June 2001 - openSUSE Security - openSUSE Mailing Lists

APOP - help
by Steven Thompson 07 Jun '01

07 Jun '01

Hi All I'm running SuSE 6.4 and I have installed the SuSE 7.0 POP.RPM on my SuSE 6.4 installation. I ran "popauth -init" to create the popauth.DB. When I try to download pop3 mail using Secure Password Authentication with Outlook Express 5 as the mail client it fails with the following errors. popper[18243]: @warrior.bidorbuy.co.za: -ERR Too few arguments for the auth command. popper[18243]: @warrior.bidorbuy.co.za: -ERR POP EOF received Q. Do u still need to recompile popper or does it work straight away without recompiling? Q. Can you use "Secure Password Authentication" with POP3s (i.e. PoP3 with SSL port 995) or Can you only use one or the other, but not both? Q. Is the user name and password encrypted when using POP3 with SSLWRAP? All tips welcome. Thanks in Advance Steven Thompson

2 1

RE: [suse-security] Post-attack advice
by Chris Quinn 07 Jun '01

07 Jun '01

>It's very common for a box that's been broken into to run some service on a >non-standard port, to allow login to the intruder, preferably without >showing up in records used by w(1) and last(1), or logging via syslog. Robert: Thank you for your reply. You are correct: I did some more snooping and was able to determine that a SSH daemon (an older version than I have running on port 22) is answering on port 31965. I have tried "netstat -anp | grep 31965" but that provides no information. It looks like I have some work to do this weekend. Despite all of the helpful replies from list members, I remain confused about how this occurred. Because this machine is located on my home LAN, I believe that a local compromise is unlikely. Chris Quinn

3 2

simple gateway
by stephane parenton 07 Jun '01

07 Jun '01

hi, I have quite a stupid question.... i set a suse 7.0 box as a gateway between a token ring network and a born-and-growing ethernet network.... it's inside our lan and we're working with private adresses. One of the subnetwork is 192.168.0.x (the token ring) and the ethernet subnetwork is 192.168.100.x... The gateway hosts 2 nics, one token ring and one ethernet. So far the gateway runs quit good, but not good enough because i have internet adresses that are visible from a box before my gateway, and not after my gateway.... I used ipchains in order to say "everything that comes and goes can cross", but actually, it does not.... what have I missed ? ip_forward is enabled i added the token ring adress as gateway to the ethernet nic and the ipchains is -A forward -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -j MASQ as it is inside our network, I don't want any filter to be active... i just want everything to pass through the gateway back and forth. I certainly have missed something important but what ?... TIA Stephane

1 0

Probably OT dumb ?
by Mark Hounschell 07 Jun '01

07 Jun '01

The command "last" showed the following entries: ftp ftp cx441045-b.ports Tue Jun 5 00:02 - 00:02 (00:00) ftp ftp adsl-64-222-16-9 Mon Jun 4 21:35 - 21:35 (00:00)] ftp ftp 211.200.28.16 Tue Jun 5 06:33 - 06:33 (00:00) ftp ftp APerpignan-101-1 Tue Jun 5 20:18 - 20:19 (00:00) Does this look like people just accidentally got the wrong ip address when they tried to ftp somewhere??? Or has somebody actually ftp'd into this box. I'm basically ignorant when it comes to security. Thanks -- Mark Hounschell dmarkh(a)cfl.rr.com

2 4

Re: [suse-security] Probably OT dumb ?
by christian.haefke＠econ.upf.es 07 Jun '01

07 Jun '01

Dear Mark, I can assure you it was not accidental. Tonight I had the same IP-address (211.200.28.16) trying to get into my computer and also my notebook and probably quite a few more machines on our network. Sorry for the bad news, Christian dmarkh(a)cfl.rr.com wrote: > > The command "last" showed the following entries: > > ftp ftp cx441045-b.ports Tue Jun 5 00:02 - 00:02 (00:00) > ftp ftp adsl-64-222-16-9 Mon Jun 4 21:35 - 21:35 > (00:00)] > ftp ftp 211.200.28.16 Tue Jun 5 06:33 - 06:33 (00:00) > ftp ftp APerpignan-101-1 Tue Jun 5 20:18 - 20:19 (00:00) > > Does this look like people just accidentally got the wrong ip address > when they tried to ftp somewhere??? Or has somebody actually ftp'd into > this box. I'm basically ignorant when it comes to security. > > Thanks > -- > Mark Hounschell > dmarkh(a)cfl.rr.com >

