June 2001 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] searching for good WINDOWS security list
by Dave Gregory 01 Jun '01

01 Jun '01

I am on a ton of security lists for windows, but so far, my favorite one is aspsecurity from www.asplists.com or www.learnasp.com Believe it or not... it is the most active list and it has very competent people advising about many issues, not just asp. I have found it the most helpful of my lists so far. Good luck dave -----Original Message----- From: A_Johnson-SuseML-e [mailto:lj_suse_ml@hotmail.com] Sent: Friday, June 01, 2001 10:32 AM To: suse-security(a)suse.com; suse-linux-e(a)suse.com Cc: suse-security(a)suse.com; suse-linux-e(a)suse.com Subject: [suse-security] searching for good WINDOWS security list I know I may get flamed here but I do use windows as much as I wish not to....so I am searching for a LIST about windows security. I think I may have a Trojan bot on my machine...akkk, they are like harpies (not herpies but harpies the little baby monsters), and Windows seems to be very susceptible to any germ out there..... PS I know I can set up my linux box to sniff at my windows box... how would I do a thing like that. I was hoping to have a direct link from the WIN to the LINUX for the task...what do I use on the linux box? nmap? I read about that someplace...any other tools? Thaanks... This is why I think I have a bot/Trojan, the first 2 lines, tcp port 1080 and 5000 and 139... they are up even when I have no IP assigned to my NIC, they are always there... and I have no idea is what is going on at those ports. I have a fire wall, Zonealarm and a linksys 4 port router that supports NAT...okay okay I am new to this stuff ....lol...but it's fun in some sick and twisted way that I can not figure out. So FLAME ON he he but with a side of help would be greatly appreciated. :) Active Connections Proto Local Address Foreign Address State TCP 0.0.0.0:1080 0.0.0.0:0 LISTENING TCP 0.0.0.0:5000 0.0.0.0:0 LISTENING TCP 24.183.224.125:139 0.0.0.0:0 LISTENING UDP 24.183.224.125:1900 *:* UDP 24.183.224.125:137 *:* UDP 24.183.224.125:138 *:* UDP 127.0.0.1:1026 *:* UDP 127.0.0.1:1041 *:* UDP 127.0.0.1:1095 *:* Aaron L Johnson --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

insmod and secmod .... whare can I find them....
by A_Johnson-SuseML-e 01 Jun '01

01 Jun '01

I am searching aimlessly my computer and what not for a place where INSMOD and SECMOD may be hiding from me. I wish to install them, I did find an insmod in /sbin but not a secmod anywhere. I have added them to my boot.local, but since they are not installed I can not use them hence the error message I get that has sent me on the escapade. Thanks again...the leaning one, Aaron L. Johnson

