July 2001 - openSUSE Security - openSUSE Mailing Lists

Problem Updating to openssl-0.9.6a-41.i386.rpm
by Sven Koch 22 Jul '01

22 Jul '01

hi... I've got a problem updating to openssl-0.9.6a-41.i386.rpm: pizza:/var/spool/autoupdate # rpm -Uhv openssl-0.9.6a-41.i386.rpm error: failed dependencies: libcrypto.so.0 is needed by lynx-2.8.3dev9-268 libcrypto.so.0 is needed by mod_php-3.0.17RC1-29 libcrypto.so.0 is needed by mod_ssl-2.8.1-0 libssl.so.0 is needed by lynx-2.8.3dev9-268 libssl.so.0 is needed by mod_php-3.0.17RC1-29 libssl.so.0 is needed by mod_ssl-2.8.1-0 (base: SuSE 7.1 pro on intel) A update with --nodeps will work (the libs are inside the package), but it should be corrected never the less - I don't like to use --nodeps or --force on my production systems. c'ya sven -- The Internet treats censorship as a routing problem, and routes around it. (John Gilmore on http://www.cygnus.com/~gnu/)

3 2

SuSEfirewall and SuSEfirewall2
by Dieter Springer 22 Jul '01

22 Jul '01

Hi! Currently, i am writing a webmin module for configuring a SuSEfirewall. In this module i need to know if the firewall is already running.=20 How can i see, if there is a running SuSEfirewall on the current system? Some things i already figured out: - SuSEfirewall ist not found via ps-command. ( Only when the script is = called there is a process ) - using a ipchains -L outputs the current rules. If no firewall is set = the default policies are to accept all ( okay, half of the work is done , but....). But it does = not show if the rules are set by SuSEfirewall. There might be another firewall lurking in the system. I = don=B4t think, that i should overwrite ipchains-rules if there is another wall. How can i be sure of the "running" SuSEfirewall? Anyone got an idea? Please send answers per PM. Thanks Dieter Springer

2 1

Re: [suse-security] Misterious non functions with OpenSSH
by Thomas Schweikle 21 Jul '01

21 Jul '01

> Thomas Schweikle schrieb am Mittwoch, den 18. Juli 2001: > >> if started manually in a shell (user stream, group stream). >> If started by cron this script will hang while running >> "ssh -l stream server ls ...". The command "ls" will execute, >> but ssh won't come back again. The connection is terminated >> after execution of the command. >> >> OpenSSH on host: openssh-2.9p1-23, SuSE 7.2 >> OpenSSH on server: openssh-2.9p1-23, SuSE 7.2 >> OpenSSH on server-extern: openssh-2.3.0p1-5, SuSE 7.0 >> >> Any idea, why this happens? Did someone else notice this >> behavior? > > I'm not sure since when (which version) exactly, but I have > openssh's ssh occasionally hanging when it's supposed to close > the connection. This affects both "send-command" and interactive > sessions. I never took the time to investigate this, but I never > saw this happen with ssh.com's ssh 1.2.2x. It might be client- > related, since it also gives problems when the connection to be > terminated has been to a Solaris box where the admin installed > OpenSSH 2.5.2p2 (own compile, I believe, I can ask if that > matters). > > I haven't yet investigated the problem (packet trace alongside > with ssh debug output or such). I had some time to investigate further. ssh executes the given command on the other host, then falling back waiting for local input! Clear - this input never will be made since it's a script started by cron. Making ssh wait forever for input. The ssh-server correctly closes the connection, cause ssh tells him so. Looks realy like a client problem, but I do not have time and knowledge to dig into the sources... > [...] -- Thomas

1 0

Misterious non functions with OpenSSH
by Thomas Schweikle 20 Jul '01

20 Jul '01

Using SSH to execute commands on an other host I found: The script echo "-- server" ssh -l stream server ls -la /var/log/server/*.log echo "-- server-extern" ssh -l stream server-extern ls -la /var/log/server/*.log gives back -- server -rw-r----- 1 stream stream 30168 Jul 18 16:07 /var/log/server/access.log -rw-r----- 1 stream stream 756 Jul 17 14:13 /var/log/server/cache.log -rw-r----- 1 stream stream 2041 Jul 18 14:57 /var/log/server/error.log -rw-r----- 1 stream stream 14049 Jul 17 14:15 /var/log/server/start.log -- server-extern -rw-r----- 1 stream stream 21917 Jul 18 15:33 /var/log/server/access.log -rw-r----- 1 stream stream 0 Jul 15 12:16 /var/log/server/cache.log -rw-r----- 1 stream stream 963 Jul 17 20:44 /var/log/server/error.log -rw-r----- 1 stream stream 6304 Apr 19 02:52 /var/log/server/start.log if started manually in a shell (user stream, group stream). If started by cron this script will hang while running "ssh -l stream server ls ...". The command "ls" will execute, but ssh won't come back again. The connection is terminated after execution of the command. OpenSSH on host: openssh-2.9p1-23, SuSE 7.2 OpenSSH on server: openssh-2.9p1-23, SuSE 7.2 OpenSSH on server-extern: openssh-2.3.0p1-5, SuSE 7.0 Any idea, why this happens? Did someone else notice this behavior? -- Thomas