1 0

Slow adsm backup with Suse-firewall
by Alexander Grujic 07 Jun '01

07 Jun '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello List ! I have set up a firewall (susefirwall 4.3) between the internet and our internal network. One thing I have noticed is that the backups have slowed down by a factor of 10 ! the adsm backup machine is in the external network, connected via a 100Mbit ethernet card and the machines that are backed up are in the DMZ, also connected via a 100Mbit ethernet card. adsm needs port 1500 and uses a tcp buffersize of 16k. One thing I noticed is the both interfaces show many collisions. This is the output of ifconfig : eth0 Link encap:Ethernet HWaddr 00:80:C8:4C:3F:1F inet addr:134.76.90.254 Bcast:134.76.90.255 Mask:255.255.255.0 inet6 addr: fe80::280:c8ff:fe4c:3f1f/10 Scope:Link inet6 addr: fe80::80:c84c:3f1f/10 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:2573757 errors:0 dropped:0 overruns:0 frame:0 TX packets:2487098 errors:33900 dropped:0 overruns:3 carrier:33897 collisions:11896 txqueuelen:100 Interrupt:12 Base address:0xe000 eth1 Link encap:Ethernet HWaddr 00:80:AD:03:1C:A3 inet addr:134.76.249.89 Bcast:134.76.249.255 Mask:255.255.255.252 inet6 addr: fe80::80:ad03:1ca3/10 Scope:Link inet6 addr: fe80::280:adff:fe03:1ca3/10 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:1925308 errors:8 dropped:0 overruns:8 frame:8 TX packets:2016065 errors:28270 dropped:0 overruns:0 carrier:0 collisions:1373 txqueuelen:100 Interrupt:10 Base address:0xd800 any help would be welcome. thanks, Alex. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.5 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7Hj48X1OUiCutGtcRAnGzAJ9/T9bwFK1ro/mDWEvjR2fhXg8LmwCfbRmY VtYswGQpM40ga2Qli652jUc= =SFz0 -----END PGP SIGNATURE-----

2 1

[suse-security]
by Markus Kohli 07 Jun '01

07 Jun '01

Hi People! I had a cable-modem installed yesterday, and now I'm looking for some good and easy tool to put up a firewall on my linux-laptop. Before I used ppp by modem, and I only had the ports for xwindow, ssh and cups open, but now I get the following from nmap: memphis:/home/kohli/downloads/rpms # nmap -sS localhost Starting nmap V. 2.53 by fyodor(a)insecure.org ( www.insecure.org/nmap/ ) Interesting ports on localhost (127.0.0.1): (The 1511 ports scanned but not shown below are in state: closed) Port State Service 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 37/tcp open time 79/tcp open finger 80/tcp open http 110/tcp open pop-3 513/tcp open login 514/tcp open shell 631/tcp open unknown 901/tcp open samba-swat 6000/tcp open X11 Nmap run completed -- 1 IP address (1 host up) scanned in 1 second Why is that? I already reran harden_suse3.2, started a firewall with firestarter... nothing changes... could anybody help me? tia markus __________________________________________________________________________ The dark ages were caused by the Y1K problem.

2 1

windoze default gw and ie5 proxy config problem
by Philipp Snizek 06 Jun '01

06 Jun '01

Hi all, I have 1 windoze client accessing a squid proxy allwing pasv ftp connections. The client 10.0.0.180 is configured like this: default gw 10.0.0.191 proxy settings in ie5: 10.0.0.191 port 3128 for all protocols. the ftp conneting speed is painful slow. The windoze 2k box first tries to have ftp routed over 10.0.0.191, then it realizes (due to the rejected packtes which produces icmp dest unreachables) it has to use the proxy's port 3128. Then it connects after ages of waiting to the ftp server in pasv mode. Trying to change directory on a ftp server takes up to several minutes of waiting. In case I remove the default gw setting from win2k client's tcp/ip settings the ftp connecting speed is ok. How can I tell windoze 2k or ie5 to first take a look into ie5 proxy settings and if successless try to connect via routing? Anybody got an idea? Thank you Philipp