1 0

Re: [SLE] suse 7.2!!
by A_Johnson-SuseML-e 01 Jun '01

01 Jun '01

----- Original Message ----- From: "Lennart Börjeson" <LennartB(a)cinnober.com> To: <suse-linux-e(a)suse.com> Sent: Friday, June 01, 2001 4:20 AM Subject: SV: [SLE] suse 7.2!! The success of Windows rests on three pillars: > 1) The acceptance of Windows as a game console. Which is going to fall because they are finally transitioning over to NT which doesn't support a lot of the "stuff" needed for a good game machine and thier X-BOX a small PC that is cramed into a wierd box to suck up some of the conole maket >This is what most home PCs are used for. The typical Windows >user wants out-of-the-box games compatibility. Just insert the CD! again x-box (@##W%#$) >2) The adoption of Word as a format for the exchange of documents. >How many times have you not received a Word document in mail or via >a web page? And with consistent regularity, it will have been made >with a Word version later than the one you have, which forces you >to upgrade. And the latest version of Word/Excel/etc is only available >on the Windows platform... (This is, BTW, what killed NT on the RISC >platforms (Mips, PowerPC, Alpha). There was ONLY Windows available, no >office applications, which forced every user who needed the extra >muscle offered by RISC to have two workstations at his/her desk.) This I feel is only true if you are an avid M$ user. Plain text is smaller/faster/and more reliable >3) The adoption of Exchange in the business community. no comment ... darrrrrr This immediately forces all clients to use Outlook, which is only available on Windows. Yes, you can use POP3/IMAP/SMTP, but you'll miss out on all the "extra" group-ware utilities bundled with Exchange. (I've heard a rumour that the Web-interface of Exchange2000 can do everything Outlook can, but I'll bet that only applies to users of IE5+ on Windows...) Linux needs to counter Windows on all three fronts by offering 99.9% Windows compatibility + superior features, otherwise the common non-techie person won't stand the hassle of converting. /Lennart -----Ursprungligt meddelande----- Från: yamaska.mail [mailto:yamaska.mail@planet.nl] Skickat: den 31 maj 2001 18:27 Till: j.e.drews(a)worldnet.att.net Kopia: suse-linux-e(a)suse.com Ämne: Re: [SLE] suse 7.2!! Worse yet, you don't even get Visual Basic, they make you buy this as well !!! Greetz Pete (A newbie) >----- Original Message ----- >From: "Jonathan Drews" <j.e.drews(a)worldnet.att.net> >To: "Ben Rosenberg" <ben(a)whack.org> >Cc: <suse-linux-e(a)suse.com> >Sent: Thursday, 31 May, 2001 7:56 AM >Subject: Re: [SLE] suse 7.2!! > On Wednesday 30 May 2001 22:51, Ben wrote: > >I would rather pay $50 every 6 > > months then $300 (W2K Feb 2000) then have to spend another $150-200 for > > XP 18 months later..and when Linux improves..it impoves..it's not just > > cosmetic most of the time. This is just my opinion. > > I would rather pay $300.00 for 3 Linux Distros than be given Microsoft > Windows for free. > > How the hell M$ sold so much software is a mystery to me. It's really > pathetic stuff. The detractors of Linux say it comes with no applications. > Are these people brain dead? All Linux distros come with C, C++, Python and > Perl. All you get with M$ is Visual Basic. I'd rather use my K+E Log-Log > Duplex Decitrig slide rule that that stuff. > > > -- > Cheers, > > Jonathan > > -- > To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com > For additional commands send e-mail to suse-linux-e-help(a)suse.com > Also check the FAQ at http://www.suse.com/support/faq and the > archives at http://lists.suse.com > -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/support/faq and the archives at http://lists.suse.com -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/support/faq and the archives at http://lists.suse.com

1 0

Problems with tripwire
by joerg.bogenrieder＠sytech.de 01 Jun '01

01 Jun '01

Hello List, I have problems with tripwire, I try to secure my binarys with tripwire but when I start tripewire to initialize the Database I get this error Message: ---[snip]--- ### Phase 1: Reading configuration file ### Phase 2: Generating file list ### Phase3: Creating file information database Segemtagen fault ---[snap]--- I have SuSE Linux 7.1 for Alpha, Kernel 2.4.4 and tripwire 1.2 (patchlevel 2). Any ideas? Jörg Bogenrieder SyTech Schuler GmbH Im Kammerbrühl 28 88212 Ravensburg www.systech.de joerg.bogenrieder(a)sytech.de Tel.: +49 (0)751/3606-470 Fax: +49 (0)751/3606-490

2 1

gpg-1.0.6
by Roman Drahtmueller 01 Jun '01

01 Jun '01

Hi together, The gpg update packages for most distributions after 6.3 are being transferred to ftp.suse.com right now. Feel free to install and test them - the announcement probably goes out on the weekend, if not today. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

SuSEfirewall doesn't close some ports
by Vadim Kouzmine 01 Jun '01

01 Jun '01

SuSEfirewall 4.3-3 on SuSE 7.1 Zebra 0.91a opens ports for virtual terminals. `netstat -anp` show these ports as (is it IPv6 notation?): ---------- tcp 0 0 :::2604 :::* LISTEN 23643/ospfd tcp 0 0 :::2601 :::* LISTEN 23640/zebra ---------- I guess SuSEfirewall doesn't discover these ports as listening and doesn't close it, although FW_AUTOPROTECT_GLOBAL_SERVICES="yes". Also `SuSEfirewall -check` doesn't show these ports as unprotected. Thank you, Vadim

