May 2001 - openSUSE Security - openSUSE Mailing Lists

Detect a portscan attac
by patric illi 25 May '01

25 May '01

Cheers List ! I am thinking about a solution to disallow access to my server for all those who have made a portscan. I would like to insert their IP's into the /etc/host.deny file. Does anybody know a way how to detect whether someone does a portscan ? would be kind ! cheers & thx in advanced patric illi

4 3

Kernel update packages not gpg signed?
by Muralito 25 May '01

25 May '01

Hi. Kernel update packages lx_sus22-2.2.19.SuSE-25.i386.rpm and lx_doc22-2.2.19.SuSE-25.i386.rpm are not gpg signed. Is this right? Thanks, Muralito

2 1

2.4 kernel is dropping tcp connections
by Kaupo Palo 24 May '01

24 May '01

Does anybody have an idea why under kernel 2.4.x I am experiencing dropping of TCP connections. (No packet filters). With packet captures I saw that my computer send out SYN, I get back SYN-ACK and then my computer responds with RST. Some hosts can regularly be connected, some are regularly dropped although occasionally the connection is established. It never happened with 2.2.x kernel. I am using the suse kernel 2.4.2 currently (2.4.0 had the same problem). The packet contents didn't reveal anything suspicious to my mind. The SYN-ACK packets looked quite similar in both cases. Does anybody have an idea? Kaupo -- Kaupo Palo, Evotec OAI, Instituudi tee 11, Harku EE76902, Estonia E-mail: palo(a)ebi.ee______________________Phone & Fax: 372-6560601

2 1

secure connection with IPSEC etc.
by Guido Tschakert 24 May '01

24 May '01

Hello list I have to connect two lan's via ISDN. Certainly the connection should be secure. I think about a linux-box in each lan with ISDN-cards, which act as routers with a VPN-connection beetween them. Now I am looking for some information about these things (ISDN, VPN and how to bring them together). So I want you to ask which kind of VPN-implemantation (CIPE, FREESWAN) would you use or maybe you can tell me some sources of information about this. I've already gone through the HOWTO's and the Manual-pages. TIA Guido PS: I'm sorry that this is not a"real" question. Maybe you can sent me the information directly and not via the list. -- ----------------- Guido Tschakert SRC GmbH, SysAd -----------------

2 1

Question about Local Daily Security check
by Markus Gaugusch 24 May '01

24 May '01

Hello List! I often get these entries in my security check (secchk.rpm): * Changes (+: new entries, -: removed entries): - kerstin:/home on /misc/khome type nfs (rw,Ì×ÿ¿|Øÿ¿¸Øÿ¿kerstin:/home,addr=192.168.10.1) + kerstin:/home on /misc/khome type nfs (rw,¬×ÿ¿\Øÿ¿¸lØÿ¿kerstin:/home,addr=192.168.10.1) I'm using autofs (from /etc/auto.misc): khome -fstype=nfs kerstin:/home Any idea, why I get those weird characters? thank you Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

1 0

Certified Information Systems Security Professional (CISSPT) - Qu estion
by Steven Thompson 24 May '01

24 May '01

Hi All Has any one writen the the "Certified Information Systems Security Professional" exam. Would anyone recomend it. The following books are recommended on their site are any of them good or are there better. https://www.isc2.org/cissp_studyguide#reference Thanks in Advance Steven

1 0

Re: [suse-security] scanrpm: script to check system for known vulnerable packages
by Bob Vickers 24 May '01

24 May '01

Dear All, I just thought I would respond to some of the points people made about my scanrpm script. A couple of people mentioned that it ought to handle ranges of vulnerable versions rather than just single ones. This was certainly my intention originally, but then I looked at the possible forms that version strings can take and realised that parsing and comparing them could be tricky. Probably still possible, but difficult to cover all the cases. And the script at present has the great virtue of simplicity (only 55 non-comment lines at present)...more complexibility means more bugs and more unexpected behaviour. A compromise would be to allow regular expressions in the comparison; this should be easy to implement. Another idea is for keys such as "SEVERITY=x" [x=1..10] and "INFO='Remote Root Exploit'" to give you more information about the exploit...good idea. Felix Huber mentioned autoupdate (http://www.mat.univie.ac.at/~gerald/ftp/autoupdate/ ), which I see as a useful but complementary tool. In particular autoupdate only helps if a fixed package is already available...sometimes the only solution is to remove a package. The problem this script is trying to address is that it is currently very hard to be confident that you have acted on all the security alerts relevant to a release. You have to plough through a long series of alerts, some of them referring to updates which no longer exist. Any solution to this problem MUST involve SuSE producing a machine-readable list of either vulnerabilities or security fixes or (preferably) both. Bob -- ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

1 0

Re: [suse-security] scanrpm: script to check system for known vulnerable packages
by Felix Huber 24 May '01

24 May '01

Hi Bob, I mean AutoUpdate from Gerald Teschl - you find it here http://www.mat.univie.ac.at/~gerald/ftp/autoupdate/ But I would no recommend this solution. A updated XML with all necessary information would be much better. Regards, Felix Huber ------------------------------------------------------- Felix Huber, Web Application Programmer, Webtopia Guendlinger Str.2, 79241 Ihringen - Germany huberfelix(a)webtopia.de (07668) 951 156 (phone) http://www.webtopia.de (07668) 951 157 (fax) (01792) 205 724 (mobile) ------------------------------------------------------- > Felix, > > Well I thought the idea couldn't be new, but a quick search on the net > didn't find what I wanted. Do you have something specific in mind? > > Bob > > On Wed, 23 May 2001, Felix Huber wrote: > > > > Hi Bob, > > > > this idea is not so new - there is already a similar tool for RPM releases > > on FTP server in general. > > But a XML file with up-to-date information (dependencies etc) would make > > life much easier. > > > > MfG > > Felix Huber

1 0

WG: [suse-security] SuSEFirewall fails on system startup
by Ragucci＠t-online.de 24 May '01

24 May '01

ReHi folks, the Script you've to download is on that page: http://www.suse.de/~marc/SuSE.html You've to download the SuSEfirewall v4.6 - 29th April 2001 <SuSEfirewall-4.6.tar.gz> Script unless you want to work with iptables (I think so...). In my Opinion the failures are a result of the bootup sequence, means that the fw-script (or parts of it) is loaded BEFORE the devices (eth0, ippp0 etc.) have been initialized! Maybe you've to make new symbolic links! Instead of "S01SuSEfirewall....." try "S25SuSEfirewall" or something like that! But remember that there's no protection between initializing the devices and loading the script! I prefer downloading the newest Script! Maybe some people have to deinstall the old Script (but the new script will do that, won't it?). I'm sure it works, I've spent some days before I got rid of that problem! If you can't get rid of it, try the "ipchains -L" command, to see if the rules have been set correctly! Bye, Mario PS: Sorry because of my bad english!

1 0

Re: [suse-security] firewalling canna port 5680
by Joss Winn 23 May '01

23 May '01

just for the record, these commands worked in the end :-) thanks to all that helped. nmap still shows the port open, but I guess this is good enough. iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -p tcp --dport 5680 -i lo -j ACCEPT iptables -A INPUT -d 127.0.0.1 -p tcp --dport 5680 -j DROP -- http://www.josswinn.org

1 0