7 9

mod_ssl in 7.1 problem
by Vitaly Shishakov 06 Jun '01

06 Jun '01

Dear LIST! I have SuSE 7.1 with apache installed, and i desired to add there mod_ssl (package taken from FTP distribution). But when i attempt to launch apache, in ssl_engine log the following appears: [06/Jun/2001 20:23:58 32591] [info] Server: Apache/1.3.17, Interface: mod_ssl/2.8.0, Library: OpenSSL/0.9.6 [06/Jun/2001 20:23:59 32591] [info] Init: 1st startup round (still not detached) [06/Jun/2001 20:23:59 32591] [info] Init: Initializing OpenSSL library [06/Jun/2001 20:23:59 32591] [info] Init: Loading certificate & private key of SSL-aware server cmpd2.phys.msu.su:443 [06/Jun/2001 20:23:59 32591] [error] Init: Unable to read server certificate from file /etc/httpd/ssl.crt/server.crt (OpenSSL library error follows) [06/Jun/2001 20:23:59 32591] [error] OpenSSL: error:0D09F007:asn1 encoding routines:d2i_X509:expecting an asn1 sequence and server becomes unavailable. Could you please help me to solve this problem? Thank you in advance, SHiFT

2 2

Sorry
by jjaime＠ticket-accor.com.ar 06 Jun '01

06 Jun '01

Sorry to have sent 4 messages, but I did it from a webmail, and not reply when it pressed the button of send.

1 0

Webserver in DMZ
by jjaime＠ticket-accor.com.ar 06 Jun '01

06 Jun '01

Hi List, I have the following configuration : internet I SuseFW--Webserver(DMZ) I Lan That direction I must put in the BindAddress directive ? The one who corresponds to the DMZ or the direction public ? With the private direction it works, but the access from my LAN, with Squid (within the FW)is very slow. Thanks a lot.

1 0

Webserver in DMZ
by jjaime＠ticket-accor.com.ar 06 Jun '01

06 Jun '01

Hi List, I have the following configuration : internet I SuseFW--Webserver(DMZ) I Lan That direction I must put in the BindAddress directive ? The one who corresponds to the DMZ or the direction public ? With the private direction it works, but the access from my LAN, with Squid (within the FW)is very slow. Thanks a lot.

1 0

Webserver in DMZ
by jjaime＠ticket-accor.com.ar 06 Jun '01

06 Jun '01

Hi List, I have the following configuration : internet I SuseFW--Webserver(DMZ) I Lan That direction I must put in the BindAddress directive ? The one who corresponds to the DMZ or the direction public ? With the private direction it works, but the access from my LAN, with Squid (within the FW)is very slow. Thanks a lot.

1 0

Webserver in DMZ
by jjaime＠ticket-accor.com.ar 06 Jun '01

06 Jun '01

Hi List, I have the following configuration : internet I SuseFW--Webserver(DMZ) I Lan That direction I must put in the BindAddress directive ? The one who corresponds to the DMZ or the direction public ? With the private direction it works, but the access from my LAN, with Squid (within the FW)is very slow. Thanks a lot.

1 0

Re: [suse-security] Re: Postdrop binary
by Corvin Russell 06 Jun '01

06 Jun '01

Hi Engelbert, The relevant portion of rpm -V postfix is: .M....G. /usr/sbin/postdrop .M...... /usr/sbin/sendmail .M...UG. /var/spool/postfix/maildrop I believe these changes are accounted for by changing to Maildir type delivery on ~/. IS that right? But that doesn't account for the date change noted earlier. > did you change permissions /etc/permission files and directories > could you run "rpm -V postfix" to verify postfix > or if you have time "rpm -Va" verifies the whole installation > which takes time. > -- Corvin Russell <corvinr(a)sympatico.ca>

2 1

Updated SuSE-Security-FAQ V 0.43
by Peter Nixon 06 Jun '01

06 Jun '01

Hi guys Just a quick note to remind anyone who is new to the List that we have a FAQ doc at http://www.susesecurity.com/faq/ I have also made a few minor changes to it. As usual, if anyone has any new sections, corrections, or updates please mail them to me, and I will add them. Viel Spaß Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

Re: [suse-security] Could need some help to understand logMessage
by Maarten van den Berg 05 Jun '01

