September 2001 - openSUSE Security - openSUSE Mailing Lists

fw on CD
by kaldewey frank 14 Sep '01

14 Sep '01

Hallo :) has anyboddy work with the suse fw on CD What tell profis about? Thanx Frank

3 2

Configuration Problems with syslog
by Guido Tschakert 14 Sep '01

14 Sep '01

Hello list, I'm building a firewall-system with cisco-routers and a linux-box. All logging of the machines should be send via syslog to a log-box. For each machine I want a separate logfile. In cisco-ios I can say: logging facility local0 logging log-box, which tells the router to send all logging to log-box using facility local0. And tell the syslog on the log-box: facility local0 should be dumped in /var/log/router1 But I don't see any chance to change the facility of ipchains. It has the facility kern so that the logging of the firewall-linux-box is mixed together with the local logging of the log-box. Is there any change to configure syslog or ipchains to have two separate logfiles for the firewall-box and the log-box on the log-box. THX Guido -- ----------------- Guido Tschakert SRC, SysAd -----------------

3 2

AW: [suse-security] SuSE is not logging anymore..
by Hirsch Wolfgang 14 Sep '01

14 Sep '01

try to restart syslogd with kill -HUP pid Wolfgang -----Ursprüngliche Nachricht----- Von: spiekey [mailto:spiekey@hotmail.com] Gesendet: Freitag, 14. September 2001 13:13 An: suse-security(a)suse.com Betreff: [suse-security] SuSE is not logging anymore.. Hello! what could be the reason that suse won´t write into my /var/log/messages anymore? The last activity was from the 11th of September. Anyone any idea? Thank you, Spiekey

1 0

SuSE stopps logging!
by spiekey 14 Sep '01

14 Sep '01

Hello! My SuSE box stopps logging the /var/log/messages since the Sep. 11th. -rw-r----- 1 root root 530468 Sep 11 11:44 messages -rw------- 1 root root 12 Sep 14 10:04 messages.offset what is the message.offset good for? # less messages.offset 10817 530468 #--> that is exactly the size of my messages file. I am a bit worried. Spiekey

3 3

malicious IDE bit-zeroing worm ?
by dove 14 Sep '01

14 Sep '01

hi, vi, without an apparent reason, began to segfault on us. rpm -Vf `which vi` showed that the md5sum was incorrect. The timestamp on the file was unchanged. The substance of the problem is that two bytes in the vi binary have spontaneously become zero's. These bytes do not have a significant effect on the code, but do make it stop working: $ diff -u vi.hex vi.oops.hex --- vi.hex Thu Sep 13 08:58:03 2001 +++ vi.oops.hex Thu Sep 13 08:57:56 2001 @@ -9981,7 +9981,7 @@ 26fc0 88 c2 89 95 50 ff ff ff 83 c4 f8 6a 64 a1 3c ca .Â..Pÿÿÿ .Äøjd¡<Ê 26fd0 0d 08 50 e8 28 cf 01 00 83 c4 10 85 c0 0f 95 c0 ..Pè(Ï.. .Ä..À..À 26fe0 31 d2 88 c2 89 95 4c ff ff ff 83 c4 f8 6a 78 a1 1Ò.Â..Lÿ ÿÿ.Äøjx¡ -26ff0 3c ca 0d 08 50 e8 06 cf 01 00 83 c4 10 85 c0 0f <Ê..Pè.Ï ...Ä..À. +26ff0 3c ca 0d 08 50 e8 06 cf 01 00 83 c4 10 85 00 00 <Ê..Pè.Ï ...Ä.... 27000 95 c0 31 d2 88 c2 89 95 48 ff ff ff a1 60 5c 0d .À1Ò.Â.. Hÿÿÿ¡`\. 27010 08 c7 05 a0 57 0d 08 00 00 00 00 83 78 50 00 75 .Ç. W... ....xP.u 27020 43 83 7d 9c 00 75 3d 83 7d 98 00 75 37 83 c4 f8 C.}..u=. }..u7.Äø This machine is running kernel 2.4.4 and reiserfs. The disk is a 20G ST320413A IDE disk (PIIX4 chipset revision 1). interesting problem : could be a file system error in reiserfs but then how did it write to the binary ? and only the one ? wich means it could be a security problem ? obvious things eg. tripwire, snort, other binaries, -- checked, no obvious signs of compromise. running no services with known holes. thanks, doVe

2 1

Re: [suse-security] SuSE stopps logging!
by Markus Gaugusch 14 Sep '01

14 Sep '01

> yes, i am using logcheck, is that bad? no, that's great :) it's perfectly normal to have those .offset files. > # ps uax |grep syslog > root 355 0.0 0.4 1340 588 ? S 09:46 0:00 /sbin/syslogd > root 1310 0.0 0.4 1532 548 pts/1 S 10:52 0:00 grep syslog this is ok. if you still get no logging, restart syslogd rcsyslog restart (or rcsyslogd restart?) Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

1 0

firewall2 ICMP MASQ?
by Anthony Hogbin 13 Sep '01

13 Sep '01

Hello All Same issue, different person - no resolution as yet. Firewall2 - on SuSE 7.1 kernel 2.4.x LAN is masqueraded. DMZ is real IP External IP is real IP ISSUE: Masqueraded LAN is 192.168.x.x - it can ping the DMZ machines, and the firewall (with all ping settings set to "yes" - however is unable to ping machines out in the real world. Surely since the local IP's are masqueraded - they go out with it's IP address, and are routable? The firewall is set to full logging - yet the it says quite happily FW-ACCEPT-PING and passes it from LAN NIC to world facing NIC. ALLOW_PING is set to yes for FW DMZ and EXT while I am testing. Looking at the tcpdump from the external NIC I can see that it is trying to ping from 192 address. How on earth do I get it to Masquerade the ping? If I restrict what services they have - then I cannot ping. If I masq with simply 192.168.0.0/24 it works.... and it will not allow me to do 192.168.0.0/24,icmp *ARGH* Can someone put me out of my misery? -----Original Message----- From: semat [mailto:semat@wawa.eahd.or.ug] Sent: 17 July 2001 10:41 To: maillist Cc: suse-security(a)suse.com Subject: Re: [suse-security] Suse firewall script question > network. But no request gets an answer. Are you using private address space or public space? if it is private then you have to turn on masquerading for the internal network. However if your network is using public ip addresses, then it is ok. However in both cases you should turn on ip forwarding if the two networks are on different interfaces on your machine. This can be done by editing /etc/rc.config and setting ip_forward=yes or in the firewall preferably both. Or you can do it manually whenever you need to with echo 1> /proc/sys/net/ipv4/ip_forward and tunr it off with echo 0> /proc/sys/net/ipv4/ip_forward Noah. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com __________________________________________________ A n t h o n y H o g b i n www.zerosandones.co.uk lynx -source http://www.zerosandones.co.uk/anthony.pgp | pgp -fka

1 0

RE: [suse-security] reverse Proxy [was: http proxy]
by Scharpff＠tembit.de 13 Sep '01

13 Sep '01

mmh ... Maybe this is realy a missunderstandig. What I`m searching is a pice of Software that I can publish my HTTP-Servers in my DMZ to the world. AND I would like to do things like: www.Name.de/sub1/ -> box2.internal/sub_main/sub www.Name.de/sub2/ -> box3.internal/something_else/sub www.Name.de/sub1/sub2 -> box2.internal/sub_main/sub3 We have one external IP, but have very different boxes for the diffrent parts of our Web-Service. Like box2 runs NT, box3 runs Solaris. As far as I know Squid does only a Proxy the other way round. Maybe I can do this even with a kind of redirecting, therefor we mostly have generated JPEG's, they woun't be cached anyway. Franziskus > -----Original Message----- > From: Kurt Seifried [mailto:listuser@seifried.org] > Sent: Donnerstag, 13. September 2001 10:43 > To: Franziskus Scharpff; suse-security(a)suse.com > Subject: Re: [suse-security] reverse Proxy [was: http proxy] > > > > Hello, > > > > might be off topic, but I'm searching for a reliable > Reverse-Proxy for Our > > Web-Servers. > > A more correct term is HTTP accelerator (couldn't figure out > your email > initially =). > > > As far as I know does Apache do the Job, but only for HTTP 1.0. > > Are there any other Solutions ? > > Or is the mod_proxy meanwhile updated ? > > Squid will pass HTTP 1.1 headers, Apache too. mod_proxy is > updated in 1.2. > > > Any Security-Hole's ? > > Yup. Misconfiguration is easy. I may be able to use your > proxy to attack > your internal network for example. Or anonymize my web > surfing. If you do it > be very restrictive and use firewalling on the accelerator machine to > enforce what it should do (i.e. only talk to port 80 on internal www > server). > > > Thank you for your help. > > > > Franziskus > > Kurt Seifried, kurt(a)seifried.org > PGP Key ID: 0xAD56E574 Fingerprint: > A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 > http://www.seifried.org/ > >

4 3

reverse Proxy [was: http proxy]
by Scharpff＠tembit.de 13 Sep '01

13 Sep '01

Hello, might be off topic, but I'm searching for a reliable Reverse-Proxy for Our Web-Servers. As far as I know does Apache do the Job, but only for HTTP 1.0. Are there any other Solutions ? Or is the mod_proxy meanwhile updated ? Any Security-Hole's ? Thank you for your help. Franziskus > -----Original Message----- > From: Kurt Seifried [mailto:listuser@seifried.org] > Sent: Donnerstag, 13. September 2001 08:41 > To: suse-security(a)suse.com > Subject: [suse-security] re: http proxy > > > How is it a resource hog? You can tune it to be as > lightweight or heavy as > you want (personally I let it have 256 megs of ram and a gig > of drive space > and it's my personal proxy). > > P.S.: use freaking text mail. > > Kurt Seifried, kurt(a)seifried.org > PGP Key ID: 0xAD56E574 Fingerprint: > A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 > http://www.seifried.org/ > > > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

2 1

re: http proxy
by Kurt Seifried 13 Sep '01

13 Sep '01

How is it a resource hog? You can tune it to be as lightweight or heavy as you want (personally I let it have 256 megs of ram and a gig of drive space and it's my personal proxy). P.S.: use freaking text mail. Kurt Seifried, kurt(a)seifried.org PGP Key ID: 0xAD56E574 Fingerprint: A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://www.seifried.org/

1 0

http proxy
by Togan Muftuoglu 13 Sep '01

13 Sep '01

Hi, I want to enable http proxy on my firewall/router which has 24 MB RAM and very limited HD space. Therefore I need a http proxy which is very small in the needs for RAM and HD space. I found tinyproxy to be one solution. Has anyone applied this or any other http proxy on a limited resources. TIA -- Togan Muftuoglu

7 9

shadow.rpm / useradd error (fwd)
by Marcel Ritter 11 Sep '01

11 Sep '01

Hi! The following post was send to the shadow maintainer/and SuSE support last week. No response from SuSE yet - perhaps someone here is interested and may psuh things a little :-) Bug was confirmed by maintainer and already made it into CVS version. (More: ftp://ftp.pld.org.pl/software/shadow/README) Ciao, Marcel --------------------- Hi there! I tried to add an awful lot of users to one group today using "useradd" from the shadow package. After some odd error messages I had a look at my /etc/group and the line containing my group/users was trashed. After some testing I had a look at the sources and tried the latest shadow release 20001016 - same problem. So I did some debugging and found the source of the problems. Due to a big buffer size in lib/commonio.c this error does only appear if a line gets longer than 4096 bytes - so I guess there are very few people stumbling across this. Anyway I fixed it - patches are included (the second one is only needed to make it compile on my system). I tried my code with a buffer size of only 32 bytes and it worked - so I guess 4096 should be fine too :-) Hope there'll be a correct version soon. I also had a look at the CVS version of the shadow utils - but the concerned files are unchanged since 20001016. Test script: #!/bin/sh typeset -i NUM NUM=0 groupadd demogroup while [ $NUM -le 1000 ]; do useradd -g demogroup -G demogroup -p "NONE" user$NUM NUM=$NUM+1 done # don't forget to have a look at /etc/group if you ran it Ciao, Marcel Ritter -- Linux-Betreuer Regionales Rechenzentrum Erlangen diff -Nur shadow-20001016.orig/lib/commonio.c shadow-20001016/lib/commonio.c --- shadow-20001016.orig/lib/commonio.c Sat Sep 2 20:40:42 2000 +++ shadow-20001016/lib/commonio.c Thu Sep 6 21:36:56 2001 @@ -470,12 +470,15 @@ while (db->ops->fgets(buf, buflen, db->fp)) { while (!(cp = strrchr(buf, '\n')) && !feof(db->fp)) { + int len; + buflen += BUFLEN; cp = (char *) realloc(buf, buflen); if (!cp) goto cleanup_buf; buf = cp; - db->ops->fgets(buf + buflen - BUFLEN, BUFLEN, db->fp); + len = strlen(buf); + db->ops->fgets(buf + len, buflen - len, db->fp); } if ((cp = strrchr(buf, '\n'))) *cp = '\0'; diff -Nur shadow-20001016.orig/src/useradd.c shadow-20001016/src/useradd.c --- shadow-20001016.orig/src/useradd.c Mon Oct 9 22:03:12 2000 +++ shadow-20001016/src/useradd.c Thu Sep 6 21:40:35 2001 @@ -1765,7 +1765,7 @@ * to that group, use useradd -g username username. * --bero */ - if (! (nflg || gflg)) { + if (! gflg) { if (getgrnam(user_name)) { fprintf(stderr, _("%s: group %s exists - if you want to add this user to that group, use -g.\n"), Prog, user_name); exit(E_NAME_IN_USE);

2 1

Why isn't the telnetd update in YOU yet?
by JW 11 Sep '01

11 Sep '01

Hello, I just fired up YaST2 on my servers in order up update the telnetd, and have found that it's not in YOU yet. Is there any explanation for why it's not? Surely SuSE understands that security issues are time sensitive. ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

2 1

question ipchain-ip address
by J Barnes 11 Sep '01

11 Sep '01

Hi I'm writing custom ip chains and am filtering out ip addresses that are not mine. the book i bought on ipchains specifys a static ip address for me in the chains but my internet provider gives me a dynamic ip address on my modem connection. How can I associate the dynamic address with the static address in my ip chains? Is there a better way? PLEASE HELP

4 3

Checking for telnetd exploit
by JW 11 Sep '01

11 Sep '01

Hello, I have unfortunately discovered that telnet was still enabled on a couple of my servers, and feel that is it very necessary to check for exploitation. However I'm having trouble trying to find out what to look for, the only thing I've found is: "An infected system also creates a lockfile in reference to the back door; this will appear as '/tmp/982235016-gtkrc-429249277'. The presence of this lockfile is an indication of a potential infection with the Remote Shell Trojan." I would actually like to know even if I've been hit, not just if the attempt was successful. Can anyone point me to some information on what to look for? P.S. I have not yet figured out if x.c is the same as RST yet :-) ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

1 0

Re: [suse-security] Apache on SuSE 7.2 and .htaccess
by Markus Gaugusch 10 Sep '01

10 Sep '01

On Mon, 10 Sep 2001, Ernesto Fries wrote: > chmod a+r .htacces > chmod a+r .htpasswd no, this is not the problem :( # ll .htaccess -rw-r--r-- 1 root root 14 Sep 10 12:13 .htaccess Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

6 13

SuSE Security Announcement: apache-contrib (SuSE-SA:2001:31)
by Thomas Biege 10 Sep '01