3 2

VPN Question
by Wilhelm Tesnaar 20 Jul '01

20 Jul '01

Anyone knows the ports used by MS VPN server. I need to generate rulez to nat them ! I have a linux Firewall and I have a MS VPN server on the internal network ! Chow Willie

3 2

Re: [suse-security] Misterious non functions with OpenSSH
by Thomas Schweikle 20 Jul '01

20 Jul '01

Roman Drahtmueller <draht(a)suse.de> on 18.07.2001 16:56:09 Bitte antworten an Roman Drahtmueller <draht(a)suse.de> An: Thomas Schweikle <tschweikle(a)fiducia.de> Kopie: <suse-security(a)suse.de> Thema: Re: [suse-security] Misterious non functions with OpenSSH >> Using SSH to execute commands on an other host I found: >> >> The script >> >> echo "-- server" >> ssh -l stream server ls -la /var/log/server/*.log >> echo "-- server-extern" >> ssh -l stream server-extern ls -la /var/log/server/*.log > > Whatever problem with ssh/openssh there might be following you behind, > there is another mistake in the commandline in the first place: quoting. > > ssh -l stream server ls -la /var/log/server/*.log > > [...] Quoting was done - I didn't notice these backslashes removed sending my mail. Thus the line in reality reads: ssh -l stream server ls -la /var/log/server/\*.log >> [...] > > Use "-v" to see what happens. Otherwise, there's little chance to find out > what goes wrong... Here it is '-v' set: command executed: "ssh -v -l stream server ls -la /var/log/server/\*.log" OpenSSH_2.9p1, SSH protocols 1.5/2.0, OpenSSL 0x0090601f debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Seeding random number generator debug1: Rhosts Authentication disabled, originating port will not be trusted. debug1: restore_uid debug1: ssh_connect: getuid 499 geteuid 499 anon 1 debug1: Connecting to server [192.168.13.15] port 22. debug1: temporarily_use_uid: 499/102 (e=499) debug1: restore_uid debug1: temporarily_use_uid: 499/102 (e=499) debug1: restore_uid debug1: Connection established. debug1: identity file /home/stream/.ssh/identity type 0 debug1: identity file /home/stream/.ssh/id_rsa type -1 debug1: identity file /home/stream/.ssh/id_dsa type -1 debug1: Remote protocol version 1.5, remote software version OpenSSH_2.9p1 debug1: match: OpenSSH_2.9p1 pat ^OpenSSH debug1: Local version string SSH-1.5-OpenSSH_2.9p1 debug1: Waiting for server public key. debug1: Received server public key (768 bits) and host key (1024 bits). debug1: Host 'server' is known and matches the RSA1 host key. debug1: Found key in /home/stream/.ssh/known_hosts:5 debug1: Encryption type: 3des debug1: Sent encrypted session key. debug1: Installing crc compensation attack detector. debug1: Received encrypted confirmation. debug1: Trying RSA authentication with key 'stream@server' debug1: Received RSA challenge from server. debug1: Sending response to host key RSA challenge. debug1: Remote: RSA authentication accepted. debug1: RSA authentication accepted by server. debug1: Sending command: ls -la /var/log/server/*.log debug1: Entering interactive session. debug1: fd 0 IS O_NONBLOCK debug1: fd 1 setting O_NONBLOCK debug1: fd 2 IS O_NONBLOCK -rw-r----- 1 stream stream 32565 Jul 19 16:59 /var/log/server/access.log -rw-r----- 1 stream stream 0 Jul 19 01:07 /var/log/server/cache.log -rw-r----- 1 stream stream 683 Jul 19 15:24 /var/log/server/error.log -rw-r----- 1 stream stream 14049 Jul 17 14:15 /var/log/server/start.log At this point the whole thing hangs. SSH won't return, but closing connection to the remote system. Killing this process will help. Killed by signal 15. debug1: Calling cleanup 0x8064ea0(0x0) -- Thomas

