May 2001 - openSUSE Security - openSUSE Mailing Lists

copying users/pwd from one box to another
by stephane parenton 28 May '01

28 May '01

hi, I'm running some servers and I would like to change one of the server with another box, that is more "up-to-date" regarding the CPU/Memory/Disk and OS... The old box is run by a RH6.0 and the new one will be a SuSE 7.0... the question is, how can I move all the users if i tell you that i don't want the passwords to be changed... The box existed long before I was here, so i don't know every password (especially our customers password). Is it possible to copy one password file from one box to another in order to keep the same passwords for all the users ?.... and is there a sure way to transfer all users once for all whithout any doubt ?... TIA Stephane Parenton

2 1

RE: [suse-security] copying users/pwd from one box to another
by José Luis Ledesma 28 May '01

28 May '01

Copy /etc/passwd /etc/shadow /etc/group I think that only with that will work, but be careful if your RH6.0 have shadowing or not. Check if in the redhat exists the file /etc/shadow, if doesn't install the shadowing package or put the passwords of shadow in passwd. Regards José Luis Ledesma Technology Dep. _____________________ COMPETITIVENESS Parque Tecnológico del Vallés 08290 Barcelona - Spain http://www.competitiveness.com Tel.: +34 66 986 55 17 Fax: +34 93 582 01 59 -----Original Message----- From: stephane parenton [mailto:sparenton@experia.com] Sent: lunes 28 de mayo de 2001 12:29 To: suse-security(a)suse.com Subject: [suse-security] copying users/pwd from one box to another hi, I'm running some servers and I would like to change one of the server with another box, that is more "up-to-date" regarding the CPU/Memory/Disk and OS... The old box is run by a RH6.0 and the new one will be a SuSE 7.0... the question is, how can I move all the users if i tell you that i don't want the passwords to be changed... The box existed long before I was here, so i don't know every password (especially our customers password). Is it possible to copy one password file from one box to another in order to keep the same passwords for all the users ?.... and is there a sure way to transfer all users once for all whithout any doubt ?... TIA Stephane Parenton --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

FW: [suse-security] OpenSSH on SuSE 6.3 --> 'PAM adding faulty mo dule: /lib/security/pam_pwcheck.so'
by José Luis Ledesma 28 May '01

28 May '01

In the /etc/pam.d/ you have the security libs you use for telnet, ftp, and openssh too. Probably you don't have the file /lib/security/pam_pwcheck.so on your linux. You can copy it from SuSE 7.0, or you can try to modify the openssh pam file... Regards José Luis Ledesma Technology Dep. _____________________ COMPETITIVENESS Parque Tecnológico del Vallés 08290 Barcelona - Spain http://www.competitiveness.com Tel.: +34 66 986 55 17 Fax: +34 93 582 01 59 -----Original Message----- From: Alex Liesch [mailto:aliesch@web.de] Sent: domingo 27 de mayo de 2001 16:54 To: suse-security(a)suse.com Subject: [suse-security] OpenSSH on SuSE 6.3 --> 'PAM adding faulty module: /lib/security/pam_pwcheck.so' Hi! I've updated one of my older linux servers running SuSE 6.3 to openssh (2.3.0p1) from "the" ssh. Now I have the following entries in messages each time a user logs in: May 27 16:47:25 r100 sshd[16621]: PAM unable to dlopen(/lib/security/pam_pwcheck.so) May 27 16:47:25 r100 sshd[16621]: PAM [dlerror: /lib/security/pam_pwcheck.so: cannot open shared object file: No such file or directory] May 27 16:47:25 r100 sshd[16621]: PAM adding faulty module: /lib/security/pam_pwcheck.so What is 'pam_pwcheck.so' for? My SuSE 7.0 box does have one. Yast did not show any unfulfilled dependencies. Alex. -- Alexander Liesch http://www.alexliesch.de/alex/ Lichtwiesenweg 9 Phone: +49 (0)6151 154715 64287 Darmstadt Fax/UMS: +49 (0)1212 5 10309699 Germany GnuPG/PGP-Key: 0xBC985C75 --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

some kind of attack?
by Daniel Quappe 28 May '01

28 May '01

hi list, got this message some minutes ago May 2 12:25:55 server kernel: Packet log: input DENY eth0 PROTO=1 192.168.0.2:3 this.is.my.ip:1 L=88 S=0x00 I=52687 F=0x000 0 T=243 where eth0 is the outbound-interface which is protected by ipchains from ip-spoofing. some kind of attack?! any ideas are appreciated...;-) many thanks in advance, bye, daniel

5 6

Antwort: [suse-security] configuring firewalls with iptables
by Stefan_Walther＠gehag-dsk.de 27 May '01