10 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: apache-contrib Announcement-ID: SuSE-SA:2001:31 Date: Monday, September 10th 2001 12:30 MEST Affected SuSE versions: 7.1, 7.2 Vulnerability Type: authentication bypass Severity (1-10): 3 SuSE default package: no Other affected systems: yes Content of this advisory: 1) security vulnerability resolved: mod_auth_mysql problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The Apache module mod_auth_mysql 1.4,which is shipped since SuSE Linux 7.1, was found vulnerable to possible bypass authentication by MySQL command injection. An adversary could insert MySQL commands along with a password and these commands will be interpreted by MySQL while mod_auth_mysql is doing the password lookup in the database. A positive authentication could be returned. Note, that this bug has not yet been proven exploitable so far. A temporary fix does not exist; we recommend to update your system with the new RPM from our FTP server. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Uhv file.rpm" to apply the update. After installing the updated RPM run - rcapache restart - SuSEconfig i386 Intel Platform: SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/apache-contrib-1.0.9-94.i386… 7c84f6c3f8aaf2b96a312fea4d36abce source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/apache-contrib-1.0.9-94.src… 56ad3d7f883a3e3eb5e96c5a92f7a2e2 SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/apache-contrib-1.0.8-35.i386… cd7cedc70d56df239db8e4434344a46e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/apache-contrib-1.0.8-35.src… 7a0ca55c351b81756a05dfcff4e062be Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/apache-contrib-1.0.8-22.spa… bdb772783eedc1fb235e2ff0af5517f7 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/apache-contrib-1.0.8-22.sr… a5b625c3b0820f4715aeee18d20a9306 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/apache-contrib-1.0.8-23.alpha… 3958307564b855c81e556b4c7e01c105 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/apache-contrib-1.0.8-23.src.… 143386a82750af64aec0f615fc847ab2 PPC Power PC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/apache-contrib-1.0.8-22.ppc.r… 97e4ab067fc16b36ecdd5bc8915379ef source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/apache-contrib-1.0.8-22.src.… aa2f5914d8e00ef511081096a1c33671 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We advise against subscribing to lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =================================================== SuSE's security contact is <security(a)suse.com>. The <security(a)suse.com> public key is listed below. =================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GZkBogQ57vSBEQQAk/GN+ftr 7+DBlSoixDDpfRnUk+jApGEt8hCnrnjVnPs/9Cr33+CXLQbILOO7Y5oiPbJdHh45 t4E0fKyLVzDerCRFB1swz/mNDxT26DLysdBV5fwNHTPhxa67goAZVrehQPqJEckk IpYriOaYcKpF3n5fQIZMEfMaHEElQhcXML8AoJVXDkJYh7vI8EUB8ZURNLZMEECN A/sH0MCnb4Q6ZcRyeZ3+1PHP8hP73b6TepRdLZhaylwVF/iu7uIn62ZUL4//NTOC DY7V63qg4iba/fUbOsWtEnGaiE7mQuAlsSWvRspwRA9/g9rdVf3/JdLJrLmKBThe yG+PSJE3W7cAE4ZWafGxIRCwXhmj3TQnJn2euqylHRubEQP/aL53NZK0kBdvrKgf f6O8Of6tqoss8Dkk55I7QVFSp+My1Dn+mngQKFejTAgtyo/WmR3wPjQ9HoT2lRiY I2lTRYT4uMdHuwVC3b4DqAKmoy375FERwHkrMVyKBJslv8QtbAWw5A1CAUseaHo+ 91wmYJ4/4p6YUahqbG/tZyhbxfq0KFN1U0UgUGFja2FnZSBTaWduaW5nIEtleSA8 YnVpbGRAc3VzZS5kZT6IXAQTEQIAHAUCOe70gQUJA8JnAAQLCgMEAxUDAgMWAgEC F4AACgkQqE7a6JyACspfLACffAYA+NM8NBhyRyH+nTX58CNjwLIAoIx9fj52BJe0 xY7WbKoXs1+72b2AiEYEEBECAAYFAjpwXlIACgkQnkDjEAAKq6TczgCgi+ddhWb7 +FWcfeE6WwPZccqAHowAnjjtRyGwHLQHr5OTFAYTXi2Wv6jNiQEVAwUQOnBgb3ey 5gA9JdPZAQE1pwf/QJ+b34lFBNVUJ7fk/xGJJREt7V12iSafaRzGuH8xWvIz1bb+ VARxnnt16FDQ1cDNjoEhCEmcW83Vxp6iJXE9PE8wVA/Yue/bon5JS7J69+UiQ2eq 2pudfwljp52lYVM53jgPYEz0q/v3091nlZ8CYkAkN9JDS1lV1gEzJ7J0+POngDpU +lDQT2EC6VKaxeWK8pNt6UFDwICRDQxKnlOoiDvTrdWT7QdJZ4sPv8Qotdw9+tKN bWQ2DqdIRxyTdw9xDfAtcj6mXeQr7852Lwem1gSKVnEYHZ9g1FTJqVOutY8KhpUc 9RfOCRv8XuIxrs4KSbfSF0s8qIRCQelxufg9AbkCDQQ57vSSEAgAhJHQTejMX+Vr 6g1pHDEcusJ63fQ2CfFFE5iE9okH9O7UVCiSfb9CV38dmeHdPCEEjDUWquFYEnvj 3WICMtH249t1Ymuf4Du3yRKQ9oXdn/qTJzlrx9qzjiG3mH7ocwHOgUIwCrZoEdBE VE2n0zPVm+hddwjWWTWXw6pxQz+i9dsN89xexRV5M9O0bNwCLaNWX2GXeLAkqTK/ 9EuZy6x2yLxi6du9YYUAXkZpqBhCjtiUXpRoFCdglMznbcAyCk9C2wqb2j/D1Z2B eSBaGCSFkR6pRLebnE17LWcu72Iy+r0z+JecbPiyDpDZj4apn7IC81aNFGi7fNIT sHODbwwjiwADBgf/YPvVdzkc8OC7ztacEWCanwylKvxCdKzTDA+DfES6WUYShyiV JvZzRy25LJ5WcK20kzOS6Qv1OrIXiz/pdGy1aKtJZrAnFEsofpmOj8VoqyyFgp/y AGQBp12+mXek7SCZRhuqalDfEMRiWEJ6J5dLkyShyRDWyPbFh0HXE7QTHN+IKKxx QqNQXL6Z3NSxS61p+5n6BseiDUI39xxkKTFwFrkgUIc5Gs2Or2lhaWvGwSfoCmwb sklszZt6xbU+R0SjFqTvjPWx6eHfqbmNC9WMDdTjGrXDDKXFp2aYlokfN6It9vsb VlGNlOwHt/JjGoPMxW6Xqj0FLA7/VewgCdXW64hMBBgRAgAMBQI57vSSBQkDwmcA AAoJEKhO2uicgArKSyIAmwUHf/vtKQfcmVg4asR7U6XQl0bAAJ4pO22B5U8UH6IY l2LBCXFqw5+5fA== =Jnnf - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQEVAwUBO5znyXey5gA9JdPZAQGEOQgAhl5wJwgsVz7fjcPP+fRM85AHW44/4Fgt RBbiEH7j3e8/k9eALFyBUxRZ5s8Nx7ouTyMHaypdqzacQT2LLsr2XKLIUgVPBRNg WJu/FuMfmJ2716SIhAto9hyShZO/KNjXPiW/V02EB1oLETaGzBZtGH4+lHIF4KQr 7vJ6FlRDPUpAZgRWgkCVP1gV1IhurqHCDUufclSPISJzaaP5P/v1JqEdAgrKykyk S2yAu8W/cNbenot8TV3GopfuGf/wlPkhUd8BloT2otLo6WkHlLLxd1FC3jm0CFHD SVYH2DPvX2AarnkH2yag7KFc0kZLwzQIYmliJ7purS3E63ZFtbTcdw== =tPMa -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/contact/thomas.asc | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 84

1 0

https and portforwarding
by Philipp Snizek 10 Sep '01

10 Sep '01

Dear list users, This is the config I have: Inet network: 195.144.47.112/29 RFC1918 network: 192.168.1.0/29 border gateway --- gate.belfin.ch --- IIS 5 http/https .113 eth0: .114 eth0: .2 eth1: .1 Portforwarding is set up on gate.belfin.ch (linux box) from .114 to .2 on ports 80 and 443. I can access http on .2, but I cannot access https. I don't think theres something wrong with my portforwarding config (see below). But there could be something wrong with the ssl certificate. Telnetting from .1 to .2:80 and .2:443 is no problem. Locally on .2 I can access to http but not to https. IE says server or DNS cannot be found. Seems like the port is being resetted by 192.168.1.2: iptraf screenshot for https after loading the web page: 195.144.47.114:443 212.254.96.227:10117 4 1136 CLOSED eth0 212.254.96.227:10117 195.144.47.114:443 7 557 CLOSED eth0 192.168.1.2:443 212.254.96.227:10117 4 1136 CLOSED eth1 212.254.96.227:10117 192.168.1.2:443 7 557 CLOSED eth1 iptraf screenshot for http after loading the web page: 212.254.96.227:10119 195.144.47.114:80 8 1719 --A- eth0 195.144.47.114:80 212.254.96.227:10119 5 1985 -PA- eth0 212.254.96.227:10119 192.168.1.2:80 8 1719 --A- eth1 192.168.1.2:80 212.254.96.227:10119 5 1985 -PA- eth1 Thank you any help. Philipp

1 0

Apache on SuSE 7.2 and .htaccess
by Markus Gaugusch 10 Sep '01

10 Sep '01

I'm having trouble with a fresh installed (and updated) suse 7.2 box. In a directory (/usr/local/httpd/htdocs/.../...) there is a .htaccess with the following content: --snip-- deny from all --snip-- But it does not work :( linux:~ # rpm -qa |grep apa apache-1.3.19-48 apache-contrib-1.0.9-94 are there any packets missing? I also disabled mod_auth_nds and mod_auth_ldap, (although they were not installed anyway, just for safety) thank you for help Markus Gaugusch -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

1 0

is this client being hacked?
by Gregory M. Begumisa 10 Sep '01

10 Sep '01

Recently a client's qpopper "just stopped working" without explanation The logs didn't reveal much....and so i simply reinstalled qpopper. what could cause qpopper to "die"? ---- Greg

1 0

rotate_logfiles possibly loss of information
by Severin Wiedemann 10 Sep '01

10 Sep '01

Hello ! I discovered that the script /etc/cron.daily/aaa_base_rotate_logs may loose information in the logfiles. it performs the following steps (a bit simplified) 1. cp "logfile" "logfile".o 2. cp "/dev/null" "logfile" 3. reload the service 4. compress the logfile etc. All data written to the logfile between step 1 and 2 will be lost. I don't know if it's save to cp a file while another process is writing to it, if not, step 1 alone may loose data. I wonder why this script doesn't do it the "normal" (or what I thought the normal way is):(a bit simplified) 1. mv "logfile" "logfile".o 2. touch "logfile" 3. reload the service 4. ... I think the security ml is appropriate, because (in)complete are very relevant for the security of our systems. thank you Nicolas/Severin -- Wiedemann EDV Systeme GmbH Landsbergerstr. 77 80339 München Tel.: 089/5108599-0 Fax.: 089/5108599-99

1 0

Firewall/IPChains or not ?
by A. Meinerzhagen 10 Sep '01

10 Sep '01

Hi, List. I have a question regarding the setup of our Webserver, well actually two. Is there a save way other than sftp/scp to let people update their webpages? Clients are using lots of Windows-Computers. After an Intrusion last week we don't like the idea anymore, that people use ftp to put their pages on the server. Does it make sense, with our setup, to use SuSE Firewall at all? Setup is : WWW---->FW---->(eth0) Webserver (eth1)<--->LAN ^ | ^ |------------------------v-----------------| Weird, I know. Incomming Traffic will go throug FW, but outgoing not. The Webserver-machine runs two instances of apache, to serve the www-pages and the local www-pages. That's the reason for the two NIC's. But by design we have to look at both NIC's as hostile Networks, because any computer is connected any time to the Inter- net (University). If using the Firewall, how would a setup look like? Or better IPChains? And what would the Rules be ? We are serving only ports 80, 443, and 22 (http, https, ssh) to the "outside" and at the moment to the "inside" also. If people would insist to use ftp from inside, what then ? Thanks in advance, A. Meinerzhagen

10 10

Re: [suse-security] Firewall/IPChains or not ?
by Wagner, Uwe 10 Sep '01

10 Sep '01

Hi, I'm using the following model with dynamic IP-Adress : Internet --- FW with webserver and ftp-proxy --- ftp-server --- LAN Updates from the LAN are done by rsync with ssh. The ftp-server exports a partition to the firewall, do you think, this is a problem ? And what's about exporting a partition from the ftp-server to the LAN for direct updates ? uwe -----Ursprungliche Nachricht----- Von: Stefan_Walther(a)gehag-dsk.de [mailto:Stefan_Walther@gehag-dsk.de] Gesendet: Samstag, 8. September 2001 20:28 An: suse-security(a)suse.com Betreff: Re: [suse-security] Firewall/IPChains or not ? Hi, I think you should install a second firewall. Maybe you should use the following model: INTERNET---FW1---(DMZ, with Webserver)---FW2---LAN You should be able to update your websites from the lan via ftp, without getting intrused by someone of the Internet. Maf king wrote that you should use iptables. Thats right, because of the real NAT which you can enable at FW1. At this point you can redirect incoming connections to port 80 to the webserver in the DMZ. The other ports can be closed if you do not need to use them. At FW2 you can enable NAT to the webserver via iptables. THX, have much fun. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Hi A.M. On 2001.09.08 15:17:46 +0100 A. Meinerzhagen wrote: > Hi, List. > > > Is there a save way other than sftp/scp to let people update their > webpages? > Clients are using lots of Windows-Computers. After an Intrusion last > week > we don't like the idea anymore, that people use ftp to put their pages > on the server. Can't think of anything easy... are all your users going to update from inside your LAN, or do thay have to update over the internet? One soloution I have seen to this problem is a temporary FTP password : something like 1. you email the server, 2. a pasword is generated and is only valid for one hour 3. password emailed back to the user. Not great, but cracker has less time when she can intrude your box. > > Does it make sense, with our setup, to use SuSE Firewall at all? > Setup is : > IMHO, it nearly always makes sense to firewall - layers of security make it harder for a bad guy to get anywhere even if he breaks into one box... > WWW---->FW---->(eth0) Webserver (eth1)<--->LAN > ^ > | ^ > |------------------------v-----------------| > > Weird, I know. Incomming Traffic will go throug FW, but outgoing not. > > The Webserver-machine runs two instances of apache, to serve > the www-pages and the local www-pages. That's the reason for the > two NIC's. But by design we have to look at both NIC's as hostile > Networks, because any computer is connected any time to the Inter- > net (University). If using the Firewall, how would a setup look like? > Or better IPChains? And what would the Rules be ? We are serving > only ports 80, 443, and 22 (http, https, ssh) to the "outside" and at > the moment to the "inside" also. If people would insist to use ftp > from inside, what then ? > I'm not sure how you gain anything by having 2 NICs on the same LAN, to my eyes, you seem to be making things too complicated... If you are using kernel 2.4.x, try iptables - it is more flexible than ipchains SuSE firewall basically makes rules for ipchains / iptables so one isn't "better" than the other, they use different ways to do the same thing. Given your unusual set-up (but fairly simple needs), I think you would be better to roll your own using iptables (sorry, Marc ;-) ) Have a look at the HOWTO at http://netfilter.samba.org for some iptables ideas. HTH, Maf. > > Thanks in advance, A. Meinerzhagen > -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Maf. King Standby Exhibition Services ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "It is easier to do a job right than to explain why you didn't." - Martin Van Buren ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Fw: Re: [suse-security] Strobe
by Peter Nixon 10 Sep '01

10 Sep '01

On Fri, 7 Sep 2001 14:02:12 +0100 Geraint Jones <geraint(a)jones5555.fsnet.co.uk> wrote: > Where can I download and how do I use strobe with SuSE 7.2 (kernel 2.4.4)? Errm. Why exactly do you want to use strobe? By your question it wouls seem that someone has told you to have a play with strobe, and you are not familiar with what it does exactly. Strobe is a very old portscanner (the first one ever) written by an Aussie named Julian Assange (homepage at http://www.iq.org) (As usual, us Aussies are the first!!!) He is now working on bigger and better things like Rubber Hose (http://www.rubberhose.org) It is very old, but if you still want a copy, you can find it at http://www.cotse.com/tools/pscan.htm Instead of strobe however, I suggest you take a look at Nmap (http://www.insecure.org/nmap/) which SuSE kindly include as an rpm in the Security secion of their cds -- Viel Spaß Nix - nix(a)susesecurity.com http://www.susesecurity.com

2 1

Re: [suse-security] Howto spread around the ext ip adress
by Stefan Knodt 09 Sep '01

09 Sep '01

I have a Firewall with a masqueraded DMZ. The adress of the external interface is not static (DHCP). The adress may change sometime. One of the servers in the DMZ needs to know the external adress. external interface | V Internet --------- Firewall ------ Intranet | | masq DMZ | |--- Server How can the Server determine the adress of the external interface or how can the firewall tell the adress of the external interface to the server Tks On Wed, 5 Sep 2001 12:25:21 -0500 (CDT), dog(a)intop.net wrote: >what exactly do you mean by this? > >On Wed, 5 Sep 2001, Stefan Knodt wrote: > >>Hi, >> >>since the external adress is assigned via dhcp and changes from time to time. >>What ist the most secure way to spread around the external ip adress to systems >>behind the firewall, e.g. in a masqueraded DMZ ? >>BTW the systems behind the firewall runs various OS. >> >>Thanks for your advice --------------------------- sknodt(a)bluewin.ch ---------------------------

2 1

stunnel vs sslwrap
by Steven Thompson 09 Sep '01

09 Sep '01

Hi All I would like to know which is best to use for IMAP. Is the one better than the other (ie faster, more stabe, more flexable, secure). Im currently using sslwrap. Thanks in Advance Steven Thompson

3 2

Re: [suse-security] IPCHAINS with dynamic DNS
by Stefan_Walther＠gehag-dsk.de 09 Sep '01