1 0

Re: [suse-security] Strange HTTP requests
by michael.ryan＠storm.ie 20 Jul '01

20 Jul '01

... on the same thread ... are there any known exploits/vulnerabilities for Apache 1.3.12 running on SuSE? (The only issue I found on http://www.suse.com/us/support/security/index.html was dated 07-09-2000 and just required a minor edit to httpd.conf) should I upgrade to 1.3.19 anyway? TIA Michael Lars Trebing <ltrebing@ltr To: SuSE Security Mailing List <suse-security(a)suse.com> ebing.de> cc: Subject: [suse-security] Strange HTTP requests 07/19/2001 07:46 PM Hello everyone, My Apache has just got three strange requests from three different addresses: 63.149.209.133 - - [19/Jul/2001:18:55:47 +0200] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 315 209.215.117.8 - - [19/Jul/2001:19:14:28 +0200] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 315 161.184.88.254 - - [19/Jul/2001:19:21:18 +0200] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 315 Might this perhaps be an attack for a known bug of some HTTP server? Should I maybe even worry about this? (I am running Apache 1.3.12). By the way, I performed the same request locally and got a 404 error instead of the 400s reported in the log. TIA, Lars -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

6 7

Re: [suse-security] ssh version and suse 6.4 i386
by michael.ryan＠storm.ie 20 Jul '01

20 Jul '01

mike, I am using OpenSSH_2.9p1 on SuSE 6.4 which afaik is the latest OpenSSH version for the 6.4 distribution. You can find it in /pub/suse/i386/update/6.4/sec1 at ftp.suse.de (it's not on the ftp.suse.com server due to crypto restrictions) You might have to do a rpm -e {current SSH package} before installing the OpenSSH package .... as far as I remember, I had problems installing OpenSSH until I removed the existing SSH package. Hope this helps. Michael berthaa(a)mac.c om To: suse-security(a)suse.com cc: 07/19/2001 Subject: [suse-security] ssh version and suse 6.4 i386 04:44 PM can anyone advise me on what version of ssh or openssh to install on a i386 running suse 6.4 system, the rpm application on suse 6.4 is rpm 3.0.4. what happens is, i cant get downloaded ssh & openssh rpms to install on system. the error message is as follows: only versions <=3 can be installed "pre install error" ssh doesn,t figure on cds of suse 6.4 so i am referring to various ftp downloaded rpms of ssh and openssh, same error message. other rpm packed applications seem to install problemless thanks mike -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Strange HTTP requests
by Lars Trebing 19 Jul '01

19 Jul '01

Hello everyone, My Apache has just got three strange requests from three different addresses: 63.149.209.133 - - [19/Jul/2001:18:55:47 +0200] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 315 209.215.117.8 - - [19/Jul/2001:19:14:28 +0200] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 315 161.184.88.254 - - [19/Jul/2001:19:21:18 +0200] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 315 Might this perhaps be an attack for a known bug of some HTTP server? Should I maybe even worry about this? (I am running Apache 1.3.12). By the way, I performed the same request locally and got a 404 error instead of the 400s reported in the log. TIA, Lars

3 2

RE: [suse-security] Strange Log Message
by Reckhard, Tobias 19 Jul '01

19 Jul '01

> I'm getting an unusual message on the console which says..... > > Packet log: output DENY ippp0 PROTO=17 xxx.xxx.xxx.xxx: 61417 > 194.247.47.47 L=78 S=0x00 I=36552 F=0x4000 T=63 (#5) > Are you sure that's all there is? I'm missing the destination port number. 61417 is the source port. The destination port could tell us what the packet was supposed to achieve. > Both the 61417 and the 36552 numbers rise all of the time to the next > one and then drop back down to another one. Also getting ........ > The rise in those numbers is their expected behaviour, since the source port is allocated by the IP masquerading code and the IP ID, used to distinguish IP packets from one another, seems to change in the same fashion in the Linux TCP/IP stack. > IP_MASQ: lp_fw_masquerade(): change masq.addr from xxx.xxx.xxx.xx to > xxx..xxx.xxxx.xx. Both these addresses are on this machine. One of > them is eth0 and the other is the address of the machine. > Could be the machine is running out of source ports to use or the masquerading table per source address is full. I don't know if the latter is real, though, i.e. if there is a separate table per source address. > Seen this on every SuSE 7.1 machine that I've installed. Anyone know > what to do about it ? > Well, why do you have ipchains rules configured to block that traffic and what is generating it, those are the questions to be answered. Cheers, Tobias

4 5