27 May '01

#!/bin/sh echo "starting firewall" # interfaces EXT="ippp+" # external interface (maybe a tokenring-card or anthing else; point to the internet) INT="eth+" # internal interface (point to your lan) LO="lo" # loopbackinterface # IP-adresses INTIP="192.168.0.1" # your local ip for your lan (internal ip) ANY="0.0.0.0/0" # all other ip's (maybe you need it in further times) # ports PRIVP="0:1023" # priviliged ports UNPRI="1024:65535" # unpriviliged ports # SYNFLOODING echo 1 > /proc/sys/net/ipv4/tcp_syncookies # Source Address Verification on for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > f done # IP-forwarding on echo 1 > /proc/sys/net/ipv4/ip_forward iptables -P INPUT DROP # drop all incoming packets iptables -P OUTPUT DROP # drop all outcoming packets iptables -P FORWARD DROP # drop all forwarded packets iptables -X # delete all userdefined tables iptables -F # flushing tables iptables -t nat -F # flushing nat-tables iptables -t nat -X # deleting userdefined nat-tables # ignore waste coming from your windowslan # netbios (drop it before writing these messages into your firewall-logfile) iptables -A INPUT -i $EXT -p tcp --sport 137:139 -j DROP iptables -A INPUT -i $EXT -p tcp --dport 137:139 -j DROP # droping bootp and tftp connections (if you have thin clients or some boxes booting from a server via bootrom) iptables -A INPUT -p tcp --sport 67:68 -j DROP iptables -A INPUT -p tcp --dport 67:68 -j DROP # no limits for connections comming from your lan (maybe specify some single rules ex.: SSH, DNS, HTTP...) iptables -A INPUT -i $INT -j ACCEPT iptables -A OUTPUT -o $INT -j ACCEPT # no limits for your LOOPBACK-device iptables -A INPUT -i $LO -j ACCEPT iptables -A OUTPUT -o $LO -j ACCEPT # do want to ping from your firewall iptables -A INPUT -p icmp -j ACCEPT iptables -A OUTPUT -p icmp -j ACCEPT iptables -A FORWARD -p icmp -j ACCEPT ########################################################################## # NAT (MASQUERADING) # replace your local-ip from lan with the offical Internet-IP you got from your ISP ########################################################################## echo "NAT" iptables -t nat -A POSTROUTING -o $EXT -j MASQUERADE iptables -A FORWARD -i $EXT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i $EXT -m state --state NEW -j ACCEPT ########################################################################## # DNS # allows you to connect to an DNS-Server of your ISP or other ########################################################################## echo "DNS" iptables -A OUTPUT -o $EXT -p udp --sport 1024:65535 --dport 53 -j ACCEPT iptables -A INPUT -i $EXT -p udp --sport 53 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -o $EXT -p tcp --sport $UNPRI --dport 53 -j ACCEPT iptables -A INPUT -i $EXT -p tcp --sport 53 --dport $UNPRI -j ACCEPT # LOG anything else with setting som prefixes infront of any message in your firewall-log # you should add one of the following line to your syslog.conf in /etc # kern.* /dev/tty11 # most tty11 is unused and you see a blank screen when switching (same tty12) # or/and # kern.* /var/log/firewall # here you write every message comming from the kernel in the file firewall iptables -A INPUT -j LOG --log-prefix "input " iptables -A OUTPUT -j LOG --log-prefix "output " iptables -A FORWARD -j LOG --log-prefix "forward " echo "READY" MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: 030/89786448 Funk: 0172/3943961

2 1

cannot ping using firewall
by Pupeno 27 May '01

27 May '01

I download SuSEfirewall 2 because I'm running on kernel 2.4. I installed and configured it (configuration file attached), I don't know why, nobody can ping me and I cannot ping nobody (not even me: 127.0.0.1). >From the internal network, they can telnet me, I can see samba shares on internal computers, fetching mail from internal network works good, but www is very slow!!! Is there any way to just configure iptables, not using this, but using a SuSE compatible way (I know, I can just write a script and put it anywhere and run it at start up, but, when I use a distribution I like doing the things in the distribution way). Thank you. -- Pupeno: pupeno(a)pupeno.com.ar http://www.pupeno.com.ar -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/support/faq and the archives at http://lists.suse.com

1 0

[suse-security] iptables-logging
by da_bug 27 May '01

27 May '01

Hi! With ipchains I could have a rule like this: ipchains -A INPUT ... -j DENY -l <- and because of the "-l" I had log-messages of this rule in my /var/log/messages. How can this be done with iptables? Bye.

4 4

how to close "pending" connections: SYN_RECV
by N. Aust 27 May '01

27 May '01

after being syn flooded two weeks ago I still have nearly two hundred of pending connections ( 'netstat' gives the state: SYN_RECV ) on port 80 of my machine from abusive foreign hosts. Is there a way to close just these pending connections without affecting the "proper" ESTABLISHED ones to port 80 ? Regards, Nick

1 0

Re: [suse-security] WTF ???
by Jörg Mayer 27 May '01

27 May '01

You didn't search the kernel sources, did you? When I search my i386 SuSE 2.4.2 source tree, it looks like this: jmayer@alice:/usr/src/linux > grep -r '\\__U_/' . ./arch/sparc/kernel/traps.c:" \\__U_/\n"); ./arch/sparc64/kernel/traps.c:" \\__U_/\n"); > In my /var/log/firewall I see - > > May 24 08:50:18 sneex kernel: \|/ ____ \|/ > May 24 08:50:18 sneex kernel: "@'/ .. \`@" > May 24 08:50:18 sneex kernel: /_| \__/ |_\ > May 24 08:50:18 sneex kernel: \__U_/ > > What is that ??? -- Jörg Mayer <jmayer(a)loplof.de> Signature fault, brain dumped

1 0

Libraries missing pam.rpm (pam_pwdb.so)
by Alexander Topolanek 27 May '01

27 May '01

Hi, I tried to install Samba 2.2 on my SuSE 7.1, but I cannot log in. The system looks for a /lib/security/pam_pwdb.so, which is missing in the pam.rpm from SuSE. Has anyone ideas or a workaround? I dont want to install a generic pam.rpm and find myself locked out... thanks Alexander Topolanek Propst Peitlstr. 85 2103 Langenzersdorf Austria Phone: +43-2244-33633-633 Fax: +43-2244-33633-55 GSM: +43-676-5702852 email: atopo(a)ocv.org

2 2