09 Sep '01

Hi you should use the ip-up and ip-down script in the /etc/ppp directory. In addition you should have a look at the SuSE-support-database, If I remember correctly, there is a way described how you can read the current IP of your interface to the internet and enabling the rules for this directly by use this IP. But if you do not want to do it in this way, switch to iptables with kernel 2.4.x. THX MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 eric.draven(a)aon.at 09.09.01 13:19 To: suse-security(a)suse.com cc: Subject: [suse-security] IPCHAINS with dynamic DNS Hi all, i recognized a strange (?) behavior of IPCHAINS toward dynamic DNS names. I have the following problem: i use a dialup-connection at home and want to grant SSH-access to our company server, but (of course) only for my IP. So I registered some dynamic DNS-service and applied the host "xxx.ath.cx". Now i added the neccessary rules to ipchains, using this hostname. It was working fine. But after i reconnected (and got a new IP) it was not working anymore. Strange. Then i re-checked the rules and saw that ipchains obviously resolves the IP of "xxx.ath.cx", reverse lookups it and inserts THIS result (which is now the hostname given by my provider) to the final rules. So the original rule of: ipchains -I input 1 -j ACCEPT -l -p tcp -i eth0 -s xxx.ath.cx -d dst 22 is translated to: (ipchains -L) target prot opt source destination ports ACCEPT tcp ----l- L0099P99.dipool.highway.telekom.at dst any -> ssh which is not really what i want.. :/ Is there any solution? Deleting and re-inserting this rules every minute via crontab is something i would not really like to do.. best regards, E. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] /lib/ld-2.2.2.so md5sum changed ?
by lars＠newsone.org 09 Sep '01

09 Sep '01

On Sat, Sep 08, 2001 at 04:53:19PM +0000, Fabian Haischmann <fcch(a)gmx.de> wrote: > Hi Lars, > > You have a via 82686 chip, which is buggy, if DMA is enabled. what does this mean exactly? necessary data corruption? > > I think in the Bios DMA is enabled for hda (dmesg output). > When did you make the hdparam output? There is DMA off, but (I think) in > the hdparam -i it's on (UDMA2). well, I wondered about it myself. the hdparm and hdparm -i where about the same second, few minutes after reboot... and I found no message about disabling DMA in the syslogs. suse 7.2 by default enables DMA support, if it thinks it worked (?). I did not fiddle with the settings myself. Not on this box, at least ;) so seemingly the kernel and the drive do not agree about the (en/dis)abled status of DMA? how comes? if hdparm shows me DMA is of, I probably can not disable it further... how can I disable this, then; and am I out of trouble if I could? will disabling DMA in the BIOS help? I thought the linux drivers do not care about bios settings. where can I find a list of known buggy, or even better a positiv list of recommended hardware?

1 0

VPN behind iptables v1.2.2
by Andreas Wahlert 09 Sep '01

09 Sep '01

Hi list, i have a VPN Gateway behind a linux iptables Firewall with v 1.2.2. But the iptables rules are not be able to allow or drop the GRE protocol (number 47). How can i configure the iptables to allow this protocol? If i allow only tcp or udp, the signing up to the Gateway don't work. Thanx for help Andreas Wahlert

1 0

Re: [suse-security] http proxy
by Volker Kuhlmann 08 Sep '01

08 Sep '01

> even something 5 years old. Squid is also good for blocking ads (sites load > much faster). So is SuSEfirewall. nslookup doubleclick.com etc and entered into the output chain with label "dump" works extremely well. I wrote a short script and just add IPs to a file. Volker

4 3

Re: [suse-security] Firewall/IPChains or not ?
by Stefan_Walther＠gehag-dsk.de 08 Sep '01

08 Sep '01

Hi, I think you should install a second firewall. Maybe you should use the following model: INTERNET---FW1---(DMZ, with Webserver)---FW2---LAN You should be able to update your websites from the lan via ftp, without getting intrused by someone of the Internet. Maf king wrote that you should use iptables. Thats right, because of the real NAT which you can enable at FW1. At this point you can redirect incoming connections to port 80 to the webserver in the DMZ. The other ports can be closed if you do not need to use them. At FW2 you can enable NAT to the webserver via iptables. THX, have much fun. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Hi A.M. On 2001.09.08 15:17:46 +0100 A. Meinerzhagen wrote: > Hi, List. > > > Is there a save way other than sftp/scp to let people update their > webpages? > Clients are using lots of Windows-Computers. After an Intrusion last > week > we don't like the idea anymore, that people use ftp to put their pages > on the server. Can't think of anything easy... are all your users going to update from inside your LAN, or do thay have to update over the internet? One soloution I have seen to this problem is a temporary FTP password : something like 1. you email the server, 2. a pasword is generated and is only valid for one hour 3. password emailed back to the user. Not great, but cracker has less time when she can intrude your box. > > Does it make sense, with our setup, to use SuSE Firewall at all? > Setup is : > IMHO, it nearly always makes sense to firewall - layers of security make it harder for a bad guy to get anywhere even if he breaks into one box... > WWW---->FW---->(eth0) Webserver (eth1)<--->LAN > ^ > | ^ > |------------------------v-----------------| > > Weird, I know. Incomming Traffic will go throug FW, but outgoing not. > > The Webserver-machine runs two instances of apache, to serve > the www-pages and the local www-pages. That's the reason for the > two NIC's. But by design we have to look at both NIC's as hostile > Networks, because any computer is connected any time to the Inter- > net (University). If using the Firewall, how would a setup look like? > Or better IPChains? And what would the Rules be ? We are serving > only ports 80, 443, and 22 (http, https, ssh) to the "outside" and at > the moment to the "inside" also. If people would insist to use ftp > from inside, what then ? > I'm not sure how you gain anything by having 2 NICs on the same LAN, to my eyes, you seem to be making things too complicated... If you are using kernel 2.4.x, try iptables - it is more flexible than ipchains SuSE firewall basically makes rules for ipchains / iptables so one isn't "better" than the other, they use different ways to do the same thing. Given your unusual set-up (but fairly simple needs), I think you would be better to roll your own using iptables (sorry, Marc ;-) ) Have a look at the HOWTO at http://netfilter.samba.org for some iptables ideas. HTH, Maf. > > Thanks in advance, A. Meinerzhagen > -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Maf. King Standby Exhibition Services ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "It is easier to do a job right than to explain why you didn't." - Martin Van Buren ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

non-Random IP ID
by Togan Muftuoglu 08 Sep '01

08 Sep '01

Hi, To test the effects of tinyproxy I have started on the firewall PC I did a nessus test via www.vulnerabilities.org. I did the test with and without the tinyproxy and the below comment is bothering me. This was not coming out with the tests I did before at the same site with the same Hardware and Software (SuSE linux 7.1 Kernel 2.2.19). The only change is the ISP is assigning the IP's from a different pool used to be 212.156.196.x now it 212.174.48.x /212.174.49.x) and maybe it has something to do from the ISP end ?? or my misconfiguration of something Security Warning found on port general/tcp The remote host uses non-random IP IDs, that is, it is possible to predict the next value of the ip_id field of the ip packets sent by this host. An attacker may use this feature to determine if the remote host sent a packet in reply to another request. This may be used for portscanning and other things. Solution : Contact your vendor for a patch Risk factor : Low -- Togan Muftuoglu

2 3

/lib/ld-2.2.2.so md5sum changed ?
by lars＠newsone.org 08 Sep '01

08 Sep '01

Hi there, I have a couple of suse 7.2 systems, on one of them # rpm -V glibc ..5..... /lib/ld-2.2.2.so # md5sum /lib/ld-2.2.2.so 36e9320d606f456f84951ba510209fc0 /lib/ld-2.2.2.so as opposed to 1312001a7eb2ccb4b666fe9f0775b932 /lib/ld-2.2.2.so as should be. this is glibc-2.2.2-38, and I wonder how this can happen. this one is almost always 'busy', so who or what could have changed it? one other shared libs related effect I have right now is that from one moment to the other our coldfusion server won't restart. it complains about unresolved symbols. any Idea? Thanks You, Lars

4 5

transfering accounts
by stephane parenton 07 Sep '01

07 Sep '01

Hi, I have an old RH6.0 box from which I'd like to export all the accounts to a brand new SuSE 7.2 box. here's the method I'd like to apply : Create the accounts with yast copying the /etc/passwd file from RH6.0 to SuSE 7.2 Copying the /etc/shadow file from RH6.0 to SuSE 7.2 Most of the accounts are customers accounts and I don't have all the passwd, so I don't want to miss one thing.... Regarding roots and internal accounts, everything is ok, I have the passwds.... Is the process correct, is it enough ? is there a simpler way to do this all ? Thanx Stephane

4 3

Apache problem behind packet filter
by Andreas Rittershofer 07 Sep '01

07 Sep '01

Due to security considerations my web server is placed behind a packet filter, both linux boxes. The webserver has the internal ip address 10.0.0.171, the packet filter has to the internal side the ip address 10.0.0.170 and to the outside the official ip address which would have the web server itself in case of no packet filter in between. On the webserver are hosted the pages of three domains, all under the same ip address, as name based virtual hosts, say domain1, domain2 and domain3. For domain1 there are the appropriate entries in /etc/hosts. When I want to access the web server apache with domain1 locally, i.e. with wget, all works fine. But for domain2 and domain3, this does not work, wget runs in a timeout. This is quite clear, because DNS gives the official ip address, not the internal 10.0.0.171. I added domain1 and domain2 to /etc/hosts, but two hours later, the server hanged. Was it the wrong syntax in /etc/hosts? How this must be? Or is it not possible to list more then one FQDN in /etc/hosts? Should it be 10.0.0.171 domain1 domain2 domain3 each as FQDN? mfg ar -- mailto:andreas@rittershofer.de http://www.rittershofer.de PGP-Public-Key http://www.rittershofer.de/ari.htm

1 0

Strobe
by Geraint Jones 07 Sep '01

07 Sep '01

Where can I download and how do I use strobe with SuSE 7.2 (kernel 2.4.4)? Thanks, G Jones.

2 1

Re: [suse-security] SuSEfirewall2 and ICMP
by James Bliss 07 Sep '01

07 Sep '01

I have mine with FW_ALLOW_EXT and this allows my internal clients to ping the internet. It sounds like you have something else setup which is preventing this ping. What are your settings for: FW_MASQ_NETS FW_ROUTE FW_MASQ_DEV FW_PROTECT_FROM_INTERNAL Jim 09/04/01 12:57:59 PM, "Peter Menzel" <Peter.Menzel(a)com-gmbh.de> wrote: >Hello, > >I successfully installed SuSEfirewall2 and configured it to my needs. The >firewall box is set up with two external interfaces (ippp0 and eth1). eth1 >is normally connected to an ELSA DSL router and in case DSL will not work I >want to switch back to ISDN. So far I've set up ISDN and that stuff, the box >is doing everything fine. Clients can do http, https, ftp, mail and so on. >Portscans run from the internet report all ports as stealth and the firewall >cannot be pinged from the internet. >But when it comes to a ping from the internal network to the internet, >nothing works. I've tried all the FW_ALLOW_PING_[FW|DMZ|EXT] settings, with >no results. Interesting: when I set FW_FORWARD_PING_DMZ="yes" I am able to >ping the internet from the firewall, but not from the clients. More >interesting: I have not configured a DMZ (yet). >What I would like to do is to ping the internet from the clients and get the >echo-reply back. echo-requests from the internet have to be dropped at the >firewall. >Has anyone experienced these problems? Any help would be appreciated. > >Thanks in advance, Peter >peter.menzel(a)com-gmbh.de > > > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

2 1

SuSEfirewall V1.2 > 1.7 wont work
by Appeldorn 07 Sep '01

07 Sep '01

OK - its Friday - but maybe there is quick hack possible. If if upgrade the script to v1.7 the whole box is closed. Why that ? Easy to circumvent ? Michael

1 0

SuSEfirewall2 all UDP port open ???!!!
by Appeldorn 07 Sep '01

07 Sep '01

At initially test i saw all my udp ports open in my testbed network. In the configfile of SuSEfirewall2 you can read : # 8.) # Do you want to autoprotect all running network services on the firewall? # # If set to "yes", all network access to services TCP and UDP on this machine # will be prevented (except to those which you explicitly allow, see below: # FW_SERVICES_{EXT,DMZ,INT}_{TCP,UDP}) # # Choice: "yes" or "no", defaults to "yes" # FW_AUTOPROTECT_SERVICES="yes" and I did FW_SERVICES_EXT_TCP="22" # Common: smtp domain FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" # For VPN/Routing which END at the firewall!! # FW_SERVICES_DMZ_TCP="" # Common: smtp domain FW_SERVICES_DMZ_UDP="" # Common: domain syslog FW_SERVICES_DMZ_IP="" # For VPN/Routing which END at the firewall!! # FW_SERVICES_INT_TCP="8080" # Common: ssh smtp domain FW_SERVICES_INT_UDP="" # Common: domain syslog FW_SERVICES_INT_IP="" if nmap -sU against the external interface from external host all udp-port comes up with. so why ? Starting nmap V. 2.02 by Fyodor (fyodor(a)dhp.com, www.insecure.org/nmap/) WARNING: -sU is now UDP scan -- for TCP FIN scan use -sF Interesting ports on (10.10.10.10): Port State Protocol Service 1 open udp tcpmux 2 open udp compressnet 3 open udp compressnet ... 48001 open udp nimspooler 48002 open udp nimhub 48003 open udp nimgtw

1 1

[Fwd: Re: [suse-security] Block IP in firewall]
by Jussi Jääskeläinen 07 Sep '01

07 Sep '01

-------- Original Message -------- Subject: Re: [suse-security] Block IP in firewall Date: Fri, 07 Sep 2001 12:58:21 +0300 From: Jussi Jääskeläinen <jussi.jaaskelainen(a)audioriders.fi> To: Boris Lorenz <bolo(a)lupa.de> References: <XFMail.010907110830.bolo(a)lupa.de> Boris Lorenz wrote: > > Jo, > > On 06-Sep-01 dog(a)intop.net wrote: > > you can use a REJECT instead of DENY for the ipchains rule and your > > machine will not appear to even be online. if you use the deny rule, they > > can still tell what ports you have open, but cannot connect to them. > > For the records, ipchains REJECT sends out ICMP type 3 (host/port unreachable) > messages to the client, telling him to stop sending packets because there would > be no service on the port the client is hammering on. DENY silently drops the > packet, telling the client nothing, who may keep on scanning and filling your > logs. How about sending "TTL-timeout" (or what router send when ttl-value goes zero)?

1 0

Re: [suse-security] http proxy
by r.maurizzi＠gvs.it 07 Sep '01

07 Sep '01

> I want to enable http proxy on my firewall/router which has 24 MB RAM > and very limited HD space. I've a 486dx2 50MHz PC with 24 MB of ram and 400MB HD, and I use it as as both FW and proxy for a small lan. I use wwwoffle as a proxy, since it's rather small, blocks ads, and its cache can be kept to a fixed minimum. However... doing a base SuSE 7.0 installation, plus a couple of other security related rpms, I do have more than 100 MB of free disk space, and proxying is somewhat useful (mainly since using a 64kb/64kb cablemodem is way slower than the very old harddisk ;) Did you try a 'rpm -qa'? Maybe you mistakenly installed a very "fat" rpm. Ciao, Roberto.

