September 2001 - openSUSE Security - openSUSE Mailing Lists

fw on CD
by kaldewey frank 14 Sep '01

14 Sep '01

Hallo :) has anyboddy work with the suse fw on CD What tell profis about? Thanx Frank

3 2

Configuration Problems with syslog
by Guido Tschakert 14 Sep '01

14 Sep '01

Hello list, I'm building a firewall-system with cisco-routers and a linux-box. All logging of the machines should be send via syslog to a log-box. For each machine I want a separate logfile. In cisco-ios I can say: logging facility local0 logging log-box, which tells the router to send all logging to log-box using facility local0. And tell the syslog on the log-box: facility local0 should be dumped in /var/log/router1 But I don't see any chance to change the facility of ipchains. It has the facility kern so that the logging of the firewall-linux-box is mixed together with the local logging of the log-box. Is there any change to configure syslog or ipchains to have two separate logfiles for the firewall-box and the log-box on the log-box. THX Guido -- ----------------- Guido Tschakert SRC, SysAd -----------------

3 2

AW: [suse-security] SuSE is not logging anymore..
by Hirsch Wolfgang 14 Sep '01

14 Sep '01

try to restart syslogd with kill -HUP pid Wolfgang -----Ursprüngliche Nachricht----- Von: spiekey [mailto:spiekey@hotmail.com] Gesendet: Freitag, 14. September 2001 13:13 An: suse-security(a)suse.com Betreff: [suse-security] SuSE is not logging anymore.. Hello! what could be the reason that suse won´t write into my /var/log/messages anymore? The last activity was from the 11th of September. Anyone any idea? Thank you, Spiekey

1 0

SuSE stopps logging!
by spiekey 14 Sep '01

14 Sep '01

Hello! My SuSE box stopps logging the /var/log/messages since the Sep. 11th. -rw-r----- 1 root root 530468 Sep 11 11:44 messages -rw------- 1 root root 12 Sep 14 10:04 messages.offset what is the message.offset good for? # less messages.offset 10817 530468 #--> that is exactly the size of my messages file. I am a bit worried. Spiekey

3 3

malicious IDE bit-zeroing worm ?
by dove 14 Sep '01

14 Sep '01

hi, vi, without an apparent reason, began to segfault on us. rpm -Vf `which vi` showed that the md5sum was incorrect. The timestamp on the file was unchanged. The substance of the problem is that two bytes in the vi binary have spontaneously become zero's. These bytes do not have a significant effect on the code, but do make it stop working: $ diff -u vi.hex vi.oops.hex --- vi.hex Thu Sep 13 08:58:03 2001 +++ vi.oops.hex Thu Sep 13 08:57:56 2001 @@ -9981,7 +9981,7 @@ 26fc0 88 c2 89 95 50 ff ff ff 83 c4 f8 6a 64 a1 3c ca .Â..Pÿÿÿ .Äøjd¡<Ê 26fd0 0d 08 50 e8 28 cf 01 00 83 c4 10 85 c0 0f 95 c0 ..Pè(Ï.. .Ä..À..À 26fe0 31 d2 88 c2 89 95 4c ff ff ff 83 c4 f8 6a 78 a1 1Ò.Â..Lÿ ÿÿ.Äøjx¡ -26ff0 3c ca 0d 08 50 e8 06 cf 01 00 83 c4 10 85 c0 0f <Ê..Pè.Ï ...Ä..À. +26ff0 3c ca 0d 08 50 e8 06 cf 01 00 83 c4 10 85 00 00 <Ê..Pè.Ï ...Ä.... 27000 95 c0 31 d2 88 c2 89 95 48 ff ff ff a1 60 5c 0d .À1Ò.Â.. Hÿÿÿ¡`\. 27010 08 c7 05 a0 57 0d 08 00 00 00 00 83 78 50 00 75 .Ç. W... ....xP.u 27020 43 83 7d 9c 00 75 3d 83 7d 98 00 75 37 83 c4 f8 C.}..u=. }..u7.Äø This machine is running kernel 2.4.4 and reiserfs. The disk is a 20G ST320413A IDE disk (PIIX4 chipset revision 1). interesting problem : could be a file system error in reiserfs but then how did it write to the binary ? and only the one ? wich means it could be a security problem ? obvious things eg. tripwire, snort, other binaries, -- checked, no obvious signs of compromise. running no services with known holes. thanks, doVe

2 1

Re: [suse-security] SuSE stopps logging!
by Markus Gaugusch 14 Sep '01

14 Sep '01

> yes, i am using logcheck, is that bad? no, that's great :) it's perfectly normal to have those .offset files. > # ps uax |grep syslog > root 355 0.0 0.4 1340 588 ? S 09:46 0:00 /sbin/syslogd > root 1310 0.0 0.4 1532 548 pts/1 S 10:52 0:00 grep syslog this is ok. if you still get no logging, restart syslogd rcsyslog restart (or rcsyslogd restart?) Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