3 2

Re: [suse-security] forcing use of proxy
by rene marhold 01 Jun '01

01 Jun '01

ok then maybe try the hard way, formide every workstation into lan direct connections to the internet, only allow the proxy to enter the i-net an easy solution with ip tables ----- Original Message ----- From: "Robert Davies" <Rob_Davies(a)NTLWorld.Com> To: "rene marhold" <rene(a)mail.marhold.net> Sent: Friday, June 01, 2001 12:09 AM Subject: Re: [suse-security] forcing use of proxy > > first you can block the port 80,443 from internal network to outside, > > its only allowed for ipadress of the proxy to go outside to port 80,443 > > so the users are forced to use the proxy, because no direct connection is > > allowed any more. > > But an evil user can run a proxy on say port 53, or another port you don't > block on the firewall, then I can browse sites you are blocking. Some > universities have this problem, they only allow Web Access and SMTP, but > clever students use thigns like CIPE and ssh to get to the other stuff they > want. > > If you want to 'force' use of something private networks are the only way, > then they really _do_ have to use the services you offer, through > application level proxies. > > Rob >

2 1

AW: [suse-security] Strange apache log entry
by Peer Stefan 01 Jun '01

01 Jun '01

You're right, a little paranoia is appropriate in order to secure a network. I am worried about security and I would never use IIS or install anything like Frontpage extensions for any other web server. But I wouldn't worry if a logfile entry points to _vti_<something>, which is either a user, who entered the wrong server or, if it's a hacker, a script, scanning a whole bunch of web-servers for known security holes. If it is a real human cracker (!= script kiddy), who tries to crack just this single system, he/she will find a way into it. -----Ursprüngliche Nachricht----- Von: Boris Lorenz [mailto:bolo@lupa.de] Gesendet: Donnerstag, 31. Mai 2001 16:19 An: suse-security(a)suse.com Betreff: RE: [suse-security] Strange apache log entry On 31-May-01 Peer Stefan wrote: > Ok, Microsoft Frontpages has several security flaws, but that does not > automatically mean that every request for _vti_<whatever> is done by a > hacker or a script-kiddy. Well, not *every* request, but there are *some*. That´s enough for being worried, isn´t it. > Have a look at the browser the client is using, if it's "MSFrontPage/X.Y" > then please don't worry. But do worry if it's the only request for a link > containing _vti* or if there is only one client (if it's not a proxy) > requesting this url. > > Watch your system, but don't worry to much. IMHO such suggestions are somewhat misleading. At last, this is a security mailing list we´re posting in, and a certain amount of paranoia seems to be appropriate considering the current lack of (inter)network security we´re confronted with all day. Sometimes I wish some of ´dem (security-)admins would be just a little more agressive towards security incidents of *any* kind, even if they (the incidents) would end up being harmless. Sorry for the rant...;) > regards, > Stefan Peer > > -----Ursprüngliche Nachricht----- > Von: Soeren Todt [mailto:sworn@gmx.net] > Gesendet: Donnerstag, 31. Mai 2001 15:30 > An: suse-security(a)suse.com; Thorsten Marquardt > Betreff: Re: [suse-security] Strange apache log entry > > > Hi, > > ----- Original Message ----- > From: "Thorsten Marquardt" <thom(a)kaupp.chemie.uni-oldenburg.de> > To: <suse-security(a)suse.com> > Sent: Thursday, May 31, 2001 1:45 PM > Subject: [suse-security] Strange apache log entry > > >> my logfiles reports 404 requests to /_vti_bin/shtml.exe/_vti_rpc and > similar. >> >> Is this a kind of hacker attack? [...] --- Boris Lorenz <bolo(a)lupa.de> System Security Admin *nix - *nux --- --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Re: [suse-security] nice ssh-problem...
by Daniel Quappe 01 Jun '01

01 Jun '01

thanks for your response, to all listmembers thinking about my problem...;-) i need to use rsaauthentication with a key to enable secure-script- automation... greets, daniel -- Machen Sie Ihr Hobby zu Geld bei unserem Partner 1&1! http://profiseller.de/info/index.php3?ac=OM.PS.PS003K00596T0409a -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

OT: new(?) possib. DoS/DDoS-Attacks (2)
by Dieter Huerten 01 Jun '01

01 Jun '01

Oooops! Wrong thread! <sorry> Hi folks! maybe (at the moment) a little bit OT, but take time to read: http://grc.com/dos/grcdos.htm A well written doc of an DoS/DDoS-Attack by an 13yr. "script-kiddy", using many W&%-Boxes as 'agents'/'bots' against grc.com ! For me (not paranoid <g>!) it shows, that security (and all belonging subjects) is an permanent importance for *everyone* -- best greetings from Solingen /GERMANY Dieter Hürten

1 0