1 0

Back Orifice (31337)
by Jesse yep 07 Sep '01

07 Sep '01

Hello, It appears that out of all my ports this is the only one open, I don't really know how to close it. I tried: /sbin/ipchains -I input -p UDP -s 0/0 -d 0/0 (port) -j REJECT Is this completely wrong, or is there another way to close all UDP ports? I'm using SuSE 7.1 2.4.0 __________________________________________________ Do You Yahoo!? Get email alerts & NEW webcam video instant messaging with Yahoo! Messenger http://im.yahoo.com

2 1

Block IP in firewall
by Radu Anghel 07 Sep '01

07 Sep '01

Hi, Got an ip witch is scanning during the night (an internet cafe sez pcnet). How can I block all the ports for this IP? Many thanks, Radu

5 8

AW: [suse-security] ssh and harden_suse
by Wagner, Uwe 07 Sep '01

07 Sep '01

Hi, thanks a lot for your help. After including the line sshd: 192.168.1.0/255.255.255.0 in /etc/hosts.allow everything works fine. uwe -----Ursprüngliche Nachricht----- Von: Guido Tschakert [mailto:gt@src-gmbh.de] Gesendet: Donnerstag, 6. September 2001 11:40 An: Wagner, Uwe; 'suse-security(a)suse.com' Betreff: Re: [suse-security] ssh and harden_suse Am Donnerstag, 6. September 2001 08:28 schrieb Wagner, Uwe: > > Hi, > > I want to use OpenSSH to connect to a server on which the harden_suse > script was installed. > If I try 'ssh servername' the connection was refused by the server. The > message is : ssh_exchange_identification. > If I try to connect with ssh to another server with not installed the > harden_suse script, it works. > > I'm using SuSE 7.1 with the OpenSSH patch. > > Any idea ? > > uwe > > > <<Wagner, Uwe.vcf>> Hello, when "installing" harden_suse the tcp-wrapper konfiguration is also changed. You have to modify your /etc/hosts.allow and /etc/hosts.deny. Example: you want to connect from 192.168.1.0/24, so you have to include the line sshd: 192.168.1.0/255.255.255.0 and don't forget: man is your friend (here man tcpd). also you should have a look at /etc/ssh/sshd_config. HTH Guido ---------------------------------------- Content-Type: application/octet-stream; charset="iso-8859-1"; name="Wagner, Uwe.vcf" Content-Transfer-Encoding: 7bit Content-Description: ---------------------------------------- ---------------------------------------- Content-Type: text/plain; charset="us-ascii"; name="Anhang: 2" Content-Transfer-Encoding: 7bit Content-Description: ---------------------------------------- -- ----------------- Guido Tschakert SRC, SysAd ----------------- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

single user mode
by Gregory M. Begumisa 07 Sep '01

07 Sep '01

Is it possible to boot in single user mode in linux? ---- Greg

5 7

Re: [suse-security] Block IP in firewall
by James Bliss 06 Sep '01

06 Sep '01

Are you using ipchains or iptables? 09/06/01 11:06:59 AM, Radu Anghel <anr(a)aral.ro> wrote: >Hi, > >Got an ip witch is scanning during the night (an internet cafe sez pcnet). >How can I block all the ports for this IP? > > >Many thanks, > >Radu > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

Re: ports scaned
by teo＠gecadsoftware.com 06 Sep '01

06 Sep '01

Hi Radu! On Thu, 06 Sep 2001, Radu Anghel wrote: > Hi, > > Got an ip witch is scanning during the night (an internet cafe sez pcnet). > How can I block all the ports for this IP? > iptables -A INPUT -s $IP_HERE -j DROP want something more elaborated than this? -- teodor

1 0

Re: BCC?: [suse-security] firewall2 and SPOOFIN
by Burghard W.V. Britzke 06 Sep '01

06 Sep '01

again: try using "SuSEfirewall2 status | grep DROP-DEFAULT" to figure out which rule does it. use "iptables -Z <chain>" to zero package count for every chain. Once you got the rule you can look which part of SuSEfirewall2 set it. good luck! Anthony Hogbin schrieb: > Alas - machines in DMZ are not getting out at all, despite their ability to > resolve IP's using the firewall..... FW_FORWARD="$DMZ_MACHINE,0/0" does not > seem to be letting it out?! Packets are being dropped with > SuSE-FE-DROP-DEFAULTIN :( > > They can be seen by machines in the 192 LAN which is a bonus - but just not > get out themselves - I am sure I am missing the point somewhere?

1 0

RE: [suse-security] ssh problem
by Reckhard, Tobias 06 Sep '01

06 Sep '01

Hi Yuri [Machine has two A records] > So now the problem arises: I normally only use the easy-to-remember > hostname: it's the one I named the machine with (not even telling it about > the other one) and this is therefore also the one that ssh-keygen uses > when generating the keys. Unfortunately ssh, scp and sftp resolve the > IP-address to the other hostname, and fail to recognize the relevant key > in $HOME/.ssh/authorized_keys2 (regardless of which "direction" I go). I > assume there is an easy way to solve this, but I haven't found it. Can > someone help me out? > Hmm.. I fail to see where the hostname matters in the authorized_keys[2] files, except for the 'from="pattern-list"' parameter, which you don't seem to mean. The hostname does matter when the server's public key is checked against the known_hosts[2] files, so I assume that is where your problem actually lies. And concerning that, the sshd man page section titled "SSH_KNOWN_HOSTS FILE FORMAT" says: Each line in these files contains the following fields: hostnames, bits, exponent, modulus, comment. The fields are separated by spaces. Hostnames is a comma-separated list of patterns ('*' and '?' act as wild- cards); each pattern in turn is matched against the canonical host name (when authenticating a client) or against the user-supplied name (when authenticating a server). A pattern may also be preceded by `!' to indi- cate negation: if the host name matches a negated pattern, it is not ac- cepted (by that line) even if it matched another pattern on the line. Therefore, all you need to do is add the complicated name to the appropriate entry in the known hosts files. I.e. modify an entry of the form: hostname 1024 35 1768399887... to: hostname,complicated_hostname 1024 35 1768399887... Does that help you in any way? Tobias

2 1

Re: BCC?: [suse-security] firewall2 and SPOOFIN
by Burghard W.V. Britzke 06 Sep '01

06 Sep '01

> use "SuSEfirewall2 status | grep ANTI-SPOOF" > to figure out which rule stops your ICMP Packets (the first column shows you the # of packets which match the rule) > In my case it has been that the external net was a subnet of the internal net (eg. int=192.168.0.0/24 and ext=192.168.0/3) > But this does not bother too much. You just don't reach your dsl router directly. if it is configured correctly you can send packages > through your router (and vice versa). if you want to configure your rooter you have to delete 2/4 rules (depends on wether you have turned > loggin on or off) from one of your chains using iptables. after that restart the firewall to regain anti-spoof security. > > Anthony Hogbin schrieb: > > > Hello > > > > I am running repeatedly into a brick wall here over SuSEfirewall2 > > > > Three NIC's - a real IP DMZ, a masqueraded LAN on 192, and a DSL router > > which is my DFG and name server. > > > > I can do most stuff I hoped it would do when I sat down and figured out what > > I needed - like web, mail, imap, ssh, MSN IM blah blah. BUT I CANNOT PING. > > > > No where on the network can ping at all. > > > > Masqueraded clients can resolve but then nothing. > > > > This is what I get in the /var/log/firewall (where 14 is the router - and > > the 192 address is the test client): > > > > Sep 5 15:40:40 prometheus kernel: SuSE-FW-DROP-ANTI-SPOOFIN=eth0 OUT= > > MAC=00:01:02:24:8b:9a:00:20:6f:09:7c:b5:08:00 SRC=217.34.212.14 > > DST=217.34.212.2 LEN=315 TOS=0x00 PREC=0x00 TTL=60 ID=42849 PROTO=UDP SPT=53 > > DPT=1027 LEN=295 > > > > ....this is just one example of many SPOOF issues - but the one that I think > > points the strongest towards my current issues. > > > > With a bit of luck the act of asking for help will bring some > > enlightenment?! > > > > ---- > > > > For your entertainment (take it easy on me!) is the setup > > > > # 2.) > > FW_DEV_EXT="eth0" > > > > # 3.) > > FW_DEV_INT="eth2" > > > > # 4.) > > FW_DEV_DMZ="eth1" > > > > # 5.) > > FW_ROUTE="yes" > > > > # 6.) > > FW_MASQUERADE="yes" > > FW_MASQ_DEV="$FW_DEV_EXT" > > FW_MASQ_NETS="$INT_LAN_RANGE,0/0,tcp,20 $INT_LAN_RANGE,0/0,tcp,21 > > $INT_LAN_RANGE,0/0,tcp,22 $INT_LAN_RANGE,0/0,tcp,23 > > $INT_LAN_RANGE,0/0,tcp,25 $INT_LAN_RANGE,0/0,tcp,37 > > $INT_LAN_RANGE,0/0,udp,37 $INT_LAN_RANGE,0/0,udp,43 > > $INT_LAN_RANGE,0/0,udp,53 $INT_LAN_RANGE,0/0,tcp,53 > > $INT_LAN_RANGE,0/0,tcp,80 $INT_LAN_RANGE,0/0,tcp,110 > > $INT_LAN_RANGE,0/0,tcp,113 $INT_LAN_RANGE,0/0,tcp,123 > > $INT_LAN_RANGE,0/0,udp,123 $INT_LAN_RANGE,0/0,tcp,143 > > $INT_LAN_RANGE,0/0,tcp,443 $INT_LAN_RANGE,0/0,tcp,554 > > $INT_LAN_RANGE,0/0,tcp,993 $INT_LAN_RANGE,0/0,tcp,1863 > > $INT_LAN_RANGE,0/0,tcp,2401 $INT_LAN_RANGE,0/0,tcp,5800 > > $INT_LAN_RANGE,0/0,tcp,5900 $INT_LAN_RANGE,0/0,tcp,6800:6900 > > $INT_LAN_RANGE,0/0,udp,6800:6900 $INT_LAN_RANGE,0/0,tcp,6901 > > $INT_LAN_RANGE,0/0,udp,6901 $INT_LAN_RANGE,0/0,tcp,6970:7170 > > $INT_LAN_RANGE,0/0,tcp,7070" > > > > # 7.) > > FW_PROTECT_FROM_INTERNAL="yes" > > > > # 8.) > > FW_AUTOPROTECT_SERVICES="yes" > > > > # 9.) > > FW_SERVICES_EXT_TCP="" > > FW_SERVICES_EXT_UDP="" # Common: domain > > FW_SERVICES_EXT_IP="" > > FW_SERVICES_DMZ_TCP="53 3128" > > FW_SERVICES_DMZ_UDP="53" > > FW_SERVICES_DMZ_IP="" > > FW_SERVICES_INT_TCP="23 53 3128" > > FW_SERVICES_INT_UDP="53" > > FW_SERVICES_INT_IP="" > > > > # 10.) > > FW_TRUSTED_NETS="$EXT_ZFT_GATE,tcp,22" > > > > # 11.) > > FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" > > FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" > > > > # 12.) > > FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting > > FW_SERVICE_DNS="yes" > > FW_SERVICE_DHCLIENT="no" > > FW_SERVICE_DHCPD="no" > > FW_SERVICE_SQUID="yes" > > FW_SERVICE_SAMBA="no" > > > > # 13.) > > FW_FORWARD="$INT_LAN_RANGE,$DMZ_IP_RANGE 0/0,$DMZ_EXCHANGE,tcp,25 > > 0/0,$DMZ_EXCHANGE,tcp,80 0/0,$DMZ_EXCHANGE,tcp,135 0/0,$DMZ_EXCHANGE,tcp,443 > > 0/0,$DMZ_BACKUP,tcp,21 0/0,$DMZ_BACKUP,tcp,20" > > > > # 14.) > > FW_FORWARD_MASQ="" # Beware to use this! > > > > # 15.) > > FW_REDIRECT="" > > > > # 16.) > > FW_LOG_DROP_CRIT="yes" > > FW_LOG_DROP_ALL="yes" > > FW_LOG_ACCEPT_CRIT="no" > > FW_LOG_ACCEPT_ALL="no" > > FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix > > SuSE-FW" > > > > # 17.) > > FW_KERNEL_SECURITY="yes" > > > > # 18.) > > FW_STOP_KEEP_ROUTING_STATE="yes" > > > > # 19.) > > FW_ALLOW_PING_FW="no" > > FW_ALLOW_PING_DMZ="no" > > FW_ALLOW_PING_EXT="yes" > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Getting hacked?
by Max Lindner 06 Sep '01

06 Sep '01

Hi out there... I've got a big problem... A few folders disappeared from my samba-dir (unfortunately they where the importantest i ever had :( ). Well that's not the real problem. After this I've checked /var/log/messages and got the following: Sep 5 22:18:21 monika sshd[2616]: Did not receive ident string from 62.225.211.70. Sep 5 22:18:23 monika sshd[2623]: Did not receive ident string from 62.225.211.70. Sep 5 22:18:26 monika in.ftpd[2615]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:26 monika in.telnetd[2617]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:26 monika in.fingerd[2618]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:26 monika popper[2619]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:26 monika popper[2619]: error: cannot execute /usr/sbin/popper: No such file or directory Sep 5 22:18:26 monika fingerd[2618]: getpeername: Transport endpoint is not connected Sep 5 22:18:26 monika ftpd[2615]: getpeername (in.ftpd): Transport endpoint is not connected Sep 5 22:18:31 monika in.ftpd[2622]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:33 monika in.telnetd[2624]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:34 monika telnetd[2624]: ttloop: peer died: EOF Sep 5 22:18:36 monika in.fingerd[2625]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:38 monika popper[2626]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:38 monika popper[2626]: error: cannot execute /usr/sbin/popper: No such file or directory When I'm not wrong, this says that someone was very interested about my router. Unfortunately there wasn't any firewall and no good protection (what was I stupid...) How can I see if he got in my system and deleted my folders? Can you say me, what signs indicate that he is already in my router. Is there a way to hide a programm from ps -axl? Thanks for any help! Max --- I'm securing my system now...

7 7

No reply since several days, need HELP!!!
by Stefan_Walther＠gehag-dsk.de 06 Sep '01

06 Sep '01

Hi folks, some days ago I wrote an email to these lists. I have a problem with getting some data through a FreeS/WAN tunnel. The first mail are coming back tells me something about strange routing. There was a fault at my side, because I had a double writing error in the IP's. I correct this in the mail from 1st september. As I wrote my first mail I get so much replies that I cannot solve them at one day, as I found time to do this. Now I cannot understand, why there is no reply anymore. I need HELP!!! A colleague of me wrote a mail yesterday to the suse-security-list. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

1 0

ssh and harden_suse
by Wagner, Uwe 06 Sep '01

06 Sep '01

Hi, I want to use OpenSSH to connect to a server on which the harden_suse script was installed. If I try 'ssh servername' the connection was refused by the server. The message is : ssh_exchange_identification. If I try to connect with ssh to another server with not installed the harden_suse script, it works. I'm using SuSE 7.1 with the OpenSSH patch. Any idea ? uwe <<Wagner, Uwe.vcf>>

2 1

RE: [suse-security] ssh and harden_suse
by Reckhard, Tobias 06 Sep '01

06 Sep '01

> Once a connection to a remote machine was established 1st time, the > identificantion > will be written to ~/.ssh/known_hosts. If the ID of a remote machine > changes, e.g. > cause someone installs it new, you'll get such messages while connecting. > > Simply remove the part in ~/.ssh/known_hosts that depends on this machine. > Note that this method of operation is less secure than if you have the option "StrictHostKeyChecking yes" set, which disables automatic addition of host keys to the known hosts files and will abort any connection attempt to a host whose key differs from the one in the known hosts files. Without StrictHostKeyChecking, you are prone to the man-in-the-middle attacks that Kurt made such a fuss about around a half a year ago. Cheers Tobias

1 0

security updates
by adm 06 Sep '01

06 Sep '01

I'm not sure if there was an announcement about this before, but do those of us using 6.2 and below no longer receive updated packages for items that are found faulty? -- aron

4 3

RE: [suse-security] ssh and harden_suse
by Appeldorn 06 Sep '01

06 Sep '01

-----Original Message----- From: Appeldorn [mailto:appeldorn@codixx.de] Sent: Thursday, September 06, 2001 9:57 AM To: Wagner, Uwe Subject: RE: [suse-security] ssh and harden_suse >I want to use OpenSSH to connect to a server on which the harden_suse script >was installed. >If I try 'ssh servername' the connection was refused by the server. The >message is : ssh_exchange_identification. >If I try to connect with ssh to another server with not installed the >harden_suse script, it works. Think not the harden script is the point, but your known_hosts file. Once a connection to a remote machine was established 1st time, the identificantion will be written to ~/.ssh/known_hosts. If the ID of a remote machine changes, e.g. cause someone installs it new, you'll get such messages while connecting. Simply remove the part in ~/.ssh/known_hosts that depends on this machine. Michael

1 0

secure-rsync-mirroring
by Daniel Quappe 06 Sep '01

06 Sep '01

hi list, today i wanted to mirror two hosts by using rsync with ssh. unfortunately this are a 6.4 and 7.1 suse-system with different rsync-version (6.4 => rsync-2.3.2-22, 7.1 => rsync-2.4.6-37). after the first mirroring (got a complete list of all relevant files, okay) the next time i executed my script i got the following error: ... receiving file list ... done unexpected EOF in read_timeout i tested some hints (--timeout=1000 etc.) but nothing has lead to success. does anyone out there know the solution? many thanks in advance, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

ssh problem
by Yuri Robbers 05 Sep '01

05 Sep '01

Hi all! I want to use OpenSSH 2.9 as shipped with SuSE 7.2 to transfer data between two servers. Such a setup has recently been discussed in this list, but in my particular situation a previously unmentioned problem arises. I have created DSA keys with ssh-keygen and copied the public keys of each machine to the other. So far, so good. But there is a complication: one of the machines is registered in my ISP's DNS records with two A records (once with a nasty name consisting of parts like the hexadecimal ip address, and once with an easier-to-remember name). So now the problem arises: I normally only use the easy-to-remember hostname: it's the one I named the machine with (not even telling it about the other one) and this is therefore also the one that ssh-keygen uses when generating the keys. Unfortunately ssh, scp and sftp resolve the IP-address to the other hostname, and fail to recognize the relevant key in $HOME/.ssh/authorized_keys2 (regardless of which "direction" I go). I assume there is an easy way to solve this, but I haven't found it. Can someone help me out? Kind regards, Yuri. -------------------------------------------------------------------------- Yuri Robbers phone : +31-71-527-4966 Leiden University fax : +31-71-527-4900 Institute for Theoretical Biology email : robbers(a)rulsfb.leidenuniv.nl Kaiserstraat 63 2311 GP Leiden PGP 5.0 public key available: the Netherlands Check your favourite hkp server. --------------------------------------------------------------------------