05 Jun '01

On Tuesday 05 June 2001 16:51, you wrote: > hello Maarten, > > > "Martian source" means the kernel received a packet that, according to > > routing table / netmask, cannot legally arrive there. This would > > happen, for instance, if you configured your network for 192.168.x.x > > and a packet claiming to be from 10.x.x.x arrived there, etc. Thus; a > > sanity-check. > > [...] > > > So, the message reads something like: > > "Unexpected, illegal packet claiming to be from 195.222.110.11 > > destined for 195.222.110.255 detected on eth0." > > thank you very much for your mail. This was very helpfull. > It kind of makes sense now. > 195.222.110.11_ is my IP if you add one more digit. > > As far as I understand this, there was a problem with an outgoing > packet? > Strange! I'm not sure, I don't know your network-setup. It could be someone is / was trying to do nasty stuff, but it could also be some misconfiguration or a hardware-glitch, or whatever. To find out more we'd need more info, like routingtables, the topology of your network / lan / whatever it is that you have, etc. But I'd prefer it -if you want to find out more- if you post that to the list, not private mail, so others may contribute too. Anyhow, glad to be of help, Cheers, Maarten

2 1

Could need some help to understand logMessage
by Phil Schrettenbrunner 05 Jun '01

05 Jun '01

Hello List, seeing my Windows Firewall (ZoneAlarm) going crazy because of a PingScan, I switched to my Linux PC (SuSE 7.1) and startet ethereal to see whats goging one. Seeing tons of ICMP Echo request packages I took a look at my /var/log/messages (which has grown up to 8 MB so far) and I found the following entries (all the same, each second for about 18 min) Jun 4 16:01:36 <myHost> kernel: martian source 0b6edec3 for ff6edec3, dev eth0 Jun 4 16:01:36 <myHost> kernel: ll header: ff ff ff ff ff ff 00 08 c7 ea 7b 85 08 00 And about every minute this: Jun 4 16:02:10 <myHost> scanlogd: <otherIP> to <myIP> ports 47557, 699, 1059, 387, 714, 1014, 654, ..., fSrpauxy, TOS 00, TTL 46 @16:02:10 (myIP and otherIP are public IPs) Still learing about how networks work, I understand 80% of whats going on here. But what does the "martian source" source mean? Could anyone give me a hint, please? Thank you very much. Regards, phil

6 6

RE: [suse-security] POP3 and SSLWRAP - help question - Fixed
by Steven Thompson 05 Jun '01

05 Jun '01

I got it working -----Original Message----- From: Steven Thompson [mailto:steven@bidorbuy.co.za] Sent: 04 June 2001 10:28 To: SuSE security mailing list (E-mail) Subject: [suse-security] POP3 and SSLWRAP - help question Hi All I have installed the POP.rpm off the SuSE 6.4 with SSLWRAP and OPENSSL. I have Updated the POP.rpm from SuSE site. I have created a normal user account ( no cyrus mail boxes). Pop3 acces is no problem. Retrieving pop3 mail via SSL is the problem. I have created my own Certificate, as shown in the README.SuSE (i.e) openssl req -config /usr/ssl/openssl.cnf -nodes -new -x509 -keyout my_cert.pem -out my_cert.pem -days 365 Inetd.conf setings: pop3s stream tcp nowait cyrus /usr/sbin/tcpd /usr/sbin/sslwrap -nocert 110 Mail Clients: Outlook Express and Outlook 2000. Q1. Do you leave the standard pop3 service running, but only allow connection from the localhost(127.0.0.1) or do u comment it out. Q2. When I try to fetch my pop3 mail via the ssl port there is connection to sslwrap service from the requesting host. Then there is connection to the popper service from the cyrus user to the localhost(127.0.0.1). After the cyrus user connection to localhost the mail client produces an error and is unable to retrieve the mail. Q3. When does my mail client have to have a certificate. In order for ssl to work. Q4. Are there any config files I have to tweak. All tips welcome. Thanks in Advance Steven --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

AW: [suse-security] windoze default gw and ie5 proxy config problem
by Philipp Snizek 05 Jun '01

05 Jun '01

> > Hi all, > > > > I have 1 windoze client accessing a squid proxy allwing pasv ftp > > connections. > > The client 10.0.0.180 is configured like this: > > default gw 10.0.0.191 > > proxy settings in ie5: 10.0.0.191 port 3128 for all protocols. > > > > the ftp conneting speed is painful slow. The windoze 2k box > first tries to > > have ftp routed over 10.0.0.191, then it realizes (due to > the rejected > > packtes which produces icmp dest unreachables) it has to > use the proxy's > > port 3128. Then it connects after ages of waiting to the > ftp server in pasv > > mode. Trying to change directory on a ftp server takes up > to several minutes > > of waiting. > > In case I remove the default gw setting from win2k client's > tcp/ip settings > > the ftp connecting speed is ok. > > > > How can I tell windoze 2k or ie5 to first take a look into ie5 proxy > > settings and if successless try to connect via routing? > Anybody got an idea? > > > Using a private address i think that u will never access by > routing, I don't want ie5 to access through the default gw. ie5 should only use it's proxy settings regardless of the default gw setting. > so it is unusefull taht you try to set the default > gateway, except the router don't have the NAT. NAT is enabled. I need routing for smtp and pop3s.

