4.x kernel PF code (netfilter, which is configured with the iptables tool) is stateful. > I found nothing on the web which > describes > the different filter functions on different network layers. > Hmm, have you read the Netfilter documentation? And do you know what stateful filtering is? If you've got in-depth questions, there's the netfilter mailing list and the ultimate reference: the source code itself. > Could anyone > give me a > short description which functions are implemented in kernels 2.2.1x and > 2.4.x, > or give me a link about these topics? > Well, the reference site is http://netfilter.kernelnotes.org, but I can't establish a connection at the moment. Just input "netfilter linux 2.4 iptables" to your favourite search engine and you should get enough hits to keep yourself busy for a while. HTH Tobias

1 0

stateful and dynamic inspection
by Christian Osterbrink 08 May '01

08 May '01

Hello, does ipchains support stateful inspection and dynamic filtering in kernel 2.2.18? whats about kernel 2.4.x and iptables? I found nothing on the web which describes the different filter functions on different network layers. Could anyone give me a short description which functions are implemented in kernels 2.2.1x and 2.4.x, or give me a link about these topics? Thanks Christian

2 1

Re: [suse-security] Kernel security
by Martin Fahlgren 08 May '01

08 May '01

Serveral distributors have already published updates... What is the problem with SuSE? A crisis? This is probably the "worst" exploit up to now and a big problem for all networks with many login accounts (web sites, schools, universities etc). So the options I have are 1) Compile and install my own kernel 2) Disable logins until SuSE comes with a new kernel 3) Switch to a distribution which provides the necessary updates Not funny at all Best regards Martin

3 2

Kernel security
by Martin Fahlgren 07 May '01

07 May '01

Warning! There are serious problems with all Linux kernels prior to version 2.2.19. Among these are possibilities for local denial of service or root exploits by exercising race conditions between the ptrace, exec, and/or suid system calls. Programs which exploit these problems have existed since middle of april. See www.securityfocus.com/bugtraq/archive for more info. A SuSE Security Announcement and a new kernel rpm are needed! Best regards Martin