1 0

freeswan ???
by Dirk Ertl 05 Sep '01

05 Sep '01

Helo folks, some times ago a friend of my posted here a problem with freeswan what we have. In his first posting he made confound a network address and fixed it in last with petition for help. Is someone know about freeswan problems like this and give us an initial stage for a resulution? Thanks in advance Dirk >Hi folks, >I recognize a problem at my side. You meant "strange routing". Now I see >what you mean. >The IP's of the first GW on eth0 must be 192.168.200.1 and the IP on the >eth1 of the second GW must be 192.168.100.1. >Now I see my fault. The IP's on the boxes where set this way I told to you >in the sentence before. >By the way, I have a look at /var/log/messages and saw the message IPSec >SA established and tcpdump tells me that there are UDP:500-->500 packets >are going through the router (ip-proto-50). >I have an established IPSec-tunnel between 2 boxes. >I'm using SuSE7.1 Kern 2.4.7 and FreeS/WAN 1.91. The FreeS/WAN tells me that the >tunnel is established (last message in /var/log/messages). >My configuration is the following: >1st client-----1st-FreeS/WAN-gateway----ROUTER----2nd-FreeS/WAN-gateway------2nd-client > eth0--------------eth0------eth1----eth1-eth0----eth0--------eth1------eth0 > Virtuelles Internet between eth1 and eth0 ROUTER >Every box is a linux box! >The 1st client has the following config: RedHat7.1, IP: 192.168.200.2 >The 1st FreeS/WAN-gateway config is: SuSE 7.1, kernel 2.4.7, eth0: 192.168.100.1, eth1: 172.16.100.1, IP-forwarding without masquerading >The Router has the following config: SuSE7.1, kernel 2.4.7, eth1: 172.16.100.2, eth0 10.16.100.2, IP-forwarding without masquerading >The 2nd FreeS/WAN-gateway config is: SuSE7.1, kernel 2.4.7, eth0: 10.16.100.1, eth1: 192.168.200.1, IP-forwarding without masquerading >The 2nd client has the following config: Windows2000, eth (seems to be a littlebit stupid): 192.168.100.2 >Every netmask is 255.255.255.0; >If i start ipsec via, ipsec start at the shell, no error (exept the IPv6-bind error) occured. >Before starting IPSec the routes, the the clients can pinging each other are set by hand. FreeS/WAN sets the routes to the ipsec0 interface. >After starting you cannot ping anymore from the 1st client to the 2nd client ans the other way around. Does anybody know a solution for this problem??? >THX -- Dirk Ertl networktechnican fon : +49 179/492 63 59 mailto : dirk(a)ertl-bln.de

1 0

[suse-security] Howto spread around the ext ip adress
by Stefan Knodt 05 Sep '01

05 Sep '01

Hi, since the external adress is assigned via dhcp and changes from time to time. What ist the most secure way to spread around the external ip adress to systems behind the firewall, e.g. in a masqueraded DMZ ? BTW the systems behind the firewall runs various OS. Thanks for your advice Stefan --------------------------- sknodt(a)bluewin.ch ---------------------------

2 1

scp/sftp and chroot (OpenSSH)
by Ulf Stegemann 05 Sep '01

05 Sep '01

The following message is a courtesy copy of an article that has been posted to comp.security.unix,comp.os.linux.security as well. On our servers there exist serveral chroot accounts where users can log in and find themselves caged in their home directory. This works for telnet, ftp and ssh (OpenSSH 2.5.1). However, scp and sftp can't be used with these accounts, they simply hang after authentication. Searching the net I found that that's a known problem and that it could be solved using ssh3 (which is not an option for me) or a chroot-patch for OpenSSH together with statically compiled ssh binaries. The latter one didn't work for me and I'm wondering if anybody has another solution for the problem that a) works with OpenSSH and b) does not require to change /etc/passwd. Ulf -- not a real signature

1 0

SuSE Security Announcement: screen (SuSE-SA:2001:030)
by Roman Drahtmueller 05 Sep '01

05 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: screen Announcement-ID: SuSE-SA:2001:030 Date: Wednesday, September 5 2001 18:00 MEST Affected SuSE versions: (6.0, 6.1, 6.2) 6.3, 6.4, 7.0, 7.1, 7.2 Vulnerability Type: local root compromise Severity (1-10): 5 SuSE default package: yes Other affected systems: some systems with the screen program installed setuid root Content of this advisory: 1) security vulnerability resolved: screen problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information screen is a terminal multiplexer program that allows reattaching to a detached session as well as multi-attached (shared) sessions. The screen package allows a local attacker to obtain root privileges if the /usr/bin/screen command is installed setuid root and if a directory below /tmp/screens/ exists. The screen program needs root permissions from the setuid-root bit for two reasons: multi-attached sessions are only possible with root privileges, and writing terminal allocation information to /var/run/utmp (the who(1) and finger(1) commands). If the screen command is not running with special privileges, all functionality except these two features will continue to work, but the local root compromise will not be possible. In order to provide the features mentioned, the screen package used to be installed setuid-root in SuSE Linux distributions. The update packages that we provide for the supported distributions 6.3, 6.4, 7.0, 7.1 and 7.2 eliminate the error in the source code. In addition to that, the rpm package does not contain the setuid-bit on the screen program any more. If there is any more security-related bug in the screen package or libraries that it is linked against to be found in the future, these errors will not open local security holes any more. Users of the screen package who need the multi-attach feature must enable it again by adding the setuid-bit to the /usr/bin/screen file. Please note that you should reflect the changes to permissions in the files /etc/permissions*. If unsure, use the setting "secure local" for the variable PERMISSION_SECURITY in /etc/rc.config and execute "SuSEconfig" as root. Alternatively, change the settings for the screen program in /etc/permissions* and run "chkstat -set <file>" for each file that you need. Use the command "rpm -qlv screen | grep /usr/bin" to find out which files to add to the permissions file (/usr/bin/screen is a symlink). The authors of screen have released the new version screen-3.9.10 that fixes the multi-attach-error, and some other uncritical bug. Our update packages contain the necessary patches applied to the version as shipped with the original distribution. We thank Christian Hürgemann <Bzrker(a)t-online.de> for reporting this error on Monday, 3 Sep 2001. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Uhv file.rpm" to apply the update. i386 Intel Platform: SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/ap1/screen-3.9.8-115.i386.rpm e85453f50170ecdabe97dd2b33b51e4a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/screen-3.9.8-115.src.rpm 74ac0119ec42f7c5ad4405a7f1c00f6a SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/ap1/screen-3.9.8-115.i386.rpm fb0a3ba99db246c1f08e3814557858ae source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/screen-3.9.8-115.src.rpm 5edb0caa388be9f1ddc2cd4d0a4f3a54 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/ap1/screen-3.9.8-115.i386.rpm b7bfa891b49db29093f6ab1830d84838 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/screen-3.9.8-115.src.rpm fb1e3bf070adec10296a59f2d1231c8c SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/ap1/screen-3.9.8-115.i386.rpm a889c9090b0a64eb57a407ee00444491 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/screen-3.9.8-115.src.rpm 29b6e24378153a4f9d2445414253759c SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/ap1/screen-3.9.8-115.i386.rpm 5a47bdc2407890d9a940c710d4806383 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/screen-3.9.8-115.src.rpm f3bace3114cfcb9b1b6e798ea8b93b34 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/ap1/screen-3.9.8-61.sparc.rpm 3bfe4ac28d54ff2cab6582b2d09f3b75 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/screen-3.9.8-61.src.rpm 17da9f63ec2b0d48b3593dacfe341a7b SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/ap1/screen-3.9.8-62.sparc.rpm 13037ae193ebd81b92ce1d94d2409421 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/screen-3.9.8-62.src.rpm c542f1c51a701ad5dd06d9f9f3701cfb AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/ap1/screen-3.9.8-71.alpha.rpm c5239b5ca727a4f7d54589399b62a5c5 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/screen-3.9.8-71.src.rpm 4c389bca8641e3c081e992e82bc5065d SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/ap1/screen-3.9.8-71.alpha.rpm 9f84734233284fc9f7be494c37a4f857 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/screen-3.9.8-71.src.rpm 31920bb58b696739100e75ce363ade6d SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/ap1/screen-3.9.8-71.alpha.rpm a7f64468ecc5be193795ea3a530d3ead source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/screen-3.9.8-71.src.rpm dae933854ae9a7efd3e80e09641b9963 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/ap1/screen-3.9.8-71.alpha.rpm f66d9c18a27cd7915d5134528b47c342 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/screen-3.9.8-71.src.rpm 13157d46457be72fd7684ca0cbe6c49b PPC Power PC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/ap1/screen-3.9.8-52.ppc.rpm 090e4781fb4949697fb08f755a0ae12d source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/screen-3.9.8-52.src.rpm ce19f08412c6517798690fa7d99ed690 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/ap1/screen-3.9.8-52.ppc.rpm e37b478c4ce85febc13785b4a48c68c0 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/screen-3.9.8-52.src.rpm 0594837833e05e430c52421745f1abfa SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/ap1/screen-3.9.8-52.ppc.rpm 53cb3d0fdf964a4013b6aed326d77c9e source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/screen-3.9.8-52.src.rpm 89300f304c709a10975f5906bedd1529 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - sendmail SuSE Security announcement SuSE-SA:2001:028 (sendmail) offers a sendmail update package for the 7.0-i386 distribution that has a lower version number than the package in the tree for ftp installation on ftp.suse.com. If your update rpm command fails with a complaint that the version installed is newer than the one you wish to be installed, then please use the "--oldpackage" commandline option to rpm: "rpm --oldpackage -Uhv sendmail-*.rpm". We are correcting the problem as soon as possible. The new package will be named sendmail-8.11.0-10.i386.rpm and should appear on the ftp server within the next 11 hours. The *-10 package is technically identical to the *-5 package that is currently available on our ftp server. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =================================================== SuSE's security contact is <security(a)suse.com>. The <security(a)suse.com> public key is listed below. =================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CpkBogQ57vSBEQQAk/GN+ftr7+DBlSoixDDpfRnUk+jApGEt8hCnrnjV nPs/9Cr33+CXLQbILOO7Y5oiPbJdHh45t4E0fKyLVzDerCRFB1swz/mNDxT26DLy sdBV5fwNHTPhxa67goAZVrehQPqJEckkIpYriOaYcKpF3n5fQIZMEfMaHEElQhcX ML8AoJVXDkJYh7vI8EUB8ZURNLZMEECNA/sH0MCnb4Q6ZcRyeZ3+1PHP8hP73b6T epRdLZhaylwVF/iu7uIn62ZUL4//NTOCDY7V63qg4iba/fUbOsWtEnGaiE7mQuAl sSWvRspwRA9/g9rdVf3/JdLJrLmKBTheyG+PSJE3W7cAE4ZWafGxIRCwXhmj3TQn Jn2euqylHRubEQP/aL53NZK0kBdvrKgff6O8Of6tqoss8Dkk55I7QVFSp+My1Dn+ mngQKFejTAgtyo/WmR3wPjQ9HoT2lRiYI2lTRYT4uMdHuwVC3b4DqAKmoy375FER wHkrMVyKBJslv8QtbAWw5A1CAUseaHo+91wmYJ4/4p6YUahqbG/tZyhbxfq0KFN1 U0UgUGFja2FnZSBTaWduaW5nIEtleSA8YnVpbGRAc3VzZS5kZT6IXAQTEQIAHAUC Oe70gQUJA8JnAAQLCgMEAxUDAgMWAgECF4AACgkQqE7a6JyACspfLACffAYA+NM8 NBhyRyH+nTX58CNjwLIAoIx9fj52BJe0xY7WbKoXs1+72b2AiEYEEBECAAYFAjpw XlIACgkQnkDjEAAKq6TczgCgi+ddhWb7+FWcfeE6WwPZccqAHowAnjjtRyGwHLQH r5OTFAYTXi2Wv6jNiQEVAwUQOnBgb3ey5gA9JdPZAQE1pwf/QJ+b34lFBNVUJ7fk /xGJJREt7V12iSafaRzGuH8xWvIz1bb+VARxnnt16FDQ1cDNjoEhCEmcW83Vxp6i JXE9PE8wVA/Yue/bon5JS7J69+UiQ2eq2pudfwljp52lYVM53jgPYEz0q/v3091n lZ8CYkAkN9JDS1lV1gEzJ7J0+POngDpU+lDQT2EC6VKaxeWK8pNt6UFDwICRDQxK nlOoiDvTrdWT7QdJZ4sPv8Qotdw9+tKNbWQ2DqdIRxyTdw9xDfAtcj6mXeQr7852 Lwem1gSKVnEYHZ9g1FTJqVOutY8KhpUc9RfOCRv8XuIxrs4KSbfSF0s8qIRCQelx ufg9AbkCDQQ57vSSEAgAhJHQTejMX+Vr6g1pHDEcusJ63fQ2CfFFE5iE9okH9O7U VCiSfb9CV38dmeHdPCEEjDUWquFYEnvj3WICMtH249t1Ymuf4Du3yRKQ9oXdn/qT Jzlrx9qzjiG3mH7ocwHOgUIwCrZoEdBEVE2n0zPVm+hddwjWWTWXw6pxQz+i9dsN 89xexRV5M9O0bNwCLaNWX2GXeLAkqTK/9EuZy6x2yLxi6du9YYUAXkZpqBhCjtiU XpRoFCdglMznbcAyCk9C2wqb2j/D1Z2BeSBaGCSFkR6pRLebnE17LWcu72Iy+r0z +JecbPiyDpDZj4apn7IC81aNFGi7fNITsHODbwwjiwADBgf/YPvVdzkc8OC7ztac EWCanwylKvxCdKzTDA+DfES6WUYShyiVJvZzRy25LJ5WcK20kzOS6Qv1OrIXiz/p dGy1aKtJZrAnFEsofpmOj8VoqyyFgp/yAGQBp12+mXek7SCZRhuqalDfEMRiWEJ6 J5dLkyShyRDWyPbFh0HXE7QTHN+IKKxxQqNQXL6Z3NSxS61p+5n6BseiDUI39xxk KTFwFrkgUIc5Gs2Or2lhaWvGwSfoCmwbsklszZt6xbU+R0SjFqTvjPWx6eHfqbmN C9WMDdTjGrXDDKXFp2aYlokfN6It9vsbVlGNlOwHt/JjGoPMxW6Xqj0FLA7/Vewg CdXW64hMBBgRAgAMBQI57vSSBQkDwmcAAAoJEKhO2uicgArKSyIAmwUHf/vtKQfc mVg4asR7U6XQl0bAAJ4pO22B5U8UH6IYl2LBCXFqw5+5fA== =rVRn - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBO5ZTFHey5gA9JdPZAQHosAf/drLZSUCL8y3JyAd9EfzXg4OctE245mjb HrAn+jgXNDHvL8SzQYFpIzt5hLiJ9WLXc0+Edu3ovKkhzCJOtWIXTu2dvOiRhF99 MO3iaqWF3J+HhGMOEr2sQWsiqVKF5Mdw13SPgiwTX3le9ropXAD8gvZCoG7WjCpb nqIbbVlY2zrxdCuoDVeLrH3FJS1TksUcga/+pdJqaPG1YgdV+UFMFbTnpEITXyNT s9vB553vw9paFf9a4LGwoht3BpwtvnPRTjQlfgApJPvMbFjTGers824cT5xOjpPz pafJ3QG9ZbiD+49yY4wXMsmBNdohGM4CFsmV5Sc8aOXFenA26Kbg4Q== =tYiI -----END PGP SIGNATURE-----