1 0

For Philipp Snizek
by alancivita＠inwind.it 05 Jun '01

05 Jun '01

thank you very much for answering i've tryied to do as you've suggested me..but it didn't work....:( the proxy is on a client.... and when i try to connect from the server via Netscape or Konqueror to an ftp site the message appears... but the strange is that..if i connect to the same site throught the ftp command using the console..i can reach the site ! this is pretty strange.. i've tryied to reach out in the configurations file but i couldn't find anything that can help me to unlock the problem may some one try to set just for fun the ftp_proxy on netscape on port 21 ? thanks to all

3 2

For Philipp Snizek
by alancivita＠inwind.it 05 Jun '01

05 Jun '01

thank you very much for answering i've tryied to do as you've suggested me..but it didn't work....:( the proxy is on a client.... and when i try to connect from the server via Netscape or Konqueror to an ftp site the message appears... but the strange is that..if i connect to the same site throught the ftp command using the console..i can reach the site ! this is pretty strange.. i've tryied to reach out in the configurations file but i couldn't find anything that can help me to unlock the problem may some one try to set just for fun the ftp_proxy on netscape on port 21 ? thanks to all

1 0

Sorry,access denied,the port number given has been disabled for security reason
by alancivita＠inwind.it 04 Jun '01

04 Jun '01

Hi all I have a Suse 7.1 just installed No firewall is installed at the moment I can surf on the net throught a proxy, ANALOGX proxy, a freeware proxy, on a windows machine The settings for http are 192.168.0.254 port 6588 and for ftp 192.168.0.254 on port 21 When i try to access an ftp site the browser (Netscape) says: Sorry, access to the port number given has been disabled for security reasons. Please really Please can someone help me on solve that problem? Thank you very much By all

2 1

Postdrop binary
by Corvin Russell 04 Jun '01

04 Jun '01

Sorry for these amateur questions. The weekly security check noted the following changes among others: - -rwxr-sr-x 1 root maildrop 77277 May 7 00:08 /usr/sbin/postdrop + -rwxr-sr-x 1 root maildrop 77277 May 31 02:16 /usr/sbin/postdrop I believe the postdrop binary is a postfix binary. I have not updated postfix recently, is this binary associated with anything else? Or is there another benign explanation for the change? + -rwxr-sr-x 1 root tty 14030 May 30 02:24 /opt/gnome/sbin/gnome-pty-helper - -rwxrwxr-x 1 root tty 14030 May 12 19:25 /opt/gnome/sbin/gnome-pty-helper As for the second, I am assuming it is related to the GPG vulnerability, as that is the only GNOME-related package I have updated recently. Does that sound right? But why the permission change? TIA Corvin -- Corvin Russell <corvinr(a)sympatico.ca>

1 1

POP3 and SSLWRAP - help question
by Steven Thompson 04 Jun '01

04 Jun '01

Hi All I have installed the POP.rpm off the SuSE 6.4 with SSLWRAP and OPENSSL. I have Updated the POP.rpm from SuSE site. I have created a normal user account ( no cyrus mail boxes). Pop3 acces is no problem. Retrieving pop3 mail via SSL is the problem. I have created my own Certificate, as shown in the README.SuSE (i.e) openssl req -config /usr/ssl/openssl.cnf -nodes -new -x509 -keyout my_cert.pem -out my_cert.pem -days 365 Inetd.conf setings: pop3s stream tcp nowait cyrus /usr/sbin/tcpd /usr/sbin/sslwrap -nocert 110 Mail Clients: Outlook Express and Outlook 2000. Q1. Do you leave the standard pop3 service running, but only allow connection from the localhost(127.0.0.1) or do u comment it out. Q2. When I try to fetch my pop3 mail via the ssl port there is connection to sslwrap service from the requesting host. Then there is connection to the popper service from the cyrus user to the localhost(127.0.0.1). After the cyrus user connection to localhost the mail client produces an error and is unable to retrieve the mail. Q3. When does my mail client have to have a certificate. In order for ssl to work. Q4. Are there any config files I have to tweak. All tips welcome. Thanks in Advance Steven

1 0