1 0

firewall2 ICMP MASQ?
by Anthony Hogbin 13 Sep '01

13 Sep '01

Hello All Same issue, different person - no resolution as yet. Firewall2 - on SuSE 7.1 kernel 2.4.x LAN is masqueraded. DMZ is real IP External IP is real IP ISSUE: Masqueraded LAN is 192.168.x.x - it can ping the DMZ machines, and the firewall (with all ping settings set to "yes" - however is unable to ping machines out in the real world. Surely since the local IP's are masqueraded - they go out with it's IP address, and are routable? The firewall is set to full logging - yet the it says quite happily FW-ACCEPT-PING and passes it from LAN NIC to world facing NIC. ALLOW_PING is set to yes for FW DMZ and EXT while I am testing. Looking at the tcpdump from the external NIC I can see that it is trying to ping from 192 address. How on earth do I get it to Masquerade the ping? If I restrict what services they have - then I cannot ping. If I masq with simply 192.168.0.0/24 it works.... and it will not allow me to do 192.168.0.0/24,icmp *ARGH* Can someone put me out of my misery? -----Original Message----- From: semat [mailto:semat@wawa.eahd.or.ug] Sent: 17 July 2001 10:41 To: maillist Cc: suse-security(a)suse.com Subject: Re: [suse-security] Suse firewall script question > network. But no request gets an answer. Are you using private address space or public space? if it is private then you have to turn on masquerading for the internal network. However if your network is using public ip addresses, then it is ok. However in both cases you should turn on ip forwarding if the two networks are on different interfaces on your machine. This can be done by editing /etc/rc.config and setting ip_forward=yes or in the firewall preferably both. Or you can do it manually whenever you need to with echo 1> /proc/sys/net/ipv4/ip_forward and tunr it off with echo 0> /proc/sys/net/ipv4/ip_forward Noah. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com __________________________________________________ A n t h o n y H o g b i n www.zerosandones.co.uk lynx -source http://www.zerosandones.co.uk/anthony.pgp | pgp -fka

1 0

RE: [suse-security] reverse Proxy [was: http proxy]
by Scharpff＠tembit.de 13 Sep '01

13 Sep '01

mmh ... Maybe this is realy a missunderstandig. What I`m searching is a pice of Software that I can publish my HTTP-Servers in my DMZ to the world. AND I would like to do things like: www.Name.de/sub1/ -> box2.internal/sub_main/sub www.Name.de/sub2/ -> box3.internal/something_else/sub www.Name.de/sub1/sub2 -> box2.internal/sub_main/sub3 We have one external IP, but have very different boxes for the diffrent parts of our Web-Service. Like box2 runs NT, box3 runs Solaris. As far as I know Squid does only a Proxy the other way round. Maybe I can do this even with a kind of redirecting, therefor we mostly have generated JPEG's, they woun't be cached anyway. Franziskus > -----Original Message----- > From: Kurt Seifried [mailto:listuser@seifried.org] > Sent: Donnerstag, 13. September 2001 10:43 > To: Franziskus Scharpff; suse-security(a)suse.com > Subject: Re: [suse-security] reverse Proxy [was: http proxy] > > > > Hello, > > > > might be off topic, but I'm searching for a reliable > Reverse-Proxy for Our > > Web-Servers. > > A more correct term is HTTP accelerator (couldn't figure out > your email > initially =). > > > As far as I know does Apache do the Job, but only for HTTP 1.0. > > Are there any other Solutions ? > > Or is the mod_proxy meanwhile updated ? > > Squid will pass HTTP 1.1 headers, Apache too. mod_proxy is > updated in 1.2. > > > Any Security-Hole's ? > > Yup. Misconfiguration is easy. I may be able to use your > proxy to attack > your internal network for example. Or anonymize my web > surfing. If you do it > be very restrictive and use firewalling on the accelerator machine to > enforce what it should do (i.e. only talk to port 80 on internal www > server). > > > Thank you for your help. > > > > Franziskus > > Kurt Seifried, kurt(a)seifried.org > PGP Key ID: 0xAD56E574 Fingerprint: > A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 > http://www.seifried.org/ > >

4 3

reverse Proxy [was: http proxy]
by Scharpff＠tembit.de 13 Sep '01

13 Sep '01

Hello, might be off topic, but I'm searching for a reliable Reverse-Proxy for Our Web-Servers. As far as I know does Apache do the Job, but only for HTTP 1.0. Are there any other Solutions ? Or is the mod_proxy meanwhile updated ? Any Security-Hole's ? Thank you for your help. Franziskus > -----Original Message----- > From: Kurt Seifried [mailto:listuser@seifried.org] > Sent: Donnerstag, 13. September 2001 08:41 > To: suse-security(a)suse.com > Subject: [suse-security] re: http proxy > > > How is it a resource hog? You can tune it to be as > lightweight or heavy as > you want (personally I let it have 256 megs of ram and a gig > of drive space > and it's my personal proxy). > > P.S.: use freaking text mail. > > Kurt Seifried, kurt(a)seifried.org > PGP Key ID: 0xAD56E574 Fingerprint: > A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 > http://www.seifried.org/ > > > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

2 1

re: http proxy
by Kurt Seifried 13 Sep '01

13 Sep '01

How is it a resource hog? You can tune it to be as lightweight or heavy as you want (personally I let it have 256 megs of ram and a gig of drive space and it's my personal proxy). P.S.: use freaking text mail. Kurt Seifried, kurt(a)seifried.org PGP Key ID: 0xAD56E574 Fingerprint: A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://www.seifried.org/

1 0