1 0

Re: [suse-security] firewall2 and SPOOFIN
by James Bliss 05 Sep '01

05 Sep '01

I believe the problem is in your FW_MASQ_NETS setting. Ping is an ICMP protocol. Why don't you try to open this up completely (internalnet/8-16-or24 - whichever appropriately applies. then test to seen what happens. then you can start restricting this more and more to tighten the controls as needed. Jim 09/05/01 10:57:34 AM, "Anthony Hogbin" <anthony.hogbin(a)btinternet.com> wrote: >Hello > >I am running repeatedly into a brick wall here over SuSEfirewall2 > >Three NIC's - a real IP DMZ, a masqueraded LAN on 192, and a DSL router >which is my DFG and name server. > >I can do most stuff I hoped it would do when I sat down and figured out what >I needed - like web, mail, imap, ssh, MSN IM blah blah. BUT I CANNOT PING. > >No where on the network can ping at all. > >Masqueraded clients can resolve but then nothing. > >This is what I get in the /var/log/firewall (where 14 is the router - and >the 192 address is the test client): > >Sep 5 15:40:40 prometheus kernel: SuSE-FW-DROP-ANTI-SPOOFIN=eth0 OUT= >MAC=00:01:02:24:8b:9a:00:20:6f:09:7c:b5:08:00 SRC=217.34.212.14 >DST=217.34.212.2 LEN=315 TOS=0x00 PREC=0x00 TTL=60 ID=42849 PROTO=UDP SPT=53 >DPT=1027 LEN=295 > >....this is just one example of many SPOOF issues - but the one that I think >points the strongest towards my current issues. > >With a bit of luck the act of asking for help will bring some >enlightenment?! > >---- > >For your entertainment (take it easy on me!) is the setup > ># 2.) >FW_DEV_EXT="eth0" > ># 3.) >FW_DEV_INT="eth2" > ># 4.) >FW_DEV_DMZ="eth1" > ># 5.) >FW_ROUTE="yes" > ># 6.) >FW_MASQUERADE="yes" >FW_MASQ_DEV="$FW_DEV_EXT" >FW_MASQ_NETS="$INT_LAN_RANGE,0/0,tcp,20 $INT_LAN_RANGE,0/0,tcp,21 >$INT_LAN_RANGE,0/0,tcp,22 $INT_LAN_RANGE,0/0,tcp,23 >$INT_LAN_RANGE,0/0,tcp,25 $INT_LAN_RANGE,0/0,tcp,37 >$INT_LAN_RANGE,0/0,udp,37 $INT_LAN_RANGE,0/0,udp,43 >$INT_LAN_RANGE,0/0,udp,53 $INT_LAN_RANGE,0/0,tcp,53 >$INT_LAN_RANGE,0/0,tcp,80 $INT_LAN_RANGE,0/0,tcp,110 >$INT_LAN_RANGE,0/0,tcp,113 $INT_LAN_RANGE,0/0,tcp,123 >$INT_LAN_RANGE,0/0,udp,123 $INT_LAN_RANGE,0/0,tcp,143 >$INT_LAN_RANGE,0/0,tcp,443 $INT_LAN_RANGE,0/0,tcp,554 >$INT_LAN_RANGE,0/0,tcp,993 $INT_LAN_RANGE,0/0,tcp,1863 >$INT_LAN_RANGE,0/0,tcp,2401 $INT_LAN_RANGE,0/0,tcp,5800 >$INT_LAN_RANGE,0/0,tcp,5900 $INT_LAN_RANGE,0/0,tcp,6800:6900 >$INT_LAN_RANGE,0/0,udp,6800:6900 $INT_LAN_RANGE,0/0,tcp,6901 >$INT_LAN_RANGE,0/0,udp,6901 $INT_LAN_RANGE,0/0,tcp,6970:7170 >$INT_LAN_RANGE,0/0,tcp,7070" > ># 7.) >FW_PROTECT_FROM_INTERNAL="yes" > ># 8.) >FW_AUTOPROTECT_SERVICES="yes" > ># 9.) >FW_SERVICES_EXT_TCP="" >FW_SERVICES_EXT_UDP="" # Common: domain >FW_SERVICES_EXT_IP="" >FW_SERVICES_DMZ_TCP="53 3128" >FW_SERVICES_DMZ_UDP="53" >FW_SERVICES_DMZ_IP="" >FW_SERVICES_INT_TCP="23 53 3128" >FW_SERVICES_INT_UDP="53" >FW_SERVICES_INT_IP="" > ># 10.) >FW_TRUSTED_NETS="$EXT_ZFT_GATE,tcp,22" > ># 11.) >FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" >FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" > ># 12.) >FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting >FW_SERVICE_DNS="yes" >FW_SERVICE_DHCLIENT="no" >FW_SERVICE_DHCPD="no" >FW_SERVICE_SQUID="yes" >FW_SERVICE_SAMBA="no" > ># 13.) >FW_FORWARD="$INT_LAN_RANGE,$DMZ_IP_RANGE 0/0,$DMZ_EXCHANGE,tcp,25 >0/0,$DMZ_EXCHANGE,tcp,80 0/0,$DMZ_EXCHANGE,tcp,135 0/0,$DMZ_EXCHANGE,tcp,443 >0/0,$DMZ_BACKUP,tcp,21 0/0,$DMZ_BACKUP,tcp,20" > ># 14.) >FW_FORWARD_MASQ="" # Beware to use this! > ># 15.) >FW_REDIRECT="" > ># 16.) >FW_LOG_DROP_CRIT="yes" >FW_LOG_DROP_ALL="yes" >FW_LOG_ACCEPT_CRIT="no" >FW_LOG_ACCEPT_ALL="no" >FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix >SuSE-FW" > ># 17.) >FW_KERNEL_SECURITY="yes" > ># 18.) >FW_STOP_KEEP_ROUTING_STATE="yes" > ># 19.) >FW_ALLOW_PING_FW="no" >FW_ALLOW_PING_DMZ="no" >FW_ALLOW_PING_EXT="yes" > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

Re: [suse-security] Kernel
by Hendrik Brandenburger 05 Sep '01

05 Sep '01

Am Mit, 05 Sep 2001 schrieb Eduard Meiler: > > Hallo , can anybody tell me what all of this mean ?? > > > > Sep 5 00:06:35 wall kernel: eth0: Transmit error, Tx status register 82. >Hi, >just one question. Do you have a ethernetcard with the Realtek9029-Chip in ^^ Sorry, I mean 8029. Greetings Hendrik --

1 0

SuSE Firewall 2 - Masq , IRC
by Michael Brandejsky 05 Sep '01

05 Sep '01

Dear List, i have Suse 7.2 Pro and the SuSE Firewall2 , ftp, www masquerade works fine but i have a problem to tranfer DCC Files in IRC , time ago there are some IRC Masq Modules, but they are not compatible to the 2.4.x Kernel. So , what should I do to use DCC Sends. I don't want to install an old kernel. greetings

2 1

Kernel
by Eduard Meiler 05 Sep '01

05 Sep '01

Hallo , can anybody tell me what all of this mean ?? Sep 5 00:06:35 wall kernel: eth0: Transmit error, Tx status register 82. Sep 5 00:06:35 wall kernel: Flags; bus-master 1, dirty 17668(4) current 17668(4) Sep 5 00:06:35 wall kernel: Transmit list 00000000 vs. c74f2300. Sep 5 00:06:35 wall kernel: 0: @c74f2200 length 80000586 status 00010586 Sep 5 00:06:35 wall kernel: 1: @c74f2240 length 80000586 status 00010586 Sep 5 00:06:35 wall kernel: 2: @c74f2280 length 80000586 status 00010586 Sep 5 00:06:35 wall kernel: 3: @c74f22c0 length 80000586 status 80010586 Sep 5 00:06:35 wall kernel: 4: @c74f2300 length 80000056 status 00010056 Sep 5 00:06:35 wall kernel: 5: @c74f2340 length 80000056 status 00010056 Sep 5 00:06:35 wall kernel: 6: @c74f2380 length 8000002a status 0001002a Sep 5 00:06:35 wall kernel: 7: @c74f23c0 length 8000003e status 0001003e Sep 5 00:06:35 wall kernel: 8: @c74f2400 length 8000004a status 0001004a Sep 5 00:06:35 wall kernel: 9: @c74f2440 length 80000055 status 00010055 Sep 5 00:06:35 wall kernel: 10: @c74f2480 length 80000063 status 00010063 Sep 5 00:06:35 wall kernel: 11: @c74f24c0 length 80000036 status 00010036 Sep 5 00:06:35 wall kernel: 12: @c74f2500 length 80000057 status 00010057 Sep 5 00:06:35 wall kernel: 13: @c74f2540 length 80000071 status 00010071 Sep 5 00:06:35 wall kernel: 14: @c74f2580 length 80000042 status 00010042 Sep 5 00:06:35 wall kernel: 15: @c74f25c0 length 80000047 status 00010047 Sep 5 00:15:17 wall su: (to nobody) root on none Sep 5 00:15:17 wall PAM-unix2[4185]: session started for user nobody, service su Sep 5 00:17:04 wall PAM-unix2[4185]: session finished for user nobody, service su Mit freundlichen Grüßen Eduard Meiler ___________________________

6 5

RE: [SLE] SuSEfirewall2 questions ?
by Eric Romang 05 Sep '01

05 Sep '01

Hello, Thanxs for your answer. I have uninstall SuSEfirewall1 and personnal suse firewall in the method you give. Thxs ;) I wan't to know how to make an upgrade of SuSEFirewall2 there is a new version on http://www.suse.de/~marc Yes I use SSH to log remotely ;) For DHCPD, my ps -aux give me this : root 611 0.0 0.2 1364 636 ? S 13:13 0:00 /sbin/syslogd -a /var/lib/dhcp/var/run/dhcpd.pid Why DHCPD has an process with syslog ?? I don't have lunch DHCPD on startup... I don't wan't dhcpd... In my rc.concfig START_DHCPD is set to no... but they are some pid ... But I don't understand why my server freeze whitout reason... Regards > -----Original Message----- > From: Jaakko Tamminen [mailto:jtamminen@satabaana.net] > Sent: 05 September 2001 12:58 > To: Eric Romang > Subject: Re: [SLE] SuSEfirewall2 questions ? > > > Hi > > Disable personal-firewall, that blocks all outside connection attempts, > and that seems to be the case for You. > > To remove the "old" susefirewall, do it with yast->install/remove > packages, or you can try someting like "rpm -e SuSEfirewall". The name > must be correct, but I believe it might be that one. > > Actually there is no need to remove the "old" firewall, just don't > enable it. In my server I have both installed the same time, and the > only annoying thing is that there is both entrys in configuration file, > but it does not really matter. > > I hope You are using ssh to log remotely...? > > About dhcp.. I did not really understand Your question.. Do you need > DHCP-client to get Your IP for the server? If so, You need to enable > that (start dhcp), and also in firewall configuration section you need > to set "dhcp client" to YES. > > Hope this helps > > Jaska. > > > > > > > Hello, > > > > I have install SuSEfirewall2 on my serveur with two ethernet card. > > One for the private network, the other to the internet. > > > > I have some crash from the server I can't explain. > > The server freeze and i don't have the hand on it... no more root > > login possible > > and the tty are froozen... > > > > I have no error messages in my message log file, and also in my > > firewall message. > > > > But I have this line in my message log and warm message. > > > > My message log messages : > > > > Sep 6 12:04:36 lithium SuSEfirewall2: Firewall rules successfully > > set from /etc/rc.config.d/firewall2.rc.config > > Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: > > SuSEpersonal-firewall: Loading of module ipchains was not successful. > > Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: Aborting. No > > action taken. > > > > My warm log messages : > > > > Sep 6 12:04:35 lithium kernel: ip_tables: (c)2000 Netfilter core > > team Sep 6 12:04:35 lithium kernel: ip_conntrack (2047 buckets, > > 16376 max) Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: > > SuSEpersonal-firewall: Loading of module ipchains was not successful. > > Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: Aborting. No > > action taken. > > > > I have also, my sylogd how run dhcp, but i don't have start the dhcpd > > on startup... > > I can see a line in process... > > > > Somebody can explain me why my server freeze ?? > > > > And another question, I wan't to upgrade my SuSEfirewall2. > > What are the step to remove the old one ? > > > > Thanxs. > > Regards > > > > Eric Romang - System Administrator > > eric.romang(a)synapse.lu > > --------------------------------------------------------------------- > >------- --------- > > Site : http://www.synapse.lu > > Synapse Internet Services > > 49, Bd. G-D. Charlotte, L-1331 Luxembourg > > Tel : +352 / 44 79 44 77 > > Fax : +352 / 44 79 44 79 > > GSM : +352 / 021 7000 35 > > --------------------------------------------------------------------- > >------- --------- > > ---------------------------------------- > Content-Type: text/html; charset="iso-8859-1"; name="Liite: 1" > Content-Transfer-Encoding: quoted-printable > Content-Description: > ---------------------------------------- >

2 2

Firewall-SUSE 7.0
by Juergen Foag 05 Sep '01

05 Sep '01

Hello, on SUSE-LINUX 7.0, kernel 2.2.16, I've installed the firewall in the sense of a packet-filter (no proxies, no DMZ, no masquerading). From an firewall-external host (192.168.0.3), I tried to establish a connection (ssh, ping or http with our internal webserver (xx.yy.zz.15)) but have failures. The network topology is: external firewall firewall internal argos eth1 eth0 webserver 192.168.0.3 192.168.0.2 xx.yy.zz.42 xx.yy.zz.15 In the case of trying to connect from the external web client our Webserver http://xx.yy.zz.15, the var/log/firewall-file on the firewall host notices: kernel: Packet log: forward ACCEPT eth0 PROTO=6 192.168.0.3:36341 xx.yy.zz.15:80 With ethereal, I've logged on the internal interface (eth0) of the dual-homed firewall-host the message: Source Destination Protocol Info argosxx.yy.zz.42 xx.yy.zz.15 TCP Source Port 36345 > Dest. Port http (80) So I conclude, that my web request toward my webserver is handled correctly. But with ethereal on the webserver interface, I cannot receive the request message (going to port 80 http). After the web client request was timed out, the message on the web client host (argos) sends "unable to connect to server". The firewall.rc.config file looks like: # 2.) FW_DEV_WORLD="eth1" FW_DEV_WORLD_eth1="192.168.0.2 255.255.255.0" # 3.) FW_DEV_INT="eth0" FW_DEV_INT_eth0="xx.yy.zz.42 255.255.255.0" # 4.) FW_DEV_DMZ="" # 5.) FW_ROUTE="yes" # 6.) FW_MASQUERADE="no" FW_MASQ_NETS="" FW_MASQ_DEV="$FW_DEV_WORLD" # e.g. "ippp0" or "$FW_DEV_WORLD" # 7.) FW_PROTECT_FROM_INTERNAL="no" # -> NIS ypbind # 8.) FW_AUTOPROTECT_GLOBAL_SERVICES="no" # "yes" is a good choice # 9.) FW_SERVICES_EXTERNAL_TCP="0:65535" # for trial FW_SERVICES_EXTERNAL_UDP="0:65535" # for trial FW_SERVICES_INTERNAL_TCP="0:65535" # for trial FW_SERVICES_INTERNAL_UDP="0:65535" # for trial # 10.) FW_TRUSTED_NETS="192.168.0.0 xx.yy.zz.0/24" FW_SERVICES_TRUSTED_TCP="ssh 8 80 443" # Common: ssh FW_SERVICES_TRUSTED_UDP="8" # Common: syslog time ntp # 11.) FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" # Common: "ftp-data" (sadly!) FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # Common: "dns" # 12.) FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SAMBA="no" # 13.) FW_FORWARD_TCP="" # Beware to use this! FW_FORWARD_TCP="192.168.0.3/24,xx.yy.zz.15,80 192.168.0.3/24,xx.yy.zz.4,22" FW_FORWARD_UDP="" # Beware to use this! # 14.) FW_FORWARD_MASQ_TCP="" # Beware to use this! FW_FORWARD_MASQ_UDP="" # Beware to use this! # 15.) FW_REDIRECT_TCP="" FW_REDIRECT_UDP="" # 16.) FW_LOG_DENY_CRIT="yes" FW_LOG_DENY_ALL="yes" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" # normally no # 17.) FW_KERNEL_SECURITY="no" # 18.) FW_STOP_KEEP_ROUTING_STATE="no" # 19.) FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" # 20.) FW_ALLOW_FW_TRACEROUTE="no" # 21.) FW_ALLOW_FW_SOURCEQUENCH="yes" # 22.) FW_MASQ_MODULES="autofw cuseeme ftp irc mfw portfw quake raudio user vdolive" So, if anyone has a solution to get a connection established, let me know it. Thanks Jürgen Foag -- _____________________________________________________________________ Telefon: +49 (0) 89 / 289 - 25290 Fax: +49 (0) 89 / 289 - 28323 Technische Universität München - Lehrstuhl f. Integrierte Schaltungen Arcisstrasse 21 - 80290 München - Deutschland / Germany E-Mail: Juergen.Foag(a)ei.tum.de Homepage: http://www.lis.e-technik.tu-muenchen.de/people/jf.html _____________________________________________________________________ If everything you try works, you are not trying hard enough ! (Gordon Moore) _____________________________________________________________________

