July 2001 - openSUSE Security - openSUSE Mailing Lists

want
by kaldewey 24 Jul '01

24 Jul '01

Hallo all :) For an exhibition I need some workstations / terminals , wich only have access the homepage of some organisations . How can I manage this with ip-chain or are their any other solutions ? Thanks Frank

2 1

netstat shows a lot of connections that seem to be strange
by Jörg Reiners 24 Jul '01

24 Jul '01

Hi, I have set up a DNS, WWW, FTP and E-Mail server using Suse Linux 6.2. The machine is also used as PROXY for my clients to connect to the internet. Now I recognized with the help of the netstat command that there are a lot of connections to the internet that seem to be strange. Special IP adresses or URL concerning spam of xxx stuff are somehow connected to my server. As far as I can tell from the netstat output these IPs connect to the www port or use a few other port numbers at the same time. So I guess my system is insecure and someone has a backdoor to my server. Can anyone tell me how to recognize intrusions using Linux commands ? And how can I stop the abuse of my system. I am not so familiar with Linux and was happy to have set up a system which can do all internet related stuff my company needs. But now it seems to become a problem. Ciao, Joerg Reiners

2 1

Should I be worried about the CodeRed Worm?
by Michelangelo van Dam 24 Jul '01

24 Jul '01

Dear all, I'm hearing more noises that the Code Red Worm is becoming a serious problem. See : http://www.symantec.com/avcenter/venc/data/codered.worm.html Although they only mention Microsoft Windows 2000 and IIS webserver, I can't find any clearance/danger notes for other webservers running on systems different from Microsoft. Can someone verify that this worm has no effect on Apache 2.3.20 running on S.u.S.E. 7.2 with Kernel 2.4.4? Yours sincerely, Michelangelo van Dam -------------------------------------------------------------------------- Michelangelo van Dam Mobile: +32 (0)479 922 951 Assistant Support Engineer E-mail: michelangelo(a)skynet.be --------------------------------------------------------------------------

3 2

Re: [suse-security] Should I be worried about the CodeRed Worm?
by michael.ryan＠storm.ie 24 Jul '01

24 Jul '01

This worm currently propagates by exploiting an unchecked buffer in the Index Server ISAPI extension and applies only to web servers (IIS4 & 5) running on WindowsNT and 2000. Michael Michelangelo van Dam To: suse-security(a)suse.com <michelangelo@adva cc: lvas.be> Subject: [suse-security] Should I be worried about the CodeRed Worm? Sent by: mike(a)yovanca.costa futura.com 07/24/2001 11:19 AM Please respond to Michelangelo van Dam Dear all, I'm hearing more noises that the Code Red Worm is becoming a serious problem. See : http://www.symantec.com/avcenter/venc/data/codered.worm.html Although they only mention Microsoft Windows 2000 and IIS webserver, I can't find any clearance/danger notes for other webservers running on systems different from Microsoft. Can someone verify that this worm has no effect on Apache 2.3.20 running on S.u.S.E. 7.2 with Kernel 2.4.4? Yours sincerely, Michelangelo van Dam -------------------------------------------------------------------------- Michelangelo van Dam Mobile: +32 (0)479 922 951 Assistant Support Engineer E-mail: michelangelo(a)skynet.be -------------------------------------------------------------------------- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

tis and ssl
by Brina 23 Jul '01

23 Jul '01

Hi all, could anybody help me to solve the following problem: How is it possible to access secure http sites (https) and use SSL with TIS FWTK fwtk 2.x Do I need to download a seperate modul (ssl-gw)? Or can I do SSL tunneling support with plug-gw? What is to consider using plug-gw! I am a newbie and I appreciative every tip :-)). Bye Brina

2 1

YOU updates fails
by Stefan_Walther＠gehag-dsk.de 23 Jul '01

23 Jul '01

Hi folks, I want to update my system by using YOU but at any time at any server it fails. The log displays, that the update tries to download from the following directory i386/update//patches as you can see, the update tries to use a double slash. how can I correct this, that the update doesn't fail anymore. thx MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

3 2

Tnanks to all folks !!
by Dario Riquelme Zornow 23 Jul '01

23 Jul '01

i went for a coffe, and was surprissed about all fastes answers few weeks ago i make a question to IBM about my websphere , and it take 2 days for a answers Thanks ! _____________________________ /"\ Dario Riquelme Zornow \ / ASCII Ribbon Campaign dario(a)riquelme.cl X Against HTML Mail Escuela de Injenieria y Ciencias / \ Universidad de Chile / \

1 0

Antivirus on Sendmail
by Dario Riquelme Zornow 23 Jul '01

23 Jul '01

doeas anybody know about some window$ antivirus for my Suse Mail server ?? i mean, something who can check mails before my users take them from the server, to theys win computers. Thanks _____________________________ /"\ Dario Riquelme Zornow \ / ASCII Ribbon Campaign dario(a)riquelme.cl X Against HTML Mail Escuela de Injenieria y Ciencias / \ Universidad de Chile / \

5 5

fw config to get only one url
by kaldewey 23 Jul '01

23 Jul '01

Hi :) Is it possible to configure the fw to get only one url \ ip nummer for the internet if browsing from insite of the fierwall . Thank you Frank

2 1

AW: [suse-security] VPN Question
by Battisti Markus 23 Jul '01

23 Jul '01

> Hi. I think pptpd listens on port 1723. But I don't know if > there are any pptpd uses port 1723 and protocol 47 *ATTENTION not PORT 47* > other ports used. Just try and turn on logging for denyed > packets to watch > any other ports. > ,,, /'^'\ ( o o ) oOOO--(_)--OOOo---------------------- Mit Freundlichen Grüssen/Best Regards Battisti Markus /"\ \ / ASCII Ribbon Campaign X Against HTML Mail / \ PGP key available on request This message was sent using 100% recyclable electrons

1 0