3 2

Apache log entry
by Phil Schrettenbrunner 07 May '01

07 May '01

Good morning, today I have found a pretty strange entry in my Apache access.log. I run a SuSE Linux 7.1/Apache 1.3.14 on a box with DSL that is up most of the time. This is in my log : --- cut --- 207.33.111.32 - - [01/May/2001:10:20:41 +0200] "HEAD%00 /%20HTTP/1.0%0D%0A%0D%0AAccept%3A%20hzwllekiww/../../index.html%3fyzhwpxdpqqt=/. ./lfspjgqdafroxyzmqeispzlifdknzswkphpwbxympterothgnnrefekenoedtvutrueqxavfamhqak gqlkhgvtxorcexhkamivmrutqcttwdtgjowguhfvucfnvcuosbycwsxoxlcuhbaothdvorozuylagkjg xcltvmijhqhobzeqiyeyhvdcmewgypgwoquonegtbpsyzctqcjmexujwrdhonducylgugrpojgjspzvq fnelrjzfvzluaazetwmjlntmnhalhnbyvhohnzuivzigwzntbzfjdztwanypiiuqjmqcqzhvsulzkjgw uucluiizzwwwiyhzbclqdqeehgrwxnprvdjnybeaaxauoscurjpsiwwrkdpzffqxscrueusjseiaexqe uyyvubgpkixksnztaxcncrkuqbohdjqfwsaldgjjphfbdcpvsxoghxsntmyeznfspgxtjhomdqeddbme zgusewcueuyydyapgudfztiiyicoqcjwxknmuorxcstavughbneygwtdyptizplytraycfedeliukxkj cuoytcnnkrucjkfjbufsabssfjtvyvxdduxmlmuxsucqfyoklposnayxzcgirqvsewnzqyhrvvbdvris rggwwupwvhwtrogkhirehsoyrarsztkxsiksmvtqtnjmmbkytxxvqqjaguszamymgskwlihmsdincvqu aqrcnwaekqchrnqswrerjlqbzxypymunwslpdmfxtezkormnkvhndatghpdhfzkvnehfcuxhiwudtoic rqqjkazjpornbqeggtjzrbeuthuhndkqougdmvrmpdiggchgjhoikthefooyfrwuaxczpgijwwgnnmbq zfpqjicskqpfajntqegvbdyrrdrfrsrikqiisqvuonowcyjxfqotsoarsznlgsejqthnlhytzgnrbnlw ungkegdomoecaoftupfzblrybjxcfnkpzionfpuovfaslpuclrbqrewqtljfjgtdsdkawpoamughityq lksslzynqlfgakkvhrxluarjdhgtvqqvosreqevbtrzigdpruvseggjqvvyqbmlnccdksobcqnlkjvwr ngosejplxykhamphsuyyfdmkqumeondxnuktknmavayeljskmlfslqyophmgghqolwbnmougnowmiibi pkyeoxsodogpqynmczourpqytbblrhgajfbmusvagnmrisiyhrbwusaahammcbnsgmbwkwdtvqjjviwg phrszbxiisubpfcgpblfkvrnpjidtfvjjonlvdskelfxxilgyttxqhafxggjlqniyxgxhupthqlsvjom njbkdcdraizjltfyxifklmzgqvlqpnzyawdpzwzuykcqkmfsuejkfcjcnoalebpptymjegylsfyegvmh qnqfbvfezbuyehszciv/.././%4d%59%4c%4f%47%2e%50%48%54%4d%4c HTTP/1.0" 501 1911 --- cut --- and it shows up every second for a 15 Minutes period. The entries differ from each other. Does anyone know what this? Thank you very much! regards | phil -- Das einzige Backup, das Sie je brauchen werden, ist das, für das Sie keine Zeit hatten.

1 0

help :(
by Jesse yep 06 May '01

06 May '01

Hi, I'm new to this kernel 2.4.x and my ipchains don't seem to work i get an error like protocol unavailable or something, any idea how i can fix it. Or is there a better tool then ipchains? I don't have any kind of security at this point, I own SuSE 7.1 with kernel 2.4.0. Any idea how i can get some security on this box? __________________________________________________ Do You Yahoo!? Yahoo! Auctions - buy the things you want at great prices http://auctions.yahoo.com/

3 2

OpenSSH versus SSH
by Marko Kaening 06 May '01

06 May '01

Hi, looks like I didn't notice that SSH seems to be really commercial now. Is this right? Do I need to pay for it if I am still using it? Is OpenSSH a full-featured substitute for SSH? Are there major problems in configuration to expect if I try to deinstall SSH and go for OpenSSH? Marko

10 15

SuSE Linux 7.1 / Kernel 2.4 and freeswan
by Thomas Stinner 06 May '01

06 May '01

Hello, i tried using Kernel 2.4 together with FreeSWAN under SuSE 7.1. Is it correct that there is no module for Kernel 2.4.x yet? -- Mit freundlichem Gruß Thomas Stinner - billiton internet services GmbH Geschäftsleitung -------------------------------------------------------------- direct phone: 0271/30386-11 direct mail: t.stinner(a)billiton.de Weitere Informationen finden Sie unter http://www.billiton.de/

2 1

port-scan-blocker
by Daniel Quappe 04 May '01

04 May '01

hey list, does anybody know an opportunity to block port-scans with ipchains etc. like some commerical firewalls do?! any solution is appreciated...;-) bye, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

4 4

missing mc update file
by Bob Vickers 04 May '01

04 May '01

Hello, The file ftp://ftp.suse.com/pub/suse/i386/update/7.1/ap1/mc-4.5.51-1.i386.rpm referenced in http://www.suse.de/de/support/security/2001_011_mc.txt seems to have gone missing...is it being updated? Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

2 1