1 0

Re : SuSEfirewall2 questions ?
by Eric Romang 05 Sep '01

05 Sep '01

Hello, Thanxs for your answer. I have uninstall SuSEfirewall1 and personnal suse firewall in the method you give. Thxs ;) I wan't to know how to make an upgrade of SuSEFirewall2 there is a new version on http://www.suse.de/~marc Yes I use SSH to log remotely ;) For DHCPD, my ps -aux give me this : root 611 0.0 0.2 1364 636 ? S 13:13 0:00 /sbin/syslogd -a /var/lib/dhcp/var/run/dhcpd.pid Why DHCPD has an process with syslog ?? I don't have lunch DHCPD on startup... I don't wan't dhcpd... In my rc.concfig START_DHCPD is set to no... but they are some pid ... But I don't understand why my server freeze whitout reason... Regards > > > -----Original Message----- > > From: Jaakko Tamminen [mailto:jtamminen@satabaana.net] > > Sent: 05 September 2001 12:58 > > To: Eric Romang > > Subject: Re: [SLE] SuSEfirewall2 questions ? > > > > > > Hi > > > > Disable personal-firewall, that blocks all outside connection attempts, > > and that seems to be the case for You. > > > > To remove the "old" susefirewall, do it with yast->install/remove > > packages, or you can try someting like "rpm -e SuSEfirewall". The name > > must be correct, but I believe it might be that one. > > > > Actually there is no need to remove the "old" firewall, just don't > > enable it. In my server I have both installed the same time, and the > > only annoying thing is that there is both entrys in configuration file, > > but it does not really matter. > > > > I hope You are using ssh to log remotely...? > > > > About dhcp.. I did not really understand Your question.. Do you need > > DHCP-client to get Your IP for the server? If so, You need to enable > > that (start dhcp), and also in firewall configuration section you need > > to set "dhcp client" to YES. > > > > Hope this helps > > > > Jaska. > > > > > > > > > > > > > Hello, > > > > > > I have install SuSEfirewall2 on my serveur with two ethernet card. > > > One for the private network, the other to the internet. > > > > > > I have some crash from the server I can't explain. > > > The server freeze and i don't have the hand on it... no more root > > > login possible > > > and the tty are froozen... > > > > > > I have no error messages in my message log file, and also in my > > > firewall message. > > > > > > But I have this line in my message log and warm message. > > > > > > My message log messages : > > > > > > Sep 6 12:04:36 lithium SuSEfirewall2: Firewall rules successfully > > > set from /etc/rc.config.d/firewall2.rc.config > > > Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: > > > SuSEpersonal-firewall: Loading of module ipchains was not successful. > > > Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: Aborting. No > > > action taken. > > > > > > My warm log messages : > > > > > > Sep 6 12:04:35 lithium kernel: ip_tables: (c)2000 Netfilter core > > > team Sep 6 12:04:35 lithium kernel: ip_conntrack (2047 buckets, > > > 16376 max) Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: > > > SuSEpersonal-firewall: Loading of module ipchains was not successful. > > > Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: Aborting. No > > > action taken. > > > > > > I have also, my sylogd how run dhcp, but i don't have start the dhcpd > > > on startup... > > > I can see a line in process... > > > > > > Somebody can explain me why my server freeze ?? > > > > > > And another question, I wan't to upgrade my SuSEfirewall2. > > > What are the step to remove the old one ? > > > > > > Thanxs. > > > Regards > > > > > > Eric Romang - System Administrator > > > eric.romang(a)synapse.lu > > > --------------------------------------------------------------------- > > >------- --------- > > > Site : http://www.synapse.lu > > > Synapse Internet Services > > > 49, Bd. G-D. Charlotte, L-1331 Luxembourg > > > Tel : +352 / 44 79 44 77 > > > Fax : +352 / 44 79 44 79 > > > GSM : +352 / 021 7000 35 > > > --------------------------------------------------------------------- > > >------- --------- > > > > ---------------------------------------- > > Content-Type: text/html; charset="iso-8859-1"; name="Liite: 1" > > Content-Transfer-Encoding: quoted-printable > > Content-Description: > > ---------------------------------------- > > > > > -- > To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com > For additional commands send e-mail to suse-linux-e-help(a)suse.com > > Also check the FAQ at http://www.suse.com/support/faq and the > archives at http://lists.suse.com >

2 1

Re: [suse-security] ssh-incompatibility ?
by Daniel Quappe 05 Sep '01

05 Sep '01

hi folks, many thanks to all hints! i decided to upgrade to openssh version 2 and that works...;-) best regards, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

ssh-incompatibility ?
by Daniel Quappe 05 Sep '01

05 Sep '01

hi list, today i've got a problem: maybe someone out there already knows... i connected two hosts by dialin and wanted to use ssh for communication. this was the error-output (ssh -v): SSH Version 1.2.27 [i386-suse-linux], protocol version 1.5. Standard version. Does not use RSAREF. dbs: Reading configuration data /etc/ssh_config dbs: ssh_connect: getuid 0 geteuid 0 anon 0 dbs: Allocated local port 1022. dbs: Connecting to 192.168.23.115 port 22. dbs: Connection established. dbs: Remote protocol version 2.0, remote software version OpenSSH_2.3.0p1 dbs: Waiting for server public key. Local: Bad packet length 1349676916. 192.168.23.115 is the dialin-server and 192.168.23.116 the client-machine. does anyone know this problem (and a solution..;-) ? best regards, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

SuSEfirewall2 questions ?
by Eric Romang 05 Sep '01

05 Sep '01

Hello, I have install SuSEfirewall2 on my serveur with two ethernet card. One for the private network, the other to the internet. I have some crash from the server I can't explain. The server freeze and i don't have the hand on it... no more root login possible and the tty are froozen... I have no error messages in my message log file, and also in my firewall message. But I have this line in my message log and warm message. My message log messages : Sep 6 12:04:36 lithium SuSEfirewall2: Firewall rules successfully set from /etc/rc.config.d/firewall2.rc.config Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: SuSEpersonal-firewall: Loading of module ipchains was not successful. Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: Aborting. No action taken. My warm log messages : Sep 6 12:04:35 lithium kernel: ip_tables: (c)2000 Netfilter core team Sep 6 12:04:35 lithium kernel: ip_conntrack (2047 buckets, 16376 max) Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: SuSEpersonal-firewall: Loading of module ipchains was not successful. Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: Aborting. No action taken. I have also, my sylogd how run dhcp, but i don't have start the dhcpd on startup... I can see a line in process... Somebody can explain me why my server freeze ?? And another question, I wan't to upgrade my SuSEfirewall2. What are the step to remove the old one ? Thanxs. Regards Eric Romang - System Administrator eric.romang(a)synapse.lu ---------------------------------------------------------------------------- --------- Site : http://www.synapse.lu Synapse Internet Services 49, Bd. G-D. Charlotte, L-1331 Luxembourg Tel : +352 / 44 79 44 77 Fax : +352 / 44 79 44 79 GSM : +352 / 021 7000 35 ---------------------------------------------------------------------------- ---------

2 1

[suse-security] problem with firewall and X-forwarding
by kohli＠dplanet.ch 05 Sep '01

05 Sep '01

Hi again. I already asked that question once, but then I didn't get any helpful answers... Following problem: I'm in the intranet at my office, and want to work on a remote server. Let's call him jasper. So, I'm on jasper an make a "xspread". Now I get the following answer: xspread: Can't open display client84.xxxx.xx:0 It doesn't matter whether I use ssh or rlogin or rsh to log in to jasper, it simply doesn't work. My firewall log says: Sep 5 11:17:55 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 xxx.xx.xxx.xx:60972 xxx.xx.xxx.xx:6000 L=44 S=0x00 I=5353 F=0x4000 T=255 SYN (#5) Sep 5 11:17:56 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 xxx.xx.xxx.xx:60974 xxx.xx.xxx.xx:6000 L=44 S=0x00 I=5354 F=0x4000 T=255 SYN (#5) Sep 5 11:17:57 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 1xxx.xx.xxx.xx:60975 xxx.xx.xxx.xx:6000 L=44 S=0x00 I=5355 F=0x4000 T=255 SYN (#5) Sep 5 11:17:58 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 1xxx.xx.xxx.xx:60976 xxx.xx.xxx.xx:6000 L=44 S=0x00 I=5356 F=0x4000 T=255 SYN (#5) Sep 5 11:17:59 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 xxx.xx.xxx.xx:60977 xxx.xx.xxx.xx:6000 L=44 S=0x00 I=5357 F=0x4000 T=255 SYN (#5) Now, how can I solve that problem? Also, I wonder why the outgoing port on jasper is steadily inceasing by one, with each attempt to connect...? Any help appreciated! TIA markus

2 1

SuSEfirewall2 and ICMP
by Peter Menzel 04 Sep '01

04 Sep '01

Hello, I successfully installed SuSEfirewall2 and configured it to my needs. The firewall box is set up with two external interfaces (ippp0 and eth1). eth1 is normally connected to an ELSA DSL router and in case DSL will not work I want to switch back to ISDN. So far I've set up ISDN and that stuff, the box is doing everything fine. Clients can do http, https, ftp, mail and so on. Portscans run from the internet report all ports as stealth and the firewall cannot be pinged from the internet. But when it comes to a ping from the internal network to the internet, nothing works. I've tried all the FW_ALLOW_PING_[FW|DMZ|EXT] settings, with no results. Interesting: when I set FW_FORWARD_PING_DMZ="yes" I am able to ping the internet from the firewall, but not from the clients. More interesting: I have not configured a DMZ (yet). What I would like to do is to ping the internet from the clients and get the echo-reply back. echo-requests from the internet have to be dropped at the firewall. Has anyone experienced these problems? Any help would be appreciated. Thanks in advance, Peter peter.menzel(a)com-gmbh.de

1 0

ssh question
by Sven Michels 04 Sep '01

04 Sep '01

Hi there, i've a problem with openssh behind a 2.4.x firewall. If i try to connect to the outside, i got no response until setting the -P flag. with -P it works fine. So it seems to be a problem with the nonprivat port. is there a firewall missconfiguration or something i missed? with 2.2.19 all works fine (without -P). Regards, Sven -- intraDAT AG http://www.intradat.com Wilhelm-Leuschner-Strasse 7 Tel: +49 69-25629-0 D - 60329 Frankfurt am Main Fax: +49 69-25629-256

3 5

AW: [suse-security] ucd-snmpd default configuration
by Reckhard, Tobias 04 Sep '01

04 Sep '01

> > SNMP is not only read but write typically. > > In it's default configuration, really? > I'd suppose so as well. It depends on the configuration of the SNMP server. > > easier to sniff (cleartext). > > I thought it's possible to set up SNMP using some encryption by > itself, but a quick search didn't found a useful HOWTO neither > about SNMP nor encryption nor security... Except "disable if not > needed"... > AFAIK, SNMPv3 will support encryption and a decent authentication scheme, but most SNMP implementations out there are still v1 or v2. Actually, I think that the SNMPv3 standard hasn't even been passed yet. > Yep, of course the firewalls restrict it to just one machine, but > I would like to make sure that the snmpd will not allow bad > things under any cirumstances. Firewalling is quite clear, like > always :) > Well, you can never be 100% sure.. (responding to your phrase. "..under *any* circumstances...". And whether things are good or bad depends a lot on the context they happen in. > > and maybe using ssh port forwarding or ipsec to encrypt it. > > IPSec with each machine is to expensive and won't help, since it > the monitor gets compromised IPSec can be used by unauthorized > software - same for SSH, so I don't see a big improvement. > Why do you consider IPSec too expensive? As it is, you don't need to do IPSec with all hosts, you can configure it on a host by host basis. In fact, you need to, unless you've got DNSSEC set up, as you need a host-specific authentication entity for each host. Still, it's not much more work than SSH, IMHO. As far as the security offered by IPSec is concerned, IPSec gives you real authentication of the source of IP packets. SNMP uses UDP, which makes the combination of easy source address spoofing and access to configuration commands (SNMP RW) a very risky thing. IPSec can prevent spoofing and keep sniffers from reading your SNMP data as well. Tobias

2 3

Re: [suse-security] SuSE-FW-DROP-ANTI-SPOOFING
by Burghard W.V. Britzke 04 Sep '01

04 Sep '01

The SuSEfirewall2 v1.6 is quite good! I found the thing. My internal net is 192.175.233.0/24 my external net is 192.175.233.0/30 (a two bit subnet with only the router and my firewall in it). There are rules to prevent boxes from extenal to be routed to internal if they have an internal address. Unfortunally 192.175.233.0/24 (my internal net) includes 192.175.233.0/30 (my extenal net). So my router cannot communicate with internal boxes. This is not as bad as it seems to because all packets which are forwarded from outside are not rejected by the ANTI-SPOOF rule (but it is most likely that they are rejected by other rules ;-)) For configuration purposes I simply delete the two DROP rules and the two LOG rules from input_ext chain (and may be from forward_ext chain if I want forwarding to my router). Steffen Schoch and Martin Haas antworteten (answered) > ... > > "Burghard W.V. Britzke" wrote: > > > > hello, > > I have problems to contact my firewall from outside. Our uunet router is capable to contact our firewall and some of the services provided > > internally from outside. but when I plug a local pc with the same IP address to the FW_DEV_EXT network and try to connect to smtp (for > > example) I get > > SuSE-FW-DROP-ANTI-SPOOF IN=eth0 OUT= MAC=... SRC=<router> DST=<firewall> LEN=48 TOS=0x0 > > 0 PREC=0x00 TTL=128 ID=546 DF PROTO=TCP SPT=1043 DPT=25 WINDOW=16384 RES=0x00 SY > > N URGP=0 OPT (020405B401010402) > > > > again: the uunet router is capable to send mails via smtp port and I do not get the above error message. Why do I get those messages?

1 0

Ftp from DMZ with SuSEfirewall2 v1.7
by wbrune 04 Sep '01

04 Sep '01

Hello, I've setup an Firewall with SuSEfirweall2 v1.7. It has got 3 Interfaces. EXT, DMZ and INT. In the DMZ is a Server running Squid and Sendmail=20 My Problem is, the Server in the DMZ can't do Ftp. I allowed outgoing ftp in FW_FORWARD. Works fine. But if the Server outside starts to send Data from Port 20 the Firewall drops the Packets=20 (SuSE-FW-DROP-DEFAULTIN=3D... spt=3D20 dpt=3Dxxxxx) Ftp from the Firewall itself works fine.=20 I tried to set ftp-data in FW_ALLOW_INCOMING_HIGHPORTS. Didn't work.=20 I tried a Rule for ftp-data in any Direction in FW_FORWARD.=20 Didn't work. Can anyone help? -- Mit freundlichem Gruss Willi Brune

1 0

SuSE-FW-DROP-ANTI-SPOOFING
by Burghard W.V. Britzke 04 Sep '01

04 Sep '01

hello, I have problems to contact my firewall from outside. Our uunet router is capable to contact our firewall and some of the services provided internally from outside. but when I plug a local pc with the same IP address to the FW_DEV_EXT network and try to connect to smtp (for example) I get SuSE-FW-DROP-ANTI-SPOOF IN=eth0 OUT= MAC=... SRC=<router> DST=<firewall> LEN=48 TOS=0x0 0 PREC=0x00 TTL=128 ID=546 DF PROTO=TCP SPT=1043 DPT=25 WINDOW=16384 RES=0x00 SY N URGP=0 OPT (020405B401010402) again: the uunet router is capable to send mails via smtp port and I do not get the above error message. Why do I get those messages?

2 1

compartment and the --cap option
by Andreas Amann 03 Sep '01

03 Sep '01

Hello everybody! I am currently trying to bring several daemons on my system into a chroot jail using Marc Heuse's 'compartment' tool. So far all works quite well but the fine tuning is still to be done. I am wondering what kind of security enhancements can be done by using compartments '--cap' option. Since the documentation of this feature is not very exhaustive i am still looking for some missing link to understand this correctly. Maybe someone here could help me with that. If I understand that correctly, capabilities are a partitioning of root's privileges and using the --cap option i can influence the privileges of a newly started process no matter whether it will run as root or not. So, for example, the command 'compartment --chroot /some/dir --cap none --verbose /daemon/with_uid0/port_below_1024' should fail miserably because the daemon won't be able to bind to it's port. But exactly this works and i am wondering why (compartment tells me that it successfully set caps to 0x0). I am using SuSE 7.2 with a (stock) Kernel 2.4.9 (but it also happens with a SuSE 2.2.19). /proc/sys/kernel/cap_bound says -257, say everything except CAP_SETPCAP. So thinking about that and the stuff i've read in the 'capfaq' from http://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.2/capfaq… i have the following questions: - Is it true that --cap only works with CAP_INIT_EFF_SET and CAP_INIT_INH_SET set to -1 in <linux/capability.h> in order to get the CAP_SETPCAP privilege? - If so, doesn't it give even more problems when granting the CAP_SETPCAP right to init? I think this would mean that every process started by init will have it. - If not, do i totally missunderstand something and everything is working well except me? Thanks in advance to everyone who will be so friendly to help me with that! With kind regards Andreas Amann <mailto:andreas.amann@epost.de>

2 4

SuSE Security Announcement: nkitb/nkitserv/telnetd
by Sebastian Krahmer 03 Sep '01

03 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: nkitb/nkitserv/telnetd Announcement-ID: SuSE-SA:2001:029 Date: Mon Sep 3 12:55:58 MEST 2001 Affected SuSE versions: [6.1, 6.2,] 6.3, 6.4, 7.0, 7.1, 7.2 Vulnerability Type: remote code execution Severity (1-10): 8 SuSE default package: yes Other affected systems: All UN*X Systems shipping BSD derived telnetd Content of this advisory: 1) security vulnerability resolved: Buffer overflow in in.telnetd problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The telnet server which is shipped with SuSE distributions contains a remotely exploitable buffer-overflow within its telnet option negotiation code. This bug is wide-spread on UN*X systems and affects almost all implementations of telnet daemons available. SuSE 7.2 distribution ships the telnet-server package which contains the vulnerable telnet daemon. This package has been fixed. The SuSE Linux distributions 6.3 and 6.4 contain versions and implementations of the telnet-daemon that are vulnerable, but the complexity of the code requires a full source code audit of the software. In order not to further delay the release of the packages for the SuSE Linux 7.x distributions, we recommend to disable the telnet daemon on the 6.x distributions. This can be done by commenting out the line in /etc/inetd.conf that starts with "telnet", and then reloading the inetd configuration using the command "killall -1 inetd". Another option is to not start the inetd in the first place if you do not need any of the services provided by the inetd daemon. Disabling inetd permanently involves killing the running inetd process ("killall -TERM inetd") and setting the variable START_INETD in /etc/rc.config to "no" (as opposed to "yes"). Disabling the telnet service is the preliminary solution/workaround against the problems with the telnetd daemon. We hope to be able to provide a better solution. The SuSE Linux distributions 7.0, 7.1 and 7.2 have similar implementations of in.telnetd, and for all of these distributions there are update packages available. Please note that the package that contains the /usr/sbin/in.telnetd program (the server program) has changed over the different releases of the SuSE Linux distribution. In the 7.0 and 7.1 distributions the package is called "nkitserv". The 7.2 distribution lists the telnet server in the package "telnet-server". Please download the packages and verify them as described in section 3. After successfull authentication you can update your packages with the command `rpm -Uhv file.rpm'. Further action should not be necessary to activate the update since the in.telnetd daemon is started from a new by inetd upon every accepted connection from the network. Regardless of the availiability of fixed packages of the telnet-daemon, SuSE Security strongly recommend to disable the telnet service if you do not use it. In addition to that, only cryptographically protected protocols such as secure shell (ssh, package openssh) can be an efficient countermeasure against sniffing and spoofing type attacks. Due to significantly more comfort (such as X11-forwarding, multiple authentication methods, ...), the transition to ssh should be worth the effort in any case. i386 Intel Platform: SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n1/telnet-server-1.0-69.i386.rpm 0adc05af9762bd4c63eee464ca3131d1 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/telnet-1.0-69.src.rpm fe313553d1a6f022c7eb2f87ccd6772f SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/nkitserv-2001.8.14-0.i386.rpm e0636eec04ccf2129b0e2ea0ee40c231 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/nkitb-2001.8.14-0.src.rpm 57760fcd8e064e89591203f7ba9adefc SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/nkitserv-2001.8.16-0.i386.rpm e8a859d5a648a572fc08628247c1e2d6 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/nkitb-2001.8.16-0.src.rpm 33d4abc52926ac957f21b8c8aae7adce Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n1/nkitserv-2001.8.14-0.sparc.… 3ef64d1cae35be51c9eff9bebcf4cf79 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/nkitb-2001.8.14-0.src.rpm 4cb76a16bd2f53c37a7cee728ea21c81 SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/nkitserv-2001.8.16-0.sparc.… f4901a4a271657d0379aff114d30b912 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/nkitb-2001.8.16-0.src.rpm ad909d8e3d2d0a617a5a9f6e3d7cd74d AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n1/nkitserv-2001.8.14-0.alpha.rpm efad3412a8d333947bcf74695c023ea8 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/nkitb-2001.8.14-0.src.rpm 94d0dba0396e41b4afbd3ef61c4fd8aa SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/nkitserv-2001.8.16-0.alpha.rpm 934525486e72a5cc98736f4cb1217f93 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/nkitb-2001.8.16-0.src.rpm a6623ff6d9439dea40f24ff35acefe99 Power PC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n1/nkitserv-2001.8.14-0.ppc.rpm 4da51d1a38095e81ee389094b0f21160 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/nkitb-2001.8.14-0.src.rpm 499b282f614835fe7a7b1a9ab039c56d SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/nkitserv-2001.8.16-0.ppc.rpm 262f3fc3653042976c8cc36a2cd7e44d source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/nkitb-2001.8.16-0.src.rpm 7cba8393bb8a71cf4d39fb480a71b42e ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - w3m The w3m browser contains a buffer-overflow which allows remote-attackers to execute arbitrary code or to crash the w3m web-client when viewing special crafted sites. Please update to the newest w3m packages available on the ftp-server. - dip The dip program is executable as setuid root program for users in the "dialout" group, a privilege that has been issued by the administrator for a trusted user group. This bug will be corrected in future releases of the SuSE Linux distribution. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =================================================== SuSE's security contact is <security(a)suse.com>. The <security(a)suse.com> public key is listed below. =================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GZkBogQ57vSBEQQAk/GN+ftr 7+DBlSoixDDpfRnUk+jApGEt8hCnrnjVnPs/9Cr33+CXLQbILOO7Y5oiPbJdHh45 t4E0fKyLVzDerCRFB1swz/mNDxT26DLysdBV5fwNHTPhxa67goAZVrehQPqJEckk IpYriOaYcKpF3n5fQIZMEfMaHEElQhcXML8AoJVXDkJYh7vI8EUB8ZURNLZMEECN A/sH0MCnb4Q6ZcRyeZ3+1PHP8hP73b6TepRdLZhaylwVF/iu7uIn62ZUL4//NTOC DY7V63qg4iba/fUbOsWtEnGaiE7mQuAlsSWvRspwRA9/g9rdVf3/JdLJrLmKBThe yG+PSJE3W7cAE4ZWafGxIRCwXhmj3TQnJn2euqylHRubEQP/aL53NZK0kBdvrKgf f6O8Of6tqoss8Dkk55I7QVFSp+My1Dn+mngQKFejTAgtyo/WmR3wPjQ9HoT2lRiY I2lTRYT4uMdHuwVC3b4DqAKmoy375FERwHkrMVyKBJslv8QtbAWw5A1CAUseaHo+ 91wmYJ4/4p6YUahqbG/tZyhbxfq0KFN1U0UgUGFja2FnZSBTaWduaW5nIEtleSA8 YnVpbGRAc3VzZS5kZT6IXAQTEQIAHAUCOe70gQUJA8JnAAQLCgMEAxUDAgMWAgEC F4AACgkQqE7a6JyACspfLACffAYA+NM8NBhyRyH+nTX58CNjwLIAoIx9fj52BJe0 xY7WbKoXs1+72b2AiEYEEBECAAYFAjpwXlIACgkQnkDjEAAKq6TczgCgi+ddhWb7 +FWcfeE6WwPZccqAHowAnjjtRyGwHLQHr5OTFAYTXi2Wv6jNiQEVAwUQOnBgb3ey 5gA9JdPZAQE1pwf/QJ+b34lFBNVUJ7fk/xGJJREt7V12iSafaRzGuH8xWvIz1bb+ VARxnnt16FDQ1cDNjoEhCEmcW83Vxp6iJXE9PE8wVA/Yue/bon5JS7J69+UiQ2eq 2pudfwljp52lYVM53jgPYEz0q/v3091nlZ8CYkAkN9JDS1lV1gEzJ7J0+POngDpU +lDQT2EC6VKaxeWK8pNt6UFDwICRDQxKnlOoiDvTrdWT7QdJZ4sPv8Qotdw9+tKN bWQ2DqdIRxyTdw9xDfAtcj6mXeQr7852Lwem1gSKVnEYHZ9g1FTJqVOutY8KhpUc 9RfOCRv8XuIxrs4KSbfSF0s8qIRCQelxufg9AbkCDQQ57vSSEAgAhJHQTejMX+Vr 6g1pHDEcusJ63fQ2CfFFE5iE9okH9O7UVCiSfb9CV38dmeHdPCEEjDUWquFYEnvj 3WICMtH249t1Ymuf4Du3yRKQ9oXdn/qTJzlrx9qzjiG3mH7ocwHOgUIwCrZoEdBE VE2n0zPVm+hddwjWWTWXw6pxQz+i9dsN89xexRV5M9O0bNwCLaNWX2GXeLAkqTK/ 9EuZy6x2yLxi6du9YYUAXkZpqBhCjtiUXpRoFCdglMznbcAyCk9C2wqb2j/D1Z2B eSBaGCSFkR6pRLebnE17LWcu72Iy+r0z+JecbPiyDpDZj4apn7IC81aNFGi7fNIT sHODbwwjiwADBgf/YPvVdzkc8OC7ztacEWCanwylKvxCdKzTDA+DfES6WUYShyiV JvZzRy25LJ5WcK20kzOS6Qv1OrIXiz/pdGy1aKtJZrAnFEsofpmOj8VoqyyFgp/y AGQBp12+mXek7SCZRhuqalDfEMRiWEJ6J5dLkyShyRDWyPbFh0HXE7QTHN+IKKxx QqNQXL6Z3NSxS61p+5n6BseiDUI39xxkKTFwFrkgUIc5Gs2Or2lhaWvGwSfoCmwb sklszZt6xbU+R0SjFqTvjPWx6eHfqbmNC9WMDdTjGrXDDKXFp2aYlokfN6It9vsb VlGNlOwHt/JjGoPMxW6Xqj0FLA7/VewgCdXW64hMBBgRAgAMBQI57vSSBQkDwmcA AAoJEKhO2uicgArKSyIAmwUHf/vtKQfcmVg4asR7U6XQl0bAAJ4pO22B5U8UH6IY l2LBCXFqw5+5fA== =Jnnf - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBO5N83Xey5gA9JdPZAQGL3wf/Y9JWafwyYG1XUd5Li95aLdQ4zGDn2DbO o4iJonbvJd5ASsm0bkLIYCfoylkQh/Tc1VxXberIwUSf3NnJ/65kU+Lzn4jvTpMB PZm2QnK9VXukXbvibgamrbiDfSlySfoPD/jJWzTUnugJwZhLDIx3ZL0T9pHvUWOz i4VoK2o70z0dzKKb1YGRZQIaBCZHLm17yWMavEXewHCFJNMYfGT7s/ZajA7FFMXS gFzm7cE+RnykKeMG2Vf53/igoDFrHCiPr8wXEbJu5mbANH9MmGKIpQYdROwKodyk gAFUjXko2fdtkG5HFhlQWXvrHH/ZmZXzWWbp5g5DQ+Uqr3jW6t328A== =AmuR -----END PGP SIGNATURE----- -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~

1 0

Re: [suse-security] ssh-incompatibility ?
by michael.ryan＠storm.ie 03 Sep '01

03 Sep '01

Install the OpenSSH rpm on the client and use it to connect to the server (afaik the SSH and OpenSSH versions are not compatible) Regards, Michael

1 0

personal firewall and netdate
by Brian Galbraith 03 Sep '01

03 Sep '01

Hi folks I don't know a lot about firewalls so please be gentle! I run the personal fire wall which meets my requirements admirably. However if I wish to set my system clock using netdate.....currently I turn the fire wall off ...log in....set the time...log off, switch on the firewall,and redial. Is there any way to change the personal fire wall to allow connection to the ntp server....and if so....what values do I change? TIA Brian -- Brian Galbraith | GnuPG 1.0.6 | SuSE Linux 7.2-2.4.9 PGP Key 0x8232434C http://www.culcreuch.org.uk ICQ# 110426381 Yahoo Messenger ID: bagalbraith

2 1

AW: [suse-security] automatic backups over ssh/scp
by My PC, Payreder Roman 03 Sep '01

03 Sep '01

Hi, Perhaps you could have a look at: http://freshmeat.net/projects/rsync-backup/ br, Roman * teo(a)gecadsoftware.com wrote on Sat, Sep 01, 2001 at 18:43 +0300: > > The permissions are important, too, imagine a world-writeable > > ~/.ssh or a not world-readble ~/public_html. > > but this is easily achived with --archive option. > as I understand it, the issue is when restoring from backups, > and given that that's a root task, I see no problems with it. Yep, that's it. root task on both sides! > when you backup with rsync, use -a to preserve ownership and > rights, recreate links BTW, I get often errors when rsync tries to create symlinks: file already exists... oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

AW: [suse-security] rsync and automatics backups over ssh
by Reckhard, Tobias 03 Sep '01

03 Sep '01

> i am thinking for using rsync over ssh. > but i have a problem, the sys ask me for writting the ssh password. > there is any method using rsync and ssh for sending the password whitout > writte it? my plan is to use rsync over ssh in a cron. > I use public key authentication with a null passphrase for the private key on the client machine. Tobias

1 0

AW: [suse-security] ucd-snmpd default configuration
by Reckhard, Tobias 03 Sep '01

03 Sep '01

> SNMP is not only read but write typically. Community strings are often > easy > to guess, easier to sniff (cleartext). I suggest _heavilly_ firewalling > snmp > and maybe using ssh port forwarding or ipsec to encrypt it. > SSH won't help, as it can only perform port forwarding of TCP ports, AFAIK, while SNMP uses UDP only. I suggest a physically separate LAN or IPSec for SNMP (and syslog, BTW). And you should configure your SNMP server as tightly as possible. Make snmpwalk show only what it needs to. Cheers Tobias

1 0

ucd-snmpd default configuration
by Steffen Dettmer 02 Sep '01

02 Sep '01

Hi, I played around with MRTG which worked out-of-the-box. I just started rcsnmpd on the hosts and adjusted the firewalls to allow UDP:161 for the "monitor" host. Now the hosts run snmpd without configuration (at least it looks that there is no configuration file). I just started snmpd. Now I want to hear some statement about the risks. Since SNMP is very powerful, I fear that I opened some security leaks. OK, the firewalls are restrictive but I could sleep better if I could be sure that the default config garantes "read-only" accesses only. Second, snmpwalk reports really much things, but for MRTG I need the interface stats only. I looked for some example configuration files but they are complex to understand. Any sugesstions? Since I run SNMP now, I think about useing the check_snmp plugin with netsaint. I could imagine to check via snmp if i.e. the process "ypbind" is still running and so on. Is this secure? Or should I better not doing this? I would be glad if I could find anyone who uses check_snmp for more that checking snmpd itself. We could discuss this is little, but maybe this list is OT for that particular issue. I'm looking forward to any statements, thank you. oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.

2 2

once again FreeS/WAN tunnel established, no data transferred
by Stefan_Walther＠gehag-dsk.de 01 Sep '01

01 Sep '01

Hi folks, I recognize a problem at my side. You meant "strange routing". Now I see what you mean. The IP's of the first GW on eth0 must be 192.168.200.1 and the IP on the eth1 of the second GW must be 192.168.100.1. Now I see my fault. The IP's on the boxes where set this way I told to you in the sentence before. By the way, I have a look at /var/log/messages and saw the message IPSec SA established and tcpdump tells me that there are UDP:500-->500 packets are going through the router (ip-proto-50). MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 ----- Forwarded by Stefan Walther/GEHAG DSK GmbH on 01.09.2001 16:41 ----- >hi folks, >I have the following problem. I have an established IPSec-tunnel between 2 boxes. >I'm using SuSE7.1 and FreeS/WAN 1.91. The FreeS/WAN tells me that the tunnel is established (last message in /var/log/messages). >My configuration is the following: >1st client-----1st-FreeS/WAN-gateway----ROUTER----2nd-FreeS/WAN-gateway------2nd-client > eth0--------------eth0------eth1----eth1-eth0----eth0--------eth1------eth0 >!Every box is a linux box! >The 1st client has the following config: RedHat7.1, IP: 192.168.200.2 >The 1st FreeS/WAN-gateway config is: SuSE 7.1, kernel 2.4.7, eth0: 192.168.100.1, eth1: 172.16.100.1, IP-forwarding without masquerading >The Router has the following config: SuSE7.1, kernel 2.4.7, eth1: 172.16.100.2, eth0 10.16.100.2, IP-forwarding without masquerading >The 2nd FreeS/WAN-gateway config is: SuSE7.1, kernel 2.4.7, eth0: 10.16.100.1, eth1: 192.168.200.1, IP-forwarding without masquerading >The 2nd client has the following config: Windows2000, eth (seems to be a littlebit stupid): 192.168.100.2 >Every netmask is 255.255.255.0; >If i start ipsec via, ipsec start at the shell, no error (exept the IPv6-bind error) occured. >Before starting IPSec the routes, the the clients can pinging each other are set by hand. FreeS/WAN sets the routes to the ipsec0 interface. >After starting you cannot ping anymore from the 1st client to the 2nd client ans the other way around. Does anybody know a solution for this problem??? >